diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index af8e12f056c2..ec145d9cd9b4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14957,6 +14957,12 @@
     githubId = 92527083;
     name = "Morten Munk";
   };
+  morxemplum = {
+    email = "morxemplum@outlook.com";
+    github = "Morxemplum";
+    githubId = 44561540;
+    name = "Synth Morxemplum";
+  };
   MostAwesomeDude = {
     email = "cds@corbinsimpson.com";
     github = "MostAwesomeDude";
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index eba8ba03e949..2bb79c3f5d76 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -226,7 +226,7 @@ in
         (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for
         both an IPv4 and an IPv6 address before forking.
         The option "if-carrier-up" is equivalent to "any" if either ethernet
-        is plugged nor WiFi is powered, and to "background" otherwise.
+        is plugged or WiFi is powered, and to "background" otherwise.
       '';
     };
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index b687e910b4b7..29f084a35e29 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -787,27 +787,27 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "134.0.6998.165",
+    "version": "135.0.7049.52",
     "deps": {
       "depot_tools": {
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "gn": {
-        "rev": "ed1abc107815210dc66ec439542bee2f6cbabc00",
-        "hash": "sha256-EqbwCLkseND1v3UqM+49N7GuoXJ3PlJjWOes4OijQ3U="
+        "rev": "4a8016dc391553fa1644c0740cc04eaac844121e",
+        "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
       },
       "ungoogled-patches": {
-        "rev": "134.0.6998.165-1",
-        "hash": "sha256-Uia8tI3ZpryD+YVV9duH6sAmB/gKvsFg9RZVKYo/HX0="
+        "rev": "135.0.7049.52-1",
+        "hash": "sha256-i7fSJsbuXgzDvh/4RJwHvVEalS134SoRzvcJZbYsIIo="
       },
-      "npmHash": "sha256-oVoTruhxTymYiGkELd2Oa1wOfjGLtChQZozP4GzOO1A="
+      "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "fd886e2cb29dd984c13deec032832dee68d8abe3",
-        "hash": "sha256-xD06hGSrccTGB6fUGw0b7RrGNBQjNmdGKPaRqhXVVOY=",
+        "rev": "9ba7e609d28c509a8ce9265c2247065d8d251173",
+        "hash": "sha256-PjvfckdlaMq9HWefGxFppgBumlqh7xoCoxYFwk/r630=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -817,23 +817,23 @@
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
-        "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U="
+        "rev": "7f8b68f91ca8b192375f5e71cd81fb3ed9650ef3",
+        "hash": "sha256-1P+p5MPXm0WkeYgzIxG2SBKZVPWplUlEo7xYI//Y0uw="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "634228a732a1d9ae1a6d459556e8fc58707cf961",
-        "hash": "sha256-ln/DCNYJXVksbwdDBnxCfc4VwtjQlJXF7ktl/NxLupg="
+        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
+        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
-        "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY="
+        "rev": "62e217a12ee1133833d9890b2f7adde900e4efbd",
+        "hash": "sha256-FBMrvCCVwm0mmaQHDvKXljxxLwthpsFqhPE8yqBx5Aw="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "6d0c8ee02e2fd44e69ac30e721e13be463035ee5",
-        "hash": "sha256-bF4hV9fY0GLYAHUnxSXkCxdZLMKR3wYWaqYJaM9aQiE="
+        "rev": "a02de4d0d992b110c8b180fdec91258e7b60265f",
+        "hash": "sha256-LtxaimMmnman7BKLKpSR8rJtbEvHsmGVeHvzEukB4EY="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -852,8 +852,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "600fc3a0b121d5007b4bb97b001e756625e6d418",
-        "hash": "sha256-f3Tdz0ykxQ2FHbNweJwPdAZHA8eVpjPuxqRpxwhYtRM="
+        "rev": "441c86221443f48e818335d51f84cf1880c35aa4",
+        "hash": "sha256-nMLn2wTAr+3U1VpqWWq93zJHrlT+f1Yky8ONKk0kWjg="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -862,8 +862,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "e7d001c82ee5bead5140481671828d5e156a525a",
-        "hash": "sha256-5YFqWgkyQ/PUKTkk1j3mAFD8JMbI+E4XRdSq34HFMWA="
+        "rev": "25a56e315359eaebb2ff4213771016a4978a346d",
+        "hash": "sha256-ZkrAaNgCqG09CufQN35wFi09TVxvbf/U4jGNNMRLY0M="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -877,13 +877,13 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "914c97c116e09ef01a99fbbbe9cd28cda56552c7",
-        "hash": "sha256-Y4eX8YHwVXiXW4U8KGbFd4fTU/v/EAUpfwv6lB127Y4="
+        "rev": "079266db445215380befce453b1ab3bbdfeaf73d",
+        "hash": "sha256-Bcm9wxlLqp/ANg+cPvsuwAlaxVmef6g+12L5ZE4uCGA="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
-        "rev": "cb550a25c75a99ae0def91a02e16ae29d73e6d1e",
-        "hash": "sha256-kqBpWHCxUl1ekmrbdPn6cL2y75nK4FxECJ5mo83Zgf4="
+        "rev": "6edcf02205fd1e8979dc3f3964257a81959b80c8",
+        "hash": "sha256-VebUALLFKwEa4+oE+jF8mBSzhJd6aflphPmcK1Em8bw="
       },
       "src/third_party/angle/third_party/rapidjson/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson",
@@ -892,8 +892,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "48e7f3020f52ef9adc31aa0f5db01dc42cc487cd",
-        "hash": "sha256-g59uC7feByGR1Ema8LqUCr5XWKpDMeXXvlS2thOo5Ks="
+        "rev": "ba86fb95004331f2cf571dd9adefe2458290ee11",
+        "hash": "sha256-wl/T/WxVNctM4m4VSFFqqtJ0xkEBiuILYywAylqa0Oo="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -907,13 +907,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "42b2b24fb8819f1ed3643aa9cf2a62f03868e3aa",
-        "hash": "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g="
+        "rev": "7d4b789f55389dad1820d6caf6a650038dad06e2",
+        "hash": "sha256-O6WOm6qTSgRmDR+yY2wH6t+7ob+TtZIA5Gax1ysEZh0="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7056f50fdefc6bc46aa442e720d0336e2855b570",
-        "hash": "sha256-aYlcplXSGjFov9dqql6d+a1PxJWtZJNQaaezof0u9QQ="
+        "rev": "bdc68b25b620d7302a955e2c38c548ebfe74ef31",
+        "hash": "sha256-R9SQiKUjLkLmPJwuWpw7fcibrWxSlXWkDsCra7Ci0UQ="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -922,8 +922,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "c2ed9ad4ee775f3de903ce757c994aecc59a5306",
-        "hash": "sha256-jecGwARtdSr2OEC68749mpFUAHuYP/IzYUZyj23CwJE="
+        "rev": "0a1143572d107c8b6980df092b84a79190ec1fbd",
+        "hash": "sha256-sUSQTOi0EuIHX9h27RXb5HnbcdfkG/U1K6EbBdjSto8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -942,8 +942,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "24d5dfa7725d6ece31941c3f3343ba6362986d6b",
-        "hash": "sha256-AEGYE2rSsPcRzJSm97DGsrPVbhCH+lyVI61Z4qavKc8="
+        "rev": "ce91fc1d085136f9c7ddca684d1764689d49b337",
+        "hash": "sha256-SsxohjLb+uoN5cMXU5DJDrtF1QVk8EWK/qvTLxCleUI="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -957,8 +957,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "ea42fe28775844ec8fe0444fc421398be42d51fe",
-        "hash": "sha256-g9i5v11uZy/3Smn8zSCFmC27Gdp5VP2b0ROrj+VmP1k="
+        "rev": "673e61fc215b178a90c0e67858bbf162c8158993",
+        "hash": "sha256-8Dl6Aol33o2FYID3oIw9grB0jY9VJnnnhmiNdyycTlU="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -967,13 +967,13 @@
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
-        "rev": "fbc5e98031e1271a0a566fcd4d9092b2d3275d05",
-        "hash": "sha256-o5/Lbhh6HHSWCVCEyDwDCgs+PLm67si981w0HuIWY7c="
+        "rev": "dcb3d2e87cebe20b6dda06d8b29abb9af27ca422",
+        "hash": "sha256-e8+rQhEU5+FfwjyEE1TM6emO0cUntuS4GN7y/BuC/U8="
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "d5166861902b565df446e15181eba270fe168275",
-        "hash": "sha256-xkvz743+w0xsI0w4reAo2rfC4J7opl1biA3eNYuRn+o="
+        "rev": "93e56257a5089dc49f1dfd1240c527f5fe1b237f",
+        "hash": "sha256-K5sOlXx72YmXlm7cc7jWf3lKmHcMdVHTwVueJo5CoHY="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -982,8 +982,8 @@
       },
       "src/third_party/chromium-variations": {
         "url": "https://chromium.googlesource.com/chromium-variations.git",
-        "rev": "84c18c7a0205fbd0a27b0214b16ded7fc44dc062",
-        "hash": "sha256-zXAmoKyj104BaIe4Rug18WbVKkyAsyWPCTPPEerinVo="
+        "rev": "270a25f8795caf0a798ebf5a7d69284e3d830d19",
+        "hash": "sha256-ZkETD+Pka5vItN70nhlGQelycFAEnb1Qfv9k2aDXZSE="
       },
       "src/third_party/cld_3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git",
@@ -1002,8 +1002,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "8a1772a0c5c447df2d18edf33ec4603a8c9c04a6",
-        "hash": "sha256-dKmZ5YXLhvVdxaJ4PefR+SWlh+MTFHNxOMeM6Vj7Gvo="
+        "rev": "aaac07ee499895770c89163ce0920ef8bb41ed23",
+        "hash": "sha256-A86nAbKs7trVwwa1HFUNbV//6O1minvlHTpZR3vabrU="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1012,23 +1012,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "ea21b22629965105426f3df5e58190513e95a17e",
-        "hash": "sha256-xUaGf4MaEXg2RHgrGS1Uuz97vq5Vbt4HFV/AXYB4lCA="
+        "rev": "b8d797a61689892adb182c9bec457c9bd24b26d2",
+        "hash": "sha256-44bD1nG7CRrvBcd9NbU4yksn7Ly9WYsWETXat/L3f0I="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "0391f0d11cbf3cf3c5bcf82e19e9d9839b1936ed",
-        "hash": "sha256-EL+lOTe1Vzg4JW2q7t3UoXzHHiEmLjf7khH9fXdplbo="
+        "rev": "bf8d1d3aaf469343576db89f81df26aeb16bd62b",
+        "hash": "sha256-XscXxoCUSVGsBCB8xymEsaLc4WgzZPXu6zkRbv8ZQZw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "65b3f414b81ffe4df49202af6fc75bc26a3cb109",
-        "hash": "sha256-rdBpJWdQ5VtFnIfbr/Vq1q1euSvkbY8iIqyuTMAS2KM="
+        "rev": "ad4e2fc82183b1463ac870818c28680bbc3de889",
+        "hash": "sha256-HS5O+r0GFe3Dfh+86JQlsEC+5Gcs1xmUkDyZ7qixqXw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1037,8 +1037,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2a35a917be47766a895be610bedd66006980b7e6",
-        "hash": "sha256-WG7uiduuMnXrvEpXJNGksrYkBsim+l7eiu5N+mx0Yr0="
+        "rev": "4c38131a16803130b66266a912029504f2cf23cd",
+        "hash": "sha256-dOq8RJ/V8kulSMK0OUWzHruiwJSP3f/86ih5gk2MMWQ="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1052,8 +1052,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
-        "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ="
+        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
+        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1080,15 +1080,10 @@
         "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
         "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA="
       },
-      "src/third_party/grpc/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git",
-        "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
-        "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg="
-      },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b1f47850878d232eea372ab167e760ccac4c4e32",
-        "hash": "sha256-YxWz3O9see1dktqZnC551V12yU5jcOERTB1Hn1lwUNM="
+        "rev": "5d4e649f740c675426fbe4cdaffc53ee2a4cb954",
+        "hash": "sha256-DxLHuzIvw7WIKKMCRBz4ne97j9DufoohXQZV6yZ5zfY="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1102,8 +1097,8 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "6d8035a99c279e32183ad063f0de201ef1b2f05c",
-        "hash": "sha256-isQvwaVdL4cM465A8Gs06VioAu8RvZFrwXDsXhfOoFo="
+        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
+        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1137,8 +1132,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "e235eb34c6c4fed790ccdad4b16394301360dcd4",
-        "hash": "sha256-jpXIcz5Uy6fDEvxTq8rTFx/M+0+SQ6TCDaqnp7nMtng="
+        "rev": "24a9e940d481f992ba852599c78bb2217362847b",
+        "hash": "sha256-oLknxClUh7l72ZAx7sxNDM6dUhMT0vUE2IdDjRLDKtk="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1167,8 +1162,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "44ac6c2594a880edbb9cb1e4e197c2b53d078130",
-        "hash": "sha256-AKXKxXqOMUb3APf5r15NmIMyhJ4ZmW5+t7y5XdgdZkw="
+        "rev": "a32ca113e3b050693e4bb379525dfae519ebd0d9",
+        "hash": "sha256-eoV+g/QVzcI7PqDmAic5Ra9K/ba4IV1wXE4RFecuMuk="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1182,18 +1177,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "3990233fc06a35944d6d33797e63931802122a95",
-        "hash": "sha256-4NOQug0MlWZ18527V3IDuGcxGEJ4b+mZZbdzugWoBgQ="
+        "rev": "99fcd816eeaa7da46688bc4b9f4f9e71be13c2e8",
+        "hash": "sha256-SOIvGkR3k7TAs9KFA3mFbBSq5h4eJghKo38IVioOK3U="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c5938b119ef52f9ff628436c1e66c9a5322ece83",
-        "hash": "sha256-+6339vcd0KJj5V11dvJvs0YpQpTxsLmDuBoYVzyn9Ec="
+        "rev": "a75457c637a365910508f3c2c2b986a701b03a2e",
+        "hash": "sha256-v3+Rj3jS/lCYZNjjAXB6zohdvM45PKayB43jX37ntsU="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "97690c6996f683a6f3e07d75fc4557958c55ac7b",
-        "hash": "sha256-d1D9/6d7a1+27nD8VijhzRMglE2PqvAMK8+GbMeesSQ="
+        "rev": "45d6317a64aad3d5060b800db267f7cea3f27198",
+        "hash": "sha256-SmU+c9YveQ4N13bteuhtmo0uvySeCnmZYpC5NYiMJuo="
       },
       "src/third_party/beto-core/src": {
         "url": "https://beto-core.googlesource.com/beto-core.git",
@@ -1210,21 +1205,26 @@
         "rev": "d6b5ffea959ad31e231c203d7446bf8b39e987ce",
         "hash": "sha256-lCwGk4Q+OXwO8vOlOQrkgygYqLrwpku/PkR03oEdX3Y="
       },
+      "src/third_party/speedometer/v3.1": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "cc9ee085ae18f05961ff3dfa1ee1a90d67b7f8ee",
+        "hash": "sha256-28vGPZLaD9xSwursTRRK1xndedeBUZ5TF/4hdy0RjFc="
+      },
       "src/third_party/speedometer/v3.0": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
         "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU="
       },
-      "src/third_party/speedometer/v2.0": {
-        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
-        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
-      },
       "src/third_party/speedometer/v2.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8bf7946e39e47c875c00767177197aea5727e84a",
         "hash": "sha256-0z5tZlz32fYh9I1ALqfLm2WWO8HiRBwt0hcmgKQhaeM="
       },
+      "src/third_party/speedometer/v2.0": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
+        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
+      },
       "src/third_party/ukey2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git",
         "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
@@ -1232,8 +1232,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "1f1c782f06956a2deb5d33f09c466e4852099c71",
-        "hash": "sha256-80WqSMP5Vlc4OY+gfpU3SRGavs7fJbTQVW1AIhq6jmE="
+        "rev": "97dc8c7a1df880206cc54d9913a7e9d73677072a",
+        "hash": "sha256-CT9c4LqTwhldsxoEny8MesULwQC4k95F4tfCtRZErGM="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1267,8 +1267,8 @@
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
-        "rev": "a304ec48dcf15d942607032151f7e9ee504b5dcf",
-        "hash": "sha256-ZyPweW+V5foxFQwjjMLkaRUo+FNV+kEDGIH/4oRV614="
+        "rev": "7bf98f78a30b067e22420ff699348f084f802e12",
+        "hash": "sha256-EaEC6R7SzqLw4QjEcWXFXhZc84lNBp6RSa9izjGnWKE="
       },
       "src/third_party/libsrtp": {
         "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git",
@@ -1287,8 +1287,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "7b3fa8114cf8ef23cbf91e50c368c1ca768d95d5",
-        "hash": "sha256-2FgBb0HzgMihGsWbEtQqyN2EXZs/y5+ToWL1ZXG35W0="
+        "rev": "2bfb9f9e0a9cca18cd5a0045e931b49dac390c79",
+        "hash": "sha256-BWid6iU7CDEElh8j13a+S767vwnO8qQg26Vp5nQGEHc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1302,8 +1302,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "5a9a6ea936085310f3b9fbd4a774868e6a984ec4",
-        "hash": "sha256-E5ePVHrEXMM8mS1qaUwPTqYO0BdP7TYuUhfX+BCiq/0="
+        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
+        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1332,18 +1332,18 @@
       },
       "src/third_party/openh264/src": {
         "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264",
-        "rev": "33f7f48613258446decb33b3575fc0a3c9ed14e3",
-        "hash": "sha256-lZlZjX8GCJOc77VJ9i1fSWn63pfVOEcwwlzh0UpIgy4="
+        "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+        "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg="
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "38d1445b41d1eb597fcd100688dbaff98aa072ed",
-        "hash": "sha256-KGVFyGp7ItKeapub3Bd+htXH/gMaaBd+k8iC7hLtvl0="
+        "rev": "b756f3c04ba53983a94cd12eb29b7f22e472fd58",
+        "hash": "sha256-P6vAoVF1/geM6MjihcEBQtbf8CxE8sPSKTRLz8/c2yE="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
-        "rev": "56013b77b6c0a650d00bde40e750e7c3b7c6bc3d",
-        "hash": "sha256-Dz7wMYQHVR7sjCGaQe2nxIxZsAxsK6GGDNpDvypPefo="
+        "rev": "00459762409cb29cecf398a23cdb0cae918b7515",
+        "hash": "sha256-QXGJRGyyuN0EPDAF7CAzcTSbjHkz8FRjhqd1JEFF/1o="
       },
       "src/third_party/openscreen/src/third_party/tinycbor/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git",
@@ -1352,23 +1352,23 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "12f7715a6390050c5cffb7e4c9b2be1c2f2956d0",
-        "hash": "sha256-/u+HYjmxSIX2GlriEWYZQJ8TDFNfzSufATGq1j9zx9w="
+        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
+        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
-        "rev": "0d78d85c2bfb993ab8dd9a85b6fee6caa6a0f357",
-        "hash": "sha256-bjgSwq4LPz9qN9rVqIJUTHetRguCx67Uq5oe1ksPqGE="
+        "rev": "aa4d8267bafad6782a1f2c8d979104f2aaa622a0",
+        "hash": "sha256-smVQykQVZdhybEUz7BlRLc+FVNH0UyGh+0eSxP8Jzrc="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
-        "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
-        "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U="
+        "rev": "426b2e025aa59c23a1b6e19fbacd6b4a11bfad16",
+        "hash": "sha256-5uieIE6ygM4Ooz9xbu1NVKCHHsPn6Ekz6OzqfWiA7/M="
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "e1469417238e13eebaa001779fa031ed25c59def",
-        "hash": "sha256-cFRELaRtWspZaqtmdKmVPqM7HVskHlFMAny+Zv/Zflw="
+        "rev": "f94ab76fe99754960035d520dce28e15b647e8cf",
+        "hash": "sha256-NdKKMnXZ6rYOC2wA6a1bPNStxpemzGckN6PPWom6mFA="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1387,8 +1387,8 @@
       },
       "src/third_party/re2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/re2.git",
-        "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
-        "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc="
+        "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+        "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis="
       },
       "src/third_party/ruy/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git",
@@ -1397,13 +1397,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "6dc3b54b420e6e03a34ee7259fcd2b1978fac5f3",
-        "hash": "sha256-8RY3AU2V4iZKEmVwT7Z1Q3QlcTXDIdeyYwnQoyJcAUY="
+        "rev": "48ba13bfb5488755a5d72aa60ff4a47069be498f",
+        "hash": "sha256-//z0HlMOkGTcp1IjbS0m+0dmgVYsG7EkfCiK2vvG2wU="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "aefbd9403c1b3032ad4cd0281ef312ed262c7125",
-        "hash": "sha256-tP6DnMeOoVqfTSn6bYXMLiCb4wg5f9uB28KzYMAeBUw="
+        "rev": "b99f146a03d3c98049768fd91c2bbe6594b02b2c",
+        "hash": "sha256-tl1GDmcStkuKMmzzsYuRG6Nrk4xDqgYYBoa1VsQNOwY="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1422,8 +1422,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "86cf34f50cbe5a9f35da7eedad0f4d4127fb8342",
-        "hash": "sha256-PSkIU8zC+4AVcYu0vaYo6I1SSykrHgcgGVMBJanux8o="
+        "rev": "c12c13839d689f411911326b1f72e96eb525686c",
+        "hash": "sha256-C8y5ShwMffNZpFuILYNw3WOMVJp/jPen/wNbFl1vqBY="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1432,18 +1432,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "51c6eed226abcfeeb46864e837d01563cc5b907b",
-        "hash": "sha256-qXHENS/6NwHAr1/16eb079XzmwAnpLtVZuva8uGCf+8="
+        "rev": "d120e39920c0e61cc1227bc1abe50fd6ecd3ce66",
+        "hash": "sha256-9p0/tR3bPvCJn+6eofmQXKbyfzxfbeVexdvuHpn50wk="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "2e4b45a53a0e2e66bcb6540ae384c53a517218d0",
-        "hash": "sha256-9ebWETg/fsS4MYZg74XHs/Nz3nX6BXBNVRN2PmyWXWM="
+        "rev": "c1c31f4d17a9e4b2af40d85c89d573eb43187e0d",
+        "hash": "sha256-uEsy4PBhO3EBJF6YdWj32GmMabgKWQJUeW3cWInAinE="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "0549c7127c2fbab2904892c9d6ff491fa1e93751",
-        "hash": "sha256-LwspMo771iaV5YeEJWgdb8xi37KMa0rsSdvO3uqMOAI="
+        "rev": "8b822ee8ac2c3e52926820f46ad858532a895951",
+        "hash": "sha256-hPd5roeHOgMiz2VUx13bUsKKDSvgQAXRdk7wfdi6e48="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1452,38 +1452,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "e7294a8ebed84f8c5bd3686c68dbe12a4e65b644",
-        "hash": "sha256-/p7kBW7mwpG/Uz0goMM7L3zjpOMBzGiuN+0ZBEOpORo="
+        "rev": "54a521dd130ae1b2f38fef79b09515702d135bdd",
+        "hash": "sha256-PScDq8HhQPFUs78N75QyL9oEykmjZmAhdxCAqQ0LJds="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "ce37fd67f83cd1e8793b988d2e4126bbf72b19dd",
-        "hash": "sha256-SJcxmKdzOjg6lOJk/3m8qo7puvtci1YEU6dXKjthx0Q="
+        "rev": "f289d047f49fb60488301ec62bafab85573668cc",
+        "hash": "sha256-2Wv0dxVQ8NvuDRTcsXkH1GKmuA6lsIuwTl0j6kbTefo="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "39f924b810e561fd86b2558b6711ca68d4363f68",
-        "hash": "sha256-twJJVBfnZbH/8Wn273h45K3BOnlAicqL2zJl6OfLm2E="
+        "rev": "952f776f6573aafbb62ea717d871cd1d6816c387",
+        "hash": "sha256-LfJ7um+rzc4HdkJerHWkuPWeEc7ZFSBafbP+svAjklk="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "0508dee4ff864f5034ae6b7f68d34cb2822b827d",
-        "hash": "sha256-QqFC3Iyhw9Pq6TwBHxa0Ss7SW0bHo0Uz5N18oxl2ROg="
+        "rev": "809941a4ca137df69dc9c6e8eb456bd70309197c",
+        "hash": "sha256-FPXAofnMfgUkwwRGh8rqtXrmLjouP5A8umXV1pHm1ck="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "c52931f012cb7b48e42bbf2050a7fb2183b76406",
-        "hash": "sha256-nIzrishMMxWzOuD3aX8B6Iuq2kPsUF0Uuvz7GijTulY="
+        "rev": "fb8f5a5d69f4590ff1f5ecacb5e3957b6d11daee",
+        "hash": "sha256-fO6fkWOMYbf/um7gKFyjtrFE21g1kYx3lLvPv4gY7qw="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "fe7a09b13899c5c77d956fa310286f7a7eb2c4ed",
-        "hash": "sha256-zI3y5aoP4QcYp677Oxj5Ef7lJyJwOMdGsaRBe+X9vpI="
+        "rev": "2d8f273ebd4b843c402d9ee881616895b854e42f",
+        "hash": "sha256-nD/WTBTwCnfZdwdNKldDVpcuirSghCIeJRBeX+uQXBk="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "a30aa23cfaff4f28f039c025c159128a6c336a7e",
-        "hash": "sha256-foa5hzqf1hPwOj3k57CloCe/j0qXW3zCQ4mwCT4epF4="
+        "rev": "4e7b0c905b1a0401e24333800937cc8792efa037",
+        "hash": "sha256-CCpfWpyGki9klgHInjs6gAhw5shPXlzmFgccCHNfGQY="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1492,8 +1492,8 @@
       },
       "src/third_party/wasm_tts_engine/src": {
         "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "7a91dbfddd93afa096a69fb7d292e22d4afecad2",
-        "hash": "sha256-bV+1YFEtCyTeZujsZtZiexT/aUTN3MaVerR2UdkUPBY="
+        "rev": "6ab3e63276a2d66ba3e7db4f87c5b7cb00e22130",
+        "hash": "sha256-ZcnKKnHsN1UyztAXClc2EUwfeX3yuLtMM2Zjwpnh62U="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1527,8 +1527,8 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "fb2b951ac3c23e453335edf35c9b3bad431d9009",
-        "hash": "sha256-tjY5ADd5tMFsYHk6xT+TXwsDYV5eI2oOywmyTjjAxYc="
+        "rev": "dcfb0d153f1e19905b0af26e640470c9ec5578e7",
+        "hash": "sha256-726p6OfKAzHtnjz/8WtMcsRxuq4wqyJv3+DHOHDTeYY="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -1537,8 +1537,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8d78f5de6c27b2c793039989ea381f1428fb0100",
-        "hash": "sha256-IsjTrEnxIqINYYjWJmDp7rlubl5dJ2YMpJf/DrG/mRM="
+        "rev": "04413d62f754a7b1a3a2d8c3df23bcde040112b2",
+        "hash": "sha256-sFoBgpPeMJQNSjNp8dDEUlB/7lJUpIXTpu0eRq94cGk="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1557,18 +1557,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "0824e2965f6edc2297e55c8dff5a8ac4cb12aaad",
-        "hash": "sha256-eb9B9lXPB2GiC4qehB/HOU36W1e9RZ0N2oEbIifyrHE="
+        "rev": "7702e723fa25102db8b633ead4e3c221a5121487",
+        "hash": "sha256-n3FxY4HESzNyccQLENbuisU29v79c2x+7fYOsUrQnFg="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ea0aa030cdf31f7897c5bfc153f0d36e92768095",
-        "hash": "sha256-UJsuaSzR4V8alLdtxzpla1v9WYHPKPp13YrgA4Y6/yA="
+        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
+        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "4f282ae4acae85cdcc8c167cbc296a86d24c1cf6",
-        "hash": "sha256-wpz9W/ZurpCT/dGIHGpmdkI3dsXbP8TPNeee2w9zBU8="
+        "rev": "e2591684c45463aa1e46ebefc3fd35deee63f37c",
+        "hash": "sha256-tbGzFdqmkoSiVGk1WMRroWC3NR5GaHRuMwGzPhVodxk="
       }
     }
   }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 528c544bc0aa..057b6fb4aebb 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -10,16 +10,16 @@ let
     if stdenv.hostPlatform.isLinux then
       {
         stable = "0.0.89";
-        ptb = "0.0.135";
-        canary = "0.0.619";
+        ptb = "0.0.136";
+        canary = "0.0.621";
         development = "0.0.73";
       }
     else
       {
         stable = "0.0.342";
-        ptb = "0.0.166";
-        canary = "0.0.727";
-        development = "0.0.84";
+        ptb = "0.0.167";
+        canary = "0.0.729";
+        development = "0.0.85";
       };
   version = versions.${branch};
   srcs = rec {
@@ -30,11 +30,11 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-tzStiIAP83+ns5ZJr2DCtgLhoPf49RBnZtx6+unXndk=";
+        hash = "sha256-7MAipSoToCTJa+QFUty88V8SXXgJJdoQfH21yCGOKvA=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-2Jm0SjFMNw9Vlda9d2xywZlevxpay8DNx0krBr1sb4A=";
+        hash = "sha256-Jz7YIH107n89N/wQfhs9QfEqWCYO+BtjHrgSvk7xG+o=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -48,15 +48,15 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/VvTAAeSS/hzdaLt9Fjj+g3lqRVwJ08nM6fJdP77L9c=";
+        hash = "sha256-7ueaVb7SrD/GOVCPvf/91CaTw2jtiV/XrIsTu2RHdOM=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-RRQyXgAKTkOweMM6FE9exRXZWiT13dFh8VioGp2z1KQ=";
+        hash = "sha256-yP/eW1fKmZ8I5BtFOOKmmYjXlSF44HlcM8LpPNHA+Pc=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-8qgWvcfWTL1FXSy5CeihpMxS3Ysa79ZFAlG1rAcoyUo=";
+        hash = "sha256-Pcy2Bi3C8Jqcu4n/YLkc/7ENYRyuSf+Qj6vwN/Etqdo=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/version-management/gitoxide/default.nix b/pkgs/applications/version-management/gitoxide/default.nix
index bcc642d139e4..b25aab2ab772 100644
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@@ -62,5 +62,8 @@ rustPlatform.buildRustPackage rec {
       asl20
     ];
     maintainers = with maintainers; [ syberant ];
+    knownVulnerabilities = [
+      "CVE-2025-31130 / GHSA-2frx-2596-x5r6 – consider using gitoxide from 25.05/unstable"
+    ];
   };
 }
diff --git a/pkgs/applications/version-management/nbstripout/default.nix b/pkgs/applications/version-management/nbstripout/default.nix
index 07edd423c42b..d5368969a6b6 100644
--- a/pkgs/applications/version-management/nbstripout/default.nix
+++ b/pkgs/applications/version-management/nbstripout/default.nix
@@ -2,25 +2,27 @@
   lib,
   python3,
   fetchPypi,
+  fetchFromGitHub,
   coreutils,
   git,
   mercurial,
 }:
 
 python3.pkgs.buildPythonApplication rec {
-  version = "0.6.1";
+  version = "0.8.1";
   pname = "nbstripout";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kGW83RSIs4bk88CB/8HUj0UTovjYv00NmiggjF2v6dM=";
+    hash = "sha256-6qyLa05yno3+Hl3ywPi6RKvFoXplRI8EgBQfgL4jC7E=";
   };
 
-  # for some reason, darwin uses /bin/sh echo native instead of echo binary, so
-  # force using the echo binary
-  postPatch = ''
-    substituteInPlace tests/test-git.t --replace "echo" "${coreutils}/bin/echo"
-  '';
+  testAssets = fetchFromGitHub {
+    owner = "kynan";
+    repo = "nbstripout";
+    rev = "${version}";
+    hash = "sha256-OSJLrWkYQIhcdyofS3Bo39ppsU6K3A4546UKB8Q1GGg=";
+  };
 
   propagatedBuildInputs = with python3.pkgs; [
     ipython
@@ -34,14 +36,21 @@ python3.pkgs.buildPythonApplication rec {
       mercurial
     ]
     ++ (with python3.pkgs; [
-      pytest-cram
       pytestCheckHook
     ]);
 
+  checkInputs = [
+    testAssets
+  ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
     export PATH=$out/bin:$PATH
     git config --global init.defaultBranch main
+
+    cp -r --no-preserve=mode,ownership ${testAssets}/tests/e2e_notebooks $TMPDIR/e2e_notebooks
+    chmod -R +w $TMPDIR/e2e_notebooks
+    substituteInPlace tests/test_end_to_end.py --replace "tests/e2e_notebooks" "$TMPDIR/e2e_notebooks"
   '';
 
   meta = {
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 7ef6b9ed0ada..fa58e6419112 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -410,15 +410,17 @@ rec {
   };
 
   docker_25 = callPackage dockerGen rec {
-    version = "25.0.6";
-    cliRev = "v${version}";
-    cliHash = "sha256-7ZKjlONL5RXEJZrvssrL1PQMNANP0qTw4myGKdtd19U=";
+    version = "25.0.8";
+    # Upstream forgot to tag release
+    # https://github.com/docker/cli/issues/5789
+    cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
+    cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-+zkhUMeVD3HNq8WrWQmLskq+HykvD5kzSACmf67YbJE=";
-    runcRev = "v1.1.12";
-    runcHash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
-    containerdRev = "v1.7.20";
-    containerdHash = "sha256-Q9lTzz+G5PSoChy8MZtbOpO81AyNWXC+CgGkdOg14uY=";
+    mobyHash = "sha256-n7GdjQEceqyC7E2sPXQWyxpRThtH35eM/J20yLa5NSs=";
+    runcRev = "v1.2.4";
+    runcHash = "sha256-LdYCMxdqDP7rKo6Ek/B1DE6QvUFrltbSJVggkVkXQZo=";
+    containerdRev = "v1.7.25";
+    containerdHash = "sha256-T0F5bwxSCqa4Czs/W01NaAlJJFvgrzkBC1y/r+muivA=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
@@ -451,4 +453,18 @@ rec {
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
 
+  docker_28 = callPackage dockerGen rec {
+    version = "28.0.4";
+    cliRev = "v${version}";
+    cliHash = "sha256-DLUcmxbCxJs3EA96SGaesA+GzvHq6DC2vrGe5PvA0dE=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-yvz8MUOU61OuphPaIDu6+1wsbCXkIxJYQKK0fhcVwp0=";
+    runcRev = "v1.2.6";
+    runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
+    containerdRev = "v1.7.27";
+    containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
+    tiniRev = "v0.19.0";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+  };
+
 }
diff --git a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
index b3cd3e511f09..879acc5f4acb 100644
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@@ -60,7 +60,7 @@ for pname in depsDict:
         command = ["nix-prefetch-git", strippedRepo, version]
         rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
         sha256 = json.loads(rawRes)["sha256"]
-        lockedDepsDict[pname] = {"version": version, "repository": repository, "sha256": sha256}
+        lockedDepsDict[pname] = {"version": version, "repository": strippedRepo, "sha256": sha256}
     else:
         eprint(f"Fetching {pname}@{version}")
         url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
diff --git a/pkgs/by-name/am/amberol/package.nix b/pkgs/by-name/am/amberol/package.nix
index 3218d9624925..006fe8118d03 100644
--- a/pkgs/by-name/am/amberol/package.nix
+++ b/pkgs/by-name/am/amberol/package.nix
@@ -22,20 +22,20 @@
 
 stdenv.mkDerivation rec {
   pname = "amberol";
-  version = "2024.2";
+  version = "2025.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "amberol";
-    rev = version;
-    hash = "sha256-FK0TJFjknEFraY8T+PQ/ABiid36kEYIEhekgyx0y3aI=";
+    tag = version;
+    hash = "sha256-vF6O7+cQFoYpO4MHHHuacwjP7AUqFQCVUivCSZO7v3o=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     name = "amberol-${version}";
-    hash = "sha256-9YRd1iOh+l+Jy8eSwJP6pxonEofBkMpFqb+JAAFDbCA=";
+    hash = "sha256-j/xkdLcmu02e+b8skx5U3uG2R2rIxwSJsYzyJ5tn5uU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ca/cargo-embassy/package.nix b/pkgs/by-name/ca/cargo-embassy/package.nix
new file mode 100644
index 000000000000..23999a0c6c36
--- /dev/null
+++ b/pkgs/by-name/ca/cargo-embassy/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  udev,
+}:
+rustPlatform.buildRustPackage {
+  pname = "cargo-embassy";
+  version = "0.3.4";
+
+  src = fetchFromGitHub {
+    owner = "adinack";
+    repo = "cargo-embassy";
+    # 0.3.4 with cargo.lock. Switch back
+    # to tag = when next version released
+    rev = "989a406387ebda89acd943c57e207d78eba600c1";
+    hash = "sha256-C8eFQFHYIj2P+zPOKLVBNX97UDVbbcdjbqh5n53ktCU=";
+  };
+
+  buildInputs = [
+    udev
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  cargoHash = "sha256-iLGoc6CKZGlq9bw1sL0jCVm9lGa0i/BXiseU1USGjfQ=";
+  useFetchCargoVendor = true;
+
+  meta = {
+    description = "Command line tool for creating Embassy projects";
+    homepage = "https://github.com/adinack/cargo-embassy";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.samw ];
+    mainProgram = "cargo-embassy";
+  };
+}
diff --git a/pkgs/by-name/ca/cargo-tauri/hook.nix b/pkgs/by-name/ca/cargo-tauri/hook.nix
index a1fbdd3024f7..bc1d57f52356 100644
--- a/pkgs/by-name/ca/cargo-tauri/hook.nix
+++ b/pkgs/by-name/ca/cargo-tauri/hook.nix
@@ -37,7 +37,7 @@ makeSetupHook {
     installScript =
       {
         darwin = ''
-          mkdir $out
+          mkdir -p $out
           mv "$targetDir"/bundle/macos $out/Applications
         '';
 
diff --git a/pkgs/by-name/co/concessio/package.nix b/pkgs/by-name/co/concessio/package.nix
index 803182fc4686..c8fa52d89ce4 100644
--- a/pkgs/by-name/co/concessio/package.nix
+++ b/pkgs/by-name/co/concessio/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "concessio";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "ronniedroid";
     repo = "concessio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XH+4oEZSKa6lAS0zXxdlCsVJcGDglKSgaD+zoRM6Pws=";
+    hash = "sha256-GDiwpErxz6GiYajcRBOnX0RO1jeaSmpLLxqEsB3nJLA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/fa/fastnetmon-advanced/package.nix b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
index fe7f6f7659e3..089f13d7ba33 100644
--- a/pkgs/by-name/fa/fastnetmon-advanced/package.nix
+++ b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.370";
+  version = "2.0.371";
 
   src = fetchurl {
     url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-41tAGjZSNFDUSoworrKOps99/PRuCSagemFzxdrc6/U=";
+    hash = "sha256-/qCUeo/2AYIT9Yl6QjoTBPfmg8Lk2efDU5Axv4JU+t8=";
   };
 
   nativeBuildInputs = [
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     tar xf data.tar.xz
 
     # unused libraries, which have additional dependencies
-    rm opt/fastnetmon/libraries/gcc1210/lib/libgccjit.so.0.0.1
+    rm opt/fastnetmon/libraries/gcc1210/lib/libgccjit.so*
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/ju/jujutsu/package.nix b/pkgs/by-name/ju/jujutsu/package.nix
index 7c9d024cecd3..c84e8ea32d45 100644
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@@ -128,5 +128,8 @@ rustPlatform.buildRustPackage {
       bbigras
     ];
     mainProgram = "jj";
+    knownVulnerabilities = [
+      "GHSA-794x-2rpg-rfgr – consider using Jujutsu from 25.05/unstable"
+    ];
   };
 }
diff --git a/pkgs/by-name/li/libnoise/package.nix b/pkgs/by-name/li/libnoise/package.nix
new file mode 100644
index 000000000000..c71de90dabb1
--- /dev/null
+++ b/pkgs/by-name/li/libnoise/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnoise";
+  version = "0-unstable-2024-09-01";
+
+  src = fetchFromGitHub {
+    owner = "qknight";
+    repo = "libnoise";
+    rev = "9ce0737b55812f7de907e86dc633724524e3a8e8";
+    hash = "sha256-coazd4yedH69b+TOSTFV1CEzN0ezjoGyOaYR9QBhp2E=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ];
+
+  meta = {
+    description = "Portable, open-source, coherent noise-generating library for C++";
+    homepage = "https://github.com/qknight/libnoise";
+    license = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [ liberodark ];
+  };
+})
diff --git a/pkgs/by-name/ma/mangojuice/package.nix b/pkgs/by-name/ma/mangojuice/package.nix
index aab7000014e8..5c2908802ff9 100644
--- a/pkgs/by-name/ma/mangojuice/package.nix
+++ b/pkgs/by-name/ma/mangojuice/package.nix
@@ -25,13 +25,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangojuice";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "radiolamp";
     repo = "mangojuice";
     tag = finalAttrs.version;
-    hash = "sha256-NpNsYwktcce9R1LpoIL2vh5UzsgDqdPyS0D3mhM3F0w=";
+    hash = "sha256-373Ws+U7fuwWLrKOnj1dD9gIJPKOd1b6I78VWOtOjTM=";
   };
 
   patches = [
@@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Convenient alternative to GOverlay for setting up MangoHud";
     homepage = "https://github.com/radiolamp/mangojuice";
+    changelog = "https://github.com/radiolamp/mangojuice/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [ gpl3Only ];
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/mc/mcpelauncher-client/dont_download_glfw_client.patch b/pkgs/by-name/mc/mcpelauncher-client/dont_download_glfw_client.patch
new file mode 100644
index 000000000000..45ecd910364f
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-client/dont_download_glfw_client.patch
@@ -0,0 +1,25 @@
+diff --git a/ext/glfw.cmake b/ext/glfw.cmake
+index 5487f32..feeb89f 100644
+--- a/ext/glfw.cmake
++++ b/ext/glfw.cmake
+@@ -1,18 +1,2 @@
+-include(FetchContent)
+-
+-set(GLFW_BUILD_DOCS OFF CACHE BOOL "" FORCE)
+-set(GLFW_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+-set(GLFW_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
+-set(GLFW_INSTALL OFF CACHE BOOL "" FORCE)
+-
+-FetchContent_Declare(
+-        glfw3_ext
+-        URL "https://github.com/minecraft-linux/glfw/archive/fce9121962bc0a21c39e2d6f8e08bad30c566c72.zip"
+-)
+-
+-FetchContent_GetProperties(glfw3_ext)
+-if(NOT glfw3_ext_POPULATED)
+-  FetchContent_Populate(glfw3_ext)
+-  add_subdirectory(${glfw3_ext_SOURCE_DIR} ${glfw3_ext_BINARY_DIR})
+-endif()
++find_package(glfw3 REQUIRED)
+ add_library(glfw3 ALIAS glfw)
+\ No newline at end of file
diff --git a/pkgs/by-name/mc/mcpelauncher-client/package.nix b/pkgs/by-name/mc/mcpelauncher-client/package.nix
new file mode 100644
index 000000000000..b9181d3d18ec
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-client/package.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  clangStdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  pkg-config,
+  openssl,
+  zlib,
+  libpng,
+  libglvnd,
+  xorg,
+  libevdev,
+  curl,
+  pulseaudio,
+  qt6,
+  glfw,
+  withQtWebview ? true,
+  withQtErrorWindow ? true,
+  fetchzip,
+}:
+
+# gcc doesn't support __has_feature
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "mcpelauncher-client";
+  version = "1.1.2-qt6";
+
+  # NOTE: check mcpelauncher-ui-qt when updating
+  src = fetchFromGitHub {
+    owner = "minecraft-linux";
+    repo = "mcpelauncher-manifest";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-PmCq6Zgtp17UV0kIbNouFwj/DMiTqwE31+tTb2LUp5o=";
+  };
+
+  patches = [
+    ./dont_download_glfw_client.patch
+    # These are upcoming changes that have been merged upstream. Once these get in a release, remove these patches.
+    (fetchpatch {
+      url = "https://github.com/minecraft-linux/game-window/commit/feea8c0e0720eea7093ed95745c17f36d6c40671.diff";
+      hash = "sha256-u4uveoKwwklEooT+i+M9kZ0PshjL1IfWhlltmulsQJo=";
+      stripLen = 1;
+      extraPrefix = "game-window/";
+    })
+    (fetchpatch {
+      url = "https://github.com/minecraft-linux/mcpelauncher-client/commit/db9c31e46d7367867c85a0d0aba42c8144cdf795.diff";
+      hash = "sha256-za/9oZYwKCYyZ1BXQ/zeEjRy81B1NpTlPHEfWAOtzHk=";
+      stripLen = 1;
+      extraPrefix = "mcpelauncher-client/";
+    })
+  ];
+
+  # FORTIFY_SOURCE breaks libc_shim and the project will fail to compile
+  hardeningDisable = [ "fortify" ];
+
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals (withQtWebview || withQtErrorWindow) [
+      qt6.wrapQtAppsHook
+    ];
+
+  buildInputs =
+    [
+      openssl
+      zlib
+      libpng
+      libglvnd
+      xorg.libX11
+      xorg.libXi
+      xorg.libXtst
+      libevdev
+      curl
+      pulseaudio
+      glfw
+    ]
+    ++ lib.optionals (withQtWebview || withQtErrorWindow) [
+      qt6.qtbase
+      qt6.qttools
+      qt6.qtwayland
+    ]
+    ++ lib.optionals withQtWebview [
+      qt6.qtwebengine
+    ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NLOHMANN_JSON_EXT" (
+      toString (fetchzip {
+        url = "https://github.com/nlohmann/json/releases/download/v3.7.3/include.zip";
+        hash = "sha256-h8czZ4f5vZqvHkDVQawrQdUeQnWxewu4OONisqlrmmM=";
+        stripRoot = false;
+      })
+    ))
+    (lib.cmakeBool "USE_OWN_CURL" false)
+    (lib.cmakeBool "ENABLE_DEV_PATHS" false)
+    (lib.cmakeFeature "GAMEWINDOW_SYSTEM" "GLFW")
+    (lib.cmakeBool "USE_SDL3_AUDIO" false)
+    (lib.cmakeBool "BUILD_WEBVIEW" withQtWebview)
+    (lib.cmakeBool "XAL_WEBVIEW_USE_CLI" (!withQtWebview))
+    (lib.cmakeBool "XAL_WEBVIEW_USE_QT" withQtWebview)
+    (lib.cmakeBool "ENABLE_QT_ERROR_UI" withQtErrorWindow)
+  ];
+
+  meta = {
+    description = "Unofficial Minecraft Bedrock Edition launcher with CLI";
+    homepage = "https://minecraft-linux.github.io";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      aleksana
+      morxemplum
+    ];
+    mainProgram = "mcpelauncher-client";
+    platforms = lib.platforms.unix;
+    # Minecraft Bedrock Edition is raising minimal OpenGL version to OpenGL ES 3.1
+    # which is currently not supported on macOS.
+    # https://github.com/minecraft-linux/mcpelauncher-manifest/issues/1042
+    # https://help.minecraft.net/hc/en-us/articles/30298767427597-Upcoming-OS-Sunset-Announcements-in-Minecraft
+    # The program is also not tested on darwin. Any help from darwin users are welcomed.
+    badPlatforms = lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/dont_download_glfw_ui.patch b/pkgs/by-name/mc/mcpelauncher-ui-qt/dont_download_glfw_ui.patch
new file mode 100644
index 000000000000..3d28d9b46149
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/dont_download_glfw_ui.patch
@@ -0,0 +1,24 @@
+diff -urB mcpelauncher-ui/mcpelauncher-ui-qt/ext/glfw.cmake mcpelauncher-ui-b/mcpelauncher-ui-qt/ext/glfw.cmake
+--- mcpelauncher-ui/mcpelauncher-ui-qt/ext/glfw.cmake	2024-11-28 21:12:36.794926431 -0700
++++ mcpelauncher-ui-b/mcpelauncher-ui-qt/ext/glfw.cmake	2024-12-03 15:04:28.466197081 -0700
+@@ -1,19 +1,2 @@
+-include(FetchContent)
+-
+-set(GLFW_BUILD_DOCS OFF CACHE BOOL "" FORCE)
+-set(GLFW_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+-set(GLFW_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
+-set(GLFW_INSTALL OFF CACHE BOOL "" FORCE)
+-set(GLFW_BUILD_WAYLAND OFF CACHE BOOL "" FORCE)
+-
+-FetchContent_Declare(
+-        glfw3_ext
+-        URL "https://github.com/glfw/glfw/archive/master.zip"
+-)
+-
+-FetchContent_GetProperties(glfw3_ext)
+-if(NOT glfw3_ext_POPULATED)
+-  FetchContent_Populate(glfw3_ext)
+-  add_subdirectory(${glfw3_ext_SOURCE_DIR} ${glfw3_ext_BINARY_DIR})
+-endif()
++find_package(glfw3 REQUIRED)
+ add_library(glfw3 ALIAS glfw)
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
new file mode 100644
index 000000000000..6867af4464ee
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  mcpelauncher-client,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  zlib,
+  libzip,
+  curl,
+  protobuf,
+  qt6,
+  glfw,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mcpelauncher-ui-qt";
+  inherit (mcpelauncher-client) version;
+
+  src = fetchFromGitHub {
+    owner = "minecraft-linux";
+    repo = "mcpelauncher-ui-manifest";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-R9wE1lS7x1IIPgVahXjF5Yg2ca+GsiQuF41pWf2edXY=";
+  };
+
+  patches = [
+    ./dont_download_glfw_ui.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    zlib
+    libzip
+    curl
+    protobuf
+    qt6.qtwebengine
+    qt6.qtsvg
+    qt6.qtwayland
+    glfw
+  ];
+
+  # the program refuses to start when QT_STYLE_OVERRIDE is set
+  # https://github.com/minecraft-linux/mcpelauncher-ui-qt/issues/25
+  preFixup = ''
+    qtWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ mcpelauncher-client ]}
+      --unset QT_STYLE_OVERRIDE
+    )
+  '';
+
+  meta = mcpelauncher-client.meta // {
+    description = "Unofficial Minecraft Bedrock Edition launcher with GUI";
+    mainProgram = "mcpelauncher-ui-qt";
+  };
+})
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 228c2fb0235d..c064a0542d4f 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -174,11 +174,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "134.0.3124.68";
+  version = "134.0.3124.95";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-zjN8ssVeR3yyw+e6tVzcrrYkLToo8Rmm4GjcG9iQMpk=";
+    hash = "sha256-vgTJl9BmMdm4Aw1FCpIfqzfmgsLuY61G/RSkA66kPhI=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index e4952620dae8..65379cf36eb7 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.94.0";
+  version = "1.94.3";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-jSGlMh+8K27lpz8oLxTGLaER5x1+CeLhGK7pITJ12rQ=";
+        hash = "sha256-SKKNdALkA8W7YNlq8Y6t8iT1NpIxcODIFaSq7Nfqydw=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-pmmKPSnr6/mixdNCfgpvBu7n8hWT/U1YyV0DwOhqfhk=";
+        hash = "sha256-G5u9w8xjJn6UFLOwiq835rvZfuEIqn4SQSFL4awlgtc=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/re/refine/package.nix b/pkgs/by-name/re/refine/package.nix
index 833e838a518e..28be2652143c 100644
--- a/pkgs/by-name/re/refine/package.nix
+++ b/pkgs/by-name/re/refine/package.nix
@@ -34,7 +34,7 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "refine";
-  version = "0.5.5";
+  version = "0.5.6";
   pyproject = false; # uses meson
 
   src = fetchFromGitLab {
@@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
     owner = "TheEvilSkeleton";
     repo = "Refine";
     tag = version;
-    hash = "sha256-b2dNhd5UJqH/l5BOEgcOUZrhCZa8ErdBzNw5g4VjtM8=";
+    hash = "sha256-cIJWTzeLm2YP8Pm/nzcYHIGzBOmQlPe0lQ+b6BufIMg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ri/riffdiff/package.nix b/pkgs/by-name/ri/riffdiff/package.nix
index 68791985d8a6..6e357a00133e 100644
--- a/pkgs/by-name/ri/riffdiff/package.nix
+++ b/pkgs/by-name/ri/riffdiff/package.nix
@@ -9,16 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "riffdiff";
-  version = "3.3.8";
+  version = "3.3.9";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "riff";
     tag = version;
-    hash = "sha256-KJ+2MdhBW0og6uj9eTUsoKcpenQj7tp3fZzgCNfdrqI=";
+    hash = "sha256-EhRruR5UzVP5OdPRX/k8Tasst9tlVteyfXD9BCXBhtI=";
   };
 
-  cargoHash = "sha256-RN//dB53Jy6fGJeUHHM7jdJrPhnbfjKiJ5TFFOtcbFI=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-a9XLP0ydG/lIXT6fa4QK5MiBN6NWp/IrchXLBm34F6g=";
 
   passthru = {
     tests.version = testers.testVersion { package = riffdiff; };
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index 63e2abe676dc..8484efd96899 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -220,9 +220,9 @@
     ]
   },
   "music": {
-    "hash": "sha256-9n934EcAUVaKLfT+QKu53/9PJvTd+SsFa2w1/idLFk0=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.2/music_2.1.2_for_nextcloud.tar.gz",
-    "version": "2.1.2",
+    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
+    "version": "2.1.3",
     "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
     "homepage": "https://github.com/owncloud/music",
     "licenses": [
@@ -230,9 +230,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-CAnDrbpXZVISJ4WjAAl7mhZY2t9ohBgPLdf7tGd3aIY=",
-    "url": "https://github.com/nextcloud/news/releases/download/25.3.0/news.tar.gz",
-    "version": "25.3.0",
+    "hash": "sha256-trXnDSSFyr5HKXaS1S3XrlSAUiiT+8B+kP0lg+exLcs=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.3.1/news.tar.gz",
+    "version": "25.3.1",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-Y97Z7ylwTGBFTUAVPhR6+aXIeasv+/U6JcnLYW41CN8=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.10/richdocuments-v8.4.10.tar.gz",
-    "version": "8.4.10",
+    "hash": "sha256-2sO5lj0v73Zo1NB4HLxt+txwlzfs7kbnLXWAsyDriI0=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.11/richdocuments-v8.4.11.tar.gz",
+    "version": "8.4.11",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -399,10 +399,20 @@
       "agpl"
     ]
   },
+  "uppush": {
+    "hash": "sha256-3QD3gtCfhs9tWrbiiPPV7lYxpzGQhc31unSZukcrvN0=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.3.0.tar.gz",
+    "version": "2.3.0",
+    "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
-    "hash": "sha256-jhqch6Gup7774P9seExlwhDGbDv0AK9LEzSEtmFW85A=",
-    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.0.0/user_oidc-v7.0.0.tar.gz",
-    "version": "7.0.0",
+    "hash": "sha256-qEsUJG63j+VRZc+tqeX4iTEs9/GIVsTsyeFEOwSBYCg=",
+    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.1.0/user_oidc-v7.1.0.tar.gz",
+    "version": "7.1.0",
     "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
     "homepage": "https://github.com/nextcloud/user_oidc",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/30.json b/pkgs/servers/nextcloud/packages/30.json
index 0346c5ea1d1a..efe5f456d81a 100644
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@@ -120,9 +120,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-qAz61bLmCSK2AucSShvCKLj9IsMaE06aTEOmLKBWtdk=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.3/forms-v5.0.3.tar.gz",
-    "version": "5.0.3",
+    "hash": "sha256-WA2sj3zjf0XuLbSaT9AZkgLYab9O2wVUIazeJXrMAxs=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.4/forms-v5.0.4.tar.gz",
+    "version": "5.0.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -190,9 +190,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-EFhjy0LcJCsNHJy//rGwM1f3UkAGLNXzC6lz6k5JstY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.1/mail-v4.3.1.tar.gz",
-    "version": "4.3.1",
+    "hash": "sha256-pqZmLPR01a1l3QCMo97yS6tpY8gwkDoZcMOvmHGE5Q0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.3/mail-v4.3.3.tar.gz",
+    "version": "4.3.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "music": {
-    "hash": "sha256-9n934EcAUVaKLfT+QKu53/9PJvTd+SsFa2w1/idLFk0=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.2/music_2.1.2_for_nextcloud.tar.gz",
-    "version": "2.1.2",
+    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
+    "version": "2.1.3",
     "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
     "homepage": "https://github.com/owncloud/music",
     "licenses": [
@@ -230,9 +230,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-CAnDrbpXZVISJ4WjAAl7mhZY2t9ohBgPLdf7tGd3aIY=",
-    "url": "https://github.com/nextcloud/news/releases/download/25.3.0/news.tar.gz",
-    "version": "25.3.0",
+    "hash": "sha256-trXnDSSFyr5HKXaS1S3XrlSAUiiT+8B+kP0lg+exLcs=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.3.1/news.tar.gz",
+    "version": "25.3.1",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-4qzUFSWxkIOYrqBpr9NYmIowGaLWSugdREw/B7UaqFo=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.5.4/richdocuments-v8.5.4.tar.gz",
-    "version": "8.5.4",
+    "hash": "sha256-A+d3fHOrna0DR4hbB6nn8NwLzZqxXErXkj2Npzvi+Ls=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.5.5/richdocuments-v8.5.5.tar.gz",
+    "version": "8.5.5",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -389,10 +389,20 @@
       "agpl"
     ]
   },
+  "uppush": {
+    "hash": "sha256-3QD3gtCfhs9tWrbiiPPV7lYxpzGQhc31unSZukcrvN0=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.3.0.tar.gz",
+    "version": "2.3.0",
+    "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
-    "hash": "sha256-jhqch6Gup7774P9seExlwhDGbDv0AK9LEzSEtmFW85A=",
-    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.0.0/user_oidc-v7.0.0.tar.gz",
-    "version": "7.0.0",
+    "hash": "sha256-qEsUJG63j+VRZc+tqeX4iTEs9/GIVsTsyeFEOwSBYCg=",
+    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.1.0/user_oidc-v7.1.0.tar.gz",
+    "version": "7.1.0",
     "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
     "homepage": "https://github.com/nextcloud/user_oidc",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index b2b7bcce45e2..00dceeef4df3 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -120,9 +120,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-qAz61bLmCSK2AucSShvCKLj9IsMaE06aTEOmLKBWtdk=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.3/forms-v5.0.3.tar.gz",
-    "version": "5.0.3",
+    "hash": "sha256-WA2sj3zjf0XuLbSaT9AZkgLYab9O2wVUIazeJXrMAxs=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.4/forms-v5.0.4.tar.gz",
+    "version": "5.0.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -190,9 +190,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-EFhjy0LcJCsNHJy//rGwM1f3UkAGLNXzC6lz6k5JstY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.1/mail-v4.3.1.tar.gz",
-    "version": "4.3.1",
+    "hash": "sha256-pqZmLPR01a1l3QCMo97yS6tpY8gwkDoZcMOvmHGE5Q0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.3/mail-v4.3.3.tar.gz",
+    "version": "4.3.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "music": {
-    "hash": "sha256-9n934EcAUVaKLfT+QKu53/9PJvTd+SsFa2w1/idLFk0=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.2/music_2.1.2_for_nextcloud.tar.gz",
-    "version": "2.1.2",
+    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
+    "version": "2.1.3",
     "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
     "homepage": "https://github.com/owncloud/music",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-CAnDrbpXZVISJ4WjAAl7mhZY2t9ohBgPLdf7tGd3aIY=",
-    "url": "https://github.com/nextcloud/news/releases/download/25.3.0/news.tar.gz",
-    "version": "25.3.0",
+    "hash": "sha256-trXnDSSFyr5HKXaS1S3XrlSAUiiT+8B+kP0lg+exLcs=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.3.1/news.tar.gz",
+    "version": "25.3.1",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -310,9 +310,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-x1x1wZb/yMUZnt5Af37iBGaWTsUdFELNOb23szGEMaY=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.6.2/richdocuments-v8.6.2.tar.gz",
-    "version": "8.6.2",
+    "hash": "sha256-/Qj9P9QZO2GLD/dZTsx++wgCT+8b13lJ67UGdkTnI2s=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.6.3/richdocuments-v8.6.3.tar.gz",
+    "version": "8.6.3",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -369,10 +369,20 @@
       "agpl"
     ]
   },
+  "uppush": {
+    "hash": "sha256-3QD3gtCfhs9tWrbiiPPV7lYxpzGQhc31unSZukcrvN0=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.3.0.tar.gz",
+    "version": "2.3.0",
+    "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
-    "hash": "sha256-jhqch6Gup7774P9seExlwhDGbDv0AK9LEzSEtmFW85A=",
-    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.0.0/user_oidc-v7.0.0.tar.gz",
-    "version": "7.0.0",
+    "hash": "sha256-qEsUJG63j+VRZc+tqeX4iTEs9/GIVsTsyeFEOwSBYCg=",
+    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v7.1.0/user_oidc-v7.1.0.tar.gz",
+    "version": "7.1.0",
     "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
     "homepage": "https://github.com/nextcloud/user_oidc",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/default.nix b/pkgs/servers/nextcloud/packages/default.nix
index 7e0c19c5a60a..ab4aaaec1149 100644
--- a/pkgs/servers/nextcloud/packages/default.nix
+++ b/pkgs/servers/nextcloud/packages/default.nix
@@ -6,13 +6,13 @@
   lib,
   pkgs,
   newScope,
+  apps ? lib.importJSON (./. + "/${ncVersion}.json"), # Support out-of-tree overrides
   callPackage,
   ncVersion,
   nextcloud-notify_push,
 }:
 
 let
-  apps = lib.importJSON (./. + "/${ncVersion}.json");
   packages =
     self:
     let
diff --git a/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index 0d25f9429a3a..11fa1e47941d 100644
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -42,6 +42,7 @@
 , "twofactor_webauthn": "agpl3Plus"
 , "unroundedcorners": "agpl3Only"
 , "unsplash": "agpl3Only"
+, "uppush": "agpl3Plus"
 , "user_oidc": "agpl3Plus"
 , "user_saml": "agpl3Plus"
 , "whiteboard": "agpl3Plus"
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index d1d67d74b153..17bc57781e69 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pcre,
   pcre2,
   jemalloc,
@@ -23,6 +24,7 @@ let
     {
       version,
       hash,
+      patches ? [ ],
       extraNativeBuildInputs ? [ ],
     }:
     stdenv.mkDerivation rec {
@@ -34,6 +36,8 @@ let
         inherit hash;
       };
 
+      inherit patches;
+
       nativeBuildInputs = with python3.pkgs; [
         pkg-config
         docutils
@@ -98,5 +102,12 @@ in
   varnish75 = common {
     version = "7.5.0";
     hash = "sha256-/KYbmDE54arGHEVG0SoaOrmAfbsdgxRXHjFIyT/3K10=";
+    patches = [
+      (fetchpatch {
+        name = "CVE-2025-30346.patch";
+        url = "https://github.com/varnishcache/varnish-cache/commit/a9640a13276048815cc51a12cda2603f4d4444e4.patch";
+        hash = "sha256-hzm09GMB7WLGp6zyqgMkxm9tJwUT9bRnEAPrX47v3e8=";
+      })
+    ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2add9f5e2192..6f82737a07b6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15227,6 +15227,7 @@ with pkgs;
     docker_25
     docker_26
     docker_27
+    docker_28
     ;
 
   docker = docker_27;