diff --git a/doc/stdenv/multiple-output.chapter.md b/doc/stdenv/multiple-output.chapter.md
index 5e86d2aa3d56..09fdba01c44a 100644
--- a/doc/stdenv/multiple-output.chapter.md
+++ b/doc/stdenv/multiple-output.chapter.md
@@ -21,7 +21,7 @@ In the Nix language the individual outputs can be reached explicitly as attribut
 
 When a multiple-output derivation gets into a build input of another derivation, the `dev` output is added if it exists, otherwise the first output is added. In addition to that, `propagatedBuildOutputs` of that package which by default contain `$outputBin` and `$outputLib` are also added. (See [](#multiple-output-file-type-groups).)
 
-In some cases it may be desirable to combine different outputs under a single store path. A function `symlinkJoin` can be used to do this. (Note that it may negate some closure size benefits of using a multiple-output package.)
+In some cases it may be desirable to combine different outputs under a single store path. The `symlinkJoin` builder can be used to do this. (See [](#trivial-builder-symlinkJoin)). Note that this may negate some closure size benefits of using a multiple-output package.
 
 ## Writing a split derivation {#sec-multiple-outputs-}
 
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index ec270055cb63..fb42a68786ee 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -503,7 +503,6 @@ with lib.maintainers;
       ryantm
       lassulus
       yayayayaka
-      asymmetric
     ];
     scope = "Maintain Jitsi.";
     shortName = "Jitsi";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index c21051d2b515..fa51b2728155 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -364,6 +364,9 @@
 
 - `services.pgbouncer` systemd service is configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the free-form type option named [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings) according to the NixOS RFC 0042.
 
+- `nodePackages.coc-metals` was removed due to being deprecated upstream.
+  `vimPlugins.nvim-metals` is its official replacement.
+
 - `teleport` has been upgraded from major version 15 to major version 16.
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
@@ -636,6 +639,12 @@
   `goModules`, `modRoot`, `vendorHash`, `deleteVendor`, and `proxyVendor` are now passed as derivation attributes.
   `goModules` and `vendorHash` are no longer placed under `passthru`.
 
+- `buildFlags`/`buildFlagsArray` on `buildGoModule` have been deprecated. 24.11 is the last release where `buildGoModule` accepts these flags (while throwing a warning).
+  Use the [`ldflags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-ldflags) and/or [`tags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-tags) attributes or
+  [the environment](https://nixos.org/manual/nixpkgs/unstable/#ssec-go-environment) instead.
+
+- `buildGoPackage` has been deprecated. 24.11 is the last release with `buildGoPackage` available.
+
 - `hareHook` has been added as the language framework for Hare. From now on, it,
   not the `hare` package, should be added to `nativeBuildInputs` when building
   Hare programs.
diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index af7b27f28e26..eca4862b16f1 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -12,7 +12,7 @@
 
   activationScript = ''
     # will be rebuilt automatically
-    rm -fv $HOME/.cache/ksycoca*
+    rm -fv "$HOME/.cache/ksycoca"*
   '';
 in {
   options = {
diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
index a38df9c8878a..ab322cad7aed 100644
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -66,6 +66,60 @@ in
         The path to a file containing the password for the smtp mailer used by Wakapi.
       '';
     };
+
+    database = {
+      createLocally = mkEnableOption ''
+        automatic database configuration.
+
+        ::: {.note}
+        Only PostgreSQL is supported for the time being.
+        :::
+      '';
+
+      dialect = mkOption {
+        type = types.nullOr (
+          types.enum [
+            "postgres"
+            "sqlite3"
+            "mysql"
+            "cockroach"
+            "mssql"
+          ]
+        );
+        default = cfg.settings.db.dialect or null; # handle case where dialect is not set
+        defaultText = ''
+          Database dialect from settings if {option}`services.wakatime.settings.db.dialect`
+          is set, or `null` otherwise.
+        '';
+        description = ''
+          The database type to use for Wakapi.
+        '';
+      };
+
+      name = mkOption {
+        type = types.str;
+        default = cfg.settings.db.name or "wakapi";
+        defaultText = ''
+          Database name from settings if {option}`services.wakatime.settings.db.name`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the database to use for Wakapi.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = cfg.settings.db.user or "wakapi";
+        defaultText = ''
+          User from settings if {option}`services.wakatime.settings.db.user`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the user to use for Wakapi.
+        '';
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -73,10 +127,10 @@ in
       description = "Wakapi (self-hosted WakaTime-compatible backend)";
       wants = [
         "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
       after = [
         "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
       wantedBy = [ "multi-user.target" ];
 
       script = ''
@@ -135,6 +189,19 @@ in
         assertion = cfg.smtpPassword != null -> cfg.smtpPasswordFile != null;
         message = "Both `services.wakapi.smtpPassword` `services.wakapi.smtpPasswordFile` should not be set at the same time.";
       }
+      {
+        assertion = cfg.db.createLocally -> cfg.db.dialect != null;
+        message = "`services.wakapi.database.createLocally` is true, but a database dialect is not set!";
+      }
+    ];
+
+    warnings = [
+      (lib.optionalString (cfg.db.createLocall -> cfg.db.dialect != "postgres") ''
+        You have enabled automatic database configuration, but the database dialect is not set to "posgres".
+
+        The Wakapi module only supports for PostgreSQL. Please set `services.wakapi.database.createLocally`
+        to `false`, or switch to "postgres" as your database dialect.
+      '')
     ];
 
     users = {
@@ -146,10 +213,10 @@ in
       groups.wakapi = { };
     };
 
-    services.postgresql = mkIf (cfg.settings.db.dialect == "postgres") {
+    services.postgresql = mkIf (cfg.database.createLocally && cfg.database.dialect == "postgres") {
       enable = true;
 
-      ensureDatabases = singleton cfg.settings.db.name;
+      ensureDatabases = singleton cfg.database.name;
       ensureUsers = singleton {
         name = cfg.settings.db.user;
         ensureDBOwnership = true;
@@ -161,5 +228,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ isabelroses ];
+  meta.maintainers = with lib.maintainers; [
+    isabelroses
+    NotAShelf
+  ];
 }
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index cfd9193f08be..c6697584e326 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.84.1";
+  version = "2.89.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-V/bOCddc7UhmN8zlHmKj+H4v+ZZ/qn8jRj0jH4EtwMI=";
+    hash = "sha256-PPoQnXDVf6Q6QPVE41guJL1vu7rW7mZdpRZjRME3Ue8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 4a58f44942f0..6c93f150bec4 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2734,7 +2734,6 @@ in
       "coc-lists"
       "coc-ltex"
       "coc-markdownlint"
-      "coc-metals"
       "coc-pairs"
       "coc-prettier"
       "coc-r-lsp"
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 1ef2e9d15382..70ebecaa63de 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -70,9 +70,9 @@ let
   # source tree.
   extraAttrs = buildFun base;
 
-  githubPatch = { commit, hash, revert ? false }: fetchpatch {
+  githubPatch = { commit, hash, revert ? false, excludes ? [] }: fetchpatch {
     url = "https://github.com/chromium/chromium/commit/${commit}.patch";
-    inherit hash revert;
+    inherit hash revert excludes;
   };
 
   mkGnFlags =
@@ -314,6 +314,22 @@ let
     ] ++ lib.optionals (chromiumVersionAtLeast "129") [
       # Rebased variant of patch right above to build M129+ with our rust and our clang.
       ./patches/chromium-129-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "130") [
+      # Our rustc.llvmPackages is too old for std::hardware_destructive_interference_size
+      # and std::hardware_constructive_interference_size.
+      # So let's revert the change for now and hope that our rustc.llvmPackages and
+      # nixpkgs-stable catch up sooner than later.
+      # https://groups.google.com/a/chromium.org/g/cxx/c/cwktrFxxUY4
+      # https://chromium-review.googlesource.com/c/chromium/src/+/5767325
+      # Note: We exclude the changes made to the partition_allocator (PA), as the revert
+      # would otherwise not apply because upstream reverted those changes to PA already
+      # in https://chromium-review.googlesource.com/c/chromium/src/+/5841144
+      (githubPatch {
+        commit = "fc838e8cc887adbe95110045d146b9d5885bf2a9";
+        hash = "sha256-NNKzIp6NYdeZaqBLWDW/qNxiDB1VFRz7msjMXuMOrZ8=";
+        excludes = [ "base/allocator/partition_allocator/src/partition_alloc/*" ];
+        revert = true;
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 484cc0e4f194..767e244a6cd1 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -58,6 +58,12 @@ let
         # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
         # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
         hardeningDisable = [ "format" ];
+      } // lib.optionalAttrs (chromiumVersionAtLeast "130") {
+        # At the time of writing, gn is at v2024-05-13 and has a backported patch.
+        # This patch appears to be already present in v2024-09-09 (from M130), which
+        # results in the patch not applying and thus failing the build.
+        # As a work around until gn is updated again, we filter specifically that patch out.
+        patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
       });
       recompressTarball = callPackage ./recompress-tarball.nix { inherit chromiumVersionAtLeast; };
     });
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 1dae6fdb4a4b..1e13bee43289 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,22 +1,22 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-/0mBZCSNULvZSQ/irsQSgNPsuOSWiRRnJA/6ogHYeGk=";
+      hash_darwin = "sha256-YndBzhUNmn5tJdCqLmpUrs2WBXXpTxiKCNczWEz6DU4=";
       hash_darwin_aarch64 =
-        "sha256-JWcYFYaaXM2KN6oSu7wwxztYPbhql2XYZlvL2ymKgwI=";
-      hash_linux = "sha256-odFoTWjDa9ilyOrQ0T+0xxedRD7YOe/s7xdAyyku74w=";
-      version = "129.0.6668.91";
+        "sha256-taG58kMgQUD40aGqnyx9O9e9m4qGsTWX57cjD3NeHm4=";
+      hash_linux = "sha256-raWGzhjqWdm5bRK+Z7Qga8QM9kQYSXxdL5N+wk1hlXI=";
+      version = "130.0.6723.58";
     };
     deps = {
       gn = {
-        hash = "sha256-8o3rDdojqVHMQCxI2T3MdJOXKlW3XX7lqpy3zWhJiaA=";
-        rev = "d010e218ca7077928ad7c9e9cc02fe43b5a8a0ad";
+        hash = "sha256-iNXRq3Mr8+wmY1SR4sV7yd2fDiIZ94eReelwFI0UhGU=";
+        rev = "20806f79c6b4ba295274e3a589d85db41a02fdaa";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-08-19";
+        version = "2024-09-09";
       };
     };
-    hash = "sha256-LOZ9EPw7VgBNEV7Wxb8H5WfSYTTWOL8EDP91uCrZAsA=";
-    version = "129.0.6668.100";
+    hash = "sha256-w1xQr+B7ROeCqBRN+M9vmh45YTRqVfjDYSsN5saDuDo=";
+    version = "130.0.6723.58";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/feedreaders/russ/default.nix b/pkgs/applications/networking/feedreaders/russ/default.nix
deleted file mode 100644
index 3fbaa2108d60..000000000000
--- a/pkgs/applications/networking/feedreaders/russ/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "russ";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "ckampfe";
-    repo = "russ";
-    rev = "1482bb1df13738fdd4ea1badf2146a9ed8e6656e";
-    hash = "sha256-MvTMo2q/cQ/LQNdUV8SmHgGlA42kLl0i9mdcoAFV/I4=";
-  };
-
-  cargoHash = "sha256-ObWrwXMGXkLqqM7VXhOXArshk2lVkbOTXhrQImDQp1s=";
-
-  # tests are network based :(
-  doCheck = false;
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-    CoreServices
-    AppKit
-  ]);
-
-  meta = with lib; {
-    description = "TUI RSS reader with vim-like controls and a local-first, offline-first focus";
-    mainProgram = "russ";
-    homepage = "https://github.com/ckampfe/russ";
-    license = with licenses; [ agpl3Only ];
-    maintainers = with maintainers; [ blusk ];
-    changelog = "https://github.com/ckampfe/russ/blob/master/CHANGELOG.md";
-  };
-}
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index ff301d690941..191a09c422cf 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -12,6 +12,7 @@
 , systemd
 , pam
 , fuse
+, libdrm
 , libjpeg
 , libopus
 , nasm
@@ -27,18 +28,18 @@
 let
   xorgxrdp = stdenv.mkDerivation rec {
     pname = "xorgxrdp";
-    version = "0.9.20";
+    version = "0.10.2";
 
     src = fetchFromGitHub {
       owner = "neutrinolabs";
       repo = "xorgxrdp";
       rev = "v${version}";
-      hash = "sha256-cAAWk/GqR5zJmh7EAzX3qJiYNl/RrDWdncdFeqsFIaU=";
+      hash = "sha256-xwkGY9dD747kyTvoXrYAIoiFBzQe5ngskUYQhDawnbU=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm ];
 
-    buildInputs = [ xorg.xorgserver ];
+    buildInputs = [ xorg.xorgserver libdrm ];
 
     postPatch = ''
       # patch from Debian, allows to run xrdp daemon under unprivileged user
@@ -50,9 +51,10 @@ let
         --replace 'sysconfdir="/etc"' "sysconfdir=$out/etc"
     '';
 
-    preConfigure = "./bootstrap";
-
-    configureFlags = [ "XRDP_CFLAGS=-I${xrdp.src}/common"  ];
+    preConfigure = ''
+      ./bootstrap
+      export XRDP_CFLAGS="-I${xrdp.src}/common -I${libdrm.dev}/include -I${libdrm.dev}/include/libdrm"
+    '';
 
     enableParallelBuilding = true;
 
@@ -61,7 +63,7 @@ let
 
   xrdp = stdenv.mkDerivation rec {
     pname = "xrdp";
-    version = "0.9.25.1";
+    version = "0.10.1";
 
     src = applyPatches {
       inherit version;
@@ -72,7 +74,7 @@ let
         repo = "xrdp";
         rev = "v${version}";
         fetchSubmodules = true;
-        hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
+        hash = "sha256-lqifQJ/JX+0304arVctsEBEDFPhEPn2OWLyjAQW1who=";
       };
     };
 
@@ -94,7 +96,7 @@ let
     ];
 
     postPatch = ''
-      substituteInPlace sesman/xauth.c --replace "xauth -q" "${xorg.xauth}/bin/xauth -q"
+      substituteInPlace sesman/sesexec/xauth.c --replace "xauth -q" "${xorg.xauth}/bin/xauth -q"
 
       substituteInPlace configure.ac --replace /usr/include/ ""
     '';
@@ -128,6 +130,7 @@ let
       cp $src/keygen/openssl.conf $out/share/xrdp/openssl.conf
 
       substituteInPlace $out/etc/xrdp/sesman.ini --replace /etc/xrdp/pulse $out/etc/xrdp/pulse
+      substituteInPlace $out/etc/xrdp/sesman.ini --replace '#SessionSockdirGroup=root' 'SessionSockdirGroup=xrdp'
 
       # remove all session types except Xorg (they are not supported by this setup)
       perl -i -ne 'print unless /\[(X11rdp|Xvnc|console|vnc-any|sesman-any|rdp-any|neutrinordp-any)\]/ .. /^$/' $out/etc/xrdp/xrdp.ini
diff --git a/pkgs/applications/networking/remote/xrdp/dynamic_config.patch b/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
index 5c97beeb6701..2cb50b19fc7f 100644
--- a/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
+++ b/pkgs/applications/networking/remote/xrdp/dynamic_config.patch
@@ -135,8 +135,8 @@ index 8fa34aea..da94cf95 100644
 -    LOG(LOG_LEVEL_DEBUG, "keyboard_cfg_file %s", keyboard_cfg_file);
 +    LOG(LOG_LEVEL_DEBUG, "keyboard_cfg_file %s", client_info->xrdp_keyboard_ini_file);
  
--    fd = g_file_open(keyboard_cfg_file);
-+    fd = g_file_open(client_info->xrdp_keyboard_ini_file);
+-    fd = g_file_open_ro(keyboard_cfg_file);
++    fd = g_file_open_ro(client_info->xrdp_keyboard_ini_file);
  
      if (fd >= 0)
      {
@@ -179,19 +179,19 @@ index 8fa34aea..da94cf95 100644
                  list_delete(items);
                  list_delete(values);
                  return 1;
-diff --git a/sesman/config.c b/sesman/config.c
+diff --git a/sesman/libsesman/sesman_config.c b/sesman/libsesman/sesman_config.c
 index 61e9e403..0466f61a 100644
---- a/sesman/config.c
-+++ b/sesman/config.c
-@@ -34,6 +34,7 @@
- #include "sesman.h"
+--- a/sesman/libsesman/sesman_config.c
++++ b/sesman/libsesman/sesman_config.c
+@@ -37,6 +37,7 @@
  #include "log.h"
+ #include "os_calls.h"
  #include "string_calls.h"
 +#include <string.h>
- #include "chansrv/chansrv_common.h"
- 
- /***************************************************************************//**
-@@ -47,11 +48,10 @@
+ //#include "chansrv/chansrv_common.h"
+ #include "scp.h"
+
+@@ -171,7 +172,7 @@ config_output_policy_string(unsigned int value,
   *
   */
  static int
@@ -200,61 +200,57 @@ index 61e9e403..0466f61a 100644
                      struct list *param_v)
  {
      int i;
--    int length;
-     char *buf;
- 
-     list_clear(param_v);
-@@ -127,13 +127,12 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
-         g_free(cf->default_wm);
+@@ -249,14 +250,12 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
          cf->default_wm = g_strdup("startwm.sh");
      }
--    /* if default_wm doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
-+    /* if default_wm doesn't begin with '/', it's a relative path to base_dir */
+     /* if default_wm doesn't begin with '/', it's a relative path to
+-     * XRDP_CFG_PATH */
++     * base_dir */
      if (cf->default_wm[0] != '/')
      {
          /* sizeof operator returns string length including null terminator  */
--        length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->default_wm) + 1; /* '/' */
--        buf = (char *)g_malloc(length, 0);
+-        int length = (sizeof(XRDP_CFG_PATH) +
+-                      g_strlen(cf->default_wm) + 1); /* '/' */
+-        char *buf = (char *)g_malloc(length, 0);
 -        g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->default_wm);
-+        buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->default_wm) + 1, 0);
++        char *buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->default_wm) + 1, 0);
 +        g_sprintf(buf, "%s/%s", base_dir, cf->default_wm);
          g_free(cf->default_wm);
-         cf->default_wm = g_strdup(buf);
-         g_free(buf);
-@@ -151,10 +150,8 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
-     /* if reconnect_sh doesn't begin with '/', it's a relative path to XRDP_CFG_PATH */
+         cf->default_wm = buf;
+     }
+@@ -271,10 +270,8 @@ config_read_globals(int file, struct config_sesman *cf, struct list *param_n,
      if (cf->reconnect_sh[0] != '/')
      {
--        /* sizeof operator returns string length including null terminator  */
--        length = sizeof(XRDP_CFG_PATH) + g_strlen(cf->reconnect_sh) + 1; /* '/' */
--        buf = (char *)g_malloc(length, 0);
+         /* sizeof operator returns string length including null terminator  */
+-        int length = (sizeof(XRDP_CFG_PATH) +
+-                      g_strlen(cf->reconnect_sh) + 1); /* '/' */
+-        char *buf = (char *)g_malloc(length, 0);
 -        g_sprintf(buf, "%s/%s", XRDP_CFG_PATH, cf->reconnect_sh);
-+        buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->reconnect_sh) + 1, 0);
-+        g_sprintf(buf, "%s/%s", base_dir, cf->reconnect_sh);     
++        char *buf = (char *)g_malloc(g_strlen(base_dir) + 1 + g_strlen(cf->reconnect_sh) + 1, 0);
++        g_sprintf(buf, "%s/%s", base_dir, cf->reconnect_sh);
          g_free(cf->reconnect_sh);
-         cf->reconnect_sh = g_strdup(buf);
-         g_free(buf);
-@@ -511,6 +508,7 @@ struct config_sesman *
+         cf->reconnect_sh = buf;
+     }
+@@ -580,6 +577,7 @@ struct config_sesman *
  config_read(const char *sesman_ini)
  {
      struct config_sesman *cfg;
 +    char cfg_dir[256];
      int all_ok = 0;
- 
+
      if ((cfg = g_new0(struct config_sesman, 1)) != NULL)
-@@ -532,8 +530,10 @@ config_read(const char *sesman_ini)
-                 param_v->auto_free = 1;
- 
+@@ -602,7 +600,10 @@ config_read(const char *sesman_ini)
+                 all_ok = 1;
+
                  /* read global config */
 -                config_read_globals(fd, cfg, param_n, param_v);
--
 +                g_strcpy(cfg_dir, sesman_ini);
 +                *(strrchr(cfg_dir, '/')) = 0;  // cfg_file validated to contain '/'
-+            
++
 +                config_read_globals(cfg_dir, fd, cfg, param_n, param_v);
-                 /* read Xvnc/X11rdp/Xorg parameter list */
+
+                 /* read Xvnc/Xorg parameter list */
                  config_read_vnc_params(fd, cfg, param_n, param_v);
-                 config_read_rdp_params(fd, cfg, param_n, param_v);
 diff --git a/xrdp/lang.c b/xrdp/lang.c
 index e4c18077..06f92997 100644
 --- a/xrdp/lang.c
diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index 6181d49d4b06..854fcaecce46 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.23";
+  version = "1.24.1";
 
   src = fetchFromBitbucket {
     owner = "agriggio";
     repo = "art";
     rev = version;
-    hash = "sha256-OB/Rr4rHNJc40o6esNPDRbhN4EPGf2zhlzzM+mBpUUU=";
+    hash = "sha256-uvdqU509ri6CKCEGA8Ln5tMp0pe3r/bcJefbeZGjocE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/auto-cpufreq/package.nix b/pkgs/by-name/au/auto-cpufreq/package.nix
index 244735554010..3a87f2ac0cbe 100644
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -82,7 +82,7 @@ python3Packages.buildPythonPackage rec {
     mkdir -p $out/share/applications
     mkdir $out/share/pixmaps
     cp scripts/auto-cpufreq-gtk.desktop $out/share/applications
-    cp images/icon.png $out/share/pixmaps/auto-cpufreq.python3Packages
+    cp images/icon.png $out/share/pixmaps/auto-cpufreq.png
 
     # polkit policy
     mkdir -p $out/share/polkit-1/actions
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 0753bf9f8be4..d94f62a63469 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.2";
+  version = "0.20.4";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-lit0v9emrAYkHWpCP1Z35UdrKdMiDh2HWeQg4WfxJIo=";
+    hash = "sha256-0wkFVExa8HCe3UBDMWjq2UAtrW1zmUQHAcVgWgmPPWM=";
   };
 
-  cargoHash = "sha256-TwUbEeka20K9C8TvJH/Hiv8qp66TjAkcyMG7K2JuagQ=";
+  cargoHash = "sha256-GWrhW9+bX0pc78Seb6WHvWjCSe8XWKiHYUXRMFq+LbY=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/gp/gpscorrelate/package.nix b/pkgs/by-name/gp/gpscorrelate/package.nix
index bb72042c21c5..d9801f5d704c 100644
--- a/pkgs/by-name/gp/gpscorrelate/package.nix
+++ b/pkgs/by-name/gp/gpscorrelate/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gpscorrelate";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "dfandrich";
     repo = "gpscorrelate";
     rev = version;
-    hash = "sha256-1t9XUY12hVaUNOg785dMJCiaMMCI2XCcif1DkKYXOoo=";
+    hash = "sha256-H1kqOzL79/Y1kHVEQ5y9JRWTDCBMbtEPo75drm8+7Qo=";
   };
 
   nativeBuildInputs = [
@@ -48,11 +48,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  preCheck = ''
-    # https://github.com/dfandrich/gpscorrelate/issues/29
-    rm tests/data/test005.*
-  '';
-
   installTargets = [ "install" "install-po" "install-desktop-file" ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index 55283031e79d..2e4ad286a1a0 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   cmake,
-  llvm,
+  darwin,
+  fetchpatch,
+  llvmPackages_17,
   fetchFromGitHub,
   mbedtls,
   gtk3,
@@ -21,13 +23,24 @@
   nlohmann_json,
   yara,
   rsync,
+  nix-update-script,
   autoPatchelfHook,
+  makeWrapper,
+  overrideSDK,
 }:
 
 let
   version = "1.35.4";
   patterns_version = "1.35.4";
 
+  llvmPackages = llvmPackages_17;
+
+  stdenv' =
+    let
+      baseStdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+    in
+    if stdenv.isDarwin then overrideSDK baseStdenv "11.0" else baseStdenv;
+
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
     owner = "WerWolv";
@@ -37,7 +50,7 @@ let
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv'.mkDerivation (finalAttrs: {
   pname = "imhex";
   inherit version;
 
@@ -46,20 +59,39 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
     owner = "WerWolv";
     repo = "ImHex";
-    rev = "refs/tags/v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
     hash = "sha256-6QpmFkSMQpGlEzo7BHZn20c+q8CTDUB4yO87wMU5JT4=";
   };
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    cmake
-    llvm
-    python3
-    perl
-    pkg-config
-    rsync
+  patches = [
+    # https://github.com/WerWolv/ImHex/pull/1910
+    # during https://github.com/NixOS/nixpkgs/pull/330303 it was discovered that ImHex
+    # would not build on Darwin x86-64
+    # this temporary patch can be removed when the above PR is merged
+    (fetchpatch {
+      url = "https://github.com/WerWolv/ImHex/commit/69624a2661ea44db9fb8b81c3278ef69016ebfcf.patch";
+      hash = "sha256-LcUCl8Rfz6cbhop2StksuViim2bH4ma3/8tGVKFdAgg=";
+    })
   ];
 
+  # Comment out fixup_bundle in PostprocessBundle.cmake as we are not building a standalone application
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/PostprocessBundle.cmake \
+      --replace-fail "fixup_bundle" "#fixup_bundle"
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      llvmPackages.llvm
+      python3
+      perl
+      pkg-config
+      rsync
+    ]
+    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ]
+    ++ lib.optionals stdenv.isDarwin [ makeWrapper ];
+
   buildInputs = [
     capstone
     curl
@@ -73,31 +105,50 @@ stdenv.mkDerivation rec {
     mbedtls
     nlohmann_json
     yara
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.UniformTypeIdentifiers ];
 
   # autoPatchelfHook only searches for *.so and *.so.*, and won't find *.hexpluglib
   # however, we will append to RUNPATH ourselves
-  autoPatchelfIgnoreMissingDeps = [ "*.hexpluglib" ];
-  appendRunpaths = [
+  autoPatchelfIgnoreMissingDeps = lib.optionals stdenv.isLinux [ "*.hexpluglib" ];
+  appendRunpaths = lib.optionals stdenv.isLinux [
     (lib.makeLibraryPath [ libGL ])
     "${placeholder "out"}/lib/imhex/plugins"
   ];
 
   cmakeFlags = [
-    "-DIMHEX_OFFLINE_BUILD=ON"
-    "-DUSE_SYSTEM_CAPSTONE=ON"
-    "-DUSE_SYSTEM_CURL=ON"
-    "-DUSE_SYSTEM_FMT=ON"
-    "-DUSE_SYSTEM_LLVM=ON"
-    "-DUSE_SYSTEM_NLOHMANN_JSON=ON"
-    "-DUSE_SYSTEM_YARA=ON"
+    (lib.cmakeBool "IMHEX_OFFLINE_BUILD" true)
+    (lib.cmakeBool "IMHEX_COMPRESS_DEBUG_INFO" false) # avoids error: cannot compress debug sections (zstd not enabled)
+    (lib.cmakeBool "IMHEX_GENERATE_PACKAGE" stdenv.isDarwin)
+    (lib.cmakeBool "USE_SYSTEM_CAPSTONE" true)
+    (lib.cmakeBool "USE_SYSTEM_CURL" true)
+    (lib.cmakeBool "USE_SYSTEM_FMT" true)
+    (lib.cmakeBool "USE_SYSTEM_LLVM" true)
+    (lib.cmakeBool "USE_SYSTEM_NLOHMANN_JSON" true)
+    (lib.cmakeBool "USE_SYSTEM_YARA" true)
   ];
 
   # rsync is used here so we can not copy the _schema.json files
-  postInstall = ''
-    mkdir -p $out/share/imhex
-    rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,patterns} $out/share/imhex
-  '';
+  postInstall =
+    if stdenv.isLinux then
+      ''
+        mkdir -p $out/share/imhex
+        rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,nodes,patterns} $out/share/imhex
+      ''
+    else if stdenv.isDarwin then
+      ''
+        mkdir -p $out/Applications
+        mv $out/imhex.app $out/Applications
+        rsync -av --exclude="*_schema.json" ${patterns_src}/{constants,encodings,includes,magic,nodes,patterns} "$out/Applications/imhex.app/Contents/MacOS"
+        install_name_tool \
+          -change "$out/lib/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
+          "@executable_path/../Frameworks/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
+          "$out/Applications/imhex.app/Contents/MacOS/imhex"
+        makeWrapper "$out/Applications/imhex.app/Contents/MacOS/imhex" "$out/bin/imhex"
+      ''
+    else
+      throw "Unsupported system";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM";
@@ -107,6 +158,6 @@ stdenv.mkDerivation rec {
       kashw2
       cafkafk
     ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 5d1739d07c07..43996b4c92d5 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mapserver";
-  version = "8.2.1";
+  version = "8.2.2";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "MapServer";
     rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-kZEDC89yoQP0ma5avp6r+Hz8JMpErGlBVQkhlHO6UFw=";
+    hash = "sha256-tub0Jd1IUkONQ5Mqz8urihbrcFLlOQybLhOvzkcwW54=";
   };
 
   nativeBuildInputs =
@@ -70,23 +70,24 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional withPython python3;
 
   cmakeFlags = [
-    "-DWITH_KML=ON"
-    "-DWITH_SOS=ON"
-    "-DWITH_RSVG=ON"
-    "-DWITH_CURL=ON"
-    "-DWITH_CLIENT_WMS=ON"
-    "-DWITH_CLIENT_WFS=ON"
+    (lib.cmakeBool "WITH_KML" true)
+    (lib.cmakeBool "WITH_SOS" true)
+    (lib.cmakeBool "WITH_RSVG" true)
+    (lib.cmakeBool "WITH_CURL" true)
+    (lib.cmakeBool "WITH_CLIENT_WMS" true)
+    (lib.cmakeBool "WITH_CLIENT_WFS" true)
+    (lib.cmakeBool "WITH_PYTHON" withPython)
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optional withPython "-DWITH_PYTHON=ON";
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Platform for publishing spatial data and interactive mapping applications to the web";
     homepage = "https://mapserver.org/";
     changelog = "https://mapserver.org/development/changelog/";
-    license = licenses.mit;
-    maintainers = teams.geospatial.members;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = lib.teams.geospatial.members;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index ce95eb246993..6b935d55642a 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prisma";
-  version = "5.21.0";
+  version = "5.21.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma";
     rev = finalAttrs.version;
-    hash = "sha256-i37Hiawmu/06Mv56FtYkvFGOtqW3x4Q2H1C0JW6/0pI=";
+    hash = "sha256-75TmTFl1EKLGE3kgghghary4Z2gjEjdguZ//ND3HAkc=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-o6m9Lxg+oqq15CtdA9RQRukdJWPPGtw/SwRyHDUf91A=";
+    hash = "sha256-fu2SJUn2xKm8lKNE8ncMRuNu6snj1J6cnHrJfzg+hJc=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/re/renpy/5687.patch b/pkgs/by-name/re/renpy/5687.patch
new file mode 100644
index 000000000000..0ed4a883919f
--- /dev/null
+++ b/pkgs/by-name/re/renpy/5687.patch
@@ -0,0 +1,91 @@
+From b120f82f9809b98231188daacb94f22a9e69187a Mon Sep 17 00:00:00 2001
+From: Gregor Riepl <onitake@gmail.com>
+Date: Thu, 8 Aug 2024 23:56:16 +0200
+Subject: [PATCH] Replace deprecated APIs when compiling against newer FFmpeg
+
+---
+ module/ffmedia.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/module/ffmedia.c b/module/ffmedia.c
+index d4bb346ac35740711b8393e66d0bfc28c849ff0e..0f57e311f277359fad731e348531becbadbb06d4 100644
+--- a/module/ffmedia.c
++++ b/module/ffmedia.c
+@@ -71,7 +71,11 @@ static int rwops_read(void *opaque, uint8_t *buf, int buf_size) {
+ 
+ }
+ 
++#if (LIBAVFORMAT_VERSION_MAJOR < 61)
+ static int rwops_write(void *opaque, uint8_t *buf, int buf_size) {
++#else
++static int rwops_write(void *opaque, const uint8_t *buf, int buf_size) {
++#endif
+     printf("Writing to an SDL_rwops is a really bad idea.\n");
+     return -1;
+ }
+@@ -690,9 +694,14 @@ static void decode_audio(MediaState *ms) {
+ 			}
+ 
+             converted_frame->sample_rate = audio_sample_rate;
++#if (LIBAVUTIL_VERSION_MAJOR < 59)
+             converted_frame->channel_layout = AV_CH_LAYOUT_STEREO;
++#else
++            converted_frame->ch_layout = (AVChannelLayout) AV_CHANNEL_LAYOUT_STEREO;
++#endif
+             converted_frame->format = AV_SAMPLE_FMT_S16;
+ 
++#if (LIBAVUTIL_VERSION_MAJOR < 59)
+ 			if (!ms->audio_decode_frame->channel_layout) {
+ 				ms->audio_decode_frame->channel_layout = av_get_default_channel_layout(ms->audio_decode_frame->channels);
+ 
+@@ -711,6 +720,26 @@ static void decode_audio(MediaState *ms) {
+ 				    swr_set_matrix(ms->swr, stereo_matrix, 1);
+ 				}
+ 			}
++#else
++			if (ms->audio_decode_frame->ch_layout.order == AV_CHANNEL_ORDER_UNSPEC) {
++				av_channel_layout_default(&ms->audio_decode_frame->ch_layout, ms->audio_decode_frame->ch_layout.nb_channels);
++
++				if (audio_equal_mono && (ms->audio_decode_frame->ch_layout.nb_channels == 1)) {
++				    swr_alloc_set_opts2(
++                        &ms->swr,
++                        &converted_frame->ch_layout,
++                        converted_frame->format,
++                        converted_frame->sample_rate,
++                        &ms->audio_decode_frame->ch_layout,
++                        ms->audio_decode_frame->format,
++                        ms->audio_decode_frame->sample_rate,
++                        0,
++                        NULL);
++
++				    swr_set_matrix(ms->swr, stereo_matrix, 1);
++				}
++			}
++#endif
+ 
+ 			if(swr_convert_frame(ms->swr, converted_frame, ms->audio_decode_frame)) {
+ 				av_frame_free(&converted_frame);
+@@ -1159,7 +1188,11 @@ static int decode_thread(void *arg) {
+ 
+ 	// Compute the number of samples we need to play back.
+ 	if (ms->audio_duration < 0) {
++#if (LIBAVFORMAT_VERSION_MAJOR < 62)
+ 		if (av_fmt_ctx_get_duration_estimation_method(ctx) != AVFMT_DURATION_FROM_BITRATE) {
++#else
++		if (ctx->duration_estimation_method != AVFMT_DURATION_FROM_BITRATE) {
++#endif
+ 
+ 			long long duration = ((long long) ctx->duration) * audio_sample_rate;
+ 			ms->audio_duration = (unsigned int) (duration /  AV_TIME_BASE);
+@@ -1319,7 +1352,11 @@ static int decode_sync_start(void *arg) {
+ 
+ 	// Compute the number of samples we need to play back.
+ 	if (ms->audio_duration < 0) {
++#if (LIBAVFORMAT_VERSION_MAJOR < 62)
+ 		if (av_fmt_ctx_get_duration_estimation_method(ctx) != AVFMT_DURATION_FROM_BITRATE) {
++#else
++		if (ctx->duration_estimation_method != AVFMT_DURATION_FROM_BITRATE) {
++#endif
+ 
+ 			long long duration = ((long long) ctx->duration) * audio_sample_rate;
+ 			ms->audio_duration = (unsigned int) (duration /  AV_TIME_BASE);
diff --git a/pkgs/by-name/re/renpy/package.nix b/pkgs/by-name/re/renpy/package.nix
index 5cc7a0970556..9bba63ce1c43 100644
--- a/pkgs/by-name/re/renpy/package.nix
+++ b/pkgs/by-name/re/renpy/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   python311,
   pkg-config,
   SDL2,
@@ -86,7 +87,10 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  patches = [ ./shutup-erofs-errors.patch ];
+  patches = [
+    ./shutup-erofs-errors.patch
+    ./5687.patch
+  ];
 
   postPatch = ''
     cp tutorial/game/tutorial_director.rpy{m,}
diff --git a/pkgs/by-name/ro/rospo/package.nix b/pkgs/by-name/ro/rospo/package.nix
index 088d0d04f61b..19300832cef1 100644
--- a/pkgs/by-name/ro/rospo/package.nix
+++ b/pkgs/by-name/ro/rospo/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "rospo";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "ferama";
     repo = "rospo";
     rev = "v${version}";
-    hash = "sha256-cUah73wr0fKK9Lw3228r5SITDn5rNlpgQW5rHtbo6jU=";
+    hash = "sha256-+1xrke8dfMkuZZ/imY+1KkeJnZCDtKJpxwAg5ksErnM=";
   };
 
-  vendorHash = "sha256-KbR8T7KwueQ9fc4AOX26GOTQFXuV9LgfSxgwCzQt4eE=";
+  vendorHash = "sha256-MTPFBrLFMQ2hEwtSDb7t3ls/Wagw7s9/w6bwWjZ62vE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ru/russ/package.nix b/pkgs/by-name/ru/russ/package.nix
new file mode 100644
index 000000000000..98d460b6d43f
--- /dev/null
+++ b/pkgs/by-name/ru/russ/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "russ";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "ckampfe";
+    repo = "russ";
+    rev = "b21aa80ebc9dc2668463386f9eb270b1782d5842";
+    hash = "sha256-/76CvSBYim831OZzLhsj2Hm+0hoY/FLtKQqt19E5YOI=";
+  };
+
+  cargoHash = "sha256-d3lJQafvBuj9Sb2Tuep3Ypt1sP+vlWHk4kuP99gMly8=";
+
+  # tests are network based :(
+  doCheck = false;
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
+    with darwin.apple_sdk.frameworks;
+    [
+      CoreServices
+      AppKit
+    ]
+  );
+
+  meta = {
+    changelog = "https://github.com/ckampfe/russ/blob/master/CHANGELOG.md";
+    description = "TUI RSS reader with vim-like controls and a local-first, offline-first focus";
+    homepage = "https://github.com/ckampfe/russ";
+    license = with lib.licenses; [ agpl3Only ];
+    maintainers = with lib.maintainers; [ blusk ];
+    mainProgram = "russ";
+  };
+}
diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index 0702a9d11438..febb85b3c9b7 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -3,6 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
+  installShellFiles,
   dbus,
   stdenv,
   darwin,
@@ -10,20 +11,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veryl";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "veryl-lang";
     repo = "veryl";
     rev = "v${version}";
-    hash = "sha256-U4ikR2jRmHUwRycAL/t2XJtvHQniKu6skRKWn8XDIgM=";
+    hash = "sha256-YcYP7JO27Fv/LTrxbQ0vNqwBE6anGjeTFS31MAp2ip4=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-t2q3rbY84+0ayxt7a/TCD0exCm7KEs+8UbQjCtqZPoE=";
+  cargoHash = "sha256-HvT56jBmFTWUdzHjyPVaJ3wuMD01omCFEIEJ53JrKY4=";
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs =
@@ -37,6 +39,13 @@ rustPlatform.buildRustPackage rec {
       darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd veryl \
+      --bash <($out/bin/veryl metadata --completion bash) \
+      --fish <($out/bin/veryl metadata --completion fish) \
+      --zsh <($out/bin/veryl metadata --completion zsh)
+  '';
+
   checkFlags = [
     # takes over an hour
     "--skip=tests::progress"
@@ -53,7 +62,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=analyzer::test_68_std"
     "--skip=emitter::test_25_dependency"
     "--skip=emitter::test_68_std"
-
   ];
 
   meta = {
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 0396d33c76cc..648d045ffd05 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -74,6 +74,7 @@ mapAliases {
   inherit (pkgs) coc-diagnostic; # added 2024-06-29
   coc-imselect = throw "coc-imselect was removed because it was broken"; # added 2023-08-21
   inherit (pkgs) coc-pyright; # added 2024-07-14
+  coc-metals = throw "coc-metals was removed because it was deprecated upstream. vimPlugins.nvim-metals is its official replacement."; # Added 2024-10-16
   coc-python = throw "coc-python was removed because it was abandoned upstream on 2020-12-24. Upstream now recommends using coc-pyright or coc-jedi instead."; # added 2024-10-15
   coinmon = throw "coinmon was removed since it was abandoned upstream"; # added 2024-03-19
   coffee-script = pkgs.coffeescript; # added 2023-08-18
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 928cfdd5d51d..ad85e2054447 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -44,7 +44,6 @@
 , "coc-lists"
 , "coc-ltex"
 , "coc-markdownlint"
-, "coc-metals"
 , "coc-pairs"
 , "coc-prettier"
 , "coc-r-lsp"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index d9d6ae7a4e03..726b4bd7e1c5 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -60910,250 +60910,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  coc-metals = nodeEnv.buildNodePackage {
-    name = "coc-metals";
-    packageName = "coc-metals";
-    version = "1.0.14";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/coc-metals/-/coc-metals-1.0.14.tgz";
-      sha512 = "zFExh1wGAZl4LXSp76NAjWORO9Tyhfw8WtALnhDv741p4tjWjVSEl6GmXTQN0U0tXz8UZ8ln2rL2OaxOdgMCTA==";
-    };
-    dependencies = [
-      sources."@chemzqm/msgpack-lite-0.1.29"
-      sources."@chemzqm/neovim-5.9.5"
-      sources."@tootallnate/once-1.1.2"
-      sources."agent-base-6.0.2"
-      sources."arch-2.2.0"
-      sources."array-buffer-byte-length-1.0.1"
-      sources."arraybuffer.prototype.slice-1.0.3"
-      sources."async-2.6.4"
-      sources."available-typed-arrays-1.0.7"
-      sources."await-semaphore-0.1.3"
-      sources."balanced-match-1.0.2"
-      sources."big-integer-1.6.52"
-      sources."binary-0.3.0"
-      sources."bluebird-3.4.7"
-      sources."brace-expansion-1.1.11"
-      sources."bser-2.1.1"
-      sources."buffer-indexof-polyfill-1.0.2"
-      sources."buffers-0.1.1"
-      sources."bytes-3.1.2"
-      sources."call-bind-1.0.7"
-      sources."chainsaw-0.1.0"
-      sources."chownr-2.0.0"
-      sources."clipboardy-2.3.0"
-      sources."coc.nvim-0.0.79"
-      sources."concat-map-0.0.1"
-      sources."content-disposition-0.5.4"
-      sources."core-util-is-1.0.3"
-      (sources."cross-spawn-6.0.5" // {
-        dependencies = [
-          sources."semver-5.7.2"
-          sources."which-1.3.1"
-        ];
-      })
-      sources."data-view-buffer-1.0.1"
-      sources."data-view-byte-length-1.0.1"
-      sources."data-view-byte-offset-1.0.0"
-      sources."date-format-4.0.14"
-      sources."debounce-1.2.1"
-      sources."debug-4.3.7"
-      sources."deep-extend-0.6.0"
-      sources."define-data-property-1.1.4"
-      sources."define-properties-1.2.1"
-      sources."duplexer2-0.1.4"
-      sources."encoding-0.1.13"
-      sources."end-of-stream-1.4.4"
-      sources."es-abstract-1.23.3"
-      sources."es-define-property-1.0.0"
-      sources."es-errors-1.3.0"
-      sources."es-object-atoms-1.0.0"
-      sources."es-set-tostringtag-2.0.3"
-      sources."es-to-primitive-1.2.1"
-      sources."execa-1.0.0"
-      sources."fast-diff-1.3.0"
-      sources."fb-watchman-2.0.2"
-      sources."flatted-3.3.1"
-      sources."follow-redirects-1.15.9"
-      sources."for-each-0.3.3"
-      sources."fp-ts-2.16.9"
-      sources."fs-extra-8.1.0"
-      (sources."fs-minipass-2.1.0" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-        ];
-      })
-      sources."fs.realpath-1.0.0"
-      (sources."fstream-1.0.12" // {
-        dependencies = [
-          sources."mkdirp-0.5.6"
-          sources."rimraf-2.7.1"
-        ];
-      })
-      sources."function-bind-1.1.2"
-      sources."function.prototype.name-1.1.6"
-      sources."functions-have-names-1.2.3"
-      sources."get-intrinsic-1.2.4"
-      sources."get-stream-4.1.0"
-      sources."get-symbol-description-1.0.2"
-      sources."glob-7.2.3"
-      sources."globalthis-1.0.4"
-      sources."gopd-1.0.1"
-      sources."graceful-fs-4.2.11"
-      sources."has-bigints-1.0.2"
-      sources."has-property-descriptors-1.0.2"
-      sources."has-proto-1.0.3"
-      sources."has-symbols-1.0.3"
-      sources."has-tostringtag-1.0.2"
-      sources."hasown-2.0.2"
-      sources."http-proxy-agent-4.0.1"
-      sources."https-proxy-agent-5.0.1"
-      sources."iconv-lite-0.6.3"
-      sources."ieee754-1.2.1"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."ini-1.3.8"
-      sources."int64-buffer-0.1.10"
-      sources."internal-slot-1.0.7"
-      sources."is-array-buffer-3.0.4"
-      sources."is-bigint-1.0.4"
-      sources."is-boolean-object-1.1.2"
-      sources."is-callable-1.2.7"
-      sources."is-data-view-1.0.1"
-      sources."is-date-object-1.0.5"
-      sources."is-docker-2.2.1"
-      sources."is-negative-zero-2.0.3"
-      sources."is-number-object-1.0.7"
-      sources."is-regex-1.1.4"
-      sources."is-shared-array-buffer-1.0.3"
-      sources."is-stream-1.1.0"
-      sources."is-string-1.0.7"
-      sources."is-symbol-1.0.4"
-      sources."is-typed-array-1.1.13"
-      sources."is-weakref-1.0.2"
-      sources."is-wsl-2.2.0"
-      sources."isarray-2.0.5"
-      sources."isexe-2.0.0"
-      sources."isuri-2.0.3"
-      sources."jsonc-parser-2.3.1"
-      sources."jsonfile-4.0.0"
-      sources."listenercount-1.0.1"
-      (sources."locate-java-home-1.1.2" // {
-        dependencies = [
-          sources."semver-5.7.2"
-        ];
-      })
-      sources."lodash-4.17.21"
-      sources."log4js-6.9.1"
-      sources."metals-languageclient-0.4.2"
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."minipass-5.0.0"
-      (sources."minizlib-2.1.2" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-        ];
-      })
-      sources."mkdirp-1.0.4"
-      sources."ms-2.1.3"
-      (sources."mv-2.1.1" // {
-        dependencies = [
-          sources."glob-6.0.4"
-          sources."mkdirp-0.5.6"
-          sources."rimraf-2.4.5"
-        ];
-      })
-      sources."ncp-2.0.0"
-      sources."nice-try-1.0.5"
-      sources."node-fetch-2.7.0"
-      sources."node-int64-0.4.0"
-      sources."npm-run-path-2.0.2"
-      sources."object-inspect-1.13.2"
-      sources."object-keys-1.1.1"
-      sources."object.assign-4.1.5"
-      sources."once-1.4.0"
-      sources."p-finally-1.0.0"
-      sources."path-is-absolute-1.0.1"
-      sources."path-key-2.0.1"
-      sources."possible-typed-array-names-1.0.0"
-      sources."process-nextick-args-2.0.1"
-      sources."promise.prototype.finally-3.1.8"
-      sources."promisify-child-process-4.1.1"
-      sources."pump-3.0.2"
-      sources."rc-1.2.8"
-      (sources."readable-stream-2.3.8" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      sources."regexp.prototype.flags-1.5.2"
-      sources."rfc-3986-1.0.1"
-      sources."rfdc-1.4.1"
-      sources."rimraf-3.0.2"
-      sources."safe-array-concat-1.1.2"
-      sources."safe-buffer-5.2.1"
-      sources."safe-regex-test-1.0.3"
-      sources."safer-buffer-2.1.2"
-      sources."semver-7.6.3"
-      sources."set-function-length-1.2.2"
-      sources."set-function-name-2.0.2"
-      sources."setimmediate-1.0.5"
-      sources."shebang-command-1.2.0"
-      sources."shebang-regex-1.0.0"
-      sources."shell-quote-1.8.1"
-      sources."side-channel-1.0.6"
-      sources."signal-exit-3.0.7"
-      sources."streamroller-3.1.5"
-      sources."string.prototype.trim-1.2.9"
-      sources."string.prototype.trimend-1.0.8"
-      sources."string.prototype.trimstart-1.0.8"
-      (sources."string_decoder-1.1.1" // {
-        dependencies = [
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      sources."strip-eof-1.0.0"
-      sources."strip-json-comments-2.0.1"
-      sources."tar-6.2.1"
-      sources."tr46-0.0.3"
-      sources."traverse-0.3.9"
-      sources."tslib-2.7.0"
-      sources."typed-array-buffer-1.0.2"
-      sources."typed-array-byte-length-1.0.1"
-      sources."typed-array-byte-offset-1.0.2"
-      sources."typed-array-length-1.0.6"
-      sources."unbox-primitive-1.0.2"
-      sources."universalify-0.1.2"
-      sources."unzipper-0.10.14"
-      sources."util-deprecate-1.0.2"
-      sources."uuid-7.0.3"
-      sources."vscode-jsonrpc-5.0.1"
-      (sources."vscode-languageserver-protocol-3.15.3" // {
-        dependencies = [
-          sources."vscode-languageserver-types-3.15.1"
-        ];
-      })
-      sources."vscode-languageserver-textdocument-1.0.12"
-      sources."vscode-languageserver-types-3.17.5"
-      sources."vscode-uri-2.1.2"
-      sources."webidl-conversions-3.0.1"
-      sources."whatwg-url-5.0.0"
-      sources."which-2.0.2"
-      sources."which-boxed-primitive-1.0.2"
-      sources."which-typed-array-1.1.15"
-      sources."wrappy-1.0.2"
-      sources."yallist-4.0.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "coc.nvim extension for Metals, the Scala language server";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   coc-pairs = nodeEnv.buildNodePackage {
     name = "coc-pairs";
     packageName = "coc-pairs";
diff --git a/pkgs/development/ocaml-modules/uuidm/default.nix b/pkgs/development/ocaml-modules/uuidm/default.nix
index 83b8cacc77a0..cf354c5e898d 100644
--- a/pkgs/development/ocaml-modules/uuidm/default.nix
+++ b/pkgs/development/ocaml-modules/uuidm/default.nix
@@ -1,20 +1,21 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner
+, version ? if lib.versionAtLeast ocaml.version "4.14" then "0.9.9" else "0.9.8"
+}:
 
 lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
   "uuidm is not available for OCaml ${ocaml.version}"
 
-stdenv.mkDerivation rec {
-  version = "0.9.8";
+stdenv.mkDerivation {
+  inherit version;
   pname = "uuidm";
   src = fetchurl {
     url = "https://erratique.ch/software/uuidm/releases/uuidm-${version}.tbz";
-    sha256 = "sha256-/GZbkJVDQu1UY8SliK282kUWAVMfOnpQadUlRT/tJrM=";
+    hash = {
+      "0.9.9" = "sha256-jOgNF05dpoU/XQEefSZhn3zSlQ1BA1b/U4Ib9j2mvFo=";
+      "0.9.8" = "sha256-/GZbkJVDQu1UY8SliK282kUWAVMfOnpQadUlRT/tJrM=";
+    }."${version}";
   };
 
-  postPatch = ''
-    substituteInPlace pkg/META --replace "bytes" ""
-  '';
-
   strictDeps = true;
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index 306dd1aff433..21d831c9e24e 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.9.4";
+  version = "0.9.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone";
     rev = "refs/tags/${version}";
-    hash = "sha256-dcYp5lMN5twK1HQK/3PhBQ4nm/NKURC0x14ozkbzJ5A=";
+    hash = "sha256-LFMHueSz0ddZNYUL0uuC91dw1ppYcdE/EjKX0ikc+J0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/breathe/default.nix b/pkgs/development/python-modules/breathe/default.nix
index 4564364bfe5e..27fef0c6a5b9 100644
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@@ -46,6 +46,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # tests fail with sphinx 7.4.x
+    "tests/test_renderer.py"
+  ];
+
   pythonImportsCheck = [ "breathe" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/flask-mail/default.nix b/pkgs/development/python-modules/flask-mail/default.nix
index 104d6f3da2b0..0f1e4e227e6b 100644
--- a/pkgs/development/python-modules/flask-mail/default.nix
+++ b/pkgs/development/python-modules/flask-mail/default.nix
@@ -31,6 +31,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # Broken by fix for CVE-2023-27043.
+    # Reported upstream in https://github.com/pallets-eco/flask-mail/issues/233
+    "test_unicode_sender_tuple"
+    "test_unicode_sender"
+  ];
+
   meta = {
     description = "Flask extension providing simple email sending capabilities";
     homepage = "https://github.com/pallets-eco/flask-mail";
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index fc288114c374..c289b781a598 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.12.2";
+  version = "1.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "home-assistant-bluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WAsgiOmYqmt/PCKp+vZA2To95YZAgnYCF8ysCn5N9nc=";
+    hash = "sha256-+2bw4im09TyjJ5/7ct42ZCFwU7yKWQnbSo7b+44VtpE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyblu/default.nix b/pkgs/development/python-modules/pyblu/default.nix
index 867ca8ba31cb..c149661969ea 100644
--- a/pkgs/development/python-modules/pyblu/default.nix
+++ b/pkgs/development/python-modules/pyblu/default.nix
@@ -12,16 +12,18 @@
 
 buildPythonPackage rec {
   pname = "pyblu";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LouisChrist";
     repo = "pyblu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1H7TqFPVstB+nCYwWOT8E2HcmkLQx9pekBq2WIAf8DQ=";
+    hash = "sha256-BDuptBC72XG+q/5MlbPMjYDIhWKg4gfEo2pLOflwQaM=";
   };
 
+  pythonRelaxDeps = [ "aiohttp" ];
+
   build-system = [ poetry-core ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/solarlog-cli/default.nix b/pkgs/development/python-modules/solarlog-cli/default.nix
index ef88f6db9363..b82b69d8c2f0 100644
--- a/pkgs/development/python-modules/solarlog-cli/default.nix
+++ b/pkgs/development/python-modules/solarlog-cli/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "solarlog-cli";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dontinelli";
     repo = "solarlog_cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-67ZEval+cRvjFhQynFVYf5FFDw+zWrAfSC/2d6X+oh4=";
+    hash = "sha256-Oa2o4fuchW3ROtQFVhiWL6rhdUbzSFDegCkm8W7bCpE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index fcae826816fb..63ed58fca0b9 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -19,6 +19,7 @@
   paramiko,
   pbr,
   prettytable,
+  pynacl,
   python,
   pythonOlder,
   pyyaml,
@@ -74,6 +75,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     hacking
     oslotest
+    pynacl
     stestr
   ];
 
diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index c404bed3418d..a991bce5abc4 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -13,13 +13,13 @@
 # function correctly.
 rustPlatform.buildRustPackage rec {
   pname = "prisma-engines";
-  version = "5.21.0";
+  version = "5.21.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
     rev = version;
-    hash = "sha256-X5aBrnyZ/tMykJFifyY1LeR/nShBlxm9HazVE0L7RJk=";
+    hash = "sha256-zVGnAFvxBRh7YGXET8YjDI+qXay6StgG618mRfpc4kw=";
   };
 
   # Use system openssl.
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 58dbbd5cc0a1..8fe00f2433a4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.10.2";
+  version = "2024.10.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 9f19d8736a02..d0bc0fbc8b08 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -425,7 +425,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.10.2";
+  hassVersion = "2024.10.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -443,13 +443,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-YHK6SJJok1FGtFfD2C2QFCtWzNK1ZiOGZe/kbQFkMvU=";
+    hash = "sha256-kxxa7FI2wIpE3bEifNyjtEHj7rsuImQvxGd6I46ySqM=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-mVKokL6EcvLMvOEKIw1dlEQeXaxMLO8ExMOzw6r1eCs=";
+    hash = "sha256-DhDdCvov5/Yf2MnY2veV8W/lYk3LTDzxYpbAsbjxWcg=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 529200dd1f16..d2b4fc16d436 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -9,7 +9,7 @@
 # TODO: Go back to using buildGoModule when upgrading to grafana 11.3.
 buildGo122Module rec {
   pname = "grafana";
-  version = "11.2.2";
+  version = "11.2.2+security-01";
 
   subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];
 
@@ -17,7 +17,7 @@ buildGo122Module rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-rELvOqKVf/Dmh38fxvvFzNM9zRQF9J8OyidXJvuubzs=";
+    hash = "sha256-1ZDX0R3t6CAdIfrYfR373olGL5orSDs2iwriAszl7qk=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index a63ee485fec7..3468ae8b5a4b 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -71,8 +71,8 @@ in
   };
 
   nextcloud30 = generic {
-    version = "30.0.0";
-    hash = "sha256-GNeoCVe7U+lPsESS9rUhNDTdo+naEtn3iZl2h8hWTmA=";
+    version = "30.0.1";
+    hash = "sha256-eewv+tYjG9j8xKuqzBLlrFHmcNCJr/s3lINZLNoP3Ms=";
     packages = nextcloud30Packages;
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 09486e784ec7..520edc153546 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13085,8 +13085,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  russ = callPackage ../applications/networking/feedreaders/russ { };
-
   tunnelto = callPackage ../tools/networking/tunnelto {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -30250,10 +30248,6 @@ with pkgs;
 
   imgp = python3Packages.callPackage ../applications/graphics/imgp { };
 
-  imhex = callPackage ../by-name/im/imhex/package.nix {
-    llvm = llvm_17;
-  };
-
   inframap = callPackage ../applications/networking/cluster/inframap { };
 
   inkcut = libsForQt5.callPackage ../applications/misc/inkcut { };