diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 45503ef89aaa..94ff838b50e0 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -368,6 +368,15 @@ in {
                     '';
                   };
 
+                  type = mkOption {
+                    type = types.enum [ "sendreceive" "sendonly" "receiveonly" "receiveencrypted" ];
+                    default = "sendreceive";
+                    description = ''
+                      Controls how the folder is handled by Syncthing.
+                      See <https://docs.syncthing.net/users/config.html#config-option-folder.type>.
+                    '';
+                  };
+
                   devices = mkOption {
                     type = types.listOf types.str;
                     default = [];
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 504aa3377e33..575b93651312 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,8 +1,8 @@
 {
-  "packageVersion": "130.0-1",
+  "packageVersion": "130.0-3",
   "source": {
-    "rev": "130.0-1",
-    "sha256": "1ynw6hzyvyv02a1y838w4jkq0a8yg95c0zs7q0bdxca5grw154qi"
+    "rev": "130.0-3",
+    "sha256": "0ah6k4637fg3v3l13rk6bw6wxsx0mc41hvi9sld5psbl8l2kyk29"
   },
   "firefox": {
     "version": "130.0",
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 7272542ea1de..cde497d8f8f8 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "6.9.3447.37";
+  version = "6.9.3447.41";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-kYTnWad/jrJt9z+AhjXzHYxVSIwIIO3RKD7szuPEg2s=";
-      x86_64-linux = "sha256-+h7SHci8gZ+epKFHD0PiXyME2xT+loD2KXpJGFCfIFg=";
+      aarch64-linux = "sha256-Up2n7G3vatsQC9JKF1A1jAIBbdWm9UhL/75AXuxDCsg=";
+      x86_64-linux = "sha256-Hcd8W8bDlRUT/zPYP+aiJnUmepS38KuK0wRFYB3uW1Y=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix b/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
deleted file mode 100644
index c7d03c0087b3..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  k3sVersion = "1.27.14+k3s1";
-  k3sCommit = "b0b34e4d927369147a37f95ee8ba6441e4b4102b";
-  k3sRepoSha256 = "0vvglvh8hl83jrpn9i2fgbck6cp7fbbwn292w76nmckmpclm47ap";
-  k3sVendorHash = "sha256-eDzBpvaK1rHp28A5zvSsxnk0CNhy4oBSifBT98M7JWc=";
-  chartVersions = import ./chart-versions.nix;
-  k3sRootVersion = "0.12.2";
-  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
-  k3sCNIVersion = "1.4.0-k3s2";
-  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.15-k3s1.27";
-  containerdSha256 = "0bjxw174prhq8izmgrmpyljfxzrj0lh5d0w04g3lyn0rp3kwxqsl";
-  criCtlVersion = "1.26.0-rc.0-k3s1";
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
index cd699dd50858..4da2bb4fcec7 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.28.12+k3s1";
-  k3sCommit = "4717e2a58e04f0ba3d9f43d574a7eff01dea9146";
-  k3sRepoSha256 = "02wywlqqna0dj9cam6q3ykb3p5mi96f6lclrg5yhjky7jdvkffds";
-  k3sVendorHash = "sha256-RyUlaGQnfrCm4cB5FRs9IAeF+zn4LzAXmIViU3o30Z4=";
+  k3sVersion = "1.28.13+k3s1";
+  k3sCommit = "47737e1c4c941325574e8aa14e4a3af2e596f696";
+  k3sRepoSha256 = "1x66n36lxcvi5d9bdz0f1w2p24493rh3vbk1pskqd1f3v3fbv7kn";
+  k3sVendorHash = "sha256-/knBr0l7dZ6lX9QpohyPNrFEi4WQpNM01zOE5bCIB2E=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.14.0";
   k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.17-k3s1.28";
-  containerdSha256 = "0nhhx932j551ran3kkvyp4nmsg5c71mq0g6jrcbs2j4nn7yqdkhm";
+  containerdVersion = "1.7.20-k3s2.28";
+  containerdSha256 = "0jqqa9202d94qd7g8d5zy161snlsc42cdjpmp50w4j3pnp2i1cki";
   criCtlVersion = "1.26.0-rc.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
index e5b95f433547..e348845ac246 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.29.7+k3s1";
-  k3sCommit = "f246bbc390a05f45431e49617b58013fe06a460d";
-  k3sRepoSha256 = "0fv628rxxavqmb2gv0ncsx4m8ghn3v6ddn2n06x8q4ar27d9gijg";
-  k3sVendorHash = "sha256-pAOyGgEaO6ewNv+6yhDt83NZl95rmLseFUs4vlXNH6Q=";
+  k3sVersion = "1.29.8+k3s1";
+  k3sCommit = "33fdc35dd67cf6c07989327e992fd26ed89b2449";
+  k3sRepoSha256 = "0ky5f039nkhdj6y5v9yr6lk875l29c67j6kqc2dzdb3iqbwskcbr";
+  k3sVendorHash = "sha256-VxVGBvpeKf/nuw09Llf85d4P8oCD2GvD1f0Mxt6fMj8=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.14.0";
   k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.17-k3s1";
-  containerdSha256 = "1j61mbgx346ydvnjd8b07wf7nmvvplx28wi5jjdzi1k688r2hxpf";
+  containerdVersion = "1.7.20-k3s1";
+  containerdSha256 = "12ihr3z8vcglv5b0v9ris29zkkkdvjbcp3bf7ym71a0xdbg83s8i";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
index 603703cd6cc6..a7909c3c28e8 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.30.3+k3s1";
-  k3sCommit = "f646604010affc6a1d3233a8a0870bca46bf80cf";
-  k3sRepoSha256 = "1sqa4cx5rihrqcnriq7if7sm4hx73ma975yyr5k9nvhg71dvlig3";
-  k3sVendorHash = "sha256-HMlYdWDUoELpwsfCtyCxVIcFULdvu5gna83lc79AUWc=";
+  k3sVersion = "1.30.4+k3s1";
+  k3sCommit = "98262b5dee29fe5ac849a0cef90b5d50292b020b";
+  k3sRepoSha256 = "1iwg7j0divbh41dx40kz69qkvscvppqb37dqvxayw3ha1yja4sq6";
+  k3sVendorHash = "sha256-EovTZ3DvDqWFR9vxhtjgcZcPXVk1C0PYNCxEV5XA6wg=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.14.0";
   k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.17-k3s1";
-  containerdSha256 = "1j61mbgx346ydvnjd8b07wf7nmvvplx28wi5jjdzi1k688r2hxpf";
+  containerdVersion = "1.7.20-k3s1";
+  containerdSha256 = "12ihr3z8vcglv5b0v9ris29zkkkdvjbcp3bf7ym71a0xdbg83s8i";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix
similarity index 100%
rename from pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
rename to pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
new file mode 100644
index 000000000000..c179bd870873
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
@@ -0,0 +1,14 @@
+{
+  k3sVersion = "1.31.0+k3s1";
+  k3sCommit = "34be6d96d17d8d65fda86272b62b752cb0e9c45e";
+  k3sRepoSha256 = "16yzsx56jmca07jdnzjvy4pcfrvvibv987l1mzdaws1vkm3xqfnw";
+  k3sVendorHash = "sha256-1uYlvGkW6n4aiUVX/2OjppczdobY/fk1ZaK6j3AEwvM=";
+  chartVersions = import ./chart-versions.nix;
+  k3sRootVersion = "0.14.0";
+  k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
+  k3sCNIVersion = "1.4.0-k3s2";
+  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
+  containerdVersion = "1.7.20-k3s1";
+  containerdSha256 = "12ihr3z8vcglv5b0v9ris29zkkkdvjbcp3bf7ym71a0xdbg83s8i";
+  criCtlVersion = "1.31.0-k3s2";
+}
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index e3f8020cbaa0..4fe0c00c086f 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -180,7 +180,7 @@ let
     sed --quiet '/# --- run the install process --/q;p' ${k3sRepo}/install.sh > install.sh
 
     # Let killall expect "containerd-shim" in the Nix store
-    to_replace="k3s/data/\[\^/\]\*/bin/containerd-shim"
+    to_replace="/data/\[\^/\]\*/bin/containerd-shim"
     replacement="/nix/store/.*k3s-containerd.*/bin/containerd-shim"
     changes=$(sed -i "s|$to_replace|$replacement| w /dev/stdout" install.sh)
     if [ -z "$changes" ]; then
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 6e7cfb0d1325..59fd6b1be344 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -12,17 +12,6 @@ let
   extraArgs = builtins.removeAttrs args [ "callPackage" ];
 in
 {
-  # 1_27 can be built with the same builder as 1_30
-  k3s_1_27 = common (
-    (import ./1_27/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "27"
-      ];
-    }
-  ) extraArgs;
-
   # 1_28 can be built with the same builder as 1_30
   k3s_1_28 = common (
     (import ./1_28/versions.nix)
@@ -54,4 +43,14 @@ in
       ];
     }
   ) extraArgs;
+
+  k3s_1_31 = common (
+    (import ./1_31/versions.nix)
+    // {
+      updateScript = [
+        ./update-script.sh
+        "31"
+      ];
+    }
+  ) extraArgs;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/update-script.sh b/pkgs/applications/networking/cluster/k3s/update-script.sh
index ca7d21bff478..e2fa6a4b1e2b 100755
--- a/pkgs/applications/networking/cluster/k3s/update-script.sh
+++ b/pkgs/applications/networking/cluster/k3s/update-script.sh
@@ -89,7 +89,13 @@ CONTAINERD_VERSION=$(grep github.com/containerd/containerd ${FILE_GO_MOD} \
 CONTAINERD_SHA256=$(nix-prefetch-url --quiet --unpack \
     "https://github.com/k3s-io/containerd/archive/refs/tags/v${CONTAINERD_VERSION}.tar.gz")
 
-CRI_CTL_VERSION=$(grep github.com/kubernetes-sigs/cri-tools ${FILE_GO_MOD} \
+# The repository of "cri-tools" changes for 1.31.x, this can likely be removed in future releases
+if [ "$MINOR_VERSION" -gt 30 ]; then
+    CRI_CTL_REPO=sigs.k8s.io
+else
+    CRI_CTL_REPO=github.com/kubernetes-sigs
+fi
+CRI_CTL_VERSION=$(grep "$CRI_CTL_REPO/cri-tools" ${FILE_GO_MOD} \
     | head -n1 | awk '{print $4}' | sed -e 's/"//g' -e 's/^v//')
 
 setKV () {
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 5e3eda6c00b1..cc6ab2bf9b8f 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -164,11 +164,11 @@ let
 
   linux = stdenv.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "128.0.6613.113";
+    version = "128.0.6613.137";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-jdgZFmkPZwNt+4nb6/4ahCM4jNEKUkIfaI9MqOcjHys=";
+      hash = "sha256-Ggah8tabckPemWtKehx8So1Y55J0UdhAFf5rPRSwV6Q=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -258,11 +258,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "128.0.6613.114";
+    version = "128.0.6613.138";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/j7qfyaczqq4hpgxunewwclxnky_128.0.6613.114/GoogleChrome-128.0.6613.114.dmg";
-      hash = "sha256-6y99T+9abmUS9wKglNgPgj9M/cyLxb85rxpgCLxXR3E=";
+      url = "http://dl.google.com/release2/chrome/gtm24cqmnwgcp7dtscvlmsbrwa_128.0.6613.138/GoogleChrome-128.0.6613.138.dmg";
+      hash = "sha256-wd6n3AeKxKdz+5X9XxTi1QHzmByzKRgIWcc3iBHhtZs=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/je/jellyfin-web/package.nix b/pkgs/by-name/je/jellyfin-web/package.nix
index e61aa25d1a2e..c1f81ee3f2f5 100644
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@@ -27,7 +27,7 @@ let
 in
 buildNpmPackage' rec {
   pname = "jellyfin-web";
-  version = "10.9.10";
+  version = "10.9.11";
 
   src =
     assert version == jellyfin.version;
@@ -35,10 +35,10 @@ buildNpmPackage' rec {
       owner = "jellyfin";
       repo = "jellyfin-web";
       rev = "v${version}";
-      hash = "sha256-6t/kCuMbSug1q1EdQFAMqf/sWa+LAO46OUG0FL84UiE=";
+      hash = "sha256-zt0Exx/4B5gqiN3fxvQuVh1MqRNNtJG6/G0/reqVHRc=";
     };
 
-  npmDepsHash = "sha256-R4myooMkKdvOFvyNqKIlZ2GozNOkg8YNTvomkt4aRIU=";
+  npmDepsHash = "sha256-kQxfh8o8NBshKmmjQrLdxiOQK83LG+lxhZwzDkEJwEo=";
 
   npmBuildScript = [ "build:production" ];
 
diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index c62a917a7465..f607c5d98c5d 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.9.10"; # ensure that jellyfin-web has matching version
+  version = "10.9.11"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "sha256-tkSQ7BKic/MD7xcvAPHeFb/RDz++KTLhmAzR4cv1q10=";
+    sha256 = "sha256-gZJIsNKXwhUUVgJh8vXuGSu9DEyrVY8NuIeyZHHQKN4=";
   };
 
   propagatedBuildInputs = [ sqlite ];
diff --git a/pkgs/development/compilers/jwasm/default.nix b/pkgs/development/compilers/jwasm/default.nix
index fa004bca3117..faaeae431e85 100644
--- a/pkgs/development/compilers/jwasm/default.nix
+++ b/pkgs/development/compilers/jwasm/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "/usr/local/bin" "${placeholder "out"}/bin"
   '';
 
+  preInstall = ''
+    mkdir -p ${placeholder "out"}/bin
+  '';
+
   postInstall = ''
     install -Dpm644 $src/Html/License.html \
                     $src/Html/Manual.html \
@@ -35,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/Baron-von-Riedesel/JWasm/";
     description = "A MASM-compatible x86 assembler";
     changelog = "https://github.com/Baron-von-Riedesel/JWasm/releases/tag/v${finalAttrs.version}";
+    mainProgram = "jwasm";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index c8dd213ae9f3..6b0f32253ab5 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -50,14 +50,14 @@ in {
   };
 
   nextcloud28 = generic {
-    version = "28.0.9";
-    hash = "sha256-DZd3NkDn+A6gqTP7+L0pe/JB2ghy+hzFQ1D/F5Nmmxs=";
+    version = "28.0.10";
+    hash = "sha256-LoAVJtKJHBhf6sWYXL084pLOcKQl9Tb5GfkBuftMwhA=";
     packages = nextcloud28Packages;
   };
 
   nextcloud29 = generic {
-    version = "29.0.6";
-    hash = "sha256-3GC+A/0X4wuv7ypNT+stCWqnekxrTyHJhXYOU3+EAeM=";
+    version = "29.0.7";
+    hash = "sha256-9TL/wxvlqDdLXgcrhv/4dl7Bn9oMhQnO45hzCB2yxUQ=";
     packages = nextcloud29Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json
index 02767b06046a..9b2342d52033 100644
--- a/pkgs/servers/nextcloud/packages/28.json
+++ b/pkgs/servers/nextcloud/packages/28.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "hash": "sha256-jByO7cJ9oQ4lQopzXCii11wqhg9tIlm/AFFViH+P3O0=",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.4/bookmarks-14.2.4.tar.gz",
-    "version": "14.2.4",
+    "hash": "sha256-ZWdz7Hl3wrTEHrXdOsPKRcE5GAnHYHjudbY5F0VjG4Y=",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.5/bookmarks-14.2.5.tar.gz",
+    "version": "14.2.5",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users and via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -90,10 +90,10 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-AMhhpzznCMW6vHc5vHkP4/wWY+NcqSvB/ZTVj2U6peM=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.8/groupfolders-v16.0.8.tar.gz",
-    "version": "16.0.8",
-    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
+    "hash": "sha256-PtxAidIono2roSVA/VLQZ13TVcqWZL069eXpY+npFB8=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.9/groupfolders-v16.0.9.tar.gz",
+    "version": "16.0.9",
+    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
       "agpl"
@@ -150,10 +150,10 @@
     ]
   },
   "music": {
-    "hash": "sha256-RnTyQYCbmkHDZhtonpvbKLUM3n93u53IhknyTrNGh9Y=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz",
-    "version": "2.0.0",
-    "description": "A stand-alone music player app and a \"lite\" player for the Files app\r\n\r\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\r\n- Playlist support with import from m3u, m3u8, and pls files\r\n- Browse by artists, albums, genres, or folders\r\n- Gapless play\r\n- Filter the shown content with the search function\r\n- Play internet radio and podcast channels\r\n- Setup Last.fm connection to see background information on artists, albums, and songs\r\n- Control with media control keys on the keyboard or OS\r\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\r\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
+    "hash": "sha256-yexffDYu0dv/i/V0Z+U1jD1+6X/JZuWZ4/mqWny5Nxs=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.0.1/music_2.0.1_for_nextcloud.tar.gz",
+    "version": "2.0.1",
+    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
     "homepage": "https://github.com/owncloud/music",
     "licenses": [
       "agpl"
@@ -200,9 +200,9 @@
     ]
   },
   "polls": {
-    "hash": "sha256-tSnR5O+OCYjoPoh2/WX3ntCagw9xanmxCR+DaMnAhJA=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.1/polls-v7.2.1.tar.gz",
-    "version": "7.2.1",
+    "hash": "sha256-TBCNr57MKEe8OSXEqWohZH9zuCwFTMDnwnZ1nFZ+FWY=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.2/polls-v7.2.2.tar.gz",
+    "version": "7.2.2",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -300,9 +300,9 @@
     ]
   },
   "unsplash": {
-    "hash": "sha256-xfu5m5VOZZ9ATnRg44sw/MTEXitrDFCuAcm+siNilsY=",
-    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.0/unsplash.tar.gz",
-    "version": "3.0.0",
+    "hash": "sha256-kNDQk4HYkrBA+o+5/bNYj65ZJbViBjhnbSA87tsu6YE=",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.1/unsplash.tar.gz",
+    "version": "3.0.1",
     "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
     "homepage": "https://github.com/nextcloud/unsplash/",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index ccb2166ed738..419b434a8453 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "hash": "sha256-jByO7cJ9oQ4lQopzXCii11wqhg9tIlm/AFFViH+P3O0=",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.4/bookmarks-14.2.4.tar.gz",
-    "version": "14.2.4",
+    "hash": "sha256-ZWdz7Hl3wrTEHrXdOsPKRcE5GAnHYHjudbY5F0VjG4Y=",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.5/bookmarks-14.2.5.tar.gz",
+    "version": "14.2.5",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users and via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -90,10 +90,10 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-cWWlvuUTO4B89CDZzfJLN8MRmQwPMwj0OwFqhIUxAsQ=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v17.0.2/groupfolders-v17.0.2.tar.gz",
-    "version": "17.0.2",
-    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
+    "hash": "sha256-fdFxsUwXM8nqb7m4pWtQVGq0SLf0zWBuyxFrzppevYI=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v17.0.3/groupfolders-v17.0.3.tar.gz",
+    "version": "17.0.3",
+    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
       "agpl"
@@ -130,8 +130,8 @@
     ]
   },
   "maps": {
-    "hash": "sha256-FmRhpPRpMnCHkJFaVvQuR6Y7Pd7vpP+tUVih919g/fQ=",
-    "url": "https://github.com/nextcloud/maps/releases/download/v1.4.0-1-nightly/maps-1.4.0-1-nightly.tar.gz",
+    "hash": "sha256-BmXs6Oepwnm+Cviy4awm3S8P9AiJTt1BnAQNb4TxVYE=",
+    "url": "https://github.com/nextcloud/maps/releases/download/v1.4.0/maps-1.4.0.tar.gz",
     "version": "1.4.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
     "homepage": "https://github.com/nextcloud/maps",
@@ -150,10 +150,10 @@
     ]
   },
   "music": {
-    "hash": "sha256-RnTyQYCbmkHDZhtonpvbKLUM3n93u53IhknyTrNGh9Y=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz",
-    "version": "2.0.0",
-    "description": "A stand-alone music player app and a \"lite\" player for the Files app\r\n\r\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\r\n- Playlist support with import from m3u, m3u8, and pls files\r\n- Browse by artists, albums, genres, or folders\r\n- Gapless play\r\n- Filter the shown content with the search function\r\n- Play internet radio and podcast channels\r\n- Setup Last.fm connection to see background information on artists, albums, and songs\r\n- Control with media control keys on the keyboard or OS\r\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\r\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
+    "hash": "sha256-yexffDYu0dv/i/V0Z+U1jD1+6X/JZuWZ4/mqWny5Nxs=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.0.1/music_2.0.1_for_nextcloud.tar.gz",
+    "version": "2.0.1",
+    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
     "homepage": "https://github.com/owncloud/music",
     "licenses": [
       "agpl"
@@ -200,9 +200,9 @@
     ]
   },
   "polls": {
-    "hash": "sha256-tSnR5O+OCYjoPoh2/WX3ntCagw9xanmxCR+DaMnAhJA=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.1/polls-v7.2.1.tar.gz",
-    "version": "7.2.1",
+    "hash": "sha256-TBCNr57MKEe8OSXEqWohZH9zuCwFTMDnwnZ1nFZ+FWY=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.2/polls-v7.2.2.tar.gz",
+    "version": "7.2.2",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -240,9 +240,9 @@
     ]
   },
   "richdocuments": {
-    "hash": "sha256-kAY1Y4PB7AIFWNx+Yi1ovZopGEER/r5RveIlS/y6Veo=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.5/richdocuments-v8.4.5.tar.gz",
-    "version": "8.4.5",
+    "hash": "sha256-S1ORUIx+rcA4UUFmPX4KiLakzPPIqvVmcABDuNX0tys=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.6/richdocuments-v8.4.6.tar.gz",
+    "version": "8.4.6",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
     "homepage": "https://collaboraoffice.com/",
     "licenses": [
@@ -250,9 +250,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-/WD/UAtuLYdtZjBNIur2qRaPNXGTG1lfPTOlJpZfyCI=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.8/spreed-v19.0.8.tar.gz",
-    "version": "19.0.8",
+    "hash": "sha256-cZYE528jSNnPFgJSnqosoPyo/7V3zdUAIxnFpcOuvh4=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.9/spreed-v19.0.9.tar.gz",
+    "version": "19.0.9",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -299,6 +299,16 @@
       "agpl"
     ]
   },
+  "unsplash": {
+    "hash": "sha256-kNDQk4HYkrBA+o+5/bNYj65ZJbViBjhnbSA87tsu6YE=",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.1/unsplash.tar.gz",
+    "version": "3.0.1",
+    "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
+    "homepage": "https://github.com/nextcloud/unsplash/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
     "hash": "sha256-8e4xQjOWSVAps6dg4jvN3MGVSOhaOgjPHPpTOgXKFJY=",
     "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v6.0.1/user_oidc-v6.0.1.tar.gz",
diff --git a/pkgs/tools/networking/curl/CVE-2024-8096.patch b/pkgs/tools/networking/curl/CVE-2024-8096.patch
new file mode 100644
index 000000000000..0f780f08c326
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2024-8096.patch
@@ -0,0 +1,200 @@
+From aeb1a281cab13c7ba791cb104e556b20e713941f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 20 Aug 2024 16:14:39 +0200
+Subject: [PATCH] gtls: fix OCSP stapling management
+
+Reported-by: Hiroki Kurosawa
+Closes #14642
+---
+ lib/vtls/gtls.c | 146 ++++++++++++++++++++++++------------------------
+ 1 file changed, 73 insertions(+), 73 deletions(-)
+
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index 03d6fcc038aac3..c7589d9d39bc81 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -850,6 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
+   init_flags |= GNUTLS_NO_TICKETS;
+ #endif
+ 
++#if defined(GNUTLS_NO_STATUS_REQUEST)
++  if(!config->verifystatus)
++    /* Disable the "status_request" TLS extension, enabled by default since
++       GnuTLS 3.8.0. */
++    init_flags |= GNUTLS_NO_STATUS_REQUEST;
++#endif
++
+   rc = gnutls_init(&gtls->session, init_flags);
+   if(rc != GNUTLS_E_SUCCESS) {
+     failf(data, "gnutls_init() failed: %d", rc);
+@@ -1321,104 +1328,97 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
+     infof(data, "  server certificate verification SKIPPED");
+ 
+   if(config->verifystatus) {
+-    if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
+-      gnutls_datum_t status_request;
+-      gnutls_ocsp_resp_t ocsp_resp;
++    gnutls_datum_t status_request;
++    gnutls_ocsp_resp_t ocsp_resp;
++    gnutls_ocsp_cert_status_t status;
++    gnutls_x509_crl_reason_t reason;
+ 
+-      gnutls_ocsp_cert_status_t status;
+-      gnutls_x509_crl_reason_t reason;
++    rc = gnutls_ocsp_status_request_get(session, &status_request);
+ 
+-      rc = gnutls_ocsp_status_request_get(session, &status_request);
++    if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
++      failf(data, "No OCSP response received");
++      return CURLE_SSL_INVALIDCERTSTATUS;
++    }
+ 
+-      infof(data, " server certificate status verification FAILED");
++    if(rc < 0) {
++      failf(data, "Invalid OCSP response received");
++      return CURLE_SSL_INVALIDCERTSTATUS;
++    }
+ 
+-      if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
+-        failf(data, "No OCSP response received");
+-        return CURLE_SSL_INVALIDCERTSTATUS;
+-      }
++    gnutls_ocsp_resp_init(&ocsp_resp);
+ 
+-      if(rc < 0) {
+-        failf(data, "Invalid OCSP response received");
+-        return CURLE_SSL_INVALIDCERTSTATUS;
+-      }
++    rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
++    if(rc < 0) {
++      failf(data, "Invalid OCSP response received");
++      return CURLE_SSL_INVALIDCERTSTATUS;
++    }
+ 
+-      gnutls_ocsp_resp_init(&ocsp_resp);
++    (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
++                                      &status, NULL, NULL, NULL, &reason);
+ 
+-      rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
+-      if(rc < 0) {
+-        failf(data, "Invalid OCSP response received");
+-        return CURLE_SSL_INVALIDCERTSTATUS;
+-      }
++    switch(status) {
++    case GNUTLS_OCSP_CERT_GOOD:
++      break;
+ 
+-      (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
+-                                        &status, NULL, NULL, NULL, &reason);
++    case GNUTLS_OCSP_CERT_REVOKED: {
++      const char *crl_reason;
+ 
+-      switch(status) {
+-      case GNUTLS_OCSP_CERT_GOOD:
++      switch(reason) {
++      default:
++      case GNUTLS_X509_CRLREASON_UNSPECIFIED:
++        crl_reason = "unspecified reason";
+         break;
+ 
+-      case GNUTLS_OCSP_CERT_REVOKED: {
+-        const char *crl_reason;
+-
+-        switch(reason) {
+-          default:
+-          case GNUTLS_X509_CRLREASON_UNSPECIFIED:
+-            crl_reason = "unspecified reason";
+-            break;
+-
+-          case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
+-            crl_reason = "private key compromised";
+-            break;
+-
+-          case GNUTLS_X509_CRLREASON_CACOMPROMISE:
+-            crl_reason = "CA compromised";
+-            break;
+-
+-          case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
+-            crl_reason = "affiliation has changed";
+-            break;
++      case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
++        crl_reason = "private key compromised";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_SUPERSEDED:
+-            crl_reason = "certificate superseded";
+-            break;
++      case GNUTLS_X509_CRLREASON_CACOMPROMISE:
++        crl_reason = "CA compromised";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
+-            crl_reason = "operation has ceased";
+-            break;
++      case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
++        crl_reason = "affiliation has changed";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
+-            crl_reason = "certificate is on hold";
+-            break;
++      case GNUTLS_X509_CRLREASON_SUPERSEDED:
++        crl_reason = "certificate superseded";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
+-            crl_reason = "will be removed from delta CRL";
+-            break;
++      case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
++        crl_reason = "operation has ceased";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
+-            crl_reason = "privilege withdrawn";
+-            break;
++      case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
++        crl_reason = "certificate is on hold";
++        break;
+ 
+-          case GNUTLS_X509_CRLREASON_AACOMPROMISE:
+-            crl_reason = "AA compromised";
+-            break;
+-        }
++      case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
++        crl_reason = "will be removed from delta CRL";
++        break;
+ 
+-        failf(data, "Server certificate was revoked: %s", crl_reason);
++      case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
++        crl_reason = "privilege withdrawn";
+         break;
+-      }
+ 
+-      default:
+-      case GNUTLS_OCSP_CERT_UNKNOWN:
+-        failf(data, "Server certificate status is unknown");
++      case GNUTLS_X509_CRLREASON_AACOMPROMISE:
++        crl_reason = "AA compromised";
+         break;
+       }
+ 
+-      gnutls_ocsp_resp_deinit(ocsp_resp);
++      failf(data, "Server certificate was revoked: %s", crl_reason);
++      break;
++    }
+ 
+-      return CURLE_SSL_INVALIDCERTSTATUS;
++    default:
++    case GNUTLS_OCSP_CERT_UNKNOWN:
++      failf(data, "Server certificate status is unknown");
++      break;
+     }
+-    else
+-      infof(data, "  server certificate status verification OK");
++
++    gnutls_ocsp_resp_deinit(ocsp_resp);
++    if(status != GNUTLS_OCSP_CERT_GOOD)
++      return CURLE_SSL_INVALIDCERTSTATUS;
+   }
+   else
+     infof(data, "  server certificate status verification SKIPPED");
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 81fd1c7c124d..0eced61b533f 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -66,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # https://curl.se/docs/CVE-2024-6197.html
     ./0001-x509asn1-remove-superfluous-free.patch
+  ] ++ lib.optionals gnutlsSupport [
+    # https://curl.se/docs/CVE-2024-8096.html
+    ./CVE-2024-8096.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 56e9c9eee723..b0fb07ba1741 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -598,6 +598,7 @@ mapAliases ({
   k3s_1_24 = throw "'k3s_1_24' has been removed from nixpkgs as it has reached end of life"; # Added 2024-03-14
   k3s_1_25 = throw "'k3s_1_25' has been removed from nixpkgs as it has reached end of life"; # Added 2024-03-14
   k3s_1_26 = throw "'k3s_1_26' has been removed from nixpkgs as it has reached end of life"; # Added 2024-05-20
+  k3s_1_27 = throw "'k3s_1_27' has been removed from nixpkgs as it has reached end of life on 2024-06-28"; # Added 2024-09-06
   # k3d was a 3d editing software k-3d - "k3d has been removed because it was broken and has seen no release since 2016" Added 2022-01-04
   # now kube3d/k3d will take it's place
   kube3d = k3d; # Added 2022-0705
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 64cb8112da81..512c0534e0f8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32025,14 +32025,12 @@ with pkgs;
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
 
-  inherit (callPackage ../applications/networking/cluster/k3s {
-    buildGoModule = buildGo121Module;
-    go = go_1_21;
-  }) k3s_1_27 k3s_1_28 k3s_1_29;
-  inherit (callPackage ../applications/networking/cluster/k3s {
-    buildGoModule = buildGo122Module;
-    go = go_1_22;
-  }) k3s_1_30;
+  inherit (callPackage ../applications/networking/cluster/k3s { })
+    k3s_1_28
+    k3s_1_29
+    k3s_1_30
+    k3s_1_31
+    ;
   k3s = k3s_1_30;
 
   k3sup = callPackage ../applications/networking/cluster/k3sup { };