diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 000000000000..18afce75372b
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,12 @@
+{
+  "name": "nixpkgs",
+  "image": "mcr.microsoft.com/devcontainers/universal:2-linux",
+  "features": {
+    "ghcr.io/devcontainers/features/nix:1": {
+      "multiUser": false
+    }
+  },
+  "remoteEnv": {
+    "NIXPKGS": "/workspaces/nixpkgs"
+  }
+}
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 83d95e0b8bff..1028b64a9176 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -20,6 +20,7 @@ permissions:
 
 jobs:
   periodic-merge:
+    if: github.repository_owner == 'NixOS'
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index c540840c0a13..9d72539dd02e 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -20,6 +20,7 @@ permissions:
 
 jobs:
   periodic-merge:
+    if: github.repository_owner == 'NixOS'
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index cd674fd582d6..e8307308218c 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -14,7 +14,6 @@ on:
 
 jobs:
   merge:
-    if: github.repository_owner == 'NixOS'
     runs-on: ubuntu-24.04
     name: ${{ inputs.from }} → ${{ inputs.into }}
     steps:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b94571d61947..27b26e58b804 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23202,6 +23202,12 @@
     githubId = 178444;
     name = "Thomas Bereknyei";
   };
+  tombert = {
+    email = "thomas@gebert.app";
+    github = "tombert";
+    githubId = 2027925;
+    name = "Thomas Gebert";
+  };
   tomfitzhenry = {
     email = "tom@tom-fitzhenry.me.uk";
     github = "tomfitzhenry";
diff --git a/nixos/modules/services/networking/strongswan-swanctl/module.nix b/nixos/modules/services/networking/strongswan-swanctl/module.nix
index e6b5f6ffdeaf..22a219bd8985 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/module.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/module.nix
@@ -42,6 +42,7 @@ in  {
     ];
 
     environment.etc."swanctl/swanctl.conf".source = configFile;
+    environment.etc."strongswan.conf".text = cfg.strongswan.extraConfig;
 
     # The swanctl command complains when the following directories don't exist:
     # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory
@@ -67,14 +68,10 @@ in  {
       wants    = [ "network-online.target" ];
       after    = [ "network-online.target" ];
       path     = with pkgs; [ kmod iproute2 iptables util-linux ];
-      environment = {
-        STRONGSWAN_CONF = pkgs.writeTextFile {
-          name = "strongswan.conf";
-          text = cfg.strongswan.extraConfig;
-        };
-        SWANCTL_DIR = "/etc/swanctl";
-      };
-      restartTriggers = [ config.environment.etc."swanctl/swanctl.conf".source ];
+      restartTriggers = [
+        config.environment.etc."swanctl/swanctl.conf".source
+        config.environment.etc."strongswan.conf".source
+      ];
       serviceConfig = {
         ExecStart     = "${cfg.package}/sbin/charon-systemd";
         Type          = "notify";
diff --git a/nixos/modules/services/security/endlessh-go.nix b/nixos/modules/services/security/endlessh-go.nix
index b8b51acc81d0..5c69d412a7d3 100644
--- a/nixos/modules/services/security/endlessh-go.nix
+++ b/nixos/modules/services/security/endlessh-go.nix
@@ -110,7 +110,13 @@ in
             );
           DynamicUser = true;
           RootDirectory = rootDirectory;
-          BindReadOnlyPaths = [ builtins.storeDir ];
+          BindReadOnlyPaths = [
+            builtins.storeDir
+            "-/etc/hosts"
+            "-/etc/localtime"
+            "-/etc/nsswitch.conf"
+            "-/etc/resolv.conf"
+          ];
           InaccessiblePaths = [ "-+${rootDirectory}" ];
           RuntimeDirectory = baseNameOf rootDirectory;
           RuntimeDirectoryMode = "700";
diff --git a/nixos/modules/services/web-apps/komga.nix b/nixos/modules/services/web-apps/komga.nix
index 5245552b2130..ed30343f1c07 100644
--- a/nixos/modules/services/web-apps/komga.nix
+++ b/nixos/modules/services/web-apps/komga.nix
@@ -8,7 +8,12 @@
 let
   cfg = config.services.komga;
   inherit (lib) mkOption mkEnableOption maintainers;
-  inherit (lib.types) port str bool;
+  inherit (lib.types)
+    port
+    str
+    bool
+    submodule
+    ;
 
   settingsFormat = pkgs.formats.yaml { };
 in
@@ -53,13 +58,14 @@ in
       };
 
       settings = lib.mkOption {
-        inherit (settingsFormat) type;
-        default = { };
-        defaultText = lib.literalExpression ''
-          {
-            server.port = 8080;
-          }
-        '';
+        type = submodule {
+          freeformType = settingsFormat.type;
+          options.server.port = mkOption {
+            type = port;
+            description = "The port that Komga will listen on.";
+            default = 8080;
+          };
+        };
         description = ''
           Komga configuration.
 
@@ -87,11 +93,7 @@ in
         }
       ];
 
-      services.komga.settings = {
-        server.port = lib.mkDefault 8080;
-      };
-
-      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.server.port ];
 
       users.groups = mkIf (cfg.group == "komga") { komga = { }; };
 
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index da486dce5eb1..ef58a5b60f9f 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -185,6 +185,10 @@ let
                     echo "reused"
                     passphrase=$(cat /crypt-ramfs/passphrase)
                     break
+                elif [ -e /dev/mapper/${dev.name} ]; then
+                    echo "opened externally"
+                    rm -f /crypt-ramfs/device
+                    return
                 else
                     # ask cryptsetup-askpass
                     echo -n "${dev.device}" > /crypt-ramfs/device
diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
index bbc55b41de22..8493793969f0 100644
--- a/pkgs/applications/audio/librespot/default.nix
+++ b/pkgs/applications/audio/librespot/default.nix
@@ -14,6 +14,8 @@
   withPulseAudio ? false,
   libpulseaudio,
   withRodio ? true,
+  withAvahi ? false,
+  avahi-compat,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -41,6 +43,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optional withALSA alsa-lib
+    ++ lib.optional withAvahi avahi-compat
     ++ lib.optional withPortAudio portaudio
     ++ lib.optional withPulseAudio libpulseaudio;
 
@@ -48,6 +51,7 @@ rustPlatform.buildRustPackage rec {
   buildFeatures =
     lib.optional withRodio "rodio-backend"
     ++ lib.optional withALSA "alsa-backend"
+    ++ lib.optional withAvahi "with-avahi"
     ++ lib.optional withPortAudio "portaudio-backend"
     ++ lib.optional withPulseAudio "pulseaudio-backend";
 
diff --git a/pkgs/applications/emulators/libretro/cores/puae.nix b/pkgs/applications/emulators/libretro/cores/puae.nix
index 07cc1c006023..aabeb76ee711 100644
--- a/pkgs/applications/emulators/libretro/cores/puae.nix
+++ b/pkgs/applications/emulators/libretro/cores/puae.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "puae";
-  version = "0-unstable-2024-10-19";
+  version = "0-unstable-2025-01-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-uae";
-    rev = "c60e42ef9ad474518d4be859b7c1da2c0c7e1d6f";
-    hash = "sha256-WCkz7BUgYaI+yRhPmNuOKGJC/GxV+n2aeJVn8vhx0Ng=";
+    rev = "67785f95db6e96dc081a2207751ab98b06b422ab";
+    hash = "sha256-jJ1yki9uPutIdAI6TBKPWjiZc7W5K9n7P/oYA/UWJf4=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/rofi/default.nix b/pkgs/applications/misc/rofi/default.nix
index 5d97aa99a513..77ba72aa871c 100644
--- a/pkgs/applications/misc/rofi/default.nix
+++ b/pkgs/applications/misc/rofi/default.nix
@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-unwrapped";
-  version = "1.7.6";
+  version = "1.7.7";
 
   src = fetchFromGitHub {
     owner = "davatorium";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-hT9FMCAwY8hZx4y1l0vHfcReIJUBxSmixZJhKP8nRpw=";
+    hash = "sha256-2rPEn+XotijqLYo2EcoiJbgdbRk4SCQ+D4jZ1gwpCQw=";
   };
 
   preConfigure = ''
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 053d26615e0b..a91aa8851efd 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.0.3495.27";
+  version = "7.0.3495.29";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-AX6PCYPpz5z9bUZqdfoTqtW9USLQRh8YgITk7DdJkUU=";
-      x86_64-linux = "sha256-pZgmRLwx64m9SwYX2cTwYEkHLYFQgIFblW9dSiYxXv8=";
+      aarch64-linux = "sha256-GdywFoaxx2VSpOJ0FJIhFcIRDJEhozCWvYvdatmEi5o=";
+      x86_64-linux = "sha256-PNSGx2oCIbB3vaNFS+7coM9Xw+2qDELJBXX8zA1UC3Q=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/qtox/default.nix b/pkgs/applications/networking/instant-messengers/qtox/default.nix
index 84b24dab2de7..70d9d9551e9a 100644
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@@ -1,17 +1,14 @@
 { lib
 , stdenv
-, mkDerivation
 , fetchFromGitHub
 , cmake
 , pkg-config
 , perl
+, kdePackages
 , libtoxcore
 , libpthreadstubs
 , libXdmcp
 , libXScrnSaver
-, qtbase
-, qtsvg
-, qttools
 , ffmpeg
 , filter-audio
 , libexif
@@ -21,28 +18,27 @@
 , openal
 , pcre
 , qrencode
+, qt6
 , sqlcipher
-, AVFoundation
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qtox";
-  version = "1.17.6";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
-    owner = "qTox";
+    owner = "TokTok";
     repo = "qTox";
-    rev = "v${version}";
-    sha256 = "sha256-naKWoodSMw0AEtACvkASFmw9t0H0d2pcqOW79NNTYF0=";
+    tag = "v${version}";
+    hash = "sha256-UgUlWeFrNoNR1ZwobfNLmDBn9/Aw4LUMeSgIfrq/uqo=";
   };
 
   buildInputs = [
+    kdePackages.sonnet
     libtoxcore
     libpthreadstubs
     libXdmcp
     libXScrnSaver
-    qtbase
-    qtsvg
     ffmpeg
     filter-audio
     libexif
@@ -52,17 +48,16 @@ mkDerivation rec {
     openal
     pcre
     qrencode
+    qt6.qtbase
+    qt6.qtsvg
     sqlcipher
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation ];
+  ];
 
-  nativeBuildInputs = [ cmake pkg-config qttools ]
+  nativeBuildInputs = [ cmake pkg-config qt6.qttools qt6.wrapQtAppsHook ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ perl ];
 
   cmakeFlags = [
     "-DGIT_DESCRIBE=v${version}"
-    "-DENABLE_STATUSNOTIFIER=False"
-    "-DENABLE_GTK_SYSTRAY=False"
-    "-DENABLE_APPINDICATOR=False"
     "-DTIMESTAMP=1"
   ];
 
diff --git a/pkgs/applications/version-management/git-cinnabar/default.nix b/pkgs/applications/version-management/git-cinnabar/default.nix
index 5a1661f1ac9d..a2419364cdec 100644
--- a/pkgs/applications/version-management/git-cinnabar/default.nix
+++ b/pkgs/applications/version-management/git-cinnabar/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  # Disable automated version-check
+  buildNoDefaultFeatures = true;
+  checkNoDefaultFeatures = true;
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index cb2a57bfb609..605bebb857a6 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -17,12 +17,12 @@
 
 let
   pname = "openshot-qt";
-  version = "3.2.1";
+  version = "3.3.0";
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "openshot-qt";
     tag = "v${version}";
-    hash = "sha256-zZZ7C/1+Qh7KS1WJ8YWkhFgw0+UHJhjk+145u9/TBcI=";
+    hash = "sha256-+QI1772ys1Czd+KSVBAdAUjLg9mUcMZs+UhkNljY7nQ=";
   };
 in
 mkDerivationWith python3.pkgs.buildPythonApplication {
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index fdb0eb33f94a..02898df4e25f 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -66,36 +66,27 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "mans" true)
   ];
 
-  buildInputs =
-    [
-      libxcb
-      xcbutilkeysyms
-      xcbutil
-      xcbutilwm
-      xcbutilxrm
-      libxkbcommon
-      libstartup_notification
-      libX11
-      pcre2
-      libev
-      yajl
-      xcb-util-cursor
-      perl
-      pango
-      perlPackages.AnyEventI3
-      perlPackages.X11XCB
-      perlPackages.IPCRun
-      perlPackages.ExtUtilsPkgConfig
-      perlPackages.InlineC
-    ]
-    ++ lib.optionals finalAttrs.doCheck [
-      xorgserver
-      xvfb-run
-      xdotool
-      xorg.setxkbmap
-      xorg.xrandr
-      which
-    ];
+  buildInputs = [
+    libxcb
+    xcbutilkeysyms
+    xcbutil
+    xcbutilwm
+    xcbutilxrm
+    libxkbcommon
+    libstartup_notification
+    libX11
+    pcre2
+    libev
+    yajl
+    xcb-util-cursor
+    perl
+    pango
+    perlPackages.AnyEventI3
+    perlPackages.X11XCB
+    perlPackages.IPCRun
+    perlPackages.ExtUtilsPkgConfig
+    perlPackages.InlineC
+  ];
 
   postPatch = ''
     patchShebangs .
@@ -111,6 +102,15 @@ stdenv.mkDerivation (finalAttrs: {
   # xvfb-run is available only on Linux
   doCheck = stdenv.hostPlatform.isLinux;
 
+  nativeCheckInputs = lib.optionals finalAttrs.doCheck [
+    xorgserver
+    xvfb-run
+    xdotool
+    xorg.setxkbmap
+    xorg.xrandr
+    which
+  ];
+
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix
index fd67cb00283f..65fa10a52e49 100644
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.74.0-57065";
+  version = "1.77.0-57419";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-muTTHJOQKY/oqGJ4OXgoyOhgAo0hW6Y12Dknq/KWTMw=";
+    hash = "sha256-euPJvD/BM0jVh3oBMsZNAZeyxTNRA4dmwIYNhwTjHoI=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/ar/ares/package.nix b/pkgs/by-name/ar/ares/package.nix
index 5e24c6d8f8fd..f712b24feb9d 100644
--- a/pkgs/by-name/ar/ares/package.nix
+++ b/pkgs/by-name/ar/ares/package.nix
@@ -13,6 +13,7 @@
   libao,
   libicns,
   libpulseaudio,
+  librashader,
   openal,
   pkg-config,
   stdenv,
@@ -24,19 +25,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ares";
-  version = "136";
+  version = "141";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Hks/MWusPiBVdb5L+53qtR6VmXG/P4rDzsvHxLeA8Do=";
+    hash = "sha256-iNcoNdGw/DfYc9tsOGsPYoZLhVwNzJe8bVotx6Rl0j4=";
   };
 
   patches = [
     ./patches/001-dont-rebuild-on-install.patch
-    ./patches/002-fix-ruby.diff
-    ./patches/003-darwin-specific.patch
   ];
 
   nativeBuildInputs =
@@ -54,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       SDL2
       libao
+      librashader
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
@@ -68,7 +68,12 @@ stdenv.mkDerivation (finalAttrs: {
       udev
     ];
 
-  appendRunpaths = [ (lib.makeLibraryPath [ vulkan-loader ]) ];
+  appendRunpaths = [
+    (lib.makeLibraryPath [
+      librashader
+      vulkan-loader
+    ])
+  ];
 
   makeFlags =
     lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/ar/ares/patches/002-fix-ruby.diff b/pkgs/by-name/ar/ares/patches/002-fix-ruby.diff
deleted file mode 100644
index ff9bda0d04b6..000000000000
--- a/pkgs/by-name/ar/ares/patches/002-fix-ruby.diff
+++ /dev/null
@@ -1,27 +0,0 @@
-diff -Naur source-old/ruby/GNUmakefile source-new/ruby/GNUmakefile
---- source-old/ruby/GNUmakefile    2024-01-23 16:12:41.009951705 +0000
-+++ source-new/ruby/GNUmakefile    2024-01-23 16:13:54.619174062 +0000
-@@ -29,20 +29,9 @@
-       ruby += input.sdl
-     endif
-   else ifeq ($(platform),linux)
--    pkg_check = $(if $(shell $(pkg_config) $1 && echo 1),$2)
--    ruby += video.glx video.glx2 video.xshm
--    ruby += $(call pkg_check,xv,video.xvideo)
--    ruby += audio.oss audio.alsa
--    ruby += $(call pkg_check,openal,audio.openal)
--    ruby += $(call pkg_check,libpulse,audio.pulseaudio)
--    ruby += $(call pkg_check,libpulse-simple,audio.pulseaudiosimple)
--    ruby += $(call pkg_check,ao,audio.ao)
--    ruby += input.xlib
--    ruby += $(call pkg_check,libudev,input.udev)
--    ifeq ($(sdl2),true)
--      ruby += $(call pkg_check,sdl2,input.sdl)
--      ruby += $(call pkg_check,sdl2,audio.sdl)
--    endif
-+    ruby += video.glx video.glx2 video.xshm video.xvideo
-+    ruby += audio.oss audio.alsa audio.openal audio.pulseaudio audio.pulseaudiosimple audio.ao
-+    ruby += input.xlib input.udev input.sdl
-   else ifeq ($(platform),bsd)
-     pkg_check = $(if $(shell $(pkg_config) $1 && echo 1),$2)
-     ruby += video.glx video.glx2 video.xshm
diff --git a/pkgs/by-name/ar/ares/patches/003-darwin-specific.patch b/pkgs/by-name/ar/ares/patches/003-darwin-specific.patch
deleted file mode 100644
index a1cd47f9c34d..000000000000
--- a/pkgs/by-name/ar/ares/patches/003-darwin-specific.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -Naur source-old/desktop-ui/GNUmakefile source-new/desktop-ui/GNUmakefile
---- source-old/desktop-ui/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/desktop-ui/GNUmakefile	2023-07-08 12:20:08.206582916 -0300
-@@ -91,8 +91,7 @@
- 	cp resource/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
- 	cp -R $(ares.path)/Shaders $(output.path)/$(name).app/Contents/Resources/
- 	cp -R $(mia.path)/Database $(output.path)/$(name).app/Contents/Resources/	
--	sips -s format icns resource/$(name).png --out $(output.path)/$(name).app/Contents/Resources/$(name).icns
--	codesign --force --deep --options runtime --entitlements resource/$(name).selfsigned.entitlements --sign - $(output.path)/$(name).app
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns resource/$(name).png
- else ifeq ($(platform),windows)
- 	$(call mkdir,$(output.path)/Shaders/)
- 	$(call mkdir,$(output.path)/Database/)
-@@ -115,8 +114,8 @@
- else ifeq ($(shell id -un),root)
- 	$(error "make install should not be run as root")
- else ifeq ($(platform),macos)
--	mkdir -p ~/Library/Application\ Support/$(name)/
--	cp -R $(output.path)/$(name).app /Applications/$(name).app
-+	mkdir -p $(prefix)/Applications/
-+	cp -R $(output.path)/$(name).app $(prefix)/Applications/$(name).app
- else ifneq ($(filter $(platform),linux bsd),)
- 	mkdir -p $(prefix)/bin/
- 	mkdir -p $(prefix)/share/applications/
-diff -Naur source-old/mia/GNUmakefile source-new/mia/GNUmakefile
---- source-old/mia/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/mia/GNUmakefile	2023-07-08 12:16:55.991517276 -0300
-@@ -39,7 +39,7 @@
- 	mkdir -p $(output.path)/$(name).app/Contents/Resources/
- 	mv $(output.path)/$(name) $(output.path)/$(name).app/Contents/MacOS/$(name)
- 	cp resource/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
--	sips -s format icns resource/$(name).png --out $(output.path)/$(name).app/Contents/Resources/$(name).icns
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns resource/$(name).png
- endif
- 
- verbose: hiro.verbose nall.verbose all;
-diff -Naur source-old/tools/genius/GNUmakefile source-new/tools/genius/GNUmakefile
---- source-old/tools/genius/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/tools/genius/GNUmakefile	2023-07-08 12:16:16.273503940 -0300
-@@ -26,7 +26,7 @@
- 	mkdir -p $(output.path)/$(name).app/Contents/Resources/
- 	mv $(output.path)/$(name) $(output.path)/$(name).app/Contents/MacOS/$(name)
- 	cp data/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
--	sips -s format icns data/$(name).png --$(output.path) $(output.path)/$(name).app/Contents/Resources/$(name).icns
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns data/$(name).png
- endif
- 
- verbose: hiro.verbose nall.verbose all;
diff --git a/pkgs/by-name/ar/arpack/package.nix b/pkgs/by-name/ar/arpack/package.nix
index 4e059b3ea95c..b85f192a867d 100644
--- a/pkgs/by-name/ar/arpack/package.nix
+++ b/pkgs/by-name/ar/arpack/package.nix
@@ -12,14 +12,14 @@
 assert useMpi -> !blas.isILP64;
 assert useAccel -> stdenv.hostPlatform.isDarwin;
 
-stdenv.mkDerivation rec {
-  pname = "arpack";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arpack${lib.optionalString useMpi "-mpi"}";
   version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "opencollab";
     repo = "arpack-ng";
-    rev = version;
+    tag = finalAttrs.version;
     sha256 = "sha256-HCvapLba8oLqx9I5+KDAU0s/dTmdWOEilS75i4gyfC0=";
   };
 
@@ -31,10 +31,17 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optional useMpi mpi;
 
   nativeCheckInputs = lib.optional useMpi openssh;
+  checkInputs =
+    # work around for `ld: file not found: @rpath/libquadmath.0.dylib`
+    # which occurs due to an mpi test linking with `-flat_namespace`
+    # can remove once `-flat_namespace` is removed or
+    # https://github.com/NixOS/nixpkgs/pull/370526 is merged
+    lib.optional (useMpi && stdenv.hostPlatform.isDarwin) gfortran.cc;
 
   # a couple tests fail when run in parallel
   doCheck = true;
   enableParallelChecking = false;
+  __darwinAllowLocalNetworking = true;
 
   env = lib.optionalAttrs useAccel {
     # Without these flags some tests will fail / segfault when using Accelerate
@@ -46,10 +53,11 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" stdenv.hostPlatform.hasSharedLibraries)
     (lib.cmakeBool "EIGEN" true)
-    (lib.cmakeBool "EXAMPLES" true)
+    (lib.cmakeBool "EXAMPLES" finalAttrs.doCheck)
     (lib.cmakeBool "ICB" true)
     (lib.cmakeBool "INTERFACE64" (!useAccel && blas.isILP64))
     (lib.cmakeBool "MPI" useMpi)
+    (lib.cmakeBool "TESTS" finalAttrs.doCheck)
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "-DBLA_VENDOR=${if useAccel then "Apple" else "Generic"}"
   ];
@@ -63,7 +71,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://github.com/opencollab/arpack-ng";
-    changelog = "https://github.com/opencollab/arpack-ng/blob/${src.rev}/CHANGES";
+    changelog = "https://github.com/opencollab/arpack-ng/blob/${finalAttrs.version}/CHANGES";
     description = ''
       A collection of Fortran77 subroutines to solve large scale eigenvalue
       problems.
@@ -72,4 +80,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ ttuegel dotlambda ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/au/auto-cpufreq/package.nix b/pkgs/by-name/au/auto-cpufreq/package.nix
index 354b5ebfd4c5..be9060cb18cd 100644
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -11,14 +11,14 @@
 }:
 python3Packages.buildPythonPackage rec {
   pname = "auto-cpufreq";
-  version = "2.4.0";
+  version = "2.5.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "AdnanHodzic";
     repo = "auto-cpufreq";
     tag = "v${version}";
-    hash = "sha256-Xsh3d7rQY7RKzZ7J0swrgxZEyITb7B3oX5F/tcBGjfk=";
+    hash = "sha256-iDvgL5dQerQnu2ERKAWGvWppG7cQ/0uKEfVY93ItvO4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch b/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch
index bf4987f8117b..183c9456de6a 100644
--- a/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch
+++ b/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch
@@ -1,8 +1,8 @@
-diff --git c/auto_cpufreq/bin/auto_cpufreq.py i/auto_cpufreq/bin/auto_cpufreq.py
-index 7192366..96289e1 100755
---- c/auto_cpufreq/bin/auto_cpufreq.py
-+++ i/auto_cpufreq/bin/auto_cpufreq.py
-@@ -134,20 +134,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
+diff --git a/auto_cpufreq/bin/auto_cpufreq.py b/auto_cpufreq/bin/auto_cpufreq.py
+index d9fcd37..7436a7e 100755
+--- a/auto_cpufreq/bin/auto_cpufreq.py
++++ b/auto_cpufreq/bin/auto_cpufreq.py
+@@ -136,20 +136,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
                  except KeyboardInterrupt: break
              conf.notifier.stop()
          elif install:
@@ -24,7 +24,7 @@ index 7192366..96289e1 100755
          elif update:
              root_check()
              custom_dir = "/opt/auto-cpufreq/source"
-@@ -185,21 +172,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
+@@ -187,21 +174,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
                      run(["auto-cpufreq", "--version"])
                  else: print("Aborted")
          elif remove:
@@ -47,96 +47,3 @@ index 7192366..96289e1 100755
          elif stats:
              not_running_daemon_check()
              config_info_dialog()
-diff --git c/auto_cpufreq/core.py i/auto_cpufreq/core.py
-index b51d55d..4e4b5d3 100755
---- c/auto_cpufreq/core.py
-+++ i/auto_cpufreq/core.py
-@@ -277,18 +277,12 @@ def get_current_gov():
-     )
- 
- def cpufreqctl():
--    """
--    deploy cpufreqctl.auto-cpufreq script
--    """
--    if not (IS_INSTALLED_WITH_SNAP or os.path.isfile("/usr/local/bin/cpufreqctl.auto-cpufreq")):
--        copy(SCRIPTS_DIR / "cpufreqctl.sh", "/usr/local/bin/cpufreqctl.auto-cpufreq")
-+    # scripts are already in the correct place
-+    pass
- 
- def cpufreqctl_restore():
--    """
--    remove cpufreqctl.auto-cpufreq script
--    """
--    if not IS_INSTALLED_WITH_SNAP and os.path.isfile("/usr/local/bin/cpufreqctl.auto-cpufreq"):
--        os.remove("/usr/local/bin/cpufreqctl.auto-cpufreq")
-+    # no need to restore
-+    pass
- 
- def footer(l=79): print("\n" + "-" * l + "\n")
- 
-@@ -306,27 +300,8 @@ def remove_complete_msg():
-     footer()
- 
- def deploy_daemon():
--    print("\n" + "-" * 21 + " Deploying auto-cpufreq as a daemon " + "-" * 22 + "\n")
--
--    cpufreqctl() # deploy cpufreqctl script func call
--
--    bluetooth_disable() # turn off bluetooth on boot
--
--    auto_cpufreq_stats_path.touch(exist_ok=True)
--
--    print("\n* Deploy auto-cpufreq install script")
--    copy(SCRIPTS_DIR / "auto-cpufreq-install.sh", "/usr/local/bin/auto-cpufreq-install")
--
--    print("\n* Deploy auto-cpufreq remove script")
--    copy(SCRIPTS_DIR / "auto-cpufreq-remove.sh", "/usr/local/bin/auto-cpufreq-remove")
--
--    # output warning if gnome power profile is running
--    gnome_power_detect_install()
--    gnome_power_svc_disable()
--
--    tlp_service_detect() # output warning if TLP service is detected
--
--    call("/usr/local/bin/auto-cpufreq-install", shell=True)
-+    # prevent needless copying and system changes
-+    pass
- 
- def deploy_daemon_performance():
-     print("\n" + "-" * 21 + " Deploying auto-cpufreq as a daemon (performance) " + "-" * 22 + "\n")
-@@ -359,34 +334,7 @@ def deploy_daemon_performance():
-     call("/usr/local/bin/auto-cpufreq-install", shell=True)
- 
- def remove_daemon():
--    # check if auto-cpufreq is installed
--    if not os.path.exists("/usr/local/bin/auto-cpufreq-remove"):
--        print("\nauto-cpufreq daemon is not installed.\n")
--        sys.exit(1)
--
--    print("\n" + "-" * 21 + " Removing auto-cpufreq daemon " + "-" * 22 + "\n")
--
--    bluetooth_enable() # turn on bluetooth on boot
--
--    # output warning if gnome power profile is stopped
--    gnome_power_rm_reminder()
--    gnome_power_svc_enable()
--
--    # run auto-cpufreq daemon remove script
--    call("/usr/local/bin/auto-cpufreq-remove", shell=True)
--
--    # remove auto-cpufreq-remove
--    os.remove("/usr/local/bin/auto-cpufreq-remove")
--
--    # delete override pickle if it exists
--    if os.path.exists(governor_override_state):  os.remove(governor_override_state)
--
--    # delete stats file
--    if auto_cpufreq_stats_path.exists():
--        if auto_cpufreq_stats_file is not None: auto_cpufreq_stats_file.close()
--        auto_cpufreq_stats_path.unlink()
--
--    cpufreqctl_restore() # restore original cpufrectl script
-+    pass
- 
- def gov_check():
-     for gov in AVAILABLE_GOVERNORS:
diff --git a/pkgs/by-name/ba/barman/package.nix b/pkgs/by-name/ba/barman/package.nix
index 20f31c7eaca4..291ad440a3ee 100644
--- a/pkgs/by-name/ba/barman/package.nix
+++ b/pkgs/by-name/ba/barman/package.nix
@@ -50,6 +50,7 @@ python3Packages.buildPythonApplication rec {
     [
       # Assertion error
       "test_help_output"
+      "test_exits_on_unsupported_target"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # FsOperationFailed
diff --git a/pkgs/by-name/bi/bigpemu/package.nix b/pkgs/by-name/bi/bigpemu/package.nix
new file mode 100644
index 000000000000..57fadfd0ffb5
--- /dev/null
+++ b/pkgs/by-name/bi/bigpemu/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  SDL2,
+  glui,
+  libGLU,
+  libGL,
+  buildFHSEnv,
+}:
+let
+  bigpemu-unwrapped = stdenv.mkDerivation rec {
+    pname = "BigPEmu";
+    version = "1.17";
+    src = fetchurl {
+      url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
+        builtins.replaceStrings [ "." ] [ "" ] version
+      }.tar.gz";
+      hash = "sha256-R5f3LD5RcGwdwcZqXGaCSFDyHaJrQ1ghS3kqVvBd38A=";
+    };
+
+    installPhase = ''
+      mkdir -p $out/bin
+      tar -xvf $src -C $out/bin --strip-components=1
+    '';
+
+    meta = {
+      description = "Atari Jaguar Emulator (BigPEmu) by Richard Whitehouse";
+      homepage = "https://www.richwhitehouse.com/jaguar/index.php";
+      license = lib.licenses.unfree;
+      maintainers = with lib.maintainers; [
+        tombert
+        hughobrien
+      ];
+      platforms = with lib.platforms; [ "x86_64-linux" ];
+    };
+  };
+in
+buildFHSEnv {
+  name = "bigpemu";
+  version = bigpemu-unwrapped.version;
+  targetPkgs = pkgs: [
+    glui
+    libGL
+    libGLU
+    SDL2
+  ];
+  runScript = "${bigpemu-unwrapped}/bin/bigpemu";
+  passthru = {
+    unwrapped = bigpemu-unwrapped;
+    updateScript = ./update.sh;
+  };
+}
diff --git a/pkgs/by-name/bi/bigpemu/update.sh b/pkgs/by-name/bi/bigpemu/update.sh
new file mode 100755
index 000000000000..35bc2506561e
--- /dev/null
+++ b/pkgs/by-name/bi/bigpemu/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl pup common-updater-scripts
+set -eu -o pipefail
+page="https://www.richwhitehouse.com/jaguar/index.php?content=download"
+extractor='font:contains("Current Version") strong text{}'
+lastest_version="$(curl "$page" | pup "$extractor")"
+update-source-version \
+    --ignore-same-version \
+    bigpemu.unwrapped "$lastest_version"
diff --git a/pkgs/by-name/bu/bun/package.nix b/pkgs/by-name/bu/bun/package.nix
index 855027e6c444..5de7c2a9e838 100644
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -14,7 +14,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.1.42";
+  version = "1.1.43";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -73,19 +73,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-ZKcP4pC9Y5GgnVVdTk4ajfVlQ+UmuxOBqzRKOFNIVyw=";
+        hash = "sha256-3sbiB84OHnxm7bSAL6eu+EKeOUQZvWqlqCGuXDCuoBE=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-AGZIRW0qjVCqYhPZr2WiUELOAfhAYDluXqo8mPeE3Rc=";
+        hash = "sha256-SjI5u1jhmsRMRDqpANuhqyz3YCCiWzz1XJxG5IZharM=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-SLSVr8hUxjXZuqqcG9nlrdulSa9/rOnNffP781OP5Cw=";
+        hash = "sha256-q2vBAlBJ7FRowGje7F50MUdgDrOmeyG0xHYC1nRpETY=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-NoIGwwONj6q8Y+MFnu6mTCr5xQ7Q37+4b2SYS6adsa8=";
+        hash = "sha256-j5iqhwkVV2R9wjxlwyBrFO6QLI4n0CA9qhIAstH6PCE=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/by-name/ca/cargo-chef/package.nix b/pkgs/by-name/ca/cargo-chef/package.nix
index f5e20e0f1f34..9b29ab2b2b6a 100644
--- a/pkgs/by-name/ca/cargo-chef/package.nix
+++ b/pkgs/by-name/ca/cargo-chef/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-chef";
-  version = "0.1.68";
+  version = "0.1.69";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-NTFrNSEIzHppwOOjI3VadjhdV6EgGUmJzyX5JmTsJoI=";
+    hash = "sha256-zDVolVllWl0DM0AByglKhU8JQpkdcmyVGe1vYo+eamk=";
   };
 
-  cargoHash = "sha256-DoIkK/tj3AYt0vm7u7f4SmgOKbdQZv3ZunMFT68+37E=";
+  cargoHash = "sha256-RyPomJJbI67izQMuKf6fBSbM6Ar9Wm4oHYqnOnP/b8U=";
 
   meta = with lib; {
     description = "Cargo-subcommand to speed up Rust Docker builds using Docker layer caching";
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index 0b9ead6eca90..811e051f3202 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       ;
 
-    hash = "sha256-jrp7epYWnfyqQbNL+XhrO4NvSTt2NOMd/icfbUYLvpA=";
+    hash = "sha256-vTjJz2t7ZrMQqOPjcWAoAl2tfKqJ0zgipegSpEvwJ9k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index 730449c04de2..fe86380d9b6f 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -2,29 +2,28 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  testers,
   bison,
   cadical,
-  cbmc,
   cmake,
   flex,
   makeWrapper,
   perl,
   substituteAll,
   cudd,
-  fetchurl,
   nix-update-script,
+  fetchpatch,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.4.0";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-PZZnseOE3nodE0zwyG+82gm55BO4rsCcP4T+fZq7L6I=";
+    hash = "sha256-O8aZTW+Eylshl9bmm9GzbljWB0+cj2liZHs2uScERkM=";
   };
 
   srcglucose = fetchFromGitHub {
@@ -47,16 +46,18 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
   ];
 
-  buildInputs = [ cadical ];
-
-  # do not download sources
-  # link existing cadical instead
   patches = [
     (substituteAll {
       src = ./0001-Do-not-download-sources-in-cmake.patch;
       inherit cudd;
     })
     ./0002-Do-not-download-sources-in-cmake.patch
+    # Fixes build with libc++ >= 19 due to the removal of std::char_traits<unsigned>.
+    # Remove for versions > 6.4.1.
+    (fetchpatch {
+      url = "https://github.com/diffblue/cbmc/commit/684bf4221c8737952e6469304f5a360dc3d5439d.patch";
+      hash = "sha256-3hHu6FcyHjfeFjNxhyhxxk7I/SK98BXT+xy7NgtEt50=";
+    })
   ];
 
   postPatch =
@@ -91,13 +92,13 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.cc.isGNU [
-      # Needed with GCC 12 but breaks on darwin (with clang)
-      "-Wno-error=maybe-uninitialized"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
+    lib.optionals stdenv.cc.isClang [
       # fix "argument unused during compilation"
       "-Wno-unused-command-line-argument"
+      # fix "variable 'plus_overflow' set but not used"
+      "-Wno-error=unused-but-set-variable"
+      # fix "passing no argument for the '...' parameter of a variadic macro is a C++20 extension"
+      "-Wno-error=c++20-extensions"
     ]
   );
 
@@ -105,15 +106,21 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DWITH_JBMC=OFF"
     "-Dsat_impl=cadical"
-    "-Dcadical_INCLUDE_DIR=${cadical.dev}/include"
   ];
 
-  passthru.tests.version = testers.testVersion {
-    package = cbmc;
-    command = "cbmc --version";
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/cbmc";
+  versionCheckProgramArg = "--version";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "cbmc-(.*)"
+    ];
+  };
 
   meta = {
     description = "CBMC is a Bounded Model Checker for C and C++ programs";
diff --git a/pkgs/by-name/de/dendrite/package.nix b/pkgs/by-name/de/dendrite/package.nix
index c3c8784cc908..d3c8f4518680 100644
--- a/pkgs/by-name/de/dendrite/package.nix
+++ b/pkgs/by-name/de/dendrite/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "matrix-dendrite";
-  version = "0.13.8";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
-    owner = "matrix-org";
+    owner = "element-hq";
     repo = "dendrite";
     rev = "v${version}";
-    hash = "sha256-zUpZdG2cdZ95L70qLG2HaUlD+G66XTi4f1V4+ZZAh30=";
+    hash = "sha256-B8ODjhL2XuAkTjggqr7re3oJohDnq1mWgms5bZFV/AI=";
   };
 
-  vendorHash = "sha256-rGOB1ikY3BgChvD1YZUF66g8P6gE29b/k9kxvHR0+WQ=";
+  vendorHash = "sha256-vLdSOSxIvfiVZfM7nRnKNwiklxHBSG7KybC35k4GcaQ=";
 
   subPackages = [
     # The server
@@ -66,10 +66,10 @@ buildGoModule rec {
   };
 
   meta = with lib; {
-    homepage = "https://matrix-org.github.io/dendrite";
+    homepage = "https://element-hq.github.io/dendrite";
     description = "Second-generation Matrix homeserver written in Go";
-    changelog = "https://github.com/matrix-org/dendrite/releases/tag/v${version}";
-    license = licenses.asl20;
+    changelog = "https://github.com/element-hq/dendrite/releases/tag/v${version}";
+    license = licenses.agpl3Plus;
     maintainers = teams.matrix.members;
     platforms = platforms.unix;
   };
diff --git a/pkgs/by-name/di/dinit/package.nix b/pkgs/by-name/di/dinit/package.nix
index f99c7bf14c38..711fdd95bc4e 100644
--- a/pkgs/by-name/di/dinit/package.nix
+++ b/pkgs/by-name/di/dinit/package.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     owner = "davmac314";
     repo = "dinit";
     rev = "v${version}";
-    hash = "sha256-AgUfU8cKAumICwLg2LvcSiS3YCP5I687Po3vj+ZOSSQ=";
+    # fix for case-insensitive filesystems
+    postFetch = ''
+      [ -f "$out/BUILD" ] && rm "$out/BUILD"
+    '';
+    hash = "sha256-KW75uB9cJY+nKcD6hapjisLGvi2NcfwaDR7/Zw3/YrE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/do/docker-slim/package.nix b/pkgs/by-name/do/docker-slim/package.nix
index 20fa9f7faf31..b0e24cdf81f7 100644
--- a/pkgs/by-name/do/docker-slim/package.nix
+++ b/pkgs/by-name/do/docker-slim/package.nix
@@ -18,6 +18,8 @@ buildGoModule rec {
 
   vendorHash = null;
 
+  env.CGO_ENABLED = 0;
+
   subPackages = [
     "cmd/slim"
     "cmd/slim-sensor"
diff --git a/pkgs/by-name/fl/flaresolverr/package.nix b/pkgs/by-name/fl/flaresolverr/package.nix
index ef1bb7f224ae..85b2d93857c1 100644
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@@ -79,5 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "flaresolverr";
     maintainers = with maintainers; [ paveloom ];
     inherit (undetected-chromedriver.meta) platforms;
+    # See https://github.com/NixOS/nixpkgs/issues/332776
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/gh/gh-markdown-preview/package.nix b/pkgs/by-name/gh/gh-markdown-preview/package.nix
index 1c39eb2d3ce6..4b67ddbc19a6 100644
--- a/pkgs/by-name/gh/gh-markdown-preview/package.nix
+++ b/pkgs/by-name/gh/gh-markdown-preview/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-y9AiHmBfDSJ6oCevUAUkg18qHe/oP7A6PLiz3MZqU0s=";
+    hash = "sha256-qvR23dXj+ERf5yhVbsJ3XcdePaAwuDvdya1zr5wtNsQ=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
diff --git a/pkgs/by-name/gi/git-mit/package.nix b/pkgs/by-name/gi/git-mit/package.nix
index e0ec0998032d..eb3f5d93ea0e 100644
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.14.2";
+  version = "5.14.3";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-5x+Sw1Lgi8x/8+neokPSIxq/PuuvUNt4KZ/fE8EdKQI=";
+    hash = "sha256-+7rl4wxVQq4bLBsnLSeJD+1kkRuf7FCi81pXGrNNOPI=";
   };
 
-  cargoHash = "sha256-MLSJiEZDbHcbUACuJASDuygND+ZN36rSeo4AtbsxnqA=";
+  cargoHash = "sha256-44Eo3ewjJj+JLnGfqm3Zb4v4qKklC23pFyJSGcKE8q8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/go/gobgpd/package.nix b/pkgs/by-name/go/gobgpd/package.nix
index 236d983bf782..922b4e6e58d2 100644
--- a/pkgs/by-name/go/gobgpd/package.nix
+++ b/pkgs/by-name/go/gobgpd/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.32.0";
+  version = "3.33.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     tag = "v${version}";
-    hash = "sha256-DIOii1jFVK3jwDLaLFWBbbQPC9eQnTwLYwI8uC8G8ig=";
+    hash = "sha256-Q1wwRCxFe3bX3EMiDExxKSafJkLptbX69ZMW0faK8Bg=";
   };
 
   vendorHash = "sha256-FYLH1Ej8Bm0+tS5Ikj1CPF+1t5opmzee8iHRZSW94Yk=";
diff --git a/pkgs/by-name/he/helm-ls/package.nix b/pkgs/by-name/he/helm-ls/package.nix
index 3a0ccda3db29..5c92a637c99d 100644
--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "helm-ls";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "mrjosh";
     repo = "helm-ls";
     rev = "v${version}";
-    hash = "sha256-EuZbbeRssacrctIbxBbd2GOh8zgFi2OBRregfC88se0=";
+    hash = "sha256-pf/gC0jIrJUfU//uj+CGkUsNDVFeS6Wm4kx3Di9wpVI=";
   };
 
-  vendorHash = "sha256-AWKCE2BZGVYcr6Pe8URQo11Xnr3sfgWWkm9v7vvILOo=";
+  vendorHash = "sha256-VAxmMDZIbbcGHoRL06oqWkDnWZBuweKyoCLSqItWHyg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ia/ianny/package.nix b/pkgs/by-name/ia/ianny/package.nix
index a417b2dcc594..2c56c8b0e77c 100644
--- a/pkgs/by-name/ia/ianny/package.nix
+++ b/pkgs/by-name/ia/ianny/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ianny";
-  version = "1.0.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "zefr0x";
     repo = "ianny";
     rev = "v${version}";
-    hash = "sha256-1QkGs4qCzEA4K3H39QcRV+yINIeZRkjBBkASO69F7ik=";
+    hash = "sha256-F8Uc2BsQ5f7yaUXXDhLvyyYKUDAuvP9cCR2h3vblr0g=";
   };
 
-  cargoHash = "sha256-gKCmiqHkCB7nP5XIaFi/8Wi/x5WFEHEmHczKiIDDxXE=";
+  cargoHash = "sha256-b3B1LMa3gIL2xF9GL7jLXagesC9FEQHb8drocgx2MqY=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus.dev ];
diff --git a/pkgs/by-name/im/impl/package.nix b/pkgs/by-name/im/impl/package.nix
index 7f44746a6767..3f08de58dd9a 100644
--- a/pkgs/by-name/im/impl/package.nix
+++ b/pkgs/by-name/im/impl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "impl";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "josharian";
     repo = "impl";
     rev = "v${version}";
-    hash = "sha256-a9jAoZp/wVnTyaE4l2yWSf5aSxXEtqN6SoxU68XhRhk=";
+    hash = "sha256-0TSyg7YEPur+h0tkDxI3twr2PzT7tmo3shKgmSSJ6qk=";
   };
 
   vendorHash = "sha256-vTqDoM/LK5SHkayLKYig+tCrXLelOoILmQGCxlTWHog=";
diff --git a/pkgs/by-name/in/interactsh/package.nix b/pkgs/by-name/in/interactsh/package.nix
index 0dd12136cae0..0a81d339104e 100644
--- a/pkgs/by-name/in/interactsh/package.nix
+++ b/pkgs/by-name/in/interactsh/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "interactsh";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-aPjeP9Js2lpJBiWYTpJjKo445wSkNcatszBZMutIIR0=";
+    hash = "sha256-ugrcGOlVRPTWhIX6Bpzl9iVydiVY5BWN3yNK/CaZS6A=";
   };
 
-  vendorHash = "sha256-SYs04LgWy6Fd9SUAxs4tB+VK2CK3gqb7fDYkp16i67Q=";
+  vendorHash = "sha256-HgYaSjg4oFNOTOiUd2YXpdUWdpKqJFF5KDejxp0J4cU=";
 
   modRoot = ".";
   subPackages = [
diff --git a/pkgs/by-name/ki/kitex/package.nix b/pkgs/by-name/ki/kitex/package.nix
index 6a113f61a8d4..316ed5ea6795 100644
--- a/pkgs/by-name/ki/kitex/package.nix
+++ b/pkgs/by-name/ki/kitex/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kitex";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "cloudwego";
     repo = "kitex";
     rev = "v${version}";
-    hash = "sha256-tCZHDdDwMgZVGeARNfBC3/vQHNN5chKt607R6htx8HI=";
+    hash = "sha256-UK+zGMtIZRoITxLrqmPd5mk3FwjjzOLH2Zpke89XgU4=";
   };
 
-  vendorHash = "sha256-OkCCrdEiq63JTATlsMF3lwZ4JjYIwKOHAz2fqDj64Do=";
+  vendorHash = "sha256-dbw4SRYCGlBJCwjcGGVi3u6dkNcXLw9l8EnXPw727cI=";
 
   subPackages = [ "tool/cmd/kitex" ];
 
diff --git a/pkgs/by-name/li/libpointmatcher/package.nix b/pkgs/by-name/li/libpointmatcher/package.nix
index 19ce98dec5cf..8b19232f1fe7 100644
--- a/pkgs/by-name/li/libpointmatcher/package.nix
+++ b/pkgs/by-name/li/libpointmatcher/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpointmatcher";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "norlab-ulaval";
     repo = "libpointmatcher";
     rev = version;
-    hash = "sha256-ewsU3aCFPeem1pJpqKaceMhL7SwTYOaYlcwOfMxwkSs=";
+    hash = "sha256-OkfWdim0JDKiBx5spYpkMyFrLQP3AMWBVDpzmFwqNFM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/librashader/package.nix b/pkgs/by-name/li/librashader/package.nix
new file mode 100644
index 000000000000..f840a949dcc0
--- /dev/null
+++ b/pkgs/by-name/li/librashader/package.nix
@@ -0,0 +1,70 @@
+{
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "librashader";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "SnowflakePowered";
+    repo = "librashader";
+    rev = "librashader-v0.6.2";
+    hash = "sha256-zkvCpQ5Cq3sDOspc12/gPmNi6hn/nBe1UfWrMGi/o0Q=";
+  };
+
+  patches = [
+    ./patches/fix-optional-dep-syntax.patch
+  ];
+
+  cargoHash = "sha256-eUZOFdbOPs81LAMEV4i6eYRN8NYVcnmble/L+ptx2EA=";
+
+  RUSTC_BOOTSTRAP = 1;
+
+  buildPhase = ''
+    runHook preBuild
+    cargo run -p librashader-build-script -- --profile optimized
+    runHook postBuild
+  '';
+
+  doCheck = false;
+
+  installPhase =
+    ''
+      runHook preInstall
+      cd target/optimized
+      mkdir -p $out/lib $out/include/librashader
+    ''
+    + (
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          install_name_tool -id $out/lib/librashader.dylib librashader.dylib
+          install -m755 librashader.dylib $out/lib/librashader.dylib
+        ''
+      else
+        ''
+          patchelf --set-soname librashader.so.2 librashader.so
+          install -m755 librashader.so $out/lib/librashader.so.2
+          ln -s $out/lib/librashader.so.2 $out/lib/librashader.so
+        ''
+    )
+    + ''
+      install -m644 librashader.h -t $out/include/librashader
+      install -m644 ../../include/librashader_ld.h -t $out/include/librashader
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "RetroArch Shaders for All";
+    homepage = "https://github.com/SnowflakePowered/librashader";
+    license = with lib.licenses; [
+      mpl20
+      gpl3Only
+    ];
+    maintainers = with lib.maintainers; [ nadiaholmquist ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/li/librashader/patches/fix-optional-dep-syntax.patch b/pkgs/by-name/li/librashader/patches/fix-optional-dep-syntax.patch
new file mode 100644
index 000000000000..166d7d6a3512
--- /dev/null
+++ b/pkgs/by-name/li/librashader/patches/fix-optional-dep-syntax.patch
@@ -0,0 +1,31 @@
+diff --git a/librashader-capi/Cargo.toml b/librashader-capi/Cargo.toml
+index 4a103ab7..38971ddb 100644
+--- a/librashader-capi/Cargo.toml
++++ b/librashader-capi/Cargo.toml
+@@ -17,12 +17,12 @@ crate-type = [ "cdylib", "staticlib" ]
+ [features]
+ default = ["runtime-all" ]
+ runtime-all = ["runtime-opengl", "runtime-d3d9", "runtime-d3d11", "runtime-d3d12", "runtime-vulkan", "runtime-metal"]
+-runtime-opengl = ["glow", "librashader/runtime-gl"]
+-runtime-d3d11 = ["windows", "librashader/runtime-d3d11", "windows/Win32_Graphics_Direct3D11"]
+-runtime-d3d12 = ["windows", "librashader/runtime-d3d12", "windows/Win32_Graphics_Direct3D12"]
+-runtime-d3d9 = ["windows", "librashader/runtime-d3d9", "windows/Win32_Graphics_Direct3D9"]
++runtime-opengl = ["dep:glow", "librashader/runtime-gl"]
++runtime-d3d11 = ["dep:windows", "librashader/runtime-d3d11", "windows/Win32_Graphics_Direct3D11"]
++runtime-d3d12 = ["dep:windows", "librashader/runtime-d3d12", "windows/Win32_Graphics_Direct3D12"]
++runtime-d3d9 = ["dep:windows", "librashader/runtime-d3d9", "windows/Win32_Graphics_Direct3D9"]
+ 
+-runtime-vulkan = ["ash", "librashader/runtime-vk"]
++runtime-vulkan = ["dep:ash", "librashader/runtime-vk"]
+ runtime-metal = ["__cbindgen_internal_objc", "librashader/runtime-metal"]
+ 
+ reflect-unstable = []
+@@ -33,7 +33,7 @@ __cbindgen_internal = ["runtime-all"]
+ 
+ # make runtime-metal depend on this, so its automatically implied.
+ # this will make cbindgen generate __OBJC__ ifdefs for metal functions.
+-__cbindgen_internal_objc = ["objc2-metal", "objc2"]
++__cbindgen_internal_objc = ["dep:objc2-metal", "dep:objc2"]
+ 
+ [dependencies]
+ thiserror = "2"
diff --git a/pkgs/by-name/li/licensure/package.nix b/pkgs/by-name/li/licensure/package.nix
index 47dfc418acac..cea8db5fcb2b 100644
--- a/pkgs/by-name/li/licensure/package.nix
+++ b/pkgs/by-name/li/licensure/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "licensure";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "chasinglogic";
     repo = "licensure";
     rev = version;
-    hash = "sha256-bo1bac/K8HMZaeLVYZRqYOS8p+62suGlgSyYz8Atj+0=";
+    hash = "sha256-YPdVVHJ/ldILGbg95x7D06chG8Q6a+NnTAimuvBScpE=";
   };
 
-  cargoHash = "sha256-Ywfn+6qdKD9CG2/xdHR2XDsj5LF5XPJ2+XR5H1o2iXk=";
+  cargoHash = "sha256-Vam66mHnDuyVfrbi897DCDmoF812YeGG0KtSYzHrteY=";
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [
diff --git a/pkgs/by-name/lz/lziprecover/package.nix b/pkgs/by-name/lz/lziprecover/package.nix
index 6c9109e90478..bc9b3248e2c0 100644
--- a/pkgs/by-name/lz/lziprecover/package.nix
+++ b/pkgs/by-name/lz/lziprecover/package.nix
@@ -5,13 +5,14 @@
   lzip,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lziprecover";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchurl {
-    url = "mirror://savannah/lzip/lziprecover/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HWmc+u/pLrJiSjZSWAvK/gu7mP54GMJebegjvN0NRY8=";
+    url = "mirror://savannah/lzip/lziprecover/lziprecover-${finalAttrs.version}.tar.gz";
+    sha256 = "4f392f9c780ae266ee3d0db166b0f1b4d3ae07076e401dc2b199dc3a0fff8b45";
+    # This hash taken from the mailing list announcement.
   };
 
   configureFlags = [
@@ -26,12 +27,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.nongnu.org/lzip/lziprecover.html";
     description = "Data recovery tool for lzip compressed files";
     license = lib.licenses.gpl2Plus;
-    maintainers = with maintainers; [ vlaci ];
+    maintainers = with lib.maintainers; [
+      vlaci
+      ehmry
+    ];
     platforms = lib.platforms.all;
     mainProgram = "lziprecover";
   };
-}
+})
diff --git a/pkgs/by-name/ma/magic-wormhole-rs/package.nix b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
index ab3dba19efc1..71e22bd68f4e 100644
--- a/pkgs/by-name/ma/magic-wormhole-rs/package.nix
+++ b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "magic-wormhole-rs";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole.rs";
     rev = version;
-    sha256 = "sha256-cPFstE442xuNnW8PQZ8y+0sXTaWk3QYjTn3HG+zWzY0=";
+    sha256 = "sha256-wah3Mkw3oFUx4rD6OkLvYyHsz6Z8pFFPhKlc0D7gIQA=";
   };
 
-  cargoHash = "sha256-+OcjILDwGg0eybzBgVIZeVelnQatPU6rgd/b6buvTRQ=";
+  cargoHash = "sha256-iAwlaEfegM2uo728kUhh7GhfponqmZ48ri6iUyRVRUI=";
 
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];
 
diff --git a/pkgs/by-name/mc/mcrl2/package.nix b/pkgs/by-name/mc/mcrl2/package.nix
index 37a2eaec73e5..3534afcbae25 100644
--- a/pkgs/by-name/mc/mcrl2/package.nix
+++ b/pkgs/by-name/mc/mcrl2/package.nix
@@ -5,25 +5,25 @@
   cmake,
   libGLU,
   libGL,
-  qt5,
+  qt6,
   boost,
 }:
 
 stdenv.mkDerivation rec {
-  version = "202307";
+  version = "202407";
   build_nr = "1";
   pname = "mcrl2";
 
   src = fetchurl {
     url = "https://www.mcrl2.org/download/release/mcrl2-${version}.${build_nr}.tar.gz";
-    hash = "sha256-zCHCO8tGyOxqUc0x3t/N3dUh4eG7slemlgK/QZsA4JA=";
+    hash = "sha256-VhP9BFSujxYMcQVu6P6k6yiH2UUhCB3P+Pj+9Ir7x6s=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     libGLU
     libGL
-    qt5.qtbase
+    qt6.qtbase
     boost
   ];
 
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index fda140295ea5..394b1cac3dd9 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "19.0.2";
+  version = "19.0.3";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-44aorX4i+/kwWMIlM1Z+I81PT+Udjk0llg706eVKONY=";
+    sha256 = "sha256-aNb/zM/KF46XDV0GjQfm2XvkbToJZf6ZdwK1E1ShA+o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/n2/n2048/package.nix b/pkgs/by-name/n2/n2048/package.nix
index 7b4c570a6fb5..e28b685d9f52 100644
--- a/pkgs/by-name/n2/n2048/package.nix
+++ b/pkgs/by-name/n2/n2048/package.nix
@@ -5,28 +5,39 @@
   ncurses,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "n2048";
   version = "0.1";
+
   src = fetchurl {
-    url = "http://www.dettus.net/n2048/n2048_v${version}.tar.gz";
-    sha256 = "184z2rr0rnj4p740qb4mzqr6kgd76ynb5gw9bj8hrfshcxdcg1kk";
+    url = "http://www.dettus.net/n2048/n2048_v${finalAttrs.version}.tar.gz";
+    hash = "sha256-c4bHWmdQuwyRXIm/sqw3p71pMv6VLAzIuUTaDHIWn6A=";
   };
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-function-declaration"
+    ];
+  };
+
   buildInputs = [
     ncurses
   ];
+
   makeFlags = [
     "DESTDIR=$(out)"
   ];
+
   preInstall = ''
     mkdir -p "$out"/{share/man,bin}
   '';
-  meta = with lib; {
+
+  meta = {
     description = "Console implementation of 2048 game";
     mainProgram = "n2048";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
     homepage = "http://www.dettus.net/n2048/";
   };
-}
+})
diff --git a/pkgs/by-name/nf/nfpm/package.nix b/pkgs/by-name/nf/nfpm/package.nix
index ce41891fdafc..3d55292eabc4 100644
--- a/pkgs/by-name/nf/nfpm/package.nix
+++ b/pkgs/by-name/nf/nfpm/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.41.1";
+  version = "2.41.2";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/me2qMOaZ0QQ1wUrMs8T/CZ5t3tL25eVYlpoWSzCJhM=";
+    hash = "sha256-anEKmMFB4szA6xdwzU2vtJO8rH4i8TCF+kiOOv8kBHs=";
   };
 
-  vendorHash = "sha256-dGVfWKnlZxVdqgZSIRrEWmqSf360J/LKkyiMkKJ88ro=";
+  vendorHash = "sha256-xtfqHeWaLMxH5paFBsbiSCVd/po9c3yy0INuy1F7Yds=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 95517c0ac920..da444403bff1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -38,7 +38,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
 
     common_build_flags = argparse.ArgumentParser(add_help=False)
     common_build_flags.add_argument("--builders")
-    common_build_flags.add_argument("--include", "-I")
+    common_build_flags.add_argument("--include", "-I", action="append")
     common_build_flags.add_argument("--quiet", action="store_true")
     common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
     common_build_flags.add_argument("--show-trace", action="store_true")
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index edf4d8ccdaa3..6fbf53a8c00b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -43,8 +43,8 @@ def dict_to_flags(d: Args | None) -> list[str]:
                 flags.append(flag)
                 flags.append(value)
             case list():
-                flags.append(flag)
                 for v in value:
+                    flags.append(flag)
                     flags.append(v)
             case _:
                 assert_never(value)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index de376135678e..858916b682c9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -150,6 +150,55 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
     )
 
 
+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+def test_execute_nix_build_vm(mock_run: Any, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-vm",
+            "--no-flake",
+            "-I",
+            "nixos-config=./configuration.nix",
+            "-I",
+            "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            "--fast",
+        ]
+    )
+
+    assert mock_run.call_count == 1
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix-build",
+                    "<nixpkgs/nixos>",
+                    "--attr",
+                    "config.system.build.vm",
+                    "--include",
+                    "nixos-config=./configuration.nix",
+                    "--include",
+                    "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            )
+        ]
+    )
+
+
 @patch.dict(nr.process.os.environ, {}, clear=True)
 @patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 def test_execute_nix_build_image_flake(mock_run: Any, tmp_path: Path) -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
index de573a2b55a2..cfa224478053 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
@@ -23,6 +23,7 @@ def test_dict_to_flags() -> None:
         "value",
         "--test-flag-4",
         "v1",
+        "--test-flag-4",
         "v2",
         "-t",
         "-vvvvv",
diff --git a/pkgs/by-name/nw/nwg-dock-hyprland/package.nix b/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
index 7a4a72c5794a..7473acb9ac14 100644
--- a/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
+++ b/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "nwg-dock-hyprland";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
diff --git a/pkgs/by-name/op/open-in-mpv/package.nix b/pkgs/by-name/op/open-in-mpv/package.nix
index 2bd21ae35ab0..175f65d615e6 100644
--- a/pkgs/by-name/op/open-in-mpv/package.nix
+++ b/pkgs/by-name/op/open-in-mpv/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "open-in-mpv";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "Baldomo";
     repo = "open-in-mpv";
     rev = "v${version}";
-    hash = "sha256-5Hu/BXUMI8CSOvE09I0YXfQ6BuIRA37yLlSTqWrrqy0=";
+    hash = "sha256-mr1c2L5D1v+4VoPA4i5q7/RCdWLLZ1UfTGayiG5Nm6M=";
   };
 
   vendorHash = "sha256-G6GZO2+CfEAYcf7zBcqDa808A0eJjM8dq7+4VGZ+P4c=";
diff --git a/pkgs/by-name/pa/patchy/package.nix b/pkgs/by-name/pa/patchy/package.nix
new file mode 100644
index 000000000000..bdc1092408f5
--- /dev/null
+++ b/pkgs/by-name/pa/patchy/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  versionCheckHook,
+}:
+let
+  version = "1.2.7";
+in
+rustPlatform.buildRustPackage {
+  pname = "patchy";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "nik-rev";
+    repo = "patchy";
+    tag = "v${version}";
+    hash = "sha256-Npb+qcguxZAvWggJC5NtxCeUCU/nOtjCbK5gfkDTkfw=";
+  };
+  cargoHash = "sha256-vtKIDmfKSSZjorIGQ13OYrdmzabS5//j2/n7kJC9O7k=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Makes it easy to maintain personal forks";
+    longDescription = ''
+      Patchy makes it easy to declaratively manage personal forks by
+      automatically merging pull request of your liking to have more
+      features.
+    '';
+    homepage = "https://github.com/nik-rev/patchy";
+    changelog = "https://github.com/nik-rev/patchy/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    mainProgram = "patchy";
+    maintainers = with lib.maintainers; [ louis-thevenet ];
+  };
+}
diff --git a/pkgs/by-name/pi/pinentry-rofi/package.nix b/pkgs/by-name/pi/pinentry-rofi/package.nix
index b97c8548c129..6912b47a2554 100644
--- a/pkgs/by-name/pi/pinentry-rofi/package.nix
+++ b/pkgs/by-name/pi/pinentry-rofi/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoconf-archive
     autoreconfHook
+    guile
     pkg-config
     texinfo
     makeWrapper
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index 751b418c59d2..b62a18a0c5e7 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -40,6 +40,8 @@ tcl.mkTclDerivation rec {
       --replace-fail 'set Remind "remind"' "set Remind \"$out/bin/remind\"" \
       --replace-fail 'set Rem2PS "rem2ps"' "set Rem2PS \"$out/bin/rem2ps\"" \
       --replace-fail 'set Rem2PDF "rem2pdf"' "set Rem2PDF \"$out/bin/rem2pdf\""
+    substituteInPlace configure \
+      --replace-fail 'f=-ffat-lto-objects' ""
   '';
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index b2f4e3843252..761efd08df0a 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.18.26";
+  version = "1.18.28";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-G7I2r/jZ3Ht8Is2TagNnyQolasfLlO57qzGcVT4QvkI=";
+    hash = "sha256-ixKZwwqk93pc8N+DJe2H7oyjf0+u7kQRDRFOm2VbJZs=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/re/resolve-march-native/package.nix b/pkgs/by-name/re/resolve-march-native/package.nix
index 0bb8d4ca4056..71a3580064ad 100644
--- a/pkgs/by-name/re/resolve-march-native/package.nix
+++ b/pkgs/by-name/re/resolve-march-native/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "resolve-march-native";
-  version = "5.1.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "hartwork";
     repo = pname;
     tag = version;
-    hash = "sha256-02d7ip5E/vkOMkkeHOx1m7FdpurXT9O6HdwrygNPHdY=";
+    hash = "sha256-YJvKLHxn80RRVEOGeg9BwxhDZ8Hhg5Qa6ryLOXumY5w=";
   };
 
   # NB: The tool uses gcc at runtime to resolve the -march=native flags
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 78dbc0395a5f..1c564dfc3732 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.36.3";
+  version = "8.36.5";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Q5taKIs3kjB1KrIxRO27/sbhamta9ljO+btghJ+M5zE=";
+    sha256 = "sha256-T5pyec+sS3hBlQTUevIP3v8vlxZEFMSFN7doJliTUCg=";
   };
 
-  vendorHash = "sha256-lMDE8M8O6HIJE585OaI1islvffVHncr5CwLoVVSCOh4=";
+  vendorHash = "sha256-+otWcVUAqO2e9v+4T5QTw2DOVfDUGu6hP/1/6LO21nY=";
 
   subPackages = [
     "cmd/rqlite"
diff --git a/pkgs/by-name/sq/squeezelite/package.nix b/pkgs/by-name/sq/squeezelite/package.nix
index 638c6784a920..cc7ab1a65fe9 100644
--- a/pkgs/by-name/sq/squeezelite/package.nix
+++ b/pkgs/by-name/sq/squeezelite/package.nix
@@ -40,13 +40,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1517";
+  version = "2.0.0.1518";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "262994a989dc29ce3be4390c57c6a43373dfdca2";
-    hash = "sha256-QmjjVbE5lQhKMt2Loq7wPV16phcEUUcdiNGdmImkoAI=";
+    rev = "ed3c82052db4846e8e0da01c5bf8db130db00dee";
+    hash = "sha256-nxEsraKV5OPaeRuN2NRvxGtUb189ArP3blxSOMPD2II=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index 9972af91f1f9..dfbac679e284 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -49,7 +49,9 @@ stdenv.mkDerivation rec {
     '';
 
   configureFlags =
-    [ "--enable-swanctl"
+    [
+      "--sysconfdir=/etc"
+      "--enable-swanctl"
       "--enable-cmd"
       "--enable-openssl"
       "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
@@ -93,10 +95,9 @@ stdenv.mkDerivation rec {
       "--disable-scripts"
     ];
 
-  postInstall = ''
-    # this is needed for l2tp
-    echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
-  '';
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
+  ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
diff --git a/pkgs/by-name/st/stu/package.nix b/pkgs/by-name/st/stu/package.nix
index f9beb3282a09..7245dedf6465 100644
--- a/pkgs/by-name/st/stu/package.nix
+++ b/pkgs/by-name/st/stu/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stu";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "stu";
     rev = "v${version}";
-    hash = "sha256-GqeKb3Fu0MkM98AGDOEuO3zbzSHOWQFiamCSgMk4xBI=";
+    hash = "sha256-an/FNDwtP8EKPwuhu/Dkqj5hZym6wpySEfr66C21pvw=";
   };
 
-  cargoHash = "sha256-fK7eHNUKAE6FykHllnIe0vNEEzeykpqvnM29KBn4l2I=";
+  cargoHash = "sha256-qZG+3Wh3R8LRvSQR5RQ1ZwAbk8s1mxg10P5I9clcMSo=";
 
   passthru.tests.version = testers.testVersion { package = stu; };
 
diff --git a/pkgs/by-name/ta/tangara-companion/package.nix b/pkgs/by-name/ta/tangara-companion/package.nix
new file mode 100644
index 000000000000..7e636f5114d2
--- /dev/null
+++ b/pkgs/by-name/ta/tangara-companion/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+
+  copyDesktopItems,
+  makeDesktopItem,
+
+  gdk-pixbuf,
+  glib,
+  graphene,
+  gtk4,
+  libadwaita,
+  pango,
+  pkg-config,
+  udev,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tangara-companion";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "haileys";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-pTE+xlXWIOOt1oiKosnbXTCLYoAqP3CfXA283a//Ds0=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-C7Q3Oo/aBBH6pW1zSFQ2nD07+wu8uXfRSwNif2pVlW0=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    glib
+    pkg-config
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    glib
+    graphene
+    gtk4
+    libadwaita
+    pango
+    udev
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "Tangara Companion";
+      comment = meta.description;
+      type = "Application";
+      exec = meta.mainProgram;
+      terminal = false;
+      categories = [
+        "Utility"
+        "GTK"
+      ];
+      icon = "tangara-companion";
+      startupNotify = true;
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 $src/data/assets/icon.svg $out/share/icons/hicolor/scalable/apps/tangara-companion.svg
+  '';
+
+  meta = {
+    description = "Companion app for Cool Tech Zone Tangara";
+    mainProgram = "tangara-companion";
+    homepage = "https://github.com/haileys/tangara-companion";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ benpye ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ta/taterclient-ddnet/package.nix b/pkgs/by-name/ta/taterclient-ddnet/package.nix
index c203061f5164..55ad58d4abaf 100644
--- a/pkgs/by-name/ta/taterclient-ddnet/package.nix
+++ b/pkgs/by-name/ta/taterclient-ddnet/package.nix
@@ -34,18 +34,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taterclient-ddnet";
-  version = "10.0.1";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "sjrc6";
     repo = "taterclient-ddnet";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-mYT/njNzMwGOFKcWZMGOpS0DMu7Wy07nBP4wGpDi4Fc=";
+    hash = "sha256-RhOZuPsjyXq5UcM+5dawDi1BfjMMQ3K9O3PHkCg5sDI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-aJmdh9OthB2OyrFdxkq4xjLBphA7nn3JVmcNdJZ4pZ8=";
+    hash = "sha256-NDeHpf1iYApP/Y/DE7FGBu67ld6A0+8227oTVlOMe1M=";
   };
 
   nativeBuildInputs = [
@@ -94,6 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CLIENT" true)
     (lib.cmakeBool "SERVER" false)
     (lib.cmakeBool "TOOLS" false)
+    (lib.cmakeBool "DISCORD" false)
     (lib.cmakeFeature "CLIENT_EXECUTABLE" clientExecutable)
   ];
 
diff --git a/pkgs/by-name/ts/tsukimi/package.nix b/pkgs/by-name/ts/tsukimi/package.nix
index a11e25d0544f..5016dcce1d59 100644
--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -15,18 +15,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tsukimi";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "tsukinaha";
     repo = "tsukimi";
     tag = "v${version}";
-    hash = "sha256-5c/Rfiz9CkBasfWTCviC3HnWKkMVOEWoaMvsZyQN/iw=";
+    hash = "sha256-MbGWPvCq4nzrp8ArXud9A+6uPcnbxs42M2QwjZxUn5w=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KvyF10kP/zRpgNdy+lLkgUgqiu075QvezYklMbkVvxQ=";
+  cargoHash = "sha256-59JakfFFM4Tpi1J3ja0aDhC5oty/0QKNLcU58nRewTg=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/tt/tty-share/package.nix b/pkgs/by-name/tt/tty-share/package.nix
index 7c653fdfdba7..1847050236b1 100644
--- a/pkgs/by-name/tt/tty-share/package.nix
+++ b/pkgs/by-name/tt/tty-share/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "tty-share";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "elisescu";
     repo = "tty-share";
     rev = "v${version}";
-    sha256 = "sha256-7rNSBpiZslUGWw0P/Q1zRtNxo9MN8Vq6hG8pD6bJIsA=";
+    sha256 = "sha256-+Bh39WtzReOmHcvpGbNfEdBqw7ZL9Vhxu5d337CMc/M=";
   };
 
   # Upstream has a `./vendor` directory with all deps which we rely upon.
diff --git a/pkgs/by-name/ua/uacme/package.nix b/pkgs/by-name/ua/uacme/package.nix
index ede36c53a203..1769fc8ba77e 100644
--- a/pkgs/by-name/ua/uacme/package.nix
+++ b/pkgs/by-name/ua/uacme/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "uacme";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "ndilieto";
     repo = "uacme";
     rev = "v${version}";
-    hash = "sha256-MaPMNAUuQmJAbl7qBqNCkzW4k6nkibezEMRaCho5I68=";
+    hash = "sha256-he0k4o/5JGFDxLrHBO6PNtRgKUzIkGby96cSz0ymuRs=";
   };
 
   configureFlags = [ "--with-openssl" ];
diff --git a/pkgs/by-name/un/unpoller/package.nix b/pkgs/by-name/un/unpoller/package.nix
index 78ce18cb6eea..36ee19619366 100644
--- a/pkgs/by-name/un/unpoller/package.nix
+++ b/pkgs/by-name/un/unpoller/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.11.2";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-/X2hCtF38X0twHsHSjpf23Mdz9aK43z3jhWbfkUo0kQ=";
+    hash = "sha256-2yDrnBi5ZaFfgpqZS1PZM3Fp3zqb5oMuMbsoAeZan8o=";
   };
 
-  vendorHash = "sha256-d7kkdiGMT3bN1dfNo8m+zp3VY8kaZM2BWO3B3iAdUQY=";
+  vendorHash = "sha256-ZylkCictJNJ/QrWEbBIXDEKElpZRw2Yrj/IHMx0lqg0=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/vu/vuetorrent/package.nix b/pkgs/by-name/vu/vuetorrent/package.nix
index 046bec502fa2..f20860a64533 100644
--- a/pkgs/by-name/vu/vuetorrent/package.nix
+++ b/pkgs/by-name/vu/vuetorrent/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "vuetorrent";
-  version = "2.19.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "VueTorrent";
     repo = "VueTorrent";
     tag = "v${version}";
-    hash = "sha256-lT0KalQNn3SMSxY6baIuLph/OLNL3y2U9+eNw8r90yI=";
+    hash = "sha256-+DB1C7lWB1bBdQIxXhil5LYORgy7cTZISnU60mbPNK0=";
   };
 
-  npmDepsHash = "sha256-GOBBZg9/e/XEKEJuW3ie9eOd7jTeid69aQRUddXOjC0=";
+  npmDepsHash = "sha256-mfYLCErwVrL9PZDKGa0NiL+CQnJk1fDnB3bvCcvupHw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/wa/wal-g/package.nix b/pkgs/by-name/wa/wal-g/package.nix
index 2a01a12c2734..94798ae0ba75 100644
--- a/pkgs/by-name/wa/wal-g/package.nix
+++ b/pkgs/by-name/wa/wal-g/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "wal-g";
-  version = "3.0.3";
+  version = "3.0.5";
 
   src = fetchFromGitHub {
     owner = "wal-g";
     repo = "wal-g";
     rev = "v${version}";
-    sha256 = "sha256-r46svvUAMjZx+Oc/vTWet9iZLEiXkRFevUz4x0OixVI=";
+    sha256 = "sha256-wVr0L2ZXMuEo6tc2ajNzPinVQ8ZVzNOSoaHZ4oFsA+U=";
   };
 
-  vendorHash = "sha256-CfXLeFQA7ix1DP+DB5qWQryS2tLFNlfZrA3OBYxIpjU=";
+  vendorHash = "sha256-YDLAmRfDl9TgbabXj/1rxVQ052NZDg3IagXVTe5i9dw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 857823715da7..900d2a801a9d 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-Un5dqYt3kGh3ODZnP2nskfzhma7KkpZXJTqPfwcZ4Dw=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-S1gNm8joPS2VKsTF2zUG9zSttFkSPBBOs4bpcph+saE=",
+    "version": "0.2025.01.08.08.02.stable_04"
   },
   "linux_x86_64": {
-    "hash": "sha256-U14TFQg72vfizYu8qXjH+JafL5aWndz1sbMSF3TD/+E=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-HHQnH4Sqju68RCBZxUpmdlpN6xSMB+3al8wKgLuvPVs=",
+    "version": "0.2025.01.08.08.02.stable_04"
   },
   "linux_aarch64": {
-    "hash": "sha256-lbZawoh9VUhNlbs+pxUu5pdWsizq9B1UPBsaNxUSs20=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-N0qHBTE6pczK5ceHXvCxNxWR9O7qcCtkgiPkGFUgNNE=",
+    "version": "0.2025.01.08.08.02.stable_04"
   }
 }
diff --git a/pkgs/by-name/we/webcord/package.nix b/pkgs/by-name/we/webcord/package.nix
index 7bed5b44961e..ca7e941f495f 100644
--- a/pkgs/by-name/we/webcord/package.nix
+++ b/pkgs/by-name/we/webcord/package.nix
@@ -11,16 +11,18 @@
 
 buildNpmPackage rec {
   pname = "webcord";
-  version = "4.10.2";
+  version = "4.10.3";
 
   src = fetchFromGitHub {
     owner = "SpacingBat3";
     repo = "WebCord";
     tag = "v${version}";
-    hash = "sha256-vzTT8tHpbJSt1PosgKTg3pT4a9UfPabtJppLLD9znhU=";
+    hash = "sha256-ga94CBc87q1U06Bm6ju304CHrIlFRLcIwNJx3GB2S+w=";
   };
 
-  npmDepsHash = "sha256-nVQv+GSnfQa8V/RitvV2juokbiRJ/vIMLWcg9QPDbP0=";
+  npmDepsHash = "sha256-h14sYaUeXb57kjxSSiXyvDjaswWi1qPAU/x1xQz3BaY=";
+
+  makeCacheWritable = true;
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/wo/wofi-power-menu/package.nix b/pkgs/by-name/wo/wofi-power-menu/package.nix
new file mode 100644
index 000000000000..a792ca678e4c
--- /dev/null
+++ b/pkgs/by-name/wo/wofi-power-menu/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeWrapper,
+  wofi,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wofi-power-menu";
+  version = "0.2.5";
+
+  src = fetchFromGitHub {
+    owner = "szaffarano";
+    repo = "wofi-power-menu";
+    tag = "v${version}";
+    hash = "sha256-V1aN8jkWmZz+ynVzZlDE/WYSBnt8XpPEb6NImd6OA4g=";
+  };
+
+  cargoHash = "sha256-KWpPyuI963v4D5uLUBNoLWU29lM1PD46uSR1LAUI+Es=";
+
+  postPatch = ''
+    sed -i 's/^version = .*/version = "${version}"/' Cargo.toml
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wofi-power-menu \
+      --prefix PATH : ${lib.makeBinPath [ wofi ]}
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Highly configurable power menu using the wofi launcher power-menu";
+    homepage = "https://github.com/szaffarano/wofi-power-menu";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "wofi-power-menu";
+  };
+}
diff --git a/pkgs/by-name/xh/xh/package.nix b/pkgs/by-name/xh/xh/package.nix
index 65d447f2d936..dd0fc11bc992 100644
--- a/pkgs/by-name/xh/xh/package.nix
+++ b/pkgs/by-name/xh/xh/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    hash = "sha256-rHhL2IWir+DpbNFu2KddslmhhiSpkpU633JYFYCoWvY=";
+    hash = "sha256-fNsiM9B3E34x8m+RuVlZXIhsoB0JaxloAUfa0RmXobQ=";
   };
 
-  cargoHash = "sha256-5V27ZV+5jWFoGMFe5EXmLdX2BjPuWDMdn4DK54ZIfUY=";
+  cargoHash = "sha256-SVinnMapZ2mFvihYYuBpvyzXQsnwBrpazk/yhSa++8g=";
 
   buildFeatures = lib.optional withNativeTls "native-tls";
 
diff --git a/pkgs/by-name/xl/xlights/package.nix b/pkgs/by-name/xl/xlights/package.nix
index 10585522ef4a..aed9abf6e218 100644
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "xlights";
-  version = "2024.19";
+  version = "2024.20";
 
   src = fetchurl {
     url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-pq+Xe2PRmQ1XpxH1gQi2zTpJlFABTer3g52PNgSOFnw=";
+    hash = "sha256-2AGmCXmTMf5DYxO+qC7qPpPqmGrnoeREw7a1kuboDc4=";
   };
 
   meta = {
diff --git a/pkgs/by-name/yq/yq-go/package.nix b/pkgs/by-name/yq/yq-go/package.nix
index 0a057378fdc3..3545da8a3a3d 100644
--- a/pkgs/by-name/yq/yq-go/package.nix
+++ b/pkgs/by-name/yq/yq-go/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.44.6";
+  version = "4.45.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-C9ql10PnEeGF8mnyLR25ibwLyE4SlqnpDNcPei9FnBw=";
+    hash = "sha256-AsTDbeRMb6QJE89Z0NGooyTY3xZpWFoWkT7dofsu0DI=";
   };
 
-  vendorHash = "sha256-B6ivzm7J0wYdYruGZ2N6SyvghsRRJlVlk84CuaF5PVA=";
+  vendorHash = "sha256-d4dwhZYzEuyh1zJQ2xU0WkygHjoVLoCBrDKuAHUzu1w=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix b/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
index 1df3f67dc3e4..bdcbdc0898a4 100644
--- a/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
+++ b/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
@@ -1,38 +1,43 @@
+# To update, get the latest URLs from Archive Downloads, eg.
+# https://www.oracle.com/java/technologies/javase/graalvm-jdk23-archive-downloads.html
+# Then run this script:
+# $ rg -No "(https://.+)\"" -r '$1' pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix | \
+#   parallel -k 'echo {}; nix hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
 {
   "22" = {
     "aarch64-linux" = {
-      hash = "sha256-E0Fm6mFB7o39pu7JVWOoXT9BdPWiSXBx2hPvlruD5ls=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_linux-aarch64_bin.tar.gz";
+      hash = "sha256-skemwlgUzJzqm2XOyKkjblIwKnHDSqpzdunrMB+Dlvs=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_linux-aarch64_bin.tar.gz";
     };
     "x86_64-linux" = {
-      hash = "sha256-1YPNsBygI6N+7UXZ0YS2i3qNf1C1jd4TaQQfKUw09KM=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_linux-x64_bin.tar.gz";
+      hash = "sha256-GIGqLEMbBQbssXBDmDKwU7dXNo1xCb1CIpjKI+eTnNA=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_linux-x64_bin.tar.gz";
     };
     "x86_64-darwin" = {
-      hash = "sha256-waR39L44Ew8wznRc67tYD3HGFZ2UUD4+ELerWnxNpms=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_macos-x64_bin.tar.gz";
+      hash = "sha256-n8vz/5bzjzHi9ZC7Yq3xngZVNcguJ7X9dC3vAFvvNSg=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_macos-x64_bin.tar.gz";
     };
     "aarch64-darwin" = {
-      hash = "sha256-dzUVPih81jopuxAx8sAYdwonNOXHyyirUUOhvStK1F8=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_macos-aarch64_bin.tar.gz";
+      hash = "sha256-O4IYBkBDJXRrCj3jISgSPVje85W2kd8cQmedlzfVh+c=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_macos-aarch64_bin.tar.gz";
     };
   };
   "17" = {
     "aarch64-linux" = {
-      hash = "sha256-0J/XaXGzNyBgxrW1HgUvtBCPPRfAvzwOx67p/QcY4u0=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_linux-aarch64_bin.tar.gz";
+      hash = "sha256-vZkdSGuS3rdDN7iB4PE6dkycHpD8NYgZCA9zIfpRdeg=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-aarch64_bin.tar.gz";
     };
     "x86_64-linux" = {
-      hash = "sha256-t0GHR7MGSZDSAGeX7bsI1ziugaP4euRcJq+covDBUYw=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_linux-x64_bin.tar.gz";
+      hash = "sha256-tvPaziTPGWDseQIW9MhvANT0PfZOTotUj2OC8EiUcT8=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-x64_bin.tar.gz";
     };
     "x86_64-darwin" = {
-      hash = "sha256-q9b6I5hSVt67gkYzUtsJDSi4bPEkzpkoeC5ZyxfqJRc=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_macos-x64_bin.tar.gz";
+      hash = "sha256-PsrBRx8/qVpWxbdcZdueYKxFUfVu2gnrnaleYEnqd9c=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-x64_bin.tar.gz";
     };
     "aarch64-darwin" = {
-      hash = "sha256-o4BGCfnD25AVYwG1Ol+2eDVCgiB+mk4I1JBIjyETK6s=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_macos-aarch64_bin.tar.gz";
+      hash = "sha256-TN/cbJOV9nc+/NGRtmBfG3yOG3irkAq1z/NHIKP+/8U=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-aarch64_bin.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index aac1dc74aff5..7d37cb623576 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libmikmod";
-  version = "3.3.11.1";
+  version = "3.3.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/mikmod/libmikmod-${version}.tar.gz";
-    sha256 = "06bdnhb0l81srdzg6gn2v2ydhhaazza7rshrcj3q8dpqr3gn97dd";
+    sha256 = "sha256-re9iFIY1FqSltE6/LHHvhOzf6zRElz2suscJEcm8Z+k=";
   };
 
   buildInputs =
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 9c40e3edd7e6..899d7eb2a8af 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -579,14 +579,14 @@ buildLuarocksPackage {
 fzf-lua = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "fzf-lua";
-  version = "0.0.1594-1";
+  version = "0.0.1635-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fzf-lua-0.0.1594-1.rockspec";
-    sha256 = "1hc23a5kf3343jzcqwlz51af5a3yfxhbspsfy4p1lzvw596hlq38";
+    url    = "mirror://luarocks/fzf-lua-0.0.1635-1.rockspec";
+    sha256 = "0d7kvdxs923qhmrfh7zcnsxqnfd5fzzi2mlgpvskb6pjg5qnshar";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/ibhagwan/fzf-lua/archive/dbc5bd14e72ba680df44906e957b0a821121726b.zip";
-    sha256 = "1qcgacgrn6jmqi623rqav45rz83r9m3xv4k5bm5f8lnqdyi3r0av";
+    url    = "https://github.com/ibhagwan/fzf-lua/archive/af6ecbd7f421e7894127a9e94b40e13172fbfb13.zip";
+    sha256 = "0zvbid4553sag41l5zx3j331nq17p1k6n2gbs7ynkbbd530qvsmf";
   };
 
   disabled = luaOlder "5.1";
@@ -630,8 +630,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "lewis6991";
     repo = "gitsigns.nvim";
-    rev = "5f808b5e4fef30bd8aca1b803b4e555da07fc412";
-    hash = "sha256-H7A+AxioiedSuC+jqRwP4c7DjZR/0j4o/fTUasT2urc=";
+    rev = "68114837e81ca16d06514c3a997c9102d1b25c15";
+    hash = "sha256-NmqXgzGp+y/WWrMxXKuQFIsKS3kYxKyAA6Qa5SGvqIw=";
   };
 
   disabled = lua.luaversion != "5.1";
@@ -2377,14 +2377,14 @@ buildLuarocksPackage {
 luautf8 = callPackage({ buildLuarocksPackage, fetchurl, luaOlder }:
 buildLuarocksPackage {
   pname = "luautf8";
-  version = "0.1.5-2";
+  version = "0.1.6-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luautf8-0.1.5-2.rockspec";
-    sha256 = "0v788kk1aj7r70w9fgjlp3qrpjbpa9z9l1m7d13csk0pgfkm5iqz";
+    url    = "mirror://luarocks/luautf8-0.1.6-1.rockspec";
+    sha256 = "0piqf7nxhkgawib8ymvqaw2jn0ksnw1ahcxxiry121r4cxq5i65h";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.5.tar.gz";
-    sha256 = "077ji840wfmy7hq0y13l01dv6jhasznykf89gk9m672jhz6dxggl";
+    url    = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.6.tar.gz";
+    sha256 = "0mlnfsskbsjd6d643yb9i03r5135w5x8hrlaa00bv6mhmys76s5p";
   };
 
   disabled = luaOlder "5.1";
@@ -2795,14 +2795,14 @@ buildLuarocksPackage {
 neotest = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio, plenary-nvim }:
 buildLuarocksPackage {
   pname = "neotest";
-  version = "5.7.0-1";
+  version = "5.8.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/neotest-5.7.0-1.rockspec";
-    sha256 = "1fzvcz54vrcjashjpq6bd10yy0kvzsfz2kk2b7imfqnjgwq44d15";
+    url    = "mirror://luarocks/neotest-5.8.0-1.rockspec";
+    sha256 = "05gm5hpy5pralchkr0d3zfc5l7zs9qv6xflk9482rysfnkm7d3dh";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neotest/neotest/archive/0dccb5ebcf00de245e2060fa17822a9464f5c41a.zip";
-    sha256 = "15zkhdbkgla3ycxzbl6l2wspcx5ig9q58wsp3cnh1biffk4zn102";
+    url    = "https://github.com/nvim-neotest/neotest/archive/d66cf4e05a116957f0d3a7755a24291c7d1e1f72.zip";
+    sha256 = "09bxarrrfnqvyv22ls6lm0y03ngcp6r372b8hy4rld902psdb11q";
   };
 
   disabled = luaOlder "5.1";
@@ -2871,8 +2871,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "hrsh7th";
     repo = "nvim-cmp";
-    rev = "b555203ce4bd7ff6192e759af3362f9d217e8c89";
-    hash = "sha256-Z/Qy2ErbCa7dbjZVuJUkMmb4d24amNunNgRcbCGPfOg=";
+    rev = "8c82d0bd31299dbff7f8e780f5e06d2283de9678";
+    hash = "sha256-TmXpMgkPWXHn4+leojZg1V18wOiPDsKQeG1h8nGgVHo=";
   };
 
   disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -3192,14 +3192,14 @@ buildLuarocksPackage {
 rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "rustaceanvim";
-  version = "5.20.1-1";
+  version = "5.22.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-5.20.1-1.rockspec";
-    sha256 = "0g1s35k1wysi59mhnfbzhxhgqd4jm2n250q8cqizpazslhis8gvf";
+    url    = "mirror://luarocks/rustaceanvim-5.22.0-1.rockspec";
+    sha256 = "0qjawr2y5ll9kksyfjx1v52kk7kca4hs5c7rqiz4zvvxszqbpayp";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/v5.20.1.zip";
-    sha256 = "1zq7p087cg9c9fl7lpcb7pg6kndiywp9cp2ja6jml3q6smb84i4d";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/v5.22.0.zip";
+    sha256 = "0wxvfj6xb5b3ikxjdwnri8mc1dnjgln67yp83461c2p822yiwl6s";
   };
 
   disabled = luaOlder "5.1";
@@ -3411,8 +3411,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "nvim-telescope";
     repo = "telescope.nvim";
-    rev = "2eca9ba22002184ac05eddbe47a7fe2d5a384dfc";
-    hash = "sha256-npb61MZYAotz71Co5G1dUeIqWt7GVeqZNz0A2Yz2dy4=";
+    rev = "415af52339215926d705cccc08145f3782c4d132";
+    hash = "sha256-5y8srYKaAqFplMtDjsc8GdDF8yui5vCNMiOeFLrC/sM=";
   };
 
   disabled = lua.luaversion != "5.1";
@@ -3549,16 +3549,16 @@ buildLuarocksPackage {
 vusted = callPackage({ buildLuarocksPackage, busted, fetchFromGitHub, fetchurl, luasystem }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.5.1-1";
+  version = "2.5.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.5.1-1.rockspec";
-    sha256 = "14h1vbms6ygqpdfsms1prvp29ld8kk1w2qa2c9b6i02h3dg45dv6";
+    url    = "mirror://luarocks/vusted-2.5.2-1.rockspec";
+    sha256 = "15khykwiqipzrgj84ny4wc18iv5qs4a6vl6czmy2g8pxldipqf81";
   }).outPath;
   src = fetchFromGitHub {
     owner = "notomo";
     repo = "vusted";
-    rev = "v2.5.1";
-    hash = "sha256-XHAPgLNGVdqyeukqimLqRlDhuiMEhOhBO0vUIFDAPjM=";
+    rev = "v2.5.2";
+    hash = "sha256-sYRMzuCUDFe77JMG9D4LedcPa+hAKIKZiEt+stOVl7g=";
   };
 
   propagatedBuildInputs = [ busted luasystem ];
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 62d1cf91c85c..54f0ea30053d 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -877,12 +877,6 @@ in
   });
 
   vusted = prev.vusted.overrideAttrs (_: {
-    postConfigure = ''
-      cat ''${rockspecFilename}
-      substituteInPlace ''${rockspecFilename} \
-        --replace-fail '"luasystem = 0.2.1",' "'luasystem >= 0.2',"
-    '';
-
     # make sure vusted_entry.vim doesn't get wrapped
     postInstall = ''
       chmod -x $out/bin/vusted_entry.vim
diff --git a/pkgs/development/misc/juce/default.nix b/pkgs/development/misc/juce/default.nix
index 62c11bc4c5b2..fc14aeeb3dc2 100644
--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/development/misc/juce/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
 
   # Native build inputs
   cmake,
diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index 289d0ee84d4c..6f98a275bdeb 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomeconnect";
-  version = "0.7.5";
+  version = "0.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${version}";
-    hash = "sha256-1+2ezwmlzLYbrODGNoOzd9Gbjl/5BzarmXr8eiaKZ9c=";
+    hash = "sha256-SHrhlchjyUPhf/LnIHB/b90aglboVArcQ/YTOw1vbII=";
   };
 
   pythonRelaxDeps = [ "httpx" ];
diff --git a/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix b/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix
index 5063e4313224..77ca01bfda4c 100644
--- a/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix
+++ b/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp-fast-zlib";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "aiohttp-fast-zlib";
     tag = "v${version}";
-    hash = "sha256-fvZVviKN/CL42Zmmm6k/JNdeAljRoqN63rlduNJVr98=";
+    hash = "sha256-OVxt1SQXOFbgnmA3FP56xixmgh5gOe/HDgzPVlr0JPg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aioimaplib/default.nix b/pkgs/development/python-modules/aioimaplib/default.nix
index 3946992eb8fd..3c8e43c83980 100644
--- a/pkgs/development/python-modules/aioimaplib/default.nix
+++ b/pkgs/development/python-modules/aioimaplib/default.nix
@@ -1,48 +1,46 @@
 {
   lib,
-  asynctest,
   buildPythonPackage,
-  docutils,
   fetchFromGitHub,
   imaplib2,
   mock,
+  poetry-core,
   pyopenssl,
+  pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
   pytz,
-  setuptools,
-  tzlocal,
 }:
 
 buildPythonPackage rec {
   pname = "aioimaplib";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bamthomas";
     repo = "aioimaplib";
     tag = version;
-    hash = "sha256-TjCPGZGsSb+04kQNzHU3kWBo2vY34ujEqh1GIMIehJc=";
+    hash = "sha256-GBehZq2F9vJQGbeBuG1EGmTt8s7XcnTIIK0QQAB+ZII=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ poetry-core ];
 
   nativeCheckInputs = [
-    asynctest
-    docutils
     imaplib2
     mock
     pyopenssl
+    pytest-asyncio
     pytestCheckHook
     pytz
-    tzlocal
   ];
 
-  # https://github.com/bamthomas/aioimaplib/issues/54
-  doCheck = pythonOlder "3.11";
+  disabledTests = [
+    # TimeoutError
+    "test_idle_start__exits_queue_get_without_timeout_error"
+  ];
 
   pythonImportsCheck = [ "aioimaplib" ];
 
diff --git a/pkgs/development/python-modules/airthings-ble/default.nix b/pkgs/development/python-modules/airthings-ble/default.nix
index 82d92c635eb7..5bb05d175447 100644
--- a/pkgs/development/python-modules/airthings-ble/default.nix
+++ b/pkgs/development/python-modules/airthings-ble/default.nix
@@ -5,6 +5,7 @@
   bleak,
   bleak-retry-connector,
   buildPythonPackage,
+  cbor2,
   fetchFromGitHub,
   poetry-core,
   pytest-cov-stub,
@@ -14,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "airthings-ble";
-  version = "0.9.2";
+  version = "1.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "vincegio";
     repo = "airthings-ble";
     tag = version;
-    hash = "sha256-m2jsXLrj2yS2Wi2dSwyxBv/nXmU738gd5iJ1JVfakUg=";
+    hash = "sha256-RKvQ3w3unDk/U6dz3r0Pn3ppVA6ZGxUoyuVk5jbI8jc=";
   };
 
   build-system = [ poetry-core ];
@@ -32,7 +33,8 @@ buildPythonPackage rec {
     async-interrupt
     bleak
     bleak-retry-connector
-  ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
+    cbor2
+  ];
 
   nativeCheckInputs = [
     pytest-cov-stub
@@ -45,7 +47,7 @@ buildPythonPackage rec {
     description = "Library for Airthings BLE devices";
     homepage = "https://github.com/vincegio/airthings-ble";
     changelog = "https://github.com/vincegio/airthings-ble/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/azure-mgmt-compute/default.nix b/pkgs/development/python-modules/azure-mgmt-compute/default.nix
index d41e95e2e42e..8094b0b49d57 100644
--- a/pkgs/development/python-modules/azure-mgmt-compute/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-compute/default.nix
@@ -11,14 +11,15 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-compute";
-  version = "33.0.0";
+  version = "33.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-o8wP5PCcjh01I8G/uSYg3+JjoKiTsKwToz1wV+nd3dI=";
+    pname = "azure_mgmt_compute";
+    inherit version;
+    hash = "sha256-9aXhilp6A1RWK7+libXbSq8eisOhlKKpENtVkA0lNek=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 1d834ff47165..d376194412ad 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.101";
+  version = "0.2.104";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = "boschshcpy";
     tag = version;
-    hash = "sha256-PUTa4ypq6zmoeNMp5SyqB05H//M2zNVILcjmU5Mzv8M=";
+    hash = "sha256-16LHTg+ROP+sn9iFXSNTqgE/zW+mWMeVgItFJeGItaI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/finitude/default.nix b/pkgs/development/python-modules/finitude/default.nix
index cf2e80928f06..dbc2a6282c81 100644
--- a/pkgs/development/python-modules/finitude/default.nix
+++ b/pkgs/development/python-modules/finitude/default.nix
@@ -6,27 +6,29 @@
   pyserial,
   pythonOlder,
   pyyaml,
+  legacy-cgi,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "finitude";
   version = "0.1.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "dulitz";
-    repo = pname;
-    rev = "v${version}";
+    repo = "finitude";
+    tag = "v${version}";
     hash = "sha256-yCI5UCRDhw+dJoTKyjmHbAGBm3by2AyxHKlqCywnLcs=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pyserial
+    legacy-cgi
     prometheus-client
     pyyaml
   ];
@@ -36,10 +38,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "finitude" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python module to get data from ABCD bus (RS-485) used by Carrier Infinity and Bryant Evolution HVAC systems";
     homepage = "https://github.com/dulitz/finitude";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    changelog = "https://github.com/dulitz/finitude/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/flask-bootstrap/default.nix b/pkgs/development/python-modules/flask-bootstrap/default.nix
index 4c4e24aa7225..2c7cd8dcb51b 100644
--- a/pkgs/development/python-modules/flask-bootstrap/default.nix
+++ b/pkgs/development/python-modules/flask-bootstrap/default.nix
@@ -1,32 +1,53 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
   flask,
   visitor,
   dominate,
+  pytestCheckHook,
+  requests,
 }:
 
 buildPythonPackage rec {
   pname = "flask-bootstrap";
   version = "3.3.7.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "Flask-Bootstrap";
-    inherit version;
-    sha256 = "1j1s2bplaifsnmr8vfxa3czca4rz78xyhrg4chx39xl306afs26b";
+  src = fetchFromGitHub {
+    owner = "mbr";
+    repo = "flask-bootstrap";
+    tag = version;
+    hash = "sha256-TsRSNhrI1jZU/beX3G7LM64IrFagD6AYiluoGzy12jE=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     flask
     visitor
     dominate
   ];
 
-  meta = with lib; {
+  pythonImportsCheck = [ "flask_bootstrap" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests
+  ];
+
+  disabledTests = [
+    # requires network access
+    "test_bootstrap_version_matches"
+    # requires flask-appconfig
+    "test_index"
+  ];
+
+  meta = {
     homepage = "https://github.com/mbr/flask-bootstrap";
     description = "Ready-to-use Twitter-bootstrap for use in Flask";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/flask-common/default.nix b/pkgs/development/python-modules/flask-common/default.nix
deleted file mode 100644
index 00881d7d8fe5..000000000000
--- a/pkgs/development/python-modules/flask-common/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  fetchPypi,
-  buildPythonPackage,
-  crayons,
-  flask,
-  flask-caching,
-  gunicorn,
-  maya,
-  meinheld,
-  whitenoise,
-}:
-
-buildPythonPackage rec {
-  pname = "flask-common";
-  version = "0.3.0";
-
-  src = fetchPypi {
-    pname = "Flask-Common";
-    inherit version;
-    sha256 = "13d99f2dbc0a332b8bc4b2cc394d3e48f89672c266868e372cd9d7b433d921a9";
-  };
-
-  propagatedBuildInputs = [
-    crayons
-    flask
-    flask-caching
-    gunicorn
-    maya
-    meinheld
-    whitenoise
-  ];
-
-  meta = with lib; {
-    description = "Flask extension with lots of common time-savers";
-    homepage = "https://github.com/kennethreitz/flask-common";
-    license = licenses.asl20; # XXX: setup.py lists BSD but git repo has Apache 2.0 LICENSE
-  };
-}
diff --git a/pkgs/development/python-modules/flask-seasurf/default.nix b/pkgs/development/python-modules/flask-seasurf/default.nix
index 4ea3134fefa8..31a20d9b4b41 100644
--- a/pkgs/development/python-modules/flask-seasurf/default.nix
+++ b/pkgs/development/python-modules/flask-seasurf/default.nix
@@ -1,53 +1,40 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   buildPythonPackage,
-  isPy3k,
+  setuptools,
   flask,
   mock,
-  unittestCheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "flask-seasurf";
-  version = "1.1.1";
-  disabled = !isPy3k;
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maxcountryman";
     repo = "flask-seasurf";
-    rev = version;
-    hash = "sha256-L/ZUEqqHmsyXG5eShcITII36ttwQlZN5GBngo+GcCdw=";
+    tag = version;
+    hash = "sha256-ajQiDizNaF0em9CVeaHEuJEeSaYraJh9YgvhvBPTIsk=";
   };
 
-  patches = [
-    # Remove usage of deprecated flask._app_ctx_stack
-    (fetchpatch {
-      url = "https://github.com/maxcountryman/flask-seasurf/commit/9039764a4e44aeb1acb6ae7747deb438bee0826b.patch";
-      hash = "sha256-bVYzJN6MXzH3fNMknd2bh+04JlPJRkU0cLcWv+Rigqc=";
-    })
-    ./0001-Fix-with-new-dependency-versions.patch
-  ];
+  build-system = [ setuptools ];
 
-  postPatch = ''
-    # Disable some tests, pytest is not supported
-    sed -i "s#\(\(test_header_set_on_post\|test_https_good_referer\|test_https_referer_check_disabled\)(self):\)#\1\n        return#g" test_seasurf.py
-  '';
-
-  propagatedBuildInputs = [ flask ];
+  dependencies = [ flask ];
 
   nativeCheckInputs = [
-    unittestCheckHook
+    pytestCheckHook
     mock
   ];
 
   pythonImportsCheck = [ "flask_seasurf" ];
 
-  meta = with lib; {
+  meta = {
     description = "Flask extension for preventing cross-site request forgery";
     homepage = "https://github.com/maxcountryman/flask-seasurf";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ zhaofengli ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ zhaofengli ];
   };
 }
diff --git a/pkgs/development/python-modules/flask-silk/default.nix b/pkgs/development/python-modules/flask-silk/default.nix
index db54dcf8ef79..8cb47f81e530 100644
--- a/pkgs/development/python-modules/flask-silk/default.nix
+++ b/pkgs/development/python-modules/flask-silk/default.nix
@@ -2,12 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   flask,
+  pytestCheckHook,
 }:
 
 buildPythonPackage {
   pname = "flask-silk";
-  version = "unstable-2018-06-28";
+  version = "0.2-unstable-2018-06-14";
+  pyproject = true;
 
   # master fixes flask import syntax and has no major changes
   # new release requested: https://github.com/sublee/flask-silk/pull/6
@@ -15,15 +18,28 @@ buildPythonPackage {
     owner = "sublee";
     repo = "flask-silk";
     rev = "3a8166550f9a0ec52edae7bf31d9818c4c15c531";
-    sha256 = "0mplziqw52jfspas6vsm210lmxqqzgj0dxm8y0i3gpbyyykwcmh0";
+    hash = "sha256-AFbGp/d+3Tci8Kj2BuT7GPdKQRBVb6PV1U6KwnH89FY=";
   };
 
-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];
 
-  meta = with lib; {
+  dependencies = [ flask ];
+
+  pythonImportsCheck = [ "flask_silk" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "test.py" ];
+
+  disabledTests = [
+    # requires network access
+    "test_subdomain"
+  ];
+
+  meta = {
     description = "Adds silk icons to your Flask application or module, or extension";
-    license = licenses.bsd3;
-    maintainers = teams.sage.members;
+    license = lib.licenses.bsd3;
+    maintainers = lib.teams.sage.members;
     homepage = "https://github.com/sublee/flask-silk";
   };
 }
diff --git a/pkgs/development/python-modules/flask-sslify/default.nix b/pkgs/development/python-modules/flask-sslify/default.nix
index f384c875a770..70269342763a 100644
--- a/pkgs/development/python-modules/flask-sslify/default.nix
+++ b/pkgs/development/python-modules/flask-sslify/default.nix
@@ -3,27 +3,32 @@
   fetchPypi,
   buildPythonPackage,
   flask,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "flask-sslify";
   version = "0.1.5";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Flask-SSLify";
     inherit version;
-    sha256 = "0gjl1m828z5dm3c5dpc2qjgi4llf84cp72mafr0ib5fd14y1sgnk";
+    hash = "sha256-0z4dPAnNlRVBdqqKcxlBjlISn8SC3VbYqK18JFANVD4=";
   };
 
-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];
 
+  dependencies = [ flask ];
+
+  # no tests
   doCheck = false;
   pythonImportsCheck = [ "flask_sslify" ];
 
-  meta = with lib; {
+  meta = {
     description = "Flask extension that redirects all incoming requests to HTTPS";
     homepage = "https://github.com/kennethreitz42/flask-sslify";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ zhaofengli ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ zhaofengli ];
   };
 }
diff --git a/pkgs/development/python-modules/flask-versioned/default.nix b/pkgs/development/python-modules/flask-versioned/default.nix
index 07bb5cbe40b1..dd47e310eaf3 100644
--- a/pkgs/development/python-modules/flask-versioned/default.nix
+++ b/pkgs/development/python-modules/flask-versioned/default.nix
@@ -2,26 +2,37 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   flask,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "flask-versioned";
-  version = "0.9.4-20101221";
+  version = "0.9.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pilt";
     repo = "flask-versioned";
     rev = "38046fb53a09060de437c90a5f7370a6b94ffc31"; # no tags
-    sha256 = "1wim9hvx7lxzfg35c0nc7p34j4vw9mzisgijlz4ibgykah4g1y37";
+    hash = "sha256-Z/jwCFTTvxXJpzI+HX9NfBNJxj3MAlbGc7/T0zdMNfI=";
   };
 
-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];
 
-  meta = with lib; {
+  dependencies = [ flask ];
+
+  pythonImportsCheck = [ "flaskext.versioned" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonNamespaces = [ "flaskext" ];
+
+  meta = {
     description = "Flask plugin to rewrite file paths to add version info";
     homepage = "https://github.com/pilt/flask-versioned";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index 7e11da049211..d6a3937e53e2 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "0.13.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-EkEXXHca4DJtY1joM1E4IXzaQzJL+QC+aYaTe46EWlE=";
+    hash = "sha256-RoUvUDgUO1M3pSZA0B0eimRvE8buF4FDaz+FD1a241I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index e79e885c3c68..11c7981bed65 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2025.1.0";
+  version = "2025.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "SukramJ";
     repo = "hahomematic";
     tag = version;
-    hash = "sha256-xsMSTZDqfAQFhxJZNPs45Niv700dJDGdT0feTZyIn08=";
+    hash = "sha256-MEGAfpA7TMscCitAjw66lXADrc/Jb1i8REV3V17YZK8=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index 1b66aab9e808..f137ecb2aa81 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_cloud";
     inherit version;
-    hash = "sha256-fBdnyyCZBUAOiUVmZhqRIwvP+DzU2cCOeC/SFDympkY=";
+    hash = "sha256-cZm6siQKnMMwdAAD+ndkj0P25TPaQRqCUKSnBYT5EVM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/moderngl-window/default.nix b/pkgs/development/python-modules/moderngl-window/default.nix
index ff982ca0f070..f87fed067d73 100644
--- a/pkgs/development/python-modules/moderngl-window/default.nix
+++ b/pkgs/development/python-modules/moderngl-window/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -30,25 +29,21 @@
 
 buildPythonPackage rec {
   pname = "moderngl-window";
-  version = "3.0.3";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "moderngl";
     repo = "moderngl_window";
     tag = version;
-    hash = "sha256-WXHQVJJCE+7FQJjRgjnmpoGGnF20OQ6/X6Fnrzsp2fA=";
+    hash = "sha256-oXUdYTvpvaML1YsqK7HudQV/RvUx6N0K/xYuiNp8uos=";
   };
 
-  pythonRelaxDeps = [
-    "numpy" # https://github.com/moderngl/moderngl-window/issues/193
-  ];
-
   build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     moderngl
     numpy
     pillow
@@ -82,6 +77,5 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ c0deaddict ];
     inherit (mesa.meta) platforms;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/pyproj/default.nix b/pkgs/development/python-modules/pyproj/default.nix
index c30042f1dd6c..d419fbb76949 100644
--- a/pkgs/development/python-modules/pyproj/default.nix
+++ b/pkgs/development/python-modules/pyproj/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   pytestCheckHook,
   pythonOlder,
   substituteAll,
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 8f775149f1f5..96ca2309c957 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -187,5 +187,8 @@ buildPythonPackage rec {
       bcdarwin
       ferrine
     ];
+    # Not yet compatible with numpy >= 2.0
+    # https://github.com/pymc-devs/pytensor/issues/688
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index 36422d5596dd..9a3eedf840f2 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "svg2tikz";
-  version = "3.2.0";
+  version = "3.3.0";
 
   disabled = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "xyz2tex";
     repo = "svg2tikz";
     tag = "v${version}";
-    hash = "sha256-5SOUvrK83ff1x4MTVoJy68OaDmZUfrEwraEWmPMJKTA=";
+    hash = "sha256-IIsgyDZkNoKjXt1jyCdBkaT5EWTdS6AmJ4evwbw0fdg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
index e1c2816985b8..930d3bb607c7 100644
--- a/pkgs/development/python-modules/yamale/default.nix
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "yamale";
-  version = "5.2.1";
+  version = "5.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "23andMe";
     repo = "yamale";
     tag = version;
-    hash = "sha256-iiiQAZ050FintRSV3l2zfikTNmphhJgrn+4tUHORiSk=";
+    hash = "sha256-fYH+0OUJ9EnsAQh/VUOUVms1jwqpcLBj/c5uLj/1gVc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/analysis/ikos/default.nix b/pkgs/development/tools/analysis/ikos/default.nix
index f69531bad214..f4ff446abe59 100644
--- a/pkgs/development/tools/analysis/ikos/default.nix
+++ b/pkgs/development/tools/analysis/ikos/default.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   boost,
   tbb,
diff --git a/pkgs/games/chiaki-ng/default.nix b/pkgs/games/chiaki-ng/default.nix
index 28520c26d4fe..edd5f112420d 100644
--- a/pkgs/games/chiaki-ng/default.nix
+++ b/pkgs/games/chiaki-ng/default.nix
@@ -36,13 +36,13 @@
 
 stdenv.mkDerivation rec {
   pname = "chiaki-ng";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = "chiaki-ng";
     rev = "v${version}";
-    hash = "sha256-0oclfGxlLlZMmpiYvsMV3ftn7Vir94G+5Xv0/B7YfPg=";
+    hash = "sha256-IkmNl2zoC/1ZF3QuTFtfmqD+oq4HJfM5uRdhgQSNkcI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 1348ce1c3ba9..b5ac3562128a 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "20.1.3-55743";
+  version = "20.2.0-55872";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-5lbTTQucop/jnsVudoqTO9bESR5tdn8NFu9Nm2WphU4=";
+    hash = "sha256-oOilbF5MzZxZXNVQYAp/JxyMVdM0oltG8pGfzzsQ1kY=";
   };
 
   hardeningDisable = [
@@ -115,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     ( # kernel modules
       cd kmods
       mkdir -p $out/lib/modules/${kernelVersion}/extra
-      cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
       cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
       cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
       ${lib.optionalString stdenv.hostPlatform.isAarch64 "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
@@ -169,9 +168,6 @@ stdenv.mkDerivation (finalAttrs: {
         ln -s $out/$i $out/''${i%.0.0}
       done
 
-      mkdir -p $out/share/man/man8
-      install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
-
       substituteInPlace ../99prltoolsd-hibernate \
         --replace "/bin/bash" "${bash}/bin/bash"
 
diff --git a/pkgs/os-specific/linux/prl-tools/update.sh b/pkgs/os-specific/linux/prl-tools/update.sh
index b1000fbd966c..a720ca8856db 100755
--- a/pkgs/os-specific/linux/prl-tools/update.sh
+++ b/pkgs/os-specific/linux/prl-tools/update.sh
@@ -37,5 +37,4 @@ sha256="$(nix store prefetch-file $dmg_url --json | jq -r '.hash')"
 sed -i -e "s,version = \"$old_version\",version = \"$version\"," \
     -e "s,hash = \"sha256-.*\",hash = \"$sha256\"," "$path"
 
-git commit -qm "linuxPackages_latest.prl-tools: $old_version -> $version" "$path"
 echo "Updated linuxPackages_latest.prl-tools $old_version -> $version"
diff --git a/pkgs/os-specific/linux/system76/default.nix b/pkgs/os-specific/linux/system76/default.nix
index 80ec862c4c4f..86a0c0a88e65 100644
--- a/pkgs/os-specific/linux/system76/default.nix
+++ b/pkgs/os-specific/linux/system76/default.nix
@@ -5,8 +5,8 @@
   kernel,
 }:
 let
-  version = "1.0.16";
-  hash = "sha256-jsBLy5WDl2l8o/2ccIk1XMqOukeDX5eZ+VH5Dyo5BaA=";
+  version = "1.0.17";
+  hash = "sha256-9/t+Mvfnq0KkPbe1mnrVy4mzNaK7vAgLuhUnOeEvBfI=";
 in
 stdenv.mkDerivation {
   name = "system76-module-${version}-${kernel.version}";
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
index 06e9d56f2b87..1630dbdf402c 100644
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "SukramJ";
   domain = "homematicip_local";
-  version = "1.77.0";
+  version = "1.78.0";
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "custom_homematic";
     tag = version;
-    hash = "sha256-l5SK3qB+fst7DQuAykVNXcVpZAaRU5NfWUqRFG/1DMg=";
+    hash = "sha256-WhY+JxX2uUk5pgraqAZqa/NB9lozXbTHr/szXUKAn48=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
index 1ae70654dea4..b021292f9b3c 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "weather-card";
-  version = "1.5.0";
+  version = "2.0.0b0";
 
   src = fetchFromGitHub {
     owner = "bramkragten";
     repo = "weather-card";
     tag = "v${version}";
-    hash = "sha256-pod5cayaHP+4vgdBgBRMQ7szkyz9HLaKVJWQX36XdTY=";
+    hash = "sha256-139OhAHxulXovyywBuz552lmDqoV7aLHKKNb81dOKDo=";
   };
   dontBuild = true;
   installPhase = ''
diff --git a/pkgs/tools/admin/meshcentral/default.nix b/pkgs/tools/admin/meshcentral/default.nix
index bfcf476a005c..93a503d716cc 100644
--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchzip,
-  fetchpatch,
   fetchYarnDeps,
   yarn2nix-moretea,
   nodejs_18,
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index 3184cfe0b602..75598abbfd11 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -1,36 +1,46 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  makeWrapper,
   ocamlPackages,
-  ncurses,
   remind,
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.6";
   pname = "wyrd";
+  version = "1.7.1";
 
-  src = fetchurl {
-    url = "http://pessimization.com/software/wyrd/wyrd-${version}.tar.gz";
-    sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
+  src = fetchFromGitLab {
+    owner = "wyrd-calendar";
+    repo = "wyrd";
+    tag = version;
+    hash = "sha256-RwGzXJLoCWRGgHf1rayBgkZuRwA1TcYNfN/h1rhJC+8=";
   };
 
-  preConfigure = ''
-    substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
-  '';
-
   strictDeps = true;
+
   nativeBuildInputs = [
+    makeWrapper
+    ocamlPackages.findlib
     ocamlPackages.ocaml
-    ocamlPackages.camlp4
+    ocamlPackages.odoc
   ];
+
   buildInputs = [
-    ncurses
+    ocamlPackages.curses
+    ocamlPackages.yojson
     remind
   ];
 
-  preferLocalBuild = true;
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/wyrd" \
+      --prefix PATH : "${lib.makeBinPath [ remind ]}"
+  '';
 
   meta = with lib; {
     description = "Text-based front-end to Remind";
@@ -41,8 +51,8 @@ stdenv.mkDerivation rec {
       flashy GUI dialogs. Rather, Wyrd is designed to make you more
       efficient at editing your reminder files directly.
     '';
-    homepage = "http://pessimization.com/software/wyrd/";
-    downloadPage = "http://pessimization.com/software/wyrd/";
+    homepage = "https://gitlab.com/wyrd-calendar/wyrd";
+    downloadPage = "https://gitlab.com/wyrd-calendar/wyrd";
     license = licenses.gpl2Only;
     maintainers = [ maintainers.prikhi ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 1f2c876d0164..c9382cc05547 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -3,6 +3,7 @@
   lib,
   pkgs,
   fetchurl,
+  bash,
   buildEnv,
   coreutils,
   findutils,
@@ -92,6 +93,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = [ bash ];
+
   installFlags = [
     "PREFIX=$(out)"
     "WITH_ALLCOMP=yes"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2c103d2a0d66..0c2ba8ba4d96 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5541,7 +5541,7 @@ with pkgs;
   wring = nodePackages.wring;
 
   wyrd = callPackage ../tools/misc/wyrd {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_14_unsafe_string;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
   xbursttools = callPackage ../tools/misc/xburst-tools {
@@ -6734,7 +6734,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-lambda = callPackage ../development/tools/rust/cargo-lambda {
-    zig = buildPackages.zig_0_12;
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };
   cargo-ndk = callPackage ../development/tools/rust/cargo-ndk {
@@ -6757,9 +6756,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  cargo-zigbuild = callPackage ../development/tools/rust/cargo-zigbuild {
-    zig = buildPackages.zig_0_12;
-  };
+  cargo-zigbuild = callPackage ../development/tools/rust/cargo-zigbuild { };
 
   opensmalltalk-vm = callPackage ../development/compilers/opensmalltalk-vm { };
 
@@ -14984,9 +14981,7 @@ with pkgs;
 
   qtemu = libsForQt5.callPackage ../applications/virtualization/qtemu { };
 
-  qtox = libsForQt5.callPackage ../applications/networking/instant-messengers/qtox {
-    inherit (darwin.apple_sdk.frameworks) AVFoundation;
-  };
+  qtox = callPackage ../applications/networking/instant-messengers/qtox { };
 
   qtpass = libsForQt5.callPackage ../applications/misc/qtpass { };
 
@@ -15751,7 +15746,7 @@ with pkgs;
 
   webcamoid = libsForQt5.callPackage ../applications/video/webcamoid { };
 
-  webcord = callPackage ../by-name/we/webcord/package.nix { electron = electron_32; };
+  webcord = callPackage ../by-name/we/webcord/package.nix { electron = electron; };
 
   webcord-vencord = callPackage ../by-name/we/webcord-vencord/package.nix { electron = electron_31; };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 926b83659415..8bd8f32db7a3 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -227,6 +227,7 @@ mapAliases ({
   flask_testing = flask-testing; # added 2022-04-25
   flask_wtf = flask-wtf; # added 2022-05-24
   flask-autoindex = throw "flask-autoindex was removed, as it is not compatible with flask 3.0 and unmaintained since 2020.";
+  flask-common = throw "flask-common was removed, as it is not compatible with flask 3.0 and unmaintained since 2018."; # added 2025-01-11
   flask-basicauth = throw "flask-basicauth was removed, as it is not compatible with flask 3.0 and unmaintained since 2016.";
   flask-sessionstore = throw "flask-sessionstore was removed, as it is not compatible with flask 3.0 and unmaintained since 2017.";
   flask-sockets = throw "flask-sockets has been removed as the upstream repository was archived in 2022"; # Added 2025-01-01
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 799636588f6d..7572954ba762 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4669,8 +4669,6 @@ self: super: with self; {
 
   flask = callPackage ../development/python-modules/flask { };
 
-  flask-common = callPackage ../development/python-modules/flask-common { };
-
   flask-compress = callPackage ../development/python-modules/flask-compress { };
 
   flask-cors = callPackage ../development/python-modules/flask-cors { };