diff --git a/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix b/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
index 701bf800d718..d2e51dc9ef62 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
@@ -89,7 +89,7 @@ in
     serviceConfig = {
       DynamicUser = false;
       ExecStart = ''
-        ${pkgs.prometheus-dovecot-exporter}/bin/dovecot_exporter \
+        ${lib.getExe pkgs.dovecot_exporter} \
           --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
           --web.telemetry-path ${cfg.telemetryPath} \
           --dovecot.socket-path ${escapeShellArg cfg.socketPath} \
diff --git a/nixos/modules/services/security/vault-agent.nix b/nixos/modules/services/security/vault-agent.nix
index 37f52f9d5bf6..b16ee53f2cea 100644
--- a/nixos/modules/services/security/vault-agent.nix
+++ b/nixos/modules/services/security/vault-agent.nix
@@ -125,7 +125,7 @@ let
         Group = instance.group;
         RuntimeDirectory = flavour;
         ExecStart = "${lib.getExe instance.package} ${
-          lib.optionalString ((lib.getName instance.package) == "vault") "agent"
+          lib.optionalString (flavour == "vault-agent") "agent"
         } -config ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
         KillSignal = "SIGINT";
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index b8e79022588d..0afbe978d874 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -294,7 +294,11 @@ in {
     https = mkOption {
       type = types.bool;
       default = false;
-      description = "Use HTTPS for generated links.";
+      description = ''
+        Use HTTPS for generated links.
+
+        Be aware that this also enables HTTP Strict Transport Security (HSTS) headers.
+      '';
     };
     package = mkOption {
       type = types.package;
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps/package.json b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps/package.json
deleted file mode 100644
index 3e7688f0e068..000000000000
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps/package.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "name": "rust-analyzer",
-  "version": "0.3.2029",
-  "dependencies": {
-    "@hpcc-js/wasm": "^2.13.0",
-    "anser": "^2.1.1",
-    "d3": "^7.8.5",
-    "d3-graphviz": "^5.0.2",
-    "vscode-languageclient": "^8.1.0",
-    "@tsconfig/strictest": "^2.0.1",
-    "@types/node": "~16.11.7",
-    "@types/vscode": "~1.78.1",
-    "@typescript-eslint/eslint-plugin": "^6.0.0",
-    "@typescript-eslint/parser": "^6.0.0",
-    "@vscode/test-electron": "^2.3.8",
-    "@vscode/vsce": "^2.19.0",
-    "eslint": "^8.44.0",
-    "eslint-config-prettier": "^8.8.0",
-    "ovsx": "^0.8.2",
-    "prettier": "^3.0.0",
-    "tslib": "^2.6.0",
-    "typescript": "^5.1.6"
-  }
-}
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
index bcb076135ae1..5abec4f2f08c 100644
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
@@ -1,10 +1,11 @@
 {
+  pkgsBuildBuild,
   lib,
   fetchFromGitHub,
   vscode-utils,
   jq,
   rust-analyzer,
-  nodePackages,
+  buildNpmPackage,
   moreutils,
   esbuild,
   pkg-config,
@@ -21,28 +22,23 @@ let
   # Use the plugin version as in vscode marketplace, updated by update script.
   inherit (vsix) version;
 
-  releaseTag = "2024-07-08";
+  releaseTag = "2025-02-17";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = releaseTag;
-    hash = "sha256-STmaV9Zu74QtkGGrbr9uMhskwagfCjJqOAYapXabiuk=";
+    hash = "sha256-i76MMFSkCr4kDwurK8CACwZq7qEgVEgIzkOr2kiuAKk=";
   };
 
-  build-deps =
-    nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps";
-  # FIXME: Making a new derivation to link `node_modules` and run `npm run package`
-  # will cause a build failure.
-  vsix = build-deps.override {
+  vsix = buildNpmPackage {
+    inherit pname releaseTag;
+    version = lib.trim (lib.readFile ./version.txt);
     src = "${src}/editors/code";
-    outputs = [
-      "vsix"
-      "out"
+    npmDepsHash = "sha256-0frOGphtzO6z8neSEYfjyRYrM6zEO3wId/TACblZkxM=";
+    buildInputs = [
+      pkgsBuildBuild.libsecret
     ];
-
-    inherit releaseTag;
-
     nativeBuildInputs =
       [
         jq
@@ -50,7 +46,6 @@ let
         esbuild
         # Required by `keytar`, which is a dependency of `vsce`.
         pkg-config
-        libsecret
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         darwin.apple_sdk.frameworks.AppKit
@@ -58,7 +53,7 @@ let
       ];
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
-    postRebuild = ''
+    installPhase = ''
       jq '
         .version = $ENV.version |
         .releaseTag = $ENV.releaseTag |
@@ -66,10 +61,11 @@ let
         walk(del(.["$generated-start"]?) | del(.["$generated-end"]?))
       ' package.json | sponge package.json
 
-      mkdir -p $vsix
-      npx vsce package -o $vsix/${pname}.zip
+      mkdir -p $out
+      npx vsce package -o $out/${pname}.zip
     '';
   };
+
 in
 vscode-utils.buildVscodeExtension {
   inherit version vsix pname;
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/update.sh b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/update.sh
index fbf62c3b9db4..3ccf27d81f81 100755
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/update.sh
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/update.sh
@@ -4,7 +4,6 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 nixpkgs=../../../../../../
-node_packages="$nixpkgs/pkgs/development/node-packages"
 owner=rust-lang
 repo=rust-analyzer
 ver=$(
@@ -25,27 +24,7 @@ fi
 extension_ver=$(curl "https://github.com/$owner/$repo/releases/download/$ver/rust-analyzer-linux-x64.vsix" -L |
     bsdtar -xf - --to-stdout extension/package.json | # Use bsdtar to extract vsix(zip).
     jq --raw-output '.version')
+echo -n $extension_ver > version.txt
 echo "Extension version: $extension_ver"
 
-# We need devDependencies to build vsix.
-# `esbuild` is a binary package an is already in nixpkgs so we omit it here.
-jq '{ name, version: $ver, dependencies: (.dependencies + .devDependencies | del(.esbuild)) }' "$node_src/package.json" \
-    --arg ver "$extension_ver" \
-    >"build-deps/package.json.new"
-
-old_deps="$(jq '.dependencies' build-deps/package.json)"
-new_deps="$(jq '.dependencies' build-deps/package.json.new)"
-if [[ "$old_deps" == "$new_deps" ]]; then
-    echo "package.json dependencies not changed, do simple version change"
-
-    sed -E '/^  "rust-analyzer-build-deps/,+3 s/version = ".*"/version = "'"$extension_ver"'"/' \
-        --in-place "$node_packages"/node-packages.nix
-    mv build-deps/package.json{.new,}
-else
-    echo "package.json dependencies changed, updating nodePackages"
-    mv build-deps/package.json{.new,}
-
-    ./"$node_packages"/generate.sh
-fi
-
 echo "Remember to also update the releaseTag and hash in default.nix!"
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/version.txt b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/version.txt
new file mode 100644
index 000000000000..00f4e21a2312
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/version.txt
@@ -0,0 +1 @@
+0.3.2308
diff --git a/pkgs/applications/graphics/apitrace/default.nix b/pkgs/applications/graphics/apitrace/default.nix
index 0aa3f79b001d..6db2925644d5 100644
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@@ -13,6 +13,7 @@
   libglvnd,
   gtest,
   brotli,
+  enableGui ? true,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,62 +30,75 @@ stdenv.mkDerivation rec {
 
   # LD_PRELOAD wrappers need to be statically linked to work against all kinds
   # of games -- so it's fine to use e.g. bundled snappy.
-  buildInputs = [
-    libX11
-    procps
-    python3
-    libdwarf
-    qtbase
-    gtest
-    brotli
-  ];
+  buildInputs =
+    [
+      libX11
+      procps
+      libdwarf
+      gtest
+      brotli
+    ]
+    ++ lib.optionals enableGui [
+      qtbase
+    ];
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+      python3
+    ]
+    ++ lib.optionals enableGui [
+      wrapQtAppsHook
+    ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_GUI" enableGui)
   ];
 
   # Don't automatically wrap all binaries, I prefer to explicitly only wrap
   # `qapitrace`.
   dontWrapQtApps = true;
 
-  postFixup = ''
+  postFixup =
+    ''
 
-    # Since https://github.com/NixOS/nixpkgs/pull/60985, we add `/run-opengl-driver[-32]`
-    # to the `RUNPATH` of dispatcher libraries `dlopen()` ing OpenGL drivers.
-    # `RUNPATH` doesn't propagate throughout the whole application, but only
-    # from the module performing the `dlopen()`.
-    #
-    # Apitrace wraps programs by running them with `LD_PRELOAD` pointing to `.so`
-    # files in $out/lib/apitrace/wrappers.
-    #
-    # Theses wrappers effectively wrap the `dlopen()` calls from `libglvnd`
-    # and other dispatcher libraries, and run `dlopen()`  by themselves.
-    #
-    # As `RUNPATH` doesn't propagate through the whole library, and they're now the
-    # library doing the real `dlopen()`, they also need to have
-    # `/run-opengl-driver[-32]` added to their `RUNPATH`.
-    #
-    # To stay simple, we add paths for 32 and 64 bits unconditionally.
-    # This doesn't have an impact on closure size, and if the 32 bit drivers
-    # are not available, that folder is ignored.
-    for i in $out/lib/apitrace/wrappers/*.so
-    do
-      echo "Patching OpenGL driver path for $i"
-      patchelf --set-rpath "/run/opengl-driver/lib:/run/opengl-driver-32/lib:$(patchelf --print-rpath $i)" $i
-    done
+      # Since https://github.com/NixOS/nixpkgs/pull/60985, we add `/run-opengl-driver[-32]`
+      # to the `RUNPATH` of dispatcher libraries `dlopen()` ing OpenGL drivers.
+      # `RUNPATH` doesn't propagate throughout the whole application, but only
+      # from the module performing the `dlopen()`.
+      #
+      # Apitrace wraps programs by running them with `LD_PRELOAD` pointing to `.so`
+      # files in $out/lib/apitrace/wrappers.
+      #
+      # Theses wrappers effectively wrap the `dlopen()` calls from `libglvnd`
+      # and other dispatcher libraries, and run `dlopen()`  by themselves.
+      #
+      # As `RUNPATH` doesn't propagate through the whole library, and they're now the
+      # library doing the real `dlopen()`, they also need to have
+      # `/run-opengl-driver[-32]` added to their `RUNPATH`.
+      #
+      # To stay simple, we add paths for 32 and 64 bits unconditionally.
+      # This doesn't have an impact on closure size, and if the 32 bit drivers
+      # are not available, that folder is ignored.
+      for i in $out/lib/apitrace/wrappers/*.so
+      do
+        echo "Patching OpenGL driver path for $i"
+        patchelf --set-rpath "/run/opengl-driver/lib:/run/opengl-driver-32/lib:$(patchelf --print-rpath $i)" $i
+      done
 
-    # Theses open the OpenGL driver at runtime, but it is not listed as NEEDED libraries. They need
-    # a reference to libglvnd.
-    for i in $out/bin/eglretrace $out/bin/glretrace
-    do
-      echo "Patching RPath for $i"
-      patchelf --set-rpath "${lib.makeLibraryPath [ libglvnd ]}:$(patchelf --print-rpath $i)" $i
-    done
+      # Theses open the OpenGL driver at runtime, but it is not listed as NEEDED libraries. They need
+      # a reference to libglvnd.
+      for i in $out/bin/eglretrace $out/bin/glretrace
+      do
+        echo "Patching RPath for $i"
+        patchelf --set-rpath "${lib.makeLibraryPath [ libglvnd ]}:$(patchelf --print-rpath $i)" $i
+      done
 
-    wrapQtApp $out/bin/qapitrace
-  '';
+    ''
+    + lib.optionalString enableGui ''
+      wrapQtApp $out/bin/qapitrace
+    '';
 
   meta = with lib; {
     homepage = "https://apitrace.github.io";
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index 3f736802f614..d9e171a24491 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.6.0";
+  version = "33.6.0.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -172,11 +172,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-fOha0D8drFbKtfl/UA4MqzBhhBrvS3T81XP09RZQc9c=";
+          hash = "sha256-oIgJOLn4+JgRN4dHmSPc5jNIzt9bPYo1f88yyIpylgg=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-r8sAkQ7XiYs39VZjvegVgx7KrfB8WyZfcl/XgGV/kwA=";
+          hash = "sha256-2ljQPbmZWzg4BAujLnlfl9LM3VHSVIIach8NmL6ged8=";
         };
       };
 
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 1dbf1a3d691f..03cac515b846 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -44,11 +44,11 @@
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
-, version ? "3.10.11.0"
+, version ? "3.10.12.0"
 }:
 
 let
-  sourceSha256 = "sha256-QOZXUj+ZmfpazsrHEs8Gx3WSmoHG/zO43NEpyhIjpN8=";
+  sourceSha256 = "sha256-489Pc6z6Ha7jkTzZSEArDQJGkWdWRDIn1uhfFyLLiCo=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -290,12 +290,6 @@ stdenv.mkDerivation (finalAttrs: (shared // {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
-    # https://github.com/gnuradio/gnuradio/issues/7458
-    (fetchpatch {
-      name = "gnuradio-numpy_2-compatibility.patch";
-      url = "https://github.com/gnuradio/gnuradio/commit/8fbc5eb4b7214a4cb029ccae97205a85d49bdd48.patch";
-      hash = "sha256-xYvjlyZ/Bcn23gT3EOee/GhkXzdpA+q33LgURVWOUQI=";
-    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix
index 12b2b9949b2d..d32dff3beb37 100644
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -50,30 +50,35 @@ let
       description,
       ...
     }@args:
-    python3.pkgs.buildPythonPackage (
-      {
-        format = "wheel";
-        src = fetchurl { inherit url hash; };
-        passthru = {
-          updateScript = extensionUpdateScript { inherit pname; };
-        } // args.passthru or { };
-        meta = {
-          inherit description;
-          inherit (azure-cli.meta) platforms maintainers;
-          homepage = "https://github.com/Azure/azure-cli-extensions";
-          changelog = "https://github.com/Azure/azure-cli-extensions/blob/main/src/${pname}/HISTORY.rst";
-          license = lib.licenses.mit;
-          sourceProvenance = [ lib.sourceTypes.fromSource ];
-        } // args.meta or { };
-      }
-      // (removeAttrs args [
-        "url"
-        "hash"
-        "description"
-        "passthru"
-        "meta"
-      ])
-    );
+    let
+      self = python3.pkgs.buildPythonPackage (
+        {
+          format = "wheel";
+          src = fetchurl { inherit url hash; };
+          passthru = {
+            updateScript = extensionUpdateScript { inherit pname; };
+            tests.azWithExtension = testAzWithExts [ self ];
+          } // args.passthru or { };
+          meta = {
+            inherit description;
+            inherit (azure-cli.meta) platforms maintainers;
+            homepage = "https://github.com/Azure/azure-cli-extensions";
+            changelog = "https://github.com/Azure/azure-cli-extensions/blob/main/src/${pname}/HISTORY.rst";
+            license = lib.licenses.mit;
+            sourceProvenance = [ lib.sourceTypes.fromSource ];
+          } // args.meta or { };
+        }
+        // (removeAttrs args [
+          "url"
+          "hash"
+          "description"
+          "passthru"
+          "meta"
+        ])
+      );
+    in
+    self;
+
   # Update script for azure cli extensions. Currently only works for manual extensions.
   extensionUpdateScript =
     { pname }:
@@ -85,6 +90,25 @@ let
       "${pname}"
     ];
 
+  # Test that the Azure CLI can be built with the given extensions, and that
+  # the extensions are recognized by the CLI and listed in the output.
+  testAzWithExts =
+    extensions:
+    let
+      extensionNames = map (ext: ext.pname) extensions;
+      az = (azure-cli.withExtensions extensions);
+    in
+    runCommand "test-az-with-extensions" { } ''
+      export HOME=$TMPDIR
+      ${lib.getExe az} extension list > $out
+      for ext in ${lib.concatStringsSep " " extensionNames}; do
+        if ! grep -q $ext $out; then
+          echo "Extension $ext not found in list"
+          exit 1
+        fi
+      done
+    '';
+
   extensions-generated = lib.mapAttrs (
     name: ext: mkAzExtension (ext // { passthru.updateScript = [ ]; })
   ) (builtins.fromJSON (builtins.readFile ./extensions-generated.json));
@@ -362,28 +386,14 @@ py.pkgs.toPythonApplication (
       inherit extensions;
       withExtensions = extensions: azure-cli.override { withExtensions = extensions; };
       tests = {
-        # Test the package builds with some extensions configured, and the
-        # wanted extensions are recognized by the CLI and listed in the output.
-        azWithExtensions =
-          let
-            extensions = with azure-cli.extensions; [
-              aks-preview
-              azure-devops
-              rdbms-connect
-            ];
-            extensionNames = map (ext: ext.pname) extensions;
-            az = (azure-cli.withExtensions extensions);
-          in
-          runCommand "test-az-with-extensions" { } ''
-            export HOME=$TMPDIR
-            ${lib.getExe az} extension list > $out
-            for ext in ${lib.concatStringsSep " " extensionNames}; do
-              if ! grep -q $ext $out; then
-                echo "Extension $ext not found in list"
-                exit 1
-              fi
-            done
-          '';
+        azWithExtensions = testAzWithExts (
+          with azure-cli.extensions;
+          [
+            aks-preview
+            azure-devops
+            rdbms-connect
+          ]
+        );
         # Test the package builds with mutable config.
         # TODO: Maybe we can install an extension from local python wheel to
         #       check mutable extension install still works.
diff --git a/pkgs/by-name/da/datafusion-cli/package.nix b/pkgs/by-name/da/datafusion-cli/package.nix
index 5f36327b125e..3b1d7284116f 100644
--- a/pkgs/by-name/da/datafusion-cli/package.nix
+++ b/pkgs/by-name/da/datafusion-cli/package.nix
@@ -8,20 +8,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "datafusion-cli";
-  version = "44.0.0";
+  version = "45.0.0";
 
   src = fetchFromGitHub {
     name = "datafusion-cli-source";
     owner = "apache";
     repo = "arrow-datafusion";
     rev = version;
-    sha256 = "sha256-235z+dyEt36sPY2UMVMMdakrDe2WWqPCk2/flEX6s4Y=";
+    sha256 = "sha256-XIxUp4i68psNtKoFR/uVJHCToz681m2q8qUhtMQKCLo=";
   };
 
   sourceRoot = "${src.name}/datafusion-cli";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hRnVwFhqPq7NiwRPeXzrhv/n58QHEIS9YgXZAFbvn6M=";
+  cargoHash = "sha256-qJjZ4Um2K27IJy7w99kJGs5ZB1y57xd6P896+Hm2GOg=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/do/dolibarr/package.nix b/pkgs/by-name/do/dolibarr/package.nix
index 7b9f19afd249..fb40bffd630b 100644
--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@@ -1,6 +1,6 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   nixosTests,
   stateDir ? "/var/lib/dolibarr",
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolibarr";
-  version = "20.0.3";
+  version = "20.0.4";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     tag = finalAttrs.version;
-    hash = "sha256-JqCDFdOkVQb9zH/ZCm7LsQktYDXXaB+0lS3HWqxE3YM=";
+    hash = "sha256-CAVSW/OU8JW8zfu9pK8u2szvTJWPaQzEQcGriHi4s1E=";
   };
 
   dontBuild = true;
@@ -36,7 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r * $out
   '';
 
-  passthru.tests = { inherit (nixosTests) dolibarr; };
+  passthru.tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    inherit (nixosTests) dolibarr;
+  };
 
   meta = {
     description = "Enterprise resource planning (ERP) and customer relationship manager (CRM) server";
diff --git a/pkgs/by-name/ga/garmindb/package.nix b/pkgs/by-name/ga/garmindb/package.nix
new file mode 100644
index 000000000000..b7093d52b441
--- /dev/null
+++ b/pkgs/by-name/ga/garmindb/package.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "garmindb";
+  version = "3.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tcgoetz";
+    repo = "garmindb";
+    tag = "v${version}";
+    hash = "sha256-JAUDAYf9CH/BxwV88ziF5Zy+3ibcbieEfHrZpHSU8m0=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    sqlalchemy
+    python-dateutil
+    cached-property
+    tqdm
+    garth
+    fitfile
+    tcxfile
+    idbutils
+    tornado
+  ];
+
+  pythonRelaxDeps = [
+    "sqlalchemy"
+    "cached-property"
+    "tqdm"
+    "fitfile"
+    "tcxfile"
+    "idbutils"
+  ];
+
+  # require data files
+  disabledTestPaths = [
+    "test/test_activities_db.py"
+    "test/test_config.py"
+    "test/test_copy.py"
+    "test/test_db_base.py"
+    "test/test_fit_file.py"
+    "test/test_garmin_db.py"
+    "test/test_garmin_db_objects.py"
+    "test/test_garmin_summary_db.py"
+    "test/test_monitoring_db.py"
+    "test/test_profile_file.py"
+    "test/test_summary_db.py"
+    "test/test_summary_db_base.py"
+    "test/test_tcx_file.py"
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  meta = {
+    description = "Download and parse data from Garmin Connect or a Garmin watch";
+    homepage = "https://github.com/tcgoetz/GarminDB";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "garmindb";
+  };
+}
diff --git a/pkgs/by-name/gi/gitxray/package.nix b/pkgs/by-name/gi/gitxray/package.nix
index 3898b3aaf1c7..fea415c56cd3 100644
--- a/pkgs/by-name/gi/gitxray/package.nix
+++ b/pkgs/by-name/gi/gitxray/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitxray";
-  version = "1.0.17.1";
+  version = "1.0.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kulkansecurity";
     repo = "gitxray";
     tag = version;
-    hash = "sha256-T4s7mgfZs2RIq/iLXT0WBbVhdY8JhEyTJ2CmUycifRc=";
+    hash = "sha256-EcDKjUC1Zi6zSvOQRhozzKPrBLjODk8+Lqpagh55LCc=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/go/gotools/package.nix b/pkgs/by-name/go/gotools/package.nix
index 486aede88b9a..51bfc88b689c 100644
--- a/pkgs/by-name/go/gotools/package.nix
+++ b/pkgs/by-name/go/gotools/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gotools";
-  version = "0.25.0";
+  version = "0.30.0";
 
   # using GitHub instead of https://go.googlesource.com/tools because Gitiles UI is to basic to browse
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     rev = "v${version}";
-    hash = "sha256-iM6mGIQF+TOo1iV8hH9/4iOPdNiS9ymPmhslhDVnIIs=";
+    hash = "sha256-yUkdZSe/GV0w1qK8aQjcFE4tNKYC8f4JeFgPiv8GlQc=";
   };
 
   postPatch = ''
@@ -22,7 +22,7 @@ buildGoModule rec {
     rm -r gopls
   '';
 
-  vendorHash = "sha256-9NSgtranuyRqtBq1oEnHCPIDFOIUJdVh5W/JufqN2Ko=";
+  vendorHash = "sha256-+jhCNi7bGkRdI1Ywfe3q4i+zcm3UJ0kbQalsDD3WkS4=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
index 6c98af6abf8e..5634f03dfb79 100644
--- a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
+++ b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
@@ -13,15 +13,15 @@ Signed-off-by: Christoph Heiss <christoph@c8h4.io>
  create mode 100644 patches/sass-embedded.patch
 
 diff --git a/package.json b/package.json
-index b66e6ff..94aaa86 100644
+index 87e57b9..723e0b6 100644
 --- a/package.json
 +++ b/package.json
 @@ -28,5 +28,10 @@
-     "vite-plugin-pwa": "^0.21.0"
+     "vite-plugin-pwa": "^0.21.1"
    },
    "license": "Apache-2.0",
--  "packageManager": "pnpm@9.14.2+sha512.6e2baf77d06b9362294152c851c4f278ede37ab1eba3a55fda317a4a17b209f4dbb973fb250a77abc463a341fcb1f17f17cfa24091c4eb319cda0d9b84278387"
-+  "packageManager": "pnpm@9.14.2+sha512.6e2baf77d06b9362294152c851c4f278ede37ab1eba3a55fda317a4a17b209f4dbb973fb250a77abc463a341fcb1f17f17cfa24091c4eb319cda0d9b84278387",
+-  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0"
++  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0",
 +  "pnpm": {
 +    "patchedDependencies": {
 +      "sass-embedded": "patches/sass-embedded.patch"
@@ -50,135 +50,95 @@ index 0000000..f941a8e
 +         ? 'linux-musl'
 +         : process.platform;
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index ecc1e3c..a7164d0 100644
+index f347757..d054bea 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
 @@ -4,6 +4,11 @@ settings:
    autoInstallPeers: true
    excludeLinksFromLockfile: false
- 
+
 +patchedDependencies:
 +  sass-embedded:
 +    hash: 6wjvcsryx2tfkpottp4wf5nbzi
 +    path: patches/sass-embedded.patch
 +
  importers:
- 
+
    .:
 @@ -26,7 +31,7 @@ importers:
      devDependencies:
        '@vitejs/plugin-vue':
-         specifier: ^5.2.0
--        version: 5.2.0(vite@5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0))(vue@3.5.13)
-+        version: 5.2.0(vite@5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.13)
+         specifier: ^5.2.1
+-        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
++        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
        '@vue/eslint-config-prettier':
-         specifier: ^10.0.0
-         version: 10.0.0(eslint@9.15.0)(prettier@3.3.3)
+         specifier: ^10.2.0
+         version: 10.2.0(eslint@9.19.0)(prettier@3.4.2)
 @@ -44,13 +49,13 @@ importers:
-         version: 3.3.3
+         version: 3.4.2
        sass-embedded:
-         specifier: ^1.81.0
--        version: 1.81.0
-+        version: 1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+         specifier: ^1.83.4
+-        version: 1.83.4
++        version: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
        vite:
-         specifier: ^5.4.11
--        version: 5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0)
-+        version: 5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+         specifier: ^6.0.11
+-        version: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
++        version: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
        vite-plugin-pwa:
-         specifier: ^0.21.0
--        version: 0.21.0(vite@5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
-+        version: 0.21.0(vite@5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
- 
+         specifier: ^0.21.1
+-        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
++        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+
  packages:
- 
-@@ -2548,7 +2553,7 @@ snapshots:
-   '@babel/code-frame@7.25.7':
-     dependencies:
-       '@babel/highlight': 7.25.7
--      picocolors: 1.1.0
-+      picocolors: 1.1.1
- 
-   '@babel/compat-data@7.25.8': {}
- 
-@@ -2715,7 +2720,7 @@ snapshots:
-       '@babel/helper-validator-identifier': 7.25.7
-       chalk: 2.4.2
-       js-tokens: 4.0.0
--      picocolors: 1.1.0
-+      picocolors: 1.1.1
- 
-   '@babel/parser@7.25.8':
-     dependencies:
-@@ -3521,9 +3526,9 @@ snapshots:
- 
+
+@@ -3683,9 +3688,9 @@ snapshots:
+
    '@types/trusted-types@2.0.7': {}
- 
--  '@vitejs/plugin-vue@5.2.0(vite@5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0))(vue@3.5.13)':
-+  '@vitejs/plugin-vue@5.2.0(vite@5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.13)':
+
+-  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
++  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
      dependencies:
--      vite: 5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0)
-+      vite: 5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+-      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
++      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
        vue: 3.5.13
- 
+
    '@vue/compiler-core@3.5.13':
-@@ -4702,7 +4707,7 @@ snapshots:
-   sass-embedded-win32-x64@1.81.0:
+@@ -4965,7 +4970,7 @@ snapshots:
+   sass-embedded-win32-x64@1.83.4:
      optional: true
- 
--  sass-embedded@1.81.0:
-+  sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
+
+-  sass-embedded@1.83.4:
++  sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
      dependencies:
        '@bufbuild/protobuf': 2.2.0
        buffer-builder: 0.2.0
-@@ -4879,7 +4884,7 @@ snapshots:
-   terser@5.35.0:
-     dependencies:
-       '@jridgewell/source-map': 0.3.6
--      acorn: 8.13.0
-+      acorn: 8.14.0
-       commander: 2.20.3
-       source-map-support: 0.5.21
- 
-@@ -4975,7 +4980,7 @@ snapshots:
-     dependencies:
-       browserslist: 4.24.0
-       escalade: 3.2.0
--      picocolors: 1.1.0
-+      picocolors: 1.1.1
- 
-   uri-js@4.4.1:
-     dependencies:
-@@ -4987,18 +4992,18 @@ snapshots:
- 
+@@ -5286,18 +5291,18 @@ snapshots:
+
    varint@6.0.0: {}
- 
--  vite-plugin-pwa@0.21.0(vite@5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
-+  vite-plugin-pwa@0.21.0(vite@5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+
+-  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
++  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
      dependencies:
        debug: 4.3.7
        pretty-bytes: 6.1.1
        tinyglobby: 0.2.10
--      vite: 5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0)
-+      vite: 5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+-      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
++      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
        workbox-build: 7.1.0
        workbox-window: 7.1.0
      transitivePeerDependencies:
        - supports-color
- 
--  vite@5.4.11(sass-embedded@1.81.0)(sass@1.79.5)(terser@5.35.0):
-+  vite@5.4.11(sass-embedded@1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0):
+
+-  vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
++  vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
      dependencies:
-       esbuild: 0.21.5
-       postcss: 8.4.47
-@@ -5006,7 +5011,7 @@ snapshots:
+       esbuild: 0.24.2
+       postcss: 8.5.1
+@@ -5305,7 +5310,7 @@ snapshots:
      optionalDependencies:
        fsevents: 2.3.3
        sass: 1.79.5
--      sass-embedded: 1.81.0
-+      sass-embedded: 1.81.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
-       terser: 5.35.0
- 
-   vue-eslint-parser@9.4.3(eslint@9.15.0):
--- 
-2.47.0
-
+-      sass-embedded: 1.83.4
++      sass-embedded: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       terser: 5.37.0
+       yaml: 2.7.0
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index 7d104aa46ff0..eaad9c42bd8f 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "homer";
-  version = "24.12.1";
+  version = "25.02.1";
   src = fetchFromGitHub {
     owner = "bastienwirtz";
     repo = "homer";
     rev = "v${version}";
-    hash = "sha256-nOhovVqWlHPunwruJrgqFhhDxccKBp/iEyB3Y3C5Cz8=";
+    hash = "sha256-Fh6qV2eU7VRskbPun7OcJmqgjILVE8w5lV70xH6znmc=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       src
       patches
       ;
-    hash = "sha256-+FijxCiI5pr6kp+/99DJJOJSI9w6pbtfW25SUyEcWio=";
+    hash = "sha256-qeMmPI2B5FW82qLVtbREDjQh76THMCOZRQCM0DgvCqI=";
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
diff --git a/pkgs/by-name/mu/mutt/package.nix b/pkgs/by-name/mu/mutt/package.nix
index 0c84b94a23bc..69a4c2fbca06 100644
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -30,7 +30,7 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.2.13";
+  version = "2.2.14";
   outputs = [
     "out"
     "doc"
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-6yP63cHMl9hnaT86Sp8wlJrZN2WtW2/a4nl6QAHFjvs=";
+    hash = "sha256-0WL7bUkeOvQ9b2L5Sbfmh7sMfCWE2lLJmpk1SiXeFO8=";
   };
 
   patches =
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
       sha256 = "0b4i00chvx6zj9pcb06x2jysmrcb2znn831lcy32cgfds6gr3nsi";
     });
 
+  enableParallelBuilding = true;
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pc/pcl/package.nix b/pkgs/by-name/pc/pcl/package.nix
index b96bdbb24a39..9d80edca070e 100644
--- a/pkgs/by-name/pc/pcl/package.nix
+++ b/pkgs/by-name/pc/pcl/package.nix
@@ -16,7 +16,7 @@
   libusb1,
 
   # nativeBuildInputs
-  boost186,
+  boost,
   flann,
   libpng,
   libtiff,
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pcl";
-  version = "1.15.0-rc1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "PointCloudLibrary";
     repo = "pcl";
     tag = "pcl-${finalAttrs.version}";
-    hash = "sha256-T/zvev1x4w87j6Zn9dpqwIQfmfg2MsHt2Xto8Z1vhuQ=";
+    hash = "sha256-UCuQMWGwe+YxeGj0Y6m5IT58NW2lAWN5RqyZnvyFSr4=";
   };
 
   # remove attempt to prevent (x86/x87-specific) extended precision use
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
-    boost186
+    boost
     flann
     libpng
     libtiff
diff --git a/pkgs/by-name/pe/peazip/package.nix b/pkgs/by-name/pe/peazip/package.nix
index 47f05c27788f..2cbfc136feae 100644
--- a/pkgs/by-name/pe/peazip/package.nix
+++ b/pkgs/by-name/pe/peazip/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "peazip";
-  version = "10.2.0";
+  version = "10.3.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = pname;
     rev = version;
-    hash = "sha256-TyfLqT9VNSViJOWwM3KgL2tvCZE14bLlT/6DgF9IAOE=";
+    hash = "sha256-rEddDg2sS/4+HK3UqPEWudWnwjMPNjA2+v4CKtFtZYM=";
   };
   sourceRoot = "${src.name}/peazip-sources";
 
@@ -84,7 +84,13 @@ stdenv.mkDerivation rec {
     ln -s $out/share/peazip $out/lib/peazip/res/share
     cp -r res/share/{icons,lang,themes,presets} $out/share/peazip/
     # Install desktop entries
+    # We don't copy res/share/batch/freedesktop_integration/additional-desktop-files/*.desktop because they are just duplicates of res/share/batch/freedesktop_integration/*.desktop
     install -D res/share/batch/freedesktop_integration/*.desktop -t $out/share/applications
+    install -D res/share/batch/freedesktop_integration/KDE-servicemenus/KDE6-dolphin/*.desktop -t $out/share/kio/servicemenus
+    install -D res/share/batch/freedesktop_integration/KDE-servicemenus/KDE5-dolphin/*.desktop -t $out/share/kservices5/ServiceMenus
+    install -D res/share/batch/freedesktop_integration/KDE-servicemenus/KDE4-dolphin/*.desktop -t $out/share/kde4/services/ServiceMenus
+    install -D res/share/batch/freedesktop_integration/KDE-servicemenus/KDE3-konqueror/*.desktop -t $out/share/apps/konqueror/servicemenus
+
     # Install desktop entries's icons
     mkdir -p $out/share/icons/hicolor/256x256/apps
     ln -s $out/share/peazip/icons/peazip.png -t $out/share/icons/hicolor/256x256/apps/
diff --git a/pkgs/by-name/ra/rattler-build/package.nix b/pkgs/by-name/ra/rattler-build/package.nix
index e8f1bacb2eb5..684294998ed4 100644
--- a/pkgs/by-name/ra/rattler-build/package.nix
+++ b/pkgs/by-name/ra/rattler-build/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rattler-build";
-  version = "0.35.9";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "rattler-build";
     tag = "v${version}";
-    hash = "sha256-gm/ajlSp7nhrYTslZ8SrcOjtnAWvDeLF/zmgPvwdJPE=";
+    hash = "sha256-q45VS5xGRmDoxYOOO8xt8iJg6zirriekXFjNAkPiqIo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hjPut3r3v/LwOUaJTAGdXQ3j4ojpFbDKjPFZJulEl3o=";
+  cargoHash = "sha256-/Hfkb1teM/CYWizK1/1gIELuaUyTXWZS3YrQWuJzuqQ=";
 
   doCheck = false; # test requires network access
 
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index d166b1fcf6ba..39d3fd2cf9c3 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.91.2";
+  version = "1.92.1";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-DnNe7huyqrReVu3oeLB4YVf04NxmZL+9/fY/MlHplBc=";
+        hash = "sha256-2/QUQMZk2XxJoKAjZvjQGL87w5+TyaqErVNr/xAT9JU=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-t+jRLZtpwVYAEVu7CjGiQMhPCoWhLUn/XODT27LmR+c=";
+        hash = "sha256-s8OTw4WN7z1cxaTjkAhxnL8VPj+XAYEDCQPejvFjuY0=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 5acb5ecc60cb..ffb2f2fef443 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -35,13 +35,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rerun";
-  version = "0.21.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "rerun-io";
     repo = "rerun";
     tag = version;
-    hash = "sha256-U+Q8u1XKBD9c49eXAgc5vASKytgyAEYyYv8XNfftlZU=";
+    hash = "sha256-J9Iy/KiDajDavL95qLcQBfUWpZ6OiUtldk+ZAGpSNWA=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IHsHvr50rhS4CH+27613OVBFC2oI37xvhKLjZY36oo8=";
+  cargoHash = "sha256-cGg8yi/jYKyle8dudHSNLPMnOtcgqlBQmu83h4B26NI=";
 
   cargoBuildFlags = [ "--package rerun-cli" ];
   cargoTestFlags = [ "--package rerun-cli" ];
@@ -153,7 +153,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Visualize streams of multimodal data. Fast, easy to use, and simple to integrate.  Built in Rust using egui";
     homepage = "https://github.com/rerun-io/rerun";
-    changelog = "https://github.com/rerun-io/rerun/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/rerun-io/rerun/blob/${version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
diff --git a/pkgs/by-name/so/softflowd/package.nix b/pkgs/by-name/so/softflowd/package.nix
new file mode 100644
index 000000000000..658717151141
--- /dev/null
+++ b/pkgs/by-name/so/softflowd/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  libpcap,
+  versionCheckHook,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "softflowd";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "irino";
+    repo = "softflowd";
+    tag = "softflowd-v${finalAttrs.version}";
+    hash = "sha256-qWHwkXT1Lw8fe9nELaMB6EzAnNxsDvxiLWH3AacVZeA=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    libpcap
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = gitUpdater { rev-prefix = "softflowd-v"; };
+
+  meta = {
+    description = "Flow-based network traffic analyser capable of Cisco NetFlow";
+    homepage = "https://github.com/irino/softflowd";
+    changelog = "https://github.com/irino/softflowd/releases/tag/spftflowd-v${finalAttrs.version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ fooker ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ti/timewall/package.nix b/pkgs/by-name/ti/timewall/package.nix
index 7f35f4f88f43..6e735cd46c6f 100644
--- a/pkgs/by-name/ti/timewall/package.nix
+++ b/pkgs/by-name/ti/timewall/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "timewall";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "bcyran";
     repo = "timewall";
     rev = version;
-    hash = "sha256-B3pZCjl7Z78vAYYzceicwjmGfTbzYgrhpldUJnY8Aqs=";
+    hash = "sha256-ohJDaN29FG/WqkcvpbukWS37RiX2pXdkKMzNh+3NqAU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-M7o2EKBVvx0RzPDwinHUJp20NHqcFwBO6QTRvGMfHa0=";
+  cargoHash = "sha256-Wg9bxzm5EJUazRUvFuPboQhZlqwWPuJ8UB9plgWUOO4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ui/uiua/unstable.nix b/pkgs/by-name/ui/uiua/unstable.nix
index 6758c68df030..8a74d19cfe7d 100644
--- a/pkgs/by-name/ui/uiua/unstable.nix
+++ b/pkgs/by-name/ui/uiua/unstable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.15.0-dev.1";
+  version = "0.15.0-dev.2";
   tag = version;
-  hash = "sha256-taR403/r6dxQv/hVpuea2Nz/meFauXUxfyVC5tvMSlo=";
-  cargoHash = "sha256-OdG5UVs5fY5xOCY1GwaKrCSY/cIe4dB6LZb+ZNSvU90=";
+  hash = "sha256-tJVfrJSceuUnLaXlzYdHOBJ5+LnOuX423IQa/Agm0KQ=";
+  cargoHash = "sha256-Ay1I6nkXLjT3H/j8hzptBqDruEY2PQ9o2VhU4lkd5jk=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index d6b112760091..a9811def0f7b 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -42,21 +42,24 @@ stdenv.mkDerivation rec {
     jq
   ];
 
-  buildInputs = [
-    glslang
-    libX11
-    libXau
-    libXdmcp
-    libXrandr
-    libffi
-    libxcb
-    robin-hood-hashing
-    spirv-headers
-    spirv-tools
-    vulkan-headers
-    vulkan-utility-libraries
-    wayland
-  ];
+  buildInputs =
+    [
+      glslang
+      robin-hood-hashing
+      spirv-headers
+      spirv-tools
+      vulkan-headers
+      vulkan-utility-libraries
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libX11
+      libXau
+      libXdmcp
+      libXrandr
+      libffi
+      libxcb
+      wayland
+    ];
 
   cmakeFlags = [
     "-DBUILD_LAYER_SUPPORT_FILES=ON"
@@ -82,7 +85,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Official Khronos Vulkan validation layers";
     homepage = "https://github.com/KhronosGroup/Vulkan-ValidationLayers";
-    platforms = platforms.linux;
+    platforms = platforms.all;
     license = licenses.asl20;
     maintainers = [ maintainers.ralith ];
   };
diff --git a/pkgs/by-name/wi/wireless-regdb/package.nix b/pkgs/by-name/wi/wireless-regdb/package.nix
index 38a358121d71..9141651290f7 100644
--- a/pkgs/by-name/wi/wireless-regdb/package.nix
+++ b/pkgs/by-name/wi/wireless-regdb/package.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "wireless-regdb";
-  version = "2024.10.07";
+  version = "2025.02.20";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-928r15plPp+d1QVI2Z0DpKTrFX2gVt/ViS9APsKPs9U=";
+    hash = "sha256-V/jnchz1qIDBOuDCAu27IQkqBg1F+enFm80qgnK/pFY=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/wo/wofi-power-menu/package.nix b/pkgs/by-name/wo/wofi-power-menu/package.nix
index 9e50dd669ea7..06a8674e632f 100644
--- a/pkgs/by-name/wo/wofi-power-menu/package.nix
+++ b/pkgs/by-name/wo/wofi-power-menu/package.nix
@@ -8,14 +8,14 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wofi-power-menu";
   version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "szaffarano";
     repo = "wofi-power-menu";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-UDDDtI6wnx64KG+1/S6bYTc1xi1vOFuZOmRCLK2Yzew=";
   };
 
@@ -38,9 +38,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Highly configurable power menu using the wofi launcher power-menu";
     homepage = "https://github.com/szaffarano/wofi-power-menu";
-    changelog = "https://github.com/szaffarano/wofi-power-menu/releases/tag/v${version}";
+    changelog = "https://github.com/szaffarano/wofi-power-menu/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ defelo ];
     mainProgram = "wofi-power-menu";
   };
-}
+})
diff --git a/pkgs/by-name/xf/xfsprogs/package.nix b/pkgs/by-name/xf/xfsprogs/package.nix
index 6ff404ce7f3a..0d90b91caf18 100644
--- a/pkgs/by-name/xf/xfsprogs/package.nix
+++ b/pkgs/by-name/xf/xfsprogs/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.12.0";
+  version = "6.13.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-CDJAckfbeRzHDe+W5+JUvW7fBD3ISoCmLzzNbj3/0yk=";
+    hash = "sha256-BFmTP5PZTIK8J4nnvWN0InPZ10IHza5n3DAyA42ggzc=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index 79d24de0da7d..cf51e9b4846d 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -105,6 +105,9 @@ stdenv.mkDerivation (finalAttrs: {
       arm-isa.h \
       arm-cpu.h \
     ''
+    + lib.optionalString stdenv.targetPlatform.isLoongArch64 ''
+      loongarch-multilib.h \
+    ''
     + ''
           insn-modes.h
       )
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index f8da186575d7..a98fde27815c 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -30,6 +30,7 @@
   fleek-cli = "fleek";
   grunt-cli = "grunt";
   gulp-cli = "gulp";
+  jsonlint = "jsonlint";
   localtunnel = "lt";
   lua-fmt = "luafmt";
   parsoid = "parse.js";
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index 03d022d12ce8..4fbbcec2a678 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.34";
+  version = "1.5.36";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     tag = version;
-    hash = "sha256-i03xAtdZUnKvhZTMw4AmavdGRC9hSf5FpdroJC/UQaU=";
+    hash = "sha256-kfBiVWKS8zgG8CgmUBSc/utWaHgluubZ8zpZuIAVjUU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cypherpunkpay/default.nix b/pkgs/development/python-modules/cypherpunkpay/default.nix
index ca3623f09199..1a19caa734c4 100644
--- a/pkgs/development/python-modules/cypherpunkpay/default.nix
+++ b/pkgs/development/python-modules/cypherpunkpay/default.nix
@@ -1,33 +1,37 @@
 {
   lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
   apscheduler,
   bitstring,
-  buildPythonPackage,
   cffi,
   ecdsa,
-  fetchFromGitHub,
   monero,
-  poetry-core,
   pypng,
   pyqrcode,
   pyramid,
   pyramid-jinja2,
   pysocks,
-  pytestCheckHook,
-  pythonOlder,
+  pytz,
   requests,
   tzlocal,
   waitress,
-  webtest,
   yoyo-migrations,
+
+  # tests
+  pytestCheckHook,
+  webtest,
 }:
 
 buildPythonPackage rec {
   pname = "cypherpunkpay";
   version = "1.0.16";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.7";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CypherpunkPay";
@@ -46,11 +50,11 @@ buildPythonPackage rec {
     "waitress"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     apscheduler
     bitstring
     cffi
@@ -61,6 +65,7 @@ buildPythonPackage rec {
     pyramid
     pyramid-jinja2
     pysocks
+    pytz
     requests
     tzlocal
     waitress
@@ -103,14 +108,14 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "cypherpunkpay" ];
 
-  meta = with lib; {
+  meta = {
     description = "Modern self-hosted software for accepting Bitcoin";
     homepage = "https://github.com/CypherpunkPay/CypherpunkPay";
     changelog = "https://github.com/CypherpunkPay/CypherpunkPay/releases/tag/v${version}";
-    license = with licenses; [
+    license = with lib.licenses; [
       mit # or
       unlicense
     ];
-    maintainers = with maintainers; [ prusnak ];
+    maintainers = with lib.maintainers; [ prusnak ];
   };
 }
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index 63c6b8e74a78..fae9c2b32085 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.43.0";
+  version = "0.44.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-UdGkHstRelFxlJ5zIm5PeFM7p0JQCPWD2zVS2XOlVq4=";
+    hash = "sha256-+zRsw+nQjkee7AGg0xW7HHbROUAz6cVO91XDlgGtJfs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fitfile/default.nix b/pkgs/development/python-modules/fitfile/default.nix
new file mode 100644
index 000000000000..08d28800fd5b
--- /dev/null
+++ b/pkgs/development/python-modules/fitfile/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "fitfile";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tcgoetz";
+    repo = "fit";
+    tag = version;
+    hash = "sha256-NIshX/IkPmqviYRPT4wRF7evZwn9e7BdCI5x+2Pz7II=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "fitfile" ];
+
+  meta = {
+    description = "Python Fit file parser";
+    license = lib.licenses.gpl2Only;
+    homepage = "https://github.com/tcgoetz/fit";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/development/python-modules/idbutils/default.nix b/pkgs/development/python-modules/idbutils/default.nix
new file mode 100644
index 000000000000..6668aa76f7cc
--- /dev/null
+++ b/pkgs/development/python-modules/idbutils/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  sqlalchemy,
+  requests,
+  python-dateutil,
+  tqdm,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "idbutils";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tcgoetz";
+    repo = "utilities";
+    tag = version;
+    hash = "sha256-niscY7sURrJ7YcPKbI6ByU03po6Hfxm0gHbvmDa6TgM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    sqlalchemy
+    requests
+    python-dateutil
+    tqdm
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "idbutils" ];
+
+  meta = {
+    description = "Python utilities useful for database and internal apps";
+    license = lib.licenses.gpl2Only;
+    homepage = "https://github.com/tcgoetz/utilities";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/development/python-modules/microsoft-kiota-http/default.nix b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
index 2d65e6882021..3808ff882fe0 100644
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-http";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
-    tag = "microsoft-kiota-http-v${version}";
-    hash = "sha256-ESRnI8prXG1h5H5RVD4eOQ1sQYSEMMLVHSk8yhzFGVw=";
+    tag = "microsoft-kiota-serialization-text-v${version}";
+    hash = "sha256-ribVfvKmDMxGmeqj30SDcnbNGdRBfs1DmqQGXP3EHCk=";
   };
 
   sourceRoot = "source/packages/http/httpx/";
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "HTTP request adapter implementation for Kiota clients for Python";
     homepage = "https://github.com/microsoft/kiota-python/tree/main/packages/http/httpx";
-    changelog = "https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-http-v${version}";
+    changelog = "https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-http-${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/more-properties/default.nix b/pkgs/development/python-modules/more-properties/default.nix
index 53e79468c66b..0a62ed9c4ac2 100644
--- a/pkgs/development/python-modules/more-properties/default.nix
+++ b/pkgs/development/python-modules/more-properties/default.nix
@@ -1,37 +1,43 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
+  pythonAtLeast,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "more-properties";
   version = "1.1.1";
+  pyproject = true;
 
-  # upstream requires >= 3.6 but only 3.7 includes dataclasses
-  disabled = pythonOlder "3.7";
-
-  format = "setuptools";
+  # All tests are failing with:
+  # AssertionError: None != 'The type of the None singleton.'
+  disabled = pythonAtLeast "3.13";
 
   src = fetchFromGitHub {
     owner = "madman-bob";
     repo = "python-more-properties";
-    rev = version;
+    tag = version;
     hash = "sha256-dKG97rw5IG19m7u3ZDBM2yGScL5cFaKBvGZxPVJaUTE=";
   };
 
   postPatch = ''
     mv pypi_upload/setup.py .
     substituteInPlace setup.py \
-      --replace "project_root = Path(__file__).parents[1]" "project_root = Path(__file__).parents[0]"
-
-    # dataclasses is included in Python 3.7
-    substituteInPlace requirements.txt \
-      --replace dataclasses ""
+      --replace-fail "project_root = Path(__file__).parents[1]" "project_root = Path(__file__).parents[0]"
   '';
 
+  build-system = [
+    setuptools
+  ];
+
+  pythonRemoveDeps = [
+    # dataclasses is included in Python since 3.7
+    "dataclasses"
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "more_properties" ];
diff --git a/pkgs/development/python-modules/pygithub/default.nix b/pkgs/development/python-modules/pygithub/default.nix
index 79da899a96c5..1ac544477849 100644
--- a/pkgs/development/python-modules/pygithub/default.nix
+++ b/pkgs/development/python-modules/pygithub/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pygithub";
-  version = "2.5.0";
+  version = "2.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "PyGithub";
     repo = "PyGithub";
     tag = "v${version}";
-    hash = "sha256-rKa441hiO4M/sC6wxU9yeCu6IQJMZroyi7bad/j6brw=";
+    hash = "sha256-/j90wLVZyOpukRAWO368+LxoKgnKTOs+gBc2SseNXRg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/rerun-sdk/default.nix b/pkgs/development/python-modules/rerun-sdk/default.nix
index c42d58374018..7d93eb9cb1ae 100644
--- a/pkgs/development/python-modules/rerun-sdk/default.nix
+++ b/pkgs/development/python-modules/rerun-sdk/default.nix
@@ -71,6 +71,15 @@ buildPythonPackage {
   inherit (rerun) addDlopenRunpaths addDlopenRunpathsPhase;
   postPhases = lib.optionals stdenv.hostPlatform.isLinux [ "addDlopenRunpathsPhase" ];
 
+  disabledTests = [
+    # numpy 2 incompatibility: AssertionError / IndexError
+    # Issue: https://github.com/rerun-io/rerun/issues/9105
+    # PR: https://github.com/rerun-io/rerun/pull/9109
+    "test_any_value"
+    "test_bad_any_value"
+    "test_none_any_value"
+  ];
+
   disabledTestPaths = [
     # "fixture 'benchmark' not found"
     "tests/python/log_benchmark/test_log_benchmark.py"
diff --git a/pkgs/development/python-modules/tcxfile/default.nix b/pkgs/development/python-modules/tcxfile/default.nix
new file mode 100644
index 000000000000..2ece880dd4cb
--- /dev/null
+++ b/pkgs/development/python-modules/tcxfile/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  python-dateutil,
+}:
+
+buildPythonPackage rec {
+  pname = "tcxfile";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tcgoetz";
+    repo = "tcx";
+    tag = version;
+    hash = "sha256-d1KSeLlaoyXFU8v+8cKu1+2dU2ywvpWqsHBddo/aBC4=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    python-dateutil
+  ];
+
+  # cannot run built in tests as they lack data files
+
+  pythonImportsCheck = [ "tcxfile" ];
+
+  meta = {
+    description = "Python library to read and write Tcx files";
+    license = lib.licenses.gpl2Only;
+    homepage = "https://github.com/tcgoetz/tcx";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index e979b7991281..dabf3d10fe75 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -1,16 +1,17 @@
 {
   lib,
+  stdenv,
   config,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # patches
   replaceVars,
   addDriverRunpath,
-  cudaSupport ? config.cudaSupport,
-  rocmSupport ? config.rocmSupport,
   cudaPackages,
+  llvmPackages,
   ocl-icd,
   rocmPackages,
-  stdenv,
 
   # build-system
   setuptools,
@@ -21,18 +22,22 @@
   unicorn,
 
   # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
   blobfile,
   bottle,
+  capstone,
   clang,
   hexdump,
   hypothesis,
+  jax,
   librosa,
   networkx,
   numpy,
   onnx,
+  onnxruntime,
   pillow,
   pytest-xdist,
-  pytestCheckHook,
   safetensors,
   sentencepiece,
   tiktoken,
@@ -40,19 +45,23 @@
   tqdm,
   transformers,
 
+  # passthru
   tinygrad,
+
+  cudaSupport ? config.cudaSupport,
+  rocmSupport ? config.rocmSupport,
 }:
 
 buildPythonPackage rec {
   pname = "tinygrad";
-  version = "0.10.0";
+  version = "0.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tinygrad";
     repo = "tinygrad";
     tag = "v${version}";
-    hash = "sha256-IIyTb3jDUSEP2IXK6DLsI15E5N34Utt7xv86aTHpXf8=";
+    hash = "sha256-BXQMacp6QjlgsVwhp2pxEZkRylZfKQhqIh92/0dPlfg=";
   };
 
   patches = [
@@ -68,14 +77,30 @@ buildPythonPackage rec {
 
   postPatch =
     # Patch `clang` directly in the source file
+    # Use the unwrapped variant to enable the "native" features currently unavailable in the sandbox
     ''
-      substituteInPlace tinygrad/runtime/ops_clang.py \
-        --replace-fail "'clang'" "'${lib.getExe clang}'"
+      substituteInPlace tinygrad/runtime/ops_cpu.py \
+        --replace-fail "getenv(\"CC\", 'clang')" "'${lib.getExe llvmPackages.clang-unwrapped}'"
+    ''
+    + ''
+      substituteInPlace tinygrad/runtime/autogen/libc.py \
+        --replace-fail "ctypes.util.find_library('c')" "'${stdenv.cc.libc}/lib/libc.so.6'"
+    ''
+    + ''
+      substituteInPlace tinygrad/runtime/support/llvm.py \
+        --replace-fail "ctypes.util.find_library('LLVM')" "'${lib.getLib llvmPackages.llvm}/lib/libLLVM.so'"
     ''
     + lib.optionalString stdenv.hostPlatform.isLinux ''
       substituteInPlace tinygrad/runtime/autogen/opencl.py \
         --replace-fail "ctypes.util.find_library('OpenCL')" "'${ocl-icd}/lib/libOpenCL.so'"
     ''
+    # test/test_tensor.py imports the PTX variable from the cuda_compiler.py file.
+    # This import leads to loading the libnvrtc.so library that is not substituted when cudaSupport = false.
+    # -> As a fix, we hardcode this variable to False
+    + lib.optionalString (!cudaSupport) ''
+      substituteInPlace test/test_tensor.py \
+        --replace-fail "from tinygrad.runtime.support.compiler_cuda import PTX" "PTX = False"
+    ''
     # `cuda_fp16.h` and co. are needed at runtime to compile kernels
     + lib.optionalString cudaSupport ''
       substituteInPlace tinygrad/runtime/support/compiler_cuda.py \
@@ -114,18 +139,23 @@ buildPythonPackage rec {
     ];
 
   nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+
     blobfile
     bottle
+    capstone
     clang
     hexdump
     hypothesis
+    jax
     librosa
     networkx
     numpy
     onnx
+    onnxruntime
     pillow
     pytest-xdist
-    pytestCheckHook
     safetensors
     sentencepiece
     tiktoken
@@ -134,15 +164,15 @@ buildPythonPackage rec {
     transformers
   ] ++ networkx.optional-dependencies.extra;
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   disabledTests =
     [
-      # Fixed in https://github.com/tinygrad/tinygrad/pull/7792
-      # TODO: re-enable at next release
-      "test_kernel_cache_in_action"
+      # RuntimeError: Attempting to relocate against an undefined symbol 'fmaxf'
+      "test_backward_sum_acc_dtype"
+      "test_failure_27"
+
+      # Flaky:
+      # AssertionError: 2.1376906810000946 not less than 2.0
+      "test_recursive_pad"
 
       # Require internet access
       "test_benchmark_openpilot_model"
@@ -178,10 +208,6 @@ buildPythonPackage rec {
       "test_vgg7"
     ]
     ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
-      # Fixed in https://github.com/tinygrad/tinygrad/pull/7796
-      # TODO: re-enable at next release
-      "test_interpolate_bilinear"
-
       # Fail with AssertionError
       "test_casts_from"
       "test_casts_to"
@@ -209,7 +235,9 @@ buildPythonPackage rec {
     changelog = "https://github.com/tinygrad/tinygrad/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    # Tests segfault on darwin
-    badPlatforms = [ lib.systems.inspect.patterns.isDarwin ];
+    badPlatforms = [
+      # Tests segfault on darwin
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/ydiff/default.nix b/pkgs/development/python-modules/ydiff/default.nix
index 4b0d10f6b161..753d6e35f3f0 100644
--- a/pkgs/development/python-modules/ydiff/default.nix
+++ b/pkgs/development/python-modules/ydiff/default.nix
@@ -1,12 +1,12 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pygments,
   gitMinimal,
   mercurial,
   subversion,
-  patchutils,
+  p4,
   less,
 }:
 
@@ -15,21 +15,23 @@ buildPythonPackage rec {
   version = "1.4.2";
   format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NpvmI9zeeVTZiXP7nbF4DWTwNTmCvzrIWBjz1i/0UrA=";
+  src = fetchFromGitHub {
+    owner = "ymattw";
+    repo = "ydiff";
+    tag = version;
+    hash = "sha256-JaGkABroj+/7MrgpFYI2vE1bndsilIodopMUnfmNhwA=";
   };
 
   patchPhase = ''
     substituteInPlace ydiff.py \
-      --replace "['git'" "['${gitMinimal}/bin/git'" \
-      --replace "['hg'" "['${mercurial}/bin/hg'" \
-      --replace "['svn'" "['${subversion}/bin/svn'" \
-      --replace "['filterdiff'" "['${patchutils}/bin/filterdiff'" \
-      --replace "['less'" "['${less}/bin/less'" # doesn't support PAGER from env
+      --replace-fail "['git'" "['${lib.getExe gitMinimal}'" \
+      --replace-fail "['hg'" "['${lib.getExe mercurial}'" \
+      --replace-fail "['svn'" "['${lib.getExe subversion}'" \
+      --replace-fail "['p4'" "['${lib.getExe p4}'" \
+      --replace-fail "['less'" "['${lib.getExe less}'" # doesn't support PAGER from env
     substituteInPlace tests/test_ydiff.py \
-      --replace /bin/rm rm \
-      --replace /bin/sh sh
+      --replace-fail /bin/rm rm \
+      --replace-fail /bin/sh sh
     patchShebangs setup.py
     patchShebangs tests/*.sh
   '';
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index e170bed87bda..274ade384421 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.24.0";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-yY2wQ4UhW95bpLxtNIsn2A1sANh6zSWv8iCqmU64fAg=";
+    hash = "sha256-ElHRhEsXP3pzTkys9c8FaQODZJmFDMl4ubUIU4B1ACM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -25,7 +25,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-J+7IPAu5FMm/yVnz9j5befnD+B8s6a2E9+HP/oIcFPM=";
+  vendorHash = "sha256-ddvdnnDxqwqO6xtLf5NoMT2WYNNMuvyHlo2+/A6rN0E=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index 6864efed6579..792ad818a20c 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  libXScrnSaver,
   makeWrapper,
   fetchurl,
   wrapGAppsHook3,
   glib,
   gtk3,
+  gtk4,
   unzip,
   at-spi2-atk,
   libdrm,
@@ -27,6 +27,11 @@
   pango,
   systemd,
   pciutils,
+  libnotify,
+  pipewire,
+  libsecret,
+  libpulseaudio,
+  speechd-minimal,
 }:
 
 version: hashes:
@@ -42,15 +47,13 @@ let
       yayayayaka
       teutat3s
     ];
-    platforms =
-      [
-        "x86_64-darwin"
-        "x86_64-linux"
-        "armv7l-linux"
-        "aarch64-linux"
-      ]
-      ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
-      ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
+    platforms = [
+      "x86_64-darwin"
+      "x86_64-linux"
+      "armv7l-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # https://www.electronjs.org/docs/latest/tutorial/electron-timelines
     knownVulnerabilities = optional (versionOlder version "32.0.0") "Electron version ${version} is EOL";
@@ -70,19 +73,13 @@ let
       sha256 = hash;
     };
 
-  tags =
-    {
-      x86_64-linux = "linux-x64";
-      armv7l-linux = "linux-armv7l";
-      aarch64-linux = "linux-arm64";
-      x86_64-darwin = "darwin-x64";
-    }
-    // lib.optionalAttrs (lib.versionAtLeast version "11.0.0") {
-      aarch64-darwin = "darwin-arm64";
-    }
-    // lib.optionalAttrs (lib.versionOlder version "19.0.0") {
-      i686-linux = "linux-ia32";
-    };
+  tags = {
+    x86_64-linux = "linux-x64";
+    armv7l-linux = "linux-armv7l";
+    aarch64-linux = "linux-arm64";
+    x86_64-darwin = "darwin-x64";
+    aarch64-darwin = "darwin-arm64";
+  };
 
   get = as: platform: as.${platform.system} or (throw "Unsupported system: ${platform.system}");
 
@@ -92,44 +89,43 @@ let
     passthru.headers = headersFetcher version hashes.headers;
   };
 
-  electronLibPath = lib.makeLibraryPath (
-    [
-      alsa-lib
-      at-spi2-atk
-      cairo
-      cups
-      dbus
-      expat
-      gdk-pixbuf
-      glib
-      gtk3
-      nss
-      nspr
-      xorg.libX11
-      xorg.libxcb
-      xorg.libXcomposite
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXrandr
-      xorg.libxkbfile
-      pango
-      pciutils
-      stdenv.cc.cc
-      systemd
-    ]
-    ++ lib.optionals (lib.versionAtLeast version "9.0.0") [
-      libdrm
-      libgbm
-    ]
-    ++ lib.optionals (lib.versionOlder version "10.0.0") [ libXScrnSaver ]
-    ++ lib.optionals (lib.versionAtLeast version "11.0.0") [ libxkbcommon ]
-    ++ lib.optionals (lib.versionAtLeast version "12.0.0") [ libxshmfence ]
-    ++ lib.optionals (lib.versionAtLeast version "17.0.0") [
-      libGL
-      vulkan-loader
-    ]
-  );
+  electronLibPath = lib.makeLibraryPath [
+    alsa-lib
+    at-spi2-atk
+    cairo
+    cups
+    dbus
+    expat
+    gdk-pixbuf
+    glib
+    gtk3
+    gtk4
+    nss
+    nspr
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXrandr
+    xorg.libxkbfile
+    pango
+    pciutils
+    stdenv.cc.cc
+    systemd
+    libnotify
+    pipewire
+    libsecret
+    libpulseaudio
+    speechd-minimal
+    libdrm
+    libgbm
+    libxkbcommon
+    libxshmfence
+    libGL
+    vulkan-loader
+  ];
 
   # Fix read out of range on aarch64 16k pages builds
   # https://github.com/NixOS/nixpkgs/pull/365364
@@ -142,6 +138,7 @@ let
     buildInputs = [
       glib
       gtk3
+      gtk4
     ];
 
     nativeBuildInputs = [
@@ -178,7 +175,7 @@ let
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "${electronLibPath}:$out/libexec/electron" \
         $out/libexec/electron/.electron-wrapped \
-        ${lib.optionalString (lib.versionAtLeast version "15.0.0") "$out/libexec/electron/.chrome_crashpad_handler-wrapped"}
+        $out/libexec/electron/.chrome_crashpad_handler-wrapped
 
       # patch libANGLE
       patchelf \
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 1211189c87dd..84ec674d943c 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -462,13 +462,13 @@ in rec {
 
   pass = mkTmuxPlugin {
     pluginName = "pass";
-    version = "0-unstable-2020-02-28";
+    version = "0-unstable-2025-02-20";
     rtpFilePath = "plugin.tmux";
-    src = pkgs.fetchFromGitHub {
+    src = fetchFromGitHub {
       owner = "rafi";
       repo = "tmux-pass";
-      rev = "76b1c98911d56928063a41bc93a2d9e81818ef4c";
-      hash = "sha256-bamz4IZrozo5R7jt+z7YKyrogawPqsZ9cTJi9osjVoA=";
+      rev = "c853c8b5e31dea93d17551ef3e18be16c063e28e";
+      hash = "sha256-fDAqQcr0SC9WrKbGgt7z03ex2ORZ7ChOzDGl6HFXMaA";
     };
 
     nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -482,10 +482,11 @@ in rec {
         ] )}
     '';
 
-    meta = with lib; {
+    meta = {
       description = "Password-store browser using fzf in tmux";
       homepage = "https://github.com/rafi/tmux-pass";
-      license = licenses.unlicense;
+      license = lib.licenses.gpl3Only;
+      maintainers = [ lib.maintainers.ethancedwards8 ];
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0437d1c6beea..ecbdb91bb35b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13300,7 +13300,6 @@ with pkgs;
   gnuradio = callPackage ../applications/radio/gnuradio/wrapper.nix {
     unwrapped = callPackage ../applications/radio/gnuradio {
       python = python311;
-      boost = boost186;  # fails with 187
     };
   };
   gnuradioPackages = lib.recurseIntoAttrs gnuradio.pkgs;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 704aa9db62dc..a01b6b3dfe25 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4686,6 +4686,8 @@ self: super: with self; {
 
   fitbit = callPackage ../development/python-modules/fitbit { };
 
+  fitfile = callPackage ../development/python-modules/fitfile { };
+
   fivem-api = callPackage ../development/python-modules/fivem-api { };
 
   fixerio = callPackage ../development/python-modules/fixerio { };
@@ -6266,6 +6268,8 @@ self: super: with self; {
 
   id = callPackage ../development/python-modules/id { };
 
+  idbutils = callPackage ../development/python-modules/idbutils { };
+
   identify = callPackage ../development/python-modules/identify { };
 
   idna = callPackage ../development/python-modules/idna { };
@@ -16105,6 +16109,8 @@ self: super: with self; {
 
   tcolorpy = callPackage ../development/python-modules/tcolorpy { };
 
+  tcxfile = callPackage ../development/python-modules/tcxfile { };
+
   tcxparser = callPackage ../development/python-modules/tcxparser { };
 
   tcxreader = callPackage ../development/python-modules/tcxreader { };