diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 20937069624f..18ca84c3eb66 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -12,6 +12,9 @@
   The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`.
   For more information, [check the docs](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750).
 
+- The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
+  `perlPackages.Xapian`.
+
 - The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller.
   The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller.
   For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 566b70056df9..2f9aebf127ec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1008,6 +1008,12 @@
     githubId = 217050;
     name = "Albert Chae";
   };
+  albertilagan = {
+    email = "me@albertilagan.dev";
+    github = "albertilagan";
+    githubId = 22500561;
+    name = "Albert Ilagan";
+  };
   albertodvp = {
     email = "alberto.fanton@protonmail.com";
     github = "albertodvp";
@@ -2547,6 +2553,12 @@
     github = "Baitinq";
     githubId = 30861839;
   };
+  bakito = {
+    email = "github@bakito.ch";
+    name = "Marc Brugger";
+    github = "bakito";
+    githubId = 2733215;
+  };
   baksa = {
     email = "baksa@pm.me";
     name = "Kryštof Baksa";
@@ -11966,6 +11978,12 @@
     githubId = 44864956;
     keys = [ { fingerprint = "3F87 0A7C A7B4 3731 2F13  6083 749F D4DF A2E9 4236"; } ];
   };
+  kaeeraa = {
+    name = "kaeeraa";
+    email = "kaeeraa@nebula-nook.ru";
+    github = "kaeeraa";
+    githubId = 99148867;
+  };
   kaiha = {
     email = "kai.harries@gmail.com";
     github = "KaiHa";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 23972da40674..2b4e3f5bddbd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -821,7 +821,6 @@
   ./services/misc/klipper.nix
   ./services/misc/languagetool.nix
   ./services/misc/leaps.nix
-  ./services/misc/lidarr.nix
   ./services/misc/lifecycled.nix
   ./services/misc/llama-cpp.nix
   ./services/misc/logkeys.nix
@@ -861,12 +860,9 @@
   ./services/misc/portunus.nix
   ./services/misc/preload.nix
   ./services/misc/private-gpt.nix
-  ./services/misc/prowlarr.nix
   ./services/misc/pufferpanel.nix
   ./services/misc/pykms.nix
-  ./services/misc/radarr.nix
   ./services/misc/radicle.nix
-  ./services/misc/readarr.nix
   ./services/misc/realmd.nix
   ./services/misc/rebuilderd.nix
   ./services/misc/recyclarr.nix
@@ -878,13 +874,18 @@
   ./services/misc/rshim.nix
   ./services/misc/safeeyes.nix
   ./services/misc/sdrplay.nix
+  ./services/misc/servarr/lidarr.nix
+  ./services/misc/servarr/prowlarr.nix
+  ./services/misc/servarr/radarr.nix
+  ./services/misc/servarr/readarr.nix
+  ./services/misc/servarr/sonarr.nix
+  ./services/misc/servarr/whisparr.nix
   ./services/misc/serviio.nix
   ./services/misc/sickbeard.nix
   ./services/misc/signald.nix
   ./services/misc/siproxd.nix
   ./services/misc/snapper.nix
   ./services/misc/soft-serve.nix
-  ./services/misc/sonarr.nix
   ./services/misc/sourcehut
   ./services/misc/spice-autorandr.nix
   ./services/misc/spice-vdagentd.nix
@@ -910,7 +911,6 @@
   ./services/misc/wastebin.nix
   ./services/misc/weechat.nix
   ./services/misc/workout-tracker.nix
-  ./services/misc/whisparr.nix
   ./services/misc/xmrig.nix
   ./services/misc/ytdl-sub.nix
   ./services/misc/zoneminder.nix
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 3aa1c65a8d26..8f826ec36431 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -447,7 +447,7 @@ in {
       enable = lib.mkDefault true;
       virtualHosts = lib.genAttrs cfg.webHosts (webHost: {
         locations = {
-          ${cfg.serve.virtualRoot}.extraConfig = "uwsgi_pass unix:/run/mailman-web.socket;";
+          ${cfg.serve.virtualRoot}.uwsgiPass = "unix:/run/mailman-web.socket";
           "${lib.removeSuffix "/" cfg.serve.virtualRoot}/static/".alias = webSettings.STATIC_ROOT + "/";
         };
       });
diff --git a/nixos/modules/services/misc/lidarr.nix b/nixos/modules/services/misc/servarr/lidarr.nix
similarity index 83%
rename from nixos/modules/services/misc/lidarr.nix
rename to nixos/modules/services/misc/servarr/lidarr.nix
index 1ca0697205b5..09df550fb2cd 100644
--- a/nixos/modules/services/misc/lidarr.nix
+++ b/nixos/modules/services/misc/servarr/lidarr.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.lidarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -28,6 +29,10 @@ in
         '';
       };
 
+      settings = servarr.mkServarrSettingsOptions "lidarr" 8686;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "lidarr";
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "lidarr";
@@ -56,18 +61,20 @@ in
       description = "Lidarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "LIDARR" cfg.settings;
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${cfg.package}/bin/Lidarr -nobrowser -data='${cfg.dataDir}'";
         Restart = "on-failure";
       };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8686 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
 
     users.users = lib.mkIf (cfg.user == "lidarr") {
diff --git a/nixos/modules/services/misc/prowlarr.nix b/nixos/modules/services/misc/servarr/prowlarr.nix
similarity index 69%
rename from nixos/modules/services/misc/prowlarr.nix
rename to nixos/modules/services/misc/servarr/prowlarr.nix
index 21296985b3ef..dcf5b18005b4 100644
--- a/nixos/modules/services/misc/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@@ -6,7 +6,7 @@
 }:
 let
   cfg = config.services.prowlarr;
-
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -20,6 +20,10 @@ in
         default = false;
         description = "Open ports in the firewall for the Prowlarr web interface.";
       };
+
+      settings = servarr.mkServarrSettingsOptions "prowlarr" 9696;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "prowlarr";
     };
   };
 
@@ -28,19 +32,22 @@ in
       description = "Prowlarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings // {
+        HOME = "/var/empty";
+      };
 
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
         StateDirectory = "prowlarr";
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
         Restart = "on-failure";
       };
-      environment.HOME = "/var/empty";
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 9696 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
   };
 }
diff --git a/nixos/modules/services/misc/radarr.nix b/nixos/modules/services/misc/servarr/radarr.nix
similarity index 82%
rename from nixos/modules/services/misc/radarr.nix
rename to nixos/modules/services/misc/servarr/radarr.nix
index bb645acd5f92..9ca4b889de63 100644
--- a/nixos/modules/services/misc/radarr.nix
+++ b/nixos/modules/services/misc/servarr/radarr.nix
@@ -6,7 +6,7 @@
 }:
 let
   cfg = config.services.radarr;
-
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -27,6 +27,10 @@ in
         description = "Open ports in the firewall for the Radarr web interface.";
       };
 
+      settings = servarr.mkServarrSettingsOptions "radarr" 7878;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "radarr";
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "radarr";
@@ -51,18 +55,20 @@ in
       description = "Radarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "RADARR" cfg.settings;
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${cfg.package}/bin/Radarr -nobrowser -data='${cfg.dataDir}'";
         Restart = "on-failure";
       };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 7878 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
 
     users.users = lib.mkIf (cfg.user == "radarr") {
diff --git a/nixos/modules/services/misc/readarr.nix b/nixos/modules/services/misc/servarr/readarr.nix
similarity index 83%
rename from nixos/modules/services/misc/readarr.nix
rename to nixos/modules/services/misc/servarr/readarr.nix
index 49a3fde81a9d..3933ec0305f4 100644
--- a/nixos/modules/services/misc/readarr.nix
+++ b/nixos/modules/services/misc/servarr/readarr.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.readarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -28,6 +29,10 @@ in
         '';
       };
 
+      settings = servarr.mkServarrSettingsOptions "readarr" 8787;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "readarr";
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "readarr";
@@ -56,18 +61,20 @@ in
       description = "Readarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "READARR" cfg.settings;
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${cfg.package}/bin/Readarr -nobrowser -data='${cfg.dataDir}'";
         Restart = "on-failure";
       };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8787 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
 
     users.users = lib.mkIf (cfg.user == "readarr") {
diff --git a/nixos/modules/services/misc/servarr/settings-options.nix b/nixos/modules/services/misc/servarr/settings-options.nix
new file mode 100644
index 000000000000..007deba75425
--- /dev/null
+++ b/nixos/modules/services/misc/servarr/settings-options.nix
@@ -0,0 +1,88 @@
+{ lib, pkgs }:
+{
+  mkServarrSettingsOptions =
+    name: port:
+    lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = (pkgs.formats.ini { }).type;
+        options = {
+          update = {
+            mechanism = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (enum [
+                  "external"
+                  "builtIn"
+                  "script"
+                ]);
+              description = "which update mechanism to use";
+              default = "external";
+            };
+            automatically = lib.mkOption {
+              type = lib.types.bool;
+              description = "Automatically download and install updates.";
+              default = false;
+            };
+          };
+          server = {
+            port = lib.mkOption {
+              type = lib.types.int;
+              description = "Port Number";
+              default = port;
+            };
+          };
+          log = {
+            analyticsEnabled = lib.mkOption {
+              type = lib.types.bool;
+              description = "Send Anonymous Usage Data";
+              default = false;
+            };
+          };
+        };
+      };
+      example = lib.options.literalExpression ''
+        {
+          update.mechanism = "internal";
+          server = {
+            urlbase = "localhost";
+            port = ${toString port};
+            bindaddress = "*";
+          };
+        }
+      '';
+      default = { };
+      description = ''
+        Attribute set of arbitrary config options.
+        Please consult the documentation at the [wiki](https://wiki.servarr.com/useful-tools#using-environment-variables-for-config).
+
+        WARNING: this configuration is stored in the world-readable Nix store!
+        For secrets use [](#opt-services.${name}.environmentFiles).
+      '';
+    };
+
+  mkServarrEnvironmentFiles =
+    name:
+    lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        Environment file to pass secret configuration values.
+        Each line must follow the `${lib.toUpper name}__SECTION__KEY=value` pattern.
+        Please consult the documentation at the [wiki](https://wiki.servarr.com/useful-tools#using-environment-variables-for-config).
+      '';
+    };
+
+  mkServarrSettingsEnvVars =
+    name: settings:
+    lib.pipe settings [
+      (lib.mapAttrsRecursive (
+        path: value:
+        lib.optionalAttrs (value != null) {
+          name = lib.toUpper "${name}__${lib.concatStringsSep "__" path}";
+          value = toString (if lib.isBool value then lib.boolToString value else value);
+        }
+      ))
+      (lib.collect (x: lib.isString x.name or false && lib.isString x.value or false))
+      lib.listToAttrs
+    ];
+}
diff --git a/nixos/modules/services/misc/sonarr.nix b/nixos/modules/services/misc/servarr/sonarr.nix
similarity index 83%
rename from nixos/modules/services/misc/sonarr.nix
rename to nixos/modules/services/misc/servarr/sonarr.nix
index 65f43df08312..9918c9da28f5 100644
--- a/nixos/modules/services/misc/sonarr.nix
+++ b/nixos/modules/services/misc/servarr/sonarr.nix
@@ -7,6 +7,7 @@
 }:
 let
   cfg = config.services.sonarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -27,6 +28,10 @@ in
         '';
       };
 
+      environmentFiles = servarr.mkServarrEnvironmentFiles "sonarr";
+
+      settings = servarr.mkServarrSettingsOptions "sonarr" 8989;
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "sonarr";
@@ -52,11 +57,12 @@ in
       description = "Sonarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-
+      environment = servarr.mkServarrSettingsEnvVars "SONARR" cfg.settings;
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = utils.escapeSystemdExecArgs [
           (lib.getExe cfg.package)
           "-nobrowser"
@@ -67,7 +73,7 @@ in
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8989 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
     };
 
     users.users = lib.mkIf (cfg.user == "sonarr") {
diff --git a/nixos/modules/services/misc/whisparr.nix b/nixos/modules/services/misc/servarr/whisparr.nix
similarity index 79%
rename from nixos/modules/services/misc/whisparr.nix
rename to nixos/modules/services/misc/servarr/whisparr.nix
index bf15ee70fde4..b686c8a76691 100644
--- a/nixos/modules/services/misc/whisparr.nix
+++ b/nixos/modules/services/misc/servarr/whisparr.nix
@@ -7,6 +7,7 @@
 
 let
   cfg = config.services.whisparr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
   options = {
@@ -27,6 +28,10 @@ in
         description = "Open ports in the firewall for the Whisparr web interface.";
       };
 
+      settings = servarr.mkServarrSettingsOptions "whisparr" 6969;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "whisparr";
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "whisparr";
@@ -48,17 +53,21 @@ in
       description = "Whisparr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "WHISPARR" cfg.settings;
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'";
         Restart = "on-failure";
       };
     };
 
-    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ 6969 ]; };
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.server.port ];
+    };
 
     users.users = lib.mkIf (cfg.user == "whisparr") {
       whisparr = {
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 7bf52b43f3f7..fb40a429f858 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -96,7 +96,7 @@ let
     REDIRECT_STATUS   = "200";
   };
 
-  recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy-headers.conf" ''
+  recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy_set_header-headers.conf" ''
     proxy_set_header        Host $host;
     proxy_set_header        X-Real-IP $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -240,6 +240,14 @@ let
         include ${recommendedProxyConfig};
       ''}
 
+      ${optionalString cfg.recommendedUwsgiSettings ''
+        uwsgi_connect_timeout   ${cfg.uwsgiTimeout};
+        uwsgi_send_timeout      ${cfg.uwsgiTimeout};
+        uwsgi_read_timeout      ${cfg.uwsgiTimeout};
+        uwsgi_param             HTTP_CONNECTION "";
+        include ${cfg.package}/conf/uwsgi_params;
+      ''}
+
       ${optionalString (cfg.mapHashBucketSize != null) ''
         map_hash_bucket_size ${toString cfg.mapHashBucketSize};
       ''}
@@ -444,6 +452,13 @@ let
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $connection_upgrade;
       ''}
+      ${optionalString (config.uwsgiPass != null && !cfg.uwsgiResolveWhileRunning)
+        "uwsgi_pass ${config.uwsgiPass};"
+      }
+      ${optionalString (config.uwsgiPass != null && cfg.uwsgiResolveWhileRunning) ''
+        set $nix_proxy_target "${config.uwsgiPass}";
+        uwsgi_pass $nix_proxy_target;
+      ''}
       ${concatStringsSep "\n"
         (mapAttrsToList (n: v: ''fastcgi_param ${n} "${v}";'')
           (optionalAttrs (config.fastcgiParams != {})
@@ -455,6 +470,7 @@ let
       ${optionalString (config.return != null) "return ${toString config.return};"}
       ${config.extraConfig}
       ${optionalString (config.proxyPass != null && config.recommendedProxySettings) "include ${recommendedProxyConfig};"}
+      ${optionalString (config.uwsgiPass != null && config.recommendedUwsgiSettings) "include ${cfg.package}/conf/uwsgi_params;"}
       ${mkBasicAuth "sublocation" config}
     }
   '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
@@ -555,6 +571,23 @@ in
         '';
       };
 
+      recommendedUwsgiSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to enable recommended uwsgi settings if a vhost does not specify the option manually.
+        '';
+      };
+
+      uwsgiTimeout = mkOption {
+        type = types.str;
+        default = "60s";
+        example = "20s";
+        description = ''
+          Change the uwsgi related timeouts in recommendedUwsgiSettings.
+        '';
+      };
+
       defaultListen = mkOption {
         type = with types; listOf (submodule {
           options = {
@@ -864,6 +897,16 @@ in
         '';
       };
 
+      uwsgiResolveWhileRunning = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Resolves domains of uwsgi targets at runtime
+          and not only at start, you have to set
+          services.nginx.resolver, too.
+        '';
+      };
+
       mapHashBucketSize = mkOption {
         type = types.nullOr (types.enum [ 32 64 128 ]);
         default = null;
@@ -1161,6 +1204,16 @@ in
         '';
       }
 
+      {
+        assertion = all (host:
+          all (location: !(location.proxyPass != null && location.uwsgiPass != null)) (attrValues host.locations))
+        (attrValues virtualHosts);
+        message = ''
+          Options services.nginx.service.virtualHosts.<name>.proxyPass and
+          services.nginx.virtualHosts.<name>.uwsgiPass are mutually exclusive.
+        '';
+      }
+
       {
         assertion = cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF);
         message = ''
diff --git a/nixos/modules/services/web-servers/nginx/location-options.nix b/nixos/modules/services/web-servers/nginx/location-options.nix
index da55dc92f596..298dc3ab3c2f 100644
--- a/nixos/modules/services/web-servers/nginx/location-options.nix
+++ b/nixos/modules/services/web-servers/nginx/location-options.nix
@@ -53,6 +53,16 @@ with lib;
       '';
     };
 
+    uwsgiPass = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "unix:/run/example/example.sock";
+      description = ''
+        Adds uwsgi_pass directive and sets recommended proxy headers if
+        recommendedUwsgiSettings is enabled.
+      '';
+    };
+
     index = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -134,5 +144,14 @@ with lib;
         Enable recommended proxy settings.
       '';
     };
+
+    recommendedUwsgiSettings = mkOption {
+      type = types.bool;
+      default = config.services.nginx.recommendedUwsgiSettings;
+      defaultText = literalExpression "config.services.nginx.recommendedUwsgiSettings";
+      description = ''
+        Enable recommended uwsgi settings.
+      '';
+    };
   };
 }
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index be11bddb9329..89e33952697f 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -364,28 +364,10 @@ let
         apiKeyFile = pkgs.writeText "dummy-api-key" apikey;
       };
       metricProvider = {
-        services.sonarr.enable = true;
-        systemd.services.sonarr.serviceConfig.ExecStartPre =
-          let
-            sonarr_config = pkgs.writeText "config.xml" ''
-              <Config>
-                <LogLevel>info</LogLevel>
-                <EnableSsl>False</EnableSsl>
-                <Port>8989</Port>
-                <SslPort>9898</SslPort>
-                <UrlBase></UrlBase>
-                <BindAddress>*</BindAddress>
-                <ApiKey>${apikey}</ApiKey>
-                <AuthenticationMethod>None</AuthenticationMethod>
-                <UpdateMechanism>BuiltIn</UpdateMechanism>
-                <Branch>main</Branch>
-                <InstanceName>Sonarr</InstanceName>
-              </Config>
-            '';
-          in
-          [
-            ''${pkgs.coreutils}/bin/install -D -m 777 ${sonarr_config} -T /var/lib/sonarr/.config/NzbDrone/config.xml''
-          ];
+        services.sonarr = {
+          enable = true;
+          environmentFiles = [(pkgs.writeText "sonarr-env" "SONARR__AUTH__APIKEY=${apikey}")];
+        };
       };
       exporterTest = ''
         wait_for_unit("sonarr.service")
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 14f5affa5d7f..8fbb7a79ad01 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -737,8 +737,8 @@ let
         mktplcRef = {
           name = "vscode-intelephense-client";
           publisher = "bmewburn";
-          version = "1.14.1";
-          hash = "sha256-h9ROZtTLY7/QbM6ftiZJCtHkEYSVkrMU9pgv4QyTrzg=";
+          version = "1.14.2";
+          hash = "sha256-T0uaJedhlH3s6QnCEZvNxU8ErYW4+L1VBz79hnhwSyU=";
         };
         meta = {
           description = "PHP code intelligence for Visual Studio Code";
@@ -1780,9 +1780,6 @@ let
         };
       };
 
-      equinusocio.vsc-material-theme = throw "'equinusocio.vsc-material-theme' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
-      equinusocio.vsc-material-theme-icons = throw "'equinusocio.vsc-material-theme-icons' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
-
       esbenp.prettier-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "prettier-vscode";
@@ -5690,6 +5687,8 @@ let
     _2gua = throw "_2gua is deprecated in favor of 2gua"; # Added 2024-05-29
     _4ops = throw "_4ops is deprecated in favor of 4ops"; # Added 2024-05-29
     Arjun.swagger-viewer = throw "Arjun.swagger-viewer is deprecated in favor of arjun.swagger-viewer"; # Added 2024-05-29
+    equinusocio.vsc-material-theme = throw "'equinusocio.vsc-material-theme' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
+    equinusocio.vsc-material-theme-icons = throw "'equinusocio.vsc-material-theme-icons' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
     jakebecker.elixir-ls = throw "jakebecker.elixir-ls is deprecated in favor of elixir-lsp.vscode-elixir-ls"; # Added 2024-05-29
     jpoissonnier.vscode-styled-components = throw "jpoissonnier.vscode-styled-components is deprecated in favor of styled-components.vscode-styled-components"; # Added 2024-05-29
     matklad.rust-analyzer = throw "matklad.rust-analyzer is deprecated in favor of rust-lang.rust-analyzer"; # Added 2024-05-29
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index b2bfa4c20ca9..b56f5f6bc4d4 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "13.35";
+  version = "13.36";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = finalAttrs.version;
-    hash = "sha256-TvDopZyrRx+604ARrOiy2OsswE8/K+W5LIhOitttt3U=";
+    hash = "sha256-yPDbQfsclpDvLsKt1mLBXWs+lY9qDVWfVWF7/RQkFso=";
   };
 
   buildInputs =
diff --git a/pkgs/build-support/php/builders/v2/build-composer-project.nix b/pkgs/build-support/php/builders/v2/build-composer-project.nix
index bfbd2327812b..a777b8a830e2 100644
--- a/pkgs/build-support/php/builders/v2/build-composer-project.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-project.nix
@@ -3,100 +3,114 @@
   stdenvNoCC,
   lib,
   php,
-}:
+}@toplevel:
 
 let
   buildComposerProjectOverride =
-    finalAttrs: previousAttrs:
-
-    let
-      phpDrv = finalAttrs.php or php;
-      composer = finalAttrs.composer or phpDrv.packages.composer;
-    in
+    finalAttrs:
     {
-      composerLock = previousAttrs.composerLock or null;
-      composerNoDev = previousAttrs.composerNoDev or true;
-      composerNoPlugins = previousAttrs.composerNoPlugins or true;
-      composerNoScripts = previousAttrs.composerNoScripts or true;
-      composerStrictValidation = previousAttrs.composerStrictValidation or true;
-
-      nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [
+      php ? toplevel.php,
+      composer ? toplevel.php.packages.composer,
+      composerVendor ? null,
+      vendorHash ? null,
+      composerLock ? null,
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
+      buildInputs ? [ ],
+      nativeBuildInputs ? [ ],
+      strictDeps ? true,
+      patches ? [ ],
+      doCheck ? true,
+      doInstallCheck ? true,
+      passthru ? { },
+      meta ? { },
+      ...
+    }@args:
+    {
+      inherit
+        patches
+        strictDeps
+        doCheck
+        doInstallCheck
+        ;
+      nativeBuildInputs = nativeBuildInputs ++ [
         composer
-        phpDrv
-        phpDrv.composerHooks2.composerInstallHook
+        php
+        php.composerHooks2.composerInstallHook
       ];
 
-      buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ phpDrv ];
-
-      patches = previousAttrs.patches or [ ];
-      strictDeps = previousAttrs.strictDeps or true;
+      buildInputs = buildInputs ++ [ php ];
 
       # Should we keep these empty phases?
       configurePhase =
-        previousAttrs.configurePhase or ''
+        args.configurePhase or ''
           runHook preConfigure
 
           runHook postConfigure
         '';
 
       buildPhase =
-        previousAttrs.buildPhase or ''
+        args.buildPhase or ''
           runHook preBuild
 
           runHook postBuild
         '';
 
-      doCheck = previousAttrs.doCheck or true;
       checkPhase =
-        previousAttrs.checkPhase or ''
+        args.checkPhase or ''
           runHook preCheck
 
           runHook postCheck
         '';
 
       installPhase =
-        previousAttrs.installPhase or ''
+        args.installPhase or ''
           runHook preInstall
 
           runHook postInstall
         '';
 
-      doInstallCheck = previousAttrs.doInstallCheck or false;
       installCheckPhase =
-        previousAttrs.installCheckPhase or ''
+        args.installCheckPhase or ''
           runHook preInstallCheck
 
           runHook postInstallCheck
         '';
 
       composerVendor =
-        previousAttrs.composerVendor or (phpDrv.mkComposerVendor {
-          inherit composer;
+        args.composerVendor or (php.mkComposerVendor {
+          inherit
+            composer
+            composerLock
+            composerNoDev
+            composerNoPlugins
+            composerNoScripts
+            composerStrictValidation
+            vendorHash
+            ;
           inherit (finalAttrs)
             patches
             pname
             src
-            vendorHash
             version
             ;
-
-          composerLock = previousAttrs.composerLock or null;
-          composerNoDev = previousAttrs.composerNoDev or true;
-          composerNoPlugins = previousAttrs.composerNoPlugins or true;
-          composerNoScripts = previousAttrs.composerNoScripts or true;
-          composerStrictValidation = previousAttrs.composerStrictValidation or true;
         });
 
       # Projects providing a lockfile from upstream can be automatically updated.
-      passthru = previousAttrs.passthru or { } // {
+      passthru = passthru // {
         updateScript =
-          previousAttrs.passthru.updateScript
+          args.passthru.updateScript
             or (if finalAttrs.composerVendor.composerLock == null then nix-update-script { } else null);
       };
 
-      meta = previousAttrs.meta or { } // {
+      meta = meta // {
         platforms = lib.platforms.all;
       };
     };
 in
-args: (stdenvNoCC.mkDerivation args).overrideAttrs buildComposerProjectOverride
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+  extendDrvArgs = buildComposerProjectOverride;
+}
diff --git a/pkgs/build-support/php/builders/v2/build-composer-vendor.nix b/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
index 75f93d066f83..c66dedb614da 100644
--- a/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
@@ -2,86 +2,77 @@
   stdenvNoCC,
   lib,
   php,
-}:
+}@toplevel:
 
 let
   mkComposerVendorOverride =
-    /*
-      We cannot destruct finalAttrs since the attrset below is used to construct it
-      and Nix currently does not support lazy attribute names.
-      {
-      php ? null,
-      composer ? null,
-      composerLock ? "composer.lock",
-      src,
-      vendorHash,
-      ...
-      }@finalAttrs:
-    */
-    finalAttrs: previousAttrs:
-
-    let
-      phpDrv = finalAttrs.php or php;
-      composer = finalAttrs.composer or phpDrv.packages.composer;
-    in
-    assert (lib.assertMsg (previousAttrs ? src) "mkComposerVendor expects src argument.");
-    assert (lib.assertMsg (previousAttrs ? vendorHash) "mkComposerVendor expects vendorHash argument.");
-    assert (lib.assertMsg (previousAttrs ? version) "mkComposerVendor expects version argument.");
-    assert (lib.assertMsg (previousAttrs ? pname) "mkComposerVendor expects pname argument.");
+    finalAttrs:
     {
-      composerNoDev = previousAttrs.composerNoDev or true;
-      composerNoPlugins = previousAttrs.composerNoPlugins or true;
-      composerNoScripts = previousAttrs.composerNoScripts or true;
-      composerStrictValidation = previousAttrs.composerStrictValidation or true;
-
-      name = "${previousAttrs.pname}-composer-repository-${previousAttrs.version}";
+      php ? toplevel.php,
+      composer ? toplevel.php.packages.composer,
+      composerLock,
+      vendorHash ? null,
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
+      buildInputs ? [ ],
+      nativeBuildInputs ? [ ],
+      dontPatchShebangs ? true,
+      strictDeps ? true,
+      doCheck ? true,
+      doInstallCheck ? false,
+      ...
+    }@args:
+    assert (lib.assertMsg (args ? src) "mkComposerVendor expects src argument.");
+    assert (lib.assertMsg (args ? vendorHash) "mkComposerVendor expects vendorHash argument.");
+    assert (lib.assertMsg (args ? version) "mkComposerVendor expects version argument.");
+    assert (lib.assertMsg (args ? pname) "mkComposerVendor expects pname argument.");
+    {
+      name = "${args.pname}-composer-vendor-${args.version}";
 
       # See https://github.com/NixOS/nix/issues/6660
-      dontPatchShebangs = previousAttrs.dontPatchShebangs or true;
+      inherit dontPatchShebangs;
 
-      nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [
+      inherit buildInputs strictDeps doCheck;
+
+      nativeBuildInputs = nativeBuildInputs ++ [
         composer
-        phpDrv
-        phpDrv.composerHooks2.composerVendorHook
+        php
+        php.composerHooks2.composerVendorHook
       ];
 
-      buildInputs = previousAttrs.buildInputs or [ ];
-
-      strictDeps = previousAttrs.strictDeps or true;
-
       # Should we keep these empty phases?
       configurePhase =
-        previousAttrs.configurePhase or ''
+        args.configurePhase or ''
           runHook preConfigure
 
           runHook postConfigure
         '';
 
       buildPhase =
-        previousAttrs.buildPhase or ''
+        args.buildPhase or ''
           runHook preBuild
 
           runHook postBuild
         '';
 
-      doCheck = previousAttrs.doCheck or true;
       checkPhase =
-        previousAttrs.checkPhase or ''
+        args.checkPhase or ''
           runHook preCheck
 
           runHook postCheck
         '';
 
       installPhase =
-        previousAttrs.installPhase or ''
+        args.installPhase or ''
           runHook preInstall
 
           runHook postInstall
         '';
 
-      doInstallCheck = previousAttrs.doInstallCheck or false;
       installCheckPhase =
-        previousAttrs.installCheckPhase or ''
+        args.installCheckPhase or ''
           runHook preInstallCheck
 
           runHook postInstallCheck
@@ -90,7 +81,10 @@ let
       outputHashMode = "recursive";
       outputHashAlgo =
         if (finalAttrs ? vendorHash && finalAttrs.vendorHash != "") then null else "sha256";
-      outputHash = finalAttrs.vendorHash or "";
+      outputHash = vendorHash;
     };
 in
-args: (stdenvNoCC.mkDerivation args).overrideAttrs mkComposerVendorOverride
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+  extendDrvArgs = mkComposerVendorOverride;
+}
diff --git a/pkgs/by-name/ay/ayugram-desktop/package.nix b/pkgs/by-name/ay/ayugram-desktop/package.nix
index 44d94cff8808..d48e1142458e 100644
--- a/pkgs/by-name/ay/ayugram-desktop/package.nix
+++ b/pkgs/by-name/ay/ayugram-desktop/package.nix
@@ -31,7 +31,10 @@ telegram-desktop.override {
         '';
         homepage = "https://github.com/AyuGram/AyuGramDesktop";
         changelog = "https://github.com/AyuGram/AyuGramDesktop/releases/tag/v${finalAttrs.version}";
-        maintainers = with lib.maintainers; [ ];
+        maintainers = with lib.maintainers; [
+          kaeeraa
+          s0me1newithhand7s
+        ];
       };
     }
   );
diff --git a/pkgs/by-name/az/azurehound/package.nix b/pkgs/by-name/az/azurehound/package.nix
index 0222f32a3dae..e21a59cc6f69 100644
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "azurehound";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
     tag = "v${version}";
-    hash = "sha256-DqoEtL0uyLsP/2PJdOpAmXryEZQDlyGWPQHThF+3gJA=";
+    hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4=";
   };
 
   vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0=";
diff --git a/pkgs/by-name/bu/buildkit/package.nix b/pkgs/by-name/bu/buildkit/package.nix
index ac82c1adc103..3b28a9b04f76 100644
--- a/pkgs/by-name/bu/buildkit/package.nix
+++ b/pkgs/by-name/bu/buildkit/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-TN6IJLQxbwhflNdnrPgcqzw2o6di+aHOqwa6efkyV0k=";
+    hash = "sha256-ApmAeR93szAqeOJR7h5MwtDPf6nrUy4vYKgFeRZlCXw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ca/cargo-sort/package.nix b/pkgs/by-name/ca/cargo-sort/package.nix
index 18f8cebb75e2..1037a74688af 100644
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-sort";
-  version = "1.1.0";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AUtue1xkhrhlF7PtqsCQ9rdhV0/0i85DWrp7YL9SAYk=";
+    sha256 = "sha256-fqmyL4ZSz+nKfUIrcrfLRT9paEas5d00Y/kvEqyz2vw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yNHVhnJiawUrWncrIC8cAS25OYIZX7wVM9zMaupfTKM=";
+  cargoHash = "sha256-z5YT+6fU12WrByu3NZwodU9Y5489eCRrHUY+H/Hka+c=";
 
   meta = with lib; {
     description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";
diff --git a/pkgs/by-name/ch/changedetection-io/package.nix b/pkgs/by-name/ch/changedetection-io/package.nix
index 9943b8b01c51..9780dc4ef637 100644
--- a/pkgs/by-name/ch/changedetection-io/package.nix
+++ b/pkgs/by-name/ch/changedetection-io/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.49.1";
+  version = "0.49.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
     tag = version;
-    hash = "sha256-2DfuD7/LmJXJIbtEhwoDdANBfP7lIXpd7BWDuvd+ci8=";
+    hash = "sha256-QYghHpT78hlCZvliPsTdDE9bdSlr0kJn5xxwi3mnP/w=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index bc85dc350031..b90a9ca71bf0 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -17,7 +17,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "24.3.4";
+  version = "24.3.5";
 
   src =
     let
@@ -30,10 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-t9yhOgcka7zRSP1QyZvnc3iefKn9gv+pjobFJongb3A=";
-        aarch64-linux = "sha256-JanACJPOgHqhjLt2BzR+H9ZHwA2uPIrmyluVkRBqAhY=";
-        x86_64-darwin = "sha256-6FFMRBj6Z4UhqENclixtcgOrrmcYuabBqeIFGEqRQEA=";
-        aarch64-darwin = "sha256-vBb1w7Y8ADvhpEx/bf4W5llNIlng6kfZEUKB5bzQ8TY=";
+        x86_64-linux = "sha256-Kt+CPPgeqKMxZZeWG3NjNKdlcQFyS9NvEaAQSI9c5CI=";
+        aarch64-linux = "sha256-9O0BhsrhVMpf3FMzqZeaNrCKdSscsOrLmo6Mq42aRLU=";
+        x86_64-darwin = "sha256-4uZrlgjHJz7zOgGn7mTRtz/qjlvzBglXAVcjf7SDmCs=";
+        aarch64-darwin = "sha256-Hm9215hcoNEc/amTQ9mBX2wl95aTCF1/T+5crctbaeA=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/de/deck/package.nix b/pkgs/by-name/de/deck/package.nix
index 34a1dad53ce0..53412526e224 100644
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.44.1";
+  version = "1.45.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     tag = "v${version}";
-    hash = "sha256-PXFbYxBlHLWcxzyWfbK+n7G/dt/MgbyC1gGy7sq0OtM=";
+    hash = "sha256-XIv1ql2PNhosFVlw9nfXcoTouTkIC3chtWLDjrsF0nY=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -27,7 +27,7 @@ buildGoModule rec {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-XBiOAVXuvhaJrhgvM2b/rdt/bmvMAp6ctgWzIgeaUGc=";
+  vendorHash = "sha256-bVHRzhie5OkuZ8MJ5LnXqr8R38exq5nwrU1w5gSfhVI=";
 
   postInstall = ''
     installShellCompletion --cmd deck \
diff --git a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
index 35361b499756..6a3a7f36396b 100644
--- a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-mcbopomofo";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "openvanilla";
     repo = "fcitx5-mcbopomofo";
     rev = version;
-    hash = "sha256-xW3nxAfhdW7S0UJNl/NKhB1vzm0mMd92cA5ksPn7+QI=";
+    hash = "sha256-fHDNhZhSVgVuZLfRA3eJErm1gwhUZJw+emCXfeO5HVo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gf/gfs2-utils/package.nix b/pkgs/by-name/gf/gfs2-utils/package.nix
index 6c3634fe48d3..af183d726ac7 100644
--- a/pkgs/by-name/gf/gfs2-utils/package.nix
+++ b/pkgs/by-name/gf/gfs2-utils/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gfs2-utils";
-  version = "3.5.1";
+  version = "3.6.0";
 
   src = fetchurl {
     url = "https://pagure.io/gfs2-utils/archive/${version}/gfs2-utils-${version}.tar.gz";
-    hash = "sha256-ZWzNfYuhIxGmSAe454vRjAKp9Lq7EBBSY36P7qVgZnw=";
+    hash = "sha256-1+wgG8HEB3ic/hyLDY+JaPElqicHrSsS2AUBq6kh3sc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/he/heimdall-proxy/package.nix b/pkgs/by-name/he/heimdall-proxy/package.nix
new file mode 100644
index 000000000000..774008723724
--- /dev/null
+++ b/pkgs/by-name/he/heimdall-proxy/package.nix
@@ -0,0 +1,43 @@
+{
+  fetchFromGitHub,
+  buildGoModule,
+  lib,
+}:
+let
+  version = "0.15.5";
+in
+buildGoModule {
+  pname = "heimdall-proxy";
+
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "dadrus";
+    repo = "heimdall";
+    tag = "v${version}";
+    hash = "sha256-tVWdxhdHr8HvestvGbyfstSagzwIB35Uub+9X64tTAA=";
+  };
+
+  vendorHash = "sha256-DkqM/zkatYskXQl+MOWJX3PkZGHCqyXZ0v/EEJUS3cA=";
+
+  tags = [ "sqlite" ];
+
+  subPackages = [ "." ];
+
+  env.CGO_ENABLED = 0;
+
+  # Pass versioning information via ldflags
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/dadrus/heimdall/version.Version=${version}"
+  ];
+
+  meta = {
+    description = "A cloud native Identity Aware Proxy and Access Control Decision service";
+    homepage = "https://dadrus.github.io/heimdall";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ albertilagan ];
+    mainProgram = "heimdall-proxy";
+  };
+}
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
index fe812ff8b2b0..031cb33bd394 100644
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -1,26 +1,26 @@
 {
-  "version": "1.127.0",
-  "hash": "sha256-9lCMVQxMNNZgu9KTxNJfE4woZ+xLhS8JvfurtC/nf8c=",
+  "version": "1.128.0",
+  "hash": "sha256-g/lDI8/ap+CfoXH6dZKKt6xQJ79YqvWD44qW/HpOwFg=",
   "components": {
     "cli": {
-      "npmDepsHash": "sha256-iKKENhyGgAfpetYt4SPxvJZrxYWevMID0jjCou9t8X8=",
-      "version": "2.2.51"
+      "npmDepsHash": "sha256-hQlCvMkUJNUJ2QkXuQ6w7U/P3EjgYdd+qG40cKKeSzw=",
+      "version": "2.2.52"
     },
     "server": {
-      "npmDepsHash": "sha256-ZWRiQlXHXofUiyxNY74RL4IMIpv5XhNrR6g/GUcyaDA=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-s5T/IAcpW3u7Gb37dCuIY8PR9CbR/gjye9PbQ+eLQeo=",
+      "version": "1.128.0"
     },
     "web": {
-      "npmDepsHash": "sha256-A7bhxO/l0x5UoFCSy48BbUZX4mOXsXQwSS3EQHnAsFE=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-/CCemxeHiitcRF2r4RWSkHHZ5BU54SjShnv4AE0l7sM=",
+      "version": "1.128.0"
     },
     "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-14bcRhQi0VoodQl+GoK+uXFSqqDou7C2Rh50UoW71J8=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-tLj6Wd8i1NGC5Udbd/Or4FK1IXHDMVXY6QZkkg1Ixys=",
+      "version": "1.128.0"
     },
     "geonames": {
-      "timestamp": "20250129185843",
-      "hash": "sha256-poOvoBprzlEe4WDOdcO0TnIcwUp5xuKScumHMJ8YgO8="
+      "timestamp": "20250228235146",
+      "hash": "sha256-ljkYXqotHYkJOWRYIGHUhEWN0hVb2ELBAsZnTxLm2tU="
     }
   }
 }
diff --git a/pkgs/by-name/jr/jreleaser-cli/package.nix b/pkgs/by-name/jr/jreleaser-cli/package.nix
index f45a6f0b6347..3754e8577554 100644
--- a/pkgs/by-name/jr/jreleaser-cli/package.nix
+++ b/pkgs/by-name/jr/jreleaser-cli/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jreleaser-cli";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchurl {
     url = "https://github.com/jreleaser/jreleaser/releases/download/v${version}/jreleaser-tool-provider-${version}.jar";
-    hash = "sha256-86FvsGitzJBGQUZ9cxtnxO/hfplnpLekxrS+k5ToeLM=";
+    hash = "sha256-V3RDSpoHLJxUImPf+8wQdfukFNftfsZI1L9k+sD4yZg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ku/kubexporter/package.nix b/pkgs/by-name/ku/kubexporter/package.nix
new file mode 100644
index 000000000000..893aebb476a5
--- /dev/null
+++ b/pkgs/by-name/ku/kubexporter/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "kubexporter";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "bakito";
+    repo = "kubexporter";
+    tag = "v${version}";
+    hash = "sha256-9TtoACuX6dEcoWX246a5PofEIksB5KnxzRjdk/HV/Ww=";
+  };
+
+  vendorHash = "sha256-SWStAW5XkZGM57ZoxrVdxM7vtmZpSPkByrhFREHqfW0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/bakito/kubexporter/version.Version=${version}"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for exporting Kubernetes resources as YAML or JSON files";
+    homepage = "https://github.com/bakito/kubexporter";
+    changelog = "https://github.com/bakito/kubexporter/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bakito ];
+    mainProgram = "kubexporter";
+  };
+}
diff --git a/pkgs/by-name/mu/mutt/package.nix b/pkgs/by-name/mu/mutt/package.nix
index 69a4c2fbca06..0f47ad426674 100644
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -12,6 +12,7 @@
   gnupg,
   gpgme,
   libkrb5,
+  zlib,
   headerCache ? true,
   sslSupport ? true,
   saslSupport ? true,
@@ -61,7 +62,10 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    [ ncurses ]
+    [
+      ncurses
+      zlib
+    ]
     ++ lib.optional headerCache gdbm
     ++ lib.optional sslSupport openssl
     ++ lib.optional gssSupport libkrb5
diff --git a/pkgs/by-name/n-/n-m3u8dl-re/deps.json b/pkgs/by-name/n-/n-m3u8dl-re/deps.json
new file mode 100644
index 000000000000..2aa2b24a72db
--- /dev/null
+++ b/pkgs/by-name/n-/n-m3u8dl-re/deps.json
@@ -0,0 +1,17 @@
+[
+  {
+    "pname": "NiL.JS",
+    "version": "2.5.1684",
+    "hash": "sha256-lxFTYyuj0SuNzIQGq+rK9s0tAqxqQg8PBj/YdktJunw="
+  },
+  {
+    "pname": "Spectre.Console",
+    "version": "0.49.2-preview.0.50",
+    "hash": "sha256-ivFyHTfQxPf/RIin+aftmd+G4PcrqmJXmdu0u/RU6YA="
+  },
+  {
+    "pname": "System.CommandLine",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  }
+]
diff --git a/pkgs/by-name/n-/n-m3u8dl-re/package.nix b/pkgs/by-name/n-/n-m3u8dl-re/package.nix
new file mode 100644
index 000000000000..513f7a5c8c84
--- /dev/null
+++ b/pkgs/by-name/n-/n-m3u8dl-re/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+}:
+buildDotnetModule rec {
+  pname = "n-m3u8dl-re";
+  version = "0.3.0-beta";
+  src = fetchFromGitHub {
+    owner = "nilaoda";
+    repo = "N_m3u8DL-RE";
+    tag = "v${version}";
+    sha256 = "sha256-AVLO7pxD1LCoogsJPPN5aoOmVBIm3Y/EVsiQWdYI6QU=";
+  };
+  patches = [
+    ./publish-fix.patch
+    ./reverse-arr.patch
+  ];
+
+  # from openutau/default.nix
+  # [...]/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(248,5): error MSB4018: The "GenerateDepsFile" task failed unexpectedly. [[...]/N_m3u8DL-RE.Common.csproj]
+  # [...]/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(248,5): error MSB4018: System.IO.IOException: The process cannot access the file '[...]/N_m3u8DL-RE.Common.deps.json' because it is being used by another process. [[...]/N_m3u8DL-RE.Common.csproj]
+  enableParallelBuilding = false;
+
+  projectFile = "src/N_m3u8DL-RE.sln";
+  nugetDeps = ./deps.json;
+
+  executables = [ "N_m3u8DL-RE" ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
+
+  postFixup = ''
+    ln -s $out/bin/N_m3u8DL-RE $out/bin/n-m3u8dl-re
+  '';
+
+  meta = {
+    description = "Cross-Platform, modern and powerful stream downloader for MPD/M3U8/ISM";
+    homepage = "https://github.com/nilaoda/N_m3u8DL-RE";
+    license = lib.licenses.mit;
+    mainProgram = "n-m3u8dl-re";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.linux ++ lib.platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/n-/n-m3u8dl-re/publish-fix.patch b/pkgs/by-name/n-/n-m3u8dl-re/publish-fix.patch
new file mode 100644
index 000000000000..1d710ac7b725
--- /dev/null
+++ b/pkgs/by-name/n-/n-m3u8dl-re/publish-fix.patch
@@ -0,0 +1,10 @@
+--- a/src/N_m3u8DL-RE/Directory.Build.props
++++ b/src/N_m3u8DL-RE/Directory.Build.props
+@@ -9,7 +9,6 @@
+     <IlcTrimMetadata>true</IlcTrimMetadata>
+     <IlcGenerateStackTraceData>true</IlcGenerateStackTraceData>
+     <SatelliteResourceLanguages>zh-CN;zh-TW;en-US</SatelliteResourceLanguages>
+-    <PublishAot>true</PublishAot>
+     <StripSymbols>true</StripSymbols>
+     <ObjCopyName Condition="'$(RuntimeIdentifier)' == 'linux-arm64' or '$(RuntimeIdentifier)' == 'linux-musl-arm64'">aarch64-linux-gnu-objcopy</ObjCopyName>
+   </PropertyGroup>
diff --git a/pkgs/by-name/n-/n-m3u8dl-re/reverse-arr.patch b/pkgs/by-name/n-/n-m3u8dl-re/reverse-arr.patch
new file mode 100644
index 000000000000..1372adfc6414
--- /dev/null
+++ b/pkgs/by-name/n-/n-m3u8dl-re/reverse-arr.patch
@@ -0,0 +1,42 @@
+diff --git a/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs b/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
+index 6b6d284..b57fc24 100644
+--- a/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
++++ b/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
+@@ -201,7 +201,8 @@ public partial class WebVttSub
+             time += Convert.ToInt32(parts.Last().PadRight(3, '0'));
+             str = parts.First();
+         }
+-        var t = str.Split(':').Reverse().ToList();
++        var t = str.Split(':').ToList();
++        t.Reverse();
+         for (int i = 0; i < t.Count; i++)
+         {
+             time += (long)Math.Pow(60, i) * Convert.ToInt32(t[i]) * 1000;
+@@ -265,4 +266,4 @@ public partial class WebVttSub
+ 
+         return srt;
+     }
+-}
+\ No newline at end of file
++}
+diff --git a/src/N_m3u8DL-RE/Util/OtherUtil.cs b/src/N_m3u8DL-RE/Util/OtherUtil.cs
+index b2487f3..4eab23f 100644
+--- a/src/N_m3u8DL-RE/Util/OtherUtil.cs
++++ b/src/N_m3u8DL-RE/Util/OtherUtil.cs
+@@ -70,7 +70,8 @@ internal static partial class OtherUtil
+         var hours = -1;
+         var mins = -1;
+         var secs = -1;
+-        arr.Reverse().Select(i => Convert.ToInt32(i)).ToList().ForEach(item =>
++        arr.Reverse();
++        arr.Select(i => Convert.ToInt32(i)).ToList().ForEach(item =>
+         {
+             if (secs == -1) secs = item;
+             else if (mins == -1) mins = item;
+@@ -170,4 +171,4 @@ internal static partial class OtherUtil
+ 
+     [GeneratedRegex(@"^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$")]
+     private static partial Regex TimeStrRegex();
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index d15df89ddf7f..7008db74155f 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.10.25";
+  version = "2.10.26";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cpAUyTnGEPPPA2RRJ+jYQgUSZuI8YJQ3s4uhHvoYDCg=";
+    hash = "sha256-jOfS1uHI8sTL7xTyIiK/M7bFFNLTZZ6+Xy5QErBe9VY=";
   };
 
-  vendorHash = "sha256-8wExTV9seztPnpgyckDZnGc5iF3oY453YX7aoRcZHaI=";
+  vendorHash = "sha256-9BkcN4XLQPc9Df6m/CssKYxUk1nKJHB5SRPMrsXd+lQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nt/ntpd-rs/package.nix b/pkgs/by-name/nt/ntpd-rs/package.nix
index 7387291ebe32..9836a34f8dc4 100644
--- a/pkgs/by-name/nt/ntpd-rs/package.nix
+++ b/pkgs/by-name/nt/ntpd-rs/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ntpd-rs";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "pendulum-project";
     repo = "ntpd-rs";
     tag = "v${version}";
-    hash = "sha256-usLtf4qwKkn+lEYSQWCa1ap9h/52YYMVFDkpFJVD00k=";
+    hash = "sha256-APQHxlsyUMA1N6FatQvotOokxNikOO22GGyXUMh3ABo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Zm7uRdgX9zgLeVdcSdp3z+NjyD9HB0GHX37qjgjSatI=";
+  cargoHash = "sha256-BiLYKOgmmqOesfl/8y4590Xo2Z4+u/Rn7CglNjQk2bU=";
 
   nativeBuildInputs = [
     pandoc
diff --git a/pkgs/by-name/pg/pgbouncer/package.nix b/pkgs/by-name/pg/pgbouncer/package.nix
index b3ee07147c84..90ae5b91d429 100644
--- a/pkgs/by-name/pg/pgbouncer/package.nix
+++ b/pkgs/by-name/pg/pgbouncer/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgbouncer";
-  version = "1.23.1";
+  version = "1.24.0";
 
   src = fetchurl {
     url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-GWO0lyMdmlYKYtJm5KLq5ogatAGFPZPl0pLDdA7sUIQ=";
+    hash = "sha256-52rflBoxkaQW4iPAss2/cxWe74CioyMUr2+9guQaHUE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/pg/pgpool/package.nix b/pkgs/by-name/pg/pgpool/package.nix
index 063eaebe766e..f2a1700b0252 100644
--- a/pkgs/by-name/pg/pgpool/package.nix
+++ b/pkgs/by-name/pg/pgpool/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "pgpool-II";
-  version = "4.5.5";
+  version = "4.6.0";
 
   src = fetchurl {
     url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
     name = "pgpool-II-${version}.tar.gz";
-    hash = "sha256-lf/urrawzr6oA04w/Bkz/sc4SyJ61REwXqzMXQkP+Zg=";
+    hash = "sha256-9oplcUQtfqU7afOddJrUV3kLABgOGbAZ/ILiNbqwcyE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pu/pulumi/package.nix b/pkgs/by-name/pu/pulumi/package.nix
index a59203394e66..561ec997b7f6 100644
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@@ -1,133 +1,119 @@
 {
-  stdenv,
   lib,
-  buildGo122Module,
-  coreutils,
+  stdenv,
+  buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
   installShellFiles,
   git,
+  buildPackages,
   # passthru
   runCommand,
   makeWrapper,
+  testers,
   pulumi,
   pulumiPackages,
 }:
-
-# Using go 1.22 as pulumi 3.122.0 will not build with 1.23.
-# Issue: https://github.com/NixOS/nixpkgs/issues/351955
-# Upgrading pulumi version should fix it, but requires more involved changes, so
-# this is a temporary workaround.
-# Upgrade: https://github.com/NixOS/nixpkgs/pull/352221
-buildGo122Module rec {
+buildGoModule rec {
   pname = "pulumi";
-  version = "3.122.0";
+  version = "3.152.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-5KHptoQliqPtJ6J5u23ZgRZOdO77BJhZbdc3Cty9Myk=";
+    owner = "pulumi";
+    repo = "pulumi";
+    tag = "v${version}";
+    hash = "sha256-/cRWj7y6d5sNQRUXg9l7eDAOkUqNGXTzgpWDQdPP8zw=";
     # Some tests rely on checkout directory name
     name = "pulumi";
   };
 
-  vendorHash = "sha256-1UyYbmNNHlAeaW6M6AkaQ5Hs25ziHenSs4QjlnUQGjs=";
-
-  patches = [
-    # Fix a test failure, can be dropped in next release (3.100.0)
-    (fetchpatch {
-      url = "https://github.com/pulumi/pulumi/commit/6dba7192d134d3b6f7e26dee9205711ccc736fa7.patch";
-      hash = "sha256-QRN6XnIR2rrqJ4UFYNt/YmIlokTSkGUvnBO/Q9UN8X8=";
-      stripLen = 1;
-    })
-  ];
+  vendorHash = "sha256-JhIyivD+YpUUr9T8roNpINb3Tx8ZElHa+BrpJkyFx60=";
 
   sourceRoot = "${src.name}/pkg";
 
   nativeBuildInputs = [ installShellFiles ];
 
-  # Bundle release metadata
+  nativeCheckInputs = [ git ];
+
+  # https://github.com/pulumi/pulumi/blob/3ec1aa75d5bf7103b283f46297321a9a4b1a8a33/.goreleaser.yml#L20-L26
+  tags = [ "osusergo" ];
   ldflags = [
-    # Omit the symbol table and debug information.
     "-s"
-    # Omit the DWARF symbol table.
     "-w"
-  ] ++ importpathFlags;
-
-  importpathFlags = [
-    "-X github.com/pulumi/pulumi/pkg/v3/version.Version=v${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=v${version}"
   ];
 
-  nativeCheckInputs = [
-    git
+  excludedPackages = [
+    "util/generate"
+    "codegen/gen_program_test"
   ];
 
-  preCheck =
-    ''
-      # The tests require `version.Version` to be unset
-      ldflags=''${ldflags//"$importpathFlags"/}
+  # Required for user.Current implementation with osusergo on Darwin.
+  preCheck = ''
+    export HOME=$TMPDIR USER=nixbld
+  '';
 
-      # Create some placeholders for plugins used in tests. Otherwise, Pulumi
-      # tries to donwload them and fails, resulting in really long test runs
-      dummyPluginPath=$(mktemp -d)
-      for name in pulumi-{resource-pkg{A,B},-pkgB}; do
-        ln -s ${coreutils}/bin/true "$dummyPluginPath/$name"
-      done
+  checkFlags = [
+    # The tests require `version.Version` (i.e. ldflags) to be unset.
+    "-ldflags="
+    # Skip tests that fail in Nix sandbox.
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        # Seems to require TTY.
+        "TestProgressEvents"
 
-      export PATH=$dummyPluginPath''${PATH:+:}$PATH
+        # Tries to clone repo: https://github.com/pulumi/test-repo.git
+        "TestValidateRelativeDirectory"
+        "TestRepoLookup"
+        "TestDSConfigureGit"
 
-      # Code generation tests also download dependencies from network
-      rm codegen/{docs,dotnet,go,nodejs,python,schema}/*_test.go
-      rm -R codegen/{dotnet,go,nodejs,python}/gen_program_test
-
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      export PULUMI_HOME=$(mktemp -d)
-    '';
-
-  checkFlags =
-    let
-      disabledTests = [
-        # Flaky test
-        "TestPendingDeleteOrder"
         # Tries to clone repo: github.com/pulumi/templates.git
         "TestGenerateOnlyProjectCheck"
-        # Following tests give this error, not quite sure why:
-        #     Error Trace:    /build/pulumi/pkg/engine/lifecycletest/update_plan_test.go:273
-        # Error:          Received unexpected error:
-        #                 Unexpected diag message: <{%reset%}>using pulumi-resource-pkgA from $PATH at /build/tmp.bS8caxmTx7/pulumi-resource-pkgA<{%reset%}>
-        # Test:           TestUnplannedDelete
-        "TestExpectedDelete"
-        "TestPlannedInputOutputDifferences"
-        "TestPlannedUpdateChangedStack"
-        "TestExpectedCreate"
-        "TestUnplannedDelete"
-        # Following test gives this  error, not sure why:
-        # --- Expected
-        # +++ Actual
-        # @@ -1 +1 @@
-        # -gcp
-        # +aws
-        "TestPluginMapper_MappedNamesDifferFromPulumiName"
-        "TestProtect"
-      ];
-    in
-    [ "-skip=^${lib.concatStringsSep "$|^" disabledTests}$" ];
+        "TestPulumiNewSetsTemplateTag"
+        "TestPulumiPromptRuntimeOptions"
+
+        # Connects to https://pulumi-testing.vault.azure.net/…
+        "TestAzureCloudManager"
+        "TestAzureKeyEditProjectStack"
+        "TestAzureKeyVaultAutoFix15329"
+        "TestAzureKeyVaultExistingKey"
+        "TestAzureKeyVaultExistingKeyState"
+        "TestAzureKeyVaultExistingState"
+
+        # Requires pulumi-yaml
+        "TestProjectNameDefaults"
+        "TestProjectNameOverrides"
+
+        # Downloads pulumi-resource-random from Pulumi plugin registry.
+        "TestPluginInstallCancellation"
+
+        # Requires language-specific tooling and/or Internet access.
+        "TestGenerateProgram"
+        "TestGenerateProgramVersionSelection"
+        "TestGeneratePackage"
+        "TestGeneratePackageOne"
+        "TestGeneratePackageThree"
+        "TestGeneratePackageTwo"
+        "TestParseAndRenderDocs"
+        "TestImportResourceRef"
+      ]
+    }$"
+  ];
 
   # Allow tests that bind or connect to localhost on macOS.
   __darwinAllowLocalNetworking = true;
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    PULUMI_SKIP_UPDATE_CHECK=1 $out/bin/pulumi version | grep v${version} > /dev/null
-  '';
+  # Use pulumi from the previous stage if we can’t execute compiled binary.
+  pulumiExe =
+    if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+      "${placeholder "out"}/bin/pulumi"
+    else
+      "${buildPackages.pulumi}/bin/pulumi";
 
   postInstall = ''
-    installShellCompletion --cmd pulumi \
-      --bash <($out/bin/pulumi gen-completion bash) \
-      --fish <($out/bin/pulumi gen-completion fish) \
-      --zsh  <($out/bin/pulumi gen-completion zsh)
+    for shell in bash fish zsh; do
+      "$pulumiExe" gen-completion $shell >pulumi.$shell
+      installShellCompletion pulumi.$shell
+    done
   '';
 
   passthru = {
@@ -144,17 +130,25 @@ buildGo122Module rec {
             --suffix PATH : ${lib.makeBinPath (f pulumiPackages)} \
             --set LD_LIBRARY_PATH "${lib.getLib stdenv.cc.cc}/lib"
         '';
+    tests = {
+      version = testers.testVersion {
+        package = pulumi;
+        version = "v${version}";
+        command = "PULUMI_SKIP_UPDATE_CHECK=1 pulumi version";
+      };
+    };
   };
 
-  meta = with lib; {
-    homepage = "https://pulumi.io/";
+  meta = {
+    homepage = "https://www.pulumi.com";
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
-    sourceProvenance = [ sourceTypes.fromSource ];
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi";
+    maintainers = with lib.maintainers; [
       trundle
       veehaitch
+      tie
     ];
   };
 }
diff --git a/pkgs/by-name/ra/rathole/0001-no-more-vergen.patch b/pkgs/by-name/ra/rathole/0001-no-more-vergen.patch
new file mode 100644
index 000000000000..9e6285cfb487
--- /dev/null
+++ b/pkgs/by-name/ra/rathole/0001-no-more-vergen.patch
@@ -0,0 +1,22 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index e7a944e..e6bae43 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -7,7 +7,6 @@ description = "A reverse proxy for NAT traversal"
+ license = "Apache-2.0"
+ repository = "https://github.com/rapiz1/rathole"
+ readme = "README.md"
+-build = "build.rs"
+ include = ["src/**/*", "LICENSE", "README.md", "build.rs"]
+ 
+ [features]
+@@ -130,9 +129,4 @@ p12 = { version = "0.6.3", optional = true }
+ openssl = { version = "0.10", features = ["vendored"], optional = true }
+ 
+ [build-dependencies]
+-vergen = { version = "7.4.2", default-features = false, features = [
+-    "build",
+-    "git",
+-    "cargo",
+-] }
+ anyhow = "1.0"
diff --git a/pkgs/by-name/ra/rathole/package.nix b/pkgs/by-name/ra/rathole/package.nix
index e58c023ee090..e7834483e8bc 100644
--- a/pkgs/by-name/ra/rathole/package.nix
+++ b/pkgs/by-name/ra/rathole/package.nix
@@ -3,13 +3,13 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
+  rustc,
   pkg-config,
   openssl,
   nixosTests,
-  darwin,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "rathole";
   version = "0.5.0-unstable-2024-06-06";
 
@@ -20,19 +20,48 @@ rustPlatform.buildRustPackage {
     hash = "sha256-C0/G4JOZ4pTAvcKZhRHsGvlLlwAyWBQ0rMScLvaLSuA=";
   };
 
+  # Get rid of git dependency on vergen. No reason to require libgit2-sys as
+  # well as libz-sys. Vendored c libraries for libgit2/zlib fail to build on
+  # darwin and using libs from nixpkgs seems excessive.
+  patches = [
+    ./0001-no-more-vergen.patch
+  ];
+
+  # Build script is only needed for vergen and does nothing when not in a git
+  # repo.
+  postPatch = ''
+    rm build.rs
+  '';
+
   useFetchCargoVendor = true;
   cargoHash = "sha256-IgPDe8kuWzJ6nF2DceUbN7fw0eGkoYhu1IGMdlSMFos=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ CoreServices ]);
+  buildInputs = [
+    openssl
+  ];
 
   __darwinAllowLocalNetworking = true;
 
+  nativeCheckInputs = [ openssl ];
+  preCheck = ''
+    patchShebangs examples/tls/create_self_signed_cert.sh
+    (cd examples/tls && chmod +x create_self_signed_cert.sh && ./create_self_signed_cert.sh)
+  '';
+
+  env = {
+    VERGEN_BUILD_TIMESTAMP = "0";
+    VERGEN_BUILD_SEMVER = version;
+    VERGEN_GIT_COMMIT_TIMESTAMP = "0";
+    VERGEN_GIT_BRANCH = "main";
+    VERGEN_RUSTC_SEMVER = rustc.version;
+    VERGEN_RUSTC_CHANNEL = "stable";
+    VERGEN_CARGO_PROFILE = "release";
+    VERGEN_CARGO_FEATURES = "";
+    VERGEN_CARGO_TARGET_TRIPLE = "${stdenv.hostPlatform.rust.rustcTarget}";
+  };
+
   passthru.tests = {
     inherit (nixosTests) rathole;
   };
diff --git a/pkgs/by-name/sp/spades/package.nix b/pkgs/by-name/sp/spades/package.nix
index f17d0f6d0ebd..01f8063cbb3d 100644
--- a/pkgs/by-name/sp/spades/package.nix
+++ b/pkgs/by-name/sp/spades/package.nix
@@ -4,7 +4,6 @@
   bzip2,
   cmake,
   fetchFromGitHub,
-  fetchpatch,
   ncurses,
   python3,
   readline,
@@ -12,28 +11,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spades";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "ablab";
     repo = "spades";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-k2+ddJIgGE41KGZODovU9VdurbWerEtdqNrFDwyuFjo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JKtWlVf0nXXLgb6BxMgVVtEdjUOOYc0bPaFMDm5O6vg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  patches = [
-    # https://github.com/ablab/spades/pull/1314
-    (fetchpatch {
-      name = "copytree.patch";
-      url = "https://github.com/ablab/spades/commit/af1f756a46c5da669897b841d4f753af1eaa9588.patch";
-      hash = "sha256-tkT7hb0TqsbLkcTs9u43nzvV8bVdh3G9VKYqFFLrQv8=";
-      stripLen = 3;
-      extraPrefix = "projects/";
-    })
-  ];
-
   cmakeFlags = [
     "-DZLIB_ENABLE_TESTS=OFF"
     "-DSPADES_BUILD_INTERNAL=OFF"
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index b77a181c3c13..8383d175ad1a 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -12,6 +12,10 @@ buildXenPackage.override { inherit python3Packages; } {
       url = "https://lore.kernel.org/xen-devel/e2caa6648a0b6c429349a9826d8fbc4338222482.1733766758.git.andrii.sultanov@cloud.com/raw";
       hash = "sha256-JC1ueXuC1Jdi2gtUsjOHmTeEx56zjotMMLde5vBonxc=";
     })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa467.patch";
+      hash = "sha256-O2IwfRo6BnXAO04xjKmOyrV6J6Q1mAVLHWNCxqIEQGU=";
+    })
   ];
   rev = "ccf400846780289ae779c62ef0c94757ff43bb60";
   hash = "sha256-s0eCBCd6ybl+kLtXCC6E1sk++w7txXn/B/Cg5acQFfY=";
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 502a9e5809c9..70ea0a11eaf9 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -47,7 +47,7 @@ let
 
     passthru.tests = {
       inherit mu xapian-omega;
-      inherit (perlPackages) SearchXapian;
+      inherit (perlPackages) Xapian;
       python-xapian = python3.pkgs.xapian;
     };
 
diff --git a/pkgs/development/python-modules/checkdmarc/default.nix b/pkgs/development/python-modules/checkdmarc/default.nix
index 9f8ff2ea696e..23cd39a4464a 100644
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "checkdmarc";
-  version = "5.7.8";
+  version = "5.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "domainaware";
     repo = "checkdmarc";
     tag = version;
-    hash = "sha256-fqSRqiakwFk1Cfb79oOEBbPF/fbtumuV7M6Mjl09Vmw=";
+    hash = "sha256-mdEfVfqK277A8QUc8rpLxS2pfdyg4Z5XqWpWkh9mFLk=";
   };
 
   pythonRelaxDeps = [ "xmltodict" ];
@@ -69,7 +69,7 @@ buildPythonPackage rec {
     description = "Parser for SPF and DMARC DNS records";
     mainProgram = "checkdmarc";
     homepage = "https://github.com/domainaware/checkdmarc";
-    changelog = "https://github.com/domainaware/checkdmarc/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${src.tag}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index 5a45f37e4100..c45f97fec14b 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "folium";
-  version = "0.19.4";
+  version = "0.19.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "python-visualization";
     repo = "folium";
     tag = "v${version}";
-    hash = "sha256-qTTJK12nHIhcMkPu4rb2IYWm96EjRafftacrlfeGqZg=";
+    hash = "sha256-jZrGJWSmQXQNlZYldeNSh5AhlTHow5gxCEkksEoKZ7E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
index 1f835c0f9325..89ae0e6193d4 100644
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -1,71 +1,96 @@
 {
   lib,
+  pkgs,
+  pulumiPackages,
   buildPythonPackage,
+  pythonOlder,
+  hatchling,
   protobuf,
-  dill,
   grpcio,
-  pulumi,
-  isPy27,
-  semver,
-  pip,
-  pytestCheckHook,
-  pyyaml,
+  dill,
   six,
+  semver,
+  pyyaml,
+  debugpy,
+  pip,
+  pytest,
+  pytest-asyncio,
+  pytest-timeout,
+  python,
 }:
-buildPythonPackage rec {
-  inherit (pulumi) version src;
+let
+  inherit (pkgs.pulumi) pname version src;
+  inherit (pulumiPackages) pulumi-language-python;
+  sourceRoot = "${src.name}/sdk/python";
+in
+buildPythonPackage {
+  inherit
+    pname
+    version
+    src
+    sourceRoot
+    ;
 
-  pname = "pulumi";
-  format = "setuptools";
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-  disabled = isPy27;
+  pyproject = true;
 
-  propagatedBuildInputs = [
-    semver
+  disabled = pythonOlder "3.9";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
     protobuf
-    dill
     grpcio
-    pyyaml
+    dill
     six
+    semver
+    pyyaml
+    debugpy
+    pip
+  ];
+
+  pythonRelaxDeps = [
+    "grpcio"
+    "pip"
+    "semver"
   ];
 
   nativeCheckInputs = [
-    pip
-    pulumi.pkgs.pulumi-language-python
-    pytestCheckHook
+    pytest
+    pytest-asyncio
+    pytest-timeout
+    pulumi-language-python
   ];
 
-  pytestFlagsArray = [ "test/" ];
-
-  sourceRoot = "${src.name}/sdk/python/lib";
-
-  # we apply the modifications done in the pulumi/sdk/python/Makefile
-  # but without the venv code
-  postPatch = ''
-    cp ../../README.md .
-    substituteInPlace setup.py \
-      --replace "3.0.0" "${version}" \
-      --replace "grpcio==1.56.2" "grpcio" \
-      --replace "semver~=2.13" "semver"
+  # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L10-L11
+  # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L16
+  installCheckPhase = ''
+    runHook preInstallCheck
+    ${python.executable} -m pytest --ignore=lib/test/automation lib/test
+    pushd lib/test_with_mocks
+    ${python.executable} -m pytest
+    popd
+    runHook postInstallCheck
   '';
 
   # Allow local networking in tests on Darwin
   __darwinAllowLocalNetworking = true;
 
-  # Verify that the version substitution works
-  preCheck = ''
-    pip show "${pname}" | grep "Version: ${version}" > /dev/null \
-      || (echo "ERROR: Version substitution seems to be broken"; exit 1)
-  '';
-
   pythonImportsCheck = [ "pulumi" ];
 
-  meta = with lib; {
+  meta = {
     description = "Modern Infrastructure as Code. Any cloud, any language";
-    homepage = "https://github.com/pulumi/pulumi";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ teto ];
+    homepage = "https://www.pulumi.com";
+    license = lib.licenses.asl20;
     # https://github.com/pulumi/pulumi/issues/16828
-    broken = versionAtLeast protobuf.version "5";
+    broken = lib.versionAtLeast protobuf.version "5";
+    maintainers = with lib.maintainers; [
+      teto
+      tie
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index 389e8635de4d..c18ed1d3ec99 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zwave-js-server-python";
-  version = "0.60.0";
+  version = "0.60.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "zwave-js-server-python";
     tag = version;
-    hash = "sha256-+TW+6NhbtANtXf5ITAs+Mz8I7iZk93YYdUkUhp4m7pw=";
+    hash = "sha256-YRC9DA77sLuTxw7YRbhYKxUOaBQaERTV4UWAwAEldhU=";
   };
 
   build-system = [ setuptools ];
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper for zwave-js-server";
     homepage = "https://github.com/home-assistant-libs/zwave-js-server-python";
-    changelog = "https://github.com/home-assistant-libs/zwave-js-server-python/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-libs/zwave-js-server-python/releases/tag/${src.tag}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
     mainProgram = "zwave-js-server-python";
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/games/vcmi/default.nix
index f213aab406d8..f36b912b471f 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-JlRZMYS4w6yScpEehNDbtogzeBMq6zwE2Qfsuxmmib8=";
+    hash = "sha256-ImfEKVyuvl8VAsaq34DBe+fiAxf11Mr0jWVI51EsSRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mail/public-inbox/default.nix b/pkgs/servers/mail/public-inbox/default.nix
index 9360f1bef003..90d699a24ffb 100644
--- a/pkgs/servers/mail/public-inbox/default.nix
+++ b/pkgs/servers/mail/public-inbox/default.nix
@@ -38,7 +38,7 @@
   Plack,
   PlackMiddlewareReverseProxy,
   PlackTestExternalServer,
-  SearchXapian,
+  Xapian,
   TestSimple13,
   TimeDate,
   URI,
@@ -128,7 +128,7 @@ buildPerlPackage rec {
     ParseRecDescent
     Plack
     PlackMiddlewareReverseProxy
-    SearchXapian
+    Xapian
     TimeDate
     URI
     libgit2 # For Gcf2
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix b/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
index 01d1fec500c5..f6f5ab016efd 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
@@ -9,21 +9,32 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/go/pulumi-language-go";
 
-  vendorHash = "sha256-eHsTEb4Vff2bfADScLSkZiotSSnT1q0bexlUMaWgqbg=";
+  vendorHash = "sha256-mhwmHxZ+I/IdNGpEzXYJWPDKt7Gnun3HuXsjmFme6GI=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
   ];
 
-  # go: inconsistent vendoring in ...
-  doCheck = false;
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestPluginsAndDependencies_vendored"
+        "TestPluginsAndDependencies_subdir"
+        "TestPluginsAndDependencies_moduleMode"
+      ]
+    }$"
+  ];
 
-  meta = with lib; {
-    description = "Golang language host plugin for Pulumi";
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/go/";
+    description = "Language host for Pulumi programs written in Go";
+    license = lib.licenses.asl20;
     mainProgram = "pulumi-language-go";
-    homepage = "https://github.com/pulumi/pulumi/tree/master/sdk/go";
-    license = licenses.asl20;
+    maintainers = with lib.maintainers; [
+      tie
+    ];
   };
 }
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix b/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
index 3fcd92e58d21..8819fb107afd 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
@@ -1,31 +1,57 @@
 {
+  lib,
   buildGoModule,
   pulumi,
+  bash,
   nodejs,
+  python3,
 }:
 buildGoModule rec {
-  inherit (pulumi) version src;
-
   pname = "pulumi-language-nodejs";
+  inherit (pulumi) version src;
 
   sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";
 
-  vendorHash = "sha256-L91qIud8dWx7dWWEcknKUSTJe+f4OBL8wBg6dKUWgkQ=";
-
-  postPatch = ''
-    # Gives github.com/pulumi/pulumi/pkg/v3: is replaced in go.mod, but not marked as replaced in vendor/modules.txt etc
-    substituteInPlace language_test.go \
-      --replace "TestLanguage" \
-                "SkipTestLanguage"
-  '';
+  vendorHash = "sha256-vmFoMxWK5sj3vsBVFAji0Pz2wtf1H3MJhbrkHshDOno=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestGetProgramDependencies"
+      ]
+    }$"
   ];
 
   nativeCheckInputs = [
+    python3 # for TestNonblockingStdout
     nodejs
   ];
+
+  # For patchShebangsAuto (see scripts copied in postInstall).
+  buildInputs = [
+    bash
+  ];
+
+  postInstall = ''
+    cp -t "$out/bin" \
+      ../../dist/pulumi-resource-pulumi-nodejs \
+      ../../dist/pulumi-analyzer-policy
+  '';
+
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/javascript/";
+    description = "Language host for Pulumi programs written in TypeScript & JavaScript (Node.js)";
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi-language-nodejs";
+    maintainers = with lib.maintainers; [
+      tie
+    ];
+  };
 }
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix b/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
index b685a8ff6335..687d9df8bf64 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
@@ -1,36 +1,57 @@
 {
+  lib,
   buildGoModule,
   pulumi,
+  bash,
   python3,
 }:
 buildGoModule rec {
-  inherit (pulumi) version src;
-
   pname = "pulumi-language-python";
+  inherit (pulumi) version src;
 
   sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";
 
-  vendorHash = "sha256-Q8nnYJJN5+W2luY8JQJj1X9KIk9ad511FBywr+0wBNg=";
-
-  postPatch = ''
-    substituteInPlace main_test.go \
-      --replace "TestDeterminePulumiPackages" \
-                "SkipTestDeterminePulumiPackages"
-  '';
+  vendorHash = "sha256-2K3EIG0xRcRRJES9h72Sk9V442T6dHZbYxz1uxxEKWI=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestDeterminePulumiPackages"
+      ]
+    }$"
   ];
 
   nativeCheckInputs = [
     python3
   ];
 
+  # For patchShebangsAuto (see scripts copied in postInstall).
+  buildInputs = [
+    bash
+    python3
+  ];
+
   postInstall = ''
-    cp ../pulumi-language-python-exec           $out/bin
-    cp ../../dist/pulumi-resource-pulumi-python $out/bin
-    cp ../../dist/pulumi-analyzer-policy-python $out/bin
+    cp -t "$out/bin" \
+      ../pulumi-language-python-exec \
+      ../../dist/pulumi-resource-pulumi-python \
+      ../../dist/pulumi-analyzer-policy-python
   '';
+
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/python/";
+    description = "Language host for Pulumi programs written in Python";
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi-language-python";
+    maintainers = with lib.maintainers; [
+      tie
+    ];
+  };
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 71d4e3c881f4..7e7243f0566f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22487,21 +22487,6 @@ with self; {
     };
   };
 
-  SearchXapian = buildPerlPackage {
-    pname = "Search-Xapian";
-    version = "1.2.25.5";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OL/OLLY/Search-Xapian-1.2.25.5.tar.gz";
-      hash = "sha256-IE+9xxLWcR/6tmjB9M/AB7Y5qftkrX4ZyyD8EKkQuos=";
-    };
-    buildInputs = [ pkgs.xapian DevelLeak ];
-    meta = {
-      description = "Perl XS frontend to the Xapian C++ search library";
-      homepage = "https://xapian.org";
-      license = with lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   SeleniumRemoteDriver = buildPerlPackage {
     pname = "Selenium-Remote-Driver";
     version = "1.49";
@@ -28613,6 +28598,35 @@ with self; {
     };
   };
 
+  Xapian = buildPerlModule rec {
+    pname = "Xapian";
+    version = "1.4.27";
+    src = fetchurl {
+      url = "https://oligarchy.co.uk/xapian/${version}/xapian-bindings-${version}.tar.xz";
+      sha256 = "1fhq6rydjymmyn79cdza0j4rmlizrrwmf5mx276rlmwyh085wfxs";
+    };
+    buildInputs = [ pkgs.xapian ];
+    preConfigure = ''
+      # FIXME: doesn't work for cross
+      export PERL_LIB="$out/lib/perl5/site_perl/${perl.version}"
+      export PERL_ARCH="$PERL_LIB/$(perl -MConfig -e 'print $Config{archname}')"
+    '';
+    configureFlags = [
+      "--with-perl"
+    ];
+    outputs = [ "out" ]; # no "devdoc"
+    # Use default phases
+    buildPhase = null;
+    checkPhase = null;
+    checkTarget = "check";
+    installPhase = null;
+    meta = {
+      description = "Bindings allowing Xapian to be used from Perl";
+      homepage = "https://xapian.org";
+      license = [ lib.licenses.gpl2Plus ];
+    };
+  };
+
   XMLDescent = buildPerlModule {
     pname = "XML-Descent";
     version = "1.04";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9263045ae0fa..c9f6b609a007 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1468,7 +1468,7 @@ self: super: with self; {
 
   pueblo = callPackage ../development/python-modules/pueblo { };
 
-  pulumi = callPackage ../development/python-modules/pulumi { inherit (pkgs) pulumi; };
+  pulumi = callPackage ../development/python-modules/pulumi { };
 
   pulumi-aws = callPackage ../development/python-modules/pulumi-aws { };