diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 6329e1d9ea11..0a4f97b1395f 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -19,6 +19,8 @@ name: Codeowners v2
 #
 # This split is done because checking code owners requires handling untrusted PR input,
 # while requesting code owners requires PR write access, and those shouldn't be mixed.
+#
+# Note that the latter is also used for ./eval.yml requesting reviewers.
 
 on:
   pull_request_target:
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 06cff2b878d3..ab62551ce468 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -133,6 +133,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          fetch-depth: 2
           path: nixpkgs
 
       - name: Install Nix
@@ -194,12 +195,18 @@ jobs:
       - name: Compare against the base branch
         if: steps.baseRunId.outputs.baseRunId
         run: |
-          nix-build nixpkgs/ci -A eval.compare \
+          git -C nixpkgs worktree add ../base ${{ needs.attrs.outputs.baseSha }}
+          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.baseSha }} ${{ needs.attrs.outputs.mergedSha }} \
+            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
+
+          # Use the base branch to get accurate maintainer info
+          nix-build base/ci -A eval.compare \
             --arg beforeResultDir ./baseResult \
             --arg afterResultDir ./prResult \
+            --arg touchedFilesJson ./touched-files.json \
             -o comparison
+
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-          # TODO: Request reviews from maintainers for packages whose files are modified in the PR
 
       - name: Upload the combined results
         if: steps.baseRunId.outputs.baseRunId
@@ -218,6 +225,14 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
+      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
+      # Can't use the token received from permissions above, because it can't get enough permissions
+      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_APP_ID }}
+          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+
       - name: Download process result
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
@@ -252,6 +267,20 @@ jobs:
               /repos/"$REPOSITORY"/issues/"$NUMBER"/labels \
               -f "labels[]=$toAdd"
           done < <(comm -13 before after)
+
+          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
+          # There appears to be no API to request reviews based on GitHub IDs
+          jq -r 'keys[]' comparison/maintainers.json \
+            | while read -r id; do gh api /user/"$id"; done \
+            | jq -s '{ reviewers: map(.login) }' \
+            > reviewers.json
+
+          # Request reviewers from maintainers of changed output paths
+          GH_TOKEN=${{ steps.app-token.outputs.token }} gh api \
+            --method POST \
+            /repos/${{ github.repository }}/pulls/${{ github.event.number }}/requested_reviewers \
+            --input reviewers.json
+
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index cfcdd3c1a217..0c55b01c7160 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -5,7 +5,11 @@
   writeText,
   ...
 }:
-{ beforeResultDir, afterResultDir }:
+{
+  beforeResultDir,
+  afterResultDir,
+  touchedFilesJson,
+}:
 let
   /*
     Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.
@@ -77,11 +81,11 @@ let
   # - values: lists of `packagePlatformPath`s
   diffAttrs = diff beforeAttrs afterAttrs;
 
+  rebuilds = uniqueStrings (diffAttrs.added ++ diffAttrs.changed);
+  rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs rebuilds;
+
   changed-paths =
     let
-      rebuilds = uniqueStrings (diffAttrs.added ++ diffAttrs.changed);
-      rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs rebuilds;
-
       rebuildsByPlatform = groupByPlatform rebuildsPackagePlatformAttrs;
       rebuildsByKernel = groupByKernel rebuildsPackagePlatformAttrs;
       rebuildCountByKernel = lib.mapAttrs (
@@ -104,10 +108,17 @@ let
           );
       }
     );
+
+  maintainers = import ./maintainers.nix {
+    changedattrs = lib.unique (map (a: a.packagePath) rebuildsPackagePlatformAttrs);
+    changedpathsjson = touchedFilesJson;
+  };
 in
 runCommand "compare"
   {
     nativeBuildInputs = [ jq ];
+    maintainers = builtins.toJSON maintainers;
+    passAsFile = [ "maintainers" ];
   }
   ''
     mkdir $out
@@ -115,5 +126,8 @@ runCommand "compare"
     cp ${changed-paths} $out/changed-paths.json
 
     jq -r -f ${./generate-step-summary.jq} < ${changed-paths} > $out/step-summary.md
+
+    cp "$maintainersPath" "$out/maintainers.json"
+
     # TODO: Compare eval stats
   ''
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
new file mode 100644
index 000000000000..6728929952d4
--- /dev/null
+++ b/ci/eval/compare/maintainers.nix
@@ -0,0 +1,123 @@
+# Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
+{ changedattrs, changedpathsjson }:
+let
+  pkgs = import ../../.. {
+    system = "x86_64-linux";
+    config = { };
+    overlays = [ ];
+  };
+  inherit (pkgs) lib;
+
+  changedpaths = builtins.fromJSON (builtins.readFile changedpathsjson);
+
+  anyMatchingFile =
+    filename:
+    let
+      matching = builtins.filter (changed: lib.strings.hasSuffix changed filename) changedpaths;
+    in
+    (builtins.length matching) > 0;
+
+  anyMatchingFiles = files: (builtins.length (builtins.filter anyMatchingFile files)) > 0;
+
+  enrichedAttrs = builtins.map (path: {
+    path = path;
+    name = builtins.concatStringsSep "." path;
+  }) changedattrs;
+
+  validPackageAttributes = builtins.filter (
+    pkg:
+    if (lib.attrsets.hasAttrByPath pkg.path pkgs) then
+      (
+        if (builtins.tryEval (lib.attrsets.attrByPath pkg.path null pkgs)).success then
+          true
+        else
+          builtins.trace "Failed to access ${pkg.name} even though it exists" false
+      )
+    else
+      builtins.trace "Failed to locate ${pkg.name}." false
+  ) enrichedAttrs;
+
+  attrsWithPackages = builtins.map (
+    pkg: pkg // { package = lib.attrsets.attrByPath pkg.path null pkgs; }
+  ) validPackageAttributes;
+
+  attrsWithMaintainers = builtins.map (
+    pkg: pkg // { maintainers = (pkg.package.meta or { }).maintainers or [ ]; }
+  ) attrsWithPackages;
+
+  attrsWeCanPing = builtins.filter (
+    pkg:
+    if (builtins.length pkg.maintainers) > 0 then
+      true
+    else
+      builtins.trace "Package has no maintainers: ${pkg.name}" false
+  ) attrsWithMaintainers;
+
+  relevantFilenames =
+    drv:
+    (lib.lists.unique (
+      builtins.map (pos: lib.strings.removePrefix (toString ../..) pos.file) (
+        builtins.filter (x: x != null) [
+          (builtins.unsafeGetAttrPos "maintainers" (drv.meta or { }))
+          (builtins.unsafeGetAttrPos "src" drv)
+          # broken because name is always set by stdenv:
+          #    # A hack to make `nix-env -qa` and `nix search` ignore broken packages.
+          #    # TODO(@oxij): remove this assert when something like NixOS/nix#1771 gets merged into nix.
+          #    name = assert validity.handled; name + lib.optionalString
+          #(builtins.unsafeGetAttrPos "name" drv)
+          (builtins.unsafeGetAttrPos "pname" drv)
+          (builtins.unsafeGetAttrPos "version" drv)
+
+          # Use ".meta.position" for cases when most of the package is
+          # defined in a "common" section and the only place where
+          # reference to the file with a derivation the "pos"
+          # attribute.
+          #
+          # ".meta.position" has the following form:
+          #   "pkgs/tools/package-management/nix/default.nix:155"
+          # We transform it to the following:
+          #   { file = "pkgs/tools/package-management/nix/default.nix"; }
+          { file = lib.head (lib.splitString ":" (drv.meta.position or "")); }
+        ]
+      )
+    ));
+
+  attrsWithFilenames = builtins.map (
+    pkg: pkg // { filenames = relevantFilenames pkg.package; }
+  ) attrsWithMaintainers;
+
+  attrsWithModifiedFiles = builtins.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
+
+  listToPing = lib.lists.flatten (
+    builtins.map (
+      pkg:
+      builtins.map (maintainer: {
+        id = maintainer.githubId;
+        packageName = pkg.name;
+        dueToFiles = pkg.filenames;
+      }) pkg.maintainers
+    ) attrsWithModifiedFiles
+  );
+
+  byMaintainer = lib.lists.foldr (
+    ping: collector:
+    collector
+    // {
+      "${toString ping.id}" = [
+        { inherit (ping) packageName dueToFiles; }
+      ] ++ (collector."${toString ping.id}" or [ ]);
+    }
+  ) { } listToPing;
+
+  textForPackages =
+    packages: lib.strings.concatStringsSep ", " (builtins.map (pkg: pkg.packageName) packages);
+
+  textPerMaintainer = lib.attrsets.mapAttrs (
+    maintainer: packages: "- @${maintainer} for ${textForPackages packages}"
+  ) byMaintainer;
+
+  packagesPerMaintainer = lib.attrsets.mapAttrs (
+    maintainer: packages: builtins.map (pkg: pkg.packageName) packages
+  ) byMaintainer;
+in
+packagesPerMaintainer
diff --git a/ci/eval/compare/utils.nix b/ci/eval/compare/utils.nix
index 82ba64e06a17..04ac4f6e6162 100644
--- a/ci/eval/compare/utils.nix
+++ b/ci/eval/compare/utils.nix
@@ -11,6 +11,7 @@ rec {
     into
       {
         name = "hello";
+        packagePath = [ "hello" ];
         platform = "aarch64-linux";
       }
   */
@@ -30,6 +31,9 @@ rec {
       null
     else
       {
+        # [ "python312Packages" "numpy" ]
+        inherit packagePath;
+
         # python312Packages.numpy
         inherit name;
 
@@ -52,12 +56,12 @@ rec {
       ]
     into
       [
-        { name = "hello"; platform = "aarch64-linux"; }
-        { name = "hello"; platform = "x86_64-linux"; }
-        { name = "hello"; platform = "aarch64-darwin"; }
-        { name = "hello"; platform = "x86_64-darwin"; }
-        { name = "bye"; platform = "aarch64-darwin"; }
-        { name = "bye"; platform = "x86_64-darwin"; }
+        { name = "hello"; platform = "aarch64-linux"; packagePath = [ "hello" ]; }
+        { name = "hello"; platform = "x86_64-linux"; packagePath = [ "hello" ]; }
+        { name = "hello"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
+        { name = "hello"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
+        { name = "bye"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
+        { name = "bye"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
       ]
   */
   convertToPackagePlatformAttrs =
@@ -120,12 +124,12 @@ rec {
 
     Turns
       [
-        { name = "hello"; platform = "aarch64-linux"; }
-        { name = "hello"; platform = "x86_64-linux"; }
-        { name = "hello"; platform = "aarch64-darwin"; }
-        { name = "hello"; platform = "x86_64-darwin"; }
-        { name = "bye"; platform = "aarch64-darwin"; }
-        { name = "bye"; platform = "x86_64-darwin"; }
+        { name = "hello"; platform = "aarch64-linux"; ... }
+        { name = "hello"; platform = "x86_64-linux"; ... }
+        { name = "hello"; platform = "aarch64-darwin"; ... }
+        { name = "hello"; platform = "x86_64-darwin"; ... }
+        { name = "bye"; platform = "aarch64-darwin"; ... }
+        { name = "bye"; platform = "x86_64-darwin"; ... }
       ]
     into
       {
@@ -145,12 +149,12 @@ rec {
 
   # Turns
   # [
-  #   { name = "hello"; platform = "aarch64-linux"; }
-  #   { name = "hello"; platform = "x86_64-linux"; }
-  #   { name = "hello"; platform = "aarch64-darwin"; }
-  #   { name = "hello"; platform = "x86_64-darwin"; }
-  #   { name = "bye"; platform = "aarch64-darwin"; }
-  #   { name = "bye"; platform = "x86_64-darwin"; }
+  #   { name = "hello"; platform = "aarch64-linux"; ... }
+  #   { name = "hello"; platform = "x86_64-linux"; ... }
+  #   { name = "hello"; platform = "aarch64-darwin"; ... }
+  #   { name = "hello"; platform = "x86_64-darwin"; ... }
+  #   { name = "bye"; platform = "aarch64-darwin"; ... }
+  #   { name = "bye"; platform = "x86_64-darwin"; ... }
   # ]
   #
   # into
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a7a0491e025a..10f6a88385b8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15661,6 +15661,12 @@
     githubId = 9636071;
     name = "Myrl Hex";
   };
+  myypo = {
+    email = "nikirsmcgl@gmail.com";
+    github = "myypo";
+    githubId = 110892040;
+    name = "Mykyta Polchanov";
+  };
   mzacho = {
     email = "nixpkgs@martinzacho.net";
     github = "mzacho";
diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix
index 5efa4e51dc06..648f2f774ddf 100644
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@@ -619,9 +619,6 @@ let format' = format; in let
         # __noChroot for example).
         export HOME=$TMPDIR
         NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot
-
-        # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
-        rm -f $mountPoint/etc/machine-id
       ''}
 
       # Set the ownerships of the contents. The modes are set in preVM.
diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix
index ed635a35617b..3828db386f66 100644
--- a/nixos/modules/services/backup/zfs-replication.nix
+++ b/nixos/modules/services/backup/zfs-replication.nix
@@ -80,9 +80,10 @@ in
         let
           args = lib.map lib.escapeShellArg (
             [
-              "-l"
+              "--verbose"
+              "--user"
               cfg.username
-              "-i"
+              "--identity-file"
               cfg.identityFilePath
               cfg.host
               cfg.remoteFilesystem
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index d2ba1e54e22e..421fde5b07af 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -159,7 +159,7 @@ def copy_from_file(file: str, dry_run: bool = False) -> str:
 
 
 def write_entry(profile: str | None, generation: int, specialisation: str | None,
-                machine_id: str, bootspec: BootSpec, current: bool) -> None:
+                machine_id: str | None, bootspec: BootSpec, current: bool) -> None:
     if specialisation:
         bootspec = bootspec.specialisations[specialisation]
     kernel = copy_from_file(bootspec.kernel)
@@ -281,11 +281,7 @@ def install_bootloader(args: argparse.Namespace) -> None:
     except IOError as e:
         if e.errno != errno.ENOENT:
             raise
-        # Since systemd version 232 a machine ID is required and it might not
-        # be there on newly installed systems, so let's generate one so that
-        # bootctl can find it and we can also pass it to write_entry() later.
-        cmd = [f"{SYSTEMD}/bin/systemd-machine-id-setup", "--print"]
-        machine_id = run(cmd, stdout=subprocess.PIPE).stdout.rstrip()
+        machine_id = None
 
     if os.getenv("NIXOS_INSTALL_GRUB") == "1":
         warnings.warn("NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER", DeprecationWarning)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 147e9c11612e..cf0616886301 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -144,6 +144,7 @@ in {
   audiobookshelf = handleTest ./audiobookshelf.nix {};
   auth-mysql = handleTest ./auth-mysql.nix {};
   authelia = handleTest ./authelia.nix {};
+  auto-cpufreq = handleTest ./auto-cpufreq.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
   ayatana-indicators = runTest ./ayatana-indicators.nix;
diff --git a/nixos/tests/auto-cpufreq.nix b/nixos/tests/auto-cpufreq.nix
new file mode 100644
index 000000000000..79129cf1ffaf
--- /dev/null
+++ b/nixos/tests/auto-cpufreq.nix
@@ -0,0 +1,33 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+
+  {
+    name = "auto-cpufreq-server";
+
+    nodes = {
+      machine =
+        { pkgs, ... }:
+        {
+          # service will still start but since vm inside qemu cpufreq adjustments
+          # cannot be made. This will resource in the following error but the service
+          # remains up:
+          #   ERROR:
+          #   Couldn't find any of the necessary scaling governors.
+          services.auto-cpufreq = {
+            enable = true;
+            settings = {
+              charger = {
+                turbo = "auto";
+              };
+            };
+          };
+        };
+    };
+
+    testScript = ''
+      machine.start()
+      machine.wait_for_unit("auto-cpufreq.service")
+      machine.succeed("auto-cpufreq --force reset")
+    '';
+  }
+)
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 8848db05fb55..5a9bd0328c25 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -6062,6 +6062,18 @@ final: prev:
     meta.homepage = "https://github.com/junegunn/limelight.vim/";
   };
 
+  linediff-vim = buildVimPlugin {
+    pname = "linediff.vim";
+    version = "2024-04-22";
+    src = fetchFromGitHub {
+      owner = "AndrewRadev";
+      repo = "linediff.vim";
+      rev = "ddae71ef5f94775d101c1c70032ebe8799f32745";
+      sha256 = "01dshpxm1svfhw9l447mz224qbvlbvywd7ai4wxwyjzgkhp36937";
+    };
+    meta.homepage = "https://github.com/AndrewRadev/linediff.vim/";
+  };
+
   lingua-franca-vim = buildVimPlugin {
     pname = "lingua-franca.vim";
     version = "2021-09-05";
@@ -9389,6 +9401,18 @@ final: prev:
     meta.homepage = "https://github.com/LhKipp/nvim-nu/";
   };
 
+  nvim-numbertoggle = buildVimPlugin {
+    pname = "nvim-numbertoggle";
+    version = "2024-03-29";
+    src = fetchFromGitHub {
+      owner = "sitiom";
+      repo = "nvim-numbertoggle";
+      rev = "c5827153f8a955886f1b38eaea6998c067d2992f";
+      sha256 = "18nxqi3a3xamrjzpsabww411ix6vr44smprqi9prd47238lpshi2";
+    };
+    meta.homepage = "https://github.com/sitiom/nvim-numbertoggle/";
+  };
+
   nvim-osc52 = buildVimPlugin {
     pname = "nvim-osc52";
     version = "2024-05-24";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 599d52852a3e..46f11e2e3b4c 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -502,6 +502,7 @@ https://github.com/spywhere/lightline-lsp/,,
 https://github.com/itchyny/lightline.vim/,,
 https://github.com/ggandor/lightspeed.nvim/,,
 https://github.com/junegunn/limelight.vim/,,
+https://github.com/AndrewRadev/linediff.vim/,HEAD,
 https://github.com/lf-lang/lingua-franca.vim/,,
 https://github.com/tamago324/lir.nvim/,,
 https://github.com/kkharji/lispdocs.nvim/,,
@@ -779,6 +780,7 @@ https://github.com/nvim-neotest/nvim-nio/,HEAD,
 https://github.com/ya2s/nvim-nonicons/,,
 https://github.com/rcarriga/nvim-notify/,,
 https://github.com/LhKipp/nvim-nu/,HEAD,
+https://github.com/sitiom/nvim-numbertoggle/,HEAD,
 https://github.com/ojroques/nvim-osc52/,,
 https://github.com/julienvincent/nvim-paredit/,,
 https://github.com/gpanders/nvim-parinfer/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
index 9d2dd8d9ba28..2950e7ab0006 100644
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@@ -1,48 +1,14 @@
 {
   lib,
-  stdenv,
   vscode-utils,
-  fetchurl,
 }:
 
-let
-  version = "0.13.4";
-
-  sources = {
-    "x86_64-linux" = {
-      arch = "linux-x64";
-      url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-q9ubYkhrV28sB9CV1dyBEIFEkTrkGHRXdz5+4xjeVzI=";
-    };
-    "x86_64-darwin" = {
-      arch = "darwin-x64";
-      url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-vV5u1QBICz3GIYRgH9UWM38a8YXtvW0u8r7c1SaKwxM=";
-    };
-    "aarch64-linux" = {
-      arch = "linux-arm64";
-      url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-fgT4brIhHI6gNCcsbHpz+v4/diyox2VoFlvCnhPIbPM=";
-    };
-    "aarch64-darwin" = {
-      arch = "darwin-arm64";
-      url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
-    };
-  };
-in
 vscode-utils.buildVscodeMarketplaceExtension {
-  vsix = fetchurl {
-    url = sources.${stdenv.hostPlatform.system}.url;
-    hash = sources.${stdenv.hostPlatform.system}.hash;
-    name = "visualjj-visualjj-${version}.zip";
-  };
-
   mktplcRef = {
-    inherit version;
     name = "visualjj";
     publisher = "visualjj";
-    arch = sources.${stdenv.hostPlatform.system}.arch;
+    version = "0.13.4";
+    hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/dosbox-x/default.nix b/pkgs/applications/emulators/dosbox-x/default.nix
index a7cc9b5ea6a3..4b6ffafb9363 100644
--- a/pkgs/applications/emulators/dosbox-x/default.nix
+++ b/pkgs/applications/emulators/dosbox-x/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosbox-x";
-  version = "2024.12.04";
+  version = "2025.01.01";
 
   src = fetchFromGitHub {
     owner = "joncampbell123";
     repo = "dosbox-x";
     rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-wZCLwEInUfzuOCcUsz8W+Gi00lp4Nwc0QZjLF8/e9iM=";
+    hash = "sha256-3zE/VDCFNQRgqpIL5hRAafDoc7agX2LIsiL4xwDBLJY=";
   };
 
   # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants
diff --git a/pkgs/applications/graphics/yacreader/default.nix b/pkgs/applications/graphics/yacreader/default.nix
index af1d7579bbca..692463174da6 100644
--- a/pkgs/applications/graphics/yacreader/default.nix
+++ b/pkgs/applications/graphics/yacreader/default.nix
@@ -16,13 +16,13 @@
 
 mkDerivation rec {
   pname = "yacreader";
-  version = "9.14.2";
+  version = "9.15.0";
 
   src = fetchFromGitHub {
     owner = "YACReader";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gQ4Aaapini6j3lCtowFbrfwbe91aFl50hp1EfxTO8uY=";
+    sha256 = "sha256-5vCjr8WRwa7Q/84Itgg07K1CJKGnWA1z53et2IxxReE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 7063cada77d9..58cfbb15babe 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -117,7 +117,7 @@ in
 
       export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
       ${if finalAttrs.proxyVendor then ''
-        mkdir -p "''${GOPATH}/pkg/mod/cache/download"
+        mkdir -p "$GOPATH/pkg/mod/cache/download"
         go mod download
       '' else ''
         if (( "''${NIX_DEBUG:-0}" >= 1 )); then
@@ -135,8 +135,8 @@ in
       runHook preInstall
 
       ${if finalAttrs.proxyVendor then ''
-        rm -rf "''${GOPATH}/pkg/mod/cache/download/sumdb"
-        cp -r --reflink=auto "''${GOPATH}/pkg/mod/cache/download" $out
+        rm -rf "$GOPATH/pkg/mod/cache/download/sumdb"
+        cp -r --reflink=auto "$GOPATH/pkg/mod/cache/download" $out
       '' else ''
         cp -r --reflink=auto vendor $out
       ''}
diff --git a/pkgs/by-name/au/auto-cpufreq/package.nix b/pkgs/by-name/au/auto-cpufreq/package.nix
index fe9e2ca49ae8..c185b8a27dd2 100644
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -7,6 +7,7 @@
   wrapGAppsHook3,
   gtk3,
   getent,
+  nixosTests,
 }:
 python3Packages.buildPythonPackage rec {
   pname = "auto-cpufreq";
@@ -92,6 +93,10 @@ python3Packages.buildPythonPackage rec {
     cp scripts/org.auto-cpufreq.pkexec.policy $out/share/polkit-1/actions
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) auto-cpufreq;
+  };
+
   meta = {
     mainProgram = "auto-cpufreq";
     homepage = "https://github.com/AdnanHodzic/auto-cpufreq";
diff --git a/pkgs/by-name/au/autofs5/package.nix b/pkgs/by-name/au/autofs5/package.nix
index f570fcdb32f3..3b053f0d0165 100644
--- a/pkgs/by-name/au/autofs5/package.nix
+++ b/pkgs/by-name/au/autofs5/package.nix
@@ -44,6 +44,10 @@ stdenv.mkDerivation rec {
       url = "mirror://kernel/linux/daemons/autofs/v5/patches-5.2.0/autofs-5.1.9-fix-crash-in-make_options_string.patch";
       hash = "sha256-YjTdJ50iNhJ2UjFdrKYEFNt04z0PfmElbFa4GuSskLA=";
     })
+    (fetchpatch {
+      url = "mirror://kernel/linux/daemons/autofs/v5/patches-5.2.0/autofs-5.1.9-Fix-incompatible-function-pointer-types-in-cyrus-sasl-module.patch";
+      hash = "sha256-erLlqZtVmYqUOsk3S7S50yA0VB8Gzibsv+X50+gcA58=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/by-name/az/azure-cli/extensions-generated.json b/pkgs/by-name/az/azure-cli/extensions-generated.json
index b6e9b9477a59..bf4c4b52064d 100644
--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@@ -645,10 +645,10 @@
   },
   "managednetworkfabric": {
     "pname": "managednetworkfabric",
-    "version": "6.4.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-6.4.0-py3-none-any.whl",
-    "hash": "sha256-nUEHjgZUqq42pfDyg/Ud6YzENgWCkgU2VCVG7TTKC8Q=",
-    "description": "Support for managednetworkfabric commands based on 2023-06-15 API version"
+    "version": "7.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-7.0.0-py3-none-any.whl",
+    "hash": "sha256-I+K24xxpm8DoyNsvqjv9Yi1ewVZeCDCVIizYUB7TKW8=",
+    "description": "Support for managednetworkfabric commands based on 2024-02-15-preview API version"
   },
   "managementpartner": {
     "pname": "managementpartner",
@@ -729,9 +729,9 @@
   },
   "networkcloud": {
     "pname": "networkcloud",
-    "version": "2.0.0b6",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/networkcloud-2.0.0b6-py3-none-any.whl",
-    "hash": "sha256-1T+IepVTU7DLHQ7CfcEltQG+/lryktzUFB7RY9O9hzM=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/networkcloud-2.0.0-py3-none-any.whl",
+    "hash": "sha256-8ntKTSkGJwdhHJCeClEd7A0cUgRed8sV/l7qP5jAQhQ=",
     "description": "Support for Azure Operator Nexus network cloud commands based on 2024-07-01 API version"
   },
   "new-relic": {
@@ -841,9 +841,9 @@
   },
   "qumulo": {
     "pname": "qumulo",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/qumulo-1.0.0-py3-none-any.whl",
-    "hash": "sha256-mXP1gKP8IMwv5VWKHP3BDd/GVnmC0S83AIu/7Hqvz5s=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/qumulo-2.0.0-py3-none-any.whl",
+    "hash": "sha256-fsUZyd0s+Rv1Sy6Lm2iq2xNMsrv+xU6KLLCOo6DkfmI=",
     "description": "Microsoft Azure Command-Line Tools Qumulo Extension"
   },
   "quota": {
@@ -953,9 +953,9 @@
   },
   "stack-hci-vm": {
     "pname": "stack-hci-vm",
-    "version": "1.4.3",
-    "url": "https://hciarcvmsstorage.z13.web.core.windows.net/cli-extensions/stack_hci_vm-1.4.3-py3-none-any.whl",
-    "hash": "sha256-T1ulOOgw3O8ZUUfIunHHObK9SUy7moq1HoMcQLwfMyk=",
+    "version": "1.5.0",
+    "url": "https://hciarcvmsstorage.z13.web.core.windows.net/cli-extensions/stack_hci_vm-1.5.0-py3-none-any.whl",
+    "hash": "sha256-otixJPDbQp0+eugYFcVEzgAjGrFkDCHdqRUwT3WQ+Pg=",
     "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
   },
   "standbypool": {
diff --git a/pkgs/by-name/bt/btrfs-list/package.nix b/pkgs/by-name/bt/btrfs-list/package.nix
index cbe4f01a4423..597f326df58e 100644
--- a/pkgs/by-name/bt/btrfs-list/package.nix
+++ b/pkgs/by-name/bt/btrfs-list/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "btrfs-list";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "btrfs-list";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cWzDRop0cyrjVIJzuZxTqELgec66GiPAUJY1xIBr3OY=";
+    hash = "sha256-K6/xFR4Qmr6ynH5rZfOTN8nkl99iqcJPmKPwtp9FYyc=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/by-name/dm/dmg2img/package.nix b/pkgs/by-name/dm/dmg2img/package.nix
index 8b1e997ff736..ff93db42d28e 100644
--- a/pkgs/by-name/dm/dmg2img/package.nix
+++ b/pkgs/by-name/dm/dmg2img/package.nix
@@ -1,33 +1,50 @@
-{ lib, stdenv, fetchurl, zlib, bzip2, openssl, fetchpatch }:
+{
+  bzip2,
+  fetchFromGitHub,
+  lib,
+  openssl,
+  stdenv,
+  unstableGitUpdater,
+  zlib,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dmg2img";
-  version = "1.6.7";
+  version = "1.6.7-unstable-2020-12-27";
 
-  src = fetchurl {
-    url = "http://vu1tur.eu.org/tools/dmg2img-${version}.tar.gz";
-    sha256 = "066hqhg7k90xcw5aq86pgr4l7apzvnb4559vj5s010avbk8adbh2";
+  src = fetchFromGitHub {
+    owner = "Lekensteyn";
+    repo = "dmg2img";
+    rev = "a3e413489ccdd05431401357bf21690536425012";
+    hash = "sha256-DewU5jz2lRjIRiT0ebjPRArsoye33xlEGfhzd4xnT4A=";
   };
 
-  buildInputs = [ zlib bzip2 openssl ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/85fa66a9/dmg2img/openssl-1.1.diff";
-      sha256 = "076sz69hf3ryylplg025vl8sj991cb81g3yazsmrf8anrd7ffmxx";
-    })
+  buildInputs = [
+    bzip2
+    openssl
+    zlib
   ];
 
-  patchFlags = [ "-p0" ];
-
-  installPhase = ''
-    install -D dmg2img $out/bin/dmg2img
-    install -D vfdecrypt $out/bin/vfdecrypt
+  preBuild = ''
+    sed -i "s/1.6.5/${finalAttrs.version}/" dmg2img.c
   '';
 
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 dmg2img vfdecrypt -t $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
+    description = "Tool which allows converting Apple compressed dmg archives to standard (hfsplus) image disk files";
+    homepage = "https://github.com/Lekensteyn/dmg2img";
+    license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
-    description = "Apple's compressed dmg to standard (hfsplus) image disk file convert tool";
-    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ KSJ2000 ];
+    mainProgram = "dmg2img";
   };
-}
+})
diff --git a/pkgs/by-name/dp/dprint/plugins/default.nix b/pkgs/by-name/dp/dprint/plugins/default.nix
new file mode 100644
index 000000000000..cefe95973b8d
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/default.nix
@@ -0,0 +1,44 @@
+{ lib, fetchurl }:
+let
+  mkDprintPlugin =
+    {
+      url,
+      hash,
+      pname,
+      version,
+      description,
+      initConfig,
+      updateUrl,
+      license ? lib.licenses.mit,
+      maintainers ? [ lib.maintainers.phanirithvij ],
+    }:
+    fetchurl {
+      inherit hash url;
+      name = "${pname}-${version}.wasm";
+      meta = {
+        inherit
+          description
+          license
+          maintainers
+          ;
+      };
+      passthru = {
+        updateScript = ./update-plugins.py;
+        inherit initConfig updateUrl;
+      };
+    };
+  inherit (lib)
+    filterAttrs
+    mapAttrs'
+    nameValuePair
+    removeSuffix
+    ;
+  files = filterAttrs (
+    name: type: type == "regular" && name != "default.nix" && lib.hasSuffix ".nix" name
+  ) (builtins.readDir ./.);
+  plugins = mapAttrs' (
+    name: _:
+    nameValuePair (removeSuffix ".nix" name) (import (./. + "/${name}") { inherit mkDprintPlugin; })
+  ) files;
+in
+plugins // { inherit mkDprintPlugin; }
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
new file mode 100644
index 000000000000..4f1087505d52
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -0,0 +1,21 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "Biome (JS/TS) wrapper plugin.";
+  hash = "sha256-+zY+myazFAUxeNuWFigkvF4zpKBs+jzVYQT09jRWFKI=";
+  initConfig = {
+    configExcludes = [ "**/node_modules" ];
+    configKey = "biome";
+    fileExtensions = [
+      "ts"
+      "tsx"
+      "js"
+      "jsx"
+      "cjs"
+      "mjs"
+    ];
+  };
+  pname = "dprint-plugin-biome";
+  updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
+  url = "https://plugins.dprint.dev/biome-0.7.1.wasm";
+  version = "0.7.1";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix
new file mode 100644
index 000000000000..76e62aceecd7
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix
@@ -0,0 +1,14 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "Dockerfile code formatter.";
+  hash = "sha256-gsfMLa4zw8AblOS459ZS9OZrkGCQi5gBN+a3hvOsspk=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "dockerfile";
+    fileExtensions = [ "dockerfile" ];
+  };
+  pname = "dprint-plugin-dockerfile";
+  updateUrl = "https://plugins.dprint.dev/dprint/dockerfile/latest.json";
+  url = "https://plugins.dprint.dev/dockerfile-0.3.2.wasm";
+  version = "0.3.2";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-json.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-json.nix
new file mode 100644
index 000000000000..2d8702539a0a
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-json.nix
@@ -0,0 +1,14 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "JSON/JSONC code formatter.";
+  hash = "sha256-Sw+HkUb4K2wrLuQRZibr8gOCR3Rz36IeId4Vd4LijmY=";
+  initConfig = {
+    configExcludes = [ "**/*-lock.json" ];
+    configKey = "json";
+    fileExtensions = [ "json" ];
+  };
+  pname = "dprint-plugin-json";
+  updateUrl = "https://plugins.dprint.dev/dprint/json/latest.json";
+  url = "https://plugins.dprint.dev/json-0.19.4.wasm";
+  version = "0.19.4";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-jupyter.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-jupyter.nix
new file mode 100644
index 000000000000..f1ac0eae9708
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-jupyter.nix
@@ -0,0 +1,14 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "Jupyter notebook code block formatter.";
+  hash = "sha256-877CEZbMlj9cHkFtl16XCnan37SeEGUL3BHaUKUv8S4=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "jupyter";
+    fileExtensions = [ "ipynb" ];
+  };
+  pname = "dprint-plugin-jupyter";
+  updateUrl = "https://plugins.dprint.dev/dprint/jupyter/latest.json";
+  url = "https://plugins.dprint.dev/jupyter-0.1.5.wasm";
+  version = "0.1.5";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix
new file mode 100644
index 000000000000..0d17600f6827
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix
@@ -0,0 +1,14 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "Markdown code formatter.";
+  hash = "sha256-PIEN9UnYC8doJpdzS7M6QEHQNQtj7WwXAgvewPsTjqs=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "markdown";
+    fileExtensions = [ "md" ];
+  };
+  pname = "dprint-plugin-markdown";
+  updateUrl = "https://plugins.dprint.dev/dprint/markdown/latest.json";
+  url = "https://plugins.dprint.dev/markdown-0.17.8.wasm";
+  version = "0.17.8";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix
new file mode 100644
index 000000000000..deee9292f48f
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix
@@ -0,0 +1,17 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "Ruff (Python) wrapper plugin.";
+  hash = "sha256-15InHQgF9c0Js4yUJxmZ1oNj1O16FBU12u/GOoaSAJ8=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "ruff";
+    fileExtensions = [
+      "py"
+      "pyi"
+    ];
+  };
+  pname = "dprint-plugin-ruff";
+  updateUrl = "https://plugins.dprint.dev/dprint/ruff/latest.json";
+  url = "https://plugins.dprint.dev/ruff-0.3.9.wasm";
+  version = "0.3.9";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix
new file mode 100644
index 000000000000..3eef32b0e3bd
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix
@@ -0,0 +1,14 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "TOML code formatter.";
+  hash = "sha256-aDfo/sKfOeNpyfd/4N1LgL1bObTTnviYrA8T7M/1KNs=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "toml";
+    fileExtensions = [ "toml" ];
+  };
+  pname = "dprint-plugin-toml";
+  updateUrl = "https://plugins.dprint.dev/dprint/toml/latest.json";
+  url = "https://plugins.dprint.dev/toml-0.6.3.wasm";
+  version = "0.6.3";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
new file mode 100644
index 000000000000..a3a805827ec0
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -0,0 +1,21 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "TypeScript/JavaScript code formatter.";
+  hash = "sha256-urgKQOjgkoDJCH/K7DWLJCkD0iH0Ok+rvrNDI0i4uS0=";
+  initConfig = {
+    configExcludes = [ "**/node_modules" ];
+    configKey = "typescript";
+    fileExtensions = [
+      "ts"
+      "tsx"
+      "js"
+      "jsx"
+      "cjs"
+      "mjs"
+    ];
+  };
+  pname = "dprint-plugin-typescript";
+  updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
+  url = "https://plugins.dprint.dev/typescript-0.93.3.wasm";
+  version = "0.93.3";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix
new file mode 100644
index 000000000000..c01cad63c064
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix
@@ -0,0 +1,19 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "CSS, SCSS, Sass and Less formatter.";
+  hash = "sha256-zt7F1tgPhPAn+gtps6+JB5RtvjIZw2n/G85Bv6kazgU=";
+  initConfig = {
+    configExcludes = [ "**/node_modules" ];
+    configKey = "malva";
+    fileExtensions = [
+      "css"
+      "scss"
+      "sass"
+      "less"
+    ];
+  };
+  pname = "g-plane-malva";
+  updateUrl = "https://plugins.dprint.dev/g-plane/malva/latest.json";
+  url = "https://plugins.dprint.dev/g-plane/malva-v0.11.1.wasm";
+  version = "0.11.1";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix
new file mode 100644
index 000000000000..b948d3569013
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix
@@ -0,0 +1,24 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "HTML, Vue, Svelte, Astro, Angular, Jinja, Twig, Nunjucks, and Vento formatter.";
+  hash = "sha256-G8UnJbc+oZ60V3oi8W2SS6H06zEYfY3wpmSUp+1GF8k=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "markup";
+    fileExtensions = [
+      "html"
+      "vue"
+      "svelte"
+      "astro"
+      "jinja"
+      "jinja2"
+      "twig"
+      "njk"
+      "vto"
+    ];
+  };
+  pname = "g-plane-markup_fmt";
+  updateUrl = "https://plugins.dprint.dev/g-plane/markup_fmt/latest.json";
+  url = "https://plugins.dprint.dev/g-plane/markup_fmt-v0.18.0.wasm";
+  version = "0.18.0";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix
new file mode 100644
index 000000000000..38d7326ab416
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix
@@ -0,0 +1,17 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "GraphQL formatter.";
+  hash = "sha256-PlQwpR0tMsghMrOX7is+anN57t9xa9weNtoWpc0E9ec=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "graphql";
+    fileExtensions = [
+      "graphql"
+      "gql"
+    ];
+  };
+  pname = "g-plane-pretty_graphql";
+  updateUrl = "https://plugins.dprint.dev/g-plane/pretty_graphql/latest.json";
+  url = "https://plugins.dprint.dev/g-plane/pretty_graphql-v0.2.1.wasm";
+  version = "0.2.1";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix
new file mode 100644
index 000000000000..a303b945d5e7
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix
@@ -0,0 +1,17 @@
+{ mkDprintPlugin }:
+mkDprintPlugin {
+  description = "YAML formatter.";
+  hash = "sha256-6ua021G7ZW7Ciwy/OHXTA1Joj9PGEx3SZGtvaA//gzo=";
+  initConfig = {
+    configExcludes = [ ];
+    configKey = "yaml";
+    fileExtensions = [
+      "yaml"
+      "yml"
+    ];
+  };
+  pname = "g-plane-pretty_yaml";
+  updateUrl = "https://plugins.dprint.dev/g-plane/pretty_yaml/latest.json";
+  url = "https://plugins.dprint.dev/g-plane/pretty_yaml-v0.5.0.wasm";
+  version = "0.5.0";
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/update-plugins.py b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
new file mode 100755
index 000000000000..9a3bd7e38cae
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
@@ -0,0 +1,156 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p nix nixfmt-rfc-style 'python3.withPackages (pp: [ pp.requests ])'
+
+import json
+import os
+from pathlib import Path
+import sys
+import subprocess
+import requests
+
+USAGE = """Usage: {0} [ | plugin-name | plugin-file-path]
+
+eg.
+  {0}
+  {0} dprint-plugin-json
+  {0} /path/to/dprint-plugin-json.nix"""
+
+FILE_PATH = Path(os.path.realpath(__file__))
+SCRIPT_DIR = FILE_PATH.parent
+
+pname = ""
+if len(sys.argv) > 1:
+    if "-help" in "".join(sys.argv):
+        print(USAGE.format(FILE_PATH.name))
+        exit(0)
+    pname = sys.argv[1]
+else:
+    pname = os.environ.get("UPDATE_NIX_PNAME", "")
+
+
+# get sri hash for a url, no unpack
+def nix_prefetch_url(url, name, algo="sha256"):
+    hash = (
+        subprocess.check_output(
+            ["nix-prefetch-url", "--type", algo, "--name", name, url]
+        )
+        .decode("utf-8")
+        .rstrip()
+    )
+    sri = (
+        subprocess.check_output(
+            # split by space is enough for this command
+            "nix --extra-experimental-features nix-command "
+            f"hash convert --hash-algo {algo} --to sri {hash}".split(" ")
+        )
+        .decode("utf-8")
+        .rstrip()
+    )
+    return sri
+
+
+# json object to nix string
+def json_to_nix(jsondata):
+    # to quote strings, dumps twice does it
+    json_str = json.dumps(json.dumps(jsondata))
+    return (
+        subprocess.check_output(
+            "nix --extra-experimental-features nix-command eval "
+            f"--expr 'builtins.fromJSON ''{json_str}''' --impure | nixfmt",
+            shell=True,
+        )
+        .decode("utf-8")
+        .rstrip()
+    )
+
+
+# nix string to json object
+def nix_to_json(nixstr):
+    return json.loads(
+        subprocess.check_output(
+            f"nix --extra-experimental-features nix-command eval --json --expr '{nixstr}'",
+            shell=True,
+        )
+        .decode("utf-8")
+        .rstrip()
+    )
+
+
+# nixfmt a file
+def nixfmt(nixfile):
+    subprocess.run(["nixfmt", nixfile])
+
+
+def get_update_url(plugin_url):
+    """Get a single plugin's update url given the plugin's url"""
+
+    # remove -version.wasm at the end
+    url = "-".join(plugin_url.split("-")[:-1])
+    names = url.split("/")[3:]
+    # if single name then -> dprint/<name>
+    if len(names) == 1:
+        names.insert(0, "dprint")
+    return "https://plugins.dprint.dev/" + "/".join(names) + "/latest.json"
+
+
+def write_plugin_derivation(drv_attrs):
+    drv = f"{{ mkDprintPlugin }}: mkDprintPlugin {json_to_nix(drv_attrs)}"
+    filepath = SCRIPT_DIR / f"{drv_attrs["pname"]}.nix"
+    with open(filepath, "w+", encoding="utf8") as f:
+        f.write(drv)
+    nixfmt(filepath)
+
+
+def update_plugin_by_name(name):
+    """Update a single plugin by name"""
+
+    # allow passing in filename as well as pname
+    if name.endswith(".nix"):
+        name = Path(name[:-4]).name
+    try:
+        p = (SCRIPT_DIR / f"{name}.nix").read_text().replace("\n", "")
+    except OSError as e:
+        print(f"failed to update plugin {name}: error: {e}")
+        exit(1)
+
+    start_idx = p.find("mkDprintPlugin {") + len("mkDprintPlugin {")
+    p = nix_to_json("{" + p[start_idx:].strip())
+
+    data = requests.get(p["updateUrl"]).json()
+    p["url"] = data["url"]
+    p["version"] = data["version"]
+    p["hash"] = nix_prefetch_url(data["url"], f"{name}-{data["version"]}.wasm")
+
+    write_plugin_derivation(p)
+
+
+def update_plugins():
+    """Update all the plugins"""
+
+    data = requests.get("https://plugins.dprint.dev/info.json").json()["latest"]
+
+    for e in data:
+        update_url = get_update_url(e["url"])
+        pname = e["name"]
+        if "/" in e["name"]:
+            pname = pname.replace("/", "-")
+        drv_attrs = {
+            "url": e["url"],
+            "hash": nix_prefetch_url(e["url"], f"{pname}-{e["version"]}.wasm"),
+            "updateUrl": update_url,
+            "pname": pname,
+            "version": e["version"],
+            "description": e["description"],
+            "initConfig": {
+                "configKey": e["configKey"],
+                "configExcludes": e["configExcludes"],
+                "fileExtensions": e["fileExtensions"],
+            },
+        }
+        write_plugin_derivation(drv_attrs)
+
+
+if pname != "":
+    update_plugin_by_name(pname)
+else:
+    update_plugins()
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index db32be221bc0..3313fe74ebd4 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.14";
+  version = "0.20.15";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-5sZlpJ7xzQsjvECN4pjPndM39qonbgNy4zew6AE06D0=";
+    hash = "sha256-r68zuMCFIccA0cRLC2RNYCWoFh7tYiGu97Kid4hh0Uw=";
   };
 
-  cargoHash = "sha256-A8vE2Q/HEMgX6HC+nwR63Kr84gy2iZ5BzYDzaZz/h9Q=";
+  cargoHash = "sha256-hBsb62fcIrSR2w9O5+UaMUadyUUtu2PLODRg70wG/Xc=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/fl/fluent-bit/package.nix b/pkgs/by-name/fl/fluent-bit/package.nix
index 388996131179..93638c5efab3 100644
--- a/pkgs/by-name/fl/fluent-bit/package.nix
+++ b/pkgs/by-name/fl/fluent-bit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5Oyw3nHlAyywF+G0UiGyi1v+jAr8eyKt/1cDT5FdJXQ=";
+    hash = "sha256-oTCGjDmGVovsfj+4fjIKy/xpiuYc0Q44LYwYPI4dSF8=";
   };
 
   # optional only to avoid linux rebuild
diff --git a/pkgs/by-name/gf/gfan/package.nix b/pkgs/by-name/gf/gfan/package.nix
index 9410d7d2e491..a4b202e829da 100644
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@@ -19,6 +19,14 @@ stdenv.mkDerivation rec {
   patches =
     [
       ./gfan-0.6.2-cddlib-prefix.patch
+      (fetchpatch {
+        # removes dead code with invalid member reference in gfanlib
+        name = "clang-19.patch";
+        url = "https://github.com/Singular/Singular/commit/d3f73432d73ac0dd041af83cb35301498e9b57d9.patch";
+        stripLen = 2;
+        extraPrefix = "src/";
+        hash = "sha256-jPGMYx/GOFV7Tk3CqaRWeX/UHkzjeL57eZj4r40s8/g=";
+      })
     ]
     ++ lib.optionals (stdenv.cc.isClang) [
       (fetchpatch {
diff --git a/pkgs/by-name/hy/hyperscan/package.nix b/pkgs/by-name/hy/hyperscan/package.nix
index b9ba8e7b8dda..bce1ead253fd 100644
--- a/pkgs/by-name/hy/hyperscan/package.nix
+++ b/pkgs/by-name/hy/hyperscan/package.nix
@@ -56,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     sed -i '/examples/d' CMakeLists.txt
     substituteInPlace libhs.pc.in \
-      --replace "libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@" "libdir=@CMAKE_INSTALL_LIBDIR@" \
-      --replace "includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@" "includedir=@CMAKE_INSTALL_INCLUDEDIR@"
+      --replace-fail "libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@" "libdir=@CMAKE_INSTALL_LIBDIR@" \
+      --replace-fail "includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@" "includedir=@CMAKE_INSTALL_INCLUDEDIR@"
   '';
 
   doCheck = true;
diff --git a/pkgs/by-name/ka/kaufkauflist/package.nix b/pkgs/by-name/ka/kaufkauflist/package.nix
index 895567ba659b..8fb3073405a4 100644
--- a/pkgs/by-name/ka/kaufkauflist/package.nix
+++ b/pkgs/by-name/ka/kaufkauflist/package.nix
@@ -1,37 +1,44 @@
-{ lib
-, buildPackages
-, fetchFromGitHub
-, buildNpmPackage
-, fetchFromGitea
-, nix-update-script
+{
+  lib,
+  buildPackages,
+  fetchFromGitHub,
+  buildNpmPackage,
+  fetchFromGitea,
+  nix-update-script,
 }:
 
 let
   esbuild' = buildPackages.esbuild.override {
-    buildGoModule = args: buildPackages.buildGoModule (args // rec {
-      version = "0.19.11";
-      src = fetchFromGitHub {
-        owner = "evanw";
-        repo = "esbuild";
-        rev = "v${version}";
-        hash = "sha256-NUwjzOpHA0Ijuh0E69KXx8YVS5GTnKmob9HepqugbIU=";
-      };
-      vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
-    });
+    buildGoModule =
+      args:
+      buildPackages.buildGoModule (
+        args
+        // rec {
+          version = "0.21.5";
+          src = fetchFromGitHub {
+            owner = "evanw";
+            repo = "esbuild";
+            rev = "v${version}";
+            hash = "sha256-FpvXWIlt67G8w3pBKZo/mcp57LunxDmRUaCU/Ne89B8=";
+          };
+          vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+        }
+      );
   };
-in buildNpmPackage rec {
+in
+buildNpmPackage rec {
   pname = "kaufkauflist";
-  version = "4.0.0";
+  version = "4.0.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "annaaurora";
     repo = "kaufkauflist";
     rev = "v${version}";
-    hash = "sha256-x30K2dYxawfebdq//9OmCCG48w0V04tDTXpvRW7lfJI=";
+    hash = "sha256-tvkicYFQewQdcz3e+ETLiCK/c3eNPlxxZNzt+OpIbN0=";
   };
 
-  npmDepsHash = "sha256-E3AXFwiRvrE2Swt7BfSfAoU5mQplSaSJ4q56pVfoEkQ=";
+  npmDepsHash = "sha256-HDv6sW6FmKZpUjymrUjz/WG9XrKgLmM6qHMAxP6gBtU=";
 
   ESBUILD_BINARY_PATH = lib.getExe esbuild';
 
diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
new file mode 100644
index 000000000000..b66c1d3ae1f2
--- /dev/null
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -0,0 +1,47 @@
+{
+  buildGoModule,
+  dbmate,
+  fetchFromGitHub,
+  lib,
+}:
+
+let
+  finalAttrs = {
+    pname = "ncps";
+    version = "v0.1.1";
+
+    src = fetchFromGitHub {
+      owner = "kalbasit";
+      repo = "ncps";
+      rev = finalAttrs.version;
+      hash = "sha256-Vr/thppCABdZDl1LEc7l7c7Ih55U/EFwJInWSUWoLJA";
+    };
+
+    ldflags = [
+      "-X github.com/kalbasit/ncps/cmd.Version=${finalAttrs.version}"
+    ];
+
+    subPackages = [ "." ];
+
+    vendorHash = "sha256-xPrWofNyDFrUPQ42AYDs2x2gGoQ2w3tRrMIsu3SVyHA=";
+    doCheck = true;
+
+    nativeBuildInputs = [
+      dbmate # used for testing
+    ];
+
+    postInstall = ''
+      mkdir -p $out/share/ncps
+      cp -r db $out/share/ncps/db
+    '';
+
+    meta = {
+      description = "Nix binary cache proxy service";
+      homepage = "https://github.com/kalbasit/ncps";
+      license = lib.licenses.mit;
+      mainProgram = "ncps";
+      maintainers = [ lib.maintainers.kalbasit ];
+    };
+  };
+in
+buildGoModule finalAttrs
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index f749546b3271..94d33583ba40 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2024-12-20";
+  version = "0-unstable-2024-12-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "323cc41b6864e53cb1b99bf909c779b739a8fccb";
-    hash = "sha256-CYgQ5CMVkHqOEPPaG74GVNhm8pa6ZpAtt54JrrDn+2M=";
+    rev = "f655a1380364fdab9fa0f72909c19ab8ff16dbb6";
+    hash = "sha256-mErr95/Ew9HwKDJhQy7V86H1MJb5Y7IFzg7Id8Llqy8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/restate/package.nix b/pkgs/by-name/re/restate/package.nix
new file mode 100644
index 000000000000..efb80b0cf913
--- /dev/null
+++ b/pkgs/by-name/re/restate/package.nix
@@ -0,0 +1,121 @@
+{
+  lib,
+  stdenv,
+  testers,
+  versionCheckHook,
+  nix-update-script,
+  rustPlatform,
+  fetchFromGitHub,
+  protobuf,
+  restate,
+  pkg-config,
+  openssl,
+  perl,
+  cmake,
+  cacert,
+  rdkafka,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "restate";
+  version = "1.1.6";
+
+  src = fetchFromGitHub {
+    owner = "restatedev";
+    repo = "restate";
+    tag = "v${version}";
+    hash = "sha256-uDNPIL9Ox5rwWVzqWe74elHPGy6lSvWR1S7HsY6ATjc=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-z7VAKU4bi6pX2z4jCKWDfQt8FFLN7ugnW2LOy6IHz/w=";
+
+  env = {
+    PROTOC = lib.getExe protobuf;
+    PROTOC_INCLUDE = "${protobuf}/include";
+
+    VERGEN_GIT_COMMIT_DATE = "2024-12-23";
+    VERGEN_GIT_SHA = "v${version}";
+
+    # rustflags as defined in the upstream's .cargo/config.toml
+    RUSTFLAGS =
+      let
+        target = stdenv.hostPlatform.config;
+        targetFlags = rec {
+          build = [
+            "-C force-unwind-tables"
+            "-C debug-assertions"
+            "--cfg uuid_unstable"
+            "--cfg tokio_unstable"
+          ];
+
+          "aarch64-unknown-linux-gnu" = build ++ [
+            # Enable frame pointers to support Parca (https://github.com/parca-dev/parca-agent/pull/1805)
+            "-C force-frame-pointers=yes"
+          ];
+
+          "x86_64-unknown-linux-musl" = build ++ [
+            "-C link-self-contained=yes"
+          ];
+
+          "aarch64-unknown-linux-musl" = build ++ [
+            # Enable frame pointers to support Parca (https://github.com/parca-dev/parca-agent/pull/1805)
+            "-C force-frame-pointers=yes"
+            "-C link-self-contained=yes"
+          ];
+        };
+      in
+      lib.concatStringsSep " " (lib.attrsets.attrByPath [ target ] targetFlags.build targetFlags);
+
+    # Have to be set to dynamically link librdkafka
+    CARGO_FEATURE_DYNAMIC_LINKING = 1;
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    openssl
+    perl
+    rustPlatform.bindgenHook
+    cmake
+  ];
+  buildInputs = [ rdkafka ];
+  nativeCheckInputs = [
+    cacert
+  ];
+
+  useNextest = true;
+  # Feature resolution seems to be failing due to this https://github.com/rust-lang/cargo/issues/7754
+  auditable = false;
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    tests.restateCliVersion = testers.testVersion {
+      package = restate;
+      command = "restate --version";
+    };
+    tests.restateServerVersion = testers.testVersion {
+      package = restate;
+      command = "restate-server --version";
+    };
+    tests.restateCtlVersion = testers.testVersion {
+      package = restate;
+      command = "restatectl --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Restate is a platform for developing distributed fault-tolerant applications.";
+    homepage = "https://restate.dev";
+    changelog = "https://github.com/restatedev/restate/releases/tag/v${version}";
+    mainProgram = "restate";
+    license = lib.licenses.bsl11;
+    maintainers = with lib.maintainers; [ myypo ];
+  };
+}
diff --git a/pkgs/by-name/ri/rip2/package.nix b/pkgs/by-name/ri/rip2/package.nix
index fcce093a2b23..3fe207615420 100644
--- a/pkgs/by-name/ri/rip2/package.nix
+++ b/pkgs/by-name/ri/rip2/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rip2";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "MilesCranmer";
     repo = "rip2";
     rev = "v${version}";
-    hash = "sha256-9leLWfPilDQHzQRzTUjAFt9olTPEL4GcQgYFWZu3dug=";
+    hash = "sha256-OZsiAh0sQygLdVdA1QxCf7FTvP5CrlDNeOQLv2G2X3U=";
   };
 
-  cargoHash = "sha256-l6rbeiyIsr1csBcp+428TpQYSs9RvfJutGoL/wtSGR8=";
+  cargoHash = "sha256-9wbHXgjOWyQS8JOMQQTVetMacdjWD9C4NBWxUpcjbdg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 853b9cae4c77..1288743c3c1f 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -14,7 +14,7 @@
   sqlite,
   ragel,
   icu,
-  hyperscan,
+  vectorscan,
   jemalloc,
   blas,
   lapack,
@@ -24,13 +24,10 @@
   zstd,
   libarchive,
   withBlas ? true,
-  withHyperscan ? stdenv.hostPlatform.isx86_64,
   withLuaJIT ? stdenv.hostPlatform.isx86_64,
   nixosTests,
 }:
 
-assert withHyperscan -> stdenv.hostPlatform.isx86_64;
-
 stdenv.mkDerivation rec {
   pname = "rspamd";
   version = "3.11.0";
@@ -48,7 +45,9 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     perl
+    ragel
   ];
+
   buildInputs =
     [
       doctest
@@ -64,8 +63,8 @@ stdenv.mkDerivation rec {
       xxHash
       zstd
       libarchive
+      vectorscan
     ]
-    ++ lib.optional withHyperscan hyperscan
     ++ lib.optionals withBlas [
       blas
       lapack
@@ -73,23 +72,21 @@ stdenv.mkDerivation rec {
     ++ lib.optional withLuaJIT luajit
     ++ lib.optional (!withLuaJIT) lua;
 
-  cmakeFlags =
-    [
-      # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
-      "-DENABLE_PCRE2=OFF"
-      "-DDEBIAN_BUILD=ON"
-      "-DRUNDIR=/run/rspamd"
-      "-DDBDIR=/var/lib/rspamd"
-      "-DLOGDIR=/var/log/rspamd"
-      "-DLOCAL_CONFDIR=/etc/rspamd"
-      "-DENABLE_JEMALLOC=ON"
-      "-DSYSTEM_DOCTEST=ON"
-      "-DSYSTEM_FMT=ON"
-      "-DSYSTEM_XXHASH=ON"
-      "-DSYSTEM_ZSTD=ON"
-    ]
-    ++ lib.optional withHyperscan "-DENABLE_HYPERSCAN=ON"
-    ++ lib.optional (!withLuaJIT) "-DENABLE_LUAJIT=OFF";
+  cmakeFlags = [
+    # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
+    "-DENABLE_PCRE2=OFF"
+    "-DDEBIAN_BUILD=ON"
+    "-DRUNDIR=/run/rspamd"
+    "-DDBDIR=/var/lib/rspamd"
+    "-DLOGDIR=/var/log/rspamd"
+    "-DLOCAL_CONFDIR=/etc/rspamd"
+    "-DENABLE_JEMALLOC=ON"
+    "-DSYSTEM_DOCTEST=ON"
+    "-DSYSTEM_FMT=ON"
+    "-DSYSTEM_XXHASH=ON"
+    "-DSYSTEM_ZSTD=ON"
+    "-DENABLE_HYPERSCAN=ON"
+  ] ++ lib.optional (!withLuaJIT) "-DENABLE_LUAJIT=OFF";
 
   passthru.tests.rspamd = nixosTests.rspamd;
 
diff --git a/pkgs/by-name/si/singular/package.nix b/pkgs/by-name/si/singular/package.nix
index 47e6c2445191..40fa34b87761 100644
--- a/pkgs/by-name/si/singular/package.nix
+++ b/pkgs/by-name/si/singular/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   gmp,
   bison,
   perl,
@@ -48,6 +49,15 @@ stdenv.mkDerivation rec {
     forceFetchGit = true;
   };
 
+  patches = [
+    (fetchpatch {
+      # removes dead code with invalid member reference in gfanlib
+      name = "clang-19.patch";
+      url = "https://github.com/Singular/Singular/commit/d3f73432d73ac0dd041af83cb35301498e9b57d9.patch";
+      hash = "sha256-1KOk+yrTvHWY4aSK9QcByHIwKwe71QIYTMx8zo7XNos=";
+    })
+  ];
+
   configureFlags =
     [
       "--enable-gfanlib"
@@ -173,6 +183,7 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "CAS for polynomial computations";
diff --git a/pkgs/by-name/so/sound-of-sorting/package.nix b/pkgs/by-name/so/sound-of-sorting/package.nix
index a95365171787..735416282a9d 100644
--- a/pkgs/by-name/so/sound-of-sorting/package.nix
+++ b/pkgs/by-name/so/sound-of-sorting/package.nix
@@ -2,10 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   pkg-config,
   SDL2,
   wxGTK32,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,18 +19,32 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-cBrTvFoz6WZIsh5qPPiWxQ338Z0OfcIefiI8CZF6nn8=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/freebsd/freebsd-ports/raw/31ec0266e31910c16b0f69e16a2a693aae20abdf/math/sound-of-sorting/files/patch-src_SortAlgo.cpp";
+      extraPrefix = "";
+      hash = "sha256-mOo3GsEZ8r8p9ROoel2TO9Z4yF5SmCN0/fUn/2qUKAo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/freebsd/freebsd-ports/raw/31ec0266e31910c16b0f69e16a2a693aae20abdf/math/sound-of-sorting/files/patch-src_SortAlgo.h";
+      extraPrefix = "";
+      hash = "sha256-NNSPs0gT6ndeMQWHLHAwLR5nMQGP880Qd6kulDYJYF0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/freebsd/freebsd-ports/raw/31ec0266e31910c16b0f69e16a2a693aae20abdf/math/sound-of-sorting/files/patch-src_SortArray.cpp";
+      extraPrefix = "";
+      hash = "sha256-WxqwcZ2L9HPG4QNf1Xi624aKTM3cRBWN+W00htcIJ5k=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
 
-  buildInputs =
-    [
-      wxGTK32
-      SDL2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = [
+    wxGTK32
+    SDL2
+  ];
 
   meta = {
     description = "Audibilization and Visualization of Sorting Algorithms";
diff --git a/pkgs/by-name/sp/spacevim/package.nix b/pkgs/by-name/sp/spacevim/package.nix
index 82268cc69616..104e30e50d1c 100644
--- a/pkgs/by-name/sp/spacevim/package.nix
+++ b/pkgs/by-name/sp/spacevim/package.nix
@@ -23,12 +23,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "spacevim";
-  version = "2.3.0";
+  version = "2.4.0";
   src = fetchFromGitHub {
     owner = "SpaceVim";
     repo = "SpaceVim";
     rev = "v${version}";
-    hash = "sha256-MHsAA0x/rfwRupe8aW1JVKGiYkySAX0AhOkBuScpn7I=";
+    hash = "sha256-qiNadhQJjU9RY14X8+pd4Ul+NLoNqbxuh3Kenw1dHDc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sp/spectra/package.nix b/pkgs/by-name/sp/spectra/package.nix
index 0cc351f13e2d..fc3a1512923e 100644
--- a/pkgs/by-name/sp/spectra/package.nix
+++ b/pkgs/by-name/sp/spectra/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spectra";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "yixuan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HaJmMo4jYmO/j53/nHrL3bvdQMAvp4Nuhhe8Yc7pL88=";
+    sha256 = "sha256-ut6nEOpzIoFy+IUWQy9x2pJ4+sA0d/Dt8WaNq5AFCFg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/us/usbkvm/package.nix b/pkgs/by-name/us/usbkvm/package.nix
index 4a24905574e6..19547c8fcacf 100644
--- a/pkgs/by-name/us/usbkvm/package.nix
+++ b/pkgs/by-name/us/usbkvm/package.nix
@@ -28,7 +28,7 @@ let
 
     inherit src;
     sourceRoot = "source/ms-tools";
-    vendorHash = "sha256-imHpsos7RDpATSZFWRxug67F7VgjRTT1SkLt7cWk6tU=";
+    vendorHash = null; # dependencies are vendored in the release tarball
 
     buildInputs = [
       hidapi
diff --git a/pkgs/by-name/ve/vectorscan/package.nix b/pkgs/by-name/ve/vectorscan/package.nix
index 860ea03f7a2d..206fb21b02eb 100644
--- a/pkgs/by-name/ve/vectorscan/package.nix
+++ b/pkgs/by-name/ve/vectorscan/package.nix
@@ -1,15 +1,16 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, ragel
-, util-linux
-, python3
-, boost
-, sqlite
-, pcre
-, enableShared ? !stdenv.hostPlatform.isStatic
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  ragel,
+  util-linux,
+  python3,
+  boost,
+  sqlite,
+  pcre,
+  enableShared ? !stdenv.hostPlatform.isStatic,
 }:
 
 stdenv.mkDerivation rec {
@@ -23,6 +24,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-wz2oIhau/vjnri3LOyPZSCFAWg694FTLVt7+SZYEsL4=";
   };
 
+  postPatch = ''
+    sed -i '/examples/d' CMakeLists.txt
+    substituteInPlace libhs.pc.in \
+      --replace-fail "libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@" "libdir=@CMAKE_INSTALL_LIBDIR@" \
+      --replace-fail "includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@" "includedir=@CMAKE_INSTALL_INCLUDEDIR@"
+    substituteInPlace cmake/build_wrapper.sh \
+      --replace-fail 'nm' '${stdenv.cc.targetPrefix}nm' \
+      --replace-fail 'objcopy' '${stdenv.cc.targetPrefix}objcopy'
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -45,18 +56,35 @@ stdenv.mkDerivation rec {
   #
   # For generic builds (e.g. x86_64) this can mean using an implementation not optimized for the
   # potentially available more modern hardware extensions (e.g. x86_64 with AVX512).
-  cmakeFlags = [ (if enableShared then "-DBUILD_SHARED_LIBS=ON" else "BUILD_STATIC_LIBS=ON") ]
-    ++
-    (if lib.elem stdenv.hostPlatform.system [ "x86_64-linux" "i686-linux" ] then
-      [ "-DBUILD_AVX2=ON" "-DBUILD_AVX512=ON" "-DBUILD_AVX512VBMI=ON" "-DFAT_RUNTIME=ON" ]
-    else
-      (if (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) then
-        [ "-DBUILD_SVE=ON" "-DBUILD_SVE2=ON" "-DBUILD_SVE2_BITPERM=ON" "-DFAT_RUNTIME=ON" ]
+  cmakeFlags =
+    [ (if enableShared then "-DBUILD_SHARED_LIBS=ON" else "BUILD_STATIC_LIBS=ON") ]
+    ++ (
+      if
+        lib.elem stdenv.hostPlatform.system [
+          "x86_64-linux"
+          "i686-linux"
+        ]
+      then
+        [
+          "-DBUILD_AVX2=ON"
+          "-DBUILD_AVX512=ON"
+          "-DBUILD_AVX512VBMI=ON"
+          "-DFAT_RUNTIME=ON"
+        ]
       else
-        [ "-DFAT_RUNTIME=OFF" ]
-          ++ lib.optional stdenv.hostPlatform.avx2Support "-DBUILD_AVX2=ON"
-          ++ lib.optional stdenv.hostPlatform.avx512Support "-DBUILD_AVX512=ON"
-      )
+        (
+          if (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) then
+            [
+              "-DBUILD_SVE=ON"
+              "-DBUILD_SVE2=ON"
+              "-DBUILD_SVE2_BITPERM=ON"
+              "-DFAT_RUNTIME=ON"
+            ]
+          else
+            [ "-DFAT_RUNTIME=OFF" ]
+            ++ lib.optional stdenv.hostPlatform.avx2Support "-DBUILD_AVX2=ON"
+            ++ lib.optional stdenv.hostPlatform.avx512Support "-DBUILD_AVX512=ON"
+        )
     );
 
   doCheck = true;
@@ -85,7 +113,14 @@ stdenv.mkDerivation rec {
     homepage = "https://www.vectorcamp.gr/vectorscan/";
     changelog = "https://github.com/VectorCamp/vectorscan/blob/${src.rev}/CHANGELOG-vectorscan.md";
     platforms = platforms.unix;
-    license = with licenses; [ bsd3 /* and */ bsd2 /* and */ licenses.boost ];
-    maintainers = with maintainers; [ tnias vlaci ];
+    license = with licenses; [
+      bsd3 # and
+      bsd2 # and
+      licenses.boost
+    ];
+    maintainers = with maintainers; [
+      tnias
+      vlaci
+    ];
   };
 }
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index d88527b138c2..f4d02c2c72aa 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -60,7 +60,7 @@
   libxml2,
   lz4,
   netcdf,
-  openexr,
+  openexr_3,
   openjpeg,
   openssl,
   pcre2,
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
       nonDarwinDeps = lib.optionals (!stdenv.hostPlatform.isDarwin) (
         [
           # tests for formats enabled by these packages fail on macos
-          openexr
+          openexr_3
           xercesc
         ]
         ++ arrowDeps
diff --git a/pkgs/development/libraries/itk/generic.nix b/pkgs/development/libraries/itk/generic.nix
index 7cb053603089..dbf4f35412bc 100644
--- a/pkgs/development/libraries/itk/generic.nix
+++ b/pkgs/development/libraries/itk/generic.nix
@@ -32,6 +32,7 @@
   zlib,
   Cocoa,
   enablePython ? false,
+  enableRtk ? true,
 }:
 
 let
@@ -116,6 +117,8 @@ stdenv.mkDerivation {
       "-DModule_MGHIO=ON"
       "-DModule_AdaptiveDenoising=ON"
       "-DModule_GenericLabelInterpolator=ON"
+    ]
+    ++ lib.optionals enableRtk [
       "-DModule_RTK=ON"
     ]
     ++ lib.optionals enablePython [
@@ -153,20 +156,23 @@ stdenv.mkDerivation {
   # These deps were propagated from VTK 9 in https://github.com/NixOS/nixpkgs/pull/206935,
   # so we simply propagate them again from ITK.
   # This admittedly is a hack and seems like an issue with VTK 9's CMake configuration.
-  propagatedBuildInputs = [
-    # The dependencies we've un-vendored from ITK, such as GDCM, must be propagated,
-    # otherwise other software built against ITK fails to configure since ITK headers
-    # refer to these previously vendored libraries:
-    expat
-    fftw
-    gdcm
-    hdf5-cpp
-    libjpeg
-    libminc
-    libpng
-    libtiff
-    zlib
-  ] ++ lib.optionals withVtk vtk.propagatedBuildInputs ++ lib.optionals enablePython [ numpy ];
+  propagatedBuildInputs =
+    [
+      # The dependencies we've un-vendored from ITK, such as GDCM, must be propagated,
+      # otherwise other software built against ITK fails to configure since ITK headers
+      # refer to these previously vendored libraries:
+      expat
+      fftw
+      gdcm
+      hdf5-cpp
+      libjpeg
+      libminc
+      libpng
+      libtiff
+      zlib
+    ]
+    ++ lib.optionals withVtk vtk.propagatedBuildInputs
+    ++ lib.optionals enablePython [ numpy ];
 
   postInstall = lib.optionalString enablePython ''
     substitute \
diff --git a/pkgs/development/libraries/physfs/default.nix b/pkgs/development/libraries/physfs/default.nix
index e00be9c841f9..efe5b4bc6a27 100644
--- a/pkgs/development/libraries/physfs/default.nix
+++ b/pkgs/development/libraries/physfs/default.nix
@@ -13,6 +13,10 @@ let
       inherit sha256;
     };
 
+    patches = [
+      ./dont-set-cmake-skip-rpath-${version}.patch
+    ];
+
     nativeBuildInputs = [ cmake doxygen ];
 
     buildInputs = [ zlib ]
diff --git a/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-2.1.1.patch b/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-2.1.1.patch
new file mode 100644
index 000000000000..fbd048499cf3
--- /dev/null
+++ b/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-2.1.1.patch
@@ -0,0 +1,16 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b4ef61e..7b2f26c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -29,11 +29,6 @@ if(APPLE)
+     set(PHYSFS_M_SRCS src/physfs_platform_apple.m)
+ endif()
+ 
+-if(CMAKE_COMPILER_IS_GNUCC)
+-    # Don't use -rpath.
+-    set(CMAKE_SKIP_RPATH ON CACHE BOOL "Skip RPATH" FORCE)
+-endif()
+-
+ if(CMAKE_C_COMPILER_ID STREQUAL "SunPro")
+     add_definitions(-erroff=E_EMPTY_TRANSLATION_UNIT)
+     add_definitions(-xldscope=hidden)
diff --git a/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-3.2.0.patch b/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-3.2.0.patch
new file mode 100644
index 000000000000..3811d1bd2e9d
--- /dev/null
+++ b/pkgs/development/libraries/physfs/dont-set-cmake-skip-rpath-3.2.0.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b3291cc..11e7ad1 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -32,8 +32,6 @@ endif()
+ 
+ if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+     add_compile_options(-Wall)
+-    # Don't use -rpath.
+-    set(CMAKE_SKIP_RPATH ON CACHE BOOL "Skip RPATH" FORCE)
+ endif()
+ 
+ if(CMAKE_C_COMPILER_ID STREQUAL "SunPro")
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK31.nix b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
index 1c72e919aed5..0f0595783c3d 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK31.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
@@ -23,14 +23,7 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_0,
   setfile,
-  AGL,
-  Carbon,
-  Cocoa,
-  Kernel,
-  QTKit,
-  AVFoundation,
-  AVKit,
-  WebKit,
+  libpng,
 }:
 
 stdenv.mkDerivation rec {
@@ -68,20 +61,11 @@ stdenv.mkDerivation rec {
     ++ lib.optional withCurl curl
     ++ lib.optional withMesa libGLU
     ++ lib.optional (withWebKit && !stdenv.hostPlatform.isDarwin) webkitgtk_4_0
-    ++ lib.optional (withWebKit && stdenv.hostPlatform.isDarwin) WebKit
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       setfile
-      Carbon
-      Cocoa
-      Kernel
-      QTKit
-      AVFoundation
-      AVKit
-      WebKit
+      libpng
     ];
 
-  propagatedBuildInputs = lib.optional stdenv.hostPlatform.isDarwin AGL;
-
   configureFlags =
     [
       "--disable-precomp-headers"
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK32.nix b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
index 84263f4c2f4e..bf53ecc7ad59 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@@ -25,14 +25,6 @@
 , withWebKit ? true
 , webkitgtk_4_0
 , setfile
-, AGL
-, Carbon
-, Cocoa
-, Kernel
-, QTKit
-, AVFoundation
-, AVKit
-, WebKit
 }:
 let
   catch = fetchFromGitHub {
@@ -81,21 +73,11 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optional withMesa libGLU
   ++ lib.optional (withWebKit && stdenv.hostPlatform.isLinux) webkitgtk_4_0
-  ++ lib.optional (withWebKit && stdenv.hostPlatform.isDarwin) WebKit
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     expat
     setfile
-    Carbon
-    Cocoa
-    Kernel
-    QTKit
-    AVFoundation
-    AVKit
-    WebKit
   ];
 
-  propagatedBuildInputs = lib.optional stdenv.hostPlatform.isDarwin AGL;
-
   configureFlags = [
     "--disable-precomp-headers"
     # This is the default option, but be explicit
diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index 5859e00c6cd8..149d30c1dda6 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -58,6 +58,7 @@ buildPythonPackage rec {
     funcparserlib
     pillow
     reportlab
+    setuptools
     webcolors
   ];
 
diff --git a/pkgs/development/python-modules/diagrams/build_poetry.patch b/pkgs/development/python-modules/diagrams/build_poetry.patch
deleted file mode 100644
index b2e3d39dae11..000000000000
--- a/pkgs/development/python-modules/diagrams/build_poetry.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 2c93a39..6c800e2 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -24,3 +24,7 @@ isort = "^4.3"
- 
- [tool.black]
- line-length = 120
-+
-+[build-system]
-+requires = ["poetry_core>=1.0.0"]
-+build-backend = "poetry.core.masonry.api"
diff --git a/pkgs/development/python-modules/diagrams/default.nix b/pkgs/development/python-modules/diagrams/default.nix
index 85eafa12893b..551430eebaa6 100644
--- a/pkgs/development/python-modules/diagrams/default.nix
+++ b/pkgs/development/python-modules/diagrams/default.nix
@@ -1,47 +1,52 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
+  fetchpatch,
+  graphviz,
+  imagemagick,
+  inkscape,
   jinja2,
   poetry-core,
-  round,
-  graphviz,
-  inkscape,
-  imagemagick,
   pytestCheckHook,
-  typed-ast,
+  pythonOlder,
+  round,
 }:
 
 buildPythonPackage rec {
   pname = "diagrams";
-  version = "0.23.4";
-  format = "pyproject";
+  version = "0.24.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "mingrammer";
-    repo = pname;
+    repo = "diagrams";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2jRWN2glGEr51fzny8nkqa5c2EdJG5aZPG2eTD7AISY=";
+    hash = "sha256-xdc8qHvLKy5QV/1c87o7H/VhitUhpH/+VgqBHn2a8lg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'graphviz = ">=0.13.2,<0.20.0"' 'graphviz = "*"'
-  '';
+  patches = [
+    # Add build-system, https://github.com/mingrammer/diagrams/pull/1089
+    (fetchpatch {
+      name = "add-build-system.patch";
+      url = "https://github.com/mingrammer/diagrams/commit/59b84698b142f5a0998ee9e395df717a1b77e9b2.patch";
+      hash = "sha256-/zV5X4qgHJs+KO9gHyu6LqQ3hB8Zx+BzOFo7K1vQK78=";
+    })
+    ./remove-black-requirement.patch
+  ];
+
+  pythonRemoveDeps = [ "pre-commit" ];
+
+  pythonRelaxDeps = [ "graphviz" ];
 
   preConfigure = ''
     patchShebangs autogen.sh
     ./autogen.sh
   '';
 
-  patches = [
-    # The build-system section is missing
-    ./build_poetry.patch
-    ./remove-black-requirement.patch
-  ];
+  build-system = [ poetry-core ];
 
   # Despite living in 'tool.poetry.dependencies',
   # these are only used at build time to process the image resource files
@@ -49,14 +54,10 @@ buildPythonPackage rec {
     inkscape
     imagemagick
     jinja2
-    poetry-core
     round
   ];
 
-  propagatedBuildInputs = [
-    graphviz
-    typed-ast
-  ];
+  dependencies = [ graphviz ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/flask-sockets/default.nix b/pkgs/development/python-modules/flask-sockets/default.nix
deleted file mode 100644
index 6879b64fdb75..000000000000
--- a/pkgs/development/python-modules/flask-sockets/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  flask,
-  gevent,
-  gevent-websocket,
-}:
-
-buildPythonPackage rec {
-  pname = "Flask-Sockets";
-  version = "0.2.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "072927da8edca0e81e024f5787e643c87d80b351b714de95d723becb30e0643b";
-  };
-
-  propagatedBuildInputs = [
-    flask
-    gevent
-    gevent-websocket
-  ];
-
-  # upstream doesn't have any tests, single file
-  doCheck = false;
-
-  pythonImportsCheck = [ "flask_sockets" ];
-
-  meta = with lib; {
-    description = "Elegant WebSockets for your Flask apps";
-    homepage = "https://github.com/heroku-python/flask-sockets";
-    license = licenses.mit;
-    maintainers = [ maintainers.prusnak ];
-  };
-}
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index b7b77f32137f..4813fd2f091e 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -70,7 +70,11 @@ buildPythonPackage rec {
       freezegun
       grpcio
       mock
+    ]
+    ++ lib.optionals (pythonOlder "3.13") [
       oauth2client
+    ]
+    ++ [
       pytest-asyncio
       pytest-localserver
       pytestCheckHook
diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
index 62ee94e72ba4..fe71e07bd36a 100644
--- a/pkgs/development/python-modules/slack-bolt/default.nix
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -21,7 +21,6 @@
   falcon,
   fastapi,
   flask,
-  flask-sockets,
   gunicorn,
   moto,
   pyramid,
@@ -73,7 +72,6 @@ buildPythonPackage rec {
       falcon
       fastapi
       flask
-      flask-sockets
       gunicorn
       moto
       pyramid
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index b1f155488f57..f116779a6a08 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -6,7 +6,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   flake8,
-  flask-sockets,
   moto,
   psutil,
   pytest-asyncio,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     flake8
-    flask-sockets
     moto
     psutil
     pytest-asyncio
diff --git a/pkgs/development/python-modules/strawberry-graphql/default.nix b/pkgs/development/python-modules/strawberry-graphql/default.nix
index 986b87ef7273..370d5ab068c3 100644
--- a/pkgs/development/python-modules/strawberry-graphql/default.nix
+++ b/pkgs/development/python-modules/strawberry-graphql/default.nix
@@ -147,6 +147,7 @@ buildPythonPackage rec {
     "tests/cli/"
     "tests/django/test_dataloaders.py"
     "tests/exceptions/"
+    "tests/experimental/pydantic/test_fields.py"
     "tests/http/"
     "tests/schema/extensions/"
     "tests/schema/test_dataloaders.py"
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 52f905878ae0..5f996b4d0a2e 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -7,59 +7,48 @@
   numpy,
   lightning-utilities,
   packaging,
-  pretty-errors,
 
   # buildInputs
   torch,
 
   # tests
-  cloudpickle,
-  psutil,
   pytestCheckHook,
   pytest-doctestplus,
   pytest-xdist,
   pytorch-lightning,
   scikit-image,
-  scikit-learn,
 
   # passthru
   torchmetrics,
 }:
 
-let
+buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.4.3";
-in
-buildPythonPackage {
-  inherit pname version;
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-527cHPFdFw/JajHe7Kkz7+zl4EfePaLx77I2OTjjxaA=";
+    tag = "v${version}";
+    hash = "sha256-itLFJB920hQGX2VLOLolHhmXFVHAOkfRRFtUGB9neKM=";
   };
 
   dependencies = [
     numpy
     lightning-utilities
     packaging
-    pretty-errors
   ];
 
   # Let the user bring their own instance
   buildInputs = [ torch ];
 
   nativeCheckInputs = [
-    cloudpickle
-    psutil
     pytestCheckHook
     pytest-doctestplus
     pytest-xdist
     pytorch-lightning
     scikit-image
-    scikit-learn
   ];
 
   # A cyclic dependency in: integrations/test_lightning.py
@@ -73,16 +62,20 @@ buildPythonPackage {
     dontInstall = true;
   });
 
-  disabledTests = [
-    # `IndexError: list index out of range`
-    "test_metric_lightning_log"
-  ];
-
   disabledTestPaths = [
     # These require too many "leftpad-level" dependencies
     # Also too cross-dependent
     "tests/unittests"
 
+    # AttributeError: partially initialized module 'pesq' has no attribute 'pesq' (most likely due to a circular import)
+    "examples/audio/pesq.py"
+
+    # Require internet access
+    "examples/text/bertscore.py"
+    "examples/image/clip_score.py"
+    "examples/text/perplexity.py"
+    "examples/text/rouge.py"
+
     # A trillion import path mismatch errors
     "src/torchmetrics"
   ];
diff --git a/pkgs/games/heroic/default.nix b/pkgs/games/heroic/default.nix
index d3a51d82cb6c..db33d8485684 100644
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@@ -5,6 +5,7 @@
   nix-update-script,
   pnpm,
   nodejs,
+  python3,
   makeWrapper,
   electron,
   vulkan-helper,
@@ -33,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpm.configHook
+    python3
     makeWrapper
   ];
 
@@ -41,21 +43,25 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-non-steam-shortcuts.patch
   ];
 
-  postPatch = ''
-    # We are not packaging this as an Electron application bundle, so Electron
-    # reports to the application that is is not "packaged", which causes Heroic
-    # to take some incorrect codepaths meant for development environments.
-    substituteInPlace src/**/*.ts --replace-quiet 'app.isPackaged' 'true'
-  '';
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   buildPhase = ''
     runHook preBuild
 
+    # set nodedir to prevent node-gyp from downloading headers
+    # taken from https://nixos.org/manual/nixpkgs/stable/#javascript-tool-specific
+    mkdir -p $HOME/.node-gyp/${nodejs.version}
+    echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
+    ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
+    export npm_config_nodedir=${nodejs}
+
     pnpm --offline electron-vite build
-    # Remove dev dependencies.
-    pnpm --ignore-scripts prune --prod
-    # Clean up broken symlinks left behind by `pnpm prune`
-    find node_modules/.bin -xtype l -delete
+    pnpm --offline electron-builder \
+      --linux \
+      --dir \
+      -c.asarUnpack="**/*.node" \
+      -c.electronDist=${electron.dist} \
+      -c.electronVersion=${electron.version}
 
     runHook postBuild
   '';
@@ -65,33 +71,32 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/{applications,heroic}
-    cp -r . $out/share/heroic
-    rm -rf $out/share/heroic/{.devcontainer,.vscode,.husky,.idea,.github}
+    mkdir -p "$out/opt/heroic"
+    cp -r dist/linux-unpacked/resources "$out/opt/heroic"
 
-    chmod -R u+w "$out/share/heroic/public/bin" "$out/share/heroic/build/bin"
-    rm -rf "$out/share/heroic/public/bin" "$out/share/heroic/build/bin"
-    mkdir -p "$out/share/heroic/build/bin/x64/linux"
+    cp -r public "$out/opt/heroic/resources/app.asar.unpacked/build"
+    rm -rf "$out/opt/heroic/resources/app.asar.unpacked/build/bin"
+    mkdir -p "$out/opt/heroic/resources/app.asar.unpacked/build/bin/x64/linux"
     ln -s \
       "${lib.getExe gogdl}" \
       "${lib.getExe legendary-gl}" \
       "${lib.getExe nile}" \
       "${lib.getExe comet-gog}" \
       "${lib.getExe vulkan-helper}" \
-      "$out/share/heroic/build/bin/x64/linux/"
+      "$out/opt/heroic/resources/app.asar.unpacked/build/bin/x64/linux"
 
     makeWrapper "${electron}/bin/electron" "$out/bin/heroic" \
       --inherit-argv0 \
+      --set ELECTRON_FORCE_IS_PACKAGED 1 \
       --add-flags --disable-gpu-compositing \
-      --add-flags $out/share/heroic \
+      --add-flags $out/opt/heroic/resources/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
 
-    substituteInPlace "$out/share/heroic/flatpak/com.heroicgameslauncher.hgl.desktop" \
+    install -D "flatpak/com.heroicgameslauncher.hgl.desktop" "$out/share/applications/com.heroicgameslauncher.hgl.desktop"
+    install -D "src/frontend/assets/heroic-icon.svg" "$out/share/icons/hicolor/scalable/apps/com.heroicgameslauncher.hgl.svg"
+    substituteInPlace "$out/share/applications/com.heroicgameslauncher.hgl.desktop" \
       --replace-fail "StartupWMClass=Heroic" "StartupWMClass=heroic" \
       --replace-fail "Exec=heroic-run" "Exec=heroic"
-    mkdir -p "$out/share/applications" "$out/share/icons/hicolor/scalable/apps"
-    ln -s "$out/share/heroic/flatpak/com.heroicgameslauncher.hgl.desktop" "$out/share/applications"
-    ln -s "$out/share/heroic/src/frontend/assets/heroic-icon.svg" "$out/share/icons/hicolor/scalable/apps/com.heroicgameslauncher.hgl.svg"
 
     runHook postInstall
   '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4ed3cf54d85b..faf644bc957b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5907,6 +5907,8 @@ with pkgs;
 
   devpi-server = python3Packages.callPackage ../development/tools/devpi-server { };
 
+  dprint-plugins = recurseIntoAttrs (callPackage ../by-name/dp/dprint/plugins { });
+
   elm2nix = haskell.lib.compose.justStaticExecutables haskellPackages.elm2nix;
 
   elmPackages = recurseIntoAttrs (callPackage ../development/compilers/elm { });
@@ -9491,6 +9493,7 @@ with pkgs;
 
   itk_5_2 = callPackage ../development/libraries/itk/5.2.x.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
+    enableRtk = false;
   };
 
   itk_5 = callPackage ../development/libraries/itk/5.x.nix {
@@ -10965,12 +10968,10 @@ with pkgs;
 
   wxGTK31 = callPackage ../development/libraries/wxwidgets/wxGTK31.nix {
     inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
   };
 
   wxGTK32 = callPackage ../development/libraries/wxwidgets/wxGTK32.nix {
     inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
   };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index ab8695d46c7f..55606e35f24f 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -224,6 +224,7 @@ mapAliases ({
   flask-autoindex = throw "flask-autoindex was removed, as it is not compatible with flask 3.0 and unmaintained since 2020.";
   flask-basicauth = throw "flask-basicauth was removed, as it is not compatible with flask 3.0 and unmaintained since 2016.";
   flask-sessionstore = throw "flask-sessionstore was removed, as it is not compatible with flask 3.0 and unmaintained since 2017.";
+  flask-sockets = throw "flask-sockets has been removed as the upstream repository was archived in 2022"; # Added 2025-01-01
   flowlogs_reader = flowlogs-reader; # added 2024-01-03
   flufl_bounce = flufl-bounce; # added 2023-11-03
   flufl_i18n = flufl-i18n; # added 2023-11-03
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 15475d6aae87..45956091b4aa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4734,8 +4734,6 @@ self: super: with self; {
 
   flask-socketio = callPackage ../development/python-modules/flask-socketio { };
 
-  flask-sockets = callPackage ../development/python-modules/flask-sockets { };
-
   flask-sqlalchemy = callPackage ../development/python-modules/flask-sqlalchemy { };
 
   flask-sqlalchemy-lite = callPackage ../development/python-modules/flask-sqlalchemy-lite { };
@@ -6491,6 +6489,7 @@ self: super: with self; {
   itk = toPythonModule (pkgs.itk.override {
     inherit python numpy;
     enablePython = true;
+    enableRtk = false;
   });