diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index d83c15c511fa..30712735d237 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -1,6 +1,7 @@
 { # The pkgs used for dependencies for the testing itself
   # Don't test properties of pkgs.lib, but rather the lib in the parent directory
-  pkgs ? import ../.. {} // { lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!"; },
+  system ? builtins.currentSystem,
+  pkgs ? import ../.. { inherit system; } // { lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!"; },
   # For testing someone may edit impure.nix to return cross pkgs, use `pkgsBuildBuild` directly so everything here works.
   pkgsBB ? pkgs.pkgsBuildBuild,
   nix ? pkgs-nixVersions.stable,
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 23b0e5213116..824387d1b9ca 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19566,6 +19566,12 @@
     githubId = 61306;
     name = "Rene Treffer";
   };
+  RTUnreal = {
+    email = "unreal+nixpkgs@rtinf.net";
+    github = "RTUnreal";
+    githubId = 22859658;
+    name = "RTUnreal";
+  };
   rubenhoenle = {
     email = "git@hoenle.xyz";
     github = "rubenhoenle";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 4e9835555103..b35dc0289e5d 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -177,6 +177,9 @@
   | virtualBoxOVA            | virtualbox-vagrant.box                                     | nixos-image-vagrant-virtualbox-25.05pre-git-x86_64-linux.ova    |
   | vmwareImage              | nixos-25.05pre-git-x86_64-linux.vmdk                       | nixos-image-vmware-25.05pre-git-x86_64-linux.vmdk               |
 
+- `security.apparmor.policies.<name>.enforce` and `security.apparmor.policies.<name>.enable` were removed.
+  Configuring the state of apparmor policies must now be done using `security.apparmor.policies.<name>.state` tristate option.
+
 - the notmuch vim plugin now lives in a separate output of the `notmuch`
   package. Installing `notmuch` will not bring the notmuch vim package anymore,
   add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index e463e48f675e..a4c2f9e29fc3 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -1,20 +1,34 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  inherit (builtins) attrNames head map match readFile;
   inherit (lib) types;
   inherit (config.environment) etc;
   cfg = config.security.apparmor;
-  mkDisableOption = name: lib.mkEnableOption name // {
-    default = true;
-    example = false;
-  };
-  enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;
+  enabledPolicies = lib.filterAttrs (n: p: p.state != "disable") cfg.policies;
+  buildPolicyPath = n: p: lib.defaultTo (pkgs.writeText n p.profile) p.path;
+
+  # Accessing submodule options when not defined results in an error thunk rather than a regular option object
+  # We can emulate the behavior of `<option>.isDefined` by attempting to evaluate it instead
+  # This is required because getting isDefined on a submodule is not possible in global module asserts.
+  submoduleOptionIsDefined = value: (builtins.tryEval value).success;
 in
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+    (lib.mkRemovedOptionModule [
+      "security"
+      "apparmor"
+      "confineSUIDApplications"
+    ] "Please use the new options: `security.apparmor.policies.<policy>.state'.")
+    (lib.mkRemovedOptionModule [
+      "security"
+      "apparmor"
+      "profiles"
+    ] "Please use the new option: `security.apparmor.policies'.")
     apparmor/includes.nix
     apparmor/profiles.nix
   ];
@@ -42,22 +56,39 @@ in
         description = ''
           AppArmor policies.
         '';
-        type = types.attrsOf (types.submodule ({ name, config, ... }: {
-          options = {
-            enable = mkDisableOption "loading of the profile into the kernel";
-            enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
-            profile = lib.mkOption {
-              description = "The policy of the profile.";
-              type = types.lines;
-              apply = pkgs.writeText name;
+        type = types.attrsOf (
+          types.submodule {
+            options = {
+              state = lib.mkOption {
+                description = "How strictly this policy should be enforced";
+                type = types.enum [
+                  "disable"
+                  "complain"
+                  "enforce"
+                ];
+                # should enforce really be the default?
+                # the docs state that this should only be used once one is REALLY sure nothing's gonna break
+                default = "enforce";
+              };
+
+              profile = lib.mkOption {
+                description = "The profile file contents. Incompatible with path.";
+                type = types.lines;
+              };
+
+              path = lib.mkOption {
+                description = "A path of a profile file to include. Incompatible with profile.";
+                type = types.nullOr types.path;
+                default = null;
+              };
             };
-          };
-        }));
-        default = {};
+          }
+        );
+        default = { };
       };
       includes = lib.mkOption {
         type = types.attrsOf types.lines;
-        default = {};
+        default = { };
         description = ''
           List of paths to be added to AppArmor's searched paths
           when resolving `include` directives.
@@ -66,7 +97,7 @@ in
       };
       packages = lib.mkOption {
         type = types.listOf types.package;
-        default = [];
+        default = [ ];
         description = "List of packages to be added to AppArmor's include path";
       };
       enableCache = lib.mkEnableOption ''
@@ -90,13 +121,20 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = map (policy:
-      { assertion = match ".*/.*" policy == null;
-        message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
-        # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
-        # which does not recurse into sub-directories.
-      }
-    ) (attrNames cfg.policies);
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (policyName: policyCfg: [
+        {
+          assertion = builtins.match ".*/.*" policyName == null;
+          message = "`security.apparmor.policies.\"${policyName}\"' must not contain a slash.";
+          # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
+          # which does not recurse into sub-directories.
+        }
+        {
+          assertion = lib.xor (policyCfg.path != null) (submoduleOptionIsDefined policyCfg.profile);
+          message = "`security.apparmor.policies.\"${policyName}\"` must define exactly one of either path or profile.";
+        }
+      ]) cfg.policies
+    );
 
     environment.systemPackages = [
       pkgs.apparmor-utils
@@ -105,67 +143,81 @@ in
     environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
       # It's important to put only enabledPolicies here and not all cfg.policies
       # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
-      lib.mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
-      lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+      lib.mapAttrsToList (name: p: {
+        inherit name;
+        path = buildPolicyPath name p;
+      }) enabledPolicies
+      ++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
     );
-    environment.etc."apparmor/parser.conf".text = ''
+    environment.etc."apparmor/parser.conf".text =
+      ''
         ${if cfg.enableCache then "write-cache" else "skip-cache"}
         cache-loc /var/cache/apparmor
         Include /etc/apparmor.d
-      '' +
-      lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+      ''
+      + lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
     # For aa-logprof
-    environment.etc."apparmor/apparmor.conf".text = ''
-    '';
+    environment.etc."apparmor/apparmor.conf".text = '''';
     # For aa-logprof
     environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
-    environment.etc."apparmor/logprof.conf".source = pkgs.runCommand "logprof.conf" {
-      header = ''
-        [settings]
-          # /etc/apparmor.d/ is read-only on NixOS
-          profiledir = /var/cache/apparmor/logprof
-          inactive_profiledir = /etc/apparmor.d/disable
-          # Use: journalctl -b --since today --grep audit: | aa-logprof
-          logfiles = /dev/stdin
+    environment.etc."apparmor/logprof.conf".source =
+      pkgs.runCommand "logprof.conf"
+        {
+          header = ''
+            [settings]
+              # /etc/apparmor.d/ is read-only on NixOS
+              profiledir = /var/cache/apparmor/logprof
+              inactive_profiledir = /etc/apparmor.d/disable
+              # Use: journalctl -b --since today --grep audit: | aa-logprof
+              logfiles = /dev/stdin
 
-          parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
-          ldd = ${pkgs.glibc.bin}/bin/ldd
-          logger = ${pkgs.util-linux}/bin/logger
+              parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
+              ldd = ${pkgs.glibc.bin}/bin/ldd
+              logger = ${pkgs.util-linux}/bin/logger
 
-          # customize how file ownership permissions are presented
-          # 0 - off
-          # 1 - default of what ever mode the log reported
-          # 2 - force the new permissions to be user
-          # 3 - force all perms on the rule to be user
-          default_owner_prompt = 1
+              # customize how file ownership permissions are presented
+              # 0 - off
+              # 1 - default of what ever mode the log reported
+              # 2 - force the new permissions to be user
+              # 3 - force all perms on the rule to be user
+              default_owner_prompt = 1
 
-          custom_includes = /etc/apparmor.d ${lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
+              custom_includes = /etc/apparmor.d ${
+                lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages
+              }
 
-        [qualifiers]
-          ${pkgs.runtimeShell} = icnu
-          ${pkgs.bashInteractive}/bin/sh = icnu
-          ${pkgs.bashInteractive}/bin/bash = icnu
-          ${config.users.defaultUserShell} = icnu
-      '';
-      footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
-      passAsFile = [ "header" ];
-    } ''
-      cp $headerPath $out
-      sed '1,/\[qualifiers\]/d' $footer >> $out
-    '';
+            [qualifiers]
+              ${pkgs.runtimeShell} = icnu
+              ${pkgs.bashInteractive}/bin/sh = icnu
+              ${pkgs.bashInteractive}/bin/bash = icnu
+              ${config.users.defaultUserShell} = icnu
+          '';
+          footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
+          passAsFile = [ "header" ];
+        }
+        ''
+          cp $headerPath $out
+          sed '1,/\[qualifiers\]/d' $footer >> $out
+        '';
 
-    boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+    boot.kernelParams = [
+      "apparmor=1"
+      "security=apparmor"
+    ];
 
     systemd.services.apparmor = {
       after = [
         "local-fs.target"
         "systemd-journald-audit.socket"
       ];
-      before = [ "sysinit.target" "shutdown.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
       conflicts = [ "shutdown.target" ];
       wantedBy = [ "multi-user.target" ];
       unitConfig = {
-        Description="Load AppArmor policies";
+        Description = "Load AppArmor policies";
         DefaultDependencies = "no";
         ConditionSecurity = "apparmor";
       };
@@ -176,39 +228,57 @@ in
         etc."apparmor/parser.conf".source
         etc."apparmor.d".source
       ];
-      serviceConfig = let
-        killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
-          set -eu
-          ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
-          ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
-          xargs --verbose --no-run-if-empty --delimiter='\n' \
-          kill
-        '';
-        commonOpts = p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
-        in {
-        Type = "oneshot";
-        RemainAfterExit = "yes";
-        ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        ExecStart = lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
-        ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-        ExecReload =
-          # Add or replace into the kernel profiles in enabledPolicies
-          # (because AppArmor can do that without stopping the processes already confined).
-          lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
-          # Remove from the kernel any profile whose name is not
-          # one of the names within the content of the profiles in enabledPolicies
-          # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
-          # Note that this does not remove profiles dynamically generated by libvirt.
-          [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
-          # Optionally kill the processes which are unconfined but now have a profile loaded
-          # (because AppArmor can only start to confine new processes).
-          lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-        ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        CacheDirectory = [ "apparmor" "apparmor/logprof" ];
-        CacheDirectoryMode = "0700";
-      };
+      serviceConfig =
+        let
+          killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
+            set -eu
+            ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
+            ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
+            xargs --verbose --no-run-if-empty --delimiter='\n' \
+            kill
+          '';
+          commonOpts =
+            n: p:
+            "--verbose --show-cache ${
+              lib.optionalString (p.state == "complain") "--complain "
+            }${buildPolicyPath n p}";
+        in
+        {
+          Type = "oneshot";
+          RemainAfterExit = "yes";
+          ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStart = lib.mapAttrsToList (
+            n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
+          ) enabledPolicies;
+          ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+          ExecReload =
+            # Add or replace into the kernel profiles in enabledPolicies
+            # (because AppArmor can do that without stopping the processes already confined).
+            lib.mapAttrsToList (
+              n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts n p}"
+            ) enabledPolicies
+            ++
+              # Remove from the kernel any profile whose name is not
+              # one of the names within the content of the profiles in enabledPolicies
+              # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
+              # Note that this does not remove profiles dynamically generated by libvirt.
+              [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ]
+            ++
+              # Optionally kill the processes which are unconfined but now have a profile loaded
+              # (because AppArmor can only start to confine new processes).
+              lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+          ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          CacheDirectory = [
+            "apparmor"
+            "apparmor/logprof"
+          ];
+          CacheDirectoryMode = "0700";
+        };
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
+  meta.maintainers = with lib.maintainers; [
+    julm
+    grimmauld
+  ];
 }
diff --git a/nixos/modules/services/cluster/hadoop/yarn.nix b/nixos/modules/services/cluster/hadoop/yarn.nix
index 7c0bc8e972d9..b21a4ca5c277 100644
--- a/nixos/modules/services/cluster/hadoop/yarn.nix
+++ b/nixos/modules/services/cluster/hadoop/yarn.nix
@@ -188,22 +188,30 @@ in
 
       services.hadoop.yarnSiteInternal =
         with cfg.yarn.nodemanager;
-        mkMerge [
+        lib.mkMerge [
           ({
-            "yarn.nodemanager.local-dirs" = mkIf (localDir != null) (concatStringsSep "," localDir);
+            "yarn.nodemanager.local-dirs" = lib.mkIf (localDir != null) (concatStringsSep "," localDir);
             "yarn.scheduler.maximum-allocation-vcores" = resource.maximumAllocationVCores;
             "yarn.scheduler.maximum-allocation-mb" = resource.maximumAllocationMB;
             "yarn.nodemanager.resource.cpu-vcores" = resource.cpuVCores;
             "yarn.nodemanager.resource.memory-mb" = resource.memoryMB;
           })
-          (mkIf useCGroups {
-            "yarn.nodemanager.linux-container-executor.cgroups.hierarchy" = "/hadoop-yarn";
-            "yarn.nodemanager.linux-container-executor.resources-handler.class" =
-              "org.apache.hadoop.yarn.server.nodemanager.util.CgroupsLCEResourcesHandler";
-            "yarn.nodemanager.linux-container-executor.cgroups.mount" = "true";
-            "yarn.nodemanager.linux-container-executor.cgroups.mount-path" =
-              "/run/wrappers/yarn-nodemanager/cgroup";
-          })
+          (lib.mkIf useCGroups (
+            lib.warnIf (lib.versionOlder cfg.package.version "3.5.0")
+              ''
+                hadoop < 3.5.0 does not support cgroup v2
+                setting `services.hadoop.yarn.nodemanager.useCGroups = false` is recommended
+                see: https://issues.apache.org/jira/browse/YARN-11669
+              ''
+              {
+                "yarn.nodemanager.linux-container-executor.cgroups.hierarchy" = "/hadoop-yarn";
+                "yarn.nodemanager.linux-container-executor.resources-handler.class" =
+                  "org.apache.hadoop.yarn.server.nodemanager.util.CgroupsLCEResourcesHandler";
+                "yarn.nodemanager.linux-container-executor.cgroups.mount" = "true";
+                "yarn.nodemanager.linux-container-executor.cgroups.mount-path" =
+                  "/run/wrappers/yarn-nodemanager/cgroup";
+              }
+          ))
         ];
 
       networking.firewall.allowedTCPPortRanges = [
diff --git a/nixos/modules/services/mail/mailhog.nix b/nixos/modules/services/mail/mailhog.nix
index 93400167a209..0ec289298f38 100644
--- a/nixos/modules/services/mail/mailhog.nix
+++ b/nixos/modules/services/mail/mailhog.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.mailhog;
 
@@ -8,17 +13,24 @@ let
       "-smtp-bind-addr :${toString cfg.smtpPort}"
       "-ui-bind-addr :${toString cfg.uiPort}"
       "-storage ${cfg.storage}"
-    ] ++ lib.optional (cfg.storage == "maildir")
-      "-maildir-path $STATE_DIRECTORY"
+    ]
+    ++ lib.optional (cfg.storage == "maildir") "-maildir-path $STATE_DIRECTORY"
     ++ cfg.extraArgs
   );
 
+  mhsendmail = pkgs.writeShellScriptBin "mailhog-sendmail" ''
+    exec ${lib.getExe pkgs.mailhog} sendmail $@
+  '';
 in
 {
   ###### interface
 
   imports = [
-    (lib.mkRemovedOptionModule [ "services" "mailhog" "user" ] "")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mailhog"
+      "user"
+    ] "")
   ];
 
   options = {
@@ -26,8 +38,15 @@ in
     services.mailhog = {
       enable = lib.mkEnableOption "MailHog, web and API based SMTP testing";
 
+      setSendmail = lib.mkEnableOption "set the system sendmail to mailhogs's" // {
+        default = true;
+      };
+
       storage = lib.mkOption {
-        type = lib.types.enum [ "maildir" "memory" ];
+        type = lib.types.enum [
+          "maildir"
+          "memory"
+        ];
         default = "memory";
         description = "Store mails on disk or in memory.";
       };
@@ -52,13 +71,12 @@ in
 
       extraArgs = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        default = [];
+        default = [ ];
         description = "List of additional arguments to pass to the MailHog process.";
       };
     };
   };
 
-
   ###### implementation
 
   config = lib.mkIf cfg.enable {
@@ -69,11 +87,21 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "exec";
-        ExecStart = "${pkgs.mailhog}/bin/MailHog ${args}";
+        ExecStart = "${lib.getExe pkgs.mailhog} ${args}";
         DynamicUser = true;
         Restart = "on-failure";
         StateDirectory = "mailhog";
       };
     };
+
+    services.mail.sendmailSetuidWrapper = lib.mkIf cfg.setSendmail {
+      program = "sendmail";
+      source = lib.getExe mhsendmail;
+      # Communication happens through the network, no data is written to disk
+      owner = "nobody";
+      group = "nogroup";
+    };
   };
+
+  meta.maintainers = with lib.maintainers; [RTUnreal];
 }
diff --git a/nixos/modules/services/web-apps/gancio.nix b/nixos/modules/services/web-apps/gancio.nix
index fa55db762c46..997384521e8a 100644
--- a/nixos/modules/services/web-apps/gancio.nix
+++ b/nixos/modules/services/web-apps/gancio.nix
@@ -282,6 +282,8 @@ in
       ];
     };
     # for nginx to access gancio socket
-    users.users."${config.services.nginx.user}".extraGroups = [ config.users.users.${cfg.user}.group ];
+    users.users."${config.services.nginx.user}" = lib.mkIf (config.services.nginx.enable) {
+      extraGroups = [ config.users.users.${cfg.user}.group ];
+    };
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index db89304691f8..8d3727289989 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -131,7 +131,7 @@ in {
   apfs = runTest ./apfs.nix;
   appliance-repart-image = runTest ./appliance-repart-image.nix;
   appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
-  apparmor = handleTest ./apparmor.nix {};
+  apparmor = handleTest ./apparmor {};
   archi = handleTest ./archi.nix {};
   aria2 = handleTest ./aria2.nix {};
   armagetronad = handleTest ./armagetronad.nix {};
diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
deleted file mode 100644
index f75c0c72718d..000000000000
--- a/nixos/tests/apparmor.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ... } : {
-  name = "apparmor";
-  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
-
-  nodes.machine =
-    { lib, pkgs, config, ... }:
-    {
-      security.apparmor.enable = lib.mkDefault true;
-    };
-
-  testScript =
-    ''
-      machine.wait_for_unit("multi-user.target")
-
-      with subtest("AppArmor profiles are loaded"):
-          machine.succeed("systemctl status apparmor.service")
-
-      # AppArmor securityfs
-      with subtest("AppArmor securityfs is mounted"):
-          machine.succeed("mountpoint -q /sys/kernel/security")
-          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
-
-      # Test apparmorRulesFromClosure by:
-      # 1. Prepending a string of the relevant packages' name and version on each line.
-      # 2. Sorting according to those strings.
-      # 3. Removing those prepended strings.
-      # 4. Using `diff` against the expected output.
-      with subtest("apparmorRulesFromClosure"):
-          machine.succeed(
-              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
-                  mr ${pkgs.bash}/lib/**.so*,
-                  r ${pkgs.bash},
-                  r ${pkgs.bash}/etc/**,
-                  r ${pkgs.bash}/lib/**,
-                  r ${pkgs.bash}/share/**,
-                  x ${pkgs.bash}/foo/**,
-                  mr ${pkgs.glibc}/lib/**.so*,
-                  r ${pkgs.glibc},
-                  r ${pkgs.glibc}/etc/**,
-                  r ${pkgs.glibc}/lib/**,
-                  r ${pkgs.glibc}/share/**,
-                  x ${pkgs.glibc}/foo/**,
-                  mr ${pkgs.libcap}/lib/**.so*,
-                  r ${pkgs.libcap},
-                  r ${pkgs.libcap}/etc/**,
-                  r ${pkgs.libcap}/lib/**,
-                  r ${pkgs.libcap}/share/**,
-                  x ${pkgs.libcap}/foo/**,
-                  mr ${pkgs.libcap.lib}/lib/**.so*,
-                  r ${pkgs.libcap.lib},
-                  r ${pkgs.libcap.lib}/etc/**,
-                  r ${pkgs.libcap.lib}/lib/**,
-                  r ${pkgs.libcap.lib}/share/**,
-                  x ${pkgs.libcap.lib}/foo/**,
-                  mr ${pkgs.libidn2.out}/lib/**.so*,
-                  r ${pkgs.libidn2.out},
-                  r ${pkgs.libidn2.out}/etc/**,
-                  r ${pkgs.libidn2.out}/lib/**,
-                  r ${pkgs.libidn2.out}/share/**,
-                  x ${pkgs.libidn2.out}/foo/**,
-                  mr ${pkgs.libunistring}/lib/**.so*,
-                  r ${pkgs.libunistring},
-                  r ${pkgs.libunistring}/etc/**,
-                  r ${pkgs.libunistring}/lib/**,
-                  r ${pkgs.libunistring}/share/**,
-                  x ${pkgs.libunistring}/foo/**,
-                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
-                  r ${pkgs.glibc.libgcc},
-                  r ${pkgs.glibc.libgcc}/etc/**,
-                  r ${pkgs.glibc.libgcc}/lib/**,
-                  r ${pkgs.glibc.libgcc}/share/**,
-                  x ${pkgs.glibc.libgcc}/foo/**,
-              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
-                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
-                      pkgs.apparmorRulesFromClosure {
-                        name = "ping";
-                        additionalRules = ["x $path/foo/**"];
-                      } [ pkgs.libcap ]
-                  } |
-                  ${pkgs.coreutils}/bin/sort -n -k1 |
-                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
-              ''}"
-          )
-    '';
-})
diff --git a/nixos/tests/apparmor/default.nix b/nixos/tests/apparmor/default.nix
new file mode 100644
index 000000000000..c618cabf5184
--- /dev/null
+++ b/nixos/tests/apparmor/default.nix
@@ -0,0 +1,130 @@
+import ../make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+    helloProfileContents = ''
+      abi <abi/4.0>,
+      include <tunables/global>
+      profile hello ${lib.getExe pkgs.hello} {
+        include <abstractions/base>
+      }
+    '';
+  in
+  {
+    name = "apparmor";
+    meta.maintainers = with lib.maintainers; [
+      julm
+      grimmauld
+    ];
+
+    nodes.machine =
+      {
+        lib,
+        pkgs,
+        config,
+        ...
+      }:
+      {
+        security.apparmor = {
+          enable = lib.mkDefault true;
+
+          policies.hello = {
+            # test profile enforce and content definition
+            state = "enforce";
+            profile = helloProfileContents;
+          };
+
+          policies.sl = {
+            # test profile complain and path definition
+            state = "complain";
+            path = ./sl_profile;
+          };
+
+          policies.hexdump = {
+            # test profile complain and path definition
+            state = "enforce";
+            profile = ''
+              abi <abi/4.0>,
+              include <tunables/global>
+              profile hexdump /nix/store/*/bin/hexdump {
+                include <abstractions/base>
+                deny /tmp/** r,
+              }
+            '';
+          };
+
+          includes."abstractions/base" = ''
+            /nix/store/*/bin/** mr,
+            /nix/store/*/lib/** mr,
+            /nix/store/** r,
+          '';
+        };
+      };
+
+    testScript =
+      let
+        inherit (lib) getExe getExe';
+      in
+      ''
+        machine.wait_for_unit("multi-user.target")
+
+        with subtest("AppArmor profiles are loaded"):
+            machine.succeed("systemctl status apparmor.service")
+
+        # AppArmor securityfs
+        with subtest("AppArmor securityfs is mounted"):
+            machine.succeed("mountpoint -q /sys/kernel/security")
+            machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+
+        # Test apparmorRulesFromClosure by:
+        # 1. Prepending a string of the relevant packages' name and version on each line.
+        # 2. Sorting according to those strings.
+        # 3. Removing those prepended strings.
+        # 4. Using `diff` against the expected output.
+        with subtest("apparmorRulesFromClosure"):
+            machine.succeed(
+                "${getExe' pkgs.diffutils "diff"} -u ${
+                  pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
+                } ${
+                  pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                    ${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
+                      pkgs.apparmorRulesFromClosure {
+                        name = "ping";
+                        additionalRules = [ "x $path/foo/**" ];
+                      } [ pkgs.libcap ]
+                    } |
+                    ${getExe' pkgs.coreutils "sort"} -n -k1 |
+                    ${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
+                  ''
+                }"
+            )
+
+        # Test apparmor profile states by using `diff` against `aa-status`
+        with subtest("apparmorProfileStates"):
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
+              <(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
+              <(${getExe pkgs.jq} --sort-keys . ${
+                pkgs.writers.writeJSON "expectedStates.json" {
+                  version = "2";
+                  processes = { };
+                  profiles = {
+                    hexdump = "enforce";
+                    hello = "enforce";
+                    sl = "complain";
+                  };
+                }
+              })")
+
+        # Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
+        with subtest("apparmorProfileTargets"):
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
+              /etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
+            ''}")
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
+
+
+        with subtest("apparmorProfileEnforce"):
+            machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
+            machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
+      '';
+  }
+)
diff --git a/nixos/tests/apparmor/makeExpectedPolicies.nix b/nixos/tests/apparmor/makeExpectedPolicies.nix
new file mode 100644
index 000000000000..0d9238b68530
--- /dev/null
+++ b/nixos/tests/apparmor/makeExpectedPolicies.nix
@@ -0,0 +1,66 @@
+{ pkgs }:
+''
+  ixr ${pkgs.bash}/libexec/**,
+  mr ${pkgs.bash}/lib/**.so*,
+  mr ${pkgs.bash}/lib64/**.so*,
+  mr ${pkgs.bash}/share/**,
+  r ${pkgs.bash},
+  r ${pkgs.bash}/etc/**,
+  r ${pkgs.bash}/lib/**,
+  r ${pkgs.bash}/lib64/**,
+  x ${pkgs.bash}/foo/**,
+  ixr ${pkgs.glibc}/libexec/**,
+  mr ${pkgs.glibc}/lib/**.so*,
+  mr ${pkgs.glibc}/lib64/**.so*,
+  mr ${pkgs.glibc}/share/**,
+  r ${pkgs.glibc},
+  r ${pkgs.glibc}/etc/**,
+  r ${pkgs.glibc}/lib/**,
+  r ${pkgs.glibc}/lib64/**,
+  x ${pkgs.glibc}/foo/**,
+  ixr ${pkgs.libcap}/libexec/**,
+  mr ${pkgs.libcap}/lib/**.so*,
+  mr ${pkgs.libcap}/lib64/**.so*,
+  mr ${pkgs.libcap}/share/**,
+  r ${pkgs.libcap},
+  r ${pkgs.libcap}/etc/**,
+  r ${pkgs.libcap}/lib/**,
+  r ${pkgs.libcap}/lib64/**,
+  x ${pkgs.libcap}/foo/**,
+  ixr ${pkgs.libcap.lib}/libexec/**,
+  mr ${pkgs.libcap.lib}/lib/**.so*,
+  mr ${pkgs.libcap.lib}/lib64/**.so*,
+  mr ${pkgs.libcap.lib}/share/**,
+  r ${pkgs.libcap.lib},
+  r ${pkgs.libcap.lib}/etc/**,
+  r ${pkgs.libcap.lib}/lib/**,
+  r ${pkgs.libcap.lib}/lib64/**,
+  x ${pkgs.libcap.lib}/foo/**,
+  ixr ${pkgs.libidn2.out}/libexec/**,
+  mr ${pkgs.libidn2.out}/lib/**.so*,
+  mr ${pkgs.libidn2.out}/lib64/**.so*,
+  mr ${pkgs.libidn2.out}/share/**,
+  r ${pkgs.libidn2.out},
+  r ${pkgs.libidn2.out}/etc/**,
+  r ${pkgs.libidn2.out}/lib/**,
+  r ${pkgs.libidn2.out}/lib64/**,
+  x ${pkgs.libidn2.out}/foo/**,
+  ixr ${pkgs.libunistring}/libexec/**,
+  mr ${pkgs.libunistring}/lib/**.so*,
+  mr ${pkgs.libunistring}/lib64/**.so*,
+  mr ${pkgs.libunistring}/share/**,
+  r ${pkgs.libunistring},
+  r ${pkgs.libunistring}/etc/**,
+  r ${pkgs.libunistring}/lib/**,
+  r ${pkgs.libunistring}/lib64/**,
+  x ${pkgs.libunistring}/foo/**,
+  ixr ${pkgs.glibc.libgcc}/libexec/**,
+  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+  mr ${pkgs.glibc.libgcc}/lib64/**.so*,
+  mr ${pkgs.glibc.libgcc}/share/**,
+  r ${pkgs.glibc.libgcc},
+  r ${pkgs.glibc.libgcc}/etc/**,
+  r ${pkgs.glibc.libgcc}/lib/**,
+  r ${pkgs.glibc.libgcc}/lib64/**,
+  x ${pkgs.glibc.libgcc}/foo/**,
+''
diff --git a/nixos/tests/apparmor/sl_profile b/nixos/tests/apparmor/sl_profile
new file mode 100644
index 000000000000..f37c80f8e013
--- /dev/null
+++ b/nixos/tests/apparmor/sl_profile
@@ -0,0 +1,5 @@
+abi <abi/4.0>,
+include <tunables/global>
+profile sl /bin/sl {
+  include <abstractions/base>
+}
diff --git a/nixos/tests/hadoop/default.nix b/nixos/tests/hadoop/default.nix
index 479690adc064..aef5bd79e359 100644
--- a/nixos/tests/hadoop/default.nix
+++ b/nixos/tests/hadoop/default.nix
@@ -1,8 +1,16 @@
 { handleTestOn, package, ... }:
 
 {
-  all = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop.nix { inherit package; };
-  hdfs = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hdfs.nix { inherit package; };
-  yarn = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./yarn.nix { inherit package; };
-  hbase = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hbase.nix { inherit package; };
+  all = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop.nix {
+    inherit package;
+  };
+  hdfs = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hdfs.nix {
+    inherit package;
+  };
+  yarn = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./yarn.nix {
+    inherit package;
+  };
+  hbase = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hbase.nix {
+    inherit package;
+  };
 }
diff --git a/nixos/tests/hadoop/hadoop.nix b/nixos/tests/hadoop/hadoop.nix
index e4db1953d369..3f2b41bbd2c8 100644
--- a/nixos/tests/hadoop/hadoop.nix
+++ b/nixos/tests/hadoop/hadoop.nix
@@ -173,6 +173,7 @@ import ../make-test-python.nix (
               yarn.nodemanager = {
                 enable = true;
                 openFirewall = true;
+                useCGroups = false;
               };
             };
           };
diff --git a/nixos/tests/hadoop/hdfs.nix b/nixos/tests/hadoop/hdfs.nix
index 45206eefa6c2..31b02964b4c6 100644
--- a/nixos/tests/hadoop/hdfs.nix
+++ b/nixos/tests/hadoop/hdfs.nix
@@ -36,6 +36,7 @@ import ../make-test-python.nix (
         datanode =
           { pkgs, ... }:
           {
+            virtualisation.diskSize = 4096;
             services.hadoop = {
               inherit package;
               hdfs.datanode = {
diff --git a/nixos/tests/hadoop/yarn.nix b/nixos/tests/hadoop/yarn.nix
index c1a03e7ec7bd..3c3db2d52a95 100644
--- a/nixos/tests/hadoop/yarn.nix
+++ b/nixos/tests/hadoop/yarn.nix
@@ -24,6 +24,7 @@ import ../make-test-python.nix (
             yarn.nodemanager = {
               enable = true;
               openFirewall = true;
+              useCGroups = false;
             };
             yarnSite = {
               "yarn.resourcemanager.hostname" = "resourcemanager";
diff --git a/nixos/tests/mailhog.nix b/nixos/tests/mailhog.nix
index e3c2da37a3c8..7d9f4553f869 100644
--- a/nixos/tests/mailhog.nix
+++ b/nixos/tests/mailhog.nix
@@ -1,11 +1,9 @@
-import ./make-test-python.nix ({ lib, ... }: {
+import ./make-test-python.nix ({lib, ...}: {
   name = "mailhog";
-  meta.maintainers = with lib.maintainers; [ jojosch ];
+  meta.maintainers = with lib.maintainers; [jojosch RTUnreal];
 
-  nodes.machine = { pkgs, ... }: {
+  nodes.machine = {pkgs, ...}: {
     services.mailhog.enable = true;
-
-    environment.systemPackages = with pkgs; [ swaks ];
   };
 
   testScript = ''
@@ -14,11 +12,11 @@ import ./make-test-python.nix ({ lib, ... }: {
     machine.wait_for_unit("mailhog.service")
     machine.wait_for_open_port(1025)
     machine.wait_for_open_port(8025)
-    machine.succeed(
-        'echo "this is the body of the email" | swaks --to root@example.org --body - --server localhost:1025'
-    )
-    assert "this is the body of the email" in machine.succeed(
+    # Test sendmail wrapper (this uses smtp, which tests the connection)
+    machine.succeed('printf "To: root@example.com\r\n\r\nthis is the body of the email" | sendmail -t -i -f sender@example.com')
+    res = machine.succeed(
         "curl --fail http://localhost:8025/api/v2/messages"
     )
+    assert all(msg in res for msg in ["this is the body of the email", "sender@example.com", "root@example.com"])
   '';
 })
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3361026fb9e6..5983f2bc39c0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1618,8 +1618,8 @@ let
         mktplcRef = {
           name = "vscode-html-css";
           publisher = "ecmel";
-          version = "2.0.9";
-          sha256 = "7c30d57d2ff9986bd5daa2c9f51ec4bb04239ca23a51e971a63f7b93d005d297";
+          version = "2.0.11";
+          hash = "sha256-Cc22Dz29yKsD99A9o49anCDVvig+U9Xt/768pgzAr/4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ecmel.vscode-html-css/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
index 4d12862a0ef2..9d2dd8d9ba28 100644
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@@ -6,28 +6,28 @@
 }:
 
 let
-  version = "0.13.3";
+  version = "0.13.4";
 
   sources = {
     "x86_64-linux" = {
       arch = "linux-x64";
       url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-1BQLhhTKzpW5YT6qOLYBwn9VRpyPdWW92Wv2NirLMbw=";
+      hash = "sha256-q9ubYkhrV28sB9CV1dyBEIFEkTrkGHRXdz5+4xjeVzI=";
     };
     "x86_64-darwin" = {
       arch = "darwin-x64";
       url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-clhE8HTtqhRyFDckvFADh0OpYe2lm16eeM8rrA8R8bo=";
+      hash = "sha256-vV5u1QBICz3GIYRgH9UWM38a8YXtvW0u8r7c1SaKwxM=";
     };
     "aarch64-linux" = {
       arch = "linux-arm64";
       url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-L+uOZsm7XQhV32kXRmCWwkIa8KAAUHcgIHafnzk9UBw=";
+      hash = "sha256-fgT4brIhHI6gNCcsbHpz+v4/diyox2VoFlvCnhPIbPM=";
     };
     "aarch64-darwin" = {
       arch = "darwin-arm64";
       url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-nAusnaItiJmyQUsd1O755k3Bh5Ib7WL9TjNAJGylKmw=";
+      hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/hadoop/default.nix b/pkgs/applications/networking/cluster/hadoop/default.nix
index 1a9aa3667e45..47cd3764a77a 100644
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@@ -46,7 +46,9 @@ let
           "mirror://apache/hadoop/common/hadoop-${finalAttrs.version}/hadoop-${finalAttrs.version}"
           + lib.optionalString stdenv.hostPlatform.isAarch64 "-aarch64"
           + ".tar.gz";
-        inherit (platformAttrs.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}")) hash;
+        inherit (platformAttrs.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}"))
+          hash
+          ;
       };
       doCheck = true;
 
@@ -101,7 +103,12 @@ let
           # hadoop 3.3+ depends on protobuf 3.18, 3.2 depends on 3.8
           find $out/lib/native -name 'libhdfspp.so*' | \
             xargs -r -n1 patchelf --replace-needed libprotobuf.so.${
-              if (lib.versionAtLeast finalAttrs.version "3.3") then "18" else "8"
+              if (lib.versionAtLeast finalAttrs.version "3.4.1") then
+                "32"
+              else if (lib.versionAtLeast finalAttrs.version "3.3") then
+                "18"
+              else
+                "8"
             } libprotobuf.so
 
           patchelf --replace-needed libcrypto.so.1.1 libcrypto.so \
@@ -163,13 +170,15 @@ in
     pname = "hadoop";
     platformAttrs = rec {
       x86_64-linux = {
-        version = "3.4.0";
-        hash = "sha256-4xGnhIBBQDD57GNUml1oXmnibyBxA9mr8hpIud0DyGw=";
-        srcHash = "sha256-viDF3LdRCZHqFycOYfN7nUQBPHiMCIjmu7jgIAaaK9E=";
+        version = "3.4.1";
+        hash = "sha256-mtVIeDOZbf5VFOdW9DkQKckFKf0i6NAC/T3QwUwEukY=";
+        srcHash = "sha256-lE9uSohy6GWXprFEYbEin2ITqTms2h6EWXe4nEd3U4Y=";
       };
       x86_64-darwin = x86_64-linux;
       aarch64-linux = x86_64-linux // {
+        version = "3.4.0";
         hash = "sha256-QWxzKtNyw/AzcHMv0v7kj91pw1HO7VAN9MHO84caFk8=";
+        srcHash = "sha256-viDF3LdRCZHqFycOYfN7nUQBPHiMCIjmu7jgIAaaK9E=";
       };
       aarch64-darwin = aarch64-linux;
     };
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
index 47ef354df93e..bac6f9bd273f 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "0vyanank5iaflhxjiz7wqq52swfdf5i0ca40bigq8ynjh39l9rh9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0i62dg60090wmiqi2wzqa4jx45dag71y0936hhy00402wdcylmj7"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "1lsfnifh5krb7jc4jr7kfrj2a8snrv58c90qq72pkl4akdbg4l2r"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "0v9wazqiypzpxpc31vi0x3w1jwsny8xcnv67bcjwj5xlwpjlsjz9"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "03y6pnr3yxa60vnz1r3k51f9fr2vrb1jffkjla1p4j8w3bs5gaqq"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "07145gdpgqy49pvinnx0pal9mzsljysgd5zfq565fx5smfxzvbyn"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.10%2Bk3s1/k3s-images.txt",
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-images.txt",
     "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
index dca091384401..a194a72812d5 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.29.10+k3s1";
-  k3sCommit = "ae4df3117e4860c986f81361a8e5825e6418f9ee";
-  k3sRepoSha256 = "17c5y00y7f3zadpqkjpbw9ylscs7m7bqcym7y3ddgsm4cg6bz5g7";
-  k3sVendorHash = "sha256-X2Js9DxEmjCQc/w6M5+6NS9y3znutFmH7j95fDETqDI=";
+  k3sVersion = "1.29.11+k3s1";
+  k3sCommit = "666b590a7512c0baab01c93bf81222fa22565c45";
+  k3sRepoSha256 = "0w9lldvzkd3rrq0gypqnyjmjr73bxay44q2vfcj4my0ryc3bajf4";
+  k3sVendorHash = "sha256-FaOBeUONkeG2CfGUN4VRUzpQl0C6b06kKCnb6ICYHzo=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.14.0";
-  k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl";
-  k3sCNIVersion = "1.5.1-k3s1";
-  k3sCNISha256 = "1bkz78p77aiw64hdvmlgc5zir9x8zha8qprfaab48jxbcsj3dfi7";
-  containerdVersion = "1.7.22-k3s1";
-  containerdSha256 = "031rapiynpm7zlzn42l8z4m125lww2vyspw02irs4q3qb6mpx3px";
+  k3sRootVersion = "0.14.1";
+  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
+  k3sCNIVersion = "1.6.0-k3s1";
+  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  containerdVersion = "1.7.23-k3s2";
+  containerdSha256 = "0lp9vxq7xj74wa7hbivvl5hwg2wzqgsxav22wa0p1l7lc1dqw8dm";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 64f212addfc4..5ec0a653155d 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.30.3";
+  version = "2.31.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-L+RDO31LnQbWA22bkCrnU2QDF6+eCPwbPpzZxHGrZ1Q=";
+    hash = "sha256-l+xSd7eIpEy6A1mtx3WrcPQl7071IdJkbHKXbe4uFdA=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-IbDr2cTGmJZM8G2cj35CwfEX+DWVD0L4pUxHBvu9EfI=";
+  vendorHash = "sha256-nBexI2hr+lKPe4HCYiNVtmc0Rl5Hhj/+TwSftYWVdQw=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 37b8c342e51f..2e3f16108309 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -12,7 +12,7 @@ rec {
       # package dependencies
       , stdenv, fetchFromGitHub, fetchpatch, buildGoModule
       , makeWrapper, installShellFiles, pkg-config, glibc
-      , go-md2man, go, containerd, runc, tini, libtool
+      , go-md2man, go, containerd, runc, tini, libtool, bash
       , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom, docker-init
       , iptables, e2fsprogs, xz, util-linux, xfsprogs, gitMinimal
       , procps, rootlesskit, slirp4netns, fuse-overlayfs, nixosTests
@@ -45,6 +45,10 @@ rec {
         hash = runcHash;
       };
 
+      preBuild = ''
+        substituteInPlace Makefile --replace-warn "/bin/bash" "${lib.getExe bash}"
+      '';
+
       # docker/runc already include these patches / are not applicable
       patches = [];
     };
@@ -343,15 +347,15 @@ rec {
   };
 
   docker_27 = callPackage dockerGen rec {
-    version = "27.3.1";
+    version = "27.4.0";
     cliRev = "v${version}";
-    cliHash = "sha256-Iurud1BwswGZCFgJ04/wl1U9AKcsXDmzFXLFCrjfc0Y=";
+    cliHash = "sha256-q6xKERB5K7idExTrwFfX2ORs2G/55s2pybyhPcV5wuo=";
     mobyRev = "v${version}";
     mobyHash = "sha256-AKl06k2ePWOFhL3oH086HcLLYs2Da+wLOcGjGnQ0SXE=";
-    runcRev = "v1.1.14";
-    runcHash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
-    containerdRev = "v1.7.22";
-    containerdHash = "sha256-8IHBKai4PvvTuHPDTgx9wFEBzz4MM7Mwo8Q/bzFRzfk=";
+    runcRev = "v1.2.2";
+    runcHash = "sha256-hRi7TJP73hRd/v8hisEUx9P2I2J5oF0Wv60NWHORI7Y=";
+    containerdRev = "v1.7.24";
+    containerdHash = "sha256-03vJs61AnTuFAdImZjBfn1izFcoalVJdVs9DZeDcABI=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
diff --git a/pkgs/build-support/php/build-pecl.nix b/pkgs/build-support/php/build-pecl.nix
index 16913a85c63d..79faa2c7700a 100644
--- a/pkgs/build-support/php/build-pecl.nix
+++ b/pkgs/build-support/php/build-pecl.nix
@@ -41,7 +41,9 @@ stdenv.mkDerivation (
 
     inherit src;
 
+    strictDeps = true;
     nativeBuildInputs = [
+      php
       autoreconfHook
       re2c
     ] ++ nativeBuildInputs;
diff --git a/pkgs/by-name/ab/abcmidi/package.nix b/pkgs/by-name/ab/abcmidi/package.nix
index c1cf87173637..3aa646dced06 100644
--- a/pkgs/by-name/ab/abcmidi/package.nix
+++ b/pkgs/by-name/ab/abcmidi/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abcmidi";
-  version = "2024.12.06";
+  version = "2024.12.16";
 
   src = fetchFromGitHub {
     owner = "sshlien";
     repo = "abcmidi";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-uSmkRoAy2tCvSy/jE0wxg2nhiQRF62zCwnr41YpRkXE=";
+    hash = "sha256-8kzgojLwVVFjpWiQ1/0S3GCVU8oEpoFItjtRDByauDg=";
   };
 
   meta = {
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index 436f3711ce20..07fb922f1ed5 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.38.0";
+  version = "3.4.38.1";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0cn4qTdNH8VHRuypdRInrmU7gh792NSYL7P2rkz/4xc=";
+    hash = "sha256-u9t+0MgmEyDJkdjv+89wJkK74NKBlxNEy2F+3zz7kLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/bs/bstone/package.nix b/pkgs/by-name/bs/bstone/package.nix
index 5ac23cb98b21..e5f98c653ad5 100644
--- a/pkgs/by-name/bs/bstone/package.nix
+++ b/pkgs/by-name/bs/bstone/package.nix
@@ -1,21 +1,21 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   cmake,
-  gcc12Stdenv,
   SDL2,
   libGL,
 }:
 
-gcc12Stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bstone";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchFromGitHub {
     owner = "bibendovsky";
     repo = "bstone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wtW595cSoVTZaVykxOkJViNs3OmuIch9nA5s1SqwbJo=";
+    hash = "sha256-jK40/FdC11SWe2Vmh6cbNTxPeM1vrAveEtUWoiAh+jc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clojure-lsp/package.nix b/pkgs/by-name/cl/clojure-lsp/package.nix
index bd0e8ae311e3..8d055872fd10 100644
--- a/pkgs/by-name/cl/clojure-lsp/package.nix
+++ b/pkgs/by-name/cl/clojure-lsp/package.nix
@@ -10,18 +10,18 @@
 
 buildGraalvmNativeImage rec {
   pname = "clojure-lsp";
-  version = "2024.08.05-18.16.00";
+  version = "2024.11.08-17.49.29";
 
   src = fetchFromGitHub {
     owner = "clojure-lsp";
     repo = "clojure-lsp";
     rev = version;
-    hash = "sha256-U66Zo0o50Pw1IAph/KmrR6pYGuOFVM9K6SzaSaYdx2M=";
+    hash = "sha256-pvIfW96RaJXMIDPKHfJjds9dU6IuC2f1TwdI8X/JTw0=";
   };
 
   jar = fetchurl {
     url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp-standalone.jar";
-    hash = "sha256-rQlYrcmZwmBBWwa+28TcBFzzqmzTAM9Do3aH55Y6LFI=";
+    hash = "sha256-QMc62p6qFTh+y4C5aBGuZX/pQZQSywbYCFA1nYIY/80=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/da/dante/clang-osint-m4.patch b/pkgs/by-name/da/dante/clang-osint-m4.patch
index 65281e22ea0e..77c5f689cdb1 100644
--- a/pkgs/by-name/da/dante/clang-osint-m4.patch
+++ b/pkgs/by-name/da/dante/clang-osint-m4.patch
@@ -1,6 +1,6 @@
 diff -ur a/osdep.m4 b/osdep.m4
---- a/osdep.m4	2017-01-18 09:11:20.000000000 -0500
-+++ b/osdep.m4	2023-10-21 12:43:59.464797030 -0400
+--- a/osdep.m4	2024-11-20 08:07:22.000000000 +1100
++++ b/osdep.m4	2024-12-16 20:39:15.424935602 +1100
 @@ -381,6 +381,7 @@
  unset have_sa_len
  AC_MSG_CHECKING([for sa_len in sockaddr])
@@ -9,22 +9,15 @@ diff -ur a/osdep.m4 b/osdep.m4
  #include <sys/types.h>
  #include <sys/socket.h>
  ], [struct sockaddr sa;
-@@ -397,12 +398,13 @@
+@@ -397,6 +398,7 @@
     unset sa_len_type_found
     for type in uint8_t "unsigned char"; do
         AC_TRY_COMPILE([
 +#include <stdint.h>
  #include <sys/types.h>
- #include <sys/socket.h>], [
- struct sockaddr sa;
- $type *sa_len_ptr;
- sa_len_ptr = &sa.sa_len;
--sa_len_ptr++; /* use to avoid warning/error */],
-+(*sa_len_ptr)++; /* use to avoid warning/error */],
-        [AC_DEFINE_UNQUOTED(sa_len_type, [$type], [sa_len type])
-         sa_len_type_found=t
-         break])
-@@ -636,6 +638,7 @@
+ #include <sys/socket.h>
+ #include <stdio.h>], [
+@@ -640,6 +642,7 @@
  		in_port_t, in_addr_t],
  		, ,
  [
diff --git a/pkgs/by-name/da/dante/dante-1.4.3-miniupnpc-2.2.8.patch b/pkgs/by-name/da/dante/dante-1.4.3-miniupnpc-2.2.8.patch
deleted file mode 100644
index 6f55c141acd5..000000000000
--- a/pkgs/by-name/da/dante/dante-1.4.3-miniupnpc-2.2.8.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-diff --git a/include/autoconf.h.in b/include/autoconf.h.in
-index bab2fcfa6c...22bc9202ca 100644
---- a/include/autoconf.h.in
-+++ b/include/autoconf.h.in
-@@ -797,6 +797,9 @@
- /* UPNP support library 1.7 */
- #undef HAVE_LIBMINIUPNP17
- 
-+/* UPNP support library 2.2.8 */
-+#undef HAVE_LIBMINIUPNP228
-+
- /* Define to 1 if you have the `prldap60' library (-lprldap60). */
- #undef HAVE_LIBPRLDAP60
- 
-diff --git a/include/common.h b/include/common.h
-index 137f5ec51f...2c24759b52 100755
---- a/include/common.h
-+++ b/include/common.h
-@@ -1404,8 +1404,14 @@
- /* return codes from UPNP_GetValidIGD(). */
- #define UPNP_NO_IGD           (0)
- #define UPNP_CONNECTED_IGD    (1)
-+#if HAVE_LIBMINIUPNP228
-+#define UPNP_RESERVED_IGD     (2)
-+#define UPNP_DISCONNECTED_IGD (3)
-+#define UPNP_UNKNOWN_DEVICE   (4)
-+#else /* !HAVE_LIBMINIUPNP_228 */
- #define UPNP_DISCONNECTED_IGD (2)
- #define UPNP_UNKNOWN_DEVICE   (3)
-+#endif /* !HAVE_LIBMINIUPNP_228 */
- 
- #define UPNP_SUCCESS          (1)
- #define UPNP_FAILURE          (2)
-diff --git a/lib/upnp.c b/lib/upnp.c
-index d9535ca03c...dc99d53c06 100644
---- a/lib/upnp.c
-+++ b/lib/upnp.c
-@@ -154,7 +154,7 @@
-                            addrstring,
-                            NULL,
-                            0
--#if HAVE_LIBMINIUPNP17
-+#if HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
-                           ,0,
- 
- #if MINIUPNPC_API_VERSION >= 14
-@@ -162,7 +162,7 @@
- #endif /* MINIUPNPC_API_VERSION >= 14 */
- 
-                           &rc
--#endif /* HAVE_LIBMINIUPNP17 */
-+#endif /* HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
-                          );
- 
- #if SOCKS_CLIENT && SOCKSLIBRARY_DYNAMIC
-@@ -208,7 +208,12 @@
-          socks_autoadd_directroute(&commands, &protocols, &saddr, &smask);
-       }
- 
-+#if HAVE_LIBMINIUPNP228
-+      devtype = UPNP_GetValidIGD(dev, &url, &data, myaddr, sizeof(myaddr),
-+                                 NULL, 0);
-+#else /* !HAVE_LIBMINIUPNP228 */
-       devtype = UPNP_GetValidIGD(dev, &url, &data, myaddr, sizeof(myaddr));
-+#endif /* !HAVE_LIBMINIUPNP228 */
-       switch (devtype) {
-          case UPNP_NO_IGD:
-             snprintf(emsg, emsglen, "no UPNP IGD discovered on local network");
-@@ -226,9 +231,10 @@
-             rc = 0;
-             break;
- 
--         case UPNP_DISCONNECTED_IGD:
-+#if HAVE_LIBMINIUPNP228
-+         case UPNP_RESERVED_IGD:
-             snprintf(emsg, emsglen,
--                    "UPNP IGD discovered at url %s, but it is not connected",
-+                    "UPNP IGD discovered at url %s, but its IP is reserved",
-                     str2vis(url.controlURL,
-                            strlen(url.controlURL),
-                             vbuf,
-@@ -236,6 +242,18 @@
- 
-             swarnx("%s: %s", function, emsg);
-             rc = -1;
-+#endif /* HAVE_LIBMINIUPNP228 */
-+
-+         case UPNP_DISCONNECTED_IGD:
-+            snprintf(emsg, emsglen,
-+                    "UPNP IGD discovered at url %s, but it is not connected",
-+                    str2vis(url.controlURL,
-+                           strlen(url.controlURL),
-+                            vbuf,
-+                            sizeof(vbuf)));
-+
-+            swarnx("%s: %s", function, emsg);
-+            rc = -1;
-             break;
- 
-          case UPNP_UNKNOWN_DEVICE:
-@@ -273,12 +291,12 @@
- #if HAVE_LIBMINIUPNP13
-       STRCPY_ASSERTLEN(gw->state.data.upnp.servicetype, data.servicetype);
- 
--#elif HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17
-+#elif HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
-       STRCPY_ASSERTLEN(gw->state.data.upnp.servicetype, data.CIF.servicetype);
- 
- #else
- #  error "unexpected miniupnp version"
--#endif /* HAVE_LIBMINIUPNP17 */
-+#endif /* HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
- 
-       slog(LOG_NEGOTIATE, "%s: inited ok.  controlurl: %s, servicetype: %s",
-            function,
-@@ -756,9 +774,9 @@
-                                        buf,
-                                        protocol,
-                                        NULL
--#if HAVE_LIBMINIUPNP17
-+#if HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
-                                        ,0
--#endif /* HAVE_LIBMINIUPNP17 */
-+#endif /* HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
-                                        )) != UPNPCOMMAND_SUCCESS) {
-                snprintf(emsg, emsglen,
-                        "UPNP_AddPortMapping() failed: %s", strupnperror(rc));
-diff --git a/miniupnpc.m4 b/miniupnpc.m4
-index 85086d4917...ebb8875763 100644
---- a/miniupnpc.m4
-+++ b/miniupnpc.m4
-@@ -20,7 +20,7 @@
- 	LIBS=$oLIBS
-     fi
-     if test x"${have_libminiupnp}" = xt; then
--        AC_MSG_CHECKING([for miniupnpc version >= 1.7])
-+        AC_MSG_CHECKING([for miniupnpc version >= 2.2.8])
- 	AC_TRY_COMPILE([
-             #include <stdio.h>
-             #include <miniupnpc/miniupnpc.h>
-@@ -30,12 +30,34 @@
-             #ifndef MINIUPNPC_API_VERSION
- 	    #error "no api version define"
-             #else
--            # if MINIUPNPC_API_VERSION < 8
-+            # if MINIUPNPC_API_VERSION < 18
-             #error "api version too low"
-             # endif
-             #endif],
-          [AC_MSG_RESULT(yes)
-           AC_DEFINE(HAVE_LIBMINIUPNP, 1, [UPNP support library])
-+          AC_DEFINE(HAVE_LIBMINIUPNP228, 1, [UPNP support library 2.2.8])
-+          unset no_upnp
-+	  SOCKDDEPS="${SOCKDDEPS}${SOCKDDEPS:+ }$UPNPLIB"
-+	  DLIBDEPS="${DLIBDEPS}${DLIBDEPS:+ }$UPNPLIB"],
-+         [AC_MSG_RESULT(no)])
-+
-+        AC_MSG_CHECKING([for miniupnpc version >= 1.7])
-+	AC_TRY_COMPILE([
-+            #include <stdio.h>
-+            #include <miniupnpc/miniupnpc.h>
-+            #include <miniupnpc/upnpcommands.h>
-+            #include <miniupnpc/upnperrors.h>], [
-+
-+            #ifndef MINIUPNPC_API_VERSION
-+	    #error "no api version define"
-+            #else
-+            # if MINIUPNPC_API_VERSION < 8 || MINIUPNPC_API_VERSION > 17
-+            #error "api version too low or high"
-+            # endif
-+            #endif],
-+         [AC_MSG_RESULT(yes)
-+          AC_DEFINE(HAVE_LIBMINIUPNP, 1, [UPNP support library])
-           AC_DEFINE(HAVE_LIBMINIUPNP17, 1, [UPNP support library 1.7])
-           unset no_upnp
- 	  SOCKDDEPS="${SOCKDDEPS}${SOCKDDEPS:+ }$UPNPLIB"
diff --git a/pkgs/by-name/da/dante/package.nix b/pkgs/by-name/da/dante/package.nix
index d772741b093f..85524a14af6c 100644
--- a/pkgs/by-name/da/dante/package.nix
+++ b/pkgs/by-name/da/dante/package.nix
@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dante";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchurl {
     url = "https://www.inet.no/dante/files/${pname}-${version}.tar.gz";
-    sha256 = "0pbahkj43rx7rmv2x40mf5p3g3x9d6i2sz7pzglarf54w5ghd2j1";
+    sha256 = "sha256-GXPHcy8fnwpMDM8sHORix8JQYLJWQ+qQ+bmPU6gT+uw=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -46,8 +46,6 @@ stdenv.mkDerivation rec {
       # Fixes several issues with `osint.m4` that causes incorrect check failures when using newer
       # versions of clang: missing `stdint.h` for `uint8_t` and unused `sa_len_ptr`.
       ./clang-osint-m4.patch
-      # Fixes build with miniupnpc 2.2.8.
-      ./dante-1.4.3-miniupnpc-2.2.8.patch
     ]
     ++ lib.optionals remove_getaddrinfo_checks [
       (fetchpatch {
diff --git a/pkgs/by-name/de/descent3-unwrapped/package.nix b/pkgs/by-name/de/descent3-unwrapped/package.nix
index eb1d0de47adb..bca14d4d8a02 100644
--- a/pkgs/by-name/de/descent3-unwrapped/package.nix
+++ b/pkgs/by-name/de/descent3-unwrapped/package.nix
@@ -17,11 +17,11 @@ stdenv.mkDerivation rec {
   # the wrapped version of Descent 3. Once there’s a stable version of Descent
   # 3 that supports the -additionaldir command-line option, we can stop using
   # an unstable version of Descent 3.
-  version = "1.5.0-beta-unstable-2024-10-29";
+  version = "1.5.0-beta-unstable-2024-12-14";
   src = fetchFromGitHub {
     owner = "DescentDevelopers";
     repo = "Descent3";
-    rev = "d51ce964c7a925333ea64f00cf8d9ae15ee63a6b";
+    rev = "6583bfe575e57effd877415c9d03b83c8e9e271e";
     fetchSubmodules = true;
     leaveDotGit = true;
     # Descent 3 is supposed to display its Git commit hash in the bottom right
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
       git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
       rm -r .git
     '';
-    hash = "sha256-C6r06cntQ14jPFO9EUzLisZjsl22cIaJb8I7xFzXrNc=";
+    hash = "sha256-GQaYgmwAmAxdMq+7RQcElkX74xBAKbjYkx5W3MNWUvs=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/by-name/dn/dns-over-https/package.nix b/pkgs/by-name/dn/dns-over-https/package.nix
new file mode 100644
index 000000000000..73998f2b96c4
--- /dev/null
+++ b/pkgs/by-name/dn/dns-over-https/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "dns-over-https";
+  version = "2.3.7";
+
+  src = fetchFromGitHub {
+    owner = "m13253";
+    repo = "dns-over-https";
+    tag = "v${version}";
+    hash = "sha256-3mg4kDlIqv+psQU/FxA9TksGVAYaOymEDpAhMBZuqKI=";
+  };
+
+  vendorHash = "sha256-Dun1HWjV44PTpnijWBpGXqmKxtUw+Qu8rqsyMhEpkb4=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
+  subPackages = [
+    "doh-client"
+    "doh-server"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/m13253/dns-over-https";
+    changelog = "https://github.com/m13253/dns-over-https/releases/tag/v${version}";
+    description = "High performance DNS over HTTPS client & server";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cryo ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/ga/garnet/deps.nix b/pkgs/by-name/ga/garnet/deps.nix
index 04b09146a091..e4197da148be 100644
--- a/pkgs/by-name/ga/garnet/deps.nix
+++ b/pkgs/by-name/ga/garnet/deps.nix
@@ -1,48 +1,221 @@
 # This file was automatically generated by passthru.fetch-deps.
 # Please dont edit it manually, your changes might get overwritten!
 
-{ fetchNuGet }: [
-  (fetchNuGet { pname = "Azure.Core"; version = "1.41.0"; hash = "sha256-/ixQr8KFGlZa43gGd2A7aBzwu9h+wLO6OqIMy3YbW+Y="; })
-  (fetchNuGet { pname = "Azure.Storage.Blobs"; version = "12.21.2"; hash = "sha256-DvdMGuophEbvvVtbRU3vsNwla0zTn5dn7HbW0Mr4P/o="; })
-  (fetchNuGet { pname = "Azure.Storage.Common"; version = "12.20.1"; hash = "sha256-XBDyzAEt5iwdyB3jgoG5TLyx5NZ/MoiEerBR/7U7F4w="; })
-  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; hash = "sha256-ApU9y1yX60daSjPk3KYDBeJ7XZByKW8hse9NRZGcjeo="; })
-  (fetchNuGet { pname = "KeraLua"; version = "1.4.1"; hash = "sha256-ouRL7+0bW/VYUNNYQoXenXzYO0HNF3D1IsScqtah3DE="; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; hash = "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="; })
-  (fetchNuGet { pname = "Microsoft.Build.Tasks.Git"; version = "8.0.0"; hash = "sha256-vX6/kPij8vNAu8f7rrvHHhPrNph20IcufmrBgZNxpQA="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "8.0.0"; hash = "sha256-9BPsASlxrV8ilmMCjdb3TiUcm5vFZxkBnAI/fNBSEyA="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "8.0.0"; hash = "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "8.0.0"; hash = "sha256-GanfInGzzoN2bKeNwON8/Hnamr6l7RTpYLA49CNXD9Q="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "8.0.0"; hash = "sha256-+qIDR8hRzreCHNEDtUcPfVHQdurzWPo/mqviCH78+EQ="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "8.0.0"; hash = "sha256-75KzEGWjbRELczJpCiJub+ltNUMMbz5A/1KQU+5dgP8="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; hash = "sha256-Meh0Z0X7KyOEG4l0RWBcuHHihcABcvCyfUXgasmQ91o="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; hash = "sha256-Jmddjeg8U5S+iBTwRlVAVLeIHxc4yrrNgqVMOB7EjM4="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Configuration"; version = "8.0.0"; hash = "sha256-mzmstNsVjKT0EtQcdAukGRifD30T82BMGYlSu8k4K7U="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Console"; version = "8.0.0"; hash = "sha256-bdb9YWWVn//AeySp7se87/tCN2E7e8Gx2GPMw28cd9c="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; hash = "sha256-n2m4JSegQKUTlOsKLZUUHHKMq926eJ0w9N9G+I3FoFw="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "8.0.0"; hash = "sha256-A5Bbzw1kiNkgirk5x8kyxwg9lLTcSngojeD+ocpG1RI="; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; hash = "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "8.0.1"; hash = "sha256-zPWUKTCfGm4MWcYPU037NzezsFE1g8tEijjQkw5iooI="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "8.0.1"; hash = "sha256-Xv9MUnjb66U3xeR9drOcSX5n2DjOCIJZPMNSKjWHo9Y="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "8.0.1"; hash = "sha256-FfwrH/2eLT521Kqw+RBIoVfzlTNyYMqlWP3z+T6Wy2Y="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "8.0.1"; hash = "sha256-v3DIpG6yfIToZBpHOjtQHRo2BhXGDoE70EVs6kBtrRg="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "8.0.1"; hash = "sha256-ZHKaZxqESk+OU1SFTFGxvZ71zbdgWqv1L6ET9+fdXX0="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "8.0.1"; hash = "sha256-beVbbVQy874HlXkTKarPTT5/r7XR1NGHA/50ywWp7YA="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Validators"; version = "8.0.1"; hash = "sha256-5LTLbFNWz33nco+hyKAEHcQeAWaBugJ0oMKR6AuEI34="; })
-  (fetchNuGet { pname = "Microsoft.SourceLink.Common"; version = "8.0.0"; hash = "sha256-AfUqleVEqWuHE7z2hNiwOLnquBJ3tuYtbkdGMppHOXc="; })
-  (fetchNuGet { pname = "Microsoft.SourceLink.GitHub"; version = "8.0.0"; hash = "sha256-hNTkpKdCLY5kIuOmznD1mY+pRdJ0PKu2HypyXog9vb0="; })
-  (fetchNuGet { pname = "NLua"; version = "1.7.3"; hash = "sha256-2+eOxal0BDwAc6nJTNsFvf5E0KdfksIie7C7hEKeQos="; })
-  (fetchNuGet { pname = "System.ClientModel"; version = "1.0.0"; hash = "sha256-yHb72M/Z8LeSZea9TKw2eD0SdYEoCNwVw6Z3695SC2Y="; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.1"; hash = "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4="; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "8.0.1"; hash = "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="; })
-  (fetchNuGet { pname = "System.Interactive.Async"; version = "6.0.1"; hash = "sha256-4yzkdop+BMlpQ+qz/H7D7LkH1Ekh9n51t9yteHpv/58="; })
-  (fetchNuGet { pname = "System.IO.Hashing"; version = "6.0.0"; hash = "sha256-gSxLJ/ujWthLknylguRv40mwMl/qNcqnFI9SNjQY6lE="; })
-  (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; hash = "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="; })
-  (fetchNuGet { pname = "System.Memory.Data"; version = "1.0.2"; hash = "sha256-XiVrVQZQIz4NgjiK/wtH8iZhhOZ9MJ+X2hL2/8BrGN0="; })
-  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.7.2"; hash = "sha256-CUZOulSeRy1CGBm7mrNrTumA9od9peKiIDR/Nb1B4io="; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "4.7.2"; hash = "sha256-xA8PZwxX9iOJvPbfdi7LWjM2RMVJ7hmtEqS9JvgNsoM="; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "8.0.5"; hash = "sha256-yKxo54w5odWT6nPruUVsaX53oPRe+gKzGvLnnxtwP68="; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; hash = "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="; })
+{ fetchNuGet }:
+[
+  (fetchNuGet {
+    pname = "Azure.Core";
+    version = "1.41.0";
+    hash = "sha256-/ixQr8KFGlZa43gGd2A7aBzwu9h+wLO6OqIMy3YbW+Y=";
+  })
+  (fetchNuGet {
+    pname = "Azure.Storage.Blobs";
+    version = "12.21.2";
+    hash = "sha256-DvdMGuophEbvvVtbRU3vsNwla0zTn5dn7HbW0Mr4P/o=";
+  })
+  (fetchNuGet {
+    pname = "Azure.Storage.Common";
+    version = "12.20.1";
+    hash = "sha256-XBDyzAEt5iwdyB3jgoG5TLyx5NZ/MoiEerBR/7U7F4w=";
+  })
+  (fetchNuGet {
+    pname = "CommandLineParser";
+    version = "2.9.1";
+    hash = "sha256-ApU9y1yX60daSjPk3KYDBeJ7XZByKW8hse9NRZGcjeo=";
+  })
+  (fetchNuGet {
+    pname = "KeraLua";
+    version = "1.4.1";
+    hash = "sha256-ouRL7+0bW/VYUNNYQoXenXzYO0HNF3D1IsScqtah3DE=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Bcl.AsyncInterfaces";
+    version = "1.1.1";
+    hash = "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Bcl.AsyncInterfaces";
+    version = "6.0.0";
+    hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Build.Tasks.Git";
+    version = "8.0.0";
+    hash = "sha256-vX6/kPij8vNAu8f7rrvHHhPrNph20IcufmrBgZNxpQA=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration";
+    version = "8.0.0";
+    hash = "sha256-9BPsASlxrV8ilmMCjdb3TiUcm5vFZxkBnAI/fNBSEyA=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.Abstractions";
+    version = "8.0.0";
+    hash = "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.Binder";
+    version = "8.0.0";
+    hash = "sha256-GanfInGzzoN2bKeNwON8/Hnamr6l7RTpYLA49CNXD9Q=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.DependencyInjection";
+    version = "8.0.0";
+    hash = "sha256-+qIDR8hRzreCHNEDtUcPfVHQdurzWPo/mqviCH78+EQ=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.DependencyInjection.Abstractions";
+    version = "8.0.0";
+    hash = "sha256-75KzEGWjbRELczJpCiJub+ltNUMMbz5A/1KQU+5dgP8=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging";
+    version = "8.0.0";
+    hash = "sha256-Meh0Z0X7KyOEG4l0RWBcuHHihcABcvCyfUXgasmQ91o=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging.Abstractions";
+    version = "8.0.0";
+    hash = "sha256-Jmddjeg8U5S+iBTwRlVAVLeIHxc4yrrNgqVMOB7EjM4=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging.Configuration";
+    version = "8.0.0";
+    hash = "sha256-mzmstNsVjKT0EtQcdAukGRifD30T82BMGYlSu8k4K7U=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging.Console";
+    version = "8.0.0";
+    hash = "sha256-bdb9YWWVn//AeySp7se87/tCN2E7e8Gx2GPMw28cd9c=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Options";
+    version = "8.0.0";
+    hash = "sha256-n2m4JSegQKUTlOsKLZUUHHKMq926eJ0w9N9G+I3FoFw=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Options.ConfigurationExtensions";
+    version = "8.0.0";
+    hash = "sha256-A5Bbzw1kiNkgirk5x8kyxwg9lLTcSngojeD+ocpG1RI=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Primitives";
+    version = "8.0.0";
+    hash = "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Abstractions";
+    version = "8.0.1";
+    hash = "sha256-zPWUKTCfGm4MWcYPU037NzezsFE1g8tEijjQkw5iooI=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.JsonWebTokens";
+    version = "8.0.1";
+    hash = "sha256-Xv9MUnjb66U3xeR9drOcSX5n2DjOCIJZPMNSKjWHo9Y=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Logging";
+    version = "8.0.1";
+    hash = "sha256-FfwrH/2eLT521Kqw+RBIoVfzlTNyYMqlWP3z+T6Wy2Y=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Protocols";
+    version = "8.0.1";
+    hash = "sha256-v3DIpG6yfIToZBpHOjtQHRo2BhXGDoE70EVs6kBtrRg=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect";
+    version = "8.0.1";
+    hash = "sha256-ZHKaZxqESk+OU1SFTFGxvZ71zbdgWqv1L6ET9+fdXX0=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Tokens";
+    version = "8.0.1";
+    hash = "sha256-beVbbVQy874HlXkTKarPTT5/r7XR1NGHA/50ywWp7YA=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.IdentityModel.Validators";
+    version = "8.0.1";
+    hash = "sha256-5LTLbFNWz33nco+hyKAEHcQeAWaBugJ0oMKR6AuEI34=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.SourceLink.Common";
+    version = "8.0.0";
+    hash = "sha256-AfUqleVEqWuHE7z2hNiwOLnquBJ3tuYtbkdGMppHOXc=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.SourceLink.GitHub";
+    version = "8.0.0";
+    hash = "sha256-hNTkpKdCLY5kIuOmznD1mY+pRdJ0PKu2HypyXog9vb0=";
+  })
+  (fetchNuGet {
+    pname = "NLua";
+    version = "1.7.3";
+    hash = "sha256-2+eOxal0BDwAc6nJTNsFvf5E0KdfksIie7C7hEKeQos=";
+  })
+  (fetchNuGet {
+    pname = "System.ClientModel";
+    version = "1.0.0";
+    hash = "sha256-yHb72M/Z8LeSZea9TKw2eD0SdYEoCNwVw6Z3695SC2Y=";
+  })
+  (fetchNuGet {
+    pname = "System.Diagnostics.DiagnosticSource";
+    version = "6.0.1";
+    hash = "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4=";
+  })
+  (fetchNuGet {
+    pname = "System.IdentityModel.Tokens.Jwt";
+    version = "8.0.1";
+    hash = "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg=";
+  })
+  (fetchNuGet {
+    pname = "System.Interactive.Async";
+    version = "6.0.1";
+    hash = "sha256-4yzkdop+BMlpQ+qz/H7D7LkH1Ekh9n51t9yteHpv/58=";
+  })
+  (fetchNuGet {
+    pname = "System.IO.Hashing";
+    version = "6.0.0";
+    hash = "sha256-gSxLJ/ujWthLknylguRv40mwMl/qNcqnFI9SNjQY6lE=";
+  })
+  (fetchNuGet {
+    pname = "System.Linq.Async";
+    version = "6.0.1";
+    hash = "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI=";
+  })
+  (fetchNuGet {
+    pname = "System.Memory.Data";
+    version = "1.0.2";
+    hash = "sha256-XiVrVQZQIz4NgjiK/wtH8iZhhOZ9MJ+X2hL2/8BrGN0=";
+  })
+  (fetchNuGet {
+    pname = "System.Numerics.Vectors";
+    version = "4.5.0";
+    hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8=";
+  })
+  (fetchNuGet {
+    pname = "System.Runtime.CompilerServices.Unsafe";
+    version = "6.0.0";
+    hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I=";
+  })
+  (fetchNuGet {
+    pname = "System.Text.Encodings.Web";
+    version = "4.7.2";
+    hash = "sha256-CUZOulSeRy1CGBm7mrNrTumA9od9peKiIDR/Nb1B4io=";
+  })
+  (fetchNuGet {
+    pname = "System.Text.Json";
+    version = "4.7.2";
+    hash = "sha256-xA8PZwxX9iOJvPbfdi7LWjM2RMVJ7hmtEqS9JvgNsoM=";
+  })
+  (fetchNuGet {
+    pname = "System.Text.Json";
+    version = "8.0.5";
+    hash = "sha256-yKxo54w5odWT6nPruUVsaX53oPRe+gKzGvLnnxtwP68=";
+  })
+  (fetchNuGet {
+    pname = "System.Threading.Tasks.Extensions";
+    version = "4.5.4";
+    hash = "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng=";
+  })
 ]
diff --git a/pkgs/by-name/ga/garnet/package.nix b/pkgs/by-name/ga/garnet/package.nix
index 2107ffb9d5e4..5a6747ac4030 100644
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "garnet";
-  version = "1.0.46";
+  version = "1.0.48";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "garnet";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WXHtb4wDQxJ5n7/zbEGIrsfP0/dxV+ruYqcPFu1upho=";
+    hash = "sha256-L+yML0VgD+rTReRurfH78U4uXZJWOW4mE+dmBQRbb9U=";
   };
 
   projectFile = "main/GarnetServer/GarnetServer.csproj";
diff --git a/pkgs/by-name/gi/git-secret/package.nix b/pkgs/by-name/gi/git-secret/package.nix
index 774eb3f825ba..de44cf13d015 100644
--- a/pkgs/by-name/gi/git-secret/package.nix
+++ b/pkgs/by-name/gi/git-secret/package.nix
@@ -6,40 +6,49 @@
   git,
   gnupg,
   gawk,
+  installShellFiles,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "git-secret";
-  version = "0.5.0";
+  version = "0.5.0-unstable-2024-12-09";
 
   src = fetchFromGitHub {
     repo = "git-secret";
     owner = "sobolevn";
-    rev = "v${version}";
-    sha256 = "sha256-Vdlv3H99BZcT1O66ZCpq5olENOaUSubx58B1PQ/OlMU=";
+    rev = "fdc5e755b34569b0ad3d84a85e611afbb86c4db5";
+    hash = "sha256-SN6Xpkc8bd1yuvUMlKaXb5M1ts1JxZynVa5GHBKyOjw=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    installShellFiles
+  ];
 
-  installPhase = ''
-    install -D git-secret $out/bin/git-secret
+  installPhase =
+    let
+      binPath = lib.makeBinPath [
+        git
+        gnupg
+        gawk
+      ];
+    in
+    ''
+      runHook preInstall
 
-    wrapProgram $out/bin/git-secret \
-      --prefix PATH : "${
-        lib.makeBinPath [
-          git
-          gnupg
-          gawk
-        ]
-      }"
+      installBin git-secret
+      wrapProgram "$out/bin/git-secret" --prefix PATH : "${binPath}"
 
-    mkdir $out/share
-    cp -r man $out/share
-  '';
+      shopt -s extglob
+      installManPage man/**/!(*.md)
+      shopt -u extglob
+
+      runHook postInstall
+    '';
 
   meta = {
     description = "Bash-tool to store your private data inside a git repository";
-    homepage = "https://git-secret.io";
+    homepage = "https://sobolevn.me/git-secret/";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.lo1tuma ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix b/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
index 74853ac87bec..510b0c0469d1 100644
--- a/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
+++ b/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "google-alloydb-auth-proxy";
-  version = "1.11.3";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "alloydb-auth-proxy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MjLnGsZ4xoZpyjJQbBd3vihIA2sZ7AAhnW8Xtu7Au+U=";
+    hash = "sha256-Z1sTArR6usEkoI/Dp5FUXhjsPeDHVG88GaSbrb9KaaA=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-uUv/PqfuMAAwfcD2Sk36NcDoVWTrIVNxfoKM7cpFG5A=";
+  vendorHash = "sha256-jEs1oI4Ka87vbFbxt7cLm042wO2Rl5NaISmHBrCHZGw=";
 
   checkFlags = [
     "-short"
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index e9fee197015e..c3b9c09c2597 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "24.10.2-0";
+  version = "24.11.0-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-f0Wg3HHVX5NIW7Rfke52/knaGfPeZLpZb5KZkzah4GU=";
+          hash = "sha256-MvLaAURzcNkG+kHFiMb7vliucJOzfqU3skeUGWiiKBY=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-rSZ6F4ERWj5ElfWAXnD0vVrA2JmMKZdBeMWsr15hbGc=";
+          hash = "sha256-2LlsBgiu2LWkK8+VAT7FvZ1YPDtNla+t8YDZF0GalxI=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-G4oul2nP6KaPuMs8bS9ilbipczd20fClA7hl3HqaxeQ=";
+          hash = "sha256-xUtpoKilueiMD+2Yd58jlxq2UPwp9oUzusB9sbJQulk=";
         };
       }
       .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
diff --git a/pkgs/by-name/in/insomnia/package.nix b/pkgs/by-name/in/insomnia/package.nix
index 80458fc41d0a..a182994ddc9b 100644
--- a/pkgs/by-name/in/insomnia/package.nix
+++ b/pkgs/by-name/in/insomnia/package.nix
@@ -6,18 +6,18 @@
 }:
 let
   pname = "insomnia";
-  version = "10.0.0";
+  version = "10.2.0";
 
   src =
     fetchurl
       {
         x86_64-darwin = {
           url = "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.dmg";
-          hash = "sha256-HYEZzLDV2T4ugCjIeskS5SkrQlu5nQt1S0RG9R/rlcs=";
+          hash = "sha256-Yny5Rwt8XHTM77DH4AXmY8VtZ92F7jAdNW+polPePJk=";
         };
         x86_64-linux = {
           url = "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.AppImage";
-          hash = "sha256-hElisKB1C1By8lCCgNqNr6bIOMKqMG3UyBQ6jYu8yNg=";
+          hash = "sha256-DmDYyYJq7B4Zs9SCwyxgY3F5v+MXAhCKeQB35b3E86w=";
         };
       }
       .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
diff --git a/pkgs/by-name/ko/komga/package.nix b/pkgs/by-name/ko/komga/package.nix
index 34e527f077f6..467af02ffc6e 100644
--- a/pkgs/by-name/ko/komga/package.nix
+++ b/pkgs/by-name/ko/komga/package.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-KUNF6TPqr85rm9XOcoaCGtK8VHfevRFgkl+lTfJEdbA=";
+    sha256 = "sha256-mgPGhBdZ7FyxkVNPJkfFjQ6mJDbQ049PKzacTN6cajk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
index 443535a8da5f..cca2ff0de454 100644
--- a/pkgs/by-name/li/linux-wallpaperengine/package.nix
+++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix
@@ -87,36 +87,33 @@ let
     systemd
   ];
   buildType = "Release";
-  platform =
-    {
-      "aarch64-linux" = "linuxarm64";
-      "x86_64-linux" = "linux64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  cef-bin-name = "cef_binary_120.1.10+g3ce3184+chromium-120.0.6099.129_${platform}";
+  selectSystem =
+    attrs:
+    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  arch = selectSystem {
+    aarch64-linux = "arm64";
+    x86_64-linux = "x64";
+  };
+  cef-bin-name = "cef_binary_120.1.10+g3ce3184+chromium-120.0.6099.129_linux${arch}";
   cef-bin = stdenv.mkDerivation {
     pname = "cef-bin";
     version = "120.0.6099.129";
-    src =
-      let
-        hash =
-          {
-            "linuxarm64" = "sha256-2mOh3GWdx0qxsLRKVYXOJnVY0eqz6B3z9/B9A9Xfs/A=";
-            "linux64" = "sha256-FFkFMMkTSseLZIDzESFl8+h7wRhv5QGi1Uy5MViYpX8=";
-          }
-          .${platform};
-        urlName = builtins.replaceStrings [ "+" ] [ "%2B" ] cef-bin-name;
-      in
-      fetchzip {
-        url = "https://cef-builds.spotifycdn.com/${urlName}.tar.bz2";
-        inherit hash;
+
+    src = fetchzip {
+      url = "https://cef-builds.spotifycdn.com/${
+        builtins.replaceStrings [ "+" ] [ "%2B" ] cef-bin-name
+      }.tar.bz2";
+      hash = selectSystem {
+        aarch64-linux = "sha256-2mOh3GWdx0qxsLRKVYXOJnVY0eqz6B3z9/B9A9Xfs/A=";
+        x86_64-linux = "sha256-FFkFMMkTSseLZIDzESFl8+h7wRhv5QGi1Uy5MViYpX8=";
       };
+    };
+
     installPhase = ''
       runHook preInstall
 
-      mkdir $out
-      cp -r ./* $out/
-      chmod +w -R $out/
+      cp -r . $out
+      chmod +w -R $out
       patchelf $out/${buildType}/libcef.so --set-rpath "${rpath}" --add-needed libudev.so
       patchelf $out/${buildType}/libGLESv2.so --set-rpath "${rpath}" --add-needed libGL.so.1
       patchelf $out/${buildType}/chrome-sandbox --set-interpreter $(cat $NIX_BINTOOLS/nix-support/dynamic-linker)
@@ -124,6 +121,7 @@ let
 
       runHook postInstall
     '';
+
     meta = {
       description = "Simple framework for embedding Chromium-based browsers in other applications";
       homepage = "https://cef-builds.spotifycdn.com/index.html";
@@ -135,6 +133,25 @@ let
       ];
     };
   };
+in
+stdenv.mkDerivation rec {
+  pname = "linux-wallpaperengine";
+  version = "0-unstable-2024-11-08";
+
+  src = fetchFromGitHub {
+    owner = "Almamu";
+    repo = "linux-wallpaperengine";
+    rev = "4a063d0b84d331a0086b3f4605358ee177328d41";
+    hash = "sha256-IRTGFxHPRRRSg0J07pq8fpo1XbMT4aZC+wMVimZlH/Y=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoPatchelfHook
+    makeWrapper
+  ];
+
   buildInputs = [
     libdecor
     ffmpeg
@@ -159,41 +176,16 @@ let
     wayland-scanner
     libXrandr
   ];
-in
-stdenv.mkDerivation {
-  pname = "linux-wallpaperengine";
-  version = "0-unstable-2024-11-8";
-
-  src = fetchFromGitHub {
-    owner = "Almamu";
-    repo = "linux-wallpaperengine";
-    rev = "4a063d0b84d331a0086b3f4605358ee177328d41";
-    hash = "sha256-IRTGFxHPRRRSg0J07pq8fpo1XbMT4aZC+wMVimZlH/Y=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    autoPatchelfHook
-    makeWrapper
-  ];
-
-  inherit buildInputs;
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=${buildType}"
+    "-DCEF_ROOT=${cef-bin}"
     "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/linux-wallpaperengine"
   ];
 
-  postPatch = ''
-    patchShebangs .
-    mkdir -p third_party/cef/
-    ln -s ${cef-bin} third_party/cef/${cef-bin-name}
-  '';
-
   preFixup = ''
     patchelf --set-rpath "${lib.makeLibraryPath buildInputs}:${cef-bin}" $out/linux-wallpaperengine/linux-wallpaperengine
-    find $out -exec chmod 755 {} +
+    chmod 755 $out/linux-wallpaperengine/linux-wallpaperengine
     mkdir $out/bin
     makeWrapper $out/linux-wallpaperengine/linux-wallpaperengine $out/bin/linux-wallpaperengine
   '';
@@ -201,7 +193,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Wallpaper Engine backgrounds for Linux";
     homepage = "https://github.com/Almamu/linux-wallpaperengine";
-    license = lib.licenses.gpl3Plus;
+    license = with lib.licenses; [ gpl3Plus ];
     mainProgram = "linux-wallpaperengine";
     maintainers = with lib.maintainers; [ aucub ];
     platforms = [
diff --git a/pkgs/by-name/ne/nexusmods-app/deps.nix b/pkgs/by-name/ne/nexusmods-app/deps.nix
index 4d97882c5b4c..eb909d24fa8b 100644
--- a/pkgs/by-name/ne/nexusmods-app/deps.nix
+++ b/pkgs/by-name/ne/nexusmods-app/deps.nix
@@ -35,8 +35,8 @@
   })
   (fetchNuGet {
     pname = "Avalonia";
-    version = "11.2.1";
-    hash = "sha256-KdjhwDKlii12v7HNI3NsYAM1qYoXKRsVN2scQJbYMTc=";
+    version = "11.2.2";
+    hash = "sha256-lYWqgjYOyh4pg+TdkgqeFhi8OMI1p9IOvSntVXo5zvE=";
   })
   (fetchNuGet {
     pname = "Avalonia.Angle.Windows.Natives";
@@ -60,38 +60,38 @@
   })
   (fetchNuGet {
     pname = "Avalonia.Controls.ColorPicker";
-    version = "11.2.1";
-    hash = "sha256-yhjVW5pH8Y0JF1vbfcdL5MQfx24wb+Lkp8OBo51he8U=";
+    version = "11.2.2";
+    hash = "sha256-Mmp7Mjy9Y6uvkfjE8KLWoJWcVZHiJwqmhQupsxYRExo=";
   })
   (fetchNuGet {
     pname = "Avalonia.Controls.DataGrid";
-    version = "11.2.1";
-    hash = "sha256-IFzA7ztuhgddckQV9DlwkUTSk3RQqkJddCHAtu9yhbY=";
+    version = "11.2.2";
+    hash = "sha256-RbkISZEp55N9dtqvPp0Ej2/wpU/YzI4wgJjBCJnIGl4=";
   })
   (fetchNuGet {
     pname = "Avalonia.Controls.TreeDataGrid";
-    version = "11.0.10";
-    hash = "sha256-1R2AFOKQQPemN7qXsdxCGXcfMSRztRiC86DLqiV6CpY=";
+    version = "11.1.0";
+    hash = "sha256-WU0vs7a3BTQQiJn+fBhs+o+iKt5aukIVjpfH5LyyWwc=";
   })
   (fetchNuGet {
     pname = "Avalonia.Desktop";
-    version = "11.2.1";
-    hash = "sha256-Bu4ZEu81g6oWnxd+ew9BZ8zwYETjY8InQsaYvYnGqX4=";
+    version = "11.2.2";
+    hash = "sha256-ucd2SH0CAjwE5TSgwhhzYZqMD1zuTlR7qLQDl3mYGvg=";
   })
   (fetchNuGet {
     pname = "Avalonia.Diagnostics";
-    version = "11.2.1";
-    hash = "sha256-gJhi2clOc+a4NDRZfEoT5BwLTq8DLAWtaxo5FI/OJaY=";
+    version = "11.2.2";
+    hash = "sha256-aOji+/TYSP0l3dpn62bvWMdce2YkYi5xzRPC3nS6ZGc=";
   })
   (fetchNuGet {
     pname = "Avalonia.FreeDesktop";
-    version = "11.2.1";
-    hash = "sha256-2j9VfG8uD2BVF+p9REPQ4dp8E41vUh+R3Lh6v5AVmHA=";
+    version = "11.2.2";
+    hash = "sha256-c/u6TX1Hl2h8B5xe7Zo1AJ6cR5BazI19NRnw56a36y0=";
   })
   (fetchNuGet {
     pname = "Avalonia.Headless";
-    version = "11.2.1";
-    hash = "sha256-3nPxjkPgeH1gJie7b39ezGMe12ZHc5lhuQbYDkoYxME=";
+    version = "11.2.2";
+    hash = "sha256-XGKYwxFAdrOWq2HgFY42+8wS03t2bHGNuajwKC4mLHc=";
   })
   (fetchNuGet {
     pname = "Avalonia.Labs.Panels";
@@ -100,13 +100,13 @@
   })
   (fetchNuGet {
     pname = "Avalonia.Native";
-    version = "11.2.1";
-    hash = "sha256-bBJsvp6gHfBcAWPNKpAAFCk1Wi0gP3tw4qimI93px0U=";
+    version = "11.2.2";
+    hash = "sha256-2Scuc+OCtfLChDYCi4feCh9XUrgJpbVaek3xRnpOGDE=";
   })
   (fetchNuGet {
     pname = "Avalonia.ReactiveUI";
-    version = "11.2.1";
-    hash = "sha256-zEO6YkOuWdSj22KgvKO54UCHnw4rn9F3cd8xXsKRe7s=";
+    version = "11.2.2";
+    hash = "sha256-Rr/wmmS47korAK0nAplpWCWrS1O9YZZD6i+efR7btN0=";
   })
   (fetchNuGet {
     pname = "Avalonia.Remote.Protocol";
@@ -115,8 +115,8 @@
   })
   (fetchNuGet {
     pname = "Avalonia.Remote.Protocol";
-    version = "11.2.1";
-    hash = "sha256-RlO65QbExBdjEUY66CTlHefRdTZWzZbN4ksibVXxKv4=";
+    version = "11.2.2";
+    hash = "sha256-lMb3VvHXQGxn0dyEGkzKXxFocvPJUaNnOpRJpHF9ORU=";
   })
   (fetchNuGet {
     pname = "Avalonia.Skia";
@@ -130,33 +130,33 @@
   })
   (fetchNuGet {
     pname = "Avalonia.Skia";
-    version = "11.2.1";
-    hash = "sha256-F8Q4q5MaeyCkAm4rc6dPG1DhH5mZMvGzzyr2Z3AUe8s=";
+    version = "11.2.2";
+    hash = "sha256-YmOT+r4OfyOyg8epho6bVaEW2HImEfsZ5rNqhWIY5Fk=";
   })
   (fetchNuGet {
     pname = "Avalonia.Svg.Skia";
-    version = "11.2.0";
-    hash = "sha256-bbmOWYlVZyQ65BVTYW7BPr++VoM3VwqQLeMzZ6ZnI/o=";
+    version = "11.2.0.2";
+    hash = "sha256-76mxaTEgJ5HCIxX6P0+V5Kd+3Vk41YXLuHmc4Rr+/rE=";
   })
   (fetchNuGet {
     pname = "Avalonia.Themes.Fluent";
-    version = "11.2.1";
-    hash = "sha256-yDCJJ9OkL5EIEXr05pdnOK1p+Yp7YIRJn4MVjLX84kE=";
+    version = "11.2.2";
+    hash = "sha256-+wBsbMAMDMRkZN/t94qwQgyew8eCY2RBreoTCgs3KJU=";
   })
   (fetchNuGet {
     pname = "Avalonia.Themes.Simple";
-    version = "11.2.1";
-    hash = "sha256-cdMQ03nOT8jL9cnZrntpzfwgMF/dctE9610eXPV60tA=";
+    version = "11.2.2";
+    hash = "sha256-HXkfpUuTN8hSBMXCCGW78+2GC5w3VdTUp1qm7HvUZPI=";
   })
   (fetchNuGet {
     pname = "Avalonia.Win32";
-    version = "11.2.1";
-    hash = "sha256-QsQXXKz8vqKwaijR/fZINXHH7Hripwdm+92i9f1k3Xg=";
+    version = "11.2.2";
+    hash = "sha256-pouvlprL9VeEi1dG5zR6nFj+I/4CIjH1rHbV3N9/FHg=";
   })
   (fetchNuGet {
     pname = "Avalonia.X11";
-    version = "11.2.1";
-    hash = "sha256-Y2Zem7GhWFHHUwwDT1qUldUCRt8vWZZXi3Fxq+p/Pdg=";
+    version = "11.2.2";
+    hash = "sha256-86EIfm1zEvKleliP58xAs7KGxP/n7x2m8ca8C9W1XqA=";
   })
   (fetchNuGet {
     pname = "AvaloniaEdit.TextMate";
@@ -448,16 +448,36 @@
     version = "7.3.0.2";
     hash = "sha256-ibgoqzT1NV7Qo5e7X2W6Vt7989TKrkd2M2pu+lhSDg8=";
   })
+  (fetchNuGet {
+    pname = "HarfBuzzSharp";
+    version = "7.3.0.3";
+    hash = "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM=";
+  })
   (fetchNuGet {
     pname = "HarfBuzzSharp.NativeAssets.Linux";
     version = "7.3.0.2";
     hash = "sha256-SSfyuyBaduGobJW+reqyioWHhFWsQ+FXa2Gn7TiWxrU=";
   })
+  (fetchNuGet {
+    pname = "HarfBuzzSharp.NativeAssets.Linux";
+    version = "7.3.0.3";
+    hash = "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM=";
+  })
   (fetchNuGet {
     pname = "HarfBuzzSharp.NativeAssets.macOS";
     version = "7.3.0.2";
     hash = "sha256-dmEqR9MmpCwK8AuscfC7xUlnKIY7+Nvi06V0u5Jff08=";
   })
+  (fetchNuGet {
+    pname = "HarfBuzzSharp.NativeAssets.macOS";
+    version = "7.3.0.3";
+    hash = "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w=";
+  })
+  (fetchNuGet {
+    pname = "HarfBuzzSharp.NativeAssets.WebAssembly";
+    version = "7.3.0.3";
+    hash = "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I=";
+  })
   (fetchNuGet {
     pname = "HarfBuzzSharp.NativeAssets.WebAssembly";
     version = "7.3.0.3-preview.2.2";
@@ -468,6 +488,11 @@
     version = "7.3.0.2";
     hash = "sha256-x4iM3NHs9VyweG57xA74yd4uLuXly147ooe0mvNQ8zo=";
   })
+  (fetchNuGet {
+    pname = "HarfBuzzSharp.NativeAssets.Win32";
+    version = "7.3.0.3";
+    hash = "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I=";
+  })
   (fetchNuGet {
     pname = "HotChocolate.Language.SyntaxTree";
     version = "14.1.0";
@@ -1398,6 +1423,11 @@
     version = "9.0.0";
     hash = "sha256-rGeoVSc3RJlhL8Sv8CgDh2+BOiFHllKl2K9vtXxl+Ec=";
   })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.TimeProvider.Testing";
+    version = "9.0.0";
+    hash = "sha256-1Pgz3Lnng9EmCqsDqAT/G1pa5dNswoFFZj35BlVlRLE=";
+  })
   (fetchNuGet {
     pname = "Microsoft.IO.RecyclableMemoryStream";
     version = "3.0.0";
@@ -1563,6 +1593,11 @@
     version = "0.6.1";
     hash = "sha256-NDUxypEccSlGBG9nYTJJiTqYrZWjSjV1xt/uUbtfeS8=";
   })
+  (fetchNuGet {
+    pname = "NexusMods.Archives.Nx";
+    version = "0.6.3";
+    hash = "sha256-E4bOexmmPqMJoXs2gDAhgierGAFyc2JVrP3HBn3KAXs=";
+  })
   (fetchNuGet {
     pname = "NexusMods.Hashing.xxHash3";
     version = "3.0.3";
@@ -2045,8 +2080,8 @@
   })
   (fetchNuGet {
     pname = "ShimSkiaSharp";
-    version = "2.0.0.2";
-    hash = "sha256-Q1ok5/R8FWDCQubbhPsbRWigGqfiADFYUoiLlCvk/20=";
+    version = "2.0.0.4";
+    hash = "sha256-5XBMk4sjg2Yxr5rhoXWRsLDbZ2aTLumnFfi0Y662jTk=";
   })
   (fetchNuGet {
     pname = "SimpleInfoName";
@@ -2063,6 +2098,11 @@
     version = "2.88.8";
     hash = "sha256-rD5gc4SnlRTXwz367uHm8XG5eAIQpZloGqLRGnvNu0A=";
   })
+  (fetchNuGet {
+    pname = "SkiaSharp";
+    version = "2.88.9";
+    hash = "sha256-jZ/4nVXYJtrz9SBf6sYc/s0FxS7ReIYM4kMkrhZS+24=";
+  })
   (fetchNuGet {
     pname = "SkiaSharp.HarfBuzz";
     version = "2.88.6";
@@ -2078,21 +2118,41 @@
     version = "2.88.8";
     hash = "sha256-fOmNbbjuTazIasOvPkd2NPmuQHVCWPnow7AxllRGl7Y=";
   })
+  (fetchNuGet {
+    pname = "SkiaSharp.NativeAssets.Linux";
+    version = "2.88.9";
+    hash = "sha256-mQ/oBaqRR71WfS66mJCvcc3uKW7CNEHoPN2JilDbw/A=";
+  })
   (fetchNuGet {
     pname = "SkiaSharp.NativeAssets.macOS";
     version = "2.88.8";
     hash = "sha256-CdcrzQHwCcmOCPtS8EGtwsKsgdljnH41sFytW7N9PmI=";
   })
+  (fetchNuGet {
+    pname = "SkiaSharp.NativeAssets.macOS";
+    version = "2.88.9";
+    hash = "sha256-qvGuAmjXGjGKMzOPBvP9VWRVOICSGb7aNVejU0lLe/g=";
+  })
   (fetchNuGet {
     pname = "SkiaSharp.NativeAssets.WebAssembly";
     version = "2.88.8";
     hash = "sha256-GWWsE98f869LiOlqZuXMc9+yuuIhey2LeftGNk3/z3w=";
   })
+  (fetchNuGet {
+    pname = "SkiaSharp.NativeAssets.WebAssembly";
+    version = "2.88.9";
+    hash = "sha256-vgFL4Pdy3O1RKBp+T9N3W4nkH9yurZ0suo8u3gPmmhY=";
+  })
   (fetchNuGet {
     pname = "SkiaSharp.NativeAssets.Win32";
     version = "2.88.8";
     hash = "sha256-b8Vb94rNjwPKSJDQgZ0Xv2dWV7gMVFl5GwTK/QiZPPM=";
   })
+  (fetchNuGet {
+    pname = "SkiaSharp.NativeAssets.Win32";
+    version = "2.88.9";
+    hash = "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4=";
+  })
   (fetchNuGet {
     pname = "Spectre.Console";
     version = "0.49.1";
@@ -2155,18 +2215,18 @@
   })
   (fetchNuGet {
     pname = "Svg.Custom";
-    version = "2.0.0.2";
-    hash = "sha256-6sWw1V2oPdLgLDybH/FT/hUo+CKZiaIfOYv0KUaiTxk=";
+    version = "2.0.0.4";
+    hash = "sha256-Gp4zGWHJ2fEOmj8VNfPDukUPusxMsPhiz0jdcWT7u7Y=";
   })
   (fetchNuGet {
     pname = "Svg.Model";
-    version = "2.0.0.2";
-    hash = "sha256-TGkz0qMKvvjMdliqHEsJE1rqKIbezUZrkjofKRduAk8=";
+    version = "2.0.0.4";
+    hash = "sha256-tMYfqm4ZYgnajWwKQIe6dc3qnoIWxbODfarIzwlWX80=";
   })
   (fetchNuGet {
     pname = "Svg.Skia";
-    version = "2.0.0.2";
-    hash = "sha256-8F9LAgj3pdfv5VmnsuS/iHAmI1tajvuSZeTeenS13Lc=";
+    version = "2.0.0.4";
+    hash = "sha256-xRB9GE2IxtV25py1S4y3R0Qk5lHYThu73O+YYu1VIoA=";
   })
   (fetchNuGet {
     pname = "System.AppContext";
@@ -3173,4 +3233,9 @@
     version = "0.8.2";
     hash = "sha256-mwU4YWaBrbbqQeQ+7ohm/0ewWPD6S8Y2pg6Rqxbi4Ts=";
   })
+  (fetchNuGet {
+    pname = "ZString";
+    version = "2.6.0";
+    hash = "sha256-9Q/L1SPmI+oVxvUBIz202mUn+UVsoV/y2OfhopHXzeo=";
+  })
 ]
diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 9c46d05b25cb..2286f76428a6 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -25,12 +25,12 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname;
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchgit {
     url = "https://github.com/Nexus-Mods/NexusMods.App.git";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-7o+orpXLvZa+F0wEh3nVnYMe4ZkiaVJQOWvhWdNmcSk=";
+    hash = "sha256-TcT+siZMJlOYRtiQV+RAPPfM47wewfsz7WiPFaxCUkc=";
     fetchSubmodules = true;
     fetchLFS = true;
   };
diff --git a/pkgs/by-name/nz/nzbget/package.nix b/pkgs/by-name/nz/nzbget/package.nix
index f0b8069c309c..ab08cada8920 100644
--- a/pkgs/by-name/nz/nzbget/package.nix
+++ b/pkgs/by-name/nz/nzbget/package.nix
@@ -17,17 +17,30 @@
 , nixosTests
 }:
 
+let
+  par2TurboSrc = fetchFromGitHub {
+    owner = "nzbgetcom";
+    repo = "par2cmdline-turbo";
+    rev = "v1.1.1-nzbget-20241128"; # from cmake/par2-turbo.cmake
+    hash = "sha256-YBv61DAUWgf4jGQciTsGX7SAC2oZZ6h/lnJgJ40gMZE=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nzbget";
-  version = "24.3";
+  version = "24.5";
 
   src = fetchFromGitHub {
     owner = "nzbgetcom";
     repo = "nzbget";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Gci9bVjmewoEii6OiOuRpLgEBEKApmMmlA5v3OedCo4=";
+    hash = "sha256-HftzgdG6AjCyJVMV2btjBRLJLQ0wc1f8FJzGDWrdxR4=";
   };
 
+  patches = [
+    # remove git usage for fetching modified+vendored par2cmdline-turbo
+    ./remove-git-usage.patch
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [
@@ -43,6 +56,12 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
+  preConfigure = ''
+    mkdir -p build/par2-turbo/src
+    cp -r ${par2TurboSrc} build/par2-turbo/src/par2-turbo
+    chmod -R u+w build/par2-turbo/src/par2-turbo
+  '';
+
   postPatch = ''
     substituteInPlace daemon/util/Util.cpp \
       --replace-fail "std::string(\"uname \")" "std::string(\"${lib.getExe deterministic-uname} \")"
diff --git a/pkgs/by-name/nz/nzbget/remove-git-usage.patch b/pkgs/by-name/nz/nzbget/remove-git-usage.patch
new file mode 100644
index 000000000000..44d1a3583117
--- /dev/null
+++ b/pkgs/by-name/nz/nzbget/remove-git-usage.patch
@@ -0,0 +1,29 @@
+diff --git a/cmake/par2-turbo.cmake b/cmake/par2-turbo.cmake
+index 4fa76b54..cf293452 100644
+--- a/cmake/par2-turbo.cmake
++++ b/cmake/par2-turbo.cmake
+@@ -24,17 +24,13 @@ if(CMAKE_SYSROOT)
+ 	)
+ endif()
+ 
+-ExternalProject_add(
+-	par2-turbo
+-	PREFIX			par2-turbo
+-	GIT_REPOSITORY	https://github.com/nzbgetcom/par2cmdline-turbo.git
+-	GIT_TAG			v1.1.1-nzbget-20241128
+-	TLS_VERIFY		TRUE
+-	GIT_SHALLOW		TRUE
+-	GIT_PROGRESS	TRUE
+-	DOWNLOAD_EXTRACT_TIMESTAMP	TRUE
+-	CMAKE_ARGS		${CMAKE_ARGS}
+-	INSTALL_COMMAND	""
++
++ExternalProject_Add(
++    par2-turbo
++    PREFIX par2-turbo 
++    SOURCE_DIR ${CMAKE_BINARY_DIR}/par2-turbo/src/par2-turbo
++    CMAKE_ARGS ${CMAKE_ARGS}
++    INSTALL_COMMAND ""
+ )
+ 
+ if(WIN32) 
diff --git a/pkgs/by-name/pd/pdi/package.nix b/pkgs/by-name/pd/pdi/package.nix
index 519b72594a10..7b7cad6e15f3 100644
--- a/pkgs/by-name/pd/pdi/package.nix
+++ b/pkgs/by-name/pd/pdi/package.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pdi";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "pdidev";
     repo = "pdi";
-    rev = "refs/tags/${version}-gh";
-    hash = "sha256-VTbXsUUJb/6zNyn4QXNHajgzzgjSwdW/d+bTSDcpRaE=";
+    tag = version;
+    hash = "sha256-l4vKWIitP0BqSRPxpv0UgjAOgHJ3Aecm1hT+f9BeqRA=";
   };
 
   # Current hdf5 version in nixpkgs is 1.14.4.3 which is 4 numbers long and doesn't match the 3 number regex. :')
@@ -81,8 +81,13 @@ stdenv.mkDerivation rec {
   meta = {
     description = "PDI supports loose coupling of simulation codes with data handling libraries";
     homepage = "https://pdi.dev/master/";
+    changelog = "https://github.com/pdidev/pdi/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     mainProgram = "pdirun";
     maintainers = with lib.maintainers; [ GaetanLepage ];
+    badPlatforms = [
+      # fatal error: 'link.h' file not found
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/by-name/pm/pmtiles/package.nix b/pkgs/by-name/pm/pmtiles/package.nix
index 567c9a4749e6..ca29c1de49fe 100644
--- a/pkgs/by-name/pm/pmtiles/package.nix
+++ b/pkgs/by-name/pm/pmtiles/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "pmtiles";
-  version = "1.22.2";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "protomaps";
     repo = "go-pmtiles";
     rev = "v${version}";
-    hash = "sha256-TEQDjtSMJFZAYCoYXHmJxpxadYyd5DTo7HUhjglLRG8=";
+    hash = "sha256-LKcJJXuQEGJ55uPattoSESxE1knlU2XXzdYrQIlX5aA=";
   };
 
   vendorHash = "sha256-KRjMEH17cvSjtRP/qYeWRFUo6f6v1ZxEd+H3xvZ1udQ=";
diff --git a/pkgs/by-name/pv/pv/package.nix b/pkgs/by-name/pv/pv/package.nix
index 58932554733c..a1968b65a212 100644
--- a/pkgs/by-name/pv/pv/package.nix
+++ b/pkgs/by-name/pv/pv/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pv";
-  version = "1.9.7";
+  version = "1.9.15";
 
   src = fetchurl {
     url = "https://www.ivarch.com/programs/sources/pv-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aXanie4bvP3EdzIBW2BYnB0ECIkiUt18u0T0M2Oi8zo=";
+    hash = "sha256-4rF1ZKueuh7Cyq4oWWDL82O0QB3/2hkaYKC+/mjhfaw=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
index 62aa7a1e3627..944e0e4802ea 100644
--- a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
+++ b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "rapidfuzz";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0ZMK9WVMflgGD4uEKp7/SvWXCByYQtPU9gSJsNEqTbM=";
+    hash = "sha256-tmk7H9F+IScYPlcbplcrqUU/+py0DFTO95QYdwz5gIc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index e04340e8fe8d..1c5562e433ec 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.110";
+  version = "0.3.111";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-BDlLvOW13Z6jE9OVC6QskVzXONkYKjXouPzedaPDmi0=";
+    hash = "sha256-k9QuYskc3lhqfjOY6vhCuzHq3+l5q3EfOEbrWz4yb4M=";
   };
 
-  cargoHash = "sha256-GptaDa8NjCcWg5OsyujIgxGH4egWGBVVTLaYp4fqP3Q=";
+  cargoHash = "sha256-l1fltHsqV0zS3EdAYLO9uTTi6iMu+ZD8zGwW9/uULoQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/rt/rtorrent/package.nix b/pkgs/by-name/rt/rtorrent/package.nix
index 5afa2ced4c56..66c431dbfd79 100644
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@@ -8,7 +8,6 @@
   fetchFromGitHub,
   fetchpatch,
   installShellFiles,
-  libsigcxx,
   libtool,
   libtorrent,
   ncurses,
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cppunit
     curl
-    libsigcxx
     libtool
     libtorrent
     ncurses
diff --git a/pkgs/by-name/sa/saber/package.nix b/pkgs/by-name/sa/saber/package.nix
index 59b51e036d95..9bbd7e2c4c97 100644
--- a/pkgs/by-name/sa/saber/package.nix
+++ b/pkgs/by-name/sa/saber/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  flutter,
+  flutter327,
   gst_all_1,
   libunwind,
   orc,
@@ -9,15 +9,15 @@
   autoPatchelfHook,
   xorg,
 }:
-flutter.buildFlutterApplication rec {
+flutter327.buildFlutterApplication rec {
   pname = "saber";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchFromGitHub {
     owner = "saber-notes";
     repo = "saber";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-ExnqXpaGDlnuhBUTUjVpc5gEto2Uaqdq9P/AnVDuIBw=";
+    tag = "v${version}";
+    hash = "sha256-plBcZo67/x8KcND28jqfrwbvI9IZz8ptLZoGl2y2vW4=";
   };
 
   gitHashes = {
@@ -47,11 +47,11 @@ flutter.buildFlutterApplication rec {
 
   preFixup = ''
     # Remove libpdfrx.so's reference to the /build/ directory
-    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" $out/app/${pname}/lib/lib*.so
+    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" $out/app/saber/lib/lib*.so
   '';
 
   meta = {
-    description = "The cross-platform open-source app built for handwriting";
+    description = "Cross-platform open-source app built for handwriting";
     homepage = "https://github.com/saber-notes/saber";
     mainProgram = "saber";
     license = with lib.licenses; [ gpl3Plus ];
diff --git a/pkgs/by-name/sa/saber/pubspec.lock.json b/pkgs/by-name/sa/saber/pubspec.lock.json
index 98267c132b1e..4fa55a1e38a3 100644
--- a/pkgs/by-name/sa/saber/pubspec.lock.json
+++ b/pkgs/by-name/sa/saber/pubspec.lock.json
@@ -234,11 +234,11 @@
       "dependency": "transitive",
       "description": {
         "name": "charcode",
-        "sha256": "fb98c0f6d12c920a02ee2d998da788bca066ca5f148492b7085ee23372b12306",
+        "sha256": "fb0f1107cac15a5ea6ef0a6ef71a807b9e4267c713bb93e00e92d737cc8dbd8a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.1"
+      "version": "1.4.0"
     },
     "clock": {
       "dependency": "transitive",
@@ -264,11 +264,11 @@
       "dependency": "direct main",
       "description": {
         "name": "collection",
-        "sha256": "ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a",
+        "sha256": "a1ace0a119f20aabc852d165077c036cd864315bd99b7eaa10a60100341941bf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.18.0"
+      "version": "1.19.0"
     },
     "convert": {
       "dependency": "transitive",
@@ -344,11 +344,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_quill_delta",
-        "sha256": "2962476fb9471439a959b68b0e032febee76475e934f2d65d8d86dd0d5bff7a6",
+        "sha256": "bddb0b2948bd5b5a328f1651764486d162c59a8ccffd4c63e8b2c5e44be1dac4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.8.2"
+      "version": "10.8.3"
     },
     "dbus": {
       "dependency": "transitive",
@@ -394,21 +394,21 @@
       "dependency": "direct main",
       "description": {
         "name": "device_info_plus",
-        "sha256": "f545ffbadee826f26f2e1a0f0cbd667ae9a6011cc0f77c0f8f00a969655e6e95",
+        "sha256": "4fa68e53e26ab17b70ca39f072c285562cfc1589df5bb1e9295db90f6645f431",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.1.1"
+      "version": "11.2.0"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "device_info_plus_platform_interface",
-        "sha256": "282d3cf731045a2feb66abfe61bbc40870ae50a3ed10a4d3d217556c35c8c2ba",
+        "sha256": "0b04e02b30791224b31969eb1b50d723498f402971bff3630bca2ba839bd1ed2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.1"
+      "version": "7.0.2"
     },
     "diff_match_patch": {
       "dependency": "transitive",
@@ -454,11 +454,11 @@
       "dependency": "transitive",
       "description": {
         "name": "equatable",
-        "sha256": "c2b87cb7756efdf69892005af546c56c0b5037f54d2a88269b4f347a505e3ca2",
+        "sha256": "567c64b3cb4cf82397aac55f4f0cbd3ca20d77c6c03bedbc4ceaddc08904aef7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.5"
+      "version": "2.0.7"
     },
     "fake_async": {
       "dependency": "transitive",
@@ -504,11 +504,41 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "aac85f20436608e01a6ffd1fdd4e746a7f33c93a2c83752e626bdfaea139b877",
+        "sha256": "16dc141db5a2ccc6520ebb6a2eb5945b1b09e95085c021d9f914f8ded7f1465c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.3"
+      "version": "8.1.4"
+    },
+    "file_selector_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_linux",
+        "sha256": "54cbbd957e1156d29548c7d9b9ec0c0ebb6de0a90452198683a7d23aed617a33",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.3+2"
+    },
+    "file_selector_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_platform_interface",
+        "sha256": "a3994c26f10378a039faa11de174d7b78eb8f79e4dd0af2a451410c1a5c3f66b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.6.2"
+    },
+    "file_selector_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_windows",
+        "sha256": "8f5d2f6590d51ecd9179ba39c64f722edc15226cc93dcc8698466ad36a4a85a4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.3+3"
     },
     "fixnum": {
       "dependency": "direct main",
@@ -596,11 +626,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_keyboard_visibility_temp_fork",
-        "sha256": "2d94acecfc170d244157821cc67e784f60972677aac94a6672626a5d6b2dc537",
+        "sha256": "cecc44a350a8a369efbc960bb2126386af53cb0597ca6789607cbfb88081b9f4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3"
+      "version": "0.1.4"
     },
     "flutter_keyboard_visibility_windows": {
       "dependency": "transitive",
@@ -652,11 +682,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_quill_delta_from_html",
-        "sha256": "288f879bd11f9b6857868e7b198e69918530bd63d196ead6d8a9ee780b4b44d2",
+        "sha256": "63873b5391b56daa999ce8fa7dd23dfd7d0417a70e00a647ba450f4a8988afd0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.2"
+      "version": "1.4.3"
     },
     "flutter_secure_storage": {
       "dependency": "direct main",
@@ -742,11 +772,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_svg",
-        "sha256": "578bd8c508144fdaffd4f77b8ef2d8c523602275cd697cc3db284dbd762ef4ce",
+        "sha256": "54900a1a1243f3c4a5506d853a2b5c2dbc38d5f27e52a52618a8054401431123",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.14"
+      "version": "2.0.16"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -758,21 +788,21 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_web_auth_2",
-        "sha256": "8f59c9fa71b5affb322cb7103b836cd0ced89c9c50c66f82b523b7d339018dc3",
+        "sha256": "3c14babeaa066c371f3a743f204dd0d348b7d42ffa6fae7a9847a521aff33696",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.1.0"
     },
     "flutter_web_auth_2_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_web_auth_2_platform_interface",
-        "sha256": "222264d4979e9372c90e441736a62d800481e4a9c860cc2c235d1d605a118a2b",
+        "sha256": "c63a472c8070998e4e422f6b34a17070e60782ac442107c70000dd1bed645f4d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.1.0"
     },
     "flutter_web_plugins": {
       "dependency": "transitive",
@@ -800,21 +830,21 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "ce89c5a993ca5eea74535f798478502c30a625ecb10a1de4d7fef5cd1bcac2a4",
+        "sha256": "2fd11229f59e23e967b0775df8d5948a519cd7e1e8b6e849729e010587b46539",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.4.1"
+      "version": "14.6.2"
     },
     "golden_screenshot": {
       "dependency": "direct dev",
       "description": {
         "name": "golden_screenshot",
-        "sha256": "a294eaad3ed06b647d4578d0f300c396305581c74f63803339b3a17a825a8287",
+        "sha256": "6c800c8e1338434ccb68dec788b5121bf97d256aa6a98b43a4330190572f144a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.2"
     },
     "golden_toolkit": {
       "dependency": "transitive",
@@ -826,16 +856,6 @@
       "source": "hosted",
       "version": "0.15.0"
     },
-    "google_fonts": {
-      "dependency": "direct main",
-      "description": {
-        "name": "google_fonts",
-        "sha256": "b1ac0fe2832c9cc95e5e88b57d627c5e68c223b9657f4b96e1487aa9098c7b82",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "6.2.1"
-    },
     "gsettings": {
       "dependency": "transitive",
       "description": {
@@ -880,11 +900,11 @@
       "dependency": "transitive",
       "description": {
         "name": "http_parser",
-        "sha256": "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b",
+        "sha256": "76d306a1c3afb33fe82e2bbacad62a61f409b5634c915fceb0d799de1a913360",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.2"
+      "version": "4.1.1"
     },
     "icons_launcher": {
       "dependency": "direct dev",
@@ -987,21 +1007,21 @@
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker",
-        "sha256": "3f87a60e8c63aecc975dda1ceedbc8f24de75f09e4856ea27daf8958f2f0ce05",
+        "sha256": "7bb2830ebd849694d1ec25bf1f44582d6ac531a57a365a803a6034ff751d2d06",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.0.5"
+      "version": "10.0.7"
     },
     "leak_tracker_flutter_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_flutter_testing",
-        "sha256": "932549fb305594d82d7183ecd9fa93463e9914e1b67cacc34bc40906594a1806",
+        "sha256": "9491a714cca3667b60b5c420da8217e6de0d1ba7a5ec322fab01758f6998f379",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.5"
+      "version": "3.0.8"
     },
     "leak_tracker_testing": {
       "dependency": "transitive",
@@ -1017,11 +1037,11 @@
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "3315600f3fb3b135be672bf4a178c55f274bebe368325ae18462c89ac1e3b413",
+        "sha256": "4a16b3f03741e1252fda5de3ce712666d010ba2122f8e912c94f9f7b90e1a4c3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.0"
+      "version": "5.1.0"
     },
     "list_utilities": {
       "dependency": "transitive",
@@ -1077,11 +1097,11 @@
       "dependency": "direct main",
       "description": {
         "name": "material_symbols_icons",
-        "sha256": "7b723abea4ad37e16fe921f1f1971cbb9b0f66d223a8c99981168a2306416b98",
+        "sha256": "64404f47f8e0a9d20478468e5decef867a688660bad7173adcd20418d7f892c9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.2791.1"
+      "version": "4.2801.0"
     },
     "matrix4_transform": {
       "dependency": "transitive",
@@ -1162,15 +1182,85 @@
       "source": "path",
       "version": "1.2.4"
     },
-    "open_filex": {
+    "open_file": {
       "dependency": "direct main",
       "description": {
-        "name": "open_filex",
-        "sha256": "ba425ea49affd0a98a234aa9344b9ea5d4c4f7625a1377961eae9fe194c3d523",
+        "name": "open_file",
+        "sha256": "d17e2bddf5b278cb2ae18393d0496aa4f162142ba97d1a9e0c30d476adf99c0e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.0"
+      "version": "3.5.10"
+    },
+    "open_file_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_android",
+        "sha256": "58141fcaece2f453a9684509a7275f231ac0e3d6ceb9a5e6de310a7dff9084aa",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.6"
+    },
+    "open_file_ios": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_ios",
+        "sha256": "02996f01e5f6863832068e97f8f3a5ef9b613516db6897f373b43b79849e4d07",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "open_file_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_linux",
+        "sha256": "d189f799eecbb139c97f8bc7d303f9e720954fa4e0fa1b0b7294767e5f2d7550",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.0.5"
+    },
+    "open_file_mac": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_mac",
+        "sha256": "1440b1e37ceb0642208cfeb2c659c6cda27b25187a90635c9d1acb7d0584d324",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "open_file_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_platform_interface",
+        "sha256": "101b424ca359632699a7e1213e83d025722ab668b9fd1412338221bf9b0e5757",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "open_file_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_web",
+        "sha256": "e3dbc9584856283dcb30aef5720558b90f88036360bd078e494ab80a80130c4f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.0.4"
+    },
+    "open_file_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "open_file_windows",
+        "sha256": "d26c31ddf935a94a1a3aa43a23f4fff8a5ff4eea395fe7a8cb819cf55431c875",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.0.3"
     },
     "packages_extensions": {
       "dependency": "transitive",
@@ -1226,21 +1316,21 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "c464428172cb986b758c6d1724c603097febb8fb855aa265aeecc9280c294d4a",
+        "sha256": "4adf4fd5423ec60a29506c76581bc05854c55e3a0b72d35bb28d661c9686edf2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.12"
+      "version": "2.2.15"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_foundation",
-        "sha256": "f234384a3fdd67f989b4d54a5d73ca2a6c422fa55ae694381ae0f4375cd1ea16",
+        "sha256": "4843174df4d288f5e29185bd6e72a6fbdf5a4a4602717eed565497429f179942",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.1"
     },
     "path_provider_linux": {
       "dependency": "transitive",
@@ -1306,11 +1396,11 @@
       "dependency": "direct main",
       "description": {
         "name": "pdfrx",
-        "sha256": "001160b6c4eba222d38de73516691062589dc8d2b20d0f69ca02f4c7688b543a",
+        "sha256": "1a9cb7c6c6ac9b6e8b441d6a956697894dc4d10a9452ca9d640490c26c07cbfc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.87"
+      "version": "1.0.97"
     },
     "perfect_freehand": {
       "dependency": "direct main",
@@ -1356,11 +1446,11 @@
       "dependency": "transitive",
       "description": {
         "name": "permission_handler_html",
-        "sha256": "af26edbbb1f2674af65a8f4b56e1a6f526156bc273d0e65dd8075fab51c78851",
+        "sha256": "38f000e83355abb3392140f6bc3030660cfaef189e1f87824facb76300b4ff24",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3+2"
+      "version": "0.1.3+5"
     },
     "permission_handler_platform_interface": {
       "dependency": "transitive",
@@ -1496,81 +1586,81 @@
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge",
-        "sha256": "5ccf1930fe52db91846754bd56391d251071524ec594eb4c8509b3095f7f9e28",
+        "sha256": "0b3200c57bb4f1f12d6c764648d42482891f20f12024c75fe3479cafc1e132c9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.7.9"
+      "version": "10.7.11"
     },
     "quill_native_bridge_android": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_android",
-        "sha256": "4e787041ad4ab99421dfed0199cb5a6f136b5f6a9e68d20b199064d85d4161d8",
+        "sha256": "b75c7e6ede362a7007f545118e756b1f19053994144ec9eda932ce5e54a57569",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.4"
+      "version": "0.0.1+2"
     },
     "quill_native_bridge_ios": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_ios",
-        "sha256": "16dd18a56bdc60f396eb873a0786141d8e3281cc0cb6ad7af24c2286abec43d8",
+        "sha256": "d23de3cd7724d482fe2b514617f8eedc8f296e120fb297368917ac3b59d8099f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.4"
+      "version": "0.0.1"
     },
     "quill_native_bridge_linux": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_linux",
-        "sha256": "a0d8aa775b36a7b8ac7ace5bd6ba05b21fed6c9b04a9f328f95489254ae0f7a3",
+        "sha256": "5fcc60cab2ab9079e0746941f05c5ca5fec85cc050b738c8c8b9da7c09da17eb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.3"
+      "version": "0.0.1"
     },
     "quill_native_bridge_macos": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_macos",
-        "sha256": "76d441a905181af04c51b9cf71a13e04c3dd51ed482dcb543a01e14d78ad3fc0",
+        "sha256": "1c0631bd1e2eee765a8b06017c5286a4e829778f4585736e048eb67c97af8a77",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.2"
+      "version": "0.0.1"
     },
     "quill_native_bridge_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_platform_interface",
-        "sha256": "5ad4a9cdb6fadd6575bca29c277f83daa324539c97f58cf45cff6195135defb9",
+        "sha256": "2d71b6c5106db0a4b1d788640d1b949ccdd0e570b5a5e0384f7b28be9630a94a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.4"
+      "version": "0.0.1"
     },
     "quill_native_bridge_web": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_web",
-        "sha256": "bb3ab017fdb9b60a29cac0bce3acfd48396d13c1bd0499c97af112c84937b4d1",
+        "sha256": "e7e55047d68f1a88574c26dbe3f12988f49d07740590d8fc6280028bbde5b908",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.5"
+      "version": "0.0.1"
     },
     "quill_native_bridge_windows": {
       "dependency": "transitive",
       "description": {
         "name": "quill_native_bridge_windows",
-        "sha256": "78bc40cc4a23387ed79a309fc04f7a95a0b6da9ebce67f739dd08b0fd0523641",
+        "sha256": "60e50d74238f22ceb43113d9a42b6627451dab9fc27f527b979a32051cf1da45",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.1-dev.3"
+      "version": "0.0.1"
     },
     "quiver": {
       "dependency": "transitive",
@@ -1627,11 +1717,11 @@
       "dependency": "direct main",
       "description": {
         "name": "saver_gallery",
-        "sha256": "ef9b06de9a947fa85226cd478cf3af394c8464594f87b4a6c373772a19dc372b",
+        "sha256": "bf59475e50b73d666630bed7a5fdb621fed92d637f64e3c61ce81653ec6a833c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "4.0.1"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -1697,21 +1787,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "9c9bafd4060728d7cdb2464c341743adbd79d327cb067ec7afb64583540b47c8",
+        "sha256": "6327c3f233729374d0abaafd61f6846115b2a481b4feddd8534211dc10659400",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.2"
+      "version": "10.1.3"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "c57c0bbfec7142e3a0f55633be504b796af72e60e3c791b44d5a017b985f7a48",
+        "sha256": "cc012a23fc2d479854e6c80150696c4a5f5bb62cb89af4de1c505cf78d0a5d0b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.1"
+      "version": "5.0.2"
     },
     "shared_preferences": {
       "dependency": "direct main",
@@ -1727,11 +1817,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "3b9febd815c9ca29c9e3520d50ec32f49157711e143b7a4ca039eb87e8ade5ab",
+        "sha256": "7f172d1b06de5da47b6264c2692ee2ead20bbbc246690427cdb4fc301cd0c549",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.3"
+      "version": "2.3.4"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -1797,27 +1887,27 @@
       "dependency": "transitive",
       "description": "flutter",
       "source": "sdk",
-      "version": "0.0.99"
+      "version": "0.0.0"
     },
     "slang": {
       "dependency": "direct main",
       "description": {
         "name": "slang",
-        "sha256": "b04db2dbaf927b28600a2f8a272a3bf2ae309556dcc5d6beb02d66af0be39e4c",
+        "sha256": "e02feadc1291280e755ed01da39817213247295368671da67570e28ac0120aa8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.3.0"
     },
     "slang_flutter": {
       "dependency": "direct main",
       "description": {
         "name": "slang_flutter",
-        "sha256": "59988f37bb8b50d96ee46832a8a389036c0da26c04b1b1d4aa6690c00f70eccf",
+        "sha256": "493456b7c4f842ec2e7519c2358a4653b3198b84e9b2656b03a648f7f3405471",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.3.0"
     },
     "source_span": {
       "dependency": "transitive",
@@ -1843,11 +1933,11 @@
       "dependency": "transitive",
       "description": {
         "name": "stack_trace",
-        "sha256": "73713990125a6d93122541237550ee3352a2d84baad52d375a4cad2eb9b7ce0b",
+        "sha256": "9f47fd3630d76be3ab26f0ee06d213679aa425996925ff3feffdec504931c377",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.11.1"
+      "version": "1.12.0"
     },
     "stream_channel": {
       "dependency": "transitive",
@@ -1863,31 +1953,31 @@
       "dependency": "transitive",
       "description": {
         "name": "string_scanner",
-        "sha256": "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde",
+        "sha256": "688af5ed3402a4bde5b3a6c15fd768dbf2621a614950b17f04626c431ab3c4c3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.3.0"
     },
     "super_clipboard": {
       "dependency": "direct main",
       "description": {
         "name": "super_clipboard",
-        "sha256": "1340c8876da05caf17ef2c887b7df4d608cb550170219fa7e33a5675870475f3",
+        "sha256": "687ef5d4ceb2cb1e0e36a4af37683936609f424f0767b46fee5fc312b0aeb595",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.0-dev.3"
+      "version": "0.9.0-dev.5"
     },
     "super_native_extensions": {
       "dependency": "transitive",
       "description": {
         "name": "super_native_extensions",
-        "sha256": "72df71db3fb87de2579285084f8d75b71bf2688e91ee57061aeab87b3aa8dea5",
+        "sha256": "1cb6baecf529300ae7f59974bdc33a53b947ecc4ce374c00126df064c10e4e51",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.0-dev.3"
+      "version": "0.9.0-dev.5"
     },
     "sync_http": {
       "dependency": "transitive",
@@ -1923,11 +2013,11 @@
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "5b8a98dafc4d5c4c9c72d8b31ab2b23fc13422348d2997120294d3bac86b4ddb",
+        "sha256": "664d3a9a64782fcdeb83ce9c6b39e78fd2971d4e37827b9b06c3aa1edc5e760c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.2"
+      "version": "0.7.3"
     },
     "timezone": {
       "dependency": "transitive",
@@ -1993,31 +2083,31 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_ios",
-        "sha256": "e43b677296fadce447e987a2f519dcf5f6d1e527dc35d01ffab4fff5b8a7063e",
+        "sha256": "16a513b6c12bb419304e72ea0ae2ab4fed569920d1c7cb850263fe3acc824626",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.1"
+      "version": "6.3.2"
     },
     "url_launcher_linux": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_linux",
-        "sha256": "e2b9622b4007f97f504cd64c0128309dfb978ae66adbe944125ed9e1750f06af",
+        "sha256": "4e9ba368772369e3e08f231d2301b4ef72b9ff87c31192ef471b380ef29a4935",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "3.2.1"
     },
     "url_launcher_macos": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_macos",
-        "sha256": "769549c999acdb42b8bcfa7c43d72bf79a382ca7441ab18a808e101149daf672",
+        "sha256": "17ba2000b847f334f16626a574c702b196723af2a289e7a93ffcb79acff855c2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.1"
+      "version": "3.2.2"
     },
     "url_launcher_platform_interface": {
       "dependency": "transitive",
@@ -2063,11 +2153,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics",
-        "sha256": "773c9522d66d523e1c7b25dfb95cc91c26a1e17b107039cfe147285e92de7878",
+        "sha256": "27d5fefe86fb9aace4a9f8375b56b3c292b64d8c04510df230f849850d912cb7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.14"
+      "version": "1.1.15"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
@@ -2083,11 +2173,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "ab9ff38fc771e9ee1139320adbe3d18a60327370c218c60752068ebee4b49ab1",
+        "sha256": "1b4b9e706a10294258727674a340ae0d6e64a7231980f9f9a3d12e4b42407aad",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.15"
+      "version": "1.1.16"
     },
     "vector_math": {
       "dependency": "direct main",
@@ -2113,11 +2203,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "5c5f338a667b4c644744b661f309fb8080bb94b18a7e91ef1dbd343bed00ed6d",
+        "sha256": "f6be3ed8bd01289b34d679c2b62226f63c0e69f9fd2e50a6b3c1c729a961041b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.2.5"
+      "version": "14.3.0"
     },
     "watcher": {
       "dependency": "transitive",
@@ -2133,31 +2223,31 @@
       "dependency": "transitive",
       "description": {
         "name": "web",
-        "sha256": "d43c1d6b787bf0afad444700ae7f4db8827f701bc61c255ac8d328c6f4d52062",
+        "sha256": "cd3543bd5798f6ad290ea73d210f423502e71900302dde696f8bff84bf89a1cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0"
+      "version": "1.1.0"
     },
     "webdriver": {
       "dependency": "transitive",
       "description": {
         "name": "webdriver",
-        "sha256": "003d7da9519e1e5f329422b36c4dcdf18d7d2978d1ba099ea4e45ba490ed845e",
+        "sha256": "3d773670966f02a646319410766d3b5e1037efb7f07cc68f844d5e06cd4d61c8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.3"
+      "version": "3.0.4"
     },
     "win32": {
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "84ba388638ed7a8cb3445a320c8273136ab2631cd5f2c57888335504ddab1bc2",
+        "sha256": "8b338d4486ab3fbc0ba0db9f9b4f5239b6697fcee427939a40e720cbb9ee0a69",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.8.0"
+      "version": "5.9.0"
     },
     "win32_registry": {
       "dependency": "transitive",
@@ -2311,7 +2401,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.5.0 <4.0.0",
+    "dart": ">=3.6.0-0 <4.0.0",
     "flutter": ">=3.24.3"
   }
 }
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index e7642e042515..e998cb73793e 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.6.0";
+  version = "9.6.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    hash = "sha256-M4228GDo9jIVJMfl61n7cgTAmBYZrmHdXb+mD40vWqY";
+    hash = "sha256-TXnBSIleUdoTek8GpJqR/10OuVvV7UxHxho5fXr8jgk=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 963dcdb21e64..46a8cce77df3 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -12,7 +12,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snapcraft";
-  version = "8.5.0";
+  version = "8.5.1";
 
   pyproject = true;
 
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
     owner = "canonical";
     repo = "snapcraft";
     rev = "refs/tags/${version}";
-    hash = "sha256-u5LO29LnAJrU8fafa1EA4ii5g8sO8REfuf/7lzI7x5k=";
+    hash = "sha256-7kIVWbVj5qse3JIdlCvRtVUfSa/rSjn4e8HJdVY3sOA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/st/stunnel/package.nix b/pkgs/by-name/st/stunnel/package.nix
index 26381ad4f4b8..5201716af9ce 100644
--- a/pkgs/by-name/st/stunnel/package.nix
+++ b/pkgs/by-name/st/stunnel/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stunnel";
-  version = "5.73";
+  version = "5.74";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.stunnel.org/archive/${lib.versions.major finalAttrs.version}.x/stunnel-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vJF8O82UOk1jI2DAZ5d6MeheOF9fSEX2l0m86IGDyzg=";
+    hash = "sha256-m+8jWrXSSiqN/2SF39eC7SNfRAfpvIcW3rOD/IDNYjA=";
     # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
index 4be5fdd072c4..078c4542052d 100644
--- a/pkgs/by-name/ta/taskwarrior3/package.nix
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -1,65 +1,94 @@
 {
-  rustPlatform,
-  rustc,
-  cargo,
-  corrosion,
   lib,
   stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   cmake,
-  libuuid,
-  nixosTests,
-  python3,
-  xdg-utils,
+  rustPlatform,
+  rustc,
+  cargo,
   installShellFiles,
-  darwin,
+
+  # buildInputs
+  libuuid,
+  xdg-utils,
+
+  # passthru.tests
+  nixosTests,
+
+  # nativeCheckInputs
+  python3,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "taskwarrior";
-  version = "3.1.0";
+  version = "3.2.0-unstable-2024-12-17";
   src = fetchFromGitHub {
     owner = "GothenburgBitFactory";
     repo = "taskwarrior";
-    rev = "v${version}";
-    hash = "sha256-iKpOExj1xM9rU/rIcOLLKMrZrAfz7y9X2kt2CjfMOOQ=";
+    rev = "cc505e488184e958bcaedad6fed86f91d128e6bd";
+    hash = "sha256-M9pRoilxTHppX/efvppBI+QiPYXBEkvWxiEnodjqryk=";
     fetchSubmodules = true;
   };
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${finalAttrs.pname}-${finalAttrs.version}-cargo-deps";
+    inherit (finalAttrs) src;
+    hash = "sha256-QPnW+FWbsjvjQr5CRuOGLIaUWSGItlFDwLEtZfRbihA="; # For fetchCargoTarball with name arguments
+  };
 
   postPatch = ''
     substituteInPlace src/commands/CmdNews.cpp \
-      --replace "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
+      --replace-fail "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
+  '';
+  # The CMakeLists files used by upstream issue a `cargo install` command to
+  # install a rust tool (cxxbridge-cmd) that is supposed to be included in the Cargo.toml's and
+  # `Cargo.lock` files of upstream. Setting CARGO_HOME like that helps `cargo
+  # install` find the dependencies we prefetched. See also:
+  # https://github.com/GothenburgBitFactory/taskwarrior/issues/3705
+  postUnpack = ''
+    export CARGO_HOME=$PWD/.cargo
+  '';
+  # Test failures, see:
+  # https://github.com/GothenburgBitFactory/taskwarrior/issues/3727
+  failingTests = [
+    "bash_completion.test.py"
+    "hooks.env.test.py"
+    "hooks.on-add.test.py"
+    "hooks.on-launch.test.py"
+    "hooks.on-modify.test.py"
+    "hooks.on-exit.test.py"
+  ];
+  preConfigure = ''
+    substituteInPlace test/CMakeLists.txt \
+      ${lib.concatMapStringsSep "\\\n  " (t: "--replace-fail ${t} '' ") finalAttrs.failingTests}
   '';
 
-  nativeBuildInputs =
-    [
-      cmake
-      libuuid
-      python3
-      installShellFiles
-      corrosion
-      cargo
-      rustc
-      rustPlatform.cargoSetupHook
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # darwin dependencies
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  strictDeps = true;
+  nativeBuildInputs = [
+    cmake
+    rustPlatform.cargoSetupHook
+    # To install cxxbridge-cmd before configurePhase, see above linked upstream
+    # issue.
+    rustc
+    cargo
+    installShellFiles
+  ];
+
+  buildInputs = [
+    libuuid
+  ];
 
   doCheck = true;
-  checkTarget = "build_tests";
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    name = "${pname}-${version}-cargo-deps";
-    inherit src;
-    sourceRoot = src.name;
-    hash = "sha256-L+hYYKXSOG4XYdexLMG3wdA7st+A9Wk9muzipSNjxrA=";
-  };
-  cargoRoot = "./";
-  preConfigure = ''
-    export CMAKE_PREFIX_PATH="${corrosion}:$CMAKE_PREFIX_PATH"
+  preCheck = ''
+    # See:
+    # https://github.com/GothenburgBitFactory/taskwarrior/blob/v3.2.0/doc/devel/contrib/development.md#run-the-test-suite
+    make test_runner
+    # Otherwise all '/usr/bin/env python' shebangs are not found by ctest
+    patchShebangs test/*.py test/*/*.py
   '';
+  nativeCheckInputs = [
+    python3
+  ];
 
   postInstall = ''
     # ZSH is installed automatically from some reason, only bash and fish need
@@ -79,7 +108,7 @@ stdenv.mkDerivation rec {
   passthru.tests.nixos = nixosTests.taskchampion-sync-server;
 
   meta = {
-    changelog = "https://github.com/GothenburgBitFactory/taskwarrior/blob/${src.rev}/ChangeLog";
+    changelog = "https://github.com/GothenburgBitFactory/taskwarrior/blob/${finalAttrs.src.rev}/ChangeLog";
     description = "Highly flexible command-line tool to manage TODO lists";
     homepage = "https://taskwarrior.org";
     license = lib.licenses.mit;
@@ -92,4 +121,4 @@ stdenv.mkDerivation rec {
     mainProgram = "task";
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/to/tone/deps.nix b/pkgs/by-name/to/tone/deps.nix
new file mode 100644
index 000000000000..c81d28820c1a
--- /dev/null
+++ b/pkgs/by-name/to/tone/deps.nix
@@ -0,0 +1,251 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }:
+[
+  (fetchNuGet {
+    pname = "Acornima";
+    version = "1.1.0";
+    hash = "sha256-adavnYPd+NnpQE0W/gOCKx7tMA0bt9KY/WekLCMpllQ=";
+  })
+  (fetchNuGet {
+    pname = "CliWrap";
+    version = "3.7.0";
+    hash = "sha256-hXClLGuhscCrcBaymrp57Prh4m8Qe0vdE4S2ErIM13w=";
+  })
+  (fetchNuGet {
+    pname = "CSharp.OperationResult";
+    version = "0.1.6";
+    hash = "sha256-0f9tlUvzZfviDpnBGeBxerWEXiqwd39O0pPtDUaT8Ig=";
+  })
+  (fetchNuGet {
+    pname = "grok.net";
+    version = "2.0.0";
+    hash = "sha256-dsuHJexpCx+CAM4JI1orJaIk/YEulySJEk2HGwSlk2k=";
+  })
+  (fetchNuGet {
+    pname = "HtmlAgilityPack";
+    version = "1.11.71";
+    hash = "sha256-ddNrIXTfiu8gwrUs/5xYDjpD0sOth90kut6qCgxGUSE=";
+  })
+  (fetchNuGet {
+    pname = "Jint";
+    version = "4.1.0";
+    hash = "sha256-jx50e7/IkrvOqEXoZv+9pkeS88HJvOOFbI6xqXf3TrM=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration";
+    version = "9.0.0";
+    hash = "sha256-uBLeb4z60y8z7NelHs9uT3cLD6wODkdwyfJm6/YZLDM=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.Abstractions";
+    version = "9.0.0";
+    hash = "sha256-xtG2USC9Qm0f2Nn6jkcklpyEDT3hcEZOxOwTc0ep7uc=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.Binder";
+    version = "9.0.0";
+    hash = "sha256-6ajYWcNOQX2WqftgnoUmVtyvC1kkPOtTCif4AiKEffU=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.EnvironmentVariables";
+    version = "9.0.0";
+    hash = "sha256-tDJx2prYZpr0RKSwmJfsK9FlUGwaDmyuSz2kqQxsWoI=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.FileExtensions";
+    version = "9.0.0";
+    hash = "sha256-PsLo6mrLGYfbi96rfCG8YS1APXkUXBG4hLstpT60I4s=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Configuration.Json";
+    version = "9.0.0";
+    hash = "sha256-qQn7Ol0CvPYuyecYWYBkPpTMdocO7I6n+jXQI2udzLI=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.DependencyInjection";
+    version = "9.0.0";
+    hash = "sha256-dAH52PPlTLn7X+1aI/7npdrDzMEFPMXRv4isV1a+14k=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.DependencyInjection.Abstractions";
+    version = "9.0.0";
+    hash = "sha256-CncVwkKZ5CsIG2O0+OM9qXuYXh3p6UGyueTHSLDVL+c=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.DependencyModel";
+    version = "9.0.0";
+    hash = "sha256-xirwlMWM0hBqgTneQOGkZ8l45mHT08XuSSRIbprgq94=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Diagnostics";
+    version = "9.0.0";
+    hash = "sha256-JMbhtjdcWRlrcrbgPlowfj26+pM+MYhnPIaYKnv9byU=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Diagnostics.Abstractions";
+    version = "9.0.0";
+    hash = "sha256-wG1LcET+MPRjUdz3HIOTHVEnbG/INFJUqzPErCM79eY=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.FileProviders.Abstractions";
+    version = "9.0.0";
+    hash = "sha256-mVfLjZ8VrnOQR/uQjv74P2uEG+rgW72jfiGdSZhIfDc=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.FileProviders.Physical";
+    version = "9.0.0";
+    hash = "sha256-IzFpjKHmF1L3eVbFLUZa2N5aH3oJkJ7KE1duGIS7DP8=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.FileSystemGlobbing";
+    version = "9.0.0";
+    hash = "sha256-eBLa8pW/y/hRj+JbEr340zbHRABIeFlcdqE0jf5/Uhc=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Http";
+    version = "9.0.0";
+    hash = "sha256-MsStH3oUfyBbcSEoxm+rfxFBKI/rtB5PZrSGvtDjVe0=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging";
+    version = "9.0.0";
+    hash = "sha256-kR16c+N8nQrWeYLajqnXPg7RiXjZMSFLnKLEs4VfjcM=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Logging.Abstractions";
+    version = "9.0.0";
+    hash = "sha256-iBTs9twjWXFeERt4CErkIIcoJZU1jrd1RWCI8V5j7KU=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Options";
+    version = "9.0.0";
+    hash = "sha256-DT5euAQY/ItB5LPI8WIp6Dnd0lSvBRP35vFkOXC68ck=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Options.ConfigurationExtensions";
+    version = "9.0.0";
+    hash = "sha256-r1Z3sEVSIjeH2UKj+KMj86har68g/zybSqoSjESBcoA=";
+  })
+  (fetchNuGet {
+    pname = "Microsoft.Extensions.Primitives";
+    version = "9.0.0";
+    hash = "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs=";
+  })
+  (fetchNuGet {
+    pname = "Newtonsoft.Json";
+    version = "13.0.3";
+    hash = "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc=";
+  })
+  (fetchNuGet {
+    pname = "PCRE.NET";
+    version = "0.20.0";
+    hash = "sha256-Vd9qJxjGlWoLDqlhTmWY/P2bvteRt9LFDXJkCsFJ/QQ=";
+  })
+  (fetchNuGet {
+    pname = "Sandreas.AudioMetadata";
+    version = "0.2.5";
+    hash = "sha256-4FrW1QV4okSEswTpgj/dhFurR/2AHyTgqDgMBjRproI=";
+  })
+  (fetchNuGet {
+    pname = "Sandreas.Files";
+    version = "1.1.2";
+    hash = "sha256-wEJ7zL02AYumMp/Unru8z6H5aoodXdt6uy14gZMQEyM=";
+  })
+  (fetchNuGet {
+    pname = "Sandreas.SpectreConsoleHelpers";
+    version = "0.0.2";
+    hash = "sha256-oVliKk5Og4o0z736F7YzT7PGDF2qN77yqxrYENR0wu8=";
+  })
+  (fetchNuGet {
+    pname = "Serilog";
+    version = "4.2.0";
+    hash = "sha256-7f3EpCsEbDxXgsuhE430KVI14p7oDUuCtwRpOCqtnbs=";
+  })
+  (fetchNuGet {
+    pname = "Serilog.Extensions.Logging";
+    version = "9.0.0";
+    hash = "sha256-aGkz1V4HVl0rWC1BkcnLhG1EC7WLBoT3tdLdUUTFXaw=";
+  })
+  (fetchNuGet {
+    pname = "Serilog.Settings.Configuration";
+    version = "9.0.0";
+    hash = "sha256-Q/q5UiSrcxoy5a/orod20E2RfiRtHDhxjjGMe1dW35I=";
+  })
+  (fetchNuGet {
+    pname = "Serilog.Sinks.Console";
+    version = "6.0.0";
+    hash = "sha256-QH8ykDkLssJ99Fgl+ZBFBr+RQRl0wRTkeccQuuGLyro=";
+  })
+  (fetchNuGet {
+    pname = "Serilog.Sinks.File";
+    version = "6.0.0";
+    hash = "sha256-KQmlUpG9ovRpNqKhKe6rz3XMLUjkBqjyQhEm2hV5Sow=";
+  })
+  (fetchNuGet {
+    pname = "Spectre.Console";
+    version = "0.49.1";
+    hash = "sha256-tqSVojyuQjuB34lXo759NOcyLgNIw815mKXJPq5JFDo=";
+  })
+  (fetchNuGet {
+    pname = "Spectre.Console.Cli";
+    version = "0.49.1";
+    hash = "sha256-sar9rhft1ivDMj1kU683+4KxUPUZL+Fb++ewMA6RD4Q=";
+  })
+  (fetchNuGet {
+    pname = "System.CodeDom";
+    version = "9.0.0";
+    hash = "sha256-578lcBgswW0eM16r0EnJzfGodPx86RxxFoZHc2PSzsw=";
+  })
+  (fetchNuGet {
+    pname = "System.Diagnostics.DiagnosticSource";
+    version = "9.0.0";
+    hash = "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE=";
+  })
+  (fetchNuGet {
+    pname = "System.IO.Abstractions";
+    version = "19.0.1";
+    hash = "sha256-zyRrlJ2+rJFfbFEfrMdqH741uX7u4Qdvob5pvpDUqpk=";
+  })
+  (fetchNuGet {
+    pname = "System.IO.Pipelines";
+    version = "9.0.0";
+    hash = "sha256-vb0NrPjfEao3kfZ0tavp2J/29XnsQTJgXv3/qaAwwz0=";
+  })
+  (fetchNuGet {
+    pname = "System.Management";
+    version = "9.0.0";
+    hash = "sha256-UyLO5dgNVC7rBT1S6o/Ix6EQGlVTSWUQtVC+/cyTkfQ=";
+  })
+  (fetchNuGet {
+    pname = "System.Text.Encodings.Web";
+    version = "9.0.0";
+    hash = "sha256-WGaUklQEJywoGR2jtCEs5bxdvYu5SHaQchd6s4RE5x0=";
+  })
+  (fetchNuGet {
+    pname = "System.Text.Json";
+    version = "9.0.0";
+    hash = "sha256-aM5Dh4okLnDv940zmoFAzRmqZre83uQBtGOImJpoIqk=";
+  })
+  (fetchNuGet {
+    pname = "TestableIO.System.IO.Abstractions";
+    version = "19.0.1";
+    hash = "sha256-rSvRFL0Gntmw/9d3/2bZF1pIlgReN7GIa+cLb9bjYgc=";
+  })
+  (fetchNuGet {
+    pname = "TestableIO.System.IO.Abstractions.Wrappers";
+    version = "19.0.1";
+    hash = "sha256-VhCfuYB29x8AV1tEOaMKjixt8U0x9oeFF3/wkhXmSNc=";
+  })
+  (fetchNuGet {
+    pname = "Ude.NetStandard";
+    version = "1.2.0";
+    hash = "sha256-9Dq7UE5OiuvciURQV8Aa13elolt1fzDhvF8c8Yxznhw=";
+  })
+  (fetchNuGet {
+    pname = "z440.atl.core";
+    version = "6.9.0";
+    hash = "sha256-lme55hhVwZ9Y/wVmekA0gVIsw3RUoyYuL9gMEHXuWMU=";
+  })
+]
diff --git a/pkgs/by-name/to/tone/nuget-deps.nix b/pkgs/by-name/to/tone/nuget-deps.nix
deleted file mode 100644
index 9378473b4a7d..000000000000
--- a/pkgs/by-name/to/tone/nuget-deps.nix
+++ /dev/null
@@ -1,251 +0,0 @@
-# This file was automatically generated by passthru.fetch-deps.
-# Please dont edit it manually, your changes might get overwritten!
-
-{ fetchNuGet }:
-[
-  (fetchNuGet {
-    pname = "CliWrap";
-    version = "3.6.0";
-    sha256 = "0x96awy81kn0dr8h5d376cgfzxg5bvmzd610rc017nliv152zkw2";
-  })
-  (fetchNuGet {
-    pname = "CSharp.OperationResult";
-    version = "0.1.6";
-    sha256 = "127hjd30vvcks977yxxh59g89dbsf7h1khcr1vignrgk9fanvzyi";
-  })
-  (fetchNuGet {
-    pname = "Esprima";
-    version = "3.0.0-beta-9";
-    sha256 = "1gwdi537832z5whyqx58474ys2akgmrkabm51sy7725c91814snz";
-  })
-  (fetchNuGet {
-    pname = "grok.net";
-    version = "1.1.0";
-    sha256 = "01vm1b658dwxcxp1l4cpsplg8pwpmbs6v6fbqwg1lvrm7li9bgjz";
-  })
-  (fetchNuGet {
-    pname = "Jint";
-    version = "3.0.0-beta-2044";
-    sha256 = "0sy0qy33gn54sszhq4dkiihxd224n58xhcxg46qi4p3i93qn3snl";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration";
-    version = "7.0.0";
-    sha256 = "0n1grglxql9llmrsbbnlz5chx8mxrb5cpvjngm0hfyrkgzcwz90d";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.Abstractions";
-    version = "7.0.0";
-    sha256 = "1as8cygz0pagg17w22nsf6mb49lr2mcl1x8i3ad1wi8lyzygy1a3";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.Binder";
-    version = "2.0.0";
-    sha256 = "1prvdbma6r18n5agbhhabv6g357p1j70gq4m9g0vs859kf44nrgc";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.Binder";
-    version = "7.0.0";
-    sha256 = "1qifb1pv7s76lih8wnjk418wdk4qwn87q2n6dx54knfvxai410bl";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.EnvironmentVariables";
-    version = "7.0.0";
-    sha256 = "0nhh7rnh45s39x8sjn88czg7nyfpry85pkm0g619j8b468zj8nb4";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.FileExtensions";
-    version = "7.0.0";
-    sha256 = "1fk7dcz6gfhd1k1d8ksz22rnjvj1waqjzk29ym4i3dz73rsq8j1i";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Configuration.Json";
-    version = "7.0.0";
-    sha256 = "05zjmrpp99l128wijp1fy8asskc11ls871qaqr4mjnz3gbfycxnj";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.DependencyInjection";
-    version = "7.0.0";
-    sha256 = "121zs4jp8iimgbpzm3wsglhjwkc06irg1pxy8c1zcdlsg34cfq1p";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.DependencyInjection.Abstractions";
-    version = "2.0.0";
-    sha256 = "1pwrfh9b72k9rq6mb2jab5qhhi225d5rjalzkapiayggmygc8nhz";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.DependencyInjection.Abstractions";
-    version = "7.0.0";
-    sha256 = "181d7mp9307fs17lyy42f8cxnjwysddmpsalky4m0pqxcimnr6g7";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.DependencyModel";
-    version = "3.0.0";
-    sha256 = "1cm0hycgb33mf1ja9q91wxi3gk13d1p462gdq7gndrya23hw2jm5";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.FileProviders.Abstractions";
-    version = "7.0.0";
-    sha256 = "0ff20yklyjgyjzdyv7sybczgqhgd557m05dbwxzjznr0x41b180d";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.FileProviders.Physical";
-    version = "7.0.0";
-    sha256 = "1f1h0l47abw0spssd64qkhgd7b54pyzslyb586zp21milimcfmgv";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.FileSystemGlobbing";
-    version = "7.0.0";
-    sha256 = "1812vnkn8n0i4yr3k5azcxcfx1bbpcsmms95rdyxjfrzfksr05ai";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Logging";
-    version = "2.0.0";
-    sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Logging.Abstractions";
-    version = "2.0.0";
-    sha256 = "1x5isi71z02khikzvm7vaschb006pqqrsv86ky1x08a4hir4s43h";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Options";
-    version = "2.0.0";
-    sha256 = "0g4zadlg73f507krilhaaa7h0jdga216syrzjlyf5fdk25gxmjqh";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Options";
-    version = "7.0.0";
-    sha256 = "0b90zkrsk5dw3wr749rbynhpxlg4bgqdnd7d5vdlw2g9c7zlhgx6";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Options.ConfigurationExtensions";
-    version = "7.0.0";
-    sha256 = "1liyprh0zha2vgmqh92n8kkjz61zwhr7g16f0gmr297z2rg1j5pj";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Primitives";
-    version = "2.0.0";
-    sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb";
-  })
-  (fetchNuGet {
-    pname = "Microsoft.Extensions.Primitives";
-    version = "7.0.0";
-    sha256 = "1b4km9fszid9vp2zb3gya5ni9fn8bq62bzaas2ck2r7gs0sdys80";
-  })
-  (fetchNuGet {
-    pname = "Newtonsoft.Json";
-    version = "13.0.2";
-    sha256 = "1p9splg1min274dpz7xdfgzrwkyfd3xlkygwpr1xgjvvyjvs6b0i";
-  })
-  (fetchNuGet {
-    pname = "Sandreas.AudioMetadata";
-    version = "0.1.1";
-    sha256 = "11ibv23h7qj5qshibmlsqmjca51dqbhib9p1gz66c5kqhk7ci38j";
-  })
-  (fetchNuGet {
-    pname = "Sandreas.Files";
-    version = "1.1.2";
-    sha256 = "08qk229q2y1dpdxdnp8xi9mgk8fgpjxrxm4z6ak8n09npp67nhn0";
-  })
-  (fetchNuGet {
-    pname = "Sandreas.SpectreConsoleHelpers";
-    version = "0.0.2";
-    sha256 = "1vy2fka11n0smgrbwdxabl6cdcsg6fv1gymxrws8m0sf9qm64nd1";
-  })
-  (fetchNuGet {
-    pname = "Serilog";
-    version = "2.12.0";
-    sha256 = "0lqxpc96qcjkv9pr1rln7mi4y7n7jdi4vb36c2fv3845w1vswgr4";
-  })
-  (fetchNuGet {
-    pname = "Serilog.Extensions.Logging";
-    version = "3.1.0";
-    sha256 = "0lv370ks2fjdn1nsgkbzbmw6hybnincw3jabr471a5w39pp4fl1c";
-  })
-  (fetchNuGet {
-    pname = "Serilog.Settings.Configuration";
-    version = "3.4.0";
-    sha256 = "1l6fyy9y5a168i1mm107aqyrwzhqmpy0cp1v13l2b89yv8dc105j";
-  })
-  (fetchNuGet {
-    pname = "Serilog.Sinks.Console";
-    version = "4.1.0";
-    sha256 = "1rpkphmqfh3bv3m7v1zwz88wz4sirj4xqyff9ga0c6bqhblj6wii";
-  })
-  (fetchNuGet {
-    pname = "Serilog.Sinks.File";
-    version = "5.0.0";
-    sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q";
-  })
-  (fetchNuGet {
-    pname = "Spectre.Console";
-    version = "0.46.0";
-    sha256 = "1fr7090f2s7q9cw1k25m439blgicsbgl9k5nhqql9xvp0b00s4n9";
-  })
-  (fetchNuGet {
-    pname = "Spectre.Console.Cli";
-    version = "0.46.0";
-    sha256 = "00clv0mw97z8a9r7zam97prdv4ich33m4dhi7v8mjdqwwhj6q4jr";
-  })
-  (fetchNuGet {
-    pname = "System.IO.Abstractions";
-    version = "19.0.1";
-    sha256 = "16dasj8bwsdyl5phgqgfgswkbghzdb3sq7sidigr3b5ykna6n96g";
-  })
-  (fetchNuGet {
-    pname = "System.Memory";
-    version = "4.5.5";
-    sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h";
-  })
-  (fetchNuGet {
-    pname = "System.Runtime.CompilerServices.Unsafe";
-    version = "4.4.0";
-    sha256 = "0a6ahgi5b148sl5qyfpyw383p3cb4yrkm802k29fsi4mxkiwir29";
-  })
-  (fetchNuGet {
-    pname = "System.Runtime.CompilerServices.Unsafe";
-    version = "6.0.0";
-    sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc";
-  })
-  (fetchNuGet {
-    pname = "System.Text.Encodings.Web";
-    version = "7.0.0";
-    sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl";
-  })
-  (fetchNuGet {
-    pname = "System.Text.Json";
-    version = "4.6.0";
-    sha256 = "0ism236hwi0k6axssfq58s1d8lihplwiz058pdvl8al71hagri39";
-  })
-  (fetchNuGet {
-    pname = "System.Text.Json";
-    version = "7.0.0";
-    sha256 = "0scb0lp7wbgcinaa4kqiqs7b8i5nx4ppfad81138jiwd1sl37pyp";
-  })
-  (fetchNuGet {
-    pname = "System.Threading.Tasks.Extensions";
-    version = "4.5.4";
-    sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153";
-  })
-  (fetchNuGet {
-    pname = "TestableIO.System.IO.Abstractions";
-    version = "19.0.1";
-    sha256 = "01v2wgb6y2z7df4b2dsy0jb4hnhpv5kgyxypzyqdk7h6plad2axd";
-  })
-  (fetchNuGet {
-    pname = "TestableIO.System.IO.Abstractions.Wrappers";
-    version = "19.0.1";
-    sha256 = "1ms8wqar5w3z2y2qgxii9pqnsb4f1aikji2vaw01zxvnh2wry42n";
-  })
-  (fetchNuGet {
-    pname = "Ude.NetStandard";
-    version = "1.2.0";
-    sha256 = "074yff6g272zpkhk0zvmbfiaaxyp3b05fl24i7ffp2jf9r8bnfpl";
-  })
-  (fetchNuGet {
-    pname = "z440.atl.core";
-    version = "4.19.0";
-    sha256 = "16290hcf42yhs69ymjrg2znk7s56nnp4hj8rqwi1i8rdajmfr2v1";
-  })
-]
diff --git a/pkgs/by-name/to/tone/package.nix b/pkgs/by-name/to/tone/package.nix
index c6dc5daa0423..aa99542d139a 100644
--- a/pkgs/by-name/to/tone/package.nix
+++ b/pkgs/by-name/to/tone/package.nix
@@ -1,33 +1,47 @@
-{ lib, fetchFromGitHub, buildDotnetModule, ffmpeg-full, dotnetCorePackages }:
+{
+  lib,
+  fetchFromGitHub,
+  buildDotnetModule,
+  ffmpeg-full,
+  dotnetCorePackages,
+  versionCheckHook,
+}:
 
 buildDotnetModule rec {
   pname = "tone";
-  version = "0.1.5";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "sandreas";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-HhXyOPoDtraT7ef0kpE7SCQbvGFLrTddzS6Kdu0LxW4=";
+    repo = "tone";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NBFAPEeUKZgyfNlvcOBS1IpktEnI+fOd9WLj0ByzpLY=";
   };
 
   projectFile = "tone/tone.csproj";
   executables = [ "tone" ];
-  nugetDeps = ./nuget-deps.nix;
+  nugetDeps = ./deps.nix;
 
   dotnetInstallFlags = [
     "-p:PublishSingleFile=false"
   ];
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.sdk_8_0;
   runtimeDeps = [ ffmpeg-full ];
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
     homepage = "https://github.com/sandreas/tone";
     description = "Cross platform utility to dump and modify audio metadata for a wide variety of formats";
-    license = licenses.asl20;
-    maintainers = [ maintainers.jvanbruegge ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/sandreas/tone/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jvanbruegge jwillikers ];
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
     mainProgram = "tone";
   };
 }
diff --git a/pkgs/by-name/to/tone/update.sh b/pkgs/by-name/to/tone/update.sh
new file mode 100755
index 000000000000..1063f97cffb9
--- /dev/null
+++ b/pkgs/by-name/to/tone/update.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash nix nix-update git cacert
+set -eo pipefail
+
+prev_version=$(nix eval --raw -f. tone.version)
+nix-update tone
+[[ $(nix eval --raw -f. tone.version) == "$prev_version" ]] ||
+  "$(nix-build . -A tone.fetch-deps --no-out-link)"
diff --git a/pkgs/by-name/un/unison-fsmonitor/package.nix b/pkgs/by-name/un/unison-fsmonitor/package.nix
index 84d367285c02..c784772fb70e 100644
--- a/pkgs/by-name/un/unison-fsmonitor/package.nix
+++ b/pkgs/by-name/un/unison-fsmonitor/package.nix
@@ -1,25 +1,20 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "unison-fsmonitor";
-  version = "0.3.4";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "autozimu";
     repo = "unison-fsmonitor";
     rev = "v${version}";
-    hash = "sha256-U/KMKYqYVSeYBmW+PnXtvjnyUTjTJgtpwy1GPefqJOk=";
+    hash = "sha256-1W05b9s0Pg2LzNu0mFo/JKpPw0QORqZkXhbbSuCZIUo=";
   };
-  cargoHash = "sha256-eKRayFU3xq2uo6YeFqcTPLInZYlympH6Z01vOCVsVqQ=";
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
+  cargoHash = "sha256-i5FRTdilY1T25KefZjVS2aVQjfH6KrvO0c4Wwes6zYQ=";
 
   checkFlags = [
     # accesses /usr/bin/env
diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index da6d9ea8ff99..23c7b809d47e 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "24.4.3";
+  version = "24.4.4";
 
   outputs = [ "out" "dev" ];
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-XkW59tdVObwRc7bIGoAaOGoK8CyB/My9a0uOeez4DK8=";
+    hash = "sha256-5xtF+8ffHkuGADmeb+ltYuypKp4g3EawwtH2GDLrBco=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/by-name/vu/vuetorrent/package.nix b/pkgs/by-name/vu/vuetorrent/package.nix
index f49cfdc3e4fc..046bec502fa2 100644
--- a/pkgs/by-name/vu/vuetorrent/package.nix
+++ b/pkgs/by-name/vu/vuetorrent/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "vuetorrent";
-  version = "2.18.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "VueTorrent";
     repo = "VueTorrent";
     tag = "v${version}";
-    hash = "sha256-n5CtVNowGUsIHdxpnXmtXLpjwRfIoRoOr7Gh7PUE0ck=";
+    hash = "sha256-lT0KalQNn3SMSxY6baIuLph/OLNL3y2U9+eNw8r90yI=";
   };
 
-  npmDepsHash = "sha256-PfnZ61m8VulRm18R3aqnIPrCXAy0DOOCUPIgr2eFrbk=";
+  npmDepsHash = "sha256-GOBBZg9/e/XEKEJuW3ie9eOd7jTeid69aQRUddXOjC0=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/yu/yutto/package.nix b/pkgs/by-name/yu/yutto/package.nix
index ccb6e05c22cb..2efb925d0ca3 100644
--- a/pkgs/by-name/yu/yutto/package.nix
+++ b/pkgs/by-name/yu/yutto/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yutto";
-  version = "2.0.0-rc.5";
+  version = "2.0.0-rc.6";
   pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.9";
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
     owner = "yutto-dev";
     repo = "yutto";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QaApCkZtHjvGB6FOfic9wEH7rUlukwmxnrDaHkbvyJo=";
+    hash = "sha256-h7ziP3+qHUFs16MuUaUPZ7qspIFCIzExDyUEo12DJIE=";
   };
 
   build-system = with python3Packages; [ hatchling ];
diff --git a/pkgs/by-name/za/zapret/package.nix b/pkgs/by-name/za/zapret/package.nix
index f24357b98a04..faa83fd66712 100644
--- a/pkgs/by-name/za/zapret/package.nix
+++ b/pkgs/by-name/za/zapret/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret";
-  version = "69.5";
+  version = "69.8";
 
   src = fetchFromGitHub {
     owner = "bol-van";
     repo = "zapret";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-3wFNXtx9Yt40ahlikHbQWh2fUtJZrCNkqgJF1C+fsDo=";
+    hash = "sha256-5wylVEE1kqZdUxntRvXdLdnRMoZ1QhmdSJaLm5IVHLU=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ze/zenoh/package.nix b/pkgs/by-name/ze/zenoh/package.nix
index ae47bfbf2199..be0fe0d26297 100644
--- a/pkgs/by-name/ze/zenoh/package.nix
+++ b/pkgs/by-name/ze/zenoh/package.nix
@@ -78,6 +78,9 @@ rustPlatform.buildRustPackage rec {
     "--skip openclose_quic_only_connect_with_interface_restriction"
     "--skip openclose_tls_only_connect_with_interface_restriction"
     "--skip openclose_tls_only_listen_with_interface_restriction"
+
+    # This test fails on Hydra
+    "--skip authenticator_quic"
   ];
 
   passthru.tests.version = testers.testVersion {
diff --git a/pkgs/by-name/zs/zsh-autosuggestions-abbreviations-strategy/package.nix b/pkgs/by-name/zs/zsh-autosuggestions-abbreviations-strategy/package.nix
new file mode 100644
index 000000000000..f4fe40c75ba5
--- /dev/null
+++ b/pkgs/by-name/zs/zsh-autosuggestions-abbreviations-strategy/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "zsh-autosuggestions-abbreviations-strategy";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "olets";
+    repo = "zsh-autosuggestions-abbreviations-strategy";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-j2Xx8EWcSRntY7gqK9X1/rn3siZgNdL7ht4CyfAA+yY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install *.zsh -Dt "$out/share/zsh/site-functions/"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Have zsh-autosuggestions suggest your zsh-abbr abbreviations";
+    homepage = "https://github.com/olets/zsh-autosuggestions-abbreviations-strategy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ llakala ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/development/compilers/dart/package-source-builders/super_native_extensions/default.nix b/pkgs/development/compilers/dart/package-source-builders/super_native_extensions/default.nix
index 6877e75c0859..fab46776345a 100644
--- a/pkgs/development/compilers/dart/package-source-builders/super_native_extensions/default.nix
+++ b/pkgs/development/compilers/dart/package-source-builders/super_native_extensions/default.nix
@@ -27,6 +27,7 @@ let
             "mime_guess-2.0.4" = "sha256-KSw0YUTGqNEWY9pMvQplUGajJgoP2BRwVX6qZPpB2rI=";
           };
         };
+        _0_9_0-dev_5 = _0_8_22;
         _0_9_0-dev_3 = _0_8_22;
         _0_8_24 = _0_8_22;
         _0_8_21 = _0_8_22;
diff --git a/pkgs/development/php-packages/grumphp/default.nix b/pkgs/development/php-packages/grumphp/default.nix
index 41d10a3dd352..da9997afbc6b 100644
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@@ -6,16 +6,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "grumphp";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6SO5LUK39pEVcJqL86CwuyU7xpi8ydJxin5sHqBYwmg=";
+    hash = "sha256-cgrQ8cBe6pQVofcJK1l2Vylt1SESwy0pvW7BIFS6uuM=";
   };
 
-  vendorHash = "sha256-pupoPA4VZKACv4nPiRIwe1BOXojnnXrjKOpq0JGl9Uc=";
+  vendorHash = "sha256-lzrPVkklU8NOhq4G2bJLLv8IxcSma6jx4hEvCr0ufuA=";
 
   meta = {
     changelog = "https://github.com/phpro/grumphp/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/development/php-packages/rrd/default.nix b/pkgs/development/php-packages/rrd/default.nix
index 6df71d4be53e..4b5aa83a09ab 100644
--- a/pkgs/development/php-packages/rrd/default.nix
+++ b/pkgs/development/php-packages/rrd/default.nix
@@ -11,9 +11,12 @@ buildPecl {
   version = "2.0.3";
   hash = "sha256-pCFh5YzcioU7cs/ymJidy96CsPdkVt1ZzgKFTJK3MPc=";
 
+  buildInputs = [
+    rrdtool
+  ];
+
   nativeBuildInputs = [
     pkg-config
-    rrdtool
   ];
 
   meta = {
diff --git a/pkgs/development/php-packages/swoole/default.nix b/pkgs/development/php-packages/swoole/default.nix
index 7b52c838f473..b821906095c7 100644
--- a/pkgs/development/php-packages/swoole/default.nix
+++ b/pkgs/development/php-packages/swoole/default.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "5.1.2";
+  version = "6.0.0";
 in
 buildPecl {
   inherit version;
@@ -19,7 +19,7 @@ buildPecl {
     owner = "swoole";
     repo = "swoole-src";
     rev = "v${version}";
-    hash = "sha256-WTsntvauiooj081mOoFcK6CVpnCCR/cEQtJbsOIJ/wo=";
+    hash = "sha256-h49TMwtEaaRfQO69Z9sAPsCqLYt/w/6Vx9ZVBajAU5U=";
   };
 
   buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ valgrind ];
@@ -33,6 +33,5 @@ buildPecl {
     homepage = "https://www.swoole.com";
     license = lib.licenses.asl20;
     maintainers = lib.teams.php.members;
-    broken = lib.versionAtLeast php.version "8.4";
   };
 }
diff --git a/pkgs/development/php-packages/yaml/default.nix b/pkgs/development/php-packages/yaml/default.nix
index e3fec9a5d885..bb890a7fd350 100644
--- a/pkgs/development/php-packages/yaml/default.nix
+++ b/pkgs/development/php-packages/yaml/default.nix
@@ -1,7 +1,6 @@
 {
   buildPecl,
   lib,
-  pkg-config,
   libyaml,
 }:
 
@@ -13,8 +12,7 @@ buildPecl {
 
   configureFlags = [ "--with-yaml=${libyaml.dev}" ];
 
-  nativeBuildInputs = [
-    pkg-config
+  buildInputs = [
     libyaml
   ];
 
diff --git a/pkgs/development/python-modules/biliass/default.nix b/pkgs/development/python-modules/biliass/default.nix
index a0d3ed2b1e93..45a003269a63 100644
--- a/pkgs/development/python-modules/biliass/default.nix
+++ b/pkgs/development/python-modules/biliass/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "biliass";
-  version = "2.1.1";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yutto-dev";
     repo = "yutto";
     rev = "refs/tags/biliass@${version}";
-    hash = "sha256-Pn6z4iDxNcLVoY4xk7v0zc8hmajWEaOYFDEw5HEYxl4=";
+    hash = "sha256-IrzFjjMNuD5UgdccHxIxZoeZpM1PGtVQRTWHOocnmAU=";
   };
 
   sourceRoot = "source/packages/biliass";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
       src
       ;
     sourceRoot = "${sourceRoot}/${cargoRoot}";
-    hash = "sha256-7jv/Q98qyn2xnv4rNK9ifGhxo9n3X90iF9CTyqc6sHU=";
+    hash = "sha256-fXYjIJNrNQSXEACSa/FwxGlBYq5SxfIVIt4LtP0taFc=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 6a8ad2149346..509df1254d17 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.21.1";
+  version = "2.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_secret_manager";
     inherit version;
-    hash = "sha256-8QTwAnUTRcujkVLO867T9Dde3wslQsi9G3cS1E/pdbY=";
+    hash = "sha256-XdlaxiQ2h/hv2AMxbAdo9QcCiVi4ouabOqCs56xlS/Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/games/heroic/default.nix b/pkgs/games/heroic/default.nix
index 9f47e84a034c..d3a51d82cb6c 100644
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@@ -87,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
 
     substituteInPlace "$out/share/heroic/flatpak/com.heroicgameslauncher.hgl.desktop" \
+      --replace-fail "StartupWMClass=Heroic" "StartupWMClass=heroic" \
       --replace-fail "Exec=heroic-run" "Exec=heroic"
     mkdir -p "$out/share/applications" "$out/share/icons/hicolor/scalable/apps"
     ln -s "$out/share/heroic/flatpak/com.heroicgameslauncher.hgl.desktop" "$out/share/applications"
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index 107b36e5515e..4468157a8b73 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.8.1";
+  version = "11.8.2";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4966";
-    sha256 = "sha256-Vy7aKyMn3C2P3N9jdRayDu35+8jzvQv4rYIEsKdyWDU=";
+    rev = "4971";
+    sha256 = "sha256-liJIx2/TlIl9jcbyCzqhzuHAalmjJM3EtAceDIFa0rw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 11ddb3fbdce1..43001c04f72b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -685,7 +685,6 @@ mapAliases {
   lightdm_gtk_greeter = lightdm-gtk-greeter; # Added 2022-08-01
   lightstep-tracer-cpp = throw "lightstep-tracer-cpp is deprecated since 2022-08-29; the upstream recommends migration to opentelemetry projects.";
   limesctl = throw "limesctl has been removed because it is insignificant."; # Added 2024-11-25
-  linux_wallpaperengine = throw "linux_wallpaperengine was removed due to freeimage dependency"; # Added 2024-07-19
   lispPackages_new = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   lispPackages = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   lispPackagesFor = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07