diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 07bfe34b0cd4..984e63fd1115 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6173,6 +6173,13 @@
     githubId = 20759788;
     name = "JP Lippold";
   };
+  DrakeTDL = {
+    name = "Drake";
+    email = "draketdl@mailbox.org";
+    matrix = "@draketdl:matrix.org";
+    github = "DrakeTDL";
+    githubId = 22124013;
+  };
   dramaturg = {
     email = "seb@ds.ag";
     github = "dramaturg";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index d510c0773b6f..4b888f502d00 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -115,6 +115,8 @@
 
 - [Zipline](https://zipline.diced.sh/), a ShareX/file upload server that is easy to use, packed with features, and with an easy setup. Available as [services.zipline](#opt-services.zipline.enable).
 
+- [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
+
 - [Fider](https://fider.io/), an open platform to collect and prioritize feedback. Available as [services.fider](#opt-services.fider.enable).
 
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 4b8b3caecba6..26a2d23291bf 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1577,6 +1577,7 @@
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/sogo.nix
   ./services/web-apps/stirling-pdf.nix
+  ./services/web-apps/stash.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/vikunja.nix
diff --git a/nixos/modules/services/databases/foundationdb.md b/nixos/modules/services/databases/foundationdb.md
index 3cf17f1e6362..5e31497ae3cd 100644
--- a/nixos/modules/services/databases/foundationdb.md
+++ b/nixos/modules/services/databases/foundationdb.md
@@ -18,7 +18,7 @@ To enable FoundationDB, add the following to your
 ```nix
 {
   services.foundationdb.enable = true;
-  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.r3.x
+  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.3.x
 }
 ```
 
diff --git a/nixos/modules/services/mail/public-inbox.nix b/nixos/modules/services/mail/public-inbox.nix
index d709b0aac9de..385de9d95985 100644
--- a/nixos/modules/services/mail/public-inbox.nix
+++ b/nixos/modules/services/mail/public-inbox.nix
@@ -84,14 +84,7 @@ let
           ++ filter (x: x != null) [
             cfg.${proto}.cert or null
             cfg.${proto}.key or null
-          ]
-          ++
-            # Without confinement the whole Nix store
-            # is made available to the service
-            optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [
-              "${pkgs.dash}/bin/dash:/bin/sh"
-              builtins.storeDir
-            ];
+          ];
         # The following options are only for optimizing:
         # systemd-analyze security public-inbox-'*'
         AmbientCapabilities = "";
@@ -108,7 +101,7 @@ let
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectProc = "invisible";
-        #ProtectSystem = "strict";
+        ProtectSystem = "strict";
         RemoveIPC = true;
         RestrictAddressFamilies =
           [ "AF_UNIX" ]
@@ -130,28 +123,9 @@ let
           # Not removing @timer because git upload-pack needs it.
         ];
         SystemCallArchitectures = "native";
-
-        # The following options are redundant when confinement is enabled
-        RootDirectory = "/var/empty";
-        TemporaryFileSystem = "/";
-        PrivateMounts = true;
-        MountAPIVFS = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectControlGroups = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
       };
       confinement = {
-        # Until we agree upon doing it directly here in NixOS
-        # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447
-        # let the user choose to enable the confinement with:
-        # systemd.services.public-inbox-httpd.confinement.enable = true;
-        # systemd.services.public-inbox-imapd.confinement.enable = true;
-        # systemd.services.public-inbox-init.confinement.enable = true;
-        # systemd.services.public-inbox-nntpd.confinement.enable = true;
-        #enable = true;
+        enable = true;
         mode = "full-apivfs";
         # Inline::C needs a /bin/sh, and dash is enough
         binSh = "${pkgs.dash}/bin/dash";
diff --git a/nixos/modules/services/web-apps/stash.nix b/nixos/modules/services/web-apps/stash.nix
new file mode 100644
index 000000000000..60c8ad8a8eb4
--- /dev/null
+++ b/nixos/modules/services/web-apps/stash.nix
@@ -0,0 +1,585 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    toUpper
+    types
+    ;
+
+  cfg = config.services.stash;
+
+  stashType = types.submodule {
+    options = {
+      path = mkOption {
+        type = types.path;
+        description = "location of your media files";
+      };
+      excludevideo = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude video files from being scanned into Stash";
+      };
+      excludeimage = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude image files from being scanned into Stash";
+      };
+    };
+  };
+  stashBoxType = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        description = "The name of the Stash Box";
+      };
+      endpoint = mkOption {
+        type = types.str;
+        description = "URL to the Stash Box graphql api";
+      };
+      apikey = mkOption {
+        type = types.str;
+        description = "Stash Box API key";
+      };
+    };
+  };
+
+  recentlyReleased = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_released_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "date";
+    direction = "DESC";
+  };
+  recentlyAdded = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_added_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "created_at";
+    direction = "DESC";
+  };
+  uiPresets = {
+    recentlyReleasedScenes = recentlyReleased "Scenes";
+    recentlyAddedScenes = recentlyAdded "Scenes";
+    recentlyReleasedGalleries = recentlyReleased "Galleries";
+    recentlyAddedGalleries = recentlyAdded "Galleries";
+    recentlyAddedImages = recentlyAdded "Images";
+    recentlyReleasedMovies = recentlyReleased "Movies";
+    recentlyAddedMovies = recentlyAdded "Movies";
+    recentlyAddedStudios = recentlyAdded "Studios";
+    recentlyAddedPerformers = recentlyAdded "Performers";
+  };
+
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "config.yml" cfg.settings;
+  settingsType = types.submodule {
+    freeformType = settingsFormat.type;
+
+    options = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        example = "::1";
+        description = "The ip address that Stash should bind to.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 9999;
+        example = 1234;
+        description = "The port that Stash should listen on.";
+      };
+
+      stash = mkOption {
+        type = types.listOf stashType;
+        description = ''
+          Add directories containing your adult videos and images.
+          Stash will use these directories to find videos and/or images during scanning.
+        '';
+        example = literalExpression ''
+          {
+            stash = [
+              {
+                Path = "/media/drive/videos";
+                ExcludeImage = true;
+              }
+            ];
+          }
+        '';
+      };
+      stash_boxes = mkOption {
+        type = types.listOf stashBoxType;
+        default = [ ];
+        description = ''Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames'';
+        example = literalExpression ''
+          {
+            stash_boxes = [
+              {
+                name = "StashDB";
+                endpoint = "https://stashdb.org/graphql";
+                apikey = "aaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbb.cccccccccccccc";
+              }
+            ];
+          }
+        '';
+      };
+      ui.frontPageContent = mkOption {
+        description = "Search filters to display on the front page.";
+        type = types.either (types.listOf types.attrs) (types.functionTo (types.listOf types.attrs));
+        default = presets: [
+          presets.recentlyReleasedScenes
+          presets.recentlyAddedStudios
+          presets.recentlyReleasedMovies
+          presets.recentlyAddedPerformers
+          presets.recentlyReleasedGalleries
+        ];
+        example = literalExpression ''
+          presets: [
+            # To get the savedFilterId, you can query `{ findSavedFilters(mode: <FilterMode>) { id name } }` on localhost:9999/graphql
+            {
+              __typename = "SavedFilter";
+              savedFilterId = 1;
+            }
+            # basic custom filter
+            {
+              __typename = "CustomFilter";
+              title = "Random Scenes";
+              mode = "SCENES";
+              sortBy = "random";
+              direction = "DESC";
+            }
+            presets.recentlyAddedImages
+          ]
+        '';
+        apply = type: if builtins.isFunction type then (type uiPresets) else type;
+      };
+      blobs_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/blobs";
+        description = "Path to blobs";
+      };
+      cache = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/cache";
+        description = "Path to cache";
+      };
+      database = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/go.sqlite";
+        description = "Path to the SQLite database";
+      };
+      generated = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/generated";
+        description = "Path to generated files";
+      };
+      plugins_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/plugins";
+        description = "Path to scrapers";
+      };
+      scrapers_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/scrapers";
+        description = "Path to scrapers";
+      };
+
+      blobs_storage = mkOption {
+        type = types.enum [
+          "FILESYSTEM"
+          "DATABASE"
+        ];
+        default = "FILESYSTEM";
+        description = "Where to store blobs";
+      };
+      calculate_md5 = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to calculate MD5 checksums for scene video files";
+      };
+      create_image_clip_from_videos = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Create Image Clips from Video extensions when Videos are disabled in Library";
+      };
+      dangerous_allow_public_without_auth = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      gallery_cover_regex = mkOption {
+        type = types.str;
+        default = "(poster|cover|folder|board)\.[^\.]+$";
+        description = "Regex used to identify images as gallery covers";
+      };
+      no_proxy = mkOption {
+        type = types.str;
+        default = "localhost,127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12";
+        description = "A list of domains for which the proxy must not be used";
+      };
+      nobrowser = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should not auto-open a browser window on startup";
+      };
+      notifications_enabled = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should send notifications to the desktop";
+      };
+      parallel_tasks = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Number of parallel tasks to start during scan/generate";
+      };
+      preview_audio = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Include audio stream in previews";
+      };
+      preview_exclude_end = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of start of video to exclude when generating previews";
+      };
+      preview_exclude_start = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of end of video to exclude when generating previews";
+      };
+      preview_segment_duration = mkOption {
+        type = types.float;
+        default = 0.75;
+        description = "Preview segment duration, in seconds";
+      };
+      preview_segments = mkOption {
+        type = types.int;
+        default = 12;
+        description = "Number of segments in a preview file";
+      };
+      security_tripwire_accessed_from_public_internet = mkOption {
+        type = types.nullOr types.str;
+        default = "";
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      sequential_scanning = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Modifies behaviour of the scanning functionality to generate support files (previews/sprites/phash) at the same time as fingerprinting/screenshotting";
+      };
+      show_one_time_moved_notification = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray";
+      };
+      sound_on_preview = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable sound on mouseover previews";
+      };
+      theme_color = mkOption {
+        type = types.str;
+        default = "#202b33";
+        description = "Sets the `theme-color` property in the UI";
+      };
+      video_file_naming_algorithm = mkOption {
+        type = types.enum [
+          "OSHASH"
+          "MD5"
+        ];
+        default = "OSHASH";
+        description = "Hash algorithm to use for generated file naming";
+      };
+      write_image_thumbnails = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Write image thumbnails to disk when generating on the fly";
+      };
+    };
+  };
+
+  pluginType =
+    kind:
+    mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      description = ''
+        The ${kind} Stash should be started with.
+      '';
+      apply =
+        srcs:
+        optionalString (srcs != [ ]) (
+          pkgs.runCommand "stash-${kind}"
+            {
+              inherit srcs;
+              nativeBuildInputs = [ pkgs.yq-go ];
+              preferLocalBuild = true;
+            }
+            ''
+              find $srcs -mindepth 1 -name '*.yml' | while read plugin_file; do
+                grep -q "^#pkgignore" "$plugin_file" && continue
+
+                plugin_dir=$(dirname $plugin_file)
+                out_path=$out/$(basename $plugin_dir)
+                mkdir -p $out_path
+                ls $plugin_dir | xargs -I{} ln -sf "$plugin_dir/{}" $out_path
+
+                env \
+                  plugin_id=$(basename $plugin_file .yml) \
+                  plugin_name="$(yq '.name' $plugin_file)" \
+                  plugin_description="$(yq '.description' $plugin_file)" \
+                  plugin_version="$(yq '.version' $plugin_file)" \
+                  plugin_files="$(find -L $out_path -mindepth 1 -type f -printf "%P\n")" \
+                  yq -n '
+                    .id = strenv(plugin_id) |
+                    .name = strenv(plugin_name) |
+                    (
+                      strenv(plugin_description) as $desc |
+                      with(select($desc == "null"); .metadata = {}) |
+                      with(select($desc != "null"); .metadata.description = $desc)
+                    ) |
+                    (
+                      strenv(plugin_version) as $ver |
+                      with(select($ver == "null"); .version = "Unknown") |
+                      with(select($ver != "null"); .version = $ver)
+                    ) |
+                    .date = (now | format_datetime("2006-01-02 15:04:05")) |
+                    .files = (strenv(plugin_files) | split("\n"))
+                  ' > $out_path/manifest
+              done
+            ''
+        );
+    };
+in
+{
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = with lib.maintainers; [ DrakeTDL ];
+  };
+
+  options = {
+    services.stash = {
+      enable = mkEnableOption "stash";
+
+      package = mkPackageOption pkgs "stash" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "User under which Stash runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "Group under which Stash runs.";
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/stash";
+        description = "The directory where Stash stores its files.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Stash web interface.";
+      };
+
+      username = mkOption {
+        type = types.nullOr types.nonEmptyStr;
+        default = null;
+        example = "admin";
+        description = ''
+          Username for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.username`
+          ::
+
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/path/to/password/file";
+        description = ''
+          Path to file containing password for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.password`
+          ::
+
+        '';
+      };
+
+      jwtSecretKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret used to sign JWT tokens.";
+      };
+      sessionStoreKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret for session store.";
+      };
+
+      mutableSettings = mkOption {
+        description = ''
+          Whether the Stash config.yml is writeable by Stash.
+
+          If `false`, Any config changes done from within Stash UI will be temporary and reset to those defined in {option}`services.stash.settings` upon `Stash.service` restart.
+          If `true`, the {option}`services.stash.settings` will only be used to initialize the Stash configuration if it does not exist, and are subsequently ignored.
+        '';
+        type = types.bool;
+        default = true;
+      };
+      mutablePlugins = mkEnableOption "Whether plugins/themes can be installed, updated, uninstalled manually.";
+      mutableScrapers = mkEnableOption "Whether scrapers can be installed, updated, uninstalled manually.";
+      plugins = pluginType "plugins";
+      scrapers = pluginType "scrapers";
+
+      settings = mkOption {
+        type = settingsType;
+        description = "Stash configuration";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          !lib.xor (cfg.username != null || cfg.settings.username or null != null) (
+            cfg.passwordFile != null || cfg.settings.password or null != null
+          );
+        message = "You must set either both username and password, or neither.";
+      }
+    ];
+
+    services.stash.settings = {
+      username = mkIf (cfg.username != null) cfg.username;
+      plugins_path = mkIf (!cfg.mutablePlugins) cfg.plugins;
+      scrapers_path = mkIf (!cfg.mutableScrapers) cfg.scrapers;
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
+
+    users.users.${cfg.user} = {
+      inherit (cfg) group;
+      isSystemUser = true;
+      home = cfg.dataDir;
+    };
+    users.groups.${cfg.group} = { };
+
+    systemd = {
+      tmpfiles.settings."10-stash-datadir".${cfg.dataDir}."d" = {
+        inherit (cfg) user group;
+        mode = "0755";
+      };
+      services.stash = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        path = with pkgs; [
+          ffmpeg-full
+          python3
+          ruby
+        ];
+        environment.STASH_CONFIG_FILE = "${cfg.dataDir}/config.yml";
+        serviceConfig = {
+          DynamicUser = false;
+          User = cfg.user;
+          Group = cfg.group;
+          Restart = "on-failure";
+          WorkingDirectory = cfg.dataDir;
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/stash") (baseNameOf cfg.dataDir);
+          ExecStartPre = pkgs.writers.writeBash "stash-setup.bash" (
+            ''
+              install -d ${cfg.settings.generated}
+              if [[ ! -z "${toString cfg.mutableSettings}" || ! -f ${cfg.dataDir}/config.yml ]]; then
+                env \
+                  password=$(< ${cfg.passwordFile}) \
+                  jwtSecretKeyFile=$(< ${cfg.jwtSecretKeyFile}) \
+                  sessionStoreKeyFile=$(< ${cfg.sessionStoreKeyFile}) \
+                  ${lib.getExe pkgs.yq-go} '
+                    .jwt_secret_key = strenv(jwtSecretKeyFile) |
+                    .session_store_key = strenv(sessionStoreKeyFile) |
+                    (
+                      strenv(password) as $password |
+                      with(select($password != ""); .password = $password)
+                    )
+                  ' ${settingsFile} > ${cfg.dataDir}/config.yml
+              fi
+            ''
+            + optionalString cfg.mutablePlugins ''
+              install -d ${cfg.settings.plugins_path}
+              ls ${cfg.plugins} | xargs -I{} ln -sf '${cfg.plugins}/{}' ${cfg.settings.plugins_path}
+            ''
+            + optionalString cfg.mutableScrapers ''
+              install -d ${cfg.settings.scrapers_path}
+              ls ${cfg.scrapers} | xargs -I{} ln -sf '${cfg.scrapers}/{}' ${cfg.settings.scrapers_path}
+            ''
+          );
+          ExecStart = getExe cfg.package;
+
+          ProtectHome = "tmpfs";
+          BindReadOnlyPaths = mkIf (cfg.settings != { }) (map (stash: "${stash.path}") cfg.settings.stash);
+
+          # hardening
+
+          DevicePolicy = "auto"; # needed for hardware acceleration
+          PrivateDevices = false; # needed for hardware acceleration
+          AmbientCapabilities = [ "" ];
+          CapabilityBoundingSet = [ "" ];
+          ProtectSystem = "full";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProcSubset = "pid";
+          ProtectProc = "invisible";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@cpu-emulation"
+            "~@debug"
+            "~@mount"
+            "~@obsolete"
+            "~@privileged"
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5eb314dad4ea..93115adf7efe 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -982,6 +982,7 @@ in {
   stalwart-mail = handleTest ./stalwart-mail.nix {};
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = handleTest ./starship.nix {};
+  stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix {};
   static-web-server = handleTest ./web-servers/static-web-server.nix {};
   step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
   stratis = handleTest ./stratis {};
diff --git a/nixos/tests/public-inbox.nix b/nixos/tests/public-inbox.nix
index 9da906e57ae2..698dbf2eb799 100644
--- a/nixos/tests/public-inbox.nix
+++ b/nixos/tests/public-inbox.nix
@@ -10,11 +10,9 @@ import ./make-test-python.nix (
       install -D -t $out key.pem cert.pem
     '';
 
-    # Git repositories paths in Gitolite.
-    # Here only their baseNameOf is used for configuring public-inbox inboxes.
     gitRepositories = [
-      "user/repo1"
-      "user/repo2"
+      "repo1"
+      "repo2"
     ];
   in
   {
@@ -81,7 +79,7 @@ import ./make-test-python.nix (
           };
           inboxes =
             lib.recursiveUpdate
-              (lib.genAttrs (map baseNameOf gitRepositories) (repo: {
+              (lib.genAttrs gitRepositories (repo: {
                 address = [
                   # Routed to the "public-inbox:" transport in services.postfix.transport
                   "${repo}@${domain}"
@@ -106,7 +104,7 @@ import ./make-test-python.nix (
           settings.coderepo = lib.listToAttrs (
             map (
               repositoryName:
-              lib.nameValuePair (baseNameOf repositoryName) {
+              lib.nameValuePair repositoryName {
                 dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
                 cgitUrl = "https://git.${domain}/${repositoryName}.git";
               }
@@ -183,6 +181,12 @@ import ./make-test-python.nix (
     testScript = ''
       start_all()
 
+      # The threshold and/or hardening may have to be changed with new features/checks
+      with subtest("systemd hardening thresholds"):
+        print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager"))
+
       machine.wait_for_unit("multi-user.target")
       machine.wait_for_unit("public-inbox-init.service")
 
diff --git a/nixos/tests/stash.nix b/nixos/tests/stash.nix
new file mode 100644
index 000000000000..838a5e8a43c6
--- /dev/null
+++ b/nixos/tests/stash.nix
@@ -0,0 +1,80 @@
+import ./make-test-python.nix (
+  let
+    host = "127.0.0.1";
+    port = 1234;
+    dataDir = "/stash";
+  in
+  { pkgs, ... }:
+  {
+    name = "stash";
+    meta.maintainers = pkgs.stash.meta.maintainers;
+
+    nodes.machine = {
+      services.stash = {
+        inherit dataDir;
+        enable = true;
+
+        username = "test";
+        passwordFile = pkgs.writeText "stash-password" "MyPassword";
+
+        jwtSecretKeyFile = pkgs.writeText "jwt_secret_key" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        sessionStoreKeyFile = pkgs.writeText "session_store_key" "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+        plugins =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScripts";
+              rev = "9b6fac4934c2fac2ef0859ea68ebee5111fc5be5";
+              hash = "sha256-PO3J15vaA7SD4r/LyHlXjnpaeYAN9Q++O94bIWdz7OA=";
+            };
+          in
+          [
+            (pkgs.runCommand "stashNotes" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/plugins/stashNotes $out/plugins/stashNotes
+            '')
+            (pkgs.runCommand "Theme-Plex" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/themes/Theme-Plex $out/plugins/Theme-Plex
+            '')
+          ];
+
+        mutableScrapers = true;
+        scrapers =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScrapers";
+              rev = "2ece82d17ddb0952c16842b0775274bcda598d81";
+              hash = "sha256-AEmnvM8Nikhue9LNF9dkbleYgabCvjKHtzFpMse4otM=";
+            };
+          in
+          [
+            (pkgs.runCommand "FTV" { inherit src; } ''
+              mkdir -p $out/scrapers/FTV
+              cp -r $src/scrapers/FTV.yml $out/scrapers/FTV
+            '')
+          ];
+
+        settings = {
+          inherit host port;
+
+          stash = [ { path = "/srv"; } ];
+        };
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("stash.service")
+      machine.wait_for_open_port(${toString port}, "${host}")
+      machine.succeed("curl --fail http://${host}:${toString port}/")
+
+      with subtest("Test plugins/scrapers"):
+        with subtest("mutable plugins directory should not exist"):
+          machine.fail("test -d ${dataDir}/plugins")
+        with subtest("mutable scrapers directory should exist and scraper FTV should be linked"):
+          machine.succeed("test -L ${dataDir}/scrapers/FTV")
+    '';
+  }
+)
diff --git a/pkgs/applications/graphics/f3d/default.nix b/pkgs/applications/graphics/f3d/default.nix
index 924ff6866d92..4d1cb07a6e5a 100644
--- a/pkgs/applications/graphics/f3d/default.nix
+++ b/pkgs/applications/graphics/f3d/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "f3d";
-  version = "2.5.1";
+  version = "3.0.0";
 
   outputs = [ "out" ] ++ lib.optionals withManual [ "man" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "f3d-app";
     repo = "f3d";
     tag = "v${version}";
-    hash = "sha256-S3eigdW6rkDRSm4uCCTFHx5fhJGNVWpAAAKboougr08=";
+    hash = "sha256-mnDmo5qzdnElhvZwBmHL3xC2o8iLuvYyfZXHoaAUG08=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/kde/angelfish.nix b/pkgs/applications/kde/angelfish.nix
index 22b24f112ce9..43f1241c66ad 100644
--- a/pkgs/applications/kde/angelfish.nix
+++ b/pkgs/applications/kde/angelfish.nix
@@ -24,9 +24,6 @@
   rustPlatform,
   rustc,
   srcs,
-
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoSha256 ? "sha256-PSrTo7nGgH0KxA82RlBEwtOu80WMCBeaCxHj3n7SgEE=",
 }:
 
 mkDerivation rec {
@@ -40,11 +37,11 @@ mkDerivation rec {
     })
   ];
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     # include version in the name so we invalidate the FOD
     name = "${pname}-${srcs.angelfish.version}";
     inherit (srcs.angelfish) src;
-    sha256 = cargoSha256;
+    hash = "sha256-M3CtP7eWqOxMvnak6K3QvB/diu4jAfMmlsa6ySFIHCU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/googleearth-pro/default.nix b/pkgs/applications/misc/googleearth-pro/default.nix
index 237345d6a388..2b835255412d 100644
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@@ -9,6 +9,8 @@
   libGLU,
   libSM,
 
+  libXcomposite,
+  libXi,
   libXrender,
   libX11,
 
@@ -38,11 +40,11 @@ let
 in
 mkDerivation rec {
   pname = "googleearth-pro";
-  version = "7.3.6.9796";
+  version = "7.3.6.10201";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
-    sha256 = "sha256-Wv2jPGN7LC5T32WdX3W1BfGYrcXTNWTI1Wv+PmD0gNM=";
+    sha256 = "sha256-LqkXOSfE52+7x+Y0DBjYzvVKO0meytLNHuS/ia88FbI=";
   };
 
   nativeBuildInputs = [
@@ -63,6 +65,8 @@ mkDerivation rec {
     libGLU
     libSM
     libX11
+    libXcomposite
+    libXi
     libXrender
     libproxy
     libxcb
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index a91aa8851efd..171b67b75de9 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.0.3495.29";
+  version = "7.1.3570.39";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-GdywFoaxx2VSpOJ0FJIhFcIRDJEhozCWvYvdatmEi5o=";
-      x86_64-linux = "sha256-PNSGx2oCIbB3vaNFS+7coM9Xw+2qDELJBXX8zA1UC3Q=";
+      aarch64-linux = "sha256-rhIz+vX/W39sN/j37nhaq+iEbIc/rfgMprqmX+DM2D8=";
+      x86_64-linux = "sha256-d6NQRueNE9P2/IOLwBIm4evrqO0D+RNKUUC156PEgcc=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 158805acafab..364ac42cbf90 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -354,11 +354,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-mPNc65zah7HO3Knd44qxbwGgPp4LyxG76abBOV/1D3I=",
+    "hash": "sha256-JRBur7pH1niPZLN+5do6GiuoiSP18QsDZqWjlc9riek=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.46.1",
+    "rev": "v2.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/protonvpn-cli/default.nix b/pkgs/applications/networking/protonvpn-cli/default.nix
index a06d76503eb0..1d77b76825ea 100644
--- a/pkgs/applications/networking/protonvpn-cli/default.nix
+++ b/pkgs/applications/networking/protonvpn-cli/default.nix
@@ -6,6 +6,9 @@
   protonvpn-nm-lib,
   pythondialog,
   dialog,
+  wrapGAppsNoGuiHook,
+  gobject-introspection,
+  glib,
 }:
 
 buildPythonApplication rec {
@@ -22,12 +25,27 @@ buildPythonApplication rec {
     sha256 = "sha256-KhfogC23i7THe6YZJ6Sy1+q83vZupHsS69NurHCeo8I=";
   };
 
+  nativeBuildInputs = [
+    wrapGAppsNoGuiHook
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    glib
+  ];
+
   propagatedBuildInputs = [
     protonvpn-nm-lib
     pythondialog
     dialog
   ];
 
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+  ];
+
   # Project has a dummy test
   doCheck = false;
 
diff --git a/pkgs/applications/office/skrooge/default.nix b/pkgs/applications/office/skrooge/default.nix
index 48caac5889eb..e2f42460d99b 100644
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@@ -31,11 +31,11 @@
 
 mkDerivation rec {
   pname = "skrooge";
-  version = "2.33.0";
+  version = "25.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/skrooge/skrooge-${version}.tar.xz";
-    hash = "sha256-9K4/r3I9VNdUKHi4FCo0SxR+QzewvEKGOQevRM/r9GU=";
+    hash = "sha256-t8A9egotR2XoMBo5uoH2RBPEo3H6nPSJS5Oi4MkSVww=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index da6b2f40e62a..848a69a3f2cc 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -60,6 +60,7 @@ let
    "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
    "8.20.0".sha256   = "sha256-WFpZlA6CzFVAruPhWcHQI7VOBVhrGLdFzWrHW0DTSl0=";
    "8.20.1".sha256   = "sha256-nRaLODPG4E3gUDzGrCK40vhl4+VhPyd+/fXFK/HC3Ig=";
+   "9.0+rc1".sha256  = "sha256-TLq925HFdizxyHjKRMeHBH9rLRpLNUiVIfA1JSMgYXA=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index d596b8f936e2..d57582482670 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -1,104 +1,147 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, libunistring
-, harfbuzz, fontconfig, pkg-config, ncurses, imagemagick
-, libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor
-, libxkbcommon, libXi, libXext, wayland-protocols, wayland, xxHash
-, nerd-fonts
-, lcms2
-, librsync
-, openssl
-, installShellFiles
-, dbus
-, sudo
-, Libsystem
-, Cocoa
-, Kernel
-, UniformTypeIdentifiers
-, UserNotifications
-, libcanberra
-, libicns
-, wayland-scanner
-, libpng
-, python3
-, zlib
-, simde
-, bashInteractive
-, zsh
-, fish
-, nixosTests
-, go_1_23
-, buildGo123Module
-, nix-update-script
-, makeBinaryWrapper
-, autoSignDarwinBinariesHook
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+  libunistring,
+  harfbuzz,
+  fontconfig,
+  pkg-config,
+  ncurses,
+  imagemagick,
+  libstartup_notification,
+  libGL,
+  libX11,
+  libXrandr,
+  libXinerama,
+  libXcursor,
+  libxkbcommon,
+  libXi,
+  libXext,
+  wayland-protocols,
+  wayland,
+  xxHash,
+  nerd-fonts,
+  lcms2,
+  librsync,
+  openssl,
+  installShellFiles,
+  dbus,
+  sudo,
+  Libsystem,
+  Cocoa,
+  Kernel,
+  UniformTypeIdentifiers,
+  UserNotifications,
+  libcanberra,
+  libicns,
+  wayland-scanner,
+  libpng,
+  python3,
+  zlib,
+  simde,
+  bashInteractive,
+  zsh,
+  fish,
+  nixosTests,
+  go_1_23,
+  buildGo123Module,
+  nix-update-script,
+  makeBinaryWrapper,
+  autoSignDarwinBinariesHook,
 }:
 
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.38.1";
+  version = "0.39.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-0M4Bvhh3j9vPedE/d+8zaiZdET4mXcrSNUgLllhaPJw=";
+    hash = "sha256-4JlsIwQzCxs1i8Pvsj9KcJZpXbVkSzWtW7klatA0FOM";
   };
 
-  goModules = (buildGo123Module {
-    pname = "kitty-go-modules";
-    inherit src version;
-    vendorHash = "sha256-K12P81jE7oOU7qX2yQ+VtVHX/igKG0nPMSBkZ7wsR0o=";
-  }).goModules;
+  goModules =
+    (buildGo123Module {
+      pname = "kitty-go-modules";
+      inherit src version;
+      vendorHash = "sha256-Yahn+nlarPy4Yf1QmDminnHDqbe0+iJ6IsUKF0tioK4=";
+    }).goModules;
 
-  buildInputs = [
-    harfbuzz
-    ncurses
-    simde
-    lcms2
-    librsync
-    matplotlib
-    openssl.dev
-    xxHash
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    Kernel
-    UniformTypeIdentifiers
-    UserNotifications
-    libpng
-    python3
-    zlib
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    Libsystem
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fontconfig libunistring libcanberra libX11
-    libXrandr libXinerama libXcursor libxkbcommon libXi libXext
-    wayland-protocols wayland dbus libGL
-  ];
+  buildInputs =
+    [
+      harfbuzz
+      ncurses
+      simde
+      lcms2
+      librsync
+      matplotlib
+      openssl.dev
+      xxHash
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Cocoa
+      Kernel
+      UniformTypeIdentifiers
+      UserNotifications
+      libpng
+      python3
+      zlib
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+      Libsystem
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      fontconfig
+      libunistring
+      libcanberra
+      libX11
+      libXrandr
+      libXinerama
+      libXcursor
+      libxkbcommon
+      libXi
+      libXext
+      wayland-protocols
+      wayland
+      dbus
+      libGL
+    ];
 
-  nativeBuildInputs = [
-    installShellFiles
-    ncurses
-    pkg-config
-    sphinx
-    furo
-    sphinx-copybutton
-    sphinxext-opengraph
-    sphinx-inline-tabs
-    go_1_23
-    fontconfig
-    makeBinaryWrapper
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    imagemagick
-    libicns  # For the png2icns tool.
-    autoSignDarwinBinariesHook
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    wayland-scanner
-  ];
+  nativeBuildInputs =
+    [
+      installShellFiles
+      ncurses
+      pkg-config
+      sphinx
+      furo
+      sphinx-copybutton
+      sphinxext-opengraph
+      sphinx-inline-tabs
+      go_1_23
+      fontconfig
+      makeBinaryWrapper
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      imagemagick
+      libicns # For the png2icns tool.
+      autoSignDarwinBinariesHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      wayland-scanner
+    ];
 
   depsBuildBuild = [ pkg-config ];
 
-  outputs = [ "out" "terminfo" "shell_integration" "kitten" ];
+  outputs = [
+    "out"
+    "terminfo"
+    "shell_integration"
+    "kitten"
+  ];
 
   patches = [
     # Gets `test_ssh_env_vars` to pass when `bzip2` is in the output of `env`.
@@ -130,49 +173,58 @@ buildPythonApplication rec {
     cp -r --reflink=auto $goModules vendor
   '';
 
-  buildPhase = let
-    commonOptions = ''
-      --update-check-interval=0 \
-      --shell-integration=enabled\ no-rc
+  buildPhase =
+    let
+      commonOptions = ''
+        --update-check-interval=0 \
+        --shell-integration=enabled\ no-rc
+      '';
+      darwinOptions = ''
+        --disable-link-time-optimization \
+        ${commonOptions}
+      '';
+    in
+    ''
+      runHook preBuild
+
+      # Add the font by hand because fontconfig does not finds it in darwin
+      mkdir ./fonts/
+      cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+
+      ${
+        if stdenv.hostPlatform.isDarwin then
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
+            make docs
+            ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
+          ''
+        else
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
+            --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
+            --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
+            --canberra-library='${libcanberra}/lib/libcanberra.so' \
+            --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
+            ${commonOptions}
+            ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
+          ''
+      }
+      runHook postBuild
     '';
-    darwinOptions = ''
-      --disable-link-time-optimization \
-      ${commonOptions}
-    '';
-  in ''
-    runHook preBuild
 
-    # Add the font by hand because fontconfig does not finds it in darwin
-    mkdir ./fonts/
-    cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+  nativeCheckInputs =
+    [
+      pillow
 
-    ${if stdenv.hostPlatform.isDarwin then ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
-      make docs
-      ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
-    '' else ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
-      --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
-      --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
-      --canberra-library='${libcanberra}/lib/libcanberra.so' \
-      --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
-      ${commonOptions}
-      ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
-    ''}
-    runHook postBuild
-  '';
-
-  nativeCheckInputs = [
-    pillow
-
-    # Shells needed for shell integration tests
-    bashInteractive
-    zsh
-    fish
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    # integration tests need sudo
-    sudo
-  ];
+      # Shells needed for shell integration tests
+      bashInteractive
+      zsh
+      fish
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      # integration tests need sudo
+      sudo
+    ];
 
   # skip failing tests due to darwin sandbox
   preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -186,49 +238,61 @@ buildPythonApplication rec {
   '';
 
   checkPhase = ''
-      runHook preCheck
+    runHook preCheck
 
-      # Fontconfig error: Cannot load default config file: No such file: (null)
-      export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
+    # Fontconfig error: Cannot load default config file: No such file: (null)
+    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
 
-      # Required for `test_ssh_shell_integration` to pass.
-      export TERM=kitty
+    # Required for `test_ssh_shell_integration` to pass.
+    export TERM=kitty
 
-      make test
-      runHook postCheck
-    '';
+    make test
+    runHook postCheck
+  '';
 
   installPhase = ''
     runHook preInstall
     mkdir -p "$out"
     mkdir -p "$kitten/bin"
-    ${if stdenv.hostPlatform.isDarwin then ''
-    mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
-    cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
-    mkdir "$out/Applications"
-    cp -r kitty.app "$out/Applications/kitty.app"
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir "$out/bin"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
+          cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
+          mkdir "$out/Applications"
+          cp -r kitty.app "$out/Applications/kitty.app"
 
-    installManPage 'docs/_build/man/kitty.1'
-    '' else ''
-    cp -r linux-package/{bin,share,lib} "$out"
-    cp linux-package/bin/kitten "$kitten/bin/kitten"
-    ''}
+          installManPage 'docs/_build/man/kitty.1'
+        ''
+      else
+        ''
+          cp -r linux-package/{bin,share,lib} "$out"
+          cp linux-package/bin/kitten "$kitten/bin/kitten"
+        ''
+    }
 
     # dereference the `kitty` symlink to make sure the actual executable
     # is wrapped on macOS as well (and not just the symlink)
-    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick ncurses.dev ]}"
+    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${
+      lib.makeBinPath [
+        imagemagick
+        ncurses.dev
+      ]
+    }"
 
     installShellCompletion --cmd kitty \
       --bash <("$out/bin/kitty" +complete setup bash) \
       --fish <("$out/bin/kitty" +complete setup fish2) \
       --zsh  <("$out/bin/kitty" +complete setup zsh)
 
-    terminfo_src=${if stdenv.hostPlatform.isDarwin then
-      ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
+    terminfo_src=${
+      if stdenv.hostPlatform.isDarwin then
+        ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
       else
-      "$out/share/terminfo"}
+        "$out/share/terminfo"
+    }
 
     mkdir -p $terminfo/share
     mv "$terminfo_src" $terminfo/share/terminfo
@@ -245,12 +309,12 @@ buildPythonApplication rec {
     tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
       default = nixosTests.terminal-emulators.kitty;
     };
-    updateScript = nix-update-script {};
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
     homepage = "https://github.com/kovidgoyal/kitty";
-    description = "Modern, hackable, featureful, OpenGL based terminal emulator";
+    description = "The fast, feature-rich, GPU based terminal emulator";
     license = licenses.gpl3Only;
     changelog = [
       "https://sw.kovidgoyal.net/kitty/changelog/"
@@ -258,6 +322,11 @@ buildPythonApplication rec {
     ];
     platforms = platforms.darwin ++ platforms.linux;
     mainProgram = "kitty";
-    maintainers = with maintainers; [ tex rvolosatovs Luflosi kashw2 ];
+    maintainers = with maintainers; [
+      tex
+      rvolosatovs
+      Luflosi
+      kashw2
+    ];
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
index 73e258f42a1b..1806e8732199 100644
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@@ -16,20 +16,20 @@ let
   bento4 = fetchFromGitHub {
     owner = "xbmc";
     repo = "Bento4";
-    rev = "1.6.0-641-${rel}";
-    sha256 = "sha256-vsFMDzH8JJecYw0qWKGCxnd/m5wn62mCKE2g2HwQhwI=";
+    tag = "1.6.0-641-3-${rel}";
+    hash = "sha256-ycWQvXgr1DQ3Wng73S8i6y6XmcUD/iN8OKfO1czgsnY=";
   };
 in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "21.4.6";
+  version = "21.5.9";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
-    rev = "${version}-${rel}";
-    sha256 = "sha256-ub4ep89datfr8aZLZAfoz7zhOizGFpzgp2PVON6Ptj8=";
+    tag = "${version}-${rel}";
+    hash = "sha256-OArvp/MgJGsRs3Z59JfgOkfwyhQ3ArC1yf37z7Y7khg=";
   };
 
   extraCMakeFlags = [
diff --git a/pkgs/by-name/ab/abracadabra/package.nix b/pkgs/by-name/ab/abracadabra/package.nix
index e597a3807d03..e85628db8764 100644
--- a/pkgs/by-name/ab/abracadabra/package.nix
+++ b/pkgs/by-name/ab/abracadabra/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abracadabra";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     rev = "v${version}";
-    hash = "sha256-T2l5wjE62xBb55IzKzInf/K4VPOuZ68vp5VxS0vIn+I=";
+    hash = "sha256-3sjN62SWl5Xpb2cP108IFqCuJAo8JLOCLxJENCrq8wI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ba/bazecor/package.nix b/pkgs/by-name/ba/bazecor/package.nix
index bce13edccf9b..7d573d478c1f 100644
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@@ -6,12 +6,12 @@
 }:
 let
   pname = "bazecor";
-  version = "1.6.1";
+  version = "1.6.2";
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-Qf9FqHgTSCD2rYp8PC/gYHyiYcfFTJJmG4oRK/bch8Y=";
+      hash = "sha256-FfowCbnhGI0sglFvxf7ActUJC9Lsj97Ui08nObBnjoE=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index 8142273039bb..53ca357bbd6e 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-vQhKvL9vRUq7WqtJ25v12DuCzO90bgXLmwu2Mm1jbig=";
+    hash = "sha256-oAtAfoWJ4YZ9YcU7DQtj6QqF1DSEMOUjauQxqo1a6GA=";
   };
 
-  cargoHash = "sha256-Gm72Hr+bVmNwdFAIsAatTcF9Il6JG2i6dQPu1ZQy46o=";
+  cargoHash = "sha256-+mrPrYk/qj4UtbUgFIFS0XUp25uLs8fNhvSzx1nu1ng=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ch/chawan/package.nix b/pkgs/by-name/ch/chawan/package.nix
index cf5c642e87e1..6463f47f429a 100644
--- a/pkgs/by-name/ch/chawan/package.nix
+++ b/pkgs/by-name/ch/chawan/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation {
   pname = "chawan";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-01-06";
 
   src = fetchFromSourcehut {
     owner = "~bptato";
     repo = "chawan";
-    rev = "93033c2c382aaff01b1aba6f5db7652c35708bf3";
-    hash = "sha256-MEOIu1CI/VTvd2cixa57Tv1xtBMXiMdD37ZYjAlg5S4=";
+    rev = "30a933adb2bade2ceee08a9b36371cecf554d648";
+    hash = "sha256-EepSEN66GTdWfCSiR/p69pN5bvTEiUFOMErCxedrq+g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 11f8d65e671d..5d4fa5cd1766 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-01-12";
+  version = "0.4.0-unstable-2025-01-22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "fc94f14823f3257961c4d0e144083fe6f397ad55";
-    hash = "sha256-J1Hhz6M1VhfIttz9lJnPNQsOJbzKBrb6Yz154oh3moo=";
+    rev = "470a8a0a5c5a878a72233339998f2e527dd32ff2";
+    hash = "sha256-H5N4YahSoMeKC+j6D6xj0MrZFUqcupvuqnahKhrq+sU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clog-cli/package.nix b/pkgs/by-name/cl/clog-cli/package.nix
index 06c498f6762d..3bec43a212ef 100644
--- a/pkgs/by-name/cl/clog-cli/package.nix
+++ b/pkgs/by-name/cl/clog-cli/package.nix
@@ -6,16 +6,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clog-cli";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "clog-tool";
     repo = "clog-cli";
-    rev = "v${version}";
-    sha256 = "1wxglc4n1dar5qphhj5pab7ps34cjr7jy611fwn72lz0f6c7jp3z";
+    # Tag seems to be missing:
+    # https://github.com/clog-tool/clog-cli/issues/128
+    rev = "7066cba2bcbaea0f62ea22c320d48dac20f36a38";
+    sha256 = "sha256-d1csT7iHf48kLkn6/cGhoIoEN/kiYc6vlUwHDNmbnMI=";
   };
 
-  cargoHash = "sha256-yjBgccrkG2D8ZW3Uju4XUhz9Kar50jkJZ75MWhn9j3U=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-b8/n3y6fTqP5+rZySEDEb8Z5DPHQ2jUasp5SvaJJlGo=";
 
   meta = {
     description = "Generate changelogs from local git metadata";
@@ -24,7 +27,5 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.nthorne ];
     mainProgram = "clog";
-    # error: could not compile `rustc-serialize`
-    broken = true; # Added 2024-03-16
   };
 }
diff --git a/pkgs/by-name/cl/clorinde/package.nix b/pkgs/by-name/cl/clorinde/package.nix
index e9b5c0efc990..7cd746071be6 100644
--- a/pkgs/by-name/cl/clorinde/package.nix
+++ b/pkgs/by-name/cl/clorinde/package.nix
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-Nqf0NNjE3gu+75tjMKAY3Wn75PiPwpnXgXtzdhqx7u8=";
   };
 
-  cargoHash = "sha256-OLA9n7MBN5Fz3D3MJLb6PoEksO5Da2mp5h8pti2/lpA=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ssyx72o/eTcFClLyl4QJ71okqKU2k6SZVH0eGEFzIjs=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 
diff --git a/pkgs/by-name/cn/cnijfilter_4_00/package.nix b/pkgs/by-name/cn/cnijfilter_4_00/package.nix
index 4ae5a908bf87..16ff7195b2fd 100644
--- a/pkgs/by-name/cn/cnijfilter_4_00/package.nix
+++ b/pkgs/by-name/cn/cnijfilter_4_00/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  gcc13Stdenv,
   lib,
   fetchzip,
   autoconf,
@@ -21,6 +21,7 @@
 */
 
 let
+  stdenv = gcc13Stdenv;
   arch =
     if stdenv.hostPlatform.system == "x86_64-linux" then
       "64"
diff --git a/pkgs/by-name/co/codespell/package.nix b/pkgs/by-name/co/codespell/package.nix
index d46e98116855..6f92315c87c9 100644
--- a/pkgs/by-name/co/codespell/package.nix
+++ b/pkgs/by-name/co/codespell/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "codespell";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "codespell-project";
     repo = "codespell";
-    rev = "v${version}";
-    sha256 = "sha256-X3Pueu0E7Q57sbKSXqCZki4/PUb1WyWk/Zmj+lhVTM8=";
+    tag = "v${version}";
+    sha256 = "sha256-TZH3+ZzsThh0GDtiSU1ZEStmCHmEuNDrk/Vyc8E2ESI=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/dw/dwfv/package.nix b/pkgs/by-name/dw/dwfv/package.nix
deleted file mode 100644
index fd1dee205734..000000000000
--- a/pkgs/by-name/dw/dwfv/package.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchCrate,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "dwfv";
-  version = "0.4.1";
-
-  src = fetchCrate {
-    inherit version pname;
-    hash = "sha256-JzOD0QQfDfIkJQATxGpyJBrFg5l6lkkAXY2qv9bir3c=";
-  };
-
-  cargoHash = "sha256-nmnpHz9sCRlxOngcSrW+oktYIKM/A295/a03fUf3ofw=";
-
-  meta = with lib; {
-    description = "Simple digital waveform viewer with vi-like key bindings";
-    mainProgram = "dwfv";
-    homepage = "https://github.com/psurply/dwfv";
-    license = licenses.mit;
-    maintainers = with maintainers; [ newam ];
-  };
-}
diff --git a/pkgs/by-name/ei/eigenmath/package.nix b/pkgs/by-name/ei/eigenmath/package.nix
index d649a87dc080..ca38f2c07b96 100644
--- a/pkgs/by-name/ei/eigenmath/package.nix
+++ b/pkgs/by-name/ei/eigenmath/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "337-unstable-2024-12-20";
+  version = "337-unstable-2025-01-25";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "571412786696680e1e04909e90e77d9d39b10b2a";
-    hash = "sha256-7/5UsU5TSW++MROWuUTsAptkv7gcqhvcqaRHYzXswB8=";
+    rev = "ae71bdf698283760ad3ac74ce57158f25c8d9198";
+    hash = "sha256-vmbujai7xW4U6fmsp4Gv63Tl3AcxOUsUA2rPTfFL3ZQ=";
   };
 
   checkPhase =
diff --git a/pkgs/by-name/fa/fastd/package.nix b/pkgs/by-name/fa/fastd/package.nix
index d49bdb7e5da3..bb883d23549e 100644
--- a/pkgs/by-name/fa/fastd/package.nix
+++ b/pkgs/by-name/fa/fastd/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fastd";
-  version = "22";
+  version = "23";
 
   src = fetchFromGitHub {
-    owner = "Neoraider";
+    owner = "neocturne";
     repo = "fastd";
     rev = "v${version}";
-    sha256 = "0qni32j7d3za9f87m68wq8zgalvfxdrx1zxi6l4x7vvmpcw5nhpq";
+    sha256 = "sha256-Sz6VEjKziL/w2a4VWFfMPDYvm7UZh5A/NmzP10rJ2r8=";
   };
 
   nativeBuildInputs = [
@@ -59,7 +59,10 @@ stdenv.mkDerivation rec {
       bsd3
     ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [
+      fpletz
+      herbetom
+    ];
     mainProgram = "fastd";
   };
 }
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index 39d4044ebc44..e5bd1138f0fc 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.34.1";
+  version = "2.35.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-kCSRS2GD58HS9Qdrv7ju8b7IGznBsP1IIAvvzkWPaLk=";
+    hash = "sha256-ChuK5DHRj1qJIjRo3oB5gdCxox2mDffCVM0wRGc5t1o=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index 26fd8b7a29e1..5a7977b97a60 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -8,20 +8,20 @@
 
 buildNpmPackage rec {
   pname = "flood";
-  version = "4.8.5";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "jesec";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lm+vPo7V99OSUAVEvdiTNMlD/+iHGPIyPLc1WzO1aTU=";
+    hash = "sha256-R8OWr9jsD6KZ3P827plCTSLcVrrFEdutmlZNwqXJNfU=";
   };
 
   npmConfigHook = pnpm_9.configHook;
   npmDeps = pnpmDeps;
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-NuU9O3bEboxmuEuk1WSUeZRNgVK5cwFiUAN3+7vACGw=";
+    hash = "sha256-6YW2m7siLzHiAFEpidQS5okhjsY9qNm+Ro8mHex1/No=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 0c90386fc63d..9dfdfa9628b8 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.3.61";
+  version = "0.3.68";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-YGUjEK8Yvb1S879MNQ/gJYNG4DjFMTL2VHE/m5KLoE0=";
+    hash = "sha256-6/84MC7wmMCfCtuV0HJ/zMG96RO55LQxudejI5exVAM=";
   };
 
-  vendorHash = "sha256-SqG5JJ2l71+fQirsg51hjr5sFHQzzH3U+acJMaN5W0c=";
+  vendorHash = "sha256-aKDziIx0xyWOczc9G0YQ7mdWdc5cWHjpjTDyJMsFriM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fo/fortune/package.nix b/pkgs/by-name/fo/fortune/package.nix
index bb0233f4b615..33e607f389a7 100644
--- a/pkgs/by-name/fo/fortune/package.nix
+++ b/pkgs/by-name/fo/fortune/package.nix
@@ -6,6 +6,7 @@
   recode,
   perl,
   rinutils,
+  fortune,
   withOffensive ? false,
 }:
 
@@ -20,11 +21,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Hzh4dyVOleq2H5NyV7QmCfKbmU7wVxUxZVu/w6KsdKw=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    perl
-    rinutils
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      perl
+      rinutils
+    ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      # "strfile" must be in PATH for cross-compiling builds.
+      fortune
+    ];
 
   buildInputs = [ recode ];
 
diff --git a/pkgs/by-name/gh/gh-markdown-preview/package.nix b/pkgs/by-name/gh/gh-markdown-preview/package.nix
index 4b67ddbc19a6..65191d3e44c6 100644
--- a/pkgs/by-name/gh/gh-markdown-preview/package.nix
+++ b/pkgs/by-name/gh/gh-markdown-preview/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-qvR23dXj+ERf5yhVbsJ3XcdePaAwuDvdya1zr5wtNsQ=";
+    hash = "sha256-5jxGFZqYkhFQ4Rx4jbI+fes9ezsuXa+VZowk5Jzhi3I=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
diff --git a/pkgs/by-name/gl/glaze/package.nix b/pkgs/by-name/gl/glaze/package.nix
index d441faa36428..610a0c27a887 100644
--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (final: {
   pname = "glaze";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "stephenberry";
     repo = "glaze";
     rev = "v${final.version}";
-    hash = "sha256-iFFc2FjcvlQqvjXvFZ+J3RTEIritSM6AZXQlLE5YF9A=";
+    hash = "sha256-AIPsujIJl0LXK6p+GttyjDsXJ0595jl/2Y3adzv2TvE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 5d1f79fd4144..c4bbad05fdcf 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -5,19 +5,20 @@
   fetchFromGitHub,
   nix-update-script,
   glibcLocales,
+  versionCheckHook,
   withPostgresAdapter ? true,
   withBigQueryAdapter ? true,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "harlequin";
-  version = "1.25.2-unstable-2024-12-30";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tconbeer";
     repo = "harlequin";
-    rev = "7ef5327157c7617c1032c9128b487b32d1c91fea";
-    hash = "sha256-QoIjEfQgN6YWDDor4PxfeFkkFGAidUC0ZvHy+PqgnWs=";
+    tag = "v${version}";
+    hash = "sha256-IUzN+rWL69TUUS9npcmfSAPqy/8SYNusNAN/muCMqNI=";
   };
 
   pythonRelaxDeps = [
@@ -65,15 +66,11 @@ python3Packages.buildPythonApplication rec {
     export HOME=$(mktemp -d)
   '';
 
-  nativeCheckInputs =
-    [
-      # FIX: restore on next release
-      # versionCheckHook
-    ]
-    ++ (with python3Packages; [
-      pytest-asyncio
-      pytestCheckHook
-    ]);
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+    versionCheckHook
+  ];
 
   disabledTests =
     [
diff --git a/pkgs/by-name/hc/hcdiag/package.nix b/pkgs/by-name/hc/hcdiag/package.nix
index ba8545996246..d431440c135a 100644
--- a/pkgs/by-name/hc/hcdiag/package.nix
+++ b/pkgs/by-name/hc/hcdiag/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "hcdiag";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "hcdiag";
     tag = "v${version}";
-    hash = "sha256-ZzSGBw7DRh/VSDtXoMgJpGWVmJUF2G2yZaae+fKklMc=";
+    hash = "sha256-MY1qaVm1PRB3A+MPz4rVUS+Kn4O4p9yzn/3DHKvhZkk=";
   };
 
-  vendorHash = "sha256-MJg6mqG1bn941LqIr0TQhcgWBCwUtfujdpqf4rgCrWM=";
+  vendorHash = "sha256-09I5Hsw7EhZZAvG7TnJNID/lVv0FVM3ejsmzy3GK48g=";
 
   nativeInstallCheckHooks = [
     versionCheckHook
diff --git a/pkgs/by-name/ja/jazz2/package.nix b/pkgs/by-name/ja/jazz2/package.nix
index 46fc1886e095..75b64b0001ca 100644
--- a/pkgs/by-name/ja/jazz2/package.nix
+++ b/pkgs/by-name/ja/jazz2/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jazz2";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "deathkiller";
     repo = "jazz2-native";
     rev = finalAttrs.version;
-    hash = "sha256-t1bXREL/WWnYnSfCyAY5tus/Bq5V4HVHg9s7oltGoIg=";
+    hash = "sha256-bPVCowop8bocUEXTQI5X4+6FgddKVOMfaXTrbvjrnjI=";
   };
 
   patches = [ ./nocontent.patch ];
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index 287ebd2909a4..589d7a0a7f8b 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -19,7 +19,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.38.0";
+  version = "1.39.0";
   outputs =
     [
       "out"
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage rec {
     owner = "casey";
     repo = pname;
     tag = version;
-    hash = "sha256-jIc8+SFAcH2TsY12+txwlMoJmpDdDpC0H+UrjYH61Lk=";
+    hash = "sha256-K2MUS6wo0qxJnnIWDdmxHRNwyzx1z7yscVwMzXKAwQA=";
   };
 
-  cargoHash = "sha256-JHLkjMy5b1spJrAqFCCzqgnlYTAKA1Z9Tx4w1WWuiAI=";
+  cargoHash = "sha256-omojDIFfkK1fAxFMe+3B7k6Wfk4/Eaqdv0NcCd8b1ks=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix
index 74f650074bdf..ce5a99532b7c 100644
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kdlfmt";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
     rev = "v${version}";
-    hash = "sha256-XqcexHeXXVfNoIu0h0Ooxlkm/FaDh/ctkH3cod1mlwY=";
+    hash = "sha256-OldgEAGvwXBnLIEVI/jGXV9lFp/Ua+n8cQqSWETn3T4=";
   };
 
-  cargoHash = "sha256-ZlaILIVG3gLVFGqv1cozDtbHcL+dxUJXq/DvuJ077O8=";
+  cargoHash = "sha256-Pxs/ITGSU3WErcUgjnehCzuqkeC6M7x2mM/sU00djUw=";
 
   meta = {
     description = "Formatter for kdl documents";
diff --git a/pkgs/by-name/ki/kissat/package.nix b/pkgs/by-name/ki/kissat/package.nix
index 0c08689cb508..94c54694dee6 100644
--- a/pkgs/by-name/ki/kissat/package.nix
+++ b/pkgs/by-name/ki/kissat/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kissat";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "arminbiere";
     repo = "kissat";
     rev = "rel-${version}";
-    sha256 = "sha256-+y9TlSEgnMTtRT9F6OBSle9OqGfljChcHOFJ5lgwjyk=";
+    sha256 = "sha256-XVaWO1zHMXM83Qih3HnmIsOvM1zpefF6u9lBP420/mQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index e61da193bcc1..d6ce30fd1752 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -40,13 +40,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.81.1";
+  version = "1.82.4";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ndi7EQ4Idh946iQuf1mFluLh+9SEfTRtIu8uYN9uHpE=";
+    hash = "sha256-ObQJS6ZRdtSCTAQCq8w3gLDa1Z8z++JgDmyedTXB1F8=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/libloragw-2g4/package.nix b/pkgs/by-name/li/libloragw-2g4/package.nix
index 204e59e3810a..a68ffa732f47 100644
--- a/pkgs/by-name/li/libloragw-2g4/package.nix
+++ b/pkgs/by-name/li/libloragw-2g4/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   preBuild = ''
-    make -C libtools
+    make -C libtools CROSS_COMPILE=${stdenv.cc.targetPrefix}
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/li/libloragw-sx1302/package.nix b/pkgs/by-name/li/libloragw-sx1302/package.nix
index a9466226ae1b..47f4629b2fc9 100644
--- a/pkgs/by-name/li/libloragw-sx1302/package.nix
+++ b/pkgs/by-name/li/libloragw-sx1302/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   preBuild = ''
-    make -C libtools
+    make -C libtools CROSS_COMPILE=${stdenv.cc.targetPrefix}
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/lo/loc/package.nix b/pkgs/by-name/lo/loc/package.nix
deleted file mode 100644
index 634841f0838f..000000000000
--- a/pkgs/by-name/lo/loc/package.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-rustPlatform.buildRustPackage rec {
-  version = "0.4.1";
-  pname = "loc";
-
-  src = fetchFromGitHub {
-    owner = "cgag";
-    repo = "loc";
-    rev = "v${version}";
-    sha256 = "0086asrx48qlmc484pjz5r5znli85q6qgpfbd81gjlzylj7f57gg";
-  };
-
-  cargoHash = "sha256-/YnU7vLz37Y9gggGx+vKWvtxBH0fjBwXGc+UWyOG2OE=";
-
-  meta = {
-    homepage = "https://github.com/cgag/loc";
-    changelog = "https://github.com/cgag/loc/blob/v${version}/CHANGELOG.md";
-    description = "Count lines of code quickly";
-    mainProgram = "loc";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sigmanificient ];
-    platforms = lib.platforms.unix;
-  };
-}
diff --git a/pkgs/by-name/mc/mcontrolcenter/package.nix b/pkgs/by-name/mc/mcontrolcenter/package.nix
index 60a927bbf096..13fa0a150ea9 100644
--- a/pkgs/by-name/mc/mcontrolcenter/package.nix
+++ b/pkgs/by-name/mc/mcontrolcenter/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  libsForQt5,
+  qt6,
   makeDesktopItem,
   copyDesktopItems,
   fetchFromGitHub,
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mcontrolcenter";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "dmitry-s93";
     repo = "MControlCenter";
     rev = finalAttrs.version;
-    hash = "sha256-SV78OVRGzy2zFLT3xqeUtbjlh81Z97PVao18P3h/8dI=";
+    hash = "sha256-Gl+YnbUbwtwF2WHT39bIKh48qSIMe3fpzxgdvifR4DQ=";
   };
 
   postPatch = ''
@@ -39,14 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
-    libsForQt5.qttools
+    qt6.wrapQtAppsHook
+    qt6.qttools
     copyDesktopItems
     cmake
   ];
 
   buildInputs = [
-    libsForQt5.qtbase
+    qt6.qtbase
     kmod
   ];
 
diff --git a/pkgs/by-name/me/memorado/package.nix b/pkgs/by-name/me/memorado/package.nix
index a750bc7f5aae..14f6c1e8fdcd 100644
--- a/pkgs/by-name/me/memorado/package.nix
+++ b/pkgs/by-name/me/memorado/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "memorado";
-  version = "0.4";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "wbernard";
     repo = "Memorado";
     tag = version;
-    hash = "sha256-yWu2+VAa5FkpLs/KLI0lcNzFLGN/kiq6frtW8SHN+W4=";
+    hash = "sha256-HNZdWRATjSfMk0e99CERPuR891549+wS/WeA7XGFxto=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/mountpoint-s3/package.nix b/pkgs/by-name/mo/mountpoint-s3/package.nix
index 09021f766264..744a01c3345e 100644
--- a/pkgs/by-name/mo/mountpoint-s3/package.nix
+++ b/pkgs/by-name/mo/mountpoint-s3/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mountpoint-s3";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "mountpoint-s3";
     rev = "v${version}";
-    hash = "sha256-L0xVrADLWVH6r600XvxI5I+IghBSmpC6F93cIH/ejh8=";
+    hash = "sha256-QpJYpHow9/vEPrq82XtbDosGz8lqVB0cOPQmY7Dx78Q=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-Uj6/ZDRaYq99gTwHqAX2c21LecC3LLkJXgCDQ+xEytE=";
+  cargoHash = "sha256-lyxuYrmmB1hQCR3fKEMXI69xYcubisRi/bc6M7hQl70=";
 
   # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
   # cargo metadata failure: error: none of the selected packages contains these features: libfuse3
diff --git a/pkgs/by-name/na/nak/package.nix b/pkgs/by-name/na/nak/package.nix
index 3fc481977f0d..9954474da0d2 100644
--- a/pkgs/by-name/na/nak/package.nix
+++ b/pkgs/by-name/na/nak/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGo123Module rec {
   pname = "nak";
-  version = "0.9.1";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "fiatjaf";
     repo = "nak";
     tag = "v${version}";
-    hash = "sha256-qfTqzsjRQXrLsL6+qXu2AacDmWbEMH6M1kgSPV3Eodg=";
+    hash = "sha256-nIqmQVLGe6iqgnz0QuCgLTPT0TsL5QUMqxBQGXq13QE=";
   };
 
-  vendorHash = "sha256-zM9VFLD1CNI9UPvB+ow8KBUDCyoARUqLjumhvWfJvVA=";
+  vendorHash = "sha256-Gt/HG3iRoz9nDBX8C8XUZ0FTic1cl2c5cVkxUG9ngwY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/nu/nuclear/package.nix b/pkgs/by-name/nu/nuclear/package.nix
index 956185245843..268955c6a10d 100644
--- a/pkgs/by-name/nu/nuclear/package.nix
+++ b/pkgs/by-name/nu/nuclear/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "nuclear";
-  version = "0.6.41";
+  version = "0.6.42";
 
   src = fetchurl {
     # Nuclear currenntly only publishes AppImage releases for x86_64, which is hardcoded in
@@ -13,7 +13,7 @@ let
     # provide more arches, we should use stdenv.hostPlatform to determine the arch and choose
     # source URL accordingly.
     url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}-x86_64.AppImage";
-    hash = "sha256-hPnFz3cQMQj8EzwqC8bNYf2MidBbLUa8U3I+vQbWpcE=";
+    hash = "sha256-95Q8TEn2gvJu75vgDdzSYH/1ci3BlidQ5nKA53fas6U=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/pa/packwiz/package.nix b/pkgs/by-name/pa/packwiz/package.nix
index a37e5656abeb..3bfc70e66caf 100644
--- a/pkgs/by-name/pa/packwiz/package.nix
+++ b/pkgs/by-name/pa/packwiz/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule {
   pname = "packwiz";
-  version = "0-unstable-2024-10-15";
+  version = "0-unstable-2025-01-19";
 
   src = fetchFromGitHub {
     owner = "packwiz";
     repo = "packwiz";
-    rev = "0626c00149a8d9a5e9f76e5640e7b8b95c064350";
-    sha256 = "sha256-eAGfLUcyjDR2oJjLK3+DiuICTqoOcIwO5wL350w6vGw=";
+    rev = "241f24b550f6fe838913a56bdd58bac2fc53254a";
+    sha256 = "sha256-VmNsWzsFVNRciNIPUXUVos4cBdpawgN1/nPwMjNpx+0=";
   };
   passthru.updateScript = unstableGitUpdater { };
 
diff --git a/pkgs/by-name/po/podman-tui/package.nix b/pkgs/by-name/po/podman-tui/package.nix
index cba37b04c3be..08e5780f2e52 100644
--- a/pkgs/by-name/po/podman-tui/package.nix
+++ b/pkgs/by-name/po/podman-tui/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-3AgPt7dRZaHrM4/y35Z5elBFq1b2ZhvwBd4CKNBbgTk=";
+    hash = "sha256-IO2y+im6QQ6krgYBiFxv9FSU4X6Y+s8/y5/piE1HDSo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/po/popeye/package.nix b/pkgs/by-name/po/popeye/package.nix
index f2663236f0a8..803a820f79bb 100644
--- a/pkgs/by-name/po/popeye/package.nix
+++ b/pkgs/by-name/po/popeye/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "popeye";
-  version = "0.21.6";
+  version = "0.21.7";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "derailed";
     repo = "popeye";
-    sha256 = "sha256-CX30/AzHFtHhctvLIgRNDBvrXuNUXfz2xLoBY5zIWPo=";
+    sha256 = "sha256-8X/L9je5TaxSx/RtPQlO/6CKd+zUIxFBfTDrNZAA2fU=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X github.com/derailed/popeye/cmd.commit=${version}"
   ];
 
-  vendorHash = "sha256-YvIINp81XPMbSLCDhK9i+I4hfVXPWH19EeVXYhEXbs8=";
+  vendorHash = "sha256-JX9afHS76kUkOdIZZP44UjcZt69YqzW/S1JKhGxLVOw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/po/portmod/package.nix b/pkgs/by-name/po/portmod/package.nix
index a0e7d38d178c..035eaee1ed18 100644
--- a/pkgs/by-name/po/portmod/package.nix
+++ b/pkgs/by-name/po/portmod/package.nix
@@ -25,7 +25,8 @@ let
     inherit src version;
     pname = "portmod-rust";
 
-    cargoHash = "sha256-sAjgGVVjgXaWbmN/eGEvatYjkHeFTZNX1GXFcJqs3GI=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-a6brse/qXzO7H46zUrOJzyOicKPiKGISp2VhdxAVUUI=";
 
     nativeBuildInputs = [
       python3Packages.python
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index a44b23c8407f..e25a4fd87a55 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-01-12";
+  version = "0-unstable-2025-01-25";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "f1182b27bb64a3bf44e92a4bafb58178ebfbf5ac";
-    hash = "sha256-3Ofv7Eam2/CXRNM84E0H97RrLWQEzDeSM6wYykzlLAM=";
+    rev = "de690ab878200fe0727571aeb97ff06d08323a64";
+    hash = "sha256-nV8RgielAjYqOGZ/5SpGOupsb770jnrehTn0S1R3hQ4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/rp/rpl/package.nix b/pkgs/by-name/rp/rpl/package.nix
index 099d34f37cb2..1185ec4c2f2a 100644
--- a/pkgs/by-name/rp/rpl/package.nix
+++ b/pkgs/by-name/rp/rpl/package.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rpl";
-  version = "1.16";
+  version = "1.16.1";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uBpzKYfdGu2j1ZEaw4TN1fH+W9VLrJf7a87vzZBBU3Y=";
+    hash = "sha256-VTm4KU59Yk501tUdVn4z3bFx9Ot00CDL9HGlf44/t44=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 1c564dfc3732..c3f5a37c4819 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.36.5";
+  version = "8.36.8";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-T5pyec+sS3hBlQTUevIP3v8vlxZEFMSFN7doJliTUCg=";
+    sha256 = "sha256-fyhBKSPE9vAMe1g7IOjrk8u3+KhMgtVrwKRZA+DsGik=";
   };
 
   vendorHash = "sha256-+otWcVUAqO2e9v+4T5QTw2DOVfDUGu6hP/1/6LO21nY=";
diff --git a/pkgs/by-name/sb/sbt-extras/package.nix b/pkgs/by-name/sb/sbt-extras/package.nix
index 5869d095fb37..a3e052c16e93 100644
--- a/pkgs/by-name/sb/sbt-extras/package.nix
+++ b/pkgs/by-name/sb/sbt-extras/package.nix
@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation rec {
   pname = "sbt-extras";
-  rev = "408f74841b90169a7f674955389212e2d02f7f4d";
-  version = "2024-09-28";
+  rev = "e16dab993203b611b9592ddae7b8822a68ae16ec";
+  version = "2024-11-06";
 
   src = fetchFromGitHub {
     owner = "paulp";
     repo = "sbt-extras";
     inherit rev;
-    sha256 = "2iXNs2Ks54Gj6T6PR5AtWrmR9uUxgFScAfek2v+qdTo=";
+    sha256 = "Z9bN+gmWiomWnp94pMXf5+Bksl6OejIPbYUGfVrDxJQ=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 7ef1c4b6aa8c..97b3a45c535c 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -37,7 +37,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "24.11.0.1";
+  version = "24.11.1.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-waUCyzLCK3NRp8DfkvzWjGjzlB1MIZ7N9X+nfjrdAFY=";
+    hash = "sha256-0Vev64P0nx0M/fW4XOX/bR92RJNBuQyWggaNeoE6SN0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/so/sops/package.nix b/pkgs/by-name/so/sops/package.nix
index aab8f59de88a..0b34ee99df23 100644
--- a/pkgs/by-name/so/sops/package.nix
+++ b/pkgs/by-name/so/sops/package.nix
@@ -3,21 +3,22 @@
   buildGo122Module,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
   nix-update-script,
 }:
 
 buildGo122Module rec {
   pname = "sops";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchFromGitHub {
     owner = "getsops";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-U8ZJktOSj0JJ70CbXDS3FpNmk07cKnco5w2rt4BnQBU=";
+    hash = "sha256-w2RMK1Fl/k8QXV68j0Kc6shtx4vQa07RCnpgHLM8c8Q=";
   };
 
-  vendorHash = "sha256-+UxngJgKG+gAjnXXEcdXPXQqRcMfRDn4wPeR1IhltC0=";
+  vendorHash = "sha256-wxmSj3QaFChGE+/2my7Oe2mhprwi404izUxteecyggY=";
 
   postPatch = ''
     substituteInPlace go.mod \
@@ -32,8 +33,6 @@ buildGo122Module rec {
     "-X github.com/getsops/sops/v3/version.Version=${version}"
   ];
 
-  passthru.updateScript = nix-update-script { };
-
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
@@ -41,15 +40,21 @@ buildGo122Module rec {
     installShellCompletion --cmd sops --zsh ${./zsh_autocomplete}
   '';
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://getsops.io/";
     description = "Simple and flexible tool for managing secrets";
     changelog = "https://github.com/getsops/sops/blob/v${version}/CHANGELOG.rst";
     mainProgram = "sops";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       Scrumplex
       mic92
     ];
-    license = licenses.mpl20;
+    license = lib.licenses.mpl20;
   };
 }
diff --git a/pkgs/by-name/sr/srsran/package.nix b/pkgs/by-name/sr/srsran/package.nix
index f20c76ae2f6c..3b32a70f7a6a 100644
--- a/pkgs/by-name/sr/srsran/package.nix
+++ b/pkgs/by-name/sr/srsran/package.nix
@@ -14,6 +14,10 @@
   soapysdr-with-plugins,
   libbladeRF,
   zeromq,
+  enableAvx ? stdenv.hostPlatform.avxSupport,
+  enableAvx2 ? stdenv.hostPlatform.avx2Support,
+  enableFma ? stdenv.hostPlatform.fmaSupport,
+  enableAvx512 ? stdenv.hostPlatform.avx512Support,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +31,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3cQMZ75I4cyHpik2d/eBuzw7M4OgbKqroCddycw4uW8=";
   };
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -45,7 +54,17 @@ stdenv.mkDerivation rec {
     zeromq
   ];
 
-  cmakeFlags = [ "-DENABLE_WERROR=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_WERROR=OFF"
+    (lib.cmakeBool "ENABLE_AVX" enableAvx)
+    (lib.cmakeBool "ENABLE_AVX2" enableAvx2)
+    (lib.cmakeBool "ENABLE_FMA" enableFma)
+    (lib.cmakeBool "ENABLE_AVX512" enableAvx512)
+  ];
+
+  postInstall = lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+    rm $out/lib/*.a
+  '';
 
   meta = with lib; {
     homepage = "https://www.srslte.com/";
diff --git a/pkgs/by-name/st/stash/package.nix b/pkgs/by-name/st/stash/package.nix
index 46c3df1a33d3..5088847950dd 100644
--- a/pkgs/by-name/st/stash/package.nix
+++ b/pkgs/by-name/st/stash/package.nix
@@ -1,50 +1,137 @@
 {
+  buildGoModule,
+  fetchFromGitHub,
+  fetchYarnDeps,
   lib,
+  nixosTests,
+  nodejs,
+  stash,
   stdenv,
-  fetchurl,
+  testers,
+  yarnBuildHook,
+  yarnConfigHook,
 }:
 let
-
-  version = "0.25.1";
-
-  sources = {
-    x86_64-linux = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-linux";
-      hash = "sha256-Rb4x6iKx6T9NPuWWDbNaz+35XPzLqZzSm0psv+k2Gw4=";
-    };
-    aarch64-linux = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-linux-arm64v8";
-      hash = "sha256-6qPyIYKFkhmBNO47w9E91FSKlByepBOnl0MNJighGSc=";
-    };
-    x86_64-darwin = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-macos";
-      hash = "sha256-W8+rgqWUDTOB8ykGO2GL9tKEjaDXdx9LpFg0TAtJsxM=";
-    };
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit version;
+  inherit (lib.importJSON ./version.json)
+    gitHash
+    srcHash
+    vendorHash
+    version
+    yarnHash
+    ;
 
   pname = "stash";
 
-  src = fetchurl { inherit (sources.${stdenv.system}) url hash; };
+  src = fetchFromGitHub {
+    owner = "stashapp";
+    repo = "stash";
+    tag = "v${version}";
+    hash = srcHash;
+  };
 
-  dontUnpack = true;
+  frontend = stdenv.mkDerivation (final: {
+    inherit version;
+    pname = "${pname}-ui";
+    src = "${src}/ui/v2.5";
 
-  installPhase = ''
-    runHook preInstall
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${final.src}/yarn.lock";
+      hash = yarnHash;
+    };
 
-    install -Dm755 $src $out/bin/stash
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      # Needed for executing package.json scripts
+      nodejs
+    ];
 
-    runHook postInstall
+    postPatch = ''
+      substituteInPlace codegen.ts \
+        --replace-fail "../../graphql/" "${src}/graphql/"
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+      export VITE_APP_DATE='1970-01-01 00:00:00'
+      export VITE_APP_GITHASH=${gitHash}
+      export VITE_APP_STASH_VERSION=v${version}
+      export VITE_APP_NOLEGACY=true
+
+      yarn --offline run gqlgen
+      yarn --offline build
+
+      mv build $out
+
+      runHook postBuild
+    '';
+
+    dontInstall = true;
+    dontFixup = true;
+  });
+in
+buildGoModule {
+  inherit
+    pname
+    src
+    version
+    vendorHash
+    ;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X 'github.com/stashapp/stash/internal/build.buildstamp=1970-01-01 00:00:00'"
+    "-X 'github.com/stashapp/stash/internal/build.githash=${gitHash}'"
+    "-X 'github.com/stashapp/stash/internal/build.version=v${version}'"
+    "-X 'github.com/stashapp/stash/internal/build.officialBuild=false'"
+  ];
+  tags = [
+    "sqlite_stat4"
+    "sqlite_math_functions"
+  ];
+
+  subPackages = [ "cmd/stash" ];
+
+  preBuild = ''
+    cp -a ${frontend} ui/v2.5/build
+    # `go mod tidy` requires internet access and does nothing
+    echo "skip_mod_tidy: true" >> gqlgen.yml
+    # remove `-trimpath` fron `GOFLAGS` because `gqlgen` does not work with it
+    GOFLAGS="''${GOFLAGS/-trimpath/}" go generate ./cmd/stash
   '';
 
-  meta = with lib; {
-    description = "Stash is a self-hosted porn app";
-    homepage = "https://github.com/stashapp/stash";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ Golo300 ];
-    platforms = builtins.attrNames sources;
-    mainProgram = "stash";
+  strictDeps = true;
+
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.py;
+    tests = {
+      inherit (nixosTests) stash;
+      version = testers.testVersion {
+        package = stash;
+        version = "v${version} (${gitHash}) - Unofficial Build - 1970-01-01 00:00:00";
+      };
+    };
   };
-})
+
+  meta = {
+    mainProgram = "stash";
+    description = "Organizer for your adult videos/images";
+    license = lib.licenses.agpl3Only;
+    homepage = "https://stashapp.cc/";
+    changelog = "https://github.com/stashapp/stash/blob/v${version}/ui/v2.5/src/docs/en/Changelog/v${lib.versions.major version}${lib.versions.minor version}0.md";
+    maintainers = with lib.maintainers; [
+      Golo300
+      DrakeTDL
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/by-name/st/stash/update.py b/pkgs/by-name/st/stash/update.py
new file mode 100755
index 000000000000..85747eb654b2
--- /dev/null
+++ b/pkgs/by-name/st/stash/update.py
@@ -0,0 +1,82 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 prefetch-yarn-deps nix-prefetch-git nix-prefetch
+
+from pathlib import Path
+from shutil import copyfile
+from urllib.request import Request, urlopen
+import json
+import os
+import subprocess
+
+
+def run_external(args: list[str]):
+    proc = subprocess.run(
+        args,
+        check=True,
+        stdout=subprocess.PIPE,
+    )
+
+    return proc.stdout.strip().decode("utf8")
+
+def get_latest_release_tag():
+    req = Request("https://api.github.com/repos/stashapp/stash/tags?per_page=1")
+
+    if "GITHUB_TOKEN" in os.environ:
+        req.add_header("authorization", f"Bearer {os.environ['GITHUB_TOKEN']}")
+
+    with urlopen(req) as resp:
+        return json.loads(resp.read())[0]
+
+def prefetch_github(rev: str):
+    print(f"Prefetching stashapp/stash({rev})")
+
+    proc = run_external(["nix-prefetch-git", "--no-deepClone", "--rev", rev, f"https://github.com/stashapp/stash"])
+
+    return json.loads(proc)
+
+def prefetch_yarn(lock_file: str):
+    print(f"Prefetching yarn deps")
+
+    hash = run_external(["prefetch-yarn-deps", lock_file])
+
+    return run_external(["nix", "hash", "convert", "--hash-algo", "sha256", hash])
+
+def prefetch_go_modules(src: str, version: str):
+    print(f"Prefetching go modules")
+    expr = fr"""
+        {{ sha256 }}: (buildGoModule {{
+            pname = "stash";
+            src = {src};
+            version = "{version}";
+            vendorHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        }}).goModules.overrideAttrs (_: {{ modSha256 = sha256; }})
+    """
+    return run_external([
+        "nix-prefetch",
+        "--option",
+        "extra-experimental-features",
+        "flakes",
+        expr
+    ])
+
+
+def save_version_json(version: dict[str, str]):
+    print("Writing version.json")
+    with open(Path(__file__).parent / "version.json", 'w') as f:
+        json.dump(version, f, indent=2)
+        f.write("\n")
+
+if __name__ == "__main__":
+    release = get_latest_release_tag()
+
+    src = prefetch_github(release['name'])
+
+    yarn_hash = prefetch_yarn(f"{src['path']}/ui/v2.5/yarn.lock")
+
+    save_version_json({
+        "version": release["name"][1:],
+        "gitHash": release["commit"]["sha"][:8],
+        "srcHash": src["hash"],
+        "yarnHash": yarn_hash,
+        "vendorHash": prefetch_go_modules(src["path"], release["name"][1:])
+    })
diff --git a/pkgs/by-name/st/stash/version.json b/pkgs/by-name/st/stash/version.json
new file mode 100644
index 000000000000..73be8439fba4
--- /dev/null
+++ b/pkgs/by-name/st/stash/version.json
@@ -0,0 +1,7 @@
+{
+  "version": "0.27.2",
+  "gitHash": "76648fee",
+  "srcHash": "sha256-SMZBDKqgVdXf2abaSf/FuG2Vodav7SBu6onjHFZIZIM=",
+  "yarnHash": "sha256-ufGYQfEbcXO3XhpDQ3UTofS5B31L427KWy5NPbWhBJo=",
+  "vendorHash": "sha256-ZtKKs0JCEe4OpPulO74qYTYrZu2Ds3prWp5N8UP6z0g="
+}
diff --git a/pkgs/by-name/tl/tlsx/package.nix b/pkgs/by-name/tl/tlsx/package.nix
index 7c8ecbf072a1..42062b8cd3b8 100644
--- a/pkgs/by-name/tl/tlsx/package.nix
+++ b/pkgs/by-name/tl/tlsx/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tlsx";
-  version = "1.1.8";
+  version = "1.1.9";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "tlsx";
     tag = "v${version}";
-    hash = "sha256-AQiwHNHfwOJYIEsFm2YiksdTUxp5vkCL80rpvxHY2rA=";
+    hash = "sha256-u83hPmmiXH7SGCyINkHFrjNDLanwJLf0o9ZyceQeSg0=";
   };
 
-  vendorHash = "sha256-KNyB+xK7TUf7XoVX/4xBTnG2lMMPVV5AOoUNi4aA/cM=";
+  vendorHash = "sha256-NF05vVLBRlWQpmTfrNEjnvH7kZMhgY73xmSgTZ8FGmo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 9828e173c0aa..efa31c0d2b81 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -7,21 +7,23 @@
 
 buildGo123Module rec {
   pname = "traefik";
-  version = "3.2.2";
+  version = "3.3.2";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-DTgpoJvk/rxzMAIBgKJPT70WW8W/aBhOEoyw3cK+JrM=";
+    hash = "sha256-7qS+rOBYDyYI8t0rVNmM0sJjGSdtIVelaIJuW1jaL+g=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-+sL0GJhWMlFdNEsRdgRJ42aGedOfn76gg70wH6/a+qQ=";
+  vendorHash = "sha256-9WuhQjl+lWRZBvEP8qjBQUbEQC1SG9J+3xNpmIieOo8=";
 
   subPackages = [ "cmd/traefik" ];
 
+  env.CGO_ENABLED = 0;
+
   preBuild = ''
-    GOOS= GOARCH= CGO_ENABLED=0 go generate
+    GOOS= GOARCH= go generate
 
     CODENAME=$(grep -Po "CODENAME \?=\s\K.+$" Makefile)
 
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index 070be4a4aefe..235b2dd424c2 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "259.241223.2";
+  version = "259.250108.1";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-VeAXOCdvy9liCJBNMdPc6iIeuOutqQ9sShc4XytApH4=";
+    hash = "sha256-VXHhN+6k1Jd/4tPxxLwXNYYPjpl+yBn8gRDLlfvCS4g=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/by-name/un/unpoller/package.nix b/pkgs/by-name/un/unpoller/package.nix
index 36ee19619366..d4d38fca860e 100644
--- a/pkgs/by-name/un/unpoller/package.nix
+++ b/pkgs/by-name/un/unpoller/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.14.0";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-2yDrnBi5ZaFfgpqZS1PZM3Fp3zqb5oMuMbsoAeZan8o=";
+    hash = "sha256-x3Uboa6bs59LafEF9/aYmudo9JIh3KIMNdLJRimcmxY=";
   };
 
   vendorHash = "sha256-ZylkCictJNJ/QrWEbBIXDEKElpZRw2Yrj/IHMx0lqg0=";
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 08f504b91a86..f83d9c3c9397 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,19 +14,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.10.9";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sU2eJUUw7crvzMGGBQP6rbxISkL+S5nmT3QspyYXlRQ=";
+    hash = "sha256-18CzWAcBotIdzXFPIptBo20KZxXDVhM7AwwlCnPz+Wk=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname src;
 
-    hash = "sha256-vVzERis1W3QZB/i6SQR9dQR56yDWadKWvFr+nLTQY9Y=";
+    hash = "sha256-ZUwtNtOmxjhOBpYB7vuytunGBRSuVxdlQsceRmeyhhI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index 361550405f88..b2700373da8a 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.19.8";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-R6J+ACYDQpOzJZFBizsQGOexR7lMyeoZqz9TnWxfwyM=";
+    hash = "sha256-+nEyFlLfTAOmd8HrngZOD1rReaXCXX/ficE/PCLcewg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wayidle/package.nix b/pkgs/by-name/wa/wayidle/package.nix
index ebe51dd5e100..f8084a5dfbb0 100644
--- a/pkgs/by-name/wa/wayidle/package.nix
+++ b/pkgs/by-name/wa/wayidle/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wayidle";
-  version = "0.2.0";
+  version = "1.0.0";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = "wayidle";
     rev = "v${version}";
-    hash = "sha256-7hFk/YGOQ5+gQy6pT5DRgMLThQ1vFAvUvdHekTyzIRU=";
+    hash = "sha256-DgsktRIGWswSBYeij5OL4nJwWaURv+v+qzOdZnLKG/E=";
   };
 
-  cargoHash = "sha256-PohfLmUoK+2a7Glnje4Rbym2rvzydUJAYW+edOj7qeo=";
+  cargoHash = "sha256-fJXI2y+kUIAwW6QrMf/T/2N6v/OY9BD3g9oXwB7U4so=";
 
   meta = with lib; {
     description = "Execute a program when a Wayland compositor reports being N seconds idle";
diff --git a/pkgs/tools/audio/openai-whisper-cpp/download-models.patch b/pkgs/by-name/wh/whisper-cpp/download-models.patch
similarity index 100%
rename from pkgs/tools/audio/openai-whisper-cpp/download-models.patch
rename to pkgs/by-name/wh/whisper-cpp/download-models.patch
diff --git a/pkgs/by-name/wh/whisper-cpp/package.nix b/pkgs/by-name/wh/whisper-cpp/package.nix
new file mode 100644
index 000000000000..e8ddeb672a19
--- /dev/null
+++ b/pkgs/by-name/wh/whisper-cpp/package.nix
@@ -0,0 +1,199 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  apple-sdk_11,
+  ninja,
+  fetchFromGitHub,
+  SDL2,
+  wget,
+  which,
+  autoAddDriverRunpath,
+  makeWrapper,
+
+  metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64,
+  coreMLSupport ? stdenv.hostPlatform.isDarwin && false, # FIXME currently broken
+
+  config,
+  cudaSupport ? config.cudaSupport,
+  cudaPackages ? { },
+
+  rocmSupport ? config.rocmSupport,
+  rocmPackages ? { },
+  rocmGpuTargets ? builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets,
+
+  vulkanSupport ? false,
+  shaderc,
+  vulkan-headers,
+  vulkan-loader,
+
+  withSDL ? true,
+}:
+
+assert metalSupport -> stdenv.hostPlatform.isDarwin;
+assert coreMLSupport -> stdenv.hostPlatform.isDarwin;
+
+let
+  # It's necessary to consistently use backendStdenv when building with CUDA support,
+  # otherwise we get libstdc++ errors downstream.
+  # cuda imposes an upper bound on the gcc version, e.g. the latest gcc compatible with cudaPackages_11 is gcc11
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+  inherit (lib)
+    cmakeBool
+    cmakeFeature
+    optional
+    optionals
+    optionalString
+    forEach
+    ;
+
+  darwinBuildInputs = [ apple-sdk_11 ];
+
+  cudaBuildInputs = with cudaPackages; [
+    cuda_cccl # <nv/target>
+
+    # A temporary hack for reducing the closure size, remove once cudaPackages
+    # have stopped using lndir: https://github.com/NixOS/nixpkgs/issues/271792
+    cuda_cudart
+    libcublas
+  ];
+
+  rocmBuildInputs = with rocmPackages; [
+    clr
+    hipblas
+    rocblas
+  ];
+
+  vulkanBuildInputs = [
+    shaderc
+    vulkan-headers
+    vulkan-loader
+  ];
+
+in
+effectiveStdenv.mkDerivation (finalAttrs: {
+  pname = "whisper-cpp";
+  version = "1.7.2";
+
+  src = fetchFromGitHub {
+    owner = "ggerganov";
+    repo = "whisper.cpp";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-y30ZccpF3SCdRGa+P3ddF1tT1KnvlI4Fexx81wZxfTk=";
+  };
+
+  # The upstream download script tries to download the models to the
+  # directory of the script, which is not writable due to being
+  # inside the nix store. This patch changes the script to download
+  # the models to the current directory of where it is being run from.
+  patches = [ ./download-models.patch ];
+
+  postPatch = ''
+    for target in examples/{bench,command,main,quantize,server,stream,talk}/CMakeLists.txt; do
+      if ! grep -q -F 'install('; then
+        echo 'install(TARGETS ''${TARGET} RUNTIME)' >> $target
+      fi
+    done
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+      which
+      makeWrapper
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
+      autoAddDriverRunpath
+    ];
+
+  buildInputs =
+    optional withSDL SDL2
+    ++ optionals effectiveStdenv.hostPlatform.isDarwin darwinBuildInputs
+    ++ optionals cudaSupport cudaBuildInputs
+    ++ optionals rocmSupport rocmBuildInputs
+    ++ optionals vulkanSupport vulkanBuildInputs;
+
+  cmakeFlags =
+    [
+      (cmakeBool "WHISPER_BUILD_EXAMPLES" true)
+      (cmakeBool "GGML_CUDA" cudaSupport)
+      (cmakeBool "GGML_HIPBLAS" rocmSupport)
+      (cmakeBool "GGML_VULKAN" vulkanSupport)
+      (cmakeBool "WHISPER_SDL2" withSDL)
+      (cmakeBool "GGML_LTO" true)
+      (cmakeBool "GGML_NATIVE" false)
+      (cmakeBool "BUILD_SHARED_LIBS" (!effectiveStdenv.hostPlatform.isStatic))
+    ]
+    ++ optionals (effectiveStdenv.hostPlatform.isx86 && !effectiveStdenv.hostPlatform.isStatic) [
+      (cmakeBool "GGML_BACKEND_DL" true)
+      (cmakeBool "GGML_CPU_ALL_VARIANTS" true)
+    ]
+    ++ optionals cudaSupport [
+      (cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
+    ]
+    ++ optionals rocmSupport [
+      (cmakeFeature "CMAKE_C_COMPILER" "hipcc")
+      (cmakeFeature "CMAKE_CXX_COMPILER" "hipcc")
+
+      # Build all targets supported by rocBLAS. When updating search for TARGET_LIST_ROCM
+      # in https://github.com/ROCmSoftwarePlatform/rocBLAS/blob/develop/CMakeLists.txt
+      # and select the line that matches the current nixpkgs version of rocBLAS.
+      "-DAMDGPU_TARGETS=${rocmGpuTargets}"
+    ]
+    ++ optionals coreMLSupport [
+      (cmakeBool "WHISPER_COREML" true)
+      (cmakeBool "WHISPER_COREML_ALLOW_FALLBACK" true)
+    ]
+    ++ optionals metalSupport [
+      (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
+      (cmakeBool "GGML_METAL" true)
+      (cmakeBool "GGML_METAL_EMBED_LIBRARY" true)
+    ];
+
+  postInstall = ''
+    # Add "whisper-cpp" prefix before every command
+    mv -v $out/bin/{main,whisper-cpp}
+
+    for file in $out/bin/*; do
+      if [[ -x "$file" && -f "$file" && "$(basename $file)" != "whisper-cpp" ]]; then
+        mv -v "$file" "$out/bin/whisper-cpp-$(basename $file)"
+      fi
+    done
+
+    install -v -D -m755 $src/models/download-ggml-model.sh $out/bin/whisper-cpp-download-ggml-model
+
+    wrapProgram $out/bin/whisper-cpp-download-ggml-model \
+      --prefix PATH : ${lib.makeBinPath [ wget ]}
+  '';
+
+  requiredSystemFeatures = optionals rocmSupport [ "big-parallel" ]; # rocmSupport multiplies build time by the number of GPU targets, which takes arround 30 minutes on a 16-cores system to build
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/whisper-cpp --help >/dev/null
+    runHook postInstallCheck
+  '';
+
+  meta = {
+    description = "Port of OpenAI's Whisper model in C/C++";
+    longDescription = ''
+      To download the models as described in the project's readme, you may
+      use the `whisper-cpp-download-ggml-model` binary from this package.
+    '';
+    homepage = "https://github.com/ggerganov/whisper.cpp";
+    license = lib.licenses.mit;
+    mainProgram = "whisper-cpp";
+    platforms = lib.platforms.all;
+    broken = coreMLSupport;
+    badPlatforms = optionals cudaSupport lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      dit7ya
+      hughobrien
+      aviallon
+    ];
+  };
+})
diff --git a/pkgs/by-name/xt/xtermcontrol/package.nix b/pkgs/by-name/xt/xtermcontrol/package.nix
index eb0cfbf74329..ad7fdf0ba1d8 100644
--- a/pkgs/by-name/xt/xtermcontrol/package.nix
+++ b/pkgs/by-name/xt/xtermcontrol/package.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.8";
+  version = "3.10";
   pname = "xtermcontrol";
 
   src = fetchurl {
     url = "https://thrysoee.dk/xtermcontrol/xtermcontrol-${version}.tar.gz";
-    sha256 = "sha256-Vh6GNiDkjNhaD9U/3fG2LpMLN39L3jRUgG/FQeG1z40=";
+    sha256 = "sha256-Prl7HZ2KrhutT+LEHKOj27ENLWfmykWZqh9jGkBQPe4=";
   };
 
   meta = {
diff --git a/pkgs/by-name/zl/zluda/package.nix b/pkgs/by-name/zl/zluda/package.nix
index 731bc55d885f..a77718981c3b 100644
--- a/pkgs/by-name/zl/zluda/package.nix
+++ b/pkgs/by-name/zl/zluda/package.nix
@@ -49,7 +49,6 @@ rustPlatform.buildRustPackage rec {
     clang
   ];
 
-  cargoHash = "sha256-gZdLThmaeWVJXoeG7fuusfacgH2RNTHrqm8W0kqkqOY=";
   cargoLock.lockFile = ./Cargo.lock;
 
   # xtask doesn't support passing --target, but nix hooks expect the folder structure from when it's set
diff --git a/pkgs/development/coq-modules/Cheerios/default.nix b/pkgs/development/coq-modules/Cheerios/default.nix
index 8bdcbab8370a..92a1525463b6 100644
--- a/pkgs/development/coq-modules/Cheerios/default.nix
+++ b/pkgs/development/coq-modules/Cheerios/default.nix
@@ -14,7 +14,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "20230107";
       }
       {
diff --git a/pkgs/development/coq-modules/CoLoR/default.nix b/pkgs/development/coq-modules/CoLoR/default.nix
index 3677f65625bb..7fadc2f74649 100644
--- a/pkgs/development/coq-modules/CoLoR/default.nix
+++ b/pkgs/development/coq-modules/CoLoR/default.nix
@@ -14,7 +14,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "1.8.5";
       }
       {
diff --git a/pkgs/development/coq-modules/ElmExtraction/default.nix b/pkgs/development/coq-modules/ElmExtraction/default.nix
index 0a7a22c812a2..cfba9df2a660 100644
--- a/pkgs/development/coq-modules/ElmExtraction/default.nix
+++ b/pkgs/development/coq-modules/ElmExtraction/default.nix
@@ -25,7 +25,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
             (range "1.3.1" "1.3.2")
           ];
           out = "0.1.0";
diff --git a/pkgs/development/coq-modules/ExtLib/default.nix b/pkgs/development/coq-modules/ExtLib/default.nix
index 4eb989a50ef4..90fd3a261639 100644
--- a/pkgs/development/coq-modules/ExtLib/default.nix
+++ b/pkgs/development/coq-modules/ExtLib/default.nix
@@ -4,7 +4,7 @@ mkCoqDerivation rec {
   pname = "coq-ext-lib";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.20"; out = "0.13.0"; }
+    { case = range "8.14" "9.0"; out = "0.13.0"; }
     { case = range "8.11" "8.19"; out = "0.12.0"; }
     { case = range "8.8" "8.16"; out = "0.11.6"; }
     { case = range "8.8" "8.14"; out = "0.11.4"; }
diff --git a/pkgs/development/coq-modules/ITree/default.nix b/pkgs/development/coq-modules/ITree/default.nix
index 218d7e2f3be8..981afa1180bd 100644
--- a/pkgs/development/coq-modules/ITree/default.nix
+++ b/pkgs/development/coq-modules/ITree/default.nix
@@ -14,7 +14,7 @@ mkCoqDerivation rec {
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
-      { case = range "8.13" "8.20"; out = "5.2.0+20241009"; }
+      { case = range "8.13" "9.0"; out = "5.2.0+20241009"; }
       { case = range "8.10" "8.16"; out = "4.0.0"; }
     ] null;
   release."5.2.0+20241009".sha256 = "sha256-eg47YgnIonCq7XOUgh9uzoKsuFCvsOSTZhgFLNNcPD0=";
diff --git a/pkgs/development/coq-modules/InfSeqExt/default.nix b/pkgs/development/coq-modules/InfSeqExt/default.nix
index 479205b0245a..42b6aa0b6f42 100644
--- a/pkgs/development/coq-modules/InfSeqExt/default.nix
+++ b/pkgs/development/coq-modules/InfSeqExt/default.nix
@@ -14,7 +14,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.9" "8.20";
+        case = range "8.9" "9.0";
         out = "20230107";
       }
       {
diff --git a/pkgs/development/coq-modules/MenhirLib/default.nix b/pkgs/development/coq-modules/MenhirLib/default.nix
index ecdbab974a5f..4e3f0ec0b4cb 100644
--- a/pkgs/development/coq-modules/MenhirLib/default.nix
+++ b/pkgs/development/coq-modules/MenhirLib/default.nix
@@ -16,7 +16,7 @@ let
       with lib.versions;
       lib.switch coq.coq-version [
         {
-          case = range "8.12" "8.20";
+          case = range "8.12" "9.0";
           out = "20240715";
         }
         {
@@ -35,11 +35,11 @@ let
     };
     propagatedBuildInputs = [ stdlib ];
     preBuild = "cd coq-menhirlib/src";
-    meta = with lib; {
+    meta = {
       homepage = "https://gitlab.inria.fr/fpottier/menhir/-/tree/master/coq-menhirlib";
       description = "A support library for verified Coq parsers produced by Menhir";
-      license = licenses.lgpl3Plus;
-      maintainers = with maintainers; [ ];
+      license = lib.licenses.lgpl3Plus;
+      maintainers = with lib.maintainers; [ damhiya ];
     };
   };
 in
diff --git a/pkgs/development/coq-modules/QuickChick/default.nix b/pkgs/development/coq-modules/QuickChick/default.nix
index 0f70982dfaf1..a18acb3120e3 100644
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@@ -21,7 +21,7 @@ in
       [
         {
           cases = [
-            (lib.versions.range "8.15" "8.20")
+            (lib.versions.range "8.15" "9.0")
             lib.pred.true
           ];
           out = "2.0.4";
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 63a450726e4c..594eb183b7b0 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -14,7 +14,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.9" "8.20";
+        case = range "8.9" "9.0";
         out = "20230107";
       }
       {
diff --git a/pkgs/development/coq-modules/autosubst/default.nix b/pkgs/development/coq-modules/autosubst/default.nix
index e5fd36cd7f05..ce28e4a0d911 100644
--- a/pkgs/development/coq-modules/autosubst/default.nix
+++ b/pkgs/development/coq-modules/autosubst/default.nix
@@ -20,7 +20,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "1.9";
       }
       {
diff --git a/pkgs/development/coq-modules/bignums/default.nix b/pkgs/development/coq-modules/bignums/default.nix
index acd6b8e04303..9dd77a802105 100644
--- a/pkgs/development/coq-modules/bignums/default.nix
+++ b/pkgs/development/coq-modules/bignums/default.nix
@@ -13,6 +13,10 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.coq-version [
+      {
+        case = range "9.0" "9.0";
+        out = "9.0.0+rocq${coq.coq-version}";
+      }
       {
         case = range "8.13" "8.20";
         out = "9.0.0+coq${coq.coq-version}";
@@ -23,6 +27,7 @@ mkCoqDerivation {
       }
     ] null;
 
+  release."9.0.0+rocq9.0".sha256 = "sha256-ctnwpyNVhryEUA5YEsAImrcJsNMhtBgDSOz+z5Z4R78=";
   release."9.0.0+coq8.20".sha256 = "sha256-pkvyDaMXRalc6Uu1eBTuiqTpRauRrzu946c6TavyTKY=";
   release."9.0.0+coq8.19".sha256 = "sha256-02uL+qWbUveHe67zKfc8w3U0iN3X2DKBsvP3pKpW8KQ=";
   release."9.0.0+coq8.18".sha256 = "sha256-vLeJ0GNKl4M84Uj2tAwlrxJOSR6VZoJQvdlDhxJRge8=";
diff --git a/pkgs/development/coq-modules/ceres/default.nix b/pkgs/development/coq-modules/ceres/default.nix
index b141d2b48e2a..3bf17cb6cf4d 100644
--- a/pkgs/development/coq-modules/ceres/default.nix
+++ b/pkgs/development/coq-modules/ceres/default.nix
@@ -17,7 +17,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "0.4.1";
       }
       {
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index 18e83c48b1a4..927f9d282131 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -21,6 +21,7 @@ default-elpi-version = if elpi-version != null then elpi-version else (
     { case = "8.18"; out = "1.18.1"; }
     { case = "8.19"; out = "1.18.1"; }
     { case = "8.20"; out = "1.19.2"; }
+    { case = "9.0"; out = "2.0.7"; }
   ] { }
 );
 elpi = coq.ocamlPackages.elpi.override { version = default-elpi-version; };
@@ -34,6 +35,7 @@ derivation = mkCoqDerivation {
   owner = "LPCIC";
   inherit version;
   defaultVersion = lib.switch coq.coq-version [
+    { case = "9.0"; out = "2.4.0"; }
     { case = "8.20"; out = "2.2.0"; }
     { case = "8.19"; out = "2.0.1"; }
     { case = "8.18"; out = "2.0.0"; }
@@ -45,6 +47,7 @@ derivation = mkCoqDerivation {
     { case = "8.12"; out = "1.8.3_8.12"; }
     { case = "8.11"; out = "1.6.3_8.11"; }
   ] null;
+  release."2.4.0".sha256 = "sha256-W2+vVGExLLux8e0nSZESSoMVvrLxhL6dmXkb+JuKiqc=";
   release."2.2.0".sha256 = "sha256-rADEoqTXM7/TyYkUKsmCFfj6fjpWdnZEOK++5oLfC/I=";
   release."2.0.1".sha256 = "sha256-cuoPsEJ+JRLVc9Golt2rJj4P7lKltTrrmQijjoViooc=";
   release."2.0.0".sha256 = "sha256-A/cH324M21k3SZ7+YWXtaYEbu6dZQq3K0cb1RMKjbsM=";
diff --git a/pkgs/development/coq-modules/coq-record-update/default.nix b/pkgs/development/coq-modules/coq-record-update/default.nix
index ff71c5ecdc43..d4c901ef044f 100644
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -13,7 +13,7 @@ mkCoqDerivation rec {
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.10" "8.20";
+        case = range "8.10" "9.0";
         out = "0.3.4";
       }
     ] null;
diff --git a/pkgs/development/coq-modules/coqide/default.nix b/pkgs/development/coq-modules/coqide/default.nix
index 8ae04078b771..8bab88333e40 100644
--- a/pkgs/development/coq-modules/coqide/default.nix
+++ b/pkgs/development/coq-modules/coqide/default.nix
@@ -17,7 +17,7 @@ mkCoqDerivation rec {
   inherit (coq) src;
   release."${coq.version}" = { };
 
-  defaultVersion = if lib.versions.isGe "8.14" coq.version then coq.version else null;
+  defaultVersion = if lib.versions.range "8.14" "8.20" coq.version then coq.version else null;
 
   preConfigure = ''
     patchShebangs dev/tools/
diff --git a/pkgs/development/coq-modules/deriving/default.nix b/pkgs/development/coq-modules/deriving/default.nix
index 909cb7f42154..259cf724c316 100644
--- a/pkgs/development/coq-modules/deriving/default.nix
+++ b/pkgs/development/coq-modules/deriving/default.nix
@@ -18,7 +18,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
             (isGe "2.0.0")
           ];
           out = "0.2.1";
diff --git a/pkgs/development/coq-modules/extructures/default.nix b/pkgs/development/coq-modules/extructures/default.nix
index 2f5b3f330089..2b5f43f31698 100644
--- a/pkgs/development/coq-modules/extructures/default.nix
+++ b/pkgs/development/coq-modules/extructures/default.nix
@@ -19,7 +19,7 @@
       [
         {
           cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
             (isGe "2.0.0")
           ];
           out = "0.5.0";
diff --git a/pkgs/development/coq-modules/gaia/default.nix b/pkgs/development/coq-modules/gaia/default.nix
index 2e17861ea3bf..05079005b6c0 100644
--- a/pkgs/development/coq-modules/gaia/default.nix
+++ b/pkgs/development/coq-modules/gaia/default.nix
@@ -26,7 +26,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (range "2.0" "2.3")
           ];
           out = "2.2";
diff --git a/pkgs/development/coq-modules/hierarchy-builder/default.nix b/pkgs/development/coq-modules/hierarchy-builder/default.nix
index bff7825637c7..270c9a26d337 100644
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@@ -5,6 +5,7 @@ let hb = mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "9.0" "9.0";   out = "1.8.1"; }
     { case = range "8.19" "8.20"; out = "1.8.0"; }
     { case = range "8.18" "8.20"; out = "1.7.1"; }
     { case = range "8.16" "8.18"; out = "1.6.0"; }
@@ -14,6 +15,7 @@ let hb = mkCoqDerivation {
     { case = range "8.12" "8.13"; out = "1.1.0"; }
     { case = isEq "8.11";         out = "0.10.0"; }
   ] null;
+  release."1.8.1".sha256  = "sha256-Z0WAHDyycqgL+Le/zNfEAoLWzFb7WIL+3G3vEBExlb4=";
   release."1.8.0".sha256  = "sha256-4s/4ZZKj5tiTtSHGIM8Op/Pak4Vp52WVOpd4l9m19fY=";
   release."1.7.1".sha256  = "sha256-MCmOzMh/SBTFAoPbbIQ7aqd3hMcSMpAKpiZI7dbRaGs=";
   release."1.7.0".sha256  = "sha256-WqSeuJhmqicJgXw/xGjGvbRzfyOK7rmkVRb6tPDTAZg=";
diff --git a/pkgs/development/coq-modules/iris/default.nix b/pkgs/development/coq-modules/iris/default.nix
index 14410a8cecd0..adcc9c3e5c72 100644
--- a/pkgs/development/coq-modules/iris/default.nix
+++ b/pkgs/development/coq-modules/iris/default.nix
@@ -15,7 +15,7 @@ mkCoqDerivation rec {
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.19" "8.20";
+        case = range "8.19" "9.0";
         out = "4.3.0";
       }
       {
diff --git a/pkgs/development/coq-modules/json/default.nix b/pkgs/development/coq-modules/json/default.nix
index 3b8ccef3bb95..52fd5871f9d1 100644
--- a/pkgs/development/coq-modules/json/default.nix
+++ b/pkgs/development/coq-modules/json/default.nix
@@ -19,7 +19,7 @@
     in
     lib.switch coq.coq-version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "0.2.0";
       }
       {
diff --git a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
index 3996db951b29..212d1cb03568 100644
--- a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
@@ -24,10 +24,10 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0")
           ];
-          out = "1.2.3";
+          out = "1.2.4";
         }
         {
           cases = [
@@ -57,6 +57,7 @@ mkCoqDerivation {
   release."1.1.1".sha256 = "sha256-5wItMeeTRoJlRBH3zBNc2VUZn6pkDde60YAvXTx+J3U=";
   release."1.2.2".sha256 = "sha256-EU9RJGV3BvnmsX+mGH+6+MDXiGHgDI7aP5sIYiMUXTs=";
   release."1.2.3".sha256 = "sha256-6uc1VEfDv+fExEfBR2c0/Q/KjrkX0TbEMCLgeYcpkls=";
+  release."1.2.4".sha256 = "sha256-BRxt0LGPz2u3kJRjcderaZqCfs8M8qKAAwNSWmIck7Q=";
 
   propagatedBuildInputs = [
     mathcomp-algebra
diff --git a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
index 4a79a3d95d90..86516fd9082d 100644
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@@ -18,14 +18,15 @@ mkCoqDerivation {
   release = {
     "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
     "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
+    "1.0.2".sha256 = "sha256-fJ/5xr91VtvpIoaFwb3PlnKl6UHG6GEeBRVGZrVLMU0=";
   };
   inherit version;
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.10" "8.20";
-        out = "1.0.1";
+        case = range "8.10" "9.0";
+        out = "1.0.2";
       }
       {
         case = range "8.5" "8.14";
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index f0fb42ddae8a..fe408966797b 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -22,7 +22,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0")
           ];
           out = "2.1.0";
diff --git a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
index 91a303219b19..7654c47abf08 100644
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@@ -37,14 +37,14 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (isGe "8.17")
+            (range "8.17" "9.0")
             (isGe "2.1.0")
           ];
           out = "2.0.2";
         }
         {
           cases = [
-            (isGe "8.17")
+            (range "8.17" "8.20")
             (isGe "2.0.0")
           ];
           out = "2.0.1";
diff --git a/pkgs/development/coq-modules/mathcomp-tarjan/default.nix b/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
index 945c63657d97..9246a0b0682e 100644
--- a/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
@@ -24,7 +24,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0.0")
           ];
           out = "1.0.2";
diff --git a/pkgs/development/coq-modules/mathcomp-word/default.nix b/pkgs/development/coq-modules/mathcomp-word/default.nix
index 8e6825979be1..84a3345e7066 100644
--- a/pkgs/development/coq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-word/default.nix
@@ -61,7 +61,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0")
           ];
           out = "3.2";
diff --git a/pkgs/development/coq-modules/mathcomp-zify/default.nix b/pkgs/development/coq-modules/mathcomp-zify/default.nix
index d6be076ba470..ec0c7cdcaa95 100644
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@@ -25,7 +25,7 @@ mkCoqDerivation rec {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0.0")
           ];
           out = "1.5.0+2.0+8.16";
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index 48d36b2dbb8c..c4442ba1283c 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -20,7 +20,7 @@ let
   withDoc = single && (args.withDoc or false);
   defaultVersion = let inherit (lib.versions) range; in
     lib.switch coq.coq-version [
-      { case = range "8.19" "8.20"; out = "2.3.0"; }
+      { case = range "8.19" "9.0"; out = "2.3.0"; }
       { case = range "8.17" "8.20"; out = "2.2.0"; }
       { case = range "8.17" "8.18"; out = "2.1.0"; }
       { case = range "8.17" "8.18"; out = "2.0.0"; }
diff --git a/pkgs/development/coq-modules/paco/default.nix b/pkgs/development/coq-modules/paco/default.nix
index d4e95619c4ad..97b5061c8e58 100644
--- a/pkgs/development/coq-modules/paco/default.nix
+++ b/pkgs/development/coq-modules/paco/default.nix
@@ -13,7 +13,7 @@ mkCoqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch coq.coq-version [
-      { case = range "8.13" "8.20"; out = "4.2.2"; }
+      { case = range "8.13" "9.0"; out = "4.2.2"; }
       { case = range "8.12" "8.17"; out = "4.1.2"; }
       { case = range "8.9" "8.13"; out = "4.1.1"; }
       { case = range "8.6" "8.13"; out = "4.0.2"; }
diff --git a/pkgs/development/coq-modules/parsec/default.nix b/pkgs/development/coq-modules/parsec/default.nix
index 4f8eeebc15da..b797fc71e7d6 100644
--- a/pkgs/development/coq-modules/parsec/default.nix
+++ b/pkgs/development/coq-modules/parsec/default.nix
@@ -24,7 +24,7 @@ mkCoqDerivation {
     with lib.versions;
     lib.switch coq.version [
       {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
         out = "0.2.0";
       }
       {
diff --git a/pkgs/development/coq-modules/reglang/default.nix b/pkgs/development/coq-modules/reglang/default.nix
index 3e95e1b893b1..cd0513a6e02a 100644
--- a/pkgs/development/coq-modules/reglang/default.nix
+++ b/pkgs/development/coq-modules/reglang/default.nix
@@ -24,7 +24,7 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
             (isGe "2.0.0")
           ];
           out = "1.2.1";
diff --git a/pkgs/development/coq-modules/simple-io/default.nix b/pkgs/development/coq-modules/simple-io/default.nix
index 6345818db5d0..bb4443433e12 100644
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@@ -16,7 +16,7 @@
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.17" "8.20";
+        case = range "8.17" "9.0";
         out = "1.10.0";
       }
       {
diff --git a/pkgs/development/coq-modules/stdlib/default.nix b/pkgs/development/coq-modules/stdlib/default.nix
index a443daef68f1..cac0c4b53405 100644
--- a/pkgs/development/coq-modules/stdlib/default.nix
+++ b/pkgs/development/coq-modules/stdlib/default.nix
@@ -14,17 +14,13 @@
   inherit version;
   defaultVersion =
     with lib.versions;
-    lib.switch
-      [ coq.version ]
-      [
-        {
-          cases = [ (isLt "8.21") ];
-          out = "8.20";
-        }
-      ]
-      null;
-  releaseRev = v: "v${v}";
+    lib.switch coq.version [
+      { case = isEq "9.0"; out = "9.0+rc1"; }
+      { case = isLt "8.21"; out = "8.20"; }
+    ] null;
+  releaseRev = v: "V${v}";
 
+  release."9.0+rc1".sha256 = "sha256-raHwniQdpAX1HGlMofM8zVeXcmlUs+VJZZg5VF43k/M=";
   release."8.20".sha256 = "sha256-AcoS4edUYCfJME1wx8UbuSQRF3jmxhArcZyPIoXcfu0=";
 
   useDune = true;
diff --git a/pkgs/development/coq-modules/stdpp/default.nix b/pkgs/development/coq-modules/stdpp/default.nix
index 750388750b6b..13a24d1600f7 100644
--- a/pkgs/development/coq-modules/stdpp/default.nix
+++ b/pkgs/development/coq-modules/stdpp/default.nix
@@ -15,7 +15,7 @@ mkCoqDerivation rec {
     with lib.versions;
     lib.switch coq.coq-version [
       {
-        case = range "8.19" "8.20";
+        case = range "8.19" "9.0";
         out = "1.11.0";
       }
       {
diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
index d865b183f9ca..5ad105a64bac 100644
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtkeychain";
-  version = "0.14.3";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "frankosterfeld";
     repo = "qtkeychain";
     rev = version;
-    sha256 = "sha256-+1WX3ARH+jWeDiaJnX+ZlRMj+l3qvgBwcGKjB9QEJNI=";
+    sha256 = "sha256-/gdozAJbjaaCcttQED2PixaFNRDZOXbBIoV9QLexNUg=";
   };
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/python-modules/commitizen/default.nix b/pkgs/development/python-modules/commitizen/default.nix
index 867b03e2c1b4..5779a1218a57 100644
--- a/pkgs/development/python-modules/commitizen/default.nix
+++ b/pkgs/development/python-modules/commitizen/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.1.0";
+  version = "4.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-f3uusTNGMK6a3Plh6FHBeM8vEXDZW31o9E0i+sWsBgE=";
+    hash = "sha256-ms1G7wKJMBjmfcD3VNZizswLilBdy4wv5fgnzzirgMs=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/htmldate/default.nix b/pkgs/development/python-modules/htmldate/default.nix
index cdf4f8dfa04d..5a0f68e129be 100644
--- a/pkgs/development/python-modules/htmldate/default.nix
+++ b/pkgs/development/python-modules/htmldate/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "htmldate";
-  version = "1.9.2";
+  version = "1.9.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "adbar";
     repo = "htmldate";
     tag = "v${version}";
-    hash = "sha256-lTBLk8SlS2R4n5HORyt5mechKKEWRtMggOxUZ6kgQIc=";
+    hash = "sha256-9uFf/sx0AZdlvizU65H87hbtwDKf8Ykm67bKM9Oq//s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/murmurhash/default.nix b/pkgs/development/python-modules/murmurhash/default.nix
index de051620c6f7..dc3aa8a32468 100644
--- a/pkgs/development/python-modules/murmurhash/default.nix
+++ b/pkgs/development/python-modules/murmurhash/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "murmurhash";
-  version = "1.0.11";
+  version = "1.0.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-h/9oolXlTnZI0HKf9BMPQ/fzjwMoijduVnk04W25N2c=";
+    hash = "sha256-Rnt+4xwfefRtAENqGVf8UqDlgBNp3S8w63ZV84BzW18=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/nh3/default.nix b/pkgs/development/python-modules/nh3/default.nix
index 0a30e71eb1c4..d1437292d7bb 100644
--- a/pkgs/development/python-modules/nh3/default.nix
+++ b/pkgs/development/python-modules/nh3/default.nix
@@ -23,10 +23,10 @@ buildPythonPackage {
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-NmSOmM3OHiBx1xwlV2QyliQxDMNFApOlEehxfwyEU0I=";
+    hash = "sha256-cYdwN/PpG1ae6lBRk5usXSwBjH37BpQEp5JLLQ2NRNU=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index 668e0af41753..4b14fcaf3780 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ntc-templates";
-  version = "7.5.0";
+  version = "7.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "networktocode";
     repo = "ntc-templates";
     tag = "v${version}";
-    hash = "sha256-VRkWjhl/7qDwXTWQ5ZhIS7JMuxJWlWkqwjoSo1DXOQE=";
+    hash = "sha256-N25XKFlTcxOczjOBsTvyYLYSLJLTFnn2hG5KnsHVKOc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pydata-google-auth/default.nix b/pkgs/development/python-modules/pydata-google-auth/default.nix
index 2aa3c872f349..c0348b08ed43 100644
--- a/pkgs/development/python-modules/pydata-google-auth/default.nix
+++ b/pkgs/development/python-modules/pydata-google-auth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pydata-google-auth";
-  version = "1.9.0";
+  version = "1.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     repo = "pydata-google-auth";
     owner = "pydata";
     tag = version;
-    hash = "sha256-Vel8xSDX0djNwlICXE/ON3G4m0dWmynl8fHfDhaZhbI=";
+    hash = "sha256-NxEpwCkjNWao2bnKOsDgw93N+cVqwM12VfoEu8CyWUU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pynvml/0001-locate-libnvidia-ml.so.1-on-NixOS.patch b/pkgs/development/python-modules/pynvml/0001-locate-libnvidia-ml.so.1-on-NixOS.patch
deleted file mode 100644
index 48727de2516a..000000000000
--- a/pkgs/development/python-modules/pynvml/0001-locate-libnvidia-ml.so.1-on-NixOS.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/pynvml/nvml.py b/pynvml/nvml.py
-index 56d908f..1de0b97 100644
---- a/pynvml/nvml.py
-+++ b/pynvml/nvml.py
-@@ -1475,7 +1475,11 @@ def _LoadNvmlLibrary():
-                             nvmlLib = CDLL(os.path.join(os.getenv("ProgramFiles", "C:/Program Files"), "NVIDIA Corporation/NVSMI/nvml.dll"))
-                     else:
-                         # assume linux
--                        nvmlLib = CDLL("libnvidia-ml.so.1")
-+                        try:
-+                            nvmlLib = CDLL("libnvidia-ml.so.1")
-+                        except OSError:
-+                            # assume NixOS
-+                            nvmlLib = CDLL("@driverLink@/lib/libnvidia-ml.so.1")
-                 except OSError as ose:
-                     _nvmlCheckReturn(NVML_ERROR_LIBRARY_NOT_FOUND)
-                 if (nvmlLib == None):
diff --git a/pkgs/development/python-modules/pynvml/default.nix b/pkgs/development/python-modules/pynvml/default.nix
index ea8c12ad5528..7de3a041ef1e 100644
--- a/pkgs/development/python-modules/pynvml/default.nix
+++ b/pkgs/development/python-modules/pynvml/default.nix
@@ -3,63 +3,48 @@
   buildPythonPackage,
   cudaPackages,
   fetchFromGitHub,
-  substituteAll,
-  addDriverRunpath,
   setuptools,
   pytestCheckHook,
-  versioneer,
+  nvidia-ml-py,
   pynvml,
 }:
 
 buildPythonPackage rec {
   pname = "pynvml";
-  version = "11.5.3";
+  version = "12.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gpuopenanalytics";
     repo = "pynvml";
     tag = version;
-    hash = "sha256-8NkYBRpcW3dvxVc6z17TMRPqA0YK/J/CdjuqgdcTdy8=";
+    hash = "sha256-bfES6QqL9DO7rmQ3btXxVzW0KlL0eHyUvYJVeijymBk=";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./0001-locate-libnvidia-ml.so.1-on-NixOS.patch;
-      inherit (addDriverRunpath) driverLink;
-    })
-  ];
-
-  # unvendor versioneer
-  postPatch = ''
-    rm versioneer.py
-  '';
-
   build-system = [
     setuptools
-    versioneer
   ];
 
+  dependencies = [ nvidia-ml-py ];
+
   pythonImportsCheck = [
-    "pynvml"
-    "pynvml.smi"
+    "pynvml_utils"
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  # OSError: /run/opengl-driver/lib/libnvidia-ml.so.1: cannot open shared object file: No such file or directory
   doCheck = false;
 
   passthru.tests.tester-nvmlInit = cudaPackages.writeGpuTestPython { libraries = [ pynvml ]; } ''
-    import pynvml
-    from pynvml.smi import nvidia_smi  # noqa: F401
-
-    print(f"{pynvml.nvmlInit()=}")
+    from pynvml_utils import nvidia_smi  # noqa: F401
+    nvsmi = nvidia_smi.getInstance()
+    print(nvsmi.DeviceQuery('memory.free, memory.total'))
   '';
 
   meta = {
-    description = "Python bindings for the NVIDIA Management Library";
+    description = "Unofficial Python bindings for the NVIDIA Management Library";
     homepage = "https://github.com/gpuopenanalytics/pynvml";
+    changelog = "https://github.com/gpuopenanalytics/pynvml?tab=readme-ov-file#release-notes";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/pysubs2/default.nix b/pkgs/development/python-modules/pysubs2/default.nix
index e03a87fffda0..03f7077afd42 100644
--- a/pkgs/development/python-modules/pysubs2/default.nix
+++ b/pkgs/development/python-modules/pysubs2/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pysubs2";
-  version = "1.7.3";
+  version = "1.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tkarabela";
     repo = pname;
     rev = version;
-    hash = "sha256-PrpN+w/gCi7S9OmD6kbbvL9VlZEfy1DbehFTwjxsibA=";
+    hash = "sha256-fKSb7MfBHGft8Tp6excjfkVXKnHRER11X0QxbR1zD4I=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/scalene/default.nix b/pkgs/development/python-modules/scalene/default.nix
index b2fc07bbcebd..b03c0f041e2f 100644
--- a/pkgs/development/python-modules/scalene/default.nix
+++ b/pkgs/development/python-modules/scalene/default.nix
@@ -11,7 +11,6 @@
   nvidia-ml-py,
   psutil,
   pydantic,
-  pynvml,
   pytestCheckHook,
   pythonOlder,
   rich,
@@ -75,7 +74,6 @@ buildPythonPackage rec {
     numpy
     psutil
     pydantic
-    pynvml
     rich
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ nvidia-ml-py ];
 
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 6bd40b69a036..9fd7a701a09d 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1309";
+  version = "3.0.1310";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-1VMvMnF73vAwlFVCGrEdUZaWuJuH2q6If3VuypbhQN8=";
+    hash = "sha256-m7Kg3aWgvSHLiDPC52lVen+6dRfVDMPdv1IItd/aBjM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 7c0234ae049f..718bf06ea14d 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -68,6 +69,15 @@ buildPythonPackage rec {
     hash = "sha256-doYvjwajwXqqaKZ363p2SE//9eupfkwrG66j0iUAnU0=";
   };
 
+  patches = [
+    # Remove on the next major version bump
+    (fetchpatch {
+      url = "https://github.com/huggingface/transformers/commit/db864b5526d56fd99143619abff969bfcb5596d5.patch?full_index=1";
+      name = "dont-import-torch-distributed-if-not-available.patch";
+      hash = "sha256-XOraJmSt9Rp/oNiil6vDUBqZhd8MDbA0nz1Tx16Mk14=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 8f29d718b83b..fc45776a64e1 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "uiprotect";
-  version = "7.4.1";
+  version = "7.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "uilibs";
     repo = "uiprotect";
     tag = "v${version}";
-    hash = "sha256-y4rJoT70WiVS9Gs/U6FPOaGGubPI43x9tA2vcdiDBlw=";
+    hash = "sha256-tOozcXDXQI3l5dMQ8WqBrC7wLVbl5iomsuy/hYL3emE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 0d554e5a5491..4231983b0c5b 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -25,7 +25,6 @@
   uvicorn,
   pydantic,
   aioprometheus,
-  pynvml,
   openai,
   pyzmq,
   tiktoken,
@@ -149,7 +148,6 @@ buildPythonPackage rec {
     ++ aioprometheus.optional-dependencies.starlette
     ++ lib.optionals cudaSupport [
       cupy
-      pynvml
     ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/webauthn/default.nix b/pkgs/development/python-modules/webauthn/default.nix
index 79a57455f714..6e08d70c787d 100644
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "webauthn";
-  version = "2.4.0";
+  version = "2.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "duo-labs";
     repo = "py_webauthn";
     tag = "v${version}";
-    hash = "sha256-5WSNrUm+V7KHoWYy2NCpb/C9x5+vIb7ddEpAcv2UQZo=";
+    hash = "sha256-XIL2rejPp/5zaPFuWHgn696sugNB3E/BRc7DuP0oI4Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/kde/gear/akonadi-search/default.nix b/pkgs/kde/gear/akonadi-search/default.nix
index 6cde22a9b0e6..999d3f2b084d 100644
--- a/pkgs/kde/gear/akonadi-search/default.nix
+++ b/pkgs/kde/gear/akonadi-search/default.nix
@@ -6,8 +6,6 @@
   rustPlatform,
   cargo,
   rustc,
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-ePvYL1ps2w7qscYNIgvjn6t/ir0izbS+MlP/jow4VrE=",
 }:
 mkKdeDerivation rec {
   pname = "akonadi-search";
@@ -15,12 +13,12 @@ mkKdeDerivation rec {
 
   cargoRoot = "agent/rs/htmlparser";
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     # include version in the name so we invalidate the FOD
     name = "${pname}-${version}";
     src = sources.${pname};
     sourceRoot = "${pname}-${version}/${cargoRoot}";
-    hash = cargoHash;
+    hash = "sha256-fx8q7b0KGEevn0DlMAGgAvQMXqZmBF8aINDwpaGyq7I=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/kde/gear/angelfish/default.nix b/pkgs/kde/gear/angelfish/default.nix
index 991196cb0cb1..3d6a8ae1ae44 100644
--- a/pkgs/kde/gear/angelfish/default.nix
+++ b/pkgs/kde/gear/angelfish/default.nix
@@ -7,8 +7,6 @@
   rustPlatform,
   cargo,
   rustc,
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-Q8cKnW4IpcpNrECXtgkPX8TdYqC5Fo4oXm1lB8RULRo=",
   qcoro,
 }:
 mkKdeDerivation rec {
@@ -19,7 +17,7 @@ mkKdeDerivation rec {
     # include version in the name so we invalidate the FOD
     name = "${pname}-${version}";
     src = sources.${pname};
-    hash = cargoHash;
+    hash = "sha256-offD53HaPG0GQk+aPjRzhhc8d8wfHYmdaJ0X8NtluMU=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/kde/gear/kdepim-addons/default.nix b/pkgs/kde/gear/kdepim-addons/default.nix
index 0d3e6c0f5cfe..0a32d7d8fb56 100644
--- a/pkgs/kde/gear/kdepim-addons/default.nix
+++ b/pkgs/kde/gear/kdepim-addons/default.nix
@@ -7,8 +7,6 @@
   discount,
   corrosion,
   alpaka,
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-LVPdcuKNPgT1kw9zOS04nd+5wuejDLyyhrK8EQfgY6A=",
 }:
 mkKdeDerivation rec {
   pname = "kdepim-addons";
@@ -17,12 +15,12 @@ mkKdeDerivation rec {
 
   cargoRoot = "plugins/webengineurlinterceptor/adblock";
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     # include version in the name so we invalidate the FOD
     name = "${pname}-${version}";
     src = sources.${pname};
     sourceRoot = "${pname}-${version}/${cargoRoot}";
-    hash = cargoHash;
+    hash = "sha256-v1TJ8xu4zXXig+ESYT0ZL6l1gOTbqyVA1P/6T/YnW0k=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix b/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
index 85b02e6620df..7b32751b4e0f 100644
--- a/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
+++ b/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  gcc13Stdenv,
   lib,
   fetchzip,
   autoconf,
@@ -17,7 +17,7 @@
   file included in the tarball
 */
 
-stdenv.mkDerivation {
+gcc13Stdenv.mkDerivation {
   pname = "cnijfilter";
 
   /*
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index f9e00616f0b1..0f2c1f462051 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -22,20 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kernelshark";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/snapshot/kernelshark-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-KV8ahV2koX7OL1C42H5If14e7m54jv0DlZ1dNsVRUWE=";
+    hash = "sha256-+Vi1Tj42bAxJKgGqVXbCYywqQAdz5y+Zv2hQH8iaJkM=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/patch/?id=9e33324644fff49b7aa15d34f836e72af8b32c78";
-      hash = "sha256-2XtEQ4WscLlUiEQYG2HiHuysMzVzlG05PVreLRVM8Lc=";
-    })
-  ];
-
   outputs = [ "out" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/foundationdb/cmake.nix b/pkgs/servers/foundationdb/cmake.nix
index 2d88687b00cc..b1d925c6a8bf 100644
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@@ -135,6 +135,8 @@ let
           license     = licenses.asl20;
           platforms   = [ "x86_64-linux" ]
             ++ lib.optionals (!(avxEnabled version)) [ "aarch64-linux" ];
+          # Fails when cross-compiling with "/bin/sh: gcc-ar: not found"
+          broken = stdenv.buildPlatform != stdenv.hostPlatform;
           maintainers = with maintainers; [ thoughtpolice lostnet ];
        };
     };
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
index 5a48c9337243..591e45485aea 100644
--- a/pkgs/servers/foundationdb/default.nix
+++ b/pkgs/servers/foundationdb/default.nix
@@ -11,7 +11,7 @@
   openjdk,
   mono,
   openssl,
-  boost,
+  boost186,
   pkg-config,
   msgpack-cxx,
   toml11,
@@ -26,7 +26,7 @@ in
   foundationdb73 = cmakeBuild {
     version = "7.3.42";
     hash = "sha256-jQcm+HLai5da2pZZ7iLdN6fpQZxf5+/kkfv9OSXQ57c=";
-    inherit boost;
+    boost = boost186;
     ssl = openssl;
 
     patches = [
@@ -38,6 +38,12 @@ in
         url = "https://github.com/apple/foundationdb/commit/c35a23d3f6b65698c3b888d76de2d93a725bff9c.patch";
         hash = "sha256-bneRoZvCzJp0Hp/G0SzAyUyuDrWErSpzv+ickZQJR5w=";
       })
+      # Add a dependency that prevents bindingtester to run before the python bindings are generated
+      # https://github.com/apple/foundationdb/pull/11859
+      (fetchpatch {
+        url = "https://github.com/apple/foundationdb/commit/8d04c97a74c6b83dd8aa6ff5af67587044c2a572.patch";
+        hash = "sha256-ZLIcmcfirm1+96DtTIr53HfM5z38uTLZrRNHAmZL6rc=";
+      })
     ];
   };
 }
diff --git a/pkgs/servers/home-assistant/custom-components/philips_airpurifier_coap/package.nix b/pkgs/servers/home-assistant/custom-components/philips_airpurifier_coap/package.nix
index f2cb6dd23e29..ec5eaf815b7c 100644
--- a/pkgs/servers/home-assistant/custom-components/philips_airpurifier_coap/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/philips_airpurifier_coap/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "kongo09";
   domain = "philips_airpurifier_coap";
-  version = "0.28.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "philips-airpurifier-coap";
     rev = "v${version}";
-    hash = "sha256-yoaph/R3c4j+sXEC02Hv+ixtuif70/y6Gag5NBpKFLs=";
+    hash = "sha256-jQXQdcgW8IDmjaHjmeyXHcNTXYmknNDw7Flegy6wj2A=";
   };
 
   dependencies = [
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
deleted file mode 100644
index e65d909b41f8..000000000000
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ /dev/null
@@ -1,113 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, SDL2
-, makeWrapper
-, wget
-, which
-, Accelerate
-, CoreGraphics
-, CoreML
-, CoreVideo
-, MetalKit
-
-, config
-, autoAddDriverRunpath
-, cudaSupport ? config.cudaSupport
-, cudaPackages ? {}
-}:
-
-let
-  # It's necessary to consistently use backendStdenv when building with CUDA support,
-  # otherwise we get libstdc++ errors downstream.
-  # cuda imposes an upper bound on the gcc version, e.g. the latest gcc compatible with cudaPackages_11 is gcc11
-  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
-in
-effectiveStdenv.mkDerivation (finalAttrs: {
-  pname = "whisper-cpp";
-  version = "1.7.2";
-
-  src = fetchFromGitHub {
-    owner = "ggerganov";
-    repo = "whisper.cpp";
-    rev = "refs/tags/v${finalAttrs.version}" ;
-    hash = "sha256-y30ZccpF3SCdRGa+P3ddF1tT1KnvlI4Fexx81wZxfTk=";
-  };
-
-  # The upstream download script tries to download the models to the
-  # directory of the script, which is not writable due to being
-  # inside the nix store. This patch changes the script to download
-  # the models to the current directory of where it is being run from.
-  patches = [ ./download-models.patch ];
-
-  nativeBuildInputs = [
-      which
-      makeWrapper
-    ] ++ lib.optionals cudaSupport [
-      cudaPackages.cuda_nvcc
-      autoAddDriverRunpath
-    ];
-
-  buildInputs = [
-      SDL2
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreML
-      CoreVideo
-      MetalKit
-    ] ++ lib.optionals cudaSupport ( with cudaPackages; [
-      cuda_cccl # provides nv/target
-      cuda_cudart
-      libcublas
-    ]);
-
-  postPatch = let
-    cudaOldStr = "-lcuda ";
-    cudaNewStr = "-lcuda -L${cudaPackages.cuda_cudart}/lib/stubs ";
-  in lib.optionalString cudaSupport ''
-    substituteInPlace Makefile \
-      --replace-fail '${cudaOldStr}' '${cudaNewStr}'
-  '';
-
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    WHISPER_COREML = "1";
-    WHISPER_COREML_ALLOW_FALLBACK = "1";
-    WHISPER_METAL_EMBED_LIBRARY = "1";
-  } // lib.optionalAttrs cudaSupport {
-    GGML_CUDA = "1";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-
-    cp ./main $out/bin/whisper-cpp
-
-    for file in *; do
-      if [[ -x "$file" && -f "$file" && "$file" != "main" ]]; then
-        cp "$file" "$out/bin/whisper-cpp-$file"
-      fi
-    done
-
-    cp models/download-ggml-model.sh $out/bin/whisper-cpp-download-ggml-model
-
-    wrapProgram $out/bin/whisper-cpp-download-ggml-model \
-      --prefix PATH : ${lib.makeBinPath [wget]}
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Port of OpenAI's Whisper model in C/C++";
-    longDescription = ''
-      To download the models as described in the project's readme, you may
-      use the `whisper-cpp-download-ggml-model` binary from this package.
-    '';
-    homepage = "https://github.com/ggerganov/whisper.cpp";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ dit7ya hughobrien ];
-  };
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 44efc2218587..a0db6ec6d3fb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -323,6 +323,7 @@ mapAliases {
   dtv-scan-tables_linuxtv = dtv-scan-tables; # Added 2023-03-03
   dtv-scan-tables_tvheadend = dtv-scan-tables; # Added 2023-03-03
   du-dust = dust; # Added 2024-01-19
+  dwfv = throw "'dwfv' has been removed due to lack of upstream maintenance";
   dylibbundler = throw "'dylibbundler' has been renamed to/replaced by 'macdylibbundler'"; # Converted to throw 2024-10-17
 
   ### E ###
@@ -821,6 +822,7 @@ mapAliases {
   llvm_9 = throw "llvm_9 has been removed from nixpkgs"; # Added 2024-04-08
 
   lobster-two = throw "'lobster-two' has been renamed to/replaced by 'google-fonts'"; # Converted to throw 2024-10-17
+  loc = throw "'loc' has been removed due to lack of upstream maintenance. Consider 'tokei' as an alternative."; # Added 2025-01-25
   loop = throw "'loop' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   lsh = throw "lsh has been removed as it had no maintainer in Nixpkgs and hasn't seen an upstream release in over a decade"; # Added 2024-08-14
   luna-icons = throw "luna-icons has been removed as it was removed upstream"; # Added 2024-10-29
@@ -997,6 +999,7 @@ mapAliases {
   oauth2_proxy = throw "'oauth2_proxy' has been renamed to/replaced by 'oauth2-proxy'"; # Converted to throw 2024-10-17
   oil = lib.warnOnInstantiate "Oil has been replaced with the faster native C++ version and renamed to 'oils-for-unix'. See also https://github.com/oils-for-unix/oils/wiki/Oils-Deployments" oils-for-unix; # Added 2024-10-22
   onevpl-intel-gpu = lib.warnOnInstantiate "onevpl-intel-gpu has been renamed to vpl-gpu-rt" vpl-gpu-rt; # Added 2024-06-04
+  openai-whisper-cpp = whisper-cpp; # Added 2024-12-13
   opencv2 = throw "opencv2 has been removed as it is obsolete and was not used by any other package; please migrate to OpenCV 4"; # Added 2024-08-20
   opencv3 = throw "opencv3 has been removed as it is obsolete and was not used by any other package; please migrate to OpenCV 4"; # Added 2024-08-20
   openafs_1_8 = openafs; # Added 2022-08-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6b27d548a1a4..e4c00c5bcb56 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8137,10 +8137,6 @@ with pkgs;
 
   openai-whisper = with python3.pkgs; toPythonApplication openai-whisper;
 
-  openai-whisper-cpp = darwin.apple_sdk_11_0.callPackage ../tools/audio/openai-whisper-cpp {
-    inherit (darwin.apple_sdk_11_0.frameworks) Accelerate CoreGraphics CoreML CoreVideo MetalKit;
-  };
-
   openocd-rp2040 = openocd.overrideAttrs (old: {
     pname = "openocd-rp2040";
     src = fetchFromGitHub {
@@ -8412,6 +8408,10 @@ with pkgs;
     inherit (llvmPackages) clang-unwrapped;
   };
 
+  whisper-cpp-vulkan = whisper-cpp.override {
+    vulkanSupport = true;
+  };
+
   watson-ruby = callPackage ../development/tools/misc/watson-ruby { };
 
   xmake = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/xmake {
@@ -17142,6 +17142,7 @@ with pkgs;
     coqPackages_8_18 coq_8_18
     coqPackages_8_19 coq_8_19
     coqPackages_8_20 coq_8_20
+    coqPackages_9_0 coq_9_0
     coqPackages      coq
   ;
 
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 87bf3a7b7a7f..8e6ac8cafe4c 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -235,6 +235,7 @@ in rec {
   coq_8_18 = mkCoq "8.18";
   coq_8_19 = mkCoq "8.19";
   coq_8_20 = mkCoq "8.20";
+  coq_9_0 = mkCoq "9.0";
 
   coqPackages_8_5 = mkCoqPackages coq_8_5;
   coqPackages_8_6 = mkCoqPackages coq_8_6;
@@ -252,6 +253,7 @@ in rec {
   coqPackages_8_18 = mkCoqPackages coq_8_18;
   coqPackages_8_19 = mkCoqPackages coq_8_19;
   coqPackages_8_20 = mkCoqPackages coq_8_20;
+  coqPackages_9_0 = mkCoqPackages coq_9_0;
 
   coqPackages = recurseIntoAttrs coqPackages_8_20;
   coq = coqPackages.coq;