diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 9b71c6656914..04676476f4b2 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -9,6 +9,7 @@
   beforeResultDir,
   afterResultDir,
   touchedFilesJson,
+  byName ? false,
 }:
 let
   /*
@@ -119,6 +120,7 @@ let
   maintainers = import ./maintainers.nix {
     changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
     changedpathsjson = touchedFilesJson;
+    inherit byName;
   };
 in
 runCommand "compare"
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 69748a629cff..8fb43be4d8e7 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,5 +1,9 @@
 # Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
-{ changedattrs, changedpathsjson }:
+{
+  changedattrs,
+  changedpathsjson,
+  byName ? false,
+}:
 let
   pkgs = import ../../.. {
     system = "x86_64-linux";
@@ -41,7 +45,18 @@ let
   ) validPackageAttributes;
 
   attrsWithMaintainers = builtins.map (
-    pkg: pkg // { maintainers = (pkg.package.meta or { }).maintainers or [ ]; }
+    pkg:
+    let
+      meta = pkg.package.meta or { };
+    in
+    pkg
+    // {
+      # TODO: Refactor this so we can ping entire teams instead of the individual members.
+      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+      maintainers =
+        meta.maintainers or [ ]
+        ++ lib.flatten (map (team: team.members or [ ]) (meta.teams or [ ]));
+    }
   ) attrsWithPackages;
 
   relevantFilenames =
@@ -83,12 +98,13 @@ let
     pkg:
     builtins.map (maintainer: {
       id = maintainer.githubId;
+      inherit (maintainer) github;
       packageName = pkg.name;
       dueToFiles = pkg.filenames;
     }) pkg.maintainers
   ) attrsWithModifiedFiles;
 
-  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
+  byMaintainer = lib.groupBy (ping: toString ping.${if byName then "github" else "id"}) listToPing;
 
   packagesPerMaintainer = lib.attrsets.mapAttrs (
     maintainer: packages: builtins.map (pkg: pkg.packageName) packages
diff --git a/doc/build-helpers/images/appimagetools.section.md b/doc/build-helpers/images/appimagetools.section.md
index 81d399e87812..7bfc45287d1f 100644
--- a/doc/build-helpers/images/appimagetools.section.md
+++ b/doc/build-helpers/images/appimagetools.section.md
@@ -33,7 +33,7 @@ let
   version = "0.6.30";
 
   src = fetchurl {
-    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
 in
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index dfe7a3c4cc9b..d4b1d65b42b2 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -49,6 +49,8 @@ stdenvNoCC.mkDerivation (
     '';
 
     buildPhase = ''
+      runHook preBuild
+
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
@@ -84,9 +86,13 @@ stdenvNoCC.mkDerivation (
         --section-toc-depth 1 \
         manual.md \
         out/index.html
+
+      runHook postBuild
     '';
 
     installPhase = ''
+      runHook preInstall
+
       dest="$out/share/doc/nixpkgs"
       mkdir -p "$(dirname "$dest")"
       mv out "$dest"
@@ -97,6 +103,8 @@ stdenvNoCC.mkDerivation (
       mkdir -p $out/nix-support/
       echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
       echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
+
+      runHook postInstall
     '';
 
     passthru = {
diff --git a/doc/functions/generators.section.md b/doc/functions/generators.section.md
index f636d00cc258..0b073c641e53 100644
--- a/doc/functions/generators.section.md
+++ b/doc/functions/generators.section.md
@@ -27,8 +27,8 @@ let
     } ":";
   };
 
-  # the INI file can now be given as plain old nix values
 in
+# the INI file can now be given as plain old nix values
 customToINI {
   main = {
     pushinfo = true;
diff --git a/doc/hooks/tauri.section.md b/doc/hooks/tauri.section.md
index 400e493d7fee..b46b738d5c88 100644
--- a/doc/hooks/tauri.section.md
+++ b/doc/hooks/tauri.section.md
@@ -23,15 +23,15 @@ In Nixpkgs, `cargo-tauri.hook` overrides the default build and install phases.
   wrapGAppsHook4,
 }:
 
-rustPlatform.buildRustPackage rec {
-  # . . .
+rustPlatform.buildRustPackage (finalAttrs: {
+  # ...
 
   useFetchCargoVendor = true;
   cargoHash = "...";
 
   # Assuming our app's frontend uses `npm` as a package manager
   npmDeps = fetchNpmDeps {
-    name = "${pname}-npm-deps-${version}";
+    name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
     inherit src;
     hash = "...";
   };
@@ -61,8 +61,8 @@ rustPlatform.buildRustPackage rec {
   # And make sure we build there too
   buildAndTestSubdir = cargoRoot;
 
-  # . . .
-}
+  # ...
+})
 ```
 
 ## Variables controlling cargo-tauri {#tauri-hook-variables-controlling}
diff --git a/doc/languages-frameworks/agda.section.md b/doc/languages-frameworks/agda.section.md
index 95b8afcbd1c0..6b9e577f8119 100644
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@@ -208,8 +208,12 @@ mkDerivation {
   libraryName = "IAL-1.3";
 
   buildPhase = ''
+    runHook preBuild
+
     patchShebangs find-deps.sh
     make
+
+    runHook postBuild
   '';
 }
 ```
diff --git a/doc/languages-frameworks/bower.section.md b/doc/languages-frameworks/bower.section.md
index 9e12afc68273..3783773e2bf2 100644
--- a/doc/languages-frameworks/bower.section.md
+++ b/doc/languages-frameworks/bower.section.md
@@ -105,10 +105,17 @@ pkgs.stdenv.mkDerivation {
     src = myWebApp;
   };
 
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook # note 3
+  ];
+
   buildPhase = ''
+    runHook preBuild
+
     cp --reflink=auto --no-preserve=mode -R $bowerComponents/bower_components . # note 2
-    export HOME=$PWD # note 3
     ${pkgs.nodePackages.gulp}/bin/gulp build # note 4
+
+    runHook postBuild
   '';
 
   installPhase = "mv gulpdist $out";
diff --git a/doc/languages-frameworks/dart.section.md b/doc/languages-frameworks/dart.section.md
index 3855cca89987..32a9a0b6f653 100644
--- a/doc/languages-frameworks/dart.section.md
+++ b/doc/languages-frameworks/dart.section.md
@@ -42,8 +42,8 @@ buildDartApplication rec {
 
   src = fetchFromGitHub {
     owner = "sass";
-    repo = pname;
-    rev = version;
+    repo = "dart-sass";
+    tag = version;
     hash = "sha256-U6enz8yJcc4Wf8m54eYIAnVg/jsGi247Wy8lp1r1wg4=";
   };
 
diff --git a/doc/languages-frameworks/dlang.section.md b/doc/languages-frameworks/dlang.section.md
index 6e9edefc5e0f..fa211dc6a43d 100644
--- a/doc/languages-frameworks/dlang.section.md
+++ b/doc/languages-frameworks/dlang.section.md
@@ -22,7 +22,7 @@ buildDubPackage rec {
   src = fetchFromGitHub {
     owner = "CyberShadow";
     repo = "btdu";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3sSZq+5UJH02IO0Y1yL3BLHDb4lk8k6awb5ZysBQciE=";
   };
 
diff --git a/doc/languages-frameworks/emscripten.section.md b/doc/languages-frameworks/emscripten.section.md
index ce0956c51b02..0fca82f70aed 100644
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@@ -41,12 +41,13 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 (pkgs.zlib.override {
   stdenv = pkgs.emscriptenStdenv;
 }).overrideAttrs
-  (old: rec {
+  (old: {
     buildInputs = old.buildInputs ++ [ pkg-config ];
     # we need to reset this setting!
     env = (old.env or { }) // {
       NIX_CFLAGS_COMPILE = "";
     };
+
     configurePhase = ''
       # FIXME: Some tests require writing at $HOME
       HOME=$TMPDIR
@@ -57,15 +58,29 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 
       runHook postConfigure
     '';
+
     dontStrip = true;
     outputs = [ "out" ];
+
     buildPhase = ''
+      runHook preBuild
+
       emmake make
+
+      runHook postBuild
     '';
+
     installPhase = ''
+      runHook preInstall
+
       emmake make install
+
+      runHook postInstall
     '';
+
     checkPhase = ''
+      runHook preCheck
+
       echo "================= testing zlib using node ================="
 
       echo "Compiling a custom test"
@@ -84,6 +99,8 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
         echo "it seems to work! very good."
       fi
       echo "================= /testing zlib using node ================="
+
+      runHook postCheck
     '';
 
     postPatch = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin ''
@@ -102,8 +119,9 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 This `xmlmirror` example features an Emscripten package that is defined completely from this context and no `pkgs.zlib.override` is used.
 
 ```nix
-pkgs.buildEmscriptenPackage rec {
-  name = "xmlmirror";
+pkgs.buildEmscriptenPackage {
+  pname = "xmlmirror";
+  version = "1.2.3";
 
   buildInputs = [
     pkg-config
@@ -116,8 +134,10 @@ pkgs.buildEmscriptenPackage rec {
     openjdk
     json_c
   ];
+
   nativeBuildInputs = [
     pkg-config
+    writableTmpDirAsHomeHook
     zlib
   ];
 
@@ -128,6 +148,8 @@ pkgs.buildEmscriptenPackage rec {
   };
 
   configurePhase = ''
+    runHook preConfigure
+
     rm -f fastXmlLint.js*
     # a fix for ERROR:root:For asm.js, TOTAL_MEMORY must be a multiple of 16MB, was 234217728
     # https://gitlab.com/odfplugfest/xmlmirror/issues/8
@@ -137,11 +159,16 @@ pkgs.buildEmscriptenPackage rec {
     sed -e "s/\$(JSONC_LDFLAGS) \$(ZLIB_LDFLAGS) \$(LIBXML20_LDFLAGS)/\$(JSONC_LDFLAGS) \$(LIBXML20_LDFLAGS) \$(ZLIB_LDFLAGS) /g" -i Makefile.emEnv
     # https://gitlab.com/odfplugfest/xmlmirror/issues/11
     sed -e "s/-o fastXmlLint.js/-s EXTRA_EXPORTED_RUNTIME_METHODS='[\"ccall\", \"cwrap\"]' -o fastXmlLint.js/g" -i Makefile.emEnv
+
+    runHook postConfigure
   '';
 
   buildPhase = ''
-    HOME=$TMPDIR
+    runHook preBuild
+
     make -f Makefile.emEnv
+
+    runHook postBuild
   '';
 
   outputs = [
@@ -150,6 +177,8 @@ pkgs.buildEmscriptenPackage rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share
     mkdir -p $doc/share/${name}
 
@@ -163,9 +192,13 @@ pkgs.buildEmscriptenPackage rec {
     cp *.json $out/share
     cp *.rng $out/share
     cp README.md $doc/share/${name}
+    runHook postInstall
   '';
-  checkPhase = ''
 
+  checkPhase = ''
+    runHook preCheck
+
+    runHook postCheck
   '';
 }
 ```
diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index 34bf913ef1e8..c23dba3d0cc1 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -13,14 +13,14 @@ The following is an example expression using `buildGoModule`:
 
 ```nix
 {
-  pet = buildGoModule rec {
+  pet = buildGoModule (finalAttrs: {
     pname = "pet";
     version = "0.3.4";
 
     src = fetchFromGitHub {
       owner = "knqyf263";
       repo = "pet";
-      rev = "v${version}";
+      tag = "v${finalAttrs.version}";
       hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
     };
 
@@ -32,7 +32,7 @@ The following is an example expression using `buildGoModule`:
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [ kalbasit ];
     };
-  };
+  });
 }
 ```
 
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 440e8c62adaa..56d0c71b8d9c 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -198,14 +198,14 @@ Here's an example:
   fetchFromGitHub,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "flood";
   version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "jesec";
-    repo = pname;
-    rev = "v${version}";
+    repo = "flood";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BR+ZGkBBfd0dSQqAvujsbgsEPFYw/ThrylxUbOksYxM=";
   };
 
@@ -222,7 +222,7 @@ buildNpmPackage rec {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ winter ];
   };
-}
+})
 ```
 
 In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
@@ -646,9 +646,16 @@ It's important to use the `--offline` flag. For example if you script is `"build
 
 ```nix
 {
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
   buildPhase = ''
-    export HOME=$(mktemp -d)
+    runHook preBuild
+
     yarn --offline build
+
+    runHook postBuild
   '';
 }
 ```
diff --git a/doc/languages-frameworks/lisp.section.md b/doc/languages-frameworks/lisp.section.md
index 6682137121ee..7f6fe99419bd 100644
--- a/doc/languages-frameworks/lisp.section.md
+++ b/doc/languages-frameworks/lisp.section.md
@@ -135,7 +135,6 @@ During Quicklisp import:
 - names starting with a number have a `_` prepended (`3d-vectors`->`_3d-vectors`)
 - `_` in names is converted to `__` for reversibility
 
-
 ## Defining packages manually inside Nixpkgs {#lisp-defining-packages-inside}
 
 Packages that for some reason are not in Quicklisp, and so cannot be
@@ -185,7 +184,7 @@ let
       domain = "gitlab.common-lisp.net";
       owner = "alexandria";
       repo = "alexandria";
-      rev = "v${version}";
+      tag = "v${version}";
       hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
     };
   };
@@ -212,7 +211,7 @@ sbcl.pkgs.alexandria.overrideLispAttrs (oldAttrs: rec {
     domain = "gitlab.common-lisp.net";
     owner = "alexandria";
     repo = "alexandria";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
   };
 })
diff --git a/doc/languages-frameworks/maven.section.md b/doc/languages-frameworks/maven.section.md
index 1689ad1580a7..d70501651f26 100644
--- a/doc/languages-frameworks/maven.section.md
+++ b/doc/languages-frameworks/maven.section.md
@@ -23,8 +23,8 @@ maven.buildMavenPackage rec {
 
   src = fetchFromGitHub {
     owner = "intoolswetrust";
-    repo = pname;
-    rev = "${pname}-${version}";
+    repo = "jd-cli";
+    tag = "jd-cli-${version}";
     hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
   };
 
@@ -33,11 +33,15 @@ maven.buildMavenPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/share/jd-cli
     install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
 
     makeWrapper ${jre}/bin/java $out/bin/jd-cli \
       --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
+
+    runHook postInstall
   '';
 
   meta = {
@@ -301,16 +305,24 @@ stdenv.mkDerivation {
   buildInputs = [ maven ];
   src = ./.; # or fetchFromGitHub, cleanSourceWith, etc
   buildPhase = ''
+    runHook preBuild
+
     mvn package -Dmaven.repo.local=$out
+
+    runHook postBuild
   '';
 
   # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
   installPhase = ''
+    runHook preInstall
+
     find $out -type f \
       -name \*.lastUpdated -or \
       -name resolver-status.properties -or \
       -name _remote.repositories \
       -delete
+
+    runHook postInstall
   '';
 
   # don't do any fixup
@@ -354,11 +366,11 @@ Regardless of which strategy is chosen above, the step to build the derivation i
   maven,
   callPackage,
 }:
-# pick a repository derivation, here we will use buildMaven
 let
+  # pick a repository derivation, here we will use buildMaven
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -366,14 +378,22 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    runHook preInstall
+
+    install -Dm644 target/${finalAttrs.pname}-${finalAttrs.version}.jar $out/share/java
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 ::: {.tip}
@@ -421,7 +441,7 @@ We make sure to provide this classpath to the `makeWrapper`.
 let
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -430,22 +450,30 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
 
     classpath=$(find ${repository} -name "*.jar" -printf ':%h/%f');
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/${pname} \
-          --add-flags "-classpath $out/share/java/${pname}-${version}.jar:''${classpath#:}" \
+    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+          --add-flags "-classpath $out/share/java/maven-demo-${finalAttrs.version}.jar:''${classpath#:}" \
           --add-flags "Main"
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 #### MANIFEST file via Maven Plugin {#manifest-file-via-maven-plugin}
@@ -502,11 +530,11 @@ We will modify the derivation above to add a symlink to our repository so that i
   makeWrapper,
   jre,
 }:
-# pick a repository derivation, here we will use buildMaven
 let
+  # pick a repository derivation, here we will use buildMaven
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -515,23 +543,31 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
 
     # create a symbolic link for the repository directory
     ln -s ${repository} $out/repository
 
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/${pname} \
-          --add-flags "-jar $out/share/java/${pname}-${version}.jar"
+    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+          --add-flags "-jar $out/share/java/maven-demo-${finalAttrs.version}.jar"
+
+    runHook postInstall
   '';
-}
+})
 ```
 ::: {.note}
 Our script produces a dependency on `jre` rather than `jdk` to restrict the runtime closure necessary to run the application.
diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index 496583d40261..62a54640b2fb 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -83,8 +83,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "inhabitedtype";
-    repo = pname;
-    rev = version;
+    repo = "angstrom";
+    tag = version;
     hash = "sha256-MK8o+iPGANEhrrTc1Kz9LBilx2bDPQt7Pp5P2libucI=";
   };
 
@@ -124,7 +124,7 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.02";
 
   src = fetchurl {
-    url = "https://github.com/flowtype/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    url = "https://github.com/flowtype/ocaml-wtf8/releases/download/v${version}/wtf8-v${version}.tbz";
     hash = "sha256-d5/3KUBAWRj8tntr4RkJ74KWW7wvn/B/m1nx0npnzyc=";
   };
 
diff --git a/doc/languages-frameworks/perl.section.md b/doc/languages-frameworks/perl.section.md
index 3683ed515d0e..50fc4945ff76 100644
--- a/doc/languages-frameworks/perl.section.md
+++ b/doc/languages-frameworks/perl.section.md
@@ -39,7 +39,7 @@ Perl packages from CPAN are defined in [pkgs/top-level/perl-packages.nix](https:
     pname = "Class-C3";
     version = "0.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/F/FL/FLORA/${pname}-${version}.tar.gz";
+      url = "mirror://cpan/authors/id/F/FL/FLORA/Class-C3-${version}.tar.gz";
       hash = "sha256-/5GE5xHT0uYGOQxroqj6LMU7CtKn2s6vMVoSXxL4iK4=";
     };
   };
@@ -88,7 +88,7 @@ buildPerlPackage rec {
   version = "0.36";
 
   src = fetchurl {
-    url = "mirror://cpan/authors/id/P/PM/PMQS/${pname}-${version}.tar.gz";
+    url = "mirror://cpan/authors/id/P/PM/PMQS/BerkeleyDB-${version}.tar.gz";
     hash = "sha256-4Y+HGgGQqcOfdiKcFIyMrWBEccVNVAMDBWZlFTMorh8=";
   };
 
@@ -107,7 +107,7 @@ Dependencies on other Perl packages can be specified in the `buildInputs` and `p
     pname = "Class-C3-Componentised";
     version = "1.0004";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AS/ASH/${pname}-${version}.tar.gz";
+      url = "mirror://cpan/authors/id/A/AS/ASH/Class-C3-Componentised-${version}.tar.gz";
       hash = "sha256-ASO9rV/FzJYZ0BH572Fxm2ZrFLMZLFATJng1NuU4FHc=";
     };
     propagatedBuildInputs = [
@@ -137,7 +137,7 @@ On Darwin, if a script has too many `-Idir` flags in its first line (its “sheb
     version = "12.50";
 
     src = fetchurl {
-      url = "https://exiftool.org/${pname}-${version}.tar.gz";
+      url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
       hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
     };
 
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 119e19f71877..6594254a0387 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -2135,8 +2135,9 @@ Occasionally packages don't make use of a common test framework, which may then
 
 #### Common issues {#common-issues}
 
-* Tests that attempt to access `$HOME` can be fixed by using the following
-  work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+* Tests that attempt to access `$HOME` can be fixed by using `writableTmpDirAsHomeHook` in
+  `nativeCheckInputs`, which sets up a writable temporary directory as the home directory. Alternatively,
+  you can achieve the same effect manually (e.g. in `preCheck`) with: `export HOME=$(mktemp -d)`.
 * Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.
   This can be fixed with two changes in the derivation: 1) replacing `pytest` with
   `pytestCheckHook` and 2) adding a `preCheck` containing `cd $out` to run
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 20d8b4824620..9f1f0603523a 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -28,14 +28,14 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ripgrep";
   version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
-    repo = pname;
-    rev = version;
+    repo = "ripgrep";
+    tag = finalAttrs.version;
     hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.unlicense;
     maintainers = [ ];
   };
-}
+})
 ```
 
 `buildRustPackage` requires a `cargoHash` attribute, computed over all crate sources of this package.
@@ -104,21 +104,21 @@ be made invariant to the version by setting `cargoDepsName` to
 `pname`:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "broot";
   version = "1.2.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-aDQA4A5mScX9or3Lyiv/5GyAehidnpKKE0grhbP1Ctc=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-iDYh52rj1M5Uupvbx2WeDd/jvQZ+2A50V5rp5e2t7q4=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   # ...
-}
+})
 ```
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
@@ -184,7 +184,7 @@ The output hash of each dependency that uses a git source must be
 specified in the `outputHashes` attribute. For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -209,7 +209,7 @@ For usage outside nixpkgs, `allowBuiltinFetchGit` could be used to
 avoid having to specify `outputHashes`. For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -235,7 +235,7 @@ If you want to use different features for check phase, you can use
 For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -427,7 +427,7 @@ source code in a reproducible way. If it is missing or out-of-date one can use
 the `cargoPatches` attribute to update or add it.
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   # ...
   cargoPatches = [
     # a patch file to add/update Cargo.lock in the source code
@@ -575,8 +575,8 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "huggingface";
-    repo = pname;
-    rev = "python-v${version}";
+    repo = "tokenizers";
+    tag = "python-v${version}";
     hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
   };
 
@@ -665,7 +665,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "retworkx";
-    rev = version;
+    tag = version;
     hash = "sha256-11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20=";
   };
 
@@ -705,7 +705,7 @@ Some projects, especially GNOME applications, are built with the Meson Build Sys
   tinysparql,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "health";
   version = "0.95.0";
 
@@ -713,12 +713,12 @@ stdenv.mkDerivation rec {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "health";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-eR1ZGtTZQNhofFUEjI7IX16sMKPJmAl7aIFfPJukecg=";
   };
 
@@ -740,7 +740,7 @@ stdenv.mkDerivation rec {
   ];
 
   # ...
-}
+})
 ```
 
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
@@ -1000,20 +1000,21 @@ let
   };
 in
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ripgrep";
   version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-9atn5qyBDy4P6iUoHFhg+TV6Ur71fiah4oTJbBMeEy4=";
 
+  # Tests require network access. Skipping.
   doCheck = false;
 
   meta = {
@@ -1025,7 +1026,7 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [ ];
   };
-}
+})
 ```
 
 Follow the below steps to try that snippet.
diff --git a/doc/languages-frameworks/swift.section.md b/doc/languages-frameworks/swift.section.md
index 50fbd511aca9..b9d4b5a7cba8 100644
--- a/doc/languages-frameworks/swift.section.md
+++ b/doc/languages-frameworks/swift.section.md
@@ -82,15 +82,15 @@ let
   generated = swiftpm2nix.helpers ./nix;
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "myproject";
   version = "0.0.0";
 
   src = fetchFromGitHub {
     owner = "nixos";
-    repo = pname;
-    rev = version;
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    repo = "myproject";
+    tag = finalAttrs.version;
+    hash = "";
   };
 
   # Including SwiftPM as a nativeBuildInput provides a buildPhase for you.
@@ -106,14 +106,18 @@ stdenv.mkDerivation rec {
   configurePhase = generated.configure;
 
   installPhase = ''
+    runHook preInstall
+
     # This is a special function that invokes swiftpm to find the location
     # of the binaries it produced.
     binPath="$(swiftpmBinPath)"
     # Now perform any installation steps.
     mkdir -p $out/bin
     cp $binPath/myproject $out/bin/
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 ### Custom build flags {#ssec-swiftpm-custom-build-flags}
diff --git a/doc/languages-frameworks/texlive.section.md b/doc/languages-frameworks/texlive.section.md
index 9256c9c38ce7..b3a13dc8b8d2 100644
--- a/doc/languages-frameworks/texlive.section.md
+++ b/doc/languages-frameworks/texlive.section.md
@@ -94,18 +94,18 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
 - TeX Live packages are also available under `texlive.pkgs` as derivations with outputs `out`, `tex`, `texdoc`, `texsource`, `tlpkg`, `man`, `info`. They cannot be installed outside of `texlive.combine` but are available for other uses. To repackage a font, for instance, use
 
   ```nix
-  stdenvNoCC.mkDerivation rec {
+  stdenvNoCC.mkDerivation (finalAttrs: {
     src = texlive.pkgs.iwona;
     dontUnpack = true;
 
-    inherit (src) pname version;
+    inherit (finalAttrs.src) pname version;
 
     installPhase = ''
       runHook preInstall
       install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
       runHook postInstall
     '';
-  }
+  })
   ```
 
   See `biber`, `iwona` for complete examples.
@@ -173,6 +173,7 @@ let
       (writeShellScript "force-tex-output.sh" ''
         out="''${tex-}"
       '')
+      writableTmpDirAsHomeHook # Need a writable $HOME for latexmk
     ];
 
     dontConfigure = true;
@@ -184,7 +185,6 @@ let
       latex foiltex.ins
 
       # Generate the documentation
-      export HOME=.
       latexmk -pdf foiltex.dtx
 
       runHook postBuild
diff --git a/doc/packages/emacs.section.md b/doc/packages/emacs.section.md
index 7d02a9389099..322ece4a348f 100644
--- a/doc/packages/emacs.section.md
+++ b/doc/packages/emacs.section.md
@@ -28,80 +28,79 @@ You can install it like any other packages via `nix-env -iA myEmacs`. However, t
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myEmacsConfig = writeText "default.el" ''
-        (eval-when-compile
-          (require 'use-package))
+  packageOverrides = pkgs: {
+    myEmacsConfig = pkgs.writeText "default.el" ''
+      (eval-when-compile
+        (require 'use-package))
 
-        ;; load some packages
+      ;; load some packages
 
-        (use-package company
-          :bind ("<C-tab>" . company-complete)
-          :diminish company-mode
-          :commands (company-mode global-company-mode)
-          :defer 1
-          :config
-          (global-company-mode))
+      (use-package company
+        :bind ("<C-tab>" . company-complete)
+        :diminish company-mode
+        :commands (company-mode global-company-mode)
+        :defer 1
+        :config
+        (global-company-mode))
 
-        (use-package counsel
-          :commands (counsel-descbinds)
-          :bind (([remap execute-extended-command] . counsel-M-x)
-                 ("C-x C-f" . counsel-find-file)
-                 ("C-c g" . counsel-git)
-                 ("C-c j" . counsel-git-grep)
-                 ("C-c k" . counsel-ag)
-                 ("C-x l" . counsel-locate)
-                 ("M-y" . counsel-yank-pop)))
+      (use-package counsel
+        :commands (counsel-descbinds)
+        :bind (([remap execute-extended-command] . counsel-M-x)
+               ("C-x C-f" . counsel-find-file)
+               ("C-c g" . counsel-git)
+               ("C-c j" . counsel-git-grep)
+               ("C-c k" . counsel-ag)
+               ("C-x l" . counsel-locate)
+               ("M-y" . counsel-yank-pop)))
 
-        (use-package flycheck
-          :defer 2
-          :config (global-flycheck-mode))
+      (use-package flycheck
+        :defer 2
+        :config (global-flycheck-mode))
 
-        (use-package ivy
-          :defer 1
-          :bind (("C-c C-r" . ivy-resume)
-                 ("C-x C-b" . ivy-switch-buffer)
-                 :map ivy-minibuffer-map
-                 ("C-j" . ivy-call))
-          :diminish ivy-mode
-          :commands ivy-mode
-          :config
-          (ivy-mode 1))
+      (use-package ivy
+        :defer 1
+        :bind (("C-c C-r" . ivy-resume)
+               ("C-x C-b" . ivy-switch-buffer)
+               :map ivy-minibuffer-map
+               ("C-j" . ivy-call))
+        :diminish ivy-mode
+        :commands ivy-mode
+        :config
+        (ivy-mode 1))
 
-        (use-package magit
-          :defer
-          :if (executable-find "git")
-          :bind (("C-x g" . magit-status)
-                 ("C-x G" . magit-dispatch-popup))
-          :init
-          (setq magit-completing-read-function 'ivy-completing-read))
+      (use-package magit
+        :defer
+        :if (executable-find "git")
+        :bind (("C-x g" . magit-status)
+               ("C-x G" . magit-dispatch-popup))
+        :init
+        (setq magit-completing-read-function 'ivy-completing-read))
 
-        (use-package projectile
-          :commands projectile-mode
-          :bind-keymap ("C-c p" . projectile-command-map)
-          :defer 5
-          :config
-          (projectile-global-mode))
-      '';
+      (use-package projectile
+        :commands projectile-mode
+        :bind-keymap ("C-c p" . projectile-command-map)
+        :defer 5
+        :config
+        (projectile-global-mode))
+    '';
 
-      myEmacs = emacs.pkgs.withPackages (
-        epkgs:
-        (with epkgs.melpaStablePackages; [
-          (runCommand "default.el" { } ''
-            mkdir -p $out/share/emacs/site-lisp
-            cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
-          '')
-          company
-          counsel
-          flycheck
-          ivy
-          magit
-          projectile
-          use-package
-        ])
-      );
-    };
+    myEmacs = emacs.pkgs.withPackages (
+      epkgs:
+      (with epkgs.melpaStablePackages; [
+        (runCommand "default.el" { } ''
+          mkdir -p $out/share/emacs/site-lisp
+          cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
+        '')
+        company
+        counsel
+        flycheck
+        ivy
+        magit
+        projectile
+        use-package
+      ])
+    );
+  };
 }
 ```
 
diff --git a/doc/redirects.json b/doc/redirects.json
index 46eb54c6c67b..627b4137281d 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -431,6 +431,9 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
+  "var-meta-teams": [
+    "index.html#var-meta-teams"
+  ],
   "variables-specifying-dependencies": [
     "index.html#variables-specifying-dependencies"
   ],
diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 2e29c75e7a99..908b97cac224 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -91,6 +91,10 @@ For details, see [Source provenance](#sec-meta-sourceProvenance).
 
 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
 
+### `teams` {#var-meta-teams}
+
+A list of the teams of this Nix expression. Teams are defined in [`nixpkgs/maintainers/team-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/team-list.nix), and can be defined in a package with `meta.teams = with lib.teams; [ team1 team2 ]`.
+
 ### `mainProgram` {#var-meta-mainProgram}
 
 The name of the main binary for the package. This affects the binary `nix run` executes. Example: `"rg"`
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 87cbd07a7dd7..2574de140b73 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -20,14 +20,14 @@ stdenv.mkDerivation {
 **Since [RFC 0035](https://github.com/NixOS/rfcs/pull/35), this is preferred for packages in Nixpkgs**, as it allows us to reuse the version easily:
 
 ```nix
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libfoo";
   version = "1.2.3";
   src = fetchurl {
-    url = "http://example.org/libfoo-source-${version}.tar.bz2";
+    url = "http://example.org/libfoo-source-${finalAttrs.version}.tar.bz2";
     hash = "sha256-tWxU/LANbQE32my+9AXyt3nCT7NBVfJ45CX757EMT3Q=";
   };
-}
+})
 ```
 
 Many packages have dependencies that are not provided in the standard environment. It’s usually sufficient to specify those dependencies in the `buildInputs` attribute:
@@ -53,13 +53,24 @@ Often it is necessary to override or modify some aspect of the build. To make th
 stdenv.mkDerivation {
   pname = "fnord";
   version = "4.5";
+
   # ...
+
   buildPhase = ''
+    runHook preBuild
+
     gcc foo.c -o foo
+
+    runHook postBuild
   '';
+
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp foo $out/bin
+
+    runHook postInstall
   '';
 }
 ```
@@ -212,12 +223,12 @@ These dependencies are only injected when [`doCheck`](#var-stdenv-doCheck) is se
 
 Consider for example this simplified derivation for `solo5`, a sandboxing tool:
 ```nix
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "solo5";
   version = "0.7.5";
 
   src = fetchurl {
-    url = "https://github.com/Solo5/solo5/releases/download/v${version}/solo5-v${version}.tar.gz";
+    url = "https://github.com/Solo5/solo5/releases/download/v${finalAttrs.version}/solo5-v${finalAttrs.version}.tar.gz";
     hash = "sha256-viwrS9lnaU8sTGuzK/+L/PlMM/xRRtgVuK5pixVeDEw=";
   };
 
@@ -225,6 +236,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     pkg-config
   ];
+
   buildInputs = [ libseccomp ];
 
   postInstall = ''
@@ -249,8 +261,8 @@ stdenv.mkDerivation rec {
     util-linux
     qemu
   ];
-  checkPhase = ''[elided] '';
-}
+  checkPhase = ''[elided]'';
+})
 ```
 
 - `makeWrapper` is a setup hook, i.e., a shell script sourced by the generic builder of `stdenv`.
diff --git a/doc/using/configuration.chapter.md b/doc/using/configuration.chapter.md
index 850465377a54..3467021715e6 100644
--- a/doc/using/configuration.chapter.md
+++ b/doc/using/configuration.chapter.md
@@ -300,42 +300,41 @@ This provides us with some useful documentation for using our packages.  However
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myProfile = writeText "my-profile" ''
-        export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
-        export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
-      '';
-      myPackages = pkgs.buildEnv {
-        name = "my-packages";
-        paths = [
-          (runCommand "profile" { } ''
-            mkdir -p $out/etc/profile.d
-            cp ${myProfile} $out/etc/profile.d/my-profile.sh
-          '')
-          aspell
-          bc
-          coreutils
-          ffmpeg
-          man
-          nix
-          emscripten
-          jq
-          nox
-          silver-searcher
-        ];
-        pathsToLink = [
-          "/share/man"
-          "/share/doc"
-          "/bin"
-          "/etc"
-        ];
-        extraOutputsToInstall = [
-          "man"
-          "doc"
-        ];
-      };
+  packageOverrides = pkgs: {
+    myProfile = pkgs.writeText "my-profile" ''
+      export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+      export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = with pkgs; [
+        (runCommand "profile" { } ''
+          mkdir -p $out/etc/profile.d
+          cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nix
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
+      pathsToLink = [
+        "/share/man"
+        "/share/doc"
+        "/bin"
+        "/etc"
+      ];
+      extraOutputsToInstall = [
+        "man"
+        "doc"
+      ];
     };
+  };
 }
 ```
 
@@ -360,54 +359,53 @@ Configuring GNU info is a little bit trickier than man pages. To work correctly,
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myProfile = writeText "my-profile" ''
-        export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
-        export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
-        export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
+  packageOverrides = pkgs: {
+    myProfile = pkgs.writeText "my-profile" ''
+      export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+      export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+      export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = with pkgs; [
+        (runCommand "profile" { } ''
+          mkdir -p $out/etc/profile.d
+          cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nix
+        emscripten
+        jq
+        nox
+        silver-searcher
+        texinfoInteractive
+      ];
+      pathsToLink = [
+        "/share/man"
+        "/share/doc"
+        "/share/info"
+        "/bin"
+        "/etc"
+      ];
+      extraOutputsToInstall = [
+        "man"
+        "doc"
+        "info"
+      ];
+      postBuild = ''
+        if [ -x $out/bin/install-info -a -w $out/share/info ]; then
+          shopt -s nullglob
+          for i in $out/share/info/*.info $out/share/info/*.info.gz; do
+              $out/bin/install-info $i $out/share/info/dir
+          done
+        fi
       '';
-      myPackages = pkgs.buildEnv {
-        name = "my-packages";
-        paths = [
-          (runCommand "profile" { } ''
-            mkdir -p $out/etc/profile.d
-            cp ${myProfile} $out/etc/profile.d/my-profile.sh
-          '')
-          aspell
-          bc
-          coreutils
-          ffmpeg
-          man
-          nix
-          emscripten
-          jq
-          nox
-          silver-searcher
-          texinfoInteractive
-        ];
-        pathsToLink = [
-          "/share/man"
-          "/share/doc"
-          "/share/info"
-          "/bin"
-          "/etc"
-        ];
-        extraOutputsToInstall = [
-          "man"
-          "doc"
-          "info"
-        ];
-        postBuild = ''
-          if [ -x $out/bin/install-info -a -w $out/share/info ]; then
-            shopt -s nullglob
-            for i in $out/share/info/*.info $out/share/info/*.info.gz; do
-                $out/bin/install-info $i $out/share/info/dir
-            done
-          fi
-        '';
-      };
     };
+  };
 }
 ```
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4c310977e192..f3b0bee2de9b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22870,6 +22870,12 @@
     githubId = 10437171;
     keys = [ { fingerprint = "75F0 AB7C FE01 D077 AEE6  CAFD 353E 4A18 EE0F AB72"; } ];
   };
+  spacedentist = {
+    email = "sp@cedenti.st";
+    github = "spacedentist";
+    githubId = 1536420;
+    name = "Sven Over";
+  };
   spacefrogg = {
     email = "spacefrogg-nixos@meterriblecrew.net";
     github = "spacefrogg";
@@ -23408,12 +23414,6 @@
     githubId = 306190;
     name = "Svend Sorensen";
   };
-  sven-of-cord = {
-    email = "sven@cord.com";
-    github = "sven-of-cord";
-    githubId = 98333944;
-    name = "Sven Over";
-  };
   Svenum = {
     email = "s.ziegler@holypenguin.net";
     github = "Svenum";
diff --git a/maintainers/scripts/README.md b/maintainers/scripts/README.md
index 44a5fc9bc590..d2ab587fb397 100644
--- a/maintainers/scripts/README.md
+++ b/maintainers/scripts/README.md
@@ -57,6 +57,17 @@ The maintainer is designated by a `selector` which must be one of:
 
 [`maintainer-list.nix`]: ../maintainer-list.nix
 
+### `get-maintainer-pings-between.sh`
+
+Gets which maintainers would be pinged between two Nixpkgs revisions.
+Outputs a JSON object on stdout mapping GitHub usernames to the attributes
+that they would be getting pinged for.
+
+Example:
+
+```sh
+maintainers/scripts/get-maintainer-pings-between.sh HEAD^ HEAD
+```
 
 ## Conventions
 
diff --git a/maintainers/scripts/get-maintainer-pings-between.sh b/maintainers/scripts/get-maintainer-pings-between.sh
new file mode 100755
index 000000000000..4b6d7ff78052
--- /dev/null
+++ b/maintainers/scripts/get-maintainer-pings-between.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p git jq
+
+# Outputs a list of maintainers that would be pinged across two nixpkgs revisions.
+# Authors:
+#  Morgan Jones (@numinit)
+#  Tristan Ross (@RossComputerGuy)
+
+set -euo pipefail
+
+if [ $# -lt 2 ]; then
+    echo "Usage: $0 <rev-from> <rev-to>" >&2
+    exit 1
+fi
+
+repo="$(git rev-parse --show-toplevel)"
+system="$(nix-instantiate --eval --expr builtins.currentSystem)"
+rev1="$(git -C "$repo" rev-parse "$1")"
+rev2="$(git -C "$repo" rev-parse "$2")"
+
+echo "Touched files:" >&2
+git -C "$repo" diff --name-only "$rev1" "$rev2" \
+    | jq --raw-input --slurp 'split("\n")[:-1]' | tee "$TMPDIR/touched-files.json" >&2
+
+# Runs an eval in the given worktree, outputting the path to $TMPDIR/$1.path.
+# $1: The revision SHA.
+eval_in_worktree() (
+    mkdir -p .worktree
+    local rev="$1"
+    local tree=".worktree/$rev"
+    if [ ! -d "$tree" ]; then
+        git -C "$repo" worktree add -f -d "$tree" "$rev" >&2
+    fi
+    cd "$tree"
+
+    local workdir="$TMPDIR/$rev"
+    rm -rf "$workdir"
+    mkdir -p "$workdir"
+
+    nix-build ci -A eval.attrpathsSuperset -o "$workdir/paths" >&2
+    mkdir -p "$workdir/intermediates"
+    nix-build ci -A eval.singleSystem \
+        --arg evalSystem "$system" \
+        --arg attrpathFile "$workdir/paths/paths.json" \
+        --arg chunkSize ${CHUNK_SIZE:-10000} \
+        -o "$workdir/intermediates/.intermediate-1" >&2
+
+    # eval.combine nix-build needs a directory, not a symlink
+    cp -RL "$workdir/intermediates/.intermediate-1" "$workdir/intermediates/intermediate-1"
+    chmod -R +w "$workdir/intermediates/intermediate-1"
+    rm -rf "$workdir/intermediates/.intermediate-1"
+
+    nix-build ci -A eval.combine \
+        --arg resultsDir "$workdir/intermediates" \
+        -o "$workdir/result" >&2
+)
+
+eval_in_worktree "$rev1" &
+pid1=$!
+eval_in_worktree "$rev2" &
+pid2=$!
+
+wait $pid1
+wait $pid2
+
+path1="$TMPDIR/$rev1"
+path2="$TMPDIR/$rev2"
+
+# Use the repo this script was executed in to get accurate maintainer info
+nix-build "$repo/ci" -A eval.compare \
+    --arg beforeResultDir "$path1/result" \
+    --arg afterResultDir "$path2/result" \
+    --arg touchedFilesJson "$TMPDIR/touched-files.json" \
+    --arg byName true \
+    -o comparison
+
+echo "Pinged maintainers (check $repo/comparison for more details)" >&2
+jq < comparison/maintainers.json
diff --git a/nixos/doc/manual/development/nixos-tests.chapter.md b/nixos/doc/manual/development/nixos-tests.chapter.md
index ec0e4b9f076a..889a90bae68b 100644
--- a/nixos/doc/manual/development/nixos-tests.chapter.md
+++ b/nixos/doc/manual/development/nixos-tests.chapter.md
@@ -10,4 +10,5 @@ writing-nixos-tests.section.md
 running-nixos-tests.section.md
 running-nixos-tests-interactively.section.md
 linking-nixos-tests-to-packages.section.md
+testing-hardware-features.section.md
 ```
diff --git a/nixos/doc/manual/development/testing-hardware-features.section.md b/nixos/doc/manual/development/testing-hardware-features.section.md
new file mode 100644
index 000000000000..aaf652d731f7
--- /dev/null
+++ b/nixos/doc/manual/development/testing-hardware-features.section.md
@@ -0,0 +1,152 @@
+# Testing Hardware Features {#sec-nixos-test-testing-hardware-features}
+
+This section covers how to test various features using NixOS tests that would
+normally only be possible with hardware. It is designed to showcase the NixOS test
+framework's flexibility when combined with various hardware simulation libraries
+or kernel modules.
+
+## Wi-Fi {#sec-nixos-test-wifi}
+
+Use `services.vwifi` to set up a virtual Wi-Fi physical layer. Create at least two nodes
+for this kind of test: one with vwifi active, and either a station or an access point.
+Give each a static IP address on the test network so they will never collide.
+This module likely supports other topologies too; document them if you make one.
+
+This NixOS module leverages [vwifi](https://github.com/Raizo62/vwifi). Read the
+upstream repository's documentation for more information.
+
+### vwifi server {#sec-nixos-test-wifi-vwifi-server}
+
+This node runs the vwifi server, and otherwise does not interact with the network.
+You can run `vwifi-ctrl` on this node to control characteristics of the simulated
+physical layer.
+
+```nix
+airgap =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.2";
+        prefixLength = 24;
+      }
+    ];
+    services.vwifi = {
+      server = {
+        enable = true;
+        ports.tcp = 8212;
+        # uncomment if you want to enable monitor mode on another node
+        # ports.spy = 8213;
+        openFirewall = true;
+      };
+    };
+  };
+```
+
+### AP {#sec-nixos-test-wifi-ap}
+
+A node like this will act as a wireless access point in infrastructure mode.
+
+```nix
+ap =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.3";
+        prefixLength = 24;
+      }
+    ];
+    services.hostapd = {
+      enable = true;
+      radios.wlan0 = {
+        channel = 1;
+        networks.wlan0 = {
+          ssid = "NixOS Test Wi-Fi Network";
+          authentication = {
+            mode = "wpa3-sae";
+            saePasswords = [ { password = "supersecret"; } ];
+            enableRecommendedPairwiseCiphers = true;
+          };
+        };
+      };
+    };
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:01";
+      };
+      client = {
+        enable = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+  };
+```
+
+### Station {#sec-nixos-test-wifi-station}
+
+A node like this acts as a wireless client.
+
+```nix
+station =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.3";
+        prefixLength = 24;
+      }
+    ];
+    networking.wireless = {
+      # No, really, we want it enabled!
+      enable = lib.mkOverride 0 true;
+      interfaces = [ "wlan0" ];
+      networks = {
+        "NixOS Test Wi-Fi Network" = {
+          psk = "supersecret";
+          authProtocols = [ "SAE" ];
+        };
+      };
+    };
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:02";
+      };
+      client = {
+        enable = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+  };
+```
+
+### Monitor {#sec-nixos-test-wifi-monitor}
+
+When the monitor mode interface is enabled, this node will receive
+all packets broadcast by all other nodes through the spy interface.
+
+```nix
+monitor =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.4";
+        prefixLength = 24;
+      }
+    ];
+
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:03";
+      };
+      client = {
+        enable = true;
+        spy = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 313610aa0b07..ea98245ed2ae 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -77,6 +77,21 @@
   "sec-mattermost-plugins-build": [
     "index.html#sec-mattermost-plugins-build"
   ],
+  "sec-nixos-test-wifi": [
+    "index.html#sec-nixos-test-wifi"
+  ],
+  "sec-nixos-test-wifi-ap": [
+    "index.html#sec-nixos-test-wifi-ap"
+  ],
+  "sec-nixos-test-wifi-monitor": [
+    "index.html#sec-nixos-test-wifi-monitor"
+  ],
+  "sec-nixos-test-wifi-station": [
+    "index.html#sec-nixos-test-wifi-station"
+  ],
+  "sec-nixos-test-wifi-vwifi-server": [
+    "index.html#sec-nixos-test-wifi-vwifi-server"
+  ],
   "sec-obtaining": [
     "index.html#sec-obtaining"
   ],
@@ -1895,6 +1910,9 @@
   "sec-linking-nixos-tests-to-packages": [
     "index.html#sec-linking-nixos-tests-to-packages"
   ],
+  "sec-nixos-test-testing-hardware-features": [
+    "index.html#sec-nixos-test-testing-hardware-features"
+  ],
   "chap-developing-the-test-driver": [
     "index.html#chap-developing-the-test-driver"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 159862ce26ce..1d3e44157e40 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -36,7 +36,6 @@
   - `services.mattermost.listenAddress` has been split into {option}`services.mattermost.host` and {option}`services.mattermost.port`. If your `listenAddress` contained a port, you will need to edit your configuration.
   - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating {option}`system.stateVersion` to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
   - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
-  - Mattermost's entire test suite is now enabled by default, which will extend build time from sources by up to an hour. A `withoutTests` passthru has been added in case you want to skip it.
   - We now support `mmctl` for Mattermost administration if both {option}`services.mattermost.socket.enable` and {option}`services.mattermost.socket.export` are set, which export the Mattermost control socket path into the system environment.
   - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
   - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
@@ -59,6 +58,10 @@
 
 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
 
+- [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as {option}`services.kismet`.
+
+- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
+
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
 - [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
@@ -527,6 +530,8 @@
 
 - [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
 
+- There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the {option}`services.vwifi` module, {option}`services.kismet` NixOS test, and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-nixos-test-wifi) for documentation and examples.
+
 - The paperless module now has an option for regular automatic export of
   documents data using the integrated document exporter.
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f9d300e3da80..6e2373694e3c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1175,6 +1175,7 @@
   ./services/networking/kea.nix
   ./services/networking/keepalived/default.nix
   ./services/networking/keybase.nix
+  ./services/networking/kismet.nix
   ./services/networking/knot.nix
   ./services/networking/kresd.nix
   ./services/networking/lambdabot.nix
@@ -1352,6 +1353,7 @@
   ./services/networking/veilid.nix
   ./services/networking/vdirsyncer.nix
   ./services/networking/vsftpd.nix
+  ./services/networking/vwifi.nix
   ./services/networking/wasabibackend.nix
   ./services/networking/websockify.nix
   ./services/networking/wg-access-server.nix
diff --git a/nixos/modules/services/networking/kismet.nix b/nixos/modules/services/networking/kismet.nix
new file mode 100644
index 000000000000..4e14e9fd51d4
--- /dev/null
+++ b/nixos/modules/services/networking/kismet.nix
@@ -0,0 +1,459 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib.trivial) isFloat isInt isBool;
+  inherit (lib.modules) mkIf;
+  inherit (lib.options)
+    literalExpression
+    mkOption
+    mkPackageOption
+    mkEnableOption
+    ;
+  inherit (lib.strings)
+    isString
+    escapeShellArg
+    escapeShellArgs
+    concatMapStringsSep
+    concatMapAttrsStringSep
+    replaceStrings
+    substring
+    stringLength
+    hasInfix
+    hasSuffix
+    typeOf
+    match
+    ;
+  inherit (lib.lists) all isList flatten;
+  inherit (lib.attrsets)
+    attrsToList
+    filterAttrs
+    optionalAttrs
+    mapAttrs'
+    mapAttrsToList
+    nameValuePair
+    ;
+  inherit (lib.generators) toKeyValue;
+  inherit (lib) types;
+
+  # Deeply checks types for a given type function. Calls `override` with type and value.
+  deep =
+    func: override: type:
+    let
+      prev = func type;
+    in
+    prev
+    // {
+      check = value: prev.check value && (override type value);
+    };
+
+  # Deep listOf.
+  listOf' = deep types.listOf (type: value: all type.check value);
+
+  # Deep attrsOf.
+  attrsOf' = deep types.attrsOf (type: value: all (item: type.check item.value) (attrsToList value));
+
+  # Kismet config atoms.
+  atom =
+    with types;
+    oneOf [
+      number
+      bool
+      str
+    ];
+
+  # Composite types.
+  listOfAtom = listOf' atom;
+  atomOrList = with types; either atom listOfAtom;
+  lists = listOf' atomOrList;
+  kvPair = attrsOf' atomOrList;
+  kvPairs = listOf' kvPair;
+
+  # Options that eval to a string with a header (foo:key=value)
+  headerKvPair = attrsOf' (attrsOf' atomOrList);
+  headerKvPairs = attrsOf' (listOf' (attrsOf' atomOrList));
+
+  # Toplevel config type.
+  topLevel =
+    let
+      topLevel' =
+        with types;
+        oneOf [
+          headerKvPairs
+          headerKvPair
+          kvPairs
+          kvPair
+          listOfAtom
+          lists
+          atom
+        ];
+    in
+    topLevel'
+    // {
+      description = "Kismet config stanza";
+    };
+
+  # Throws invalid.
+  invalid = atom: throw "invalid value '${toString atom}' of type '${typeOf atom}'";
+
+  # Converts an atom.
+  mkAtom =
+    atom:
+    if isString atom then
+      if hasInfix "\"" atom || hasInfix "," atom then
+        ''"${replaceStrings [ ''"'' ] [ ''\"'' ] atom}"''
+      else
+        atom
+    else if isFloat atom || isInt atom || isBool atom then
+      toString atom
+    else
+      invalid atom;
+
+  # Converts an inline atom or list to a string.
+  mkAtomOrListInline =
+    atomOrList:
+    if isList atomOrList then
+      mkAtom "${concatMapStringsSep "," mkAtom atomOrList}"
+    else
+      mkAtom atomOrList;
+
+  # Converts an out of line atom or list to a string.
+  mkAtomOrList =
+    atomOrList:
+    if isList atomOrList then
+      "${concatMapStringsSep "," mkAtomOrListInline atomOrList}"
+    else
+      mkAtom atomOrList;
+
+  # Throws if the string matches the given regex.
+  deny =
+    regex: str:
+    assert (match regex str) == null;
+    str;
+
+  # Converts a set of k/v pairs.
+  convertKv = concatMapAttrsStringSep "," (
+    name: value: "${mkAtom (deny "=" name)}=${mkAtomOrListInline value}"
+  );
+
+  # Converts k/v pairs with a header.
+  convertKvWithHeader = header: attrs: "${mkAtom (deny ":" header)}:${convertKv attrs}";
+
+  # Converts the entire config.
+  convertConfig = mapAttrs' (
+    name: value:
+    let
+      # Convert foo' into 'foo+' for support for '+=' syntax.
+      newName = if hasSuffix "'" name then substring 0 (stringLength name - 1) name + "+" else name;
+
+      # Get the stringified value.
+      newValue =
+        if headerKvPairs.check value then
+          flatten (
+            mapAttrsToList (header: values: (map (value: convertKvWithHeader header value) values)) value
+          )
+        else if headerKvPair.check value then
+          mapAttrsToList convertKvWithHeader value
+        else if kvPairs.check value then
+          map convertKv value
+        else if kvPair.check value then
+          convertKv value
+        else if listOfAtom.check value then
+          mkAtomOrList value
+        else if lists.check value then
+          map mkAtomOrList value
+        else if atom.check value then
+          mkAtom value
+        else
+          invalid value;
+    in
+    nameValuePair newName newValue
+  );
+
+  mkKismetConf =
+    options:
+    (toKeyValue { listsAsDuplicateKeys = true; }) (
+      filterAttrs (_: value: value != null) (convertConfig options)
+    );
+
+  cfg = config.services.kismet;
+in
+{
+  options.services.kismet = {
+    enable = mkEnableOption "kismet";
+    package = mkPackageOption pkgs "kismet" { };
+    user = mkOption {
+      description = "The user to run Kismet as.";
+      type = types.str;
+      default = "kismet";
+    };
+    group = mkOption {
+      description = "The group to run Kismet as.";
+      type = types.str;
+      default = "kismet";
+    };
+    serverName = mkOption {
+      description = "The name of the server.";
+      type = types.str;
+      default = "Kismet";
+    };
+    serverDescription = mkOption {
+      description = "The description of the server.";
+      type = types.str;
+      default = "NixOS Kismet server";
+    };
+    logTypes = mkOption {
+      description = "The log types.";
+      type = with types; listOf str;
+      default = [ "kismet" ];
+    };
+    dataDir = mkOption {
+      description = "The Kismet data directory.";
+      type = types.path;
+      default = "/var/lib/kismet";
+    };
+    httpd = {
+      enable = mkOption {
+        description = "True to enable the HTTP server.";
+        type = types.bool;
+        default = false;
+      };
+      address = mkOption {
+        description = "The address to listen on. Note that this cannot be a hostname or Kismet will not start.";
+        type = types.str;
+        default = "127.0.0.1";
+      };
+      port = mkOption {
+        description = "The port to listen on.";
+        type = types.port;
+        default = 2501;
+      };
+    };
+    settings = mkOption {
+      description = ''
+        Options for Kismet. See:
+        https://www.kismetwireless.net/docs/readme/configuring/configfiles/
+      '';
+      default = { };
+      type = with types; attrsOf topLevel;
+      example = literalExpression ''
+        {
+          /* Examples for atoms */
+          # dot11_link_bssts=false
+          dot11_link_bssts = false; # Boolean
+
+          # dot11_related_bss_window=10000000
+          dot11_related_bss_window = 10000000; # Integer
+
+          # devicefound=00:11:22:33:44:55
+          devicefound = "00:11:22:33:44:55"; # String
+
+          # log_types+=wiglecsv
+          log_types' = "wiglecsv";
+
+          /* Examples for lists of atoms */
+          # wepkey=00:DE:AD:C0:DE:00,FEEDFACE42
+          wepkey = [ "00:DE:AD:C0:DE:00" "FEEDFACE42" ];
+
+          # alert=ADHOCCONFLICT,5/min,1/sec
+          # alert=ADVCRYPTCHANGE,5/min,1/sec
+          alert = [
+            [ "ADHOCCONFLICT"  "5/min" "1/sec" ]
+            [ "ADVCRYPTCHANGE" "5/min" "1/sec" ]
+          ];
+
+          /* Examples for sets of atoms */
+          # source=wlan0:name=ath11k
+          source.wlan0 = { name = "ath11k"; };
+
+          /* Examples with colon-suffixed headers */
+          # gps=gpsd:host=localhost,port=2947
+          gps.gpsd = {
+            host = "localhost";
+            port = 2947;
+          };
+
+          # apspoof=Foo1:ssid=Bar1,validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"
+          # apspoof=Foo1:ssid=Bar2,validmacs="01:12:23:34:45:56,ab:bc:cd:de:ef:f0"
+          # apspoof=Foo2:ssid=Baz1,validmacs="11:22:33:44:55:66,bb:cc:dd:ee:ff:00"
+          apspoof.Foo1 = [
+            { ssid = "Bar1"; validmacs = [ "00:11:22:33:44:55" "aa:bb:cc:dd:ee:ff" ]; }
+            { ssid = "Bar2"; validmacs = [ "01:12:23:34:45:56" "ab:bc:cd:de:ef:f0" ]; }
+          ];
+
+          # because Foo1 is a list, Foo2 needs to be as well
+          apspoof.Foo2 = [
+            {
+              ssid = "Bar2";
+              validmacs = [ "00:11:22:33:44:55" "aa:bb:cc:dd:ee:ff" ];
+            };
+          ];
+        }
+      '';
+    };
+    extraConfig = mkOption {
+      description = ''
+        Literal Kismet config lines appended to the site config.
+        Note that `services.kismet.settings` allows you to define
+        all options here using Nix attribute sets.
+      '';
+      default = "";
+      type = types.str;
+      example = ''
+        # Looks like the following in `services.kismet.settings`:
+        # wepkey = [ "00:DE:AD:C0:DE:00" "FEEDFACE42" ];
+        wepkey=00:DE:AD:C0:DE:00,FEEDFACE42
+      '';
+    };
+  };
+
+  config =
+    let
+      configDir = "${cfg.dataDir}/.kismet";
+      settings =
+        cfg.settings
+        // {
+          server_name = cfg.serverName;
+          server_description = cfg.serverDescription;
+          logging_enabled = cfg.logTypes != [ ];
+          log_types = cfg.logTypes;
+        }
+        // optionalAttrs cfg.httpd.enable {
+          httpd_bind_address = cfg.httpd.address;
+          httpd_port = cfg.httpd.port;
+          httpd_auth_file = "${configDir}/kismet_httpd.conf";
+          httpd_home = "${cfg.package}/share/kismet/httpd";
+        };
+    in
+    mkIf cfg.enable {
+      systemd.tmpfiles.settings = {
+        "10-kismet" = {
+          ${cfg.dataDir} = {
+            d = {
+              inherit (cfg) user group;
+              mode = "0750";
+            };
+          };
+          ${configDir} = {
+            d = {
+              inherit (cfg) user group;
+              mode = "0750";
+            };
+          };
+        };
+      };
+      systemd.services.kismet =
+        let
+          kismetConf = pkgs.writeText "kismet.conf" ''
+            ${mkKismetConf settings}
+            ${cfg.extraConfig}
+          '';
+        in
+        {
+          description = "Kismet monitoring service";
+          wants = [ "basic.target" ];
+          after = [
+            "basic.target"
+            "network.target"
+          ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig =
+            let
+              capabilities = [
+                "CAP_NET_ADMIN"
+                "CAP_NET_RAW"
+              ];
+              kismetPreStart = pkgs.writeShellScript "kismet-pre-start" ''
+                owner=${escapeShellArg "${cfg.user}:${cfg.group}"}
+                mkdir -p ~/.kismet
+
+                # Ensure permissions on directories Kismet uses.
+                chown "$owner" ~/ ~/.kismet
+                cd ~/.kismet
+
+                package=${cfg.package}
+                if [ -d "$package/etc" ]; then
+                  for file in "$package/etc"/*.conf; do
+                    # Symlink the config files if they exist or are already a link.
+                    base="''${file##*/}"
+                    if [ ! -f "$base" ] || [ -L "$base" ]; then
+                      ln -sf "$file" "$base"
+                    fi
+                  done
+                fi
+
+                for file in kismet_httpd.conf; do
+                  # Un-symlink these files.
+                  if [ -L "$file" ]; then
+                    cp "$file" ".$file"
+                    rm -f "$file"
+                    mv ".$file" "$file"
+                    chmod 0640 "$file"
+                    chown "$owner" "$file"
+                  fi
+                done
+
+                # Link the site config.
+                ln -sf ${kismetConf} kismet_site.conf
+              '';
+            in
+            {
+              Type = "simple";
+              ExecStart = escapeShellArgs [
+                "${cfg.package}/bin/kismet"
+                "--homedir"
+                cfg.dataDir
+                "--confdir"
+                configDir
+                "--datadir"
+                "${cfg.package}/share"
+                "--no-ncurses"
+                "-f"
+                "${configDir}/kismet.conf"
+              ];
+              WorkingDirectory = cfg.dataDir;
+              ExecStartPre = "+${kismetPreStart}";
+              Restart = "always";
+              KillMode = "control-group";
+              CapabilityBoundingSet = capabilities;
+              AmbientCapabilities = capabilities;
+              LockPersonality = true;
+              NoNewPrivileges = true;
+              PrivateDevices = false;
+              PrivateTmp = true;
+              PrivateUsers = false;
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHome = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectProc = "invisible";
+              ProtectSystem = "full";
+              RestrictNamespaces = true;
+              RestrictSUIDSGID = true;
+              User = cfg.user;
+              Group = cfg.group;
+              UMask = "0007";
+              TimeoutStopSec = 30;
+            };
+
+          # Allow it to restart if the wifi interface is not up
+          unitConfig.StartLimitIntervalSec = 5;
+        };
+      users.groups.${cfg.group} = { };
+      users.users.${cfg.user} = {
+        inherit (cfg) group;
+        description = "User for running Kismet";
+        isSystemUser = true;
+        home = cfg.dataDir;
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [ numinit ];
+}
diff --git a/nixos/modules/services/networking/vwifi.nix b/nixos/modules/services/networking/vwifi.nix
new file mode 100644
index 000000000000..64b7fbdf45a4
--- /dev/null
+++ b/nixos/modules/services/networking/vwifi.nix
@@ -0,0 +1,200 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib.modules) mkIf mkMerge;
+  inherit (lib.options) mkOption mkPackageOption mkEnableOption;
+  inherit (lib.lists) optional optionals;
+  inherit (lib.strings)
+    hasSuffix
+    escapeShellArgs
+    ;
+  inherit (lib) types;
+  cfg = config.services.vwifi;
+in
+{
+  options = {
+    services.vwifi =
+      let
+        mkOptionalPort =
+          name:
+          mkOption {
+            description = ''
+              The ${name} port. Set to null if we should leave it unset.
+            '';
+            type = with types; nullOr port;
+            default = null;
+          };
+      in
+      {
+        package = mkPackageOption pkgs "vwifi" { };
+        module = {
+          enable = mkEnableOption "mac80211_hwsim module";
+          numRadios = mkOption {
+            description = "The number of virtual radio interfaces to create.";
+            type = types.int;
+            default = 1;
+          };
+          macPrefix = mkOption {
+            description = ''
+              The prefix for MAC addresses to use, without the trailing ':'.
+              If one radio is created, you can specify the whole MAC address here.
+              The default is defined in vwifi/src/config.h.
+            '';
+            type = types.strMatching "^(([0-9A-Fa-f]{2}:){0,5}[0-9A-Fa-f]{2})$";
+            default = "74:F8:F6";
+          };
+        };
+        client = {
+          enable = mkEnableOption "vwifi client";
+          spy = mkEnableOption "spy mode, useful for wireless monitors";
+          serverAddress = mkOption {
+            description = ''
+              The address of the server. If set to null, will try to use the vsock protocol.
+              Note that this assumes that the server is spawned on the host and passed through to
+              QEMU, with something like:
+
+              -device vhost-vsock-pci,id=vwifi0,guest-cid=42
+            '';
+            type = with types; nullOr str;
+            default = null;
+          };
+          serverPort = mkOptionalPort "server port";
+          extraArgs = mkOption {
+            description = ''
+              Extra arguments to pass to vwifi-client. You can use this if you want to bring
+              the radios up using vwifi-client instead of at boot.
+            '';
+            type = with types; listOf str;
+            default = [ ];
+            example = [
+              "--number"
+              "3"
+            ];
+          };
+        };
+        server = {
+          enable = mkEnableOption "vwifi server";
+          vsock.enable = mkEnableOption "vsock kernel module";
+          ports = {
+            vhost = mkOptionalPort "vhost";
+            tcp = mkOptionalPort "TCP server";
+            spy = mkOptionalPort "spy interface";
+            control = mkOptionalPort "control interface";
+          };
+          openFirewall = mkEnableOption "opening the firewall for the TCP and spy ports";
+          extraArgs = mkOption {
+            description = ''
+              Extra arguments to pass to vwifi-server. You can use this for things including
+              changing the ports or inducing packet loss.
+            '';
+            type = with types; listOf str;
+            default = [ ];
+            example = [ "--lost-packets" ];
+          };
+        };
+      };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.module.enable {
+      boot.kernelModules = [
+        "mac80211_hwsim"
+      ];
+      boot.extraModprobeConfig = ''
+        # We'll add more radios using vwifi-add-interfaces in the systemd unit.
+        options mac80211_hwsim radios=0
+      '';
+      systemd.services.vwifi-add-interfaces = mkIf (cfg.module.numRadios > 0) {
+        description = "vwifi interface bringup";
+        wantedBy = [ "network-pre.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart =
+            let
+              args = [
+                (toString cfg.module.numRadios)
+                cfg.module.macPrefix
+              ];
+            in
+            "${cfg.package}/bin/vwifi-add-interfaces ${escapeShellArgs args}";
+        };
+      };
+      assertions = [
+        {
+          assertion = !(hasSuffix ":" cfg.module.macPrefix);
+          message = ''
+            services.vwifi.module.macPrefix should not have a trailing ":".
+          '';
+        }
+      ];
+    })
+    (mkIf cfg.client.enable {
+      systemd.services.vwifi-client =
+        let
+          clientArgs =
+            optional cfg.client.spy "--spy"
+            ++ optional (cfg.client.serverAddress != null) cfg.client.serverAddress
+            ++ optionals (cfg.client.serverPort != null) [
+              "--port"
+              cfg.client.serverPort
+            ]
+            ++ cfg.client.extraArgs;
+        in
+        rec {
+          description = "vwifi client";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          requires = after;
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/vwifi-client ${escapeShellArgs clientArgs}";
+          };
+        };
+    })
+    (mkIf cfg.server.enable {
+      boot.kernelModules = mkIf cfg.server.vsock.enable [
+        "vhost_vsock"
+      ];
+      networking.firewall.allowedTCPPorts = mkIf cfg.server.openFirewall (
+        optional (cfg.server.ports.tcp != null) cfg.server.ports.tcp
+        ++ optional (cfg.server.ports.spy != null) cfg.server.ports.spy
+      );
+      systemd.services.vwifi-server =
+        let
+          serverArgs =
+            optionals (cfg.server.ports.vhost != null) [
+              "--port-vhost"
+              (toString cfg.server.ports.vhost)
+            ]
+            ++ optionals (cfg.server.ports.tcp != null) [
+              "--port-tcp"
+              (toString cfg.server.ports.tcp)
+            ]
+            ++ optionals (cfg.server.ports.spy != null) [
+              "--port-spy"
+              (toString cfg.server.ports.spy)
+            ]
+            ++ optionals (cfg.server.ports.control != null) [
+              "--port-ctrl"
+              (toString cfg.server.ports.control)
+            ]
+            ++ cfg.server.extraArgs;
+        in
+        rec {
+          description = "vwifi server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          requires = after;
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/vwifi-server ${escapeShellArgs serverArgs}";
+          };
+        };
+    })
+  ];
+
+  meta.maintainers = with lib.maintainers; [ numinit ];
+}
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 572b47d2b518..dce0774b07ee 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -41,9 +41,15 @@ let
   # The directory to store mutable data within dataDir.
   mutableDataDir = "${cfg.dataDir}/data";
 
-  # The plugin directory. Note that this is the *post-unpack* plugin directory,
-  # since Mattermost unpacks plugins to put them there. (Hence, mutable data.)
-  pluginDir = "${mutableDataDir}/plugins";
+  # The plugin directory. Note that this is the *pre-unpack* plugin directory,
+  # since Mattermost looks in mutableDataDir for a directory called "plugins".
+  # If Mattermost is installed with plugins defined in a Nix configuration, the plugins
+  # are symlinked here. Otherwise, this is a real directory and the tarballs are uploaded here.
+  pluginTarballDir = "${mutableDataDir}/plugins";
+
+  # We need a different unpack directory for Mattermost to sync things to at launch,
+  # since the above may be a symlink to the store.
+  pluginUnpackDir = "${mutableDataDir}/.plugins";
 
   # Mattermost uses this as a staging directory to unpack plugins, among possibly other things.
   # Ensure that it's inside mutableDataDir since it can get rather large.
@@ -232,9 +238,12 @@ let
           services.mattermost.environmentFile = "<your environment file>";
           services.mattermost.database.fromEnvironment = true;
         '' database;
-    FileSettings.Directory = cfg.dataDir;
-    PluginSettings.Directory = "${pluginDir}/server";
-    PluginSettings.ClientDirectory = "${pluginDir}/client";
+
+    # Note that the plugin tarball directory is not configurable, and is expected to be in FileSettings.Directory/plugins.
+    FileSettings.Directory = mutableDataDir;
+    PluginSettings.Directory = "${pluginUnpackDir}/server";
+    PluginSettings.ClientDirectory = "${pluginUnpackDir}/client";
+
     LogSettings = {
       FileLocation = cfg.logDir;
 
@@ -800,9 +809,9 @@ in
           "R- ${tempDir} - - - - -"
           "d= ${tempDir} 0750 ${cfg.user} ${cfg.group} - -"
 
-          # Ensure that pluginDir is a directory, as it could be a symlink on prior versions.
+          # Ensure that pluginUnpackDir is a directory.
           # Don't remove or clean it out since it should be persistent, as this is where plugins are unpacked.
-          "d= ${pluginDir} 0750 ${cfg.user} ${cfg.group} - -"
+          "d= ${pluginUnpackDir} 0750 ${cfg.user} ${cfg.group} - -"
 
           # Ensure that the plugin directories exist.
           "d= ${mattermostConf.PluginSettings.Directory} 0750 ${cfg.user} ${cfg.group} - -"
@@ -819,11 +828,11 @@ in
           if cfg.pluginsBundle == null then
             # Create the plugin tarball directory to allow plugin uploads.
             [
-              "d= ${cfg.dataDir}/plugins 0750 ${cfg.user} ${cfg.group} - -"
+              "d= ${pluginTarballDir} 0750 ${cfg.user} ${cfg.group} - -"
             ]
           else
             # Symlink the plugin tarball directory, removing anything existing, since it's managed by Nix.
-            [ "L+ ${cfg.dataDir}/plugins - - - - ${cfg.pluginsBundle}" ]
+            [ "L+ ${pluginTarballDir} - - - - ${cfg.pluginsBundle}" ]
         );
 
       systemd.services.mattermost = rec {
@@ -867,12 +876,13 @@ in
             # Logs too.
             oldLogs="$dataDir/logs"
             newLogs="$logDir"
-            if [ "$oldLogs" != "$newLogs" ] && [ -d "$oldLogs" ]; then
+            if [ "$oldLogs" != "$newLogs" ] && [ -d "$oldLogs" ] && [ ! -f "$newLogs/.initial-created" ]; then
               # Migrate the legacy log location to the new log location.
               # Allow this to fail if there aren't any logs to move.
               echo "Moving legacy logs at $oldLogs to $newLogs" >&2
               mkdir -p "$newLogs"
               mv "$oldLogs"/* "$newLogs" || true
+              touch "$newLogs/.initial-created"
             fi
           ''
           + optionalString (!cfg.mutableConfig) ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1f866d1f6cb5..a2924622576b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -702,6 +702,7 @@ in
   keyd = handleTest ./keyd.nix { };
   keymap = handleTest ./keymap.nix { };
   kimai = runTest ./kimai.nix;
+  kismet = runTest ./kismet.nix;
   kmonad = runTest ./kmonad.nix;
   knot = runTest ./knot.nix;
   komga = handleTest ./komga.nix { };
diff --git a/nixos/tests/kismet.nix b/nixos/tests/kismet.nix
new file mode 100644
index 000000000000..878a341cedea
--- /dev/null
+++ b/nixos/tests/kismet.nix
@@ -0,0 +1,266 @@
+{ pkgs, lib, ... }:
+
+let
+  ssid = "Hydra SmokeNet";
+  psk = "stayoffmywifi";
+  wlanInterface = "wlan0";
+in
+{
+  name = "kismet";
+
+  nodes =
+    let
+      hostAddress = id: "192.168.1.${toString (id + 1)}";
+      serverAddress = hostAddress 1;
+    in
+    {
+      airgap =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = serverAddress;
+              prefixLength = 24;
+            }
+          ];
+          services.vwifi = {
+            server = {
+              enable = true;
+              ports.tcp = 8212;
+              ports.spy = 8213;
+              openFirewall = true;
+            };
+          };
+        };
+
+      ap =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 2;
+              prefixLength = 24;
+            }
+          ];
+          services.hostapd = {
+            enable = true;
+            radios.${wlanInterface} = {
+              channel = 1;
+              networks.${wlanInterface} = {
+                inherit ssid;
+                authentication = {
+                  mode = "wpa3-sae";
+                  saePasswords = [ { password = psk; } ];
+                  enableRecommendedPairwiseCiphers = true;
+                };
+              };
+            };
+          };
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:01";
+            };
+            client = {
+              enable = true;
+              inherit serverAddress;
+            };
+          };
+        };
+
+      station =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 3;
+              prefixLength = 24;
+            }
+          ];
+          networking.wireless = {
+            # No, really, we want it enabled!
+            enable = lib.mkOverride 0 true;
+            interfaces = [ wlanInterface ];
+            networks = {
+              ${ssid} = {
+                inherit psk;
+                authProtocols = [ "SAE" ];
+              };
+            };
+          };
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:02";
+            };
+            client = {
+              enable = true;
+              inherit serverAddress;
+            };
+          };
+        };
+
+      monitor =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 4;
+              prefixLength = 24;
+            }
+          ];
+
+          services.kismet = {
+            enable = true;
+            serverName = "NixOS Kismet Smoke Test";
+            serverDescription = "Server testing virtual wifi devices running on Hydra";
+            httpd.enable = true;
+            # Check that the settings all eval correctly
+            settings = {
+              # Should append to log_types
+              log_types' = "wiglecsv";
+
+              # Should all generate correctly
+              wepkey = [
+                "00:DE:AD:C0:DE:00"
+                "FEEDFACE42"
+              ];
+              alert = [
+                [
+                  "ADHOCCONFLICT"
+                  "5/min"
+                  "1/sec"
+                ]
+                [
+                  "ADVCRYPTCHANGE"
+                  "5/min"
+                  "1/sec"
+                ]
+              ];
+              gps.gpsd = {
+                host = "localhost";
+                port = 2947;
+              };
+              apspoof.Foo1 = [
+                {
+                  ssid = "Bar1";
+                  validmacs = [
+                    "00:11:22:33:44:55"
+                    "aa:bb:cc:dd:ee:ff"
+                  ];
+                }
+                {
+                  ssid = "Bar2";
+                  validmacs = [
+                    "01:12:23:34:45:56"
+                    "ab:bc:cd:de:ef:f0"
+                  ];
+                }
+              ];
+              apspoof.Foo2 = [
+                {
+                  ssid = "Bar2";
+                  validmacs = [
+                    "00:11:22:33:44:55"
+                    "aa:bb:cc:dd:ee:ff"
+                  ];
+                }
+              ];
+
+              # The actual source
+              source.${wlanInterface} = {
+                name = "Virtual Wifi";
+              };
+            };
+            extraConfig = ''
+              # this comment should be ignored
+            '';
+          };
+
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:03";
+            };
+            client = {
+              enable = true;
+              spy = true;
+              inherit serverAddress;
+            };
+          };
+
+          environment.systemPackages = with pkgs; [
+            config.services.kismet.package
+            config.services.vwifi.package
+            jq
+          ];
+        };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import shlex
+
+      # Wait for the vwifi server to come up
+      airgap.start()
+      airgap.wait_for_unit("vwifi-server.service")
+      airgap.wait_for_open_port(${toString nodes.airgap.services.vwifi.server.ports.tcp})
+
+      httpd_port = ${toString nodes.monitor.services.kismet.httpd.port}
+      server_name = "${nodes.monitor.services.kismet.serverName}"
+      server_description = "${nodes.monitor.services.kismet.serverDescription}"
+      wlan_interface = "${wlanInterface}"
+      ap_essid = "${ssid}"
+      ap_mac_prefix = "${nodes.ap.services.vwifi.module.macPrefix}"
+      station_mac_prefix = "${nodes.station.services.vwifi.module.macPrefix}"
+
+      # Spawn the other nodes.
+      monitor.start()
+
+      # Wait for the monitor to come up
+      monitor.wait_for_unit("kismet.service")
+      monitor.wait_for_open_port(httpd_port)
+
+      # Should be up but require authentication.
+      url = f"http://localhost:{httpd_port}"
+      monitor.succeed(f"curl {url} | tee /dev/stderr | grep '<title>Kismet</title>'")
+
+      # Have to set the password now.
+      monitor.succeed("echo httpd_username=nixos >> ~kismet/.kismet/kismet_httpd.conf")
+      monitor.succeed("echo httpd_password=hydra >> ~kismet/.kismet/kismet_httpd.conf")
+      monitor.systemctl("restart kismet.service")
+      monitor.wait_for_unit("kismet.service")
+      monitor.wait_for_open_port(httpd_port)
+
+      # Authentication should now work.
+      url = f"http://nixos:hydra@localhost:{httpd_port}"
+      monitor.succeed(f"curl {url}/system/status.json | tee /dev/stderr | jq -e --arg serverName {shlex.quote(server_name)} --arg serverDescription {shlex.quote(server_description)} '.\"kismet.system.server_name\" == $serverName and .\"kismet.system.server_description\" == $serverDescription'")
+
+      # Wait for the station to connect to the AP while Kismet is monitoring
+      ap.start()
+      station.start()
+
+      unit = f"wpa_supplicant-{wlan_interface}"
+
+      # Generate handshakes until we detect both devices
+      success = False
+      for i in range(100):
+        station.wait_for_unit(f"wpa_supplicant-{wlan_interface}.service")
+        station.succeed(f"ifconfig {wlan_interface} down && ifconfig {wlan_interface} up")
+        station.wait_until_succeeds(f"journalctl -u {shlex.quote(unit)} -e | grep -Eqi {shlex.quote(wlan_interface + ': CTRL-EVENT-CONNECTED - Connection to ' + ap_mac_prefix + '[0-9a-f:]* completed')}")
+        station.succeed(f"journalctl --rotate --unit={shlex.quote(unit)}")
+        station.succeed(f"sleep 3 && journalctl --vacuum-time=1s --unit={shlex.quote(unit)}")
+
+        # We're connected, make sure Kismet sees both of our devices
+        status, stdout = monitor.execute(f"curl {url}/devices/views/all/last-time/0/devices.json | tee /dev/stderr | jq -e --arg macPrefix {shlex.quote(ap_mac_prefix)} --arg ssid {shlex.quote(ap_essid)} '. | (map(select((.\"kismet.device.base.macaddr\"? | startswith($macPrefix)) and .\"dot11.device\"?.\"dot11.device.last_beaconed_ssid_record\"?.\"dot11.advertisedssid.ssid\" == $ssid)) | length) == 1'")
+        if status != 0:
+          continue
+        status, stdout = monitor.execute(f"curl {url}/devices/views/all/last-time/0/devices.json | tee /dev/stderr | jq -e --arg macPrefix {shlex.quote(station_mac_prefix)} '. | (map(select((.\"kismet.device.base.macaddr\"? | startswith($macPrefix)))) | length) == 1'")
+        if status == 0:
+          success = True
+          break
+
+      assert success
+    '';
+}
diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index bfbbf40b3d8d..4cb9845df880 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -335,9 +335,23 @@ import ../make-test-python.nix (
             if [ "$actualPostAttachmentHash" != "$postAttachmentHash" ]; then
               echo "Post attachment hash mismatched!" >&2
               exit 1
-            else
+            fi
+
+            # Make sure it's on the filesystem in the expected place
+            fsPath="$(find /var/lib/mattermost/data -name "$(basename -- "$postAttachment")" -print -quit)"
+            if [ -z "$fsPath" ] || [ ! -f "$fsPath" ]; then
+              echo "Attachment didn't exist on the filesystem!" >&2
+              exit 1
+            fi
+
+            # And that the hash matches.
+            actualFsAttachmentHash="$(sha256sum "$fsPath" | awk '{print $1}')"
+            if [ "$actualFsAttachmentHash" == "$postAttachmentHash" ]; then
               echo "Post attachment hash was OK!" >&2
               exit 0
+            else
+              echo "Attachment hash mismatched on disk!" >&2
+              exit 1
             fi
           else
             echo "Post didn't exist when it should have!" >&2
@@ -454,11 +468,9 @@ import ../make-test-python.nix (
           # Switch to the newer config and make sure the plugins directory is replaced with a directory,
           # since it could have been a symlink on previous versions.
           mostlyMutable.systemctl("stop mattermost.service")
-          mostlyMutable.succeed(f"[ ! -L /var/lib/mattermost/data/plugins ] && rm -rf /var/lib/mattermost/data/plugins && ln -s {mostlyMutablePlugins} /var/lib/mattermost/data/plugins || true")
           mostlyMutable.succeed('[ -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
           switch_to_specialisation(mostlyMutable, mostlyMutableToplevel, "upgrade")
           wait_mattermost_up(mostlyMutable)
-          mostlyMutable.succeed('[ ! -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
 
           # HelpLink should be changed, still, and the post should still exist
           expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')
diff --git a/pkgs/applications/audio/puredata/default.nix b/pkgs/applications/audio/puredata/default.nix
index 7f49c31fd38c..9f48ef0cb7df 100644
--- a/pkgs/applications/audio/puredata/default.nix
+++ b/pkgs/applications/audio/puredata/default.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/pd --prefix PATH : ${lib.makeBinPath [ tk ]}
+    wrapProgram $out/bin/pd-gui --prefix PATH : ${lib.makeBinPath [ tk ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/goldendict-ng/default.nix b/pkgs/applications/misc/goldendict-ng/default.nix
index bd8c911eac89..b99886f953fc 100644
--- a/pkgs/applications/misc/goldendict-ng/default.nix
+++ b/pkgs/applications/misc/goldendict-ng/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation {
   pname = "goldendict-ng";
-  version = "25.02.0";
+  version = "25.05.0";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    tag = "v25.02.0-Release.e895b18c";
-    hash = "sha256-k8pGzrSFbAUP7DG3lSAYBa5WeeSUbjZMvMqmxPqdT3E=";
+    tag = "v25.05.0-Release.2a2b0e16";
+    hash = "sha256-PBqkVac867xE4ZcvwTysAK6rQSoEZelKrV9USvFsaLk=";
   };
 
   nativeBuildInputs = [
@@ -92,6 +92,7 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [
       slbtty
       michojel
+      linsui
     ];
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/applications/networking/charles/default.nix b/pkgs/applications/networking/charles/default.nix
index a76be42cf112..f30c4262a176 100644
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -4,6 +4,7 @@
   makeWrapper,
   makeDesktopItem,
   fetchurl,
+  openjdk17-bootstrap,
   jdk11,
   jdk8,
 }:
@@ -12,7 +13,7 @@ let
   generic =
     {
       version,
-      sha256,
+      hash,
       platform ? "",
       jdk,
       ...
@@ -52,13 +53,16 @@ let
           "--user-agent"
           "Mozilla/5.0"
         ]; # HTTP 104 otherwise
-        inherit sha256;
+        inherit hash;
       };
+
       nativeBuildInputs = [ makeWrapper ];
 
       installPhase = ''
+        runHook preInstall
+
         makeWrapper ${jdk}/bin/java $out/bin/charles \
-          --add-flags "-Xmx1024M -Dcharles.config='~/.charles.config' -jar $out/share/java/charles.jar"
+          --add-flags "-Xmx1024M -Dcharles.config='~/.charles.config' ${lib.optionalString (lib.versionOlder version "5.0") "-jar $out/share/java/charles.jar"} ${lib.optionalString (lib.versionAtLeast version "5.0") "-XX:+UseZGC -Djava.library.path='$out/share/java' --add-opens java.base/sun.security.ssl=com.charlesproxy --add-opens java.desktop/java.awt.event=com.charlesproxy --add-opens java.base/java.io=com.charlesproxy --add-modules com.jthemedetector,com.formdev.flatlaf --module-path '$out/share/java' -m com.charlesproxy"}"
 
         for fn in lib/*.jar; do
           install -D -m644 $fn $out/share/java/$(basename $fn)
@@ -69,27 +73,37 @@ let
 
         mkdir -p $out/share/icons
         cp -r icon $out/share/icons/hicolor
+
+        runHook postInstall
       '';
 
-      meta = with lib; {
+      meta = {
         description = "Web Debugging Proxy";
         homepage = "https://www.charlesproxy.com/";
-        maintainers = with maintainers; [
+        maintainers = with lib.maintainers; [
           kalbasit
           kashw2
         ];
-        sourceProvenance = with sourceTypes; [ binaryBytecode ];
-        license = licenses.unfree;
-        platforms = platforms.unix;
+        sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+        license = lib.licenses.unfree;
+        platforms = lib.platforms.unix;
       };
     };
 
 in
 {
+  charles5 = (
+    generic {
+      version = "5.0";
+      hash = "sha256-gvspRI3uF7bjE4UBuTGS5+n2h0nKudLtW3sqs2GZIyM=";
+      platform = "_x86_64";
+      jdk = openjdk17-bootstrap;
+    }
+  );
   charles4 = (
     generic {
-      version = "4.6.4";
-      sha256 = "KEQYb90kt41dS3TJLZqdaV9P3mQA9UPsEyiFb/knm3w=";
+      version = "4.6.8";
+      hash = "sha256-AaS+zmQTWsGoLEhyGHA/UojmctE7IV0N9fnygNhEPls=";
       platform = "_amd64";
       jdk = jdk11;
     }
@@ -97,7 +111,7 @@ in
   charles3 = (
     generic {
       version = "3.12.3";
-      sha256 = "13zk82ny1w5zd9qcs9qkq0kdb22ni5byzajyshpxdfm4zv6p32ss";
+      hash = "sha256-Wotxzf6kutYv1F6q71eJVojVJsATJ81war/w4K1A848=";
       jdk = jdk8.jre;
       mainProgram = "charles";
     }
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index b46ba1ecdf27..b4570d58434b 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "notmuch";
-  version = "0.38.3";
+  version = "0.39";
 
   src = fetchurl {
     url = "https://notmuchmail.org/releases/notmuch-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mvRsyA2li0MByiuu/MJaQNES0DFVB+YywPPw8IMo0FQ=";
+    hash = "sha256-uIuwKnbEa62NMT/Su0+OOSmLUfZvy+swTZ+Aw+73BOM=";
   };
 
   nativeBuildInputs =
@@ -68,14 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withRuby ruby
     ++ lib.optional withSfsexp sfsexp;
 
-  patches = [
-    (fetchpatch {
-      name = "add-workaround-for-Emacs-30-pp-changes.patch";
-      url = "https://git.notmuchmail.org/git?p=notmuch;a=patch;h=e3d4721b1ba4836c7646e057b50123fe994652eb";
-      hash = "sha256-phfNSOlTajTmaf+DjtdmBAWSm+2tUbrQEChInUlwn5k=";
-    })
-  ];
-
   postPatch =
     ''
       patchShebangs configure test/
@@ -142,10 +134,9 @@ stdenv.mkDerivation (finalAttrs: {
       ln -s ${test-database} test/test-databases/database-v1.tar.xz
     ''
     + ''
-      # Issues since gnupg: 2.4.0 -> 2.4.1
-      rm test/{T350-crypto,T357-index-decryption}.sh
       # Issues since pbr 6.0.0 bump (ModuleNotFoundError: No module named 'notmuch2')
       rm test/T055-path-config.sh
+      rm test/T610-message-property.sh
       # Flaky, seems to get its paths wrong sometimes (?)
       # *ERROR*: Opening output file: Permission denied, /nix/store/bzy21v2cd5sq1djzwa9b19q08wpp9mm0-emacs-29.1/bin/OUTPUT
       rm test/T460-emacs-tree.sh
@@ -209,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
   passthru = {
-    pythonSourceRoot = "notmuch-${finalAttrs.version}/bindings/python";
+    pythonSourceRoot = "notmuch-${finalAttrs.version}/contrib/python-legacy";
     gemEnv = buildEnv {
       name = "notmuch-vim-gems";
       paths = with ruby.gems; [ mail ];
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 356a46d5ca81..dbad506b8c94 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -10,7 +10,7 @@
   libxslt,
   perl,
   perlPackages,
-  box2d,
+  box2d_2,
   gettext,
   zlib,
   libjpeg,
@@ -397,7 +397,7 @@ stdenv.mkDerivation (finalAttrs: {
       ant
       bluez5
       boost
-      box2d
+      box2d_2
       cairo
       clucene_core_2
       cppunit
diff --git a/pkgs/applications/science/math/mathematica/versions.nix b/pkgs/applications/science/math/mathematica/versions.nix
index 103e47e7fb87..32c2aab73c6a 100644
--- a/pkgs/applications/science/math/mathematica/versions.nix
+++ b/pkgs/applications/science/math/mathematica/versions.nix
@@ -8,6 +8,20 @@
 
 let
   versions = [
+    {
+      version = "14.2.1";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-WNLuq9RviYF3Mj8uOALhmvcxGGHVq/TAGFMTGWoYBcc=";
+      installer = "Wolfram_14.2.1_LIN.sh";
+    }
+    {
+      version = "14.2.1";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-DcZbetr5wO3i/DkchgpsW3RGHfa1PslA4fK+bRQ68Bg=";
+      installer = "Wolfram_14.2.1_LIN_Bndl.sh";
+    }
     {
       version = "14.2.0";
       lang = "en";
diff --git a/pkgs/applications/science/misc/openrefine/default.nix b/pkgs/applications/science/misc/openrefine/default.nix
index b934320025a5..840e76c1fc5a 100644
--- a/pkgs/applications/science/misc/openrefine/default.nix
+++ b/pkgs/applications/science/misc/openrefine/default.nix
@@ -11,12 +11,12 @@
 }:
 
 let
-  version = "3.9.2";
+  version = "3.9.3";
   src = fetchFromGitHub {
     owner = "openrefine";
     repo = "openrefine";
     rev = version;
-    hash = "sha256-Z52YfS+caNe7N3xMv85eoBes6TwkSsGk5/rGaQd/6ds=";
+    hash = "sha256-wV5ur31JEGcMSLRHQq/H6GlsdpEzTH6ZxBkE9Sj6TkU=";
   };
 
   npmPkg = buildNpmPackage {
diff --git a/pkgs/by-name/ao/aonsoku/package.nix b/pkgs/by-name/ao/aonsoku/package.nix
index c2ab26c2dbf7..03fa9cc13a3d 100644
--- a/pkgs/by-name/ao/aonsoku/package.nix
+++ b/pkgs/by-name/ao/aonsoku/package.nix
@@ -8,7 +8,6 @@
   pkg-config,
   wrapGAppsHook3,
   openssl,
-  libsoup_2_4,
   webkitgtk_4_1,
   glib-networking,
   nix-update-script,
@@ -48,7 +47,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [
     openssl
-    libsoup_2_4
     webkitgtk_4_1
     glib-networking
   ];
diff --git a/pkgs/by-name/ap/apt/package.nix b/pkgs/by-name/ap/apt/package.nix
index c95aea8d14ee..216251a44741 100644
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -34,14 +34,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.9.35";
+  version = "3.0.0";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "apt-team";
     repo = "apt";
     rev = finalAttrs.version;
-    hash = "sha256-B4rFOt4J94/XkFw09sdvfogdY1b5R6QYnNC3HVUV9pc=";
+    hash = "sha256-0jtJ/y8TK/mJeTM5n1WblT9i5OtRg6r5C7kvB+ioMz0=";
   };
 
   # cycle detection; lib can't be split
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index b6b1a3b465da..c8c7410d8d4c 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -278,7 +278,7 @@ let
             pyyaml
             requests-oauthlib
             scim2-filter-parser
-            sentry-sdk_2
+            sentry-sdk
             service-identity
             setproctitle
             structlog
diff --git a/pkgs/by-name/ba/base16-schemes/package.nix b/pkgs/by-name/ba/base16-schemes/package.nix
index 55377a415843..5534fc67a7e5 100644
--- a/pkgs/by-name/ba/base16-schemes/package.nix
+++ b/pkgs/by-name/ba/base16-schemes/package.nix
@@ -4,16 +4,15 @@
   fetchFromGitHub,
   ...
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "base16-schemes";
-  version = "unstable-2024-11-12";
+  version = "unstable-2025-04-18";
 
   src = fetchFromGitHub {
     owner = "tinted-theming";
     repo = "schemes";
-    rev = "61058a8d2e2bd4482b53d57a68feb56cdb991f0b";
-    sha256 = "sha256-Tp1BpaF5qRav7O2TsSGjCfgRzhiasu4IuwROR66gz1o=";
+    rev = "28c26a621123ad4ebd5bbfb34ab39421c0144bdd";
+    hash = "sha256-Fg+rdGs5FAgfkYNCs74lnl8vkQmiZVdBsziyPhVqrlY=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ba/bazel-watcher/package.nix b/pkgs/by-name/ba/bazel-watcher/package.nix
index a53c794767a0..9cdc9e5085a1 100644
--- a/pkgs/by-name/ba/bazel-watcher/package.nix
+++ b/pkgs/by-name/ba/bazel-watcher/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "bazel-watcher";
-  version = "0.25.3";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${version}";
-    hash = "sha256-5cRj04e5VVG4NSe4LOLkZIrerT4laLEDeXCqTiJj6MM=";
+    hash = "sha256-FPyOdKJ8HSerFHDIjUkHKXMgoLmVeuyHYmo0v/8C0do=";
   };
 
-  vendorHash = "sha256-0I/bvuyosN55oNSMuom4C8rVjxneUaqV19l9OMiwWhU=";
+  vendorHash = "sha256-H1Bqw5hbOLS4oJeQOdIXQ9c2H8jGtoW1J75BIkTNR9k=";
 
   # The dependency github.com/fsnotify/fsevents requires CGO
   env.CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
diff --git a/pkgs/by-name/bo/borgbackup/package.nix b/pkgs/by-name/bo/borgbackup/package.nix
index e2be04cc98f9..0a9823869efa 100644
--- a/pkgs/by-name/bo/borgbackup/package.nix
+++ b/pkgs/by-name/bo/borgbackup/package.nix
@@ -20,14 +20,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "borgbackup";
     repo = "borg";
     tag = version;
-    hash = "sha256-n1hCM7Sp0t2bOJEzErEd1PS/Xc7c+KDmJ4PjQuuF140=";
+    hash = "sha256-1RRizsHY6q1ruofTkRZ4sSN4k6Hoo+sG85w2zz+7yL8=";
   };
 
   postPatch = ''
@@ -45,6 +45,7 @@ python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python.pkgs; [
     # docs
     sphinxHook
+    sphinxcontrib-jquery
     guzzle-sphinx-theme
 
     # shell completions
@@ -78,6 +79,13 @@ python.pkgs.buildPythonApplication rec {
     ''--prefix PATH ':' "${openssh}/bin"''
   ];
 
+  preInstallSphinx = ''
+    # remove invalid outputs for manpages
+    rm .sphinx/man/man/_static/jquery.js
+    rm .sphinx/man/man/_static/_sphinx_javascript_frameworks_compat.js
+    rmdir .sphinx/man/man/_static/
+  '';
+
   postInstall = ''
     installShellCompletion --cmd borg \
       --bash scripts/shell_completions/bash/borg \
diff --git a/pkgs/by-name/bo/box2d/cmake_dont_fetch_enkits.patch b/pkgs/by-name/bo/box2d/cmake_dont_fetch_enkits.patch
new file mode 100644
index 000000000000..aa685fb71f14
--- /dev/null
+++ b/pkgs/by-name/bo/box2d/cmake_dont_fetch_enkits.patch
@@ -0,0 +1,16 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8c1390e..791d3b7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -83,10 +83,7 @@ if(PROJECT_IS_TOP_LEVEL)
+ 		# Used in tests and samples
+ 		FetchContent_Declare(
+ 			enkits
+-			GIT_REPOSITORY https://github.com/dougbinks/enkiTS.git
+-			GIT_TAG master
+-			GIT_SHALLOW TRUE
+-			GIT_PROGRESS TRUE
++			URL @enkits_src@
+ 		)
+ 		FetchContent_MakeAvailable(enkits)
+ 	endif()
diff --git a/pkgs/by-name/bo/box2d/cmake_use_system_glfw_and_imgui.patch b/pkgs/by-name/bo/box2d/cmake_use_system_glfw_and_imgui.patch
new file mode 100644
index 000000000000..dd76023882df
--- /dev/null
+++ b/pkgs/by-name/bo/box2d/cmake_use_system_glfw_and_imgui.patch
@@ -0,0 +1,54 @@
+diff --git a/samples/CMakeLists.txt b/samples/CMakeLists.txt
+index 5020345..97af8c6 100644
+--- a/samples/CMakeLists.txt
++++ b/samples/CMakeLists.txt
+@@ -17,47 +17,12 @@ set(GLFW_BUILD_EXAMPLES OFF CACHE BOOL "GLFW Examples")
+ set(GLFW_BUILD_TESTS OFF CACHE BOOL "GLFW Tests")
+ set(GLFW_INSTALL OFF CACHE BOOL "GLFW Install")
+ 
+-FetchContent_Declare(
+-	glfw
+-	GIT_REPOSITORY https://github.com/glfw/glfw.git
+-	GIT_TAG 3.4
+-	GIT_SHALLOW TRUE
+-	GIT_PROGRESS TRUE
+-)
+-FetchContent_MakeAvailable(glfw)
++find_package(glfw)
+ 
+ # imgui and glfw backend for GUI
+ # https://gist.github.com/jeffamstutz/992723dfabac4e3ffff265eb71a24cd9
+ # Modified to pin to a specific imgui release
+-FetchContent_Populate(imgui
+-	URL https://github.com/ocornut/imgui/archive/refs/tags/v1.91.3.zip
+-	SOURCE_DIR ${CMAKE_SOURCE_DIR}/build/imgui
+-)
+-
+-set(IMGUI_DIR ${CMAKE_SOURCE_DIR}/build/imgui)
+-
+-add_library(imgui STATIC
+-	${IMGUI_DIR}/imconfig.h
+-	${IMGUI_DIR}/imgui.h
+-
+-	${IMGUI_DIR}/imgui.cpp
+-	${IMGUI_DIR}/imgui_draw.cpp
+-	${IMGUI_DIR}/imgui_demo.cpp
+-	${IMGUI_DIR}/imgui_tables.cpp
+-	${IMGUI_DIR}/imgui_widgets.cpp
+-
+-	${IMGUI_DIR}/backends/imgui_impl_glfw.cpp
+-	${IMGUI_DIR}/backends/imgui_impl_opengl3.cpp
+-)
+-
+-target_link_libraries(imgui PUBLIC glfw glad)
+-target_include_directories(imgui PUBLIC ${IMGUI_DIR} ${IMGUI_DIR}/backends)
+-target_compile_definitions(imgui PUBLIC IMGUI_DISABLE_OBSOLETE_FUNCTIONS)
+-set_target_properties(imgui PROPERTIES
+-	CXX_STANDARD 20
+-    CXX_STANDARD_REQUIRED YES
+-    CXX_EXTENSIONS NO
+-)
++find_package(imgui)
+ 
+ # jsmn for json
+ set(JSMN_DIR ${CMAKE_SOURCE_DIR}/extern/jsmn)
diff --git a/pkgs/by-name/bo/box2d/package.nix b/pkgs/by-name/bo/box2d/package.nix
new file mode 100644
index 000000000000..8b29fa3afa45
--- /dev/null
+++ b/pkgs/by-name/bo/box2d/package.nix
@@ -0,0 +1,101 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  substituteAll,
+
+  # nativeBuildInputs
+  cmake,
+  pkg-config,
+
+  # buildInputs
+  glfw3,
+  imgui,
+  libGLU,
+  libX11,
+  libXcursor,
+  libXi,
+  libXinerama,
+  libXrandr,
+  libglut,
+  xorgproto,
+
+  nix-update-script,
+}:
+
+let
+  inherit (lib) cmakeBool;
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "box2d";
+  version = "3.1.0";
+
+  src = fetchFromGitHub {
+    owner = "erincatto";
+    repo = "box2d";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QTSU1+9x8GoUK3hlTDMh43fc4vbNfFR7syt6xVHIuPs=";
+  };
+
+  patches = [
+    # prevent CMake from trying to download some libraries from the internet
+    (substituteAll {
+      src = ./cmake_dont_fetch_enkits.patch;
+      enkits_src = fetchFromGitHub {
+        owner = "dougbinks";
+        repo = "enkiTS";
+        rev = "686d0ec31829e0d9e5edf9ceb68c40f9b9b20ea9";
+        hash = "sha256-CerLj/WY+J3mrMvv7dGmZltjAM9v5C/IY4X+Ph78HVs=";
+      };
+    })
+    ./cmake_use_system_glfw_and_imgui.patch
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isGNU [
+      # error: '*(float *)((char *)&localPointA + offsetof(b2Vec2, y))' may be used uninitialized
+      "-Wno-error=maybe-uninitialized"
+    ]
+  );
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    glfw3
+    (imgui.override {
+      # GLFW backend is disabled by default on darwin but box2d imports it unconditionally
+      # https://github.com/erincatto/box2d/blob/v3.1.0/samples/main.cpp#L28
+      IMGUI_BUILD_GLFW_BINDING = true;
+    })
+    libGLU
+    libX11
+    libXcursor
+    libXi
+    libXinerama
+    libXrandr
+    libglut
+    xorgproto
+  ];
+
+  cmakeFlags = [
+    (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "2D physics engine";
+    homepage = "https://box2d.org/";
+    changelog = "https://github.com/erincatto/box2d/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.zlib;
+  };
+})
diff --git a/pkgs/development/libraries/box2d/default.nix b/pkgs/by-name/bo/box2d_2/package.nix
similarity index 56%
rename from pkgs/development/libraries/box2d/default.nix
rename to pkgs/by-name/bo/box2d_2/package.nix
index 6b1bb1c8307d..48eb6c42bfc9 100644
--- a/pkgs/development/libraries/box2d/default.nix
+++ b/pkgs/by-name/bo/box2d_2/package.nix
@@ -2,22 +2,27 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   cmake,
+  pkg-config,
+
+  # buildInputs
+  glfw3,
   libGLU,
-  libGL,
-  libglut,
   libX11,
   libXcursor,
+  libXi,
   libXinerama,
   libXrandr,
+  libglut,
   xorgproto,
-  libXi,
-  pkg-config,
-  settingsFile ? "include/box2d/b2_settings.h",
+
+  nix-update-script,
 }:
 
 let
-  inherit (lib) cmakeBool optionals;
+  inherit (lib) cmakeBool;
 
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -27,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "erincatto";
     repo = "box2d";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-yvhpgiZpjTPeSY7Ma1bh4LwIokUUKB10v2WHlamL9D8=";
   };
 
@@ -37,34 +42,27 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    glfw3
     libGLU
-    libGL
-    libglut
     libX11
     libXcursor
+    libXi
     libXinerama
     libXrandr
+    libglut
     xorgproto
-    libXi
   ];
 
   cmakeFlags = [
     (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
-  prePatch = ''
-    substituteInPlace ${settingsFile}  \
-      --replace-fail 'b2_maxPolygonVertices	8' 'b2_maxPolygonVertices	15'
-  '';
-
-  # tests are broken on 2.4.2 and 2.3.x doesn't have tests: https://github.com/erincatto/box2d/issues/677
-  doCheck = lib.versionAtLeast finalAttrs.version "2.4.2";
-
-  meta = with lib; {
+  meta = {
     description = "2D physics engine";
     homepage = "https://box2d.org/";
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.unix;
-    license = licenses.zlib;
+    changelog = "https://github.com/erincatto/box2d/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.zlib;
   };
 })
diff --git a/pkgs/by-name/ca/catppuccin/package.nix b/pkgs/by-name/ca/catppuccin/package.nix
index fd168c3021ab..32914fe6da4b 100644
--- a/pkgs/by-name/ca/catppuccin/package.nix
+++ b/pkgs/by-name/ca/catppuccin/package.nix
@@ -1,5 +1,6 @@
 let
   validThemes = [
+    "alacritty"
     "bat"
     "bottom"
     "btop"
@@ -55,6 +56,14 @@ let
 
   selectedSources = map (themeName: builtins.getAttr themeName sources) themeList;
   sources = {
+    alacritty = fetchFromGitHub {
+      name = "alacritty";
+      owner = "catppuccin";
+      repo = "alacritty";
+      rev = "f6cb5a5c2b404cdaceaff193b9c52317f62c62f7";
+      hash = "sha256-H8bouVCS46h0DgQ+oYY8JitahQDj0V9p2cOoD4cQX+Q=";
+    };
+
     bat = fetchFromGitHub {
       name = "bat";
       owner = "catppuccin";
@@ -222,6 +231,11 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
         local capitalizedVariant=$(sed 's/^\(.\)/\U\1/' <<< "${variant}")
         local capitalizedAccent=$(sed 's/^\(.\)/\U\1/' <<< "${accent}")
 
+      ''
+      + lib.optionalString (lib.elem "alacritty" themeList) ''
+        mkdir -p "$out/alacritty"
+        cp "${sources.alacritty}/catppuccin-${variant}.toml" "$out/alacritty/"
+
       ''
       + lib.optionalString (lib.elem "bat" themeList) ''
         mkdir -p "$out/bat"
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index ed6b6025a0c5..85e2af95a374 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -2,14 +2,15 @@
   lib,
   appimageTools,
   fetchurl,
+  writeScript,
 }:
 let
   pname = "chatbox";
-  version = "1.11.3";
+  version = "1.11.12";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-YMZsgbCkG/cZd77DOVZj6jVJDzWMcrt92soxyLNr2QI=";
+    hash = "sha256-sfR4fXpREPdEoPoez5ugCpn/ubpB6EhkvpVq6rz0BSg=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
@@ -25,7 +26,7 @@ appimageTools.wrapType2 {
       --replace-fail 'Icon=xyz.chatboxapp.app' 'Icon=chatbox'
   '';
 
-  passthru.updateScript = ''
+  passthru.updateScript = writeScript "update-chatbox" ''
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl gnugrep common-updater-scripts
     version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')
diff --git a/pkgs/by-name/cl/clapper-enhancers/package.nix b/pkgs/by-name/cl/clapper-enhancers/package.nix
new file mode 100644
index 000000000000..4de5dca52635
--- /dev/null
+++ b/pkgs/by-name/cl/clapper-enhancers/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gobject-introspection,
+  libpeas2,
+  json-glib,
+  libsoup_3,
+  glib,
+  clapper-unwrapped,
+  gst_all_1,
+  python3Packages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clapper-enhancers";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "Rafostar";
+    repo = "clapper-enhancers";
+    tag = finalAttrs.version;
+    hash = "sha256-CUfTz+YvliJXiv/nsdrpDVFSblqoSW7js8vAtJ9u5vM=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    python3Packages.python
+    python3Packages.wrapPython
+  ];
+
+  buildInputs = [
+    libpeas2
+    json-glib
+    libsoup_3
+    glib
+    clapper-unwrapped
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+  ];
+
+  pythonPath = with python3Packages; [
+    yt-dlp
+  ];
+
+  postFixup = ''
+    buildPythonPath "$out $pythonPath"
+    for yt_plugin in $out/lib/clapper-enhancers/plugins/yt-dlp/*.py; do
+      patchPythonScript $yt_plugin
+    done
+  '';
+
+  mesonFlags = [ "-Denhancersdir=${placeholder "out"}/${finalAttrs.passthru.pluginPath}" ];
+
+  passthru.pluginPath = "lib/clapper-enhancers/plugins";
+
+  meta = {
+    description = "Plugins enhancing Clapper library capabilities";
+    homepage = "https://github.com/Rafostar/clapper-enhancers";
+    license = lib.licenses.lgpl21Only;
+    inherit (clapper-unwrapped.meta) maintainers platforms;
+  };
+})
diff --git a/pkgs/by-name/cl/clapper-unwrapped/package.nix b/pkgs/by-name/cl/clapper-unwrapped/package.nix
new file mode 100644
index 000000000000..15b6030d8bdb
--- /dev/null
+++ b/pkgs/by-name/cl/clapper-unwrapped/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gobject-introspection,
+  pkg-config,
+  ninja,
+  desktop-file-utils,
+  shared-mime-info,
+  meson,
+  gtk4,
+  gst_all_1,
+  libGL,
+  libadwaita,
+  libsoup_3,
+  vala,
+  cmake,
+  libmicrodns,
+  glib-networking,
+  libpeas2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clapper-unwrapped";
+  version = "0.8.0";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "Rafostar";
+    repo = "clapper";
+    tag = finalAttrs.version;
+    hash = "sha256-Yb2fWsdd8jhxkGWKanLn7CAuF4MjyQ27XTrO8ja3hfs=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    meson
+    cmake
+    ninja
+    pkg-config
+    desktop-file-utils # for update-desktop-database
+    shared-mime-info # for update-mime-database
+    vala
+  ];
+
+  buildInputs = [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+    glib-networking # for TLS support
+    gtk4
+    libGL
+    libadwaita
+    libsoup_3
+    libmicrodns
+    libpeas2
+  ];
+
+  postPatch = ''
+    patchShebangs --build build-aux/meson/postinstall.py
+  '';
+
+  preFixup = ''
+    mkdir -p $out/share/gsettings-schemas
+    cp -r $lib/share/gsettings-schemas/clapper-unwrapped-$version $out/share/gsettings-schemas/clapper-$version
+  '';
+
+  meta = {
+    description = "GNOME media player built using GTK4 toolkit and powered by GStreamer with OpenGL rendering";
+    longDescription = ''
+      Clapper is a GNOME media player built using the GTK4 toolkit.
+      The media player is using GStreamer as a media backend.
+    '';
+    homepage = "https://github.com/Rafostar/clapper";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/cl/clapper/package.nix b/pkgs/by-name/cl/clapper/package.nix
index b1219422261a..596b03a94cd0 100644
--- a/pkgs/by-name/cl/clapper/package.nix
+++ b/pkgs/by-name/cl/clapper/package.nix
@@ -1,88 +1,41 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  gobject-introspection,
-  pkg-config,
-  ninja,
-  desktop-file-utils,
-  makeWrapper,
-  shared-mime-info,
+  stdenvNoCC,
+  clapper-unwrapped,
   wrapGAppsHook4,
-  meson,
-  gtk4,
-  gst_all_1,
-  libGL,
-  libadwaita,
-  libsoup_3,
-  vala,
-  cmake,
-  libmicrodns,
-  gtuber,
-  glib-networking,
-  libpeas2,
+  gobject-introspection,
+  xorg,
+  clapper-enhancers,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation {
   pname = "clapper";
-  version = "0.8.0";
+  inherit (clapper-unwrapped) version meta;
 
-  src = fetchFromGitHub {
-    owner = "Rafostar";
-    repo = "clapper";
-    tag = finalAttrs.version;
-    hash = "sha256-Yb2fWsdd8jhxkGWKanLn7CAuF4MjyQ27XTrO8ja3hfs=";
-  };
+  src = clapper-unwrapped;
+
+  dontConfigure = true;
+  dontBuild = true;
 
   nativeBuildInputs = [
+    wrapGAppsHook4
     gobject-introspection
-    meson
-    cmake
-    ninja
-    makeWrapper
-    pkg-config
-    wrapGAppsHook4 # for gsettings
-    desktop-file-utils # for update-desktop-database
-    shared-mime-info # for update-mime-database
-    vala
+    xorg.lndir
   ];
 
-  buildInputs = [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-ugly
-    gtuber
-    glib-networking # for TLS support
-    gtk4
-    libGL
-    libadwaita
-    libsoup_3
-    libmicrodns
-    libpeas2
-  ];
+  buildInputs = [ clapper-unwrapped ] ++ clapper-unwrapped.buildInputs;
 
-  postPatch = ''
-    patchShebangs --build build-aux/meson/postinstall.py
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    lndir $src $out
+
+    runHook postInstall
   '';
 
-  # The package uses "clappersink" provided by itself
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : $out/lib/gstreamer-1.0
+      --set-default CLAPPER_ENHANCERS_PATH "${clapper-enhancers}/${clapper-enhancers.passthru.pluginPath}"
     )
   '';
-
-  meta = {
-    description = "GNOME media player built using GTK4 toolkit and powered by GStreamer with OpenGL rendering";
-    longDescription = ''
-      Clapper is a GNOME media player built using the GTK4 toolkit.
-      The media player is using GStreamer as a media backend.
-    '';
-    homepage = "https://github.com/Rafostar/clapper";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ aleksana ];
-    platforms = lib.platforms.linux;
-  };
-})
+}
diff --git a/pkgs/by-name/co/copier/package.nix b/pkgs/by-name/co/copier/package.nix
index cceaf852271c..80e24c2f99b1 100644
--- a/pkgs/by-name/co/copier/package.nix
+++ b/pkgs/by-name/co/copier/package.nix
@@ -7,7 +7,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "copier";
-  version = "9.4.1";
+  version = "9.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
     postFetch = ''
       rm $out/tests/demo/doc/ma*ana.txt
     '';
-    hash = "sha256-bNz3xFYksgdN9iXbkZIHWsHpRa9aICxBZmzy/t0+3z0=";
+    hash = "sha256-mezmXrOvfqbZGZadNZklQZt/OEKqRYnwugNkZc88t6o=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;
@@ -49,16 +49,14 @@ python3.pkgs.buildPythonApplication rec {
     questionary
   ];
 
-  makeWrapperArgs = [
-    "--suffix PATH : ${lib.makeBinPath [ git ]}"
-  ];
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ git ]}" ];
 
-  meta = with lib; {
+  meta = {
     description = "Library and command-line utility for rendering projects templates";
     homepage = "https://copier.readthedocs.io";
     changelog = "https://github.com/copier-org/copier/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ greg ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ greg ];
     mainProgram = "copier";
   };
 }
diff --git a/pkgs/by-name/ed/eduli/package.nix b/pkgs/by-name/ed/eduli/package.nix
index 9ff2c1a8faa4..e30cb785ba3a 100644
--- a/pkgs/by-name/ed/eduli/package.nix
+++ b/pkgs/by-name/ed/eduli/package.nix
@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchzip {
     name = "${pname}-${version}";
     url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-3.0.zip";
-    hash = "sha256-/X5jPtjOvJTUbiKV5r2dWIFL5ft0iemdwj+Zt+Q13OA=";
+    hash = "sha256-bDQtLugYPWwJJNusBLEJrgIVufocRK4NIR0CCGaTkyw=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ex/excalidraw_export/bump-nan.patch b/pkgs/by-name/ex/excalidraw_export/bump-nan.patch
new file mode 100644
index 000000000000..db257d139d8c
--- /dev/null
+++ b/pkgs/by-name/ex/excalidraw_export/bump-nan.patch
@@ -0,0 +1,18 @@
+diff --git a/package-lock.json b/package-lock.json
+index 89dd54f..2f364e4 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -805,9 +805,10 @@
+       "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
+     },
+     "node_modules/nan": {
+-      "version": "2.18.0",
+-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz",
+-      "integrity": "sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w=="
++      "version": "2.22.0",
++      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.0.tgz",
++      "integrity": "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==",
++      "license": "MIT"
+     },
+     "node_modules/node-fetch": {
+       "version": "2.7.0",
diff --git a/pkgs/by-name/ex/excalidraw_export/package.nix b/pkgs/by-name/ex/excalidraw_export/package.nix
index f0180e09e907..1f118e677a6b 100644
--- a/pkgs/by-name/ex/excalidraw_export/package.nix
+++ b/pkgs/by-name/ex/excalidraw_export/package.nix
@@ -5,7 +5,6 @@
   cairo,
   pango,
   pkg-config,
-  stdenv,
 }:
 
 buildNpmPackage {
@@ -19,7 +18,13 @@ buildNpmPackage {
     hash = "sha256-E5kYI8+hzObd2WNVBd0aQDKMH1Sns539loCQfClJs1Q=";
   };
 
-  npmDepsHash = "sha256-5yec7BCi1c/e+y00TqxIeoazs49+WdKdfsskAqnVkFs=";
+  patches = [
+    # for compatibility with nodejs_22
+    # generated by running: `npm update nan`
+    ./bump-nan.patch
+  ];
+
+  npmDepsHash = "sha256-bU+q83Pmw6+mCF5rTR0DyYstUYVN+YxH9T9H7ZA15so=";
 
   npmBuildScript = "compile";
 
@@ -35,6 +40,5 @@ buildNpmPackage {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ venikx ];
     mainProgram = "excalidraw_export";
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/ex/exportarr/package.nix b/pkgs/by-name/ex/exportarr/package.nix
index 329fa3b7aa90..3f02b4ae9451 100644
--- a/pkgs/by-name/ex/exportarr/package.nix
+++ b/pkgs/by-name/ex/exportarr/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "exportarr";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "onedr0p";
     repo = "exportarr";
     rev = "v${version}";
-    hash = "sha256-iNcdD2zigBZ2phtCkHRV0GZPrEjopV0K+vin1Zkb3Oo=";
+    hash = "sha256-8EHFnqQ3h9/X2lR+9UuuJeSPMonuVQVDYiMDoroDajs=";
   };
 
-  vendorHash = "sha256-F5WOSsjeOzMaj4Yze11OnqpgL1l87wpgl3OQEGya//M=";
+  vendorHash = "sha256-yzzhlhrfzj+qlG4wY+qGM0/sTUUlVQAgwiKNUEIVN0g=";
 
   subPackages = [ "cmd/exportarr" ];
 
diff --git a/pkgs/by-name/fi/fim/native-tools.patch b/pkgs/by-name/fi/fim/native-tools.patch
new file mode 100644
index 000000000000..643e535dbd2c
--- /dev/null
+++ b/pkgs/by-name/fi/fim/native-tools.patch
@@ -0,0 +1,26 @@
+diff --git a/doc/Makefile.in b/doc/Makefile.in
+index be8ebe5..13ae676 100644
+--- a/doc/Makefile.in
++++ b/doc/Makefile.in
+@@ -684,7 +684,7 @@ fimgs.man.html: fimgs.man
+ 	if test ! -s $@ ; then $(MAN2TXT) ./$< > $<.txt && $(srcdir)/vim2html.pl tags $<.txt && mv $<.txt.html $@ ; fi
+ 
+ doctags$(EXEEXT): doctags.c
+-	        $(CC) -o $@ $<
++	        @cc_for_build@ -o $@ $<
+ 
+ #clean:
+ #	        $(RM) -f  doctags.o doctags$(EXEEXT) FIM.html tags fim-stylesheet.css fim.man.html fimgs.man.html
+diff --git a/src/Makefile.in b/src/Makefile.in
+index 76f5e1e..027159c 100644
+--- a/src/Makefile.in
++++ b/src/Makefile.in
+@@ -1132,7 +1132,7 @@ help-acm.cpp: fim.h
+ 	$(ECHO) '//#endif' >> $@
+ 
+ b2ba$(EXEEXT): b2ba.c
+-	$(CC) -o $@ $<
++	@cc_for_build@ -o $@ $<
+ 
+ @FIM_WANT_CUSTOM_HARDCODED_CONSOLEFONT_TRUE@@HAVE_RUNNABLE_TESTS_TRUE@default_font_byte_array.h: $(FIM_CUSTOM_HARDCODED_CONSOLEFONT) b2ba$(EXEEXT)
+ @FIM_WANT_CUSTOM_HARDCODED_CONSOLEFONT_TRUE@@HAVE_RUNNABLE_TESTS_TRUE@	./b2ba$(EXEEXT) < $< > $@
diff --git a/pkgs/by-name/fi/fim/package.nix b/pkgs/by-name/fi/fim/package.nix
index 8e8954f52d50..3a452fac4bda 100644
--- a/pkgs/by-name/fi/fim/package.nix
+++ b/pkgs/by-name/fi/fim/package.nix
@@ -4,13 +4,17 @@
   autoconf,
   automake,
   pkg-config,
+  substituteAll,
   lib,
   perl,
   flex,
   bison,
   readline,
   libexif,
-  x11Support ? true,
+  bash,
+  buildPackages,
+  # SDL depends on Qt, which doesn't cross-compile
+  x11Support ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform),
   SDL,
   svgSupport ? true,
   inkscape,
@@ -35,24 +39,33 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/p7bjeZM46DJOQ9sgtebhkNpBPj2RJYY3dMXhzHnNmg=";
   };
 
+  patches = [
+    # build tools with a build compiler
+    (substituteAll {
+      src = ./native-tools.patch;
+      cc_for_build = lib.getExe buildPackages.stdenv.cc;
+    })
+  ];
+
   postPatch = ''
-    substituteInPlace doc/vim2html.pl \
-      --replace /usr/bin/perl ${perl}/bin/perl
+    patchShebangs --build doc/vim2html.pl
   '';
 
   nativeBuildInputs = [
     autoconf
     automake
+    bison
+    flex
+    perl
     pkg-config
   ];
 
   buildInputs =
     [
-      perl
       flex
-      bison
       readline
       libexif
+      bash
     ]
     ++ lib.optional x11Support SDL
     ++ lib.optional svgSupport inkscape
@@ -62,6 +75,15 @@ stdenv.mkDerivation rec {
     ++ lib.optional jpegSupport libjpeg
     ++ lib.optional pngSupport libpng;
 
+  configureFlags = [
+    # mmap works on all relevant platforms
+    "ac_cv_func_mmap_fixed_mapped=yes"
+    # system regexp works on all relevant platforms
+    "fim_cv_regex_broken=no"
+  ];
+
+  env.LIBAA_CONFIG = lib.getExe' (lib.getDev aalib) "aalib-config";
+  env.LIBPNG_CONFIG = lib.getExe' (lib.getDev libpng) "libpng-config";
   env.NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
 
   meta = with lib; {
diff --git a/pkgs/by-name/fq/fq/package.nix b/pkgs/by-name/fq/fq/package.nix
index b388edd34a3f..e18cd0d41e22 100644
--- a/pkgs/by-name/fq/fq/package.nix
+++ b/pkgs/by-name/fq/fq/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fq";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "fq";
     rev = "v${version}";
-    hash = "sha256-I3mVAPNWjRHG0td1ulzGOthiNybfWLx1HgwPjFfBHCo=";
+    hash = "sha256-/yRTeWyHVZZzWbkI/VhYD/T5KZq8E2j678LE8gn5ILE=";
   };
 
-  vendorHash = "sha256-p2cvv983gYTvyLPYIGVsk6N7yUzBpiPzgJ3sMRNWPTo=";
+  vendorHash = "sha256-vp7JQSnzijCkWximw4E2abd39l0qjIGkl+mPfEoli0w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fs/fstar/package.nix b/pkgs/by-name/fs/fstar/package.nix
new file mode 100644
index 000000000000..5d2561fbb7e7
--- /dev/null
+++ b/pkgs/by-name/fs/fstar/package.nix
@@ -0,0 +1,121 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  installShellFiles,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  ocaml-ng,
+  removeReferencesTo,
+  util-linux,
+  which,
+}:
+
+let
+  # The version of ocaml fstar uses.
+  ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+
+  fstarZ3 = callPackage ./z3 { };
+in
+ocamlPackages.buildDunePackage rec {
+  pname = "fstar";
+  version = "2025.03.25";
+
+  src = fetchFromGitHub {
+    owner = "FStarLang";
+    repo = "FStar";
+    rev = "v${version}";
+    hash = "sha256-PhjfThXF6fJlFHtNEURG4igCnM6VegWODypmRvnZPdA=";
+  };
+
+  duneVersion = "3";
+
+  nativeBuildInputs = [
+    ocamlPackages.menhir
+    which
+    util-linux
+    installShellFiles
+    makeWrapper
+    removeReferencesTo
+  ];
+
+  prePatch = ''
+    patchShebangs .scripts/*.sh
+    patchShebangs ulib/ml/app/ints/mk_int_file.sh
+  '';
+
+  buildInputs = with ocamlPackages; [
+    batteries
+    menhir
+    menhirLib
+    pprint
+    ppx_deriving
+    ppx_deriving_yojson
+    ppxlib
+    process
+    sedlex
+    stdint
+    yojson
+    zarith
+    memtrace
+    mtime
+  ];
+
+  preConfigure = ''
+    mkdir -p cache
+    export DUNE_CACHE_ROOT="$(pwd)/cache"
+    export PATH="${lib.makeBinPath [ fstarZ3 ]}''${PATH:+:}$PATH"
+    export PREFIX="$out"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make -j$NIX_BUILD_CORES
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    make install
+
+    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
+
+    for binary in $out/bin/*; do
+      wrapProgram "$binary" --prefix PATH : "${lib.makeBinPath [ fstarZ3 ]}"
+    done
+
+    src="$(pwd)"
+    cd $out
+    installShellCompletion --bash $src/.completion/bash/fstar.exe.bash
+    installShellCompletion --fish $src/.completion/fish/fstar.exe.fish
+    installShellCompletion --zsh --name _fstar.exe $src/.completion/zsh/__fstar.exe
+    cd $src
+
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v(\d{4}\.\d{2}\.\d{2})$"
+      ];
+    };
+    z3 = fstarZ3;
+  };
+
+  meta = with lib; {
+    description = "ML-like functional programming language aimed at program verification";
+    homepage = "https://www.fstar-lang.org";
+    changelog = "https://github.com/FStarLang/FStar/raw/v${version}/CHANGES.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      numinit
+    ];
+    mainProgram = "fstar.exe";
+    platforms = with platforms; darwin ++ linux;
+  };
+}
diff --git a/pkgs/by-name/fs/fstar/z3/4-8-5-typos.diff b/pkgs/by-name/fs/fstar/z3/4-8-5-typos.diff
new file mode 100644
index 000000000000..64a4887e0ef4
--- /dev/null
+++ b/pkgs/by-name/fs/fstar/z3/4-8-5-typos.diff
@@ -0,0 +1,26 @@
+diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
+index 4c17df2..4c3c311 100644
+--- a/src/util/lp/lp_core_solver_base.h
++++ b/src/util/lp/lp_core_solver_base.h
+@@ -600,8 +600,6 @@ public:
+            out << " \n";
+     }
+ 
+-    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
+-
+     bool column_has_upper_bound(unsigned j) const {
+         switch(m_column_types[j]) {
+         case column_type::free_column:
+diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
+index 7949573..2f1cb42 100644
+--- a/src/util/lp/static_matrix_def.h
++++ b/src/util/lp/static_matrix_def.h
+@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
+     init_row_columns(m, m);
+     while (m--) {
+         for (auto & col : A.m_columns[m]){
+-            set(col.var(), m, A.get_value_of_column_cell(col));
++            set(col.var(), m, A.get_column_cell(col));
+         }
+     }
+ }
diff --git a/pkgs/by-name/fs/fstar/z3/default.nix b/pkgs/by-name/fs/fstar/z3/default.nix
new file mode 100644
index 000000000000..b0429deb8d0c
--- /dev/null
+++ b/pkgs/by-name/fs/fstar/z3/default.nix
@@ -0,0 +1,106 @@
+{
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+  replaceVars,
+  stdenvNoCC,
+  z3,
+}:
+
+let
+  # fstar has a pretty hard dependency on certain z3 patch versions.
+  # https://github.com/FStarLang/FStar/issues/3689#issuecomment-2625073641
+  # We need to package all the Z3 versions it prefers here.
+  fstarNewZ3Version = "4.13.3";
+  fstarNewZ3 =
+    if z3.version == fstarNewZ3Version then
+      z3
+    else
+      z3.overrideAttrs (final: rec {
+        version = fstarNewZ3Version;
+        src = fetchFromGitHub {
+          owner = "Z3Prover";
+          repo = "z3";
+          rev = "z3-${version}";
+          hash = "sha256-odwalnF00SI+sJGHdIIv4KapFcfVVKiQ22HFhXYtSvA=";
+        };
+      });
+
+  fstarOldZ3Version = "4.8.5";
+  fstarOldZ3 =
+    if z3.version == fstarOldZ3Version then
+      z3
+    else
+      z3.overrideAttrs (prev: rec {
+        version = fstarOldZ3Version;
+        src = fetchFromGitHub {
+          owner = "Z3Prover";
+          repo = "z3";
+          rev = "Z3-${version}"; # caps matter
+          hash = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
+        };
+        patches =
+          let
+            static-matrix-patch = fetchpatch {
+              # clang / gcc fixes. fixes typos in some member names
+              name = "gcc-15-fixes.patch";
+              url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
+              includes = [ "src/@dir@/lp/static_matrix.h" ];
+              stripLen = 3;
+              extraPrefix = "src/@dir@/";
+              hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
+            };
+
+            # replace @dir@ in the path of the given list of patches
+            fixupPatches = dir: map (patch: replaceVars patch { dir = dir; });
+          in
+          prev.patches or [ ]
+          ++ fixupPatches "util" [
+            ./lower-bound-typo.diff
+            static-matrix-patch
+            ./tail-matrix.diff
+          ]
+          ++ [
+            ./4-8-5-typos.diff
+          ];
+
+        postPatch =
+          let
+            python = lib.findFirst (pkg: lib.hasPrefix "python" pkg.pname) null prev.nativeBuildInputs;
+          in
+
+          assert python != null;
+
+          prev.postPatch or ""
+          +
+            lib.optionalString
+              ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
+              ''
+                # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
+                for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
+                  substituteInPlace "$file" \
+                    --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
+                    --replace-fail "distutils.sysconfig" "sysconfig"
+                done
+              '';
+
+      });
+in
+stdenvNoCC.mkDerivation {
+  name = "fstar-z3";
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    ln -s ${lib.getExe fstarNewZ3} $out/bin/z3-${lib.escapeShellArg fstarNewZ3.version}
+    ln -s ${lib.getExe fstarOldZ3} $out/bin/z3-${lib.escapeShellArg fstarOldZ3.version}
+  '';
+
+  passthru = rec {
+    new = fstarNewZ3;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = new;
+
+    old = fstarOldZ3;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = old;
+  };
+}
diff --git a/pkgs/by-name/fs/fstar/z3/lower-bound-typo.diff b/pkgs/by-name/fs/fstar/z3/lower-bound-typo.diff
new file mode 100644
index 000000000000..254c35be5369
--- /dev/null
+++ b/pkgs/by-name/fs/fstar/z3/lower-bound-typo.diff
@@ -0,0 +1,13 @@
+diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
+index 1dc0c60..9cbeea6 100644
+--- a/src/@dir@/lp/column_info.h
++++ b/src/@dir@/lp/column_info.h
+@@ -47,7 +47,7 @@ public:
+             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
+             m_upper_bound_is_set == c.m_upper_bound_is_set&&
+             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
+-            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
++            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
+             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
+             m_cost == c.m_cost &&
+             m_is_fixed == c.m_is_fixed &&
diff --git a/pkgs/by-name/fs/fstar/z3/tail-matrix.diff b/pkgs/by-name/fs/fstar/z3/tail-matrix.diff
new file mode 100644
index 000000000000..4f680e7617d2
--- /dev/null
+++ b/pkgs/by-name/fs/fstar/z3/tail-matrix.diff
@@ -0,0 +1,12 @@
+diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
+index 2047e8c..c84340e 100644
+--- a/src/@dir@/lp/tail_matrix.h
++++ b/src/@dir@/lp/tail_matrix.h
+@@ -43,7 +43,6 @@ public:
+         const tail_matrix & m_A;
+         unsigned m_row;
+         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
+-        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
+     };
+     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
+ };
diff --git a/pkgs/by-name/ga/gapless/package.nix b/pkgs/by-name/ga/gapless/package.nix
index eba06f9754cf..9541ab1c910b 100644
--- a/pkgs/by-name/ga/gapless/package.nix
+++ b/pkgs/by-name/ga/gapless/package.nix
@@ -16,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gapless";
-  version = "4.3.1";
+  version = "4.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "neithern";
     repo = "g4music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zLjpYGZR/o76onSjwfpHEx26vd8rUa/1PXL+DuC8C2o=";
+    hash = "sha256-10AFaUmqVkL4q8xgewfosN2/SziNhat9p6x/+9mBdyU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ge/gearlever/package.nix b/pkgs/by-name/ge/gearlever/package.nix
index 427c2cc28e13..895797545a58 100644
--- a/pkgs/by-name/ge/gearlever/package.nix
+++ b/pkgs/by-name/ge/gearlever/package.nix
@@ -11,24 +11,26 @@
   desktop-file-utils,
   libadwaita,
   file,
-  p7zip,
+  _7zz,
   which,
   appimage-run,
   gtk4,
   bintools,
   libnotify,
+  dwarfs,
+  squashfsTools,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "gearlever";
-  version = "3.0.2";
+  version = "3.2.2";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "mijorus";
     repo = "gearlever";
     tag = version;
-    hash = "sha256-b5CH7qJKsXwARCIv4EiwGcc3nH/GKGkb8gwxPWYAr4s=";
+    hash = "sha256-8gvulVq3RQZ/v7DCJ1Azrs23WMEznJCaalyjqD6iCU8=";
   };
 
   postPatch =
@@ -76,13 +78,15 @@ python3Packages.buildPythonApplication rec {
     "--prefix PATH : ${
       lib.makeBinPath [
         file
-        p7zip
+        _7zz # 7zz
         which
         appimage-run
         desktop-file-utils # update-desktop-database
         gtk4.dev # gtk4-launch
         bintools # readelf
         libnotify # notify-send
+        dwarfs # dwarfsextract, dwarfsck
+        squashfsTools # unsquashfs
       ]
     }"
   ];
diff --git a/pkgs/by-name/go/golangci-lint-langserver/package.nix b/pkgs/by-name/go/golangci-lint-langserver/package.nix
index b6695d6ae77e..34a13d3a6602 100644
--- a/pkgs/by-name/go/golangci-lint-langserver/package.nix
+++ b/pkgs/by-name/go/golangci-lint-langserver/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint-langserver";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "nametake";
     repo = "golangci-lint-langserver";
     tag = "v${version}";
-    hash = "sha256-wNofr/s8K+vbvNZWrQ97g2V0fNAS2P/Zf7tsOmly+gc=";
+    hash = "sha256-mwYhOUH5PAbPRfP86dw9w6lIZYz/iL+f863XWOhBFy0=";
   };
 
-  vendorHash = "sha256-SsGw26y/ZIBFp9dBk55ebQgJiLWOFRNe21h6huYE84I=";
+  vendorHash = "sha256-kbGTORTTxfftdU8ffsfh53nT7wZldOnBZ/1WWzN89Uc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/he/hedgedoc/package.nix b/pkgs/by-name/he/hedgedoc/package.nix
index 700bbe3abe2d..8091974a7f06 100644
--- a/pkgs/by-name/he/hedgedoc/package.nix
+++ b/pkgs/by-name/he/hedgedoc/package.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation {
     makeBinaryWrapper
     (python3.withPackages (ps: with ps; [ setuptools ])) # required to build sqlite3 bindings
     yarn
+    writableTmpDirAsHomeHook # A writable home directory is required for yarn
   ];
 
   buildInputs = [
@@ -67,7 +68,6 @@ stdenv.mkDerivation {
   buildPhase = ''
     runHook preBuild
 
-    export HOME=$(mktemp -d)
     yarn config set enableTelemetry 0
     yarn config set cacheFolder ${offlineCache}
     export npm_config_nodedir=${nodejs} # prevent node-gyp from downloading headers
diff --git a/pkgs/by-name/ho/honeymarker/package.nix b/pkgs/by-name/ho/honeymarker/package.nix
new file mode 100644
index 000000000000..b1538db6752a
--- /dev/null
+++ b/pkgs/by-name/ho/honeymarker/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeymarker";
+  version = "0.2.1";
+  vendorHash = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeymarker";
+    rev = "v${version}";
+    hash = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
+  };
+
+  meta = with lib; {
+    description = "provides a simple CRUD interface for dealing with per-dataset markers on honeycomb.io";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}
diff --git a/pkgs/by-name/ho/honeytail/package.nix b/pkgs/by-name/ho/honeytail/package.nix
new file mode 100644
index 000000000000..f6b6ea561fd0
--- /dev/null
+++ b/pkgs/by-name/ho/honeytail/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeytail";
+  version = "1.6.0";
+  vendorHash = "sha256-LtiiLGLjhbfT49A6Fw5CbSbnmTHMxtcUssr+ayCVrvY=";
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeytail";
+    rev = "v${version}";
+    hash = "sha256-S0hIgNNzF1eNe+XJs+PT7EUIl5oJCXu+B/zQago4sf8=";
+  };
+
+  meta = with lib; {
+    description = "agent for ingesting log file data into honeycomb.io and making it available for exploration";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}
diff --git a/pkgs/by-name/ho/honeyvent/package.nix b/pkgs/by-name/ho/honeyvent/package.nix
new file mode 100644
index 000000000000..9b018da8a14f
--- /dev/null
+++ b/pkgs/by-name/ho/honeyvent/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeyvent";
+  version = "1.1.0";
+  vendorHash = null;
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeyvent";
+    rev = "v${version}";
+    hash = "sha256-yFQEOshjaH6fRCQ7IZChANI9guZlTXk35p1NzQvxUdI=";
+  };
+
+  meta = with lib; {
+    description = "CLI for sending individual events to honeycomb.io";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}
diff --git a/pkgs/by-name/is/isabelle/components/isabelle-linter.nix b/pkgs/by-name/is/isabelle/components/isabelle-linter.nix
index 61a484a7f54b..6063638edd6e 100644
--- a/pkgs/by-name/is/isabelle/components/isabelle-linter.nix
+++ b/pkgs/by-name/is/isabelle/components/isabelle-linter.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "isabelle-linter";
-  version = "2024-1.0.1";
+  version = "2025-1.0.0";
 
   src = fetchFromGitHub {
     owner = "isabelle-prover";
     repo = "isabelle-linter";
-    rev = "Isabelle2024-v1.0.1";
-    hash = "sha256-oTrwcfJgbkpkIweDIyc6lZjAvdS9J4agPoJgZzH+PuQ=";
+    rev = "Isabelle2025-v1.0.0";
+    hash = "sha256-cH9EoIbKa6cqLjw83gnYvCy+Dq0d5fFmJCabdPrRJeI=";
   };
 
   nativeBuildInputs = [ isabelle ];
diff --git a/pkgs/by-name/is/isabelle/package.nix b/pkgs/by-name/is/isabelle/package.nix
index c8f5d1306e5b..363bf860b8c9 100644
--- a/pkgs/by-name/is/isabelle/package.nix
+++ b/pkgs/by-name/is/isabelle/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   coreutils,
   nettools,
   java,
@@ -10,7 +11,6 @@
   veriT,
   vampire,
   eprover-ho,
-  naproche,
   rlwrap,
   perl,
   procps,
@@ -21,6 +21,15 @@
 }:
 
 let
+  vampire' = vampire.overrideAttrs (_: {
+    src = fetchFromGitHub {
+      owner = "vprover";
+      repo = "vampire";
+      tag = "v4.8HO4Sledgahammer";
+      hash = "sha256-CmppaGa4M9tkE1b25cY1LSPFygJy5yV4kpHKbPqvcVE=";
+    };
+  });
+
   sha1 = stdenv.mkDerivation {
     pname = "isabelle-sha1";
     version = "2024";
@@ -46,7 +55,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "isabelle";
-  version = "2024";
+  version = "2025";
 
   dirname = "Isabelle${version}";
 
@@ -54,17 +63,17 @@ stdenv.mkDerivation (finalAttrs: rec {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
-        hash = "sha256-IgNfmW9x6h8DBj9vFEGV62oEl01NkW7QdyzXlWmii8c=";
+        hash = "sha256-6ldUwiiFf12dOuJU7JgUeX8kU+opDfILL23LLvDi5/g=";
       }
     else if stdenv.hostPlatform.isx86 then
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-        hash = "sha256-YDqq+KvqNll687BlHSwWKobAoN1EIHZvR+VyQDljkmc=";
+        hash = "sha256-PR1m3jcYI/4xqormZjj3NXW6wkTwCzGu4dy2LzgUfFY=";
       }
     else
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux_arm.tar.gz";
-        hash = "sha256-jXWVv18WwrVnqVX1s4Lnyf7DkOzPa3EdLXYxgtKD+YA=";
+        hash = "sha256-p/Hp+7J5gJy5s6BVD5Ma1Mu2OS53I8BS7gKSOYYB0PE=";
       };
 
   nativeBuildInputs = [ java ];
@@ -72,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   buildInputs = [
     polyml
     veriT
-    vampire
+    vampire'
     eprover-ho
     nettools
   ];
@@ -103,8 +112,8 @@ stdenv.mkDerivation (finalAttrs: rec {
       EOF
 
       cat >contrib/vampire-*/etc/settings <<EOF
-        VAMPIRE_HOME=${vampire}/bin
-        VAMPIRE_VERSION=${vampire.version}
+        VAMPIRE_HOME=${vampire'}/bin
+        VAMPIRE_VERSION=${vampire'.version}
         VAMPIRE_EXTRA_OPTIONS="--mode casc"
       EOF
 
@@ -123,13 +132,6 @@ stdenv.mkDerivation (finalAttrs: rec {
         ISABELLE_JDK_HOME=${java}
       EOF
 
-    ''
-    + lib.optionalString stdenv.hostPlatform.isx86 ''
-      rm contrib/naproche-*/x86*/Naproche-SAD
-      ln -s ${naproche}/bin/Naproche-SAD contrib/naproche-*/x86*/
-    ''
-    + ''
-
       echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
       for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
diff --git a/pkgs/by-name/jr/jrnl/package.nix b/pkgs/by-name/jr/jrnl/package.nix
index c60e20d95751..3d0113ed4aa1 100644
--- a/pkgs/by-name/jr/jrnl/package.nix
+++ b/pkgs/by-name/jr/jrnl/package.nix
@@ -41,6 +41,8 @@ python3.pkgs.buildPythonApplication rec {
     rich
   ];
 
+  pythonRelaxDeps = [ "rich" ];
+
   nativeCheckInputs = with python3.pkgs; [
     pytest-bdd
     pytest-xdist
diff --git a/pkgs/by-name/ka/kahip/package.nix b/pkgs/by-name/ka/kahip/package.nix
new file mode 100644
index 000000000000..19b79ba4ac33
--- /dev/null
+++ b/pkgs/by-name/ka/kahip/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  cmake,
+  mpi,
+  metis,
+  python3Packages,
+  pythonSupport ? false,
+  isILP64 ? false,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kahip";
+  version = "3.18";
+
+  src = fetchFromGitHub {
+    owner = "KaHIP";
+    repo = "KaHIP";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-l8DhVb2G6pQQcH3Wq4NsKw30cSK3sG+gCYRdpibw4ZI=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/KaHIP/KaHIP/commit/9d4978c7540a1ccbc9807367d6e3852114e86567.patch?full_index=1";
+      hash = "sha256-nIJL0YmVp9+JUhzEXjoabD1qNEnhtrBnjMWnitYt0eU=";
+    })
+  ];
+
+  nativeBuildInputs =
+    [ cmake ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.python
+      python3Packages.pybind11
+    ];
+
+  buildInputs = [
+    mpi
+    metis
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "64BITMODE" isILP64)
+    (lib.cmakeBool "BUILDPYTHONMODULE" pythonSupport)
+    (lib.cmakeFeature "CMAKE_INSTALL_PYTHONDIR" python3Packages.python.sitePackages)
+  ];
+
+  doInstallCheck = pythonSupport;
+
+  nativeInstallCheckInputs = lib.optionals pythonSupport [
+    python3Packages.pythonImportsCheckHook
+  ];
+
+  pythonImportsCheck = [ "kahip" ];
+
+  meta = {
+    homepage = "https://kahip.github.io/";
+    downloadPage = "https://github.com/KaHIP/KaHIP/";
+    changelog = "https://github.com/KaHIP/KaHIP/releases/tag/v${finalAttrs.version}";
+    description = "Karlsruhe HIGH Quality Partitioning";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+})
diff --git a/pkgs/by-name/ka/kalker/package.nix b/pkgs/by-name/ka/kalker/package.nix
index 62d73f96b129..be92531e950c 100644
--- a/pkgs/by-name/ka/kalker/package.nix
+++ b/pkgs/by-name/ka/kalker/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   gmp,
   mpfr,
   libmpc,
@@ -19,7 +20,17 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IYxgh6ni3BFnocHGKwKUqgSC2xUjn0b/4pBqRC5iY8U=";
+  cargoHash = "sha256-LEP2ebthwtpPSRmJt0BW/T/lB6EE+tylyVv+PDt8UoQ=";
+
+  cargoPatches = [
+    # Fixes build issue by just running cargo update
+    # Can be removed on next release
+    (fetchpatch {
+      name = "bump_cargo_deps.patch";
+      url = "https://github.com/PaddiM8/kalker/commit/81bf66950a9dfeca4ab5fdd12774c93e40021eb1.patch";
+      hash = "sha256-XT8jXTMIMOFw8OieoQM7IkUqw3SDi1c9eE1cD15BI9I=";
+    })
+  ];
 
   buildInputs = [
     gmp
diff --git a/pkgs/by-name/ki/kismet/package.nix b/pkgs/by-name/ki/kismet/package.nix
index 9bb47dc7c7ca..cc38baff02f9 100644
--- a/pkgs/by-name/ki/kismet/package.nix
+++ b/pkgs/by-name/ki/kismet/package.nix
@@ -15,6 +15,7 @@
   lm_sensors,
   networkmanager,
   nix-update-script,
+  nixosTests,
   pcre2,
   pkg-config,
   openssl,
@@ -115,6 +116,7 @@ stdenv.mkDerivation (finalPackage: {
   enableParallelBuilding = true;
 
   passthru = {
+    tests.kismet = nixosTests.kismet;
     updateScript = nix-update-script {
       extraArgs = [
         "--version-regex"
diff --git a/pkgs/by-name/li/libndctl/musl-compat.patch b/pkgs/by-name/li/libndctl/musl-compat.patch
new file mode 100644
index 000000000000..4173363b18b6
--- /dev/null
+++ b/pkgs/by-name/li/libndctl/musl-compat.patch
@@ -0,0 +1,22 @@
+diff --git a/daxctl/device.c b/daxctl/device.c
+index e3993b1..0b2f20d 100644
+--- a/daxctl/device.c
++++ b/daxctl/device.c
+@@ -23,6 +23,8 @@
+ #include "filter.h"
+ #include "json.h"
+ 
++#include <libgen.h>
++
+ static struct {
+ 	const char *dev;
+ 	const char *mode;
+@@ -366,7 +368,7 @@ static const char *parse_device_options(int argc, const char **argv,
+ 
+ 	argc = parse_options(argc, argv, options, u, 0);
+ 	if (argc > 0)
+-		device = basename(argv[0]);
++		device = basename(strdup(argv[0]));
+ 
+ 	/* Handle action-agnostic non-option arguments */
+ 	if (argc == 0 &&
diff --git a/pkgs/by-name/li/libndctl/package.nix b/pkgs/by-name/li/libndctl/package.nix
index d2ccec80a570..61d0704897b9 100644
--- a/pkgs/by-name/li/libndctl/package.nix
+++ b/pkgs/by-name/li/libndctl/package.nix
@@ -25,6 +25,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gG1Rz5AtDLzikGFr8A3l25ypd+VoLw2oWjszy9ogDLk=";
   };
 
+  patches = lib.optionals (!stdenv.hostPlatform.isGnu) [
+    # Use POSIX basename on non-glib.
+    # Remove when https://github.com/pmem/ndctl/pull/263
+    # or equivalent fix is merged and released.
+    ./musl-compat.patch
+  ];
+
   outputs = [
     "out"
     "man"
diff --git a/pkgs/by-name/li/libofa/package.nix b/pkgs/by-name/li/libofa/package.nix
index e1176a1ff2c6..242eacf9bd71 100644
--- a/pkgs/by-name/li/libofa/package.nix
+++ b/pkgs/by-name/li/libofa/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
   expat,
   curl,
   fftw,
@@ -17,11 +18,22 @@ stdenv.mkDerivation rec {
     sha256 = "184ham039l7lwhfgg0xr2vch2xnw1lwh7sid432mh879adhlc5h2";
   };
 
-  patches = fetchurl {
+  debian_patches = fetchzip {
     url = "mirror://debian/pool/main/libo/libofa/libofa_${version}-${deb_patch}.debian.tar.gz";
-    sha256 = "1rfkyz13cm8izm90c1xflp4rvsa24aqs6qpbbbqqcbmvzsj6j9yn";
+    hash = "sha256-tENhXSRcUP1PKm35IJyLUEEROze8UzxJzRx3VNAqo40=";
   };
 
+  patches = [
+    "${debian_patches}/patches/01_gcc41.diff"
+    "${debian_patches}/patches/02_example-open.diff"
+    "${debian_patches}/patches/03_example-size_type.diff"
+    "${debian_patches}/patches/04_libofa.pc-deps.diff"
+    "${debian_patches}/patches/05_gcc43.diff"
+    "${debian_patches}/patches/06_gcc44.diff"
+    "${debian_patches}/patches/fix_ftbfs.diff"
+    "${debian_patches}/patches/fix-ftbfs-gcc4.7.diff"
+  ];
+
   outputs = [
     "out"
     "dev"
diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix
index 60cf915ad92f..84452edb54ba 100644
--- a/pkgs/by-name/ma/mattermost/tests.nix
+++ b/pkgs/by-name/ma/mattermost/tests.nix
@@ -39,9 +39,10 @@ mattermost.overrideAttrs (
       + ''
         # Just echo install/get/mod commands in the Makefile, since the dependencies are locked.
         substituteInPlace server/Makefile \
-          --replace-warn '$(GO) install' '@echo $(GO) install' \
-          --replace-warn '$(GO) get' '@echo $(GO) get' \
-          --replace-warn '$(GO) get' '@echo $(GO) mod'
+          --replace-warn '$(GO) install' 'echo $(GO) install' \
+          --replace-warn '$(GOBIN)/go$$version download' 'echo $(GOBIN)/go$$version download' \
+          --replace-warn '$(GO) get' 'echo $(GO) get' \
+          --replace-warn '$(GO) get' 'echo $(GO) mod'
         # mmctl tests shell out by writing a bash script to a tempfile
         substituteInPlace server/cmd/mmctl/commands/config_e2e_test.go \
           --replace-fail '#!/bin/bash' '#!${runtimeShell}'
@@ -142,6 +143,9 @@ mattermost.overrideAttrs (
         # Appear to be broken.
         "TestSessionStore/MySQL/SessionGetWithDeviceId"
         "TestSessionStore/MySQL/GetMobileSessionMetadata"
+        "TestSessionStore/MySQL/GetSessionsWithActiveDeviceIds"
+        "TestUpdateTeam"
+        "TestSyncSyncableRoles"
       ]
       ++ optionals (!stdenv.hostPlatform.isx86_64) [
         # aarch64: invalid operating system or processor architecture
diff --git a/pkgs/by-name/me/media-downloader/package.nix b/pkgs/by-name/me/media-downloader/package.nix
index 18850c1bcdbb..dcd1b8e261fa 100644
--- a/pkgs/by-name/me/media-downloader/package.nix
+++ b/pkgs/by-name/me/media-downloader/package.nix
@@ -1,7 +1,6 @@
 {
   aria2,
   cmake,
-  # https://github.com/mhogomchungu/media-downloader?tab=readme-ov-file#extensions
   extraPackages ? [
     aria2
     ffmpeg
@@ -10,8 +9,8 @@
   fetchFromGitHub,
   ffmpeg,
   lib,
-  libsForQt5,
   python3,
+  qt6,
   stdenv,
 }:
 
@@ -28,10 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
-  buildInputs = [ libsForQt5.qtbase ];
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+  ];
 
   qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath extraPackages}" ];
 
diff --git a/pkgs/by-name/mi/min-ed-launcher/deps.json b/pkgs/by-name/mi/min-ed-launcher/deps.json
new file mode 100644
index 000000000000..a12052661d25
--- /dev/null
+++ b/pkgs/by-name/mi/min-ed-launcher/deps.json
@@ -0,0 +1,257 @@
+[
+  {
+    "pname": "Expecto",
+    "version": "10.2.1",
+    "hash": "sha256-DgwHFsPMySlnMag4kPTviTwrNOD7uPnnJLi9DCZif5s="
+  },
+  {
+    "pname": "Expecto.FsCheck",
+    "version": "10.2.1",
+    "hash": "sha256-+IDkxZKfEir5/TJrwxMFC4H6voWbSmCsvZUrjxcbc50="
+  },
+  {
+    "pname": "FsCheck",
+    "version": "2.16.5",
+    "hash": "sha256-+UXoE+QGCDN1LM+XgseKJ7c5Lj/Cblo3izmo7GtIE0A="
+  },
+  {
+    "pname": "FsConfig",
+    "version": "4.1.0",
+    "hash": "sha256-daaTrzhZjnJLDL49vOCkeXX6W5PWaLj5aqHuaYgiS1s="
+  },
+  {
+    "pname": "FSharp.Core",
+    "version": "8.0.200",
+    "hash": "sha256-wjYiedFiqOTKaM4mF6uT9kc/yKDJ78mqfw9qLoBFHOw="
+  },
+  {
+    "pname": "FSharp.Data",
+    "version": "6.4.0",
+    "hash": "sha256-8/iQA6anTybzseyvsvFV33jVVwrnYiKG1iqgwkqNeRc="
+  },
+  {
+    "pname": "FSharp.Data.Csv.Core",
+    "version": "6.4.0",
+    "hash": "sha256-jcw/6uDN0he/PhhopEvTydy2X13Xt3g3kKuVdt+8+oY="
+  },
+  {
+    "pname": "FSharp.Data.Html.Core",
+    "version": "6.4.0",
+    "hash": "sha256-HeljybTU019Z7HxFoErPM/HIAm32pJiKQM+kSyt63xw="
+  },
+  {
+    "pname": "FSharp.Data.Http",
+    "version": "6.4.0",
+    "hash": "sha256-Zn4dZCb46vr8LYR5donzeistFPSO8YYiXUU3Iqo+vKg="
+  },
+  {
+    "pname": "FSharp.Data.Json.Core",
+    "version": "6.4.0",
+    "hash": "sha256-dVhcVzUi//PFFFIML/5SWKrileeQ6IOd1VlGyEptaw0="
+  },
+  {
+    "pname": "FSharp.Data.Runtime.Utilities",
+    "version": "6.4.0",
+    "hash": "sha256-nD4U7mwZtFEUcD9XvPxhpot8FNl2YyhiLpjpjmFNAO0="
+  },
+  {
+    "pname": "FSharp.Data.WorldBank.Core",
+    "version": "6.4.0",
+    "hash": "sha256-ea2CZyHisqa1MnF70TBKfcMl6+W90MnLJ5Ctgjfk9SM="
+  },
+  {
+    "pname": "FSharp.Data.Xml.Core",
+    "version": "6.4.0",
+    "hash": "sha256-6eZWKdNjKMqufyOYolTximIS41gipBUNMKNn3HEiYw0="
+  },
+  {
+    "pname": "FSharpx.Collections",
+    "version": "3.1.0",
+    "hash": "sha256-CmDCfx19VNthqZHphYywOK0attxyJjOhu2srNKSky10="
+  },
+  {
+    "pname": "FsToolkit.ErrorHandling",
+    "version": "4.15.2",
+    "hash": "sha256-fzsnH7178Gr0pnFoXkJvqRc2s5c+MXuRKQHBifIhmQk="
+  },
+  {
+    "pname": "FsToolkit.ErrorHandling.TaskResult",
+    "version": "4.15.2",
+    "hash": "sha256-I/3BXTQQzVSlldcfaVZ849/PirOcozM5GLCmfL2qHWg="
+  },
+  {
+    "pname": "Microsoft.CodeCoverage",
+    "version": "17.9.0",
+    "hash": "sha256-OaGa4+jRPHs+T+p/oekm2Miluqfd2IX8Rt+BmUx8kr4="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration",
+    "version": "8.0.0",
+    "hash": "sha256-9BPsASlxrV8ilmMCjdb3TiUcm5vFZxkBnAI/fNBSEyA="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Abstractions",
+    "version": "8.0.0",
+    "hash": "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Binder",
+    "version": "8.0.1",
+    "hash": "sha256-KYPQYYspiBGiez7JshmEjy4kFt7ASzVxQeVsygIEvHA="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.FileExtensions",
+    "version": "8.0.0",
+    "hash": "sha256-BCxcjVP+kvrDDB0nzsFCJfU74UK4VBvct2JA4r+jNcs="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Json",
+    "version": "8.0.0",
+    "hash": "sha256-Fi/ijcG5l0BOu7i96xHu96aN5/g7zO6SWQbTsI3Qetg="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
+    "version": "8.0.0",
+    "hash": "sha256-uQSXmt47X2HGoVniavjLICbPtD2ReQOYQMgy3l0xuMU="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Physical",
+    "version": "8.0.0",
+    "hash": "sha256-29y5ZRQ1ZgzVOxHktYxyiH40kVgm5un2yTGdvuSWnRc="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileSystemGlobbing",
+    "version": "8.0.0",
+    "hash": "sha256-+Oz41JR5jdcJlCJOSpQIL5OMBNi+1Hl2d0JUHfES7sU="
+  },
+  {
+    "pname": "Microsoft.Extensions.Primitives",
+    "version": "8.0.0",
+    "hash": "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="
+  },
+  {
+    "pname": "Microsoft.Extensions.TimeProvider.Testing",
+    "version": "8.5.0",
+    "hash": "sha256-ZGXrOV/qJVfjwrJsv3jtC80IVQyH3OLOw70gCIn6uIM="
+  },
+  {
+    "pname": "Microsoft.NET.Test.Sdk",
+    "version": "17.9.0",
+    "hash": "sha256-q/1AJ7eNlk02wvN76qvjl2xBx5iJ+h5ssiE/4akLmtI="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "5.0.0",
+    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.ObjectModel",
+    "version": "17.9.0",
+    "hash": "sha256-iiXUFzpvT8OWdzMj9FGJDqanwHx40s1TXVY9l3ii+s0="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.TestHost",
+    "version": "17.9.0",
+    "hash": "sha256-1BZIY1z+C9TROgdTV/tq4zsPy7Q71GQksr/LoMKAzqU="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "5.0.0",
+    "hash": "sha256-9kylPGfKZc58yFqNKa77stomcoNnMeERXozWJzDcUIA="
+  },
+  {
+    "pname": "Mono.Cecil",
+    "version": "0.11.4",
+    "hash": "sha256-HrnRgFsOzfqAWw0fUxi/vkzZd8dMn5zueUeLQWA9qvs="
+  },
+  {
+    "pname": "Mono.Posix.NETStandard",
+    "version": "5.20.1-preview",
+    "hash": "sha256-gLtcH308/VVYgZcrJtvXDkBIMIQjK8w35AcmuxYYTvM="
+  },
+  {
+    "pname": "Newtonsoft.Json",
+    "version": "13.0.1",
+    "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
+  },
+  {
+    "pname": "Serilog",
+    "version": "3.1.1",
+    "hash": "sha256-L263y8jkn7dNFD2jAUK6mgvyRTqFe39i1tRhVZsNZTI="
+  },
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "5.0.1",
+    "hash": "sha256-aveoZM25ykc2haBHCXWD09jxZ2t2tYIGmaNTaO2V0jI="
+  },
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "5.0.0",
+    "hash": "sha256-GKy9hwOdlu2W0Rw8LiPyEwus+sDtSOTl8a5l9uqz+SQ="
+  },
+  {
+    "pname": "Serilog.Sinks.File.Header",
+    "version": "1.0.2",
+    "hash": "sha256-2igOXIHtojhhNlg/C5OhPwmVUoE5MpmgApi8dFmutx4="
+  },
+  {
+    "pname": "System.Collections.Immutable",
+    "version": "6.0.0",
+    "hash": "sha256-DKEbpFqXCIEfqp9p3ezqadn5b/S1YTk32/EQK+tEScs="
+  },
+  {
+    "pname": "System.Reflection.Metadata",
+    "version": "1.6.0",
+    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
+  },
+  {
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "6.0.0",
+    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "5.0.0",
+    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
+  },
+  {
+    "pname": "System.Security.Cryptography.ProtectedData",
+    "version": "8.0.0",
+    "hash": "sha256-fb0pa9sQxN+mr0vnXg1Igbx49CaOqS+GDkTfWNboUvs="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "8.0.0",
+    "hash": "sha256-+YUPY+3HnTmfPLZzr+5qEk0RqalCbFZBgLXee1yCH1M="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "5.0.0",
+    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
+  },
+  {
+    "pname": "System.Text.Encodings.Web",
+    "version": "8.0.0",
+    "hash": "sha256-IUQkQkV9po1LC0QsqrilqwNzPvnc+4eVvq+hCvq8fvE="
+  },
+  {
+    "pname": "System.Text.Json",
+    "version": "8.0.0",
+    "hash": "sha256-XFcCHMW1u2/WujlWNHaIWkbW1wn8W4kI0QdrwPtWmow="
+  },
+  {
+    "pname": "System.Windows.Extensions",
+    "version": "8.0.0",
+    "hash": "sha256-aHkz7LtmUDDRS7swQM0i6dDVUytRCMYeA2CfaeVA2Y0="
+  },
+  {
+    "pname": "TypeShape",
+    "version": "10.0.0",
+    "hash": "sha256-esJFuRvxuLXwBgi/7FjEVm1ATCGXU/yB2RtgN4ilZtg="
+  },
+  {
+    "pname": "YoloDev.Expecto.TestSdk",
+    "version": "0.14.3",
+    "hash": "sha256-3FIZM+GYsBsFGhLsasF7Ia9nXHSpqooQNe5H7ANy334="
+  }
+]
diff --git a/pkgs/by-name/mi/min-ed-launcher/package.nix b/pkgs/by-name/mi/min-ed-launcher/package.nix
new file mode 100644
index 000000000000..a43c5532eb6d
--- /dev/null
+++ b/pkgs/by-name/mi/min-ed-launcher/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  git,
+}:
+buildDotnetModule rec {
+  pname = "min-ed-launcher";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "rfvgyhn";
+    repo = "min-ed-launcher";
+    tag = "v${version}";
+    hash = "sha256-HJIvbuTsCG51PPVieJbXGyAviqgM9/WPz0+0VhIWz9k=";
+
+    leaveDotGit = true; # During build the current commit is appended to the version
+  };
+
+  projectFile = "MinEdLauncher.sln";
+  nugetDeps = ./deps.json;
+  buildInputs = [
+    git # During build the current commit is appended to the version
+  ];
+
+  executables = [ "MinEdLauncher" ];
+
+  meta = {
+    homepage = "https://github.com/rfvgyhn/min-ed-launcher";
+    description = "Minimal Elite Dangerous Launcher";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.x86_64;
+    mainProgram = "MinEdLauncher";
+    maintainers = with lib.maintainers; [ jiriks74 ];
+  };
+}
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index 9b6dfc19cde8..bfa87faf91f7 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.05";
+  version = "11.08";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-CHOkP5L5FITV2ZpeYjSL9r8K6eeG/p4ZBrUztRvnIU4=";
+    hash = "sha256-iy/WFFRv3/ZJoGCAKH2+rYnyIdvaO+kgxaH/XeKWtbs=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ne/neohtop/package.nix b/pkgs/by-name/ne/neohtop/package.nix
index 14a83ec87048..4ed54a841699 100644
--- a/pkgs/by-name/ne/neohtop/package.nix
+++ b/pkgs/by-name/ne/neohtop/package.nix
@@ -11,7 +11,6 @@
   fetchFromGitHub,
   glib,
   gtk3,
-  libsoup_2_4,
   openssl,
   nix-update-script,
 }:
@@ -51,7 +50,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     glib
     gtk3
     openssl
-    libsoup_2_4
     webkitgtk_4_1
   ];
 
diff --git a/pkgs/by-name/ne/newsflash/package.nix b/pkgs/by-name/ne/newsflash/package.nix
index 2c89c3e550e3..26f7cf614a6f 100644
--- a/pkgs/by-name/ne/newsflash/package.nix
+++ b/pkgs/by-name/ne/newsflash/package.nix
@@ -12,7 +12,7 @@
   rustc,
   wrapGAppsHook4,
   gdk-pixbuf,
-  clapper,
+  clapper-unwrapped,
   gtk4,
   libadwaita,
   libxml2,
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      clapper
+      clapper-unwrapped
       gtk4
       libadwaita
       libxml2
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index d08b3773c9af..b0c6d9655fc8 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-talk-desktop";
-  version = "1.1.5";
+  version = "1.1.6";
 
   # Building from source would require building also building Server and Talk components
   # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
   src = fetchzip {
     url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${finalAttrs.version}/Nextcloud.Talk-linux-x64.zip";
-    hash = "sha256-KI6EJxsiIPjk+SBdqAwQNpaMZgVQSra/tqCGufQYSPs=";
+    hash = "sha256-+bKE9taQxOrxB9tBP3PReyZlict6/gEX5uWbuzGIa8k=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
index f0e68a0383a5..bdbeba1066d4 100644
--- a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nezha-theme-nazhua";
-  version = "0.6.4";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "hi2shark";
     repo = "nazhua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9mBM8M9pPZMMyFcf4JOyY5rnhpiNEy8ZDDnEoopjcbg=";
+    hash = "sha256-Flx0yHhYGDM9qPIsE1ZfjdmuWXbDTodnaiVK7Hee3Z4=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/nw/nwg-dock-hyprland/package.nix b/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
index 3cf0161f6354..90eaa3c6b0fc 100644
--- a/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
+++ b/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nwg-dock-hyprland";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-dock-hyprland";
     tag = "v${version}";
-    hash = "sha256-mkwUDPBMpFxr+W5bRSQFevYVhZ949intKRU+KNo0/Gc=";
+    hash = "sha256-zpQou/ABWIYg5QRynfrzPI3YOuNzpU5wHYZwutXwFc0=";
   };
 
-  vendorHash = "sha256-6qgUvTByq4mkJoG38pI8eVe5o0pVI9O+/y/ZTDS5hw8=";
+  vendorHash = "sha256-ZR/vF7ogOEhyKQr35ew3OmYLVeudt51W8b734SZXvC0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/or/orthanc-framework/package.nix b/pkgs/by-name/or/orthanc-framework/package.nix
index 037044b68a6f..e19bd8331e79 100644
--- a/pkgs/by-name/or/orthanc-framework/package.nix
+++ b/pkgs/by-name/or/orthanc-framework/package.nix
@@ -18,10 +18,6 @@ stdenv.mkDerivation (finalAttrs: {
     ;
 
   sourceRoot = "${finalAttrs.src.name}/OrthancFramework/SharedLibrary";
-  outputs = [
-    "out"
-    "dev"
-  ];
 
   buildInputs = orthanc.buildInputs ++ [
     icu
diff --git a/pkgs/by-name/or/orthanc-plugin-dicomweb/fix-orthanc-framework-headers-detection.patch b/pkgs/by-name/or/orthanc-plugin-dicomweb/fix-orthanc-framework-headers-detection.patch
deleted file mode 100644
index 87c92ed94d1b..000000000000
--- a/pkgs/by-name/or/orthanc-plugin-dicomweb/fix-orthanc-framework-headers-detection.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff -r ad41d16f36b1 Resources/Orthanc/CMake/DownloadOrthancFramework.cmake
---- a/Resources/Orthanc/CMake/DownloadOrthancFramework.cmake	Fri Jan 17 12:24:54 2025 +0100
-+++ b/Resources/Orthanc/CMake/DownloadOrthancFramework.cmake	Thu Mar 20 17:45:59 2025 +0100
-@@ -552,9 +552,10 @@
-     set(ORTHANC_FRAMEWORK_INCLUDE_DIR ${ORTHANC_FRAMEWORK_ROOT})
-   else()
-     find_path(ORTHANC_FRAMEWORK_INCLUDE_DIR OrthancFramework.h
--      /usr/include/orthanc-framework
--      /usr/local/include/orthanc-framework
-+      /usr/
-+      /usr/local/
-       ${ORTHANC_FRAMEWORK_ROOT}
-+      PATH_SUFFIXES include include/orthanc-framework
-       )
-   endif()
- 
diff --git a/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix b/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
index 160d7bb47949..40e0cdf16ce1 100644
--- a/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
+++ b/pkgs/by-name/or/orthanc-plugin-dicomweb/package.nix
@@ -13,7 +13,6 @@
   pugixml,
   libuuid,
   zlib,
-  pkg-config,
 }:
 
 let
@@ -48,11 +47,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ee271Fcu8yi1gZpTWrCuqhsBdFcPR/JK/fsnJg8PwIc=";
   };
 
-  patches = [
-    # Fix Orthanc Framework headers files detection
-    ./fix-orthanc-framework-headers-detection.patch
-  ];
-
   postPatch = ''
     mkdir -p ThirdPartyDownloads
     ln -s ${bootstrap} ThirdPartyDownloads/bootstrap-5.3.3.zip
@@ -92,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_BUILD_TYPE=Release"
     "-DSTATIC_BUILD=OFF"
     "-DORTHANC_FRAMEWORK_SOURCE=system"
+    "-DORTHANC_FRAMEWORK_ROOT=${orthanc.framework}/include/orthanc-framework"
   ];
 
   meta = {
diff --git a/pkgs/by-name/pi/pipeline/package.nix b/pkgs/by-name/pi/pipeline/package.nix
index d86d5ee726f5..350a2157def2 100644
--- a/pkgs/by-name/pi/pipeline/package.nix
+++ b/pkgs/by-name/pi/pipeline/package.nix
@@ -17,7 +17,7 @@
   desktop-file-utils,
   blueprint-compiler,
   sqlite,
-  clapper,
+  clapper-unwrapped,
   gettext,
   gst_all_1,
   gtuber,
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
     openssl
     sqlite
-    clapper
+    clapper-unwrapped
 
     gst_all_1.gstreamer
     gst_all_1.gst-libav
diff --git a/pkgs/by-name/po/pocl/package.nix b/pkgs/by-name/po/pocl/package.nix
index 4f1d93a72eb8..4075762f19e5 100644
--- a/pkgs/by-name/po/pocl/package.nix
+++ b/pkgs/by-name/po/pocl/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  nix-update-script,
   cmake,
   pkg-config,
   hwloc,
@@ -11,28 +10,34 @@
   spirv-llvm-translator,
   spirv-tools,
   lttng-ust,
+  opencl-headers,
   ocl-icd,
   python3,
   runCommand,
   makeWrapper,
+  writableTmpDirAsHomeHook,
 }:
 
 let
   clang = llvmPackages.clangUseLLVM;
   # Workaround to make sure libclang finds libgcc.a and libgcc_s.so when
   # invoked from within libpocl
-  clangWrapped = runCommand "clang-pocl" { nativeBuildInputs = [ makeWrapper ]; } ''
-    mkdir -p $out/bin
-    cp -r ${clang}/bin/* $out/bin/
-    LIBGCC_DIR=$(dirname $(find ${stdenv.cc.cc}/lib/ -name libgcc.a))
-    for F in ${clang}/bin/ld*; do
-      BASENAME=$(basename "$F")
-      rm -f $out/bin/$BASENAME
-      makeWrapper ${clang}/bin/$BASENAME $out/bin/$BASENAME \
-        --add-flags "-L$LIBGCC_DIR" \
-        --add-flags "-L${lib.getLib stdenv.cc.cc}/lib"
-    done
-  '';
+  clangWrapped =
+    if stdenv.hostPlatform.isDarwin then
+      clang
+    else
+      runCommand "clang-pocl" { nativeBuildInputs = [ makeWrapper ]; } ''
+        mkdir -p $out/bin
+        cp -r ${clang}/bin/* $out/bin/
+        LIBGCC_DIR=$(dirname $(find ${stdenv.cc.cc}/lib/ -name libgcc.a))
+        for F in ${clang}/bin/ld*; do
+          BASENAME=$(basename "$F")
+          rm -f $out/bin/$BASENAME
+          makeWrapper ${clang}/bin/$BASENAME $out/bin/$BASENAME \
+            --add-flags "-L$LIBGCC_DIR" \
+            --add-flags "-L${lib.getLib stdenv.cc.cc}/lib"
+        done
+      '';
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pocl";
@@ -45,18 +50,31 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-d/BD8YkdMYtu6yFlGNXrsz7PVIrzBvvYLU1JRv7ZJmc=";
   };
 
-  cmakeFlags = [
-    "-DKERNELLIB_HOST_CPU_VARIANTS=distro"
-    # avoid the runtime linker pulling in a different llvm e.g. from graphics drivers
-    "-DSTATIC_LLVM=ON"
-    "-DENABLE_POCL_BUILDING=OFF"
-    "-DPOCL_ICD_ABSOLUTE_PATH=ON"
-    "-DENABLE_ICD=ON"
-    "-DCLANG=${clangWrapped}/bin/clang"
-    "-DCLANGXX=${clangWrapped}/bin/clang++"
-    "-DENABLE_REMOTE_CLIENT=ON"
-    "-DENABLE_REMOTE_SERVER=ON"
-  ];
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace pocld/shared_cl_context.cc --replace-fail \
+      "Dev.getInfo<CL_DEVICE_GLOBAL_MEM_SIZE>()" \
+      "static_cast<size_t>(Dev.getInfo<CL_DEVICE_GLOBAL_MEM_SIZE>())"
+  '';
+
+  cmakeFlags =
+    [
+      # avoid the runtime linker pulling in a different llvm e.g. from graphics drivers
+      (lib.cmakeBool "STATIC_LLVM" true)
+      (lib.cmakeBool "ENABLE_POCL_BUILDING" false)
+      (lib.cmakeBool "POCL_ICD_ABSOLUTE_PATH" true)
+      (lib.cmakeBool "ENABLE_ICD" true)
+      (lib.cmakeBool "ENABLE_REMOTE_CLIENT" true)
+      (lib.cmakeBool "ENABLE_REMOTE_SERVER" true)
+      (lib.cmakeFeature "CLANG" "${clangWrapped}/bin/clang")
+      (lib.cmakeFeature "CLANGXX" "${clangWrapped}/bin/clang++")
+    ]
+    # Only x86_64 supports "distro" which allows runtime detection of SSE/AVX
+    ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+      (lib.cmakeFeature "KERNELLIB_HOST_CPU_VARIANTS" "distro")
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
+      (lib.cmakeFeature "LLC_HOST_CPU" "generic")
+    ];
 
   nativeBuildInputs = [
     cmake
@@ -65,21 +83,40 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs = [
-    hwloc
-    libxml2
-    llvmPackages.llvm
-    llvmPackages.libclang
-    lttng-ust
-    ocl-icd
-    spirv-tools
-    spirv-llvm-translator
+  buildInputs =
+    [
+      hwloc
+      libxml2
+      llvmPackages.llvm
+      llvmPackages.libclang
+      opencl-headers
+      ocl-icd
+      spirv-tools
+      spirv-llvm-translator
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      lttng-ust
+    ];
+
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
   ];
 
-  passthru.updateScript = nix-update-script { };
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    export OCL_ICD_VENDORS=$out/etc/OpenCL/vendors
+    $out/bin/poclcc -o poclcc.cl.pocl $src/examples/poclcc/poclcc.cl
+
+    runHook postInstallCheck
+  '';
+
+  setupHook = ./setup-hook.sh;
 
   meta = {
-    description = "A portable open source (MIT-licensed) implementation of the OpenCL standard";
+    description = "portable open source (MIT-licensed) implementation of the OpenCL standard";
     homepage = "http://portablecl.org";
     changelog = "https://github.com/pocl/pocl/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/po/pocl/setup-hook.sh b/pkgs/by-name/po/pocl/setup-hook.sh
new file mode 100644
index 000000000000..986297516b75
--- /dev/null
+++ b/pkgs/by-name/po/pocl/setup-hook.sh
@@ -0,0 +1,6 @@
+preCheckHooks+=('setupPoclCheck')
+preInstallCheckHooks+=('setupPoclCheck')
+
+setupPoclCheck () {
+  export OCL_ICD_VENDORS="@out@/etc/OpenCL/vendors"
+}
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index cb6a67f343f2..d417a13e161e 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -25,16 +25,6 @@ let
         };
       });
 
-      geoip2 = super.geoip2.overridePythonAttrs rec {
-        version = "5.0.1";
-
-        src = fetchPypi {
-          pname = "geoip2";
-          inherit version;
-          hash = "sha256-kK+LbTaH877yUfJwitAXsw1ifRFEwAQOq8TJAXqAfYY=";
-        };
-      };
-
       stripe = super.stripe.overridePythonAttrs rec {
         version = "7.9.0";
 
@@ -46,8 +36,6 @@ let
       };
 
       pretix-plugin-build = self.callPackage ./plugin-build.nix { };
-
-      sentry-sdk = super.sentry-sdk_2;
     };
   };
 
diff --git a/pkgs/by-name/ra/rain/package.nix b/pkgs/by-name/ra/rain/package.nix
index eb1a8ec4d010..30a334aee635 100644
--- a/pkgs/by-name/ra/rain/package.nix
+++ b/pkgs/by-name/ra/rain/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "rain";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0FjJXOmLHM0At0TJdcsYTafgDbw+C37BH11ft+UjEl0=";
+    sha256 = "sha256-Dsg8vUMs6aep4FfrulHdtH3H7fitWdzENfTPm+9z5m0=";
   };
 
-  vendorHash = "sha256-A+fQCiA2jArnhxbKxNmRQB6wY5mcmrY+fMtZQX5aBmU=";
+  vendorHash = "sha256-5i6dAjgWclyEkRrDzrkiIRQKTeNz4GM1LU+2J3t/+Yc=";
 
   subPackages = [ "cmd/rain" ];
 
diff --git a/pkgs/by-name/rc/rclone-ui/package.nix b/pkgs/by-name/rc/rclone-ui/package.nix
index d9320d6fe6ea..0db1c5d2cb26 100644
--- a/pkgs/by-name/rc/rclone-ui/package.nix
+++ b/pkgs/by-name/rc/rclone-ui/package.nix
@@ -12,7 +12,6 @@
   wrapGAppsHook3,
 
   openssl,
-  libsoup_2_4,
   webkitgtk_4_1,
   glib-networking,
   libappindicator,
@@ -62,7 +61,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [
     openssl
-    libsoup_2_4
     webkitgtk_4_1
     glib-networking
     libappindicator
diff --git a/pkgs/by-name/re/redu/package.nix b/pkgs/by-name/re/redu/package.nix
new file mode 100644
index 000000000000..5da1913d43a9
--- /dev/null
+++ b/pkgs/by-name/re/redu/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "redu";
+  version = "0.2.12";
+
+  src = fetchFromGitHub {
+    owner = "drdo";
+    repo = "redu";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3DcBTpog5tWv2qdmhOlDLHFY77Cug6mCpDQEAtViw74=";
+  };
+
+  cargoHash = "sha256-Rp8y2tBnpzBVEoLP4fTMulIJpu1j2TpJNh5M9kjnuEo=";
+
+  env.RUSTC_BOOTSTRAP = 1;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "ncdu for your restic repo";
+    homepage = "https://github.com/drdo/redu";
+    changelog = "https://github.com/drdo/redu/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ alexfmpe ];
+    mainProgram = "redu";
+  };
+})
diff --git a/pkgs/by-name/re/revolver/package.nix b/pkgs/by-name/re/revolver/package.nix
index 37eac352fd82..fd6c63266b38 100644
--- a/pkgs/by-name/re/revolver/package.nix
+++ b/pkgs/by-name/re/revolver/package.nix
@@ -5,7 +5,7 @@
   zsh,
   installShellFiles,
   ncurses,
-  nix-update-script,
+  unstableGitUpdater,
   testers,
   runCommand,
 }:
@@ -79,7 +79,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         version = "0.2.0";
       };
     };
-    updateScript = nix-update-script { };
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/se/senpai/package.nix b/pkgs/by-name/se/senpai/package.nix
index b0488b7ef307..9812e3d934f2 100644
--- a/pkgs/by-name/se/senpai/package.nix
+++ b/pkgs/by-name/se/senpai/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "senpai";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromSourcehut {
     owner = "~delthas";
     repo = "senpai";
     rev = "v${version}";
-    sha256 = "sha256-3DVy+7mMVFmPpGxwJqtt2+QwNEMrgZazynawE/Wf+UM=";
+    sha256 = "sha256-lwfhRnaHGOIp6NyugPEu6P+3WXkVgQEWaz7DUfHiJrQ=";
   };
 
   vendorHash = "sha256-6glslBPjJr0TmrAkDGbOQ4sDzvODlavVeTugs6RXsCU=";
diff --git a/pkgs/by-name/su/supermodel/package.nix b/pkgs/by-name/su/supermodel/package.nix
index 15702e89aad8..f78444742fe2 100644
--- a/pkgs/by-name/su/supermodel/package.nix
+++ b/pkgs/by-name/su/supermodel/package.nix
@@ -4,25 +4,27 @@
   libGLU,
   SDL2,
   SDL2_net,
+  xorg,
   stdenv,
   zlib,
 }:
 
 stdenv.mkDerivation {
   pname = "supermodel";
-  version = "0-unstable-2024-11-07";
+  version = "0-unstable-2025-04-17";
 
   src = fetchFromGitHub {
     owner = "trzy";
     repo = "supermodel";
-    rev = "4e7356ab2c077aa3bc3d75fb6e164a1c943fe4c1";
-    hash = "sha256-ajRbgs6oMFF+dYHPsKM7FU16vuZcSovaNk2thdsUWtk=";
+    rev = "2272893a0511c0b3b50f6dda64addb7014717dd3";
+    hash = "sha256-3FdLBGxmi4Xj7ao2nvjLleJSTXvKQrhUWvnQr8DK/RY=";
   };
 
   buildInputs = [
     libGLU
     SDL2
     SDL2_net
+    xorg.libX11
     zlib
   ];
 
diff --git a/pkgs/by-name/te/televido/package.nix b/pkgs/by-name/te/televido/package.nix
index 1da3458e257a..fa02c90a65f3 100644
--- a/pkgs/by-name/te/televido/package.nix
+++ b/pkgs/by-name/te/televido/package.nix
@@ -14,7 +14,7 @@
   desktop-file-utils,
   openssl,
   gst_all_1,
-  clapper,
+  clapper-unwrapped,
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libadwaita
     desktop-file-utils
-    clapper
+    clapper-unwrapped
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-libav
diff --git a/pkgs/by-name/ts/tsduck/package.nix b/pkgs/by-name/ts/tsduck/package.nix
index b58896719134..298b3c05c803 100644
--- a/pkgs/by-name/ts/tsduck/package.nix
+++ b/pkgs/by-name/ts/tsduck/package.nix
@@ -2,93 +2,87 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  # build and doc tooling
+  asciidoctor-with-extensions,
+  doxygen,
+  graphviz,
+  python3,
+  ruby,
+  qpdf,
+  # build deps
   curl,
+  glibcLocales,
   jdk,
   libedit,
+  librist,
+  openssl,
   srt,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tsduck";
-  version = "3.31-2761";
+  version = "3.40-4165";
 
   src = fetchFromGitHub {
     owner = "tsduck";
     repo = "tsduck";
-    rev = "v${version}";
-    sha256 = "sha256-268TKCh3naebbw+sOQ6d4N/zl7UEVtc3l3flFAYHDU4=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-bFnsGoElXeStIX5KwonJuF0x7DDzhzq+3oygkUOmZE0=";
   };
 
+  nativeBuildInputs = [
+    asciidoctor-with-extensions
+    doxygen
+    graphviz
+    python3
+    ruby
+    qpdf
+  ];
+
   buildInputs = [
     curl
-    libedit
-    srt
+    glibcLocales
     jdk
+    libedit
+    librist
+    openssl
+    srt
   ];
 
-  # remove tests which call out to https://tsduck.io/download/test/...
+  enableParallelBuilding = true;
+
   postPatch = ''
-    sed -i \
-      -e '/TSUNIT_TEST(testMasterPlaylist);/ d' \
-      -e '/TSUNIT_TEST(testMasterPlaylistWithAlternate);/ d' \
-      -e '/TSUNIT_TEST(testMediaPlaylist);/ d' \
-      src/utest/utestHLS.cpp
-
-    sed -i \
-      -e '/TSUNIT_TEST(testBetterSystemRandomGenerator);/ d' \
-      src/utest/utestSystemRandomGenerator.cpp
-
-    sed -i \
-      -e '/TSUNIT_ASSERT(request.downloadBinaryContent/ d' \
-      -e '/TSUNIT_ASSERT(!request.downloadBinaryContent/ d' \
-      -e '/TSUNIT_TEST(testGitHub);/ d' \
-      -e '/TSUNIT_TEST(testGoogle);/ d' \
-      -e '/TSUNIT_TEST(testNoRedirection);/ d' \
-      -e '/TSUNIT_TEST(testReadMeFile);/ d' \
-      src/utest/utestWebRequest.cpp
-
-    sed -i \
-      -e '/TSUNIT_TEST(testHomeDirectory);/ d' \
-      src/utest/utestSysUtils.cpp
-
-    sed -i \
-      -e '/TSUNIT_TEST(testIPv4Address);/ d' \
-      -e '/TSUNIT_TEST(testIPv4AddressConstructors);/ d' \
-      -e '/TSUNIT_TEST(testIPv4SocketAddressConstructors);/ d' \
-      -e '/TSUNIT_TEST(testTCPSocket);/ d' \
-      -e '/TSUNIT_TEST(testUDPSocket);/ d' \
-      src/utest/utestNetworking.cpp
+    patchShebangs scripts
   '';
 
-  enableParallelBuilding = true;
+  # see CONFIG.txt in the sources
   makeFlags = [
+    "CXXFLAGS_NO_WARNINGS=-Wno-deprecated-declarations"
     "NODEKTEC=1"
+    "NOGITHUB=1"
     "NOHIDES=1"
     "NOPCSC=1"
-    "NORIST=1"
     "NOVATEK=1"
-  ] ++ installFlags;
+    "SYSPREFIX=/"
+    "SYSROOT=${placeholder "out"}"
+  ];
 
+  # remove tests which break the sandbox
+  patches = [ ./tests.patch ];
   checkTarget = "test";
   doCheck = true;
 
-  installFlags = [
-    "SYSROOT=${placeholder "out"}"
-    "SYSPREFIX=/"
-    "USRLIBDIR=/lib"
-  ];
   installTargets = [
     "install-tools"
     "install-devel"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "MPEG Transport Stream Toolkit";
     homepage = "https://github.com/tsduck/tsduck";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ siriobalmelli ];
-    platforms = platforms.all;
-    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin;
+    mainProgram = "tsversion";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ siriobalmelli ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/ts/tsduck/tests.patch b/pkgs/by-name/ts/tsduck/tests.patch
new file mode 100644
index 000000000000..65b270e506f1
--- /dev/null
+++ b/pkgs/by-name/ts/tsduck/tests.patch
@@ -0,0 +1,744 @@
+diff --git a/src/utest/utestHLS.cpp b/src/utest/utestHLS.cpp
+index ebfe67f3d..dc023b636 100644
+--- a/src/utest/utestHLS.cpp
++++ b/src/utest/utestHLS.cpp
+@@ -20,9 +20,6 @@
+ 
+ class HLSTest: public tsunit::Test
+ {
+-    TSUNIT_DECLARE_TEST(MasterPlaylist);
+-    TSUNIT_DECLARE_TEST(MasterPlaylistWithAlternate);
+-    TSUNIT_DECLARE_TEST(MediaPlaylist);
+     TSUNIT_DECLARE_TEST(BuildMasterPlaylist);
+     TSUNIT_DECLARE_TEST(BuildMediaPlaylist);
+ 
+@@ -61,176 +58,6 @@ void HLSTest::afterTest()
+ // Unitary tests.
+ //----------------------------------------------------------------------------
+ 
+-TSUNIT_DEFINE_TEST(MasterPlaylist)
+-{
+-    // Test file downloaded from TSDuck web site.
+-    // Copied from Apple test file at
+-    // https://devstreaming-cdn.apple.com/videos/streaming/examples/img_bipbop_adv_example_ts/master.m3u8
+-
+-    ts::hls::PlayList pl;
+-    TSUNIT_ASSERT(pl.loadURL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/master.m3u8", true));
+-    TSUNIT_ASSERT(pl.isValid());
+-    TSUNIT_EQUAL(ts::hls::PlayListType::MASTER, pl.type());
+-    TSUNIT_EQUAL(6, pl.version());
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/master.m3u8", pl.url());
+-    ts::hls::MediaElement media;
+-    pl.buildURL(media, u"foo.bar");
+-    TSUNIT_EQUAL(u"foo.bar", media.relative_uri);
+-    TSUNIT_EQUAL(u"/download/test/hls/img_bipbop_adv_example_ts/foo.bar", media.file_path);
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/foo.bar", media.url.toString());
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/foo.bar", media.urlString());
+-    TSUNIT_EQUAL(0, pl.segmentCount());
+-    TSUNIT_EQUAL(24, pl.playListCount());
+-    TSUNIT_EQUAL(5, pl.altPlayListCount());
+-    TSUNIT_EQUAL(0, pl.targetDuration().count());
+-    TSUNIT_EQUAL(0, pl.mediaSequence());
+-    TSUNIT_ASSERT(!pl.endList());
+-    TSUNIT_EQUAL(ts::hls::PlayListType::MASTER, pl.type());
+-
+-    TSUNIT_EQUAL(u"v5/prog_index.m3u8", pl.playList(0).relative_uri);
+-    TSUNIT_EQUAL(2227464, pl.playList(0).bandwidth.toInt());
+-    TSUNIT_EQUAL(2218327, pl.playList(0).average_bandwidth.toInt());
+-    TSUNIT_EQUAL(960, pl.playList(0).width);
+-    TSUNIT_EQUAL(540, pl.playList(0).height);
+-    TSUNIT_EQUAL(60000, pl.playList(0).frame_rate);
+-    TSUNIT_EQUAL(u"avc1.640020,mp4a.40.2", pl.playList(0).codecs);
+-    TSUNIT_EQUAL(u"", pl.playList(0).hdcp);
+-    TSUNIT_EQUAL(u"", pl.playList(0).video_range);
+-    TSUNIT_EQUAL(u"", pl.playList(0).video);
+-    TSUNIT_EQUAL(u"aud1", pl.playList(0).audio);
+-    TSUNIT_EQUAL(u"sub1", pl.playList(0).subtitles);
+-    TSUNIT_EQUAL(u"cc1", pl.playList(0).closed_captions);
+-    TSUNIT_EQUAL(u"v5/prog_index.m3u8, 960x540, 2,227,464 b/s, @60 fps", pl.playList(0).toString());
+-
+-    TSUNIT_EQUAL(u"v2/prog_index.m3u8", pl.playList(23).relative_uri);
+-    TSUNIT_EQUAL(582387, pl.playList(23).bandwidth.toInt());
+-    TSUNIT_EQUAL(570616, pl.playList(23).average_bandwidth.toInt());
+-    TSUNIT_EQUAL(480, pl.playList(23).width);
+-    TSUNIT_EQUAL(270, pl.playList(23).height);
+-    TSUNIT_EQUAL(30000, pl.playList(23).frame_rate);
+-    TSUNIT_EQUAL(u"avc1.640015,ec-3", pl.playList(23).codecs);
+-    TSUNIT_EQUAL(u"", pl.playList(23).hdcp);
+-    TSUNIT_EQUAL(u"", pl.playList(23).video_range);
+-    TSUNIT_EQUAL(u"", pl.playList(23).video);
+-    TSUNIT_EQUAL(u"aud3", pl.playList(23).audio);
+-    TSUNIT_EQUAL(u"sub1", pl.playList(23).subtitles);
+-    TSUNIT_EQUAL(u"cc1", pl.playList(23).closed_captions);
+-    TSUNIT_EQUAL(u"v2/prog_index.m3u8, 480x270, 582,387 b/s, @30 fps", pl.playList(23).toString());
+-
+-    TSUNIT_EQUAL(0, pl.selectPlayList(0, 0, 0, 0, 0, 0));
+-    TSUNIT_EQUAL(ts::NPOS, pl.selectPlayList(10000000, 0, 0, 0, 0, 0));
+-    TSUNIT_EQUAL(9, pl.selectPlayListHighestBitRate());
+-    TSUNIT_EQUAL(7, pl.selectPlayListLowestBitRate());
+-    TSUNIT_EQUAL(1, pl.selectPlayListHighestResolution());
+-    TSUNIT_EQUAL(7, pl.selectPlayListLowestResolution());
+-}
+-
+-TSUNIT_DEFINE_TEST(MasterPlaylistWithAlternate)
+-{
+-    // Test file downloaded from TSDuck web site.
+-
+-    ts::hls::PlayList pl;
+-    TSUNIT_ASSERT(pl.loadURL(u"https://tsduck.io/download/test/hls/alternative/index_hd.m3u8", true));
+-    TSUNIT_ASSERT(pl.isValid());
+-    TSUNIT_EQUAL(ts::hls::PlayListType::MASTER, pl.type());
+-    TSUNIT_EQUAL(4, pl.version());
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/alternative/index_hd.m3u8", pl.url());
+-    TSUNIT_EQUAL(0, pl.segmentCount());
+-    TSUNIT_EQUAL(7, pl.playListCount());
+-    TSUNIT_EQUAL(2, pl.altPlayListCount());
+-    TSUNIT_EQUAL(0, pl.targetDuration().count());
+-    TSUNIT_EQUAL(0, pl.mediaSequence());
+-    TSUNIT_ASSERT(!pl.endList());
+-    TSUNIT_EQUAL(ts::hls::PlayListType::MASTER, pl.type());
+-
+-    TSUNIT_EQUAL(u"04_hd.m3u8", pl.playList(0).relative_uri);
+-    TSUNIT_EQUAL(1209781, pl.playList(0).bandwidth.toInt());
+-    TSUNIT_EQUAL(768, pl.playList(0).width);
+-    TSUNIT_EQUAL(432, pl.playList(0).height);
+-    TSUNIT_EQUAL(25000, pl.playList(0).frame_rate);
+-    TSUNIT_EQUAL(u"avc1.4D4020,mp4a.40.2", pl.playList(0).codecs);
+-    TSUNIT_EQUAL(u"", pl.playList(0).hdcp);
+-    TSUNIT_EQUAL(u"", pl.playList(0).video_range);
+-    TSUNIT_EQUAL(u"", pl.playList(0).video);
+-    TSUNIT_EQUAL(u"audio2", pl.playList(0).audio);
+-    TSUNIT_EQUAL(u"", pl.playList(0).subtitles);
+-    TSUNIT_EQUAL(u"", pl.playList(0).closed_captions);
+-    TSUNIT_EQUAL(u"04_hd.m3u8, 768x432, 1,209,781 b/s, @25 fps", pl.playList(0).toString());
+-
+-    TSUNIT_EQUAL(u"09_hd.m3u8", pl.altPlayList(0).relative_uri);
+-    TSUNIT_EQUAL(u"AUDIO", pl.altPlayList(0).type);
+-    TSUNIT_EQUAL(u"audio2", pl.altPlayList(0).group_id);
+-    TSUNIT_EQUAL(u"ENG", pl.altPlayList(0).name);
+-    TSUNIT_EQUAL(u"ENG", pl.altPlayList(0).language);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(0).stable_rendition_id);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(0).assoc_language);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(0).in_stream_id);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(0).characteristics);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(0).channels);
+-    TSUNIT_ASSERT(pl.altPlayList(0).is_default);
+-    TSUNIT_ASSERT(pl.altPlayList(0).auto_select);
+-    TSUNIT_ASSERT(!pl.altPlayList(0).forced);
+-
+-    TSUNIT_EQUAL(u"01_hd.m3u8", pl.altPlayList(1).relative_uri);
+-    TSUNIT_EQUAL(u"AUDIO", pl.altPlayList(1).type);
+-    TSUNIT_EQUAL(u"audio1", pl.altPlayList(1).group_id);
+-    TSUNIT_EQUAL(u"FOO", pl.altPlayList(1).name);
+-    TSUNIT_EQUAL(u"FOO", pl.altPlayList(1).language);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(1).stable_rendition_id);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(1).assoc_language);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(1).in_stream_id);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(1).characteristics);
+-    TSUNIT_EQUAL(u"", pl.altPlayList(1).channels);
+-    TSUNIT_ASSERT(!pl.altPlayList(1).is_default);
+-    TSUNIT_ASSERT(!pl.altPlayList(1).auto_select);
+-    TSUNIT_ASSERT(!pl.altPlayList(1).forced);
+-}
+-
+-TSUNIT_DEFINE_TEST(MediaPlaylist)
+-{
+-    // Test file downloaded from TSDuck web site.
+-    // Copied from Apple test file at
+-    // https://devstreaming-cdn.apple.com/videos/streaming/examples/img_bipbop_adv_example_ts/v5/prog_index.m3u8
+-
+-    ts::hls::PlayList pl;
+-    TSUNIT_ASSERT(pl.loadURL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/v5/prog_index.m3u8", true));
+-    TSUNIT_ASSERT(pl.isValid());
+-    TSUNIT_EQUAL(ts::hls::PlayListType::VOD, pl.type());
+-    TSUNIT_EQUAL(3, pl.version());
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/v5/prog_index.m3u8", pl.url());
+-    ts::hls::MediaElement media;
+-    pl.buildURL(media, u"foo.bar");
+-    TSUNIT_EQUAL(u"https://tsduck.io/download/test/hls/img_bipbop_adv_example_ts/v5/foo.bar", media.urlString());
+-    TSUNIT_EQUAL(100, pl.segmentCount());
+-    TSUNIT_EQUAL(0, pl.playListCount());
+-    TSUNIT_EQUAL(0, pl.altPlayListCount());
+-    TSUNIT_EQUAL(6, pl.targetDuration().count());
+-    TSUNIT_EQUAL(0, pl.mediaSequence());
+-    TSUNIT_ASSERT(pl.endList());
+-
+-    TSUNIT_EQUAL(u"fileSequence0.ts", pl.segment(0).relative_uri);
+-    TSUNIT_EQUAL(u"", pl.segment(0).title);
+-    TSUNIT_EQUAL(2060 * 1024, pl.segment(0).bitrate.toInt());
+-    TSUNIT_EQUAL(6000, pl.segment(0).duration.count());
+-    TSUNIT_ASSERT(!pl.segment(0).gap);
+-
+-    TSUNIT_EQUAL(u"fileSequence99.ts", pl.segment(99).relative_uri);
+-    TSUNIT_EQUAL(u"", pl.segment(99).title);
+-    TSUNIT_EQUAL(2055 * 1024, pl.segment(99).bitrate.toInt());
+-    TSUNIT_EQUAL(6000, pl.segment(99).duration.count());
+-    TSUNIT_ASSERT(!pl.segment(99).gap);
+-
+-    ts::hls::MediaSegment seg;
+-    TSUNIT_ASSERT(pl.popFirstSegment(seg));
+-    TSUNIT_EQUAL(99, pl.segmentCount());
+-
+-    TSUNIT_EQUAL(u"fileSequence0.ts", seg.relative_uri);
+-    TSUNIT_EQUAL(u"", seg.title);
+-    TSUNIT_EQUAL(2060 * 1024, seg.bitrate.toInt());
+-    TSUNIT_EQUAL(6000, seg.duration.count());
+-    TSUNIT_ASSERT(!seg.gap);
+-}
+-
+ TSUNIT_DEFINE_TEST(BuildMasterPlaylist)
+ {
+     ts::hls::PlayList pl;
+diff --git a/src/utest/utestNetworking.cpp b/src/utest/utestNetworking.cpp
+index 058d5eb4c..67e5610d5 100644
+--- a/src/utest/utestNetworking.cpp
++++ b/src/utest/utestNetworking.cpp
+@@ -33,19 +33,13 @@
+ class NetworkingTest: public tsunit::Test
+ {
+     TSUNIT_DECLARE_TEST(SystemStructures);
+-    TSUNIT_DECLARE_TEST(IPv4AddressConstructors);
+-    TSUNIT_DECLARE_TEST(IPv4Address);
+-    TSUNIT_DECLARE_TEST(IPv6Address);
+     TSUNIT_DECLARE_TEST(Conversion);
+     TSUNIT_DECLARE_TEST(IPAddressMask);
+     TSUNIT_DECLARE_TEST(MACAddress);
+     TSUNIT_DECLARE_TEST(LocalHost);
+     TSUNIT_DECLARE_TEST(GetLocalIPAddresses);
+-    TSUNIT_DECLARE_TEST(IPv4SocketAddressConstructors);
+     TSUNIT_DECLARE_TEST(IPv4SocketAddress);
+     TSUNIT_DECLARE_TEST(IPv6SocketAddress);
+-    TSUNIT_DECLARE_TEST(TCPSocket);
+-    TSUNIT_DECLARE_TEST(UDPSocket);
+     TSUNIT_DECLARE_TEST(IPHeader);
+     TSUNIT_DECLARE_TEST(IPProtocol);
+     TSUNIT_DECLARE_TEST(TCPPacket);
+@@ -96,183 +90,6 @@ TSUNIT_DEFINE_TEST(SystemStructures)
+             << "NetworkingTest::SystemStructures: sizeof(::sockaddr_storage) = " << sizeof(::sockaddr_storage) << std::endl;
+ }
+ 
+-TSUNIT_DEFINE_TEST(IPv4AddressConstructors)
+-{
+-    TSUNIT_ASSERT(ts::IPInitialize());
+-
+-    TSUNIT_EQUAL(0, ts::IPAddress::AnyAddress4.address4());
+-    TSUNIT_EQUAL(0x7F000001, ts::IPAddress::LocalHost4.address4()); // 127.0.0.1
+-
+-    ts::IPAddress a1;
+-    TSUNIT_EQUAL(0, a1.address4());
+-
+-    ts::IPAddress a2(0x01020304);
+-    TSUNIT_EQUAL(0x01020304, a2.address4());
+-
+-    ts::IPAddress a3(1, 2, 3, 4);
+-    TSUNIT_EQUAL(0x01020304, a3.address4());
+-
+-    ::in_addr ia4;
+-    ia4.s_addr = htonl(0x01020304);
+-    ts::IPAddress a4(ia4);
+-    TSUNIT_EQUAL(0x01020304, a4.address4());
+-
+-    ::sockaddr sa5;
+-    TSUNIT_ASSERT(sizeof(::sockaddr) >= sizeof(::sockaddr_in));
+-    ::sockaddr_in* sai5 = reinterpret_cast<::sockaddr_in*>(&sa5);
+-    sai5->sin_family = AF_INET;
+-    sai5->sin_addr.s_addr = htonl(0x01020304);
+-    sai5->sin_port = 0;
+-    ts::IPAddress a5 (sa5);
+-    TSUNIT_EQUAL(0x01020304, a5.address4());
+-
+-    ::sockaddr_in sa6;
+-    sa6.sin_family = AF_INET;
+-    sa6.sin_addr.s_addr = htonl(0x01020304);
+-    sa6.sin_port = 0;
+-    ts::IPAddress a6 (sa6);
+-    TSUNIT_EQUAL(0x01020304, a6.address4());
+-
+-    ts::IPAddress a7(u"2.3.4.5", CERR);
+-    TSUNIT_EQUAL(0x02030405, a7.address4());
+-}
+-
+-TSUNIT_DEFINE_TEST(IPv4Address)
+-{
+-    TSUNIT_ASSERT(ts::IPInitialize());
+-
+-    ts::IPAddress a1 (1, 2, 3, 4);
+-    ts::IPAddress a2 (1, 2, 3, 4);
+-    ts::IPAddress a3 (2, 3, 4, 5);
+-
+-    TSUNIT_EQUAL(u"IPv4", a1.familyName());
+-    TSUNIT_ASSERT(a1 == a2);
+-    TSUNIT_ASSERT(a1 != a3);
+-
+-    a1.setAddress4(0x02030405);
+-    TSUNIT_ASSERT(a1 == a3);
+-
+-    a1.setAddress4(1, 2, 3, 4);
+-    TSUNIT_ASSERT(a1 == a2);
+-
+-    a2.setAddress4(224, 1, 2, 3);
+-    TSUNIT_ASSERT(!a1.isMulticast());
+-    TSUNIT_ASSERT(a2.isMulticast());
+-
+-    TSUNIT_ASSERT(a1.hasAddress());
+-    a1.clear();
+-    TSUNIT_ASSERT(!a1.hasAddress());
+-    TSUNIT_EQUAL(0, a1.address4());
+-
+-    a1.setAddress4(1, 2, 3, 4);
+-    ::in_addr ia;
+-    a1.getAddress4(ia);
+-    TSUNIT_EQUAL(htonl(0x01020304), ia.s_addr);
+-
+-    ::sockaddr_storage sa;
+-    TSUNIT_EQUAL(sizeof(::sockaddr_in), a1.getAddress(sa, 80));
+-    const ::sockaddr_in* saip = reinterpret_cast<const ::sockaddr_in*>(&sa);
+-    TSUNIT_EQUAL(AF_INET, saip->sin_family);
+-    TSUNIT_EQUAL(htonl(0x01020304), saip->sin_addr.s_addr);
+-    TSUNIT_EQUAL(htons(80), saip->sin_port);
+-
+-    ::sockaddr_in sai;
+-    a1.getAddress4(sai, 80);
+-    TSUNIT_EQUAL(AF_INET, sai.sin_family);
+-    TSUNIT_EQUAL(htonl(0x01020304), sai.sin_addr.s_addr);
+-    TSUNIT_EQUAL(htons(80), sai.sin_port);
+-
+-    TSUNIT_ASSERT(a1.resolve(u"2.3.4.5", CERR));
+-    TSUNIT_EQUAL(0x02030405, a1.address4());
+-
+-    a1.setAddress4(2, 3, 4, 5);
+-    const ts::UString s1(a1.toString());
+-    TSUNIT_EQUAL(u"2.3.4.5", s1);
+-
+-    // Note: fail if not connected to a network.
+-    debug() << "NetworkingTest: www.google.com = " << ts::IPAddress(u"www.google.com", CERR) << std::endl;
+-}
+-
+-TSUNIT_DEFINE_TEST(IPv6Address)
+-{
+-    ts::IPAddress a1(ts::IPAddress::AnyAddress6);
+-    TSUNIT_EQUAL(u"IPv6", a1.familyName());
+-    TSUNIT_EQUAL(ts::IP::v6, a1.generation());
+-    TSUNIT_ASSERT(!a1.hasAddress());
+-    TSUNIT_ASSERT(!a1.isMulticast());
+-
+-    TSUNIT_ASSERT(!ts::IPAddress::AnyAddress6.hasAddress());
+-    TSUNIT_ASSERT(ts::IPAddress::LocalHost6.hasAddress());
+-    TSUNIT_EQUAL(0, ts::IPAddress::LocalHost6.networkPrefix6());
+-    TSUNIT_EQUAL(1, ts::IPAddress::LocalHost6.interfaceIdentifier6());
+-
+-    TSUNIT_ASSERT(!a1.resolve(u":", NULLREP));
+-    TSUNIT_ASSERT(!a1.hasAddress());
+-
+-    TSUNIT_ASSERT(a1.resolve(u"::", CERR));
+-    TSUNIT_ASSERT(!a1.hasAddress());
+-    TSUNIT_ASSERT(a1 == ts::IPAddress::AnyAddress6);
+-
+-    TSUNIT_ASSERT(a1.resolve(u"::1", CERR));
+-    TSUNIT_ASSERT(a1.hasAddress());
+-    TSUNIT_ASSERT(a1 == ts::IPAddress::LocalHost6);
+-
+-    TSUNIT_ASSERT(!a1.resolve(u"", NULLREP));
+-    TSUNIT_ASSERT(!a1.hasAddress());
+-
+-    a1.setAddress6(0, 1, 2, 3, 4, 5, 6, 7);
+-    TSUNIT_ASSERT(a1.hasAddress());
+-    TSUNIT_ASSERT(!a1.isIPv4Mapped());
+-    TSUNIT_EQUAL(0x0000000100020003, a1.networkPrefix6());
+-    TSUNIT_EQUAL(0x0004000500060007, a1.interfaceIdentifier6());
+-    TSUNIT_EQUAL(u"0:1:2:3:4:5:6:7", a1.toString());
+-    TSUNIT_EQUAL(u"0000:0001:0002:0003:0004:0005:0006:0007", a1.toFullString());
+-
+-    a1.setAddress6(0x12, 0x345, 0x6789, 0xFFFF, 0, 0, 0, 0xBEEF);
+-    TSUNIT_ASSERT(a1.hasAddress());
+-    TSUNIT_ASSERT(!a1.isIPv4Mapped());
+-    TSUNIT_EQUAL(0x001203456789FFFF, a1.networkPrefix6());
+-    TSUNIT_EQUAL(0x000000000000BEEF, a1.interfaceIdentifier6());
+-    TSUNIT_EQUAL(u"12:345:6789:ffff::beef", a1.toString());
+-    TSUNIT_EQUAL(u"0012:0345:6789:ffff:0000:0000:0000:beef", a1.toFullString());
+-
+-    TSUNIT_ASSERT(a1.resolve(u"fe80::93a3:dea0:2108:b81e", CERR));
+-    TSUNIT_ASSERT(a1.hasAddress());
+-    TSUNIT_ASSERT(!a1.isIPv4Mapped());
+-    TSUNIT_EQUAL(0xFE80000000000000, a1.networkPrefix6());
+-    TSUNIT_EQUAL(0x93A3DEA02108B81E, a1.interfaceIdentifier6());
+-    TSUNIT_EQUAL(u"fe80::93a3:dea0:2108:b81e", a1.toString());
+-    TSUNIT_EQUAL(u"fe80:0000:0000:0000:93a3:dea0:2108:b81e", a1.toFullString());
+-
+-    TSUNIT_ASSERT(a1.convert(ts::IP::Any));
+-    TSUNIT_ASSERT(a1.convert(ts::IP::v6));
+-    TSUNIT_ASSERT(!a1.convert(ts::IP::v4));
+-    TSUNIT_EQUAL(u"IPv6", a1.familyName());
+-    TSUNIT_EQUAL(ts::IP::v6, a1.generation());
+-
+-    ts::IPAddress a2;
+-    TSUNIT_ASSERT(a2.resolve(u"0:0::ffff:12.13.14.15", CERR));
+-    TSUNIT_ASSERT(a2.hasAddress());
+-    TSUNIT_EQUAL(u"IPv6", a2.familyName());
+-    TSUNIT_EQUAL(ts::IP::v6, a2.generation());
+-    TSUNIT_ASSERT(a2.isIPv4Mapped());
+-    TSUNIT_EQUAL(0x0000000000000000, a2.networkPrefix6());
+-    TSUNIT_EQUAL(0x0000FFFF0C0D0E0F, a2.interfaceIdentifier6());
+-    TSUNIT_EQUAL(u"::ffff:12.13.14.15", a2.toString());
+-    TSUNIT_EQUAL(u"0000:0000:0000:0000:0000:ffff:0c0d:0e0f", a2.toFullString());
+-
+-    TSUNIT_ASSERT(a2.convert(ts::IP::Any));
+-    TSUNIT_ASSERT(a2.convert(ts::IP::v6));
+-    TSUNIT_ASSERT(a2.convert(ts::IP::v4));
+-
+-    TSUNIT_ASSERT(a2.hasAddress());
+-    TSUNIT_EQUAL(u"IPv4", a2.familyName());
+-    TSUNIT_EQUAL(ts::IP::v4, a2.generation());
+-    TSUNIT_EQUAL(u"12.13.14.15", a2.toString());
+-    TSUNIT_EQUAL(u"12.13.14.15", a2.toFullString());
+-    TSUNIT_EQUAL(0x0C0D0E0F, a2.address4());
+-}
+-
+ TSUNIT_DEFINE_TEST(Conversion)
+ {
+     ts::IPAddress a1(0x12345678);
+@@ -437,101 +254,6 @@ TSUNIT_DEFINE_TEST(GetLocalIPAddresses)
+     }
+ }
+ 
+-TSUNIT_DEFINE_TEST(IPv4SocketAddressConstructors)
+-{
+-    TSUNIT_ASSERT(ts::IPInitialize());
+-
+-    TSUNIT_EQUAL(0, ts::IPSocketAddress::AnyAddress4.address4());
+-    TSUNIT_EQUAL(0x7F000001, ts::IPSocketAddress::LocalHost4.address4()); // 127.0.0.1
+-
+-    ts::IPSocketAddress a1;
+-    TSUNIT_EQUAL(0, a1.address4());
+-    TSUNIT_EQUAL(0, a1.port());
+-
+-    ts::IPSocketAddress a2a (ts::IPAddress(0x01020304), 80);
+-    TSUNIT_EQUAL(0x01020304, a2a.address4());
+-    TSUNIT_EQUAL(80, a2a.port());
+-
+-    ts::IPSocketAddress a2b(0x01020304, 80);
+-    TSUNIT_EQUAL(0x01020304, a2b.address4());
+-    TSUNIT_EQUAL(80, a2b.port());
+-
+-    ts::IPSocketAddress a3(1, 2, 3, 4, 80);
+-    TSUNIT_EQUAL(0x01020304, a3.address4());
+-    TSUNIT_EQUAL(80, a3.port());
+-
+-    ::in_addr ia4;
+-    ia4.s_addr = htonl(0x01020304);
+-    ts::IPSocketAddress a4(ia4, 80);
+-    TSUNIT_EQUAL(0x01020304, a4.address4());
+-    TSUNIT_EQUAL(80, a4.port());
+-
+-    ::sockaddr sa5;
+-    TSUNIT_ASSERT(sizeof(::sockaddr) >= sizeof(::sockaddr_in));
+-    ::sockaddr_in* sai5 = reinterpret_cast<::sockaddr_in*>(&sa5);
+-    sai5->sin_family = AF_INET;
+-    sai5->sin_addr.s_addr = htonl(0x01020304);
+-    sai5->sin_port = htons (80);
+-    ts::IPSocketAddress a5 (sa5);
+-    TSUNIT_EQUAL(0x01020304, a5.address4());
+-    TSUNIT_EQUAL(80, a5.port());
+-
+-    ::sockaddr_in sa6;
+-    sa6.sin_family = AF_INET;
+-    sa6.sin_addr.s_addr = htonl(0x01020304);
+-    sa6.sin_port = htons(80);
+-    ts::IPSocketAddress a6(sa6);
+-    TSUNIT_EQUAL(0x01020304, a6.address4());
+-    TSUNIT_EQUAL(80, a6.port());
+-
+-    ts::IPSocketAddress a7(u"2.3.4.5", CERR);
+-    TSUNIT_EQUAL(0x02030405, a7.address4());
+-    TSUNIT_EQUAL(ts::IPSocketAddress::AnyPort, a7.port());
+-
+-    // Some hosts can return localhost in IPv4 or IPv6.
+-    ts::IPSocketAddress a8(u"localhost", CERR);
+-    if (a8.generation() == ts::IP::v6) {
+-        TSUNIT_EQUAL(0, a8.hexlet6(0));
+-        TSUNIT_EQUAL(0, a8.hexlet6(1));
+-        TSUNIT_EQUAL(0, a8.hexlet6(2));
+-        TSUNIT_EQUAL(0, a8.hexlet6(3));
+-        TSUNIT_EQUAL(0, a8.hexlet6(4));
+-        TSUNIT_EQUAL(0, a8.hexlet6(5));
+-        TSUNIT_EQUAL(0, a8.hexlet6(8));
+-        TSUNIT_EQUAL(1, a8.hexlet6(7));
+-        TSUNIT_ASSERT(ts::IPAddress(a8) == ts::IPAddress::LocalHost6);
+-    }
+-    else {
+-        TSUNIT_EQUAL(0x7F000001, a8.address4()); // 127.0.0.1
+-        TSUNIT_ASSERT(ts::IPAddress(a8) == ts::IPAddress::LocalHost4);
+-    }
+-    TSUNIT_EQUAL(ts::IPSocketAddress::AnyPort, a8.port());
+-
+-    ts::IPSocketAddress a9(u"2.3.4.5:80", CERR);
+-    TSUNIT_EQUAL(0x02030405, a9.address4());
+-    TSUNIT_EQUAL(80, a9.port());
+-
+-    ts::IPSocketAddress a10(u":80", CERR);
+-    TSUNIT_EQUAL(0, a10.address4());
+-    TSUNIT_EQUAL(80, a10.port());
+-
+-    ts::IPSocketAddress a11(u"83", CERR);
+-    TSUNIT_EQUAL(0, a11.address4());
+-    TSUNIT_EQUAL(83, a11.port());
+-
+-    ts::IPSocketAddress a12(u"2.3.4.5:", CERR);
+-    TSUNIT_EQUAL(0x02030405, a12.address4());
+-    TSUNIT_EQUAL(0, a12.port());
+-
+-    ts::IPSocketAddress a13(u":", CERR);
+-    TSUNIT_EQUAL(0, a13.address4());
+-    TSUNIT_EQUAL(0, a13.port());
+-
+-    ts::IPSocketAddress a14(u"", CERR);
+-    TSUNIT_EQUAL(0, a14.address4());
+-    TSUNIT_EQUAL(0, a14.port());
+-}
+-
+ TSUNIT_DEFINE_TEST(IPv4SocketAddress)
+ {
+     TSUNIT_ASSERT(ts::IPInitialize());
+@@ -739,56 +461,6 @@ namespace {
+     };
+ }
+ 
+-// Test cases
+-TSUNIT_DEFINE_TEST(TCPSocket)
+-{
+-    TSUNIT_ASSERT(ts::IPInitialize());
+-
+-    const uint16_t portNumber = 12345;
+-
+-    // Create server socket
+-    CERR.debug(u"TCPSocketTest: main thread: create server");
+-    const ts::IPSocketAddress serverAddress(ts::IPAddress::LocalHost4, portNumber);
+-    ts::TCPServer server;
+-    TSUNIT_ASSERT(!server.isOpen());
+-    TSUNIT_ASSERT(server.open(ts::IP::v4, CERR));
+-    TSUNIT_ASSERT(server.isOpen());
+-    TSUNIT_ASSERT(server.reusePort(true, CERR));
+-    TSUNIT_ASSERT(server.setSendBufferSize(1024, CERR));
+-    TSUNIT_ASSERT(server.setReceiveBufferSize(1024, CERR));
+-    TSUNIT_ASSERT(server.setTTL(1, CERR));
+-    TSUNIT_ASSERT(server.bind(serverAddress, CERR));
+-    TSUNIT_ASSERT(server.listen(5, CERR));
+-
+-    CERR.debug(u"TCPSocketTest: main thread: starting client thread");
+-    TCPClient client(portNumber);
+-    client.start();
+-
+-    CERR.debug(u"TCPSocketTest: main thread: waiting for a client");
+-    ts::TCPConnection session;
+-    ts::IPSocketAddress clientAddress;
+-    TSUNIT_ASSERT(server.accept(session, clientAddress, CERR));
+-    CERR.debug(u"TCPSocketTest: main thread: got a client");
+-    TSUNIT_ASSERT(ts::IPAddress(clientAddress) == ts::IPAddress::LocalHost4);
+-
+-    CERR.debug(u"TCPSocketTest: main thread: waiting for data");
+-    ts::IPSocketAddress sender;
+-    char buffer [1024];
+-    size_t size = 0;
+-    while (session.receive(buffer, sizeof(buffer), size, nullptr, CERR)) {
+-        CERR.debug(u"TCPSocketTest: main thread: data received, %d bytes", size);
+-        TSUNIT_ASSERT(session.send(buffer, size, CERR));
+-        CERR.debug(u"TCPSocketTest: main thread: data sent back");
+-    }
+-
+-    CERR.debug(u"TCPSocketTest: main thread: end of client session");
+-    session.disconnect(CERR);
+-    session.close(CERR);
+-    TSUNIT_ASSERT(server.close(CERR));
+-
+-    CERR.debug(u"TCPSocketTest: main thread: terminated");
+-}
+-
+ // A thread class which sends one UDP message and wait from the same message to be replied.
+ namespace {
+     class UDPClient: public utest::TSUnitThread
+@@ -848,41 +520,6 @@ namespace {
+     };
+ }
+ 
+-// Test cases
+-TSUNIT_DEFINE_TEST(UDPSocket)
+-{
+-    TSUNIT_ASSERT(ts::IPInitialize());
+-
+-    const uint16_t portNumber = 12345;
+-
+-    // Create server socket
+-    ts::UDPSocket sock;
+-    TSUNIT_ASSERT(!sock.isOpen());
+-    TSUNIT_ASSERT(sock.open(ts::IP::v4, CERR));
+-    TSUNIT_ASSERT(sock.isOpen());
+-    TSUNIT_ASSERT(sock.setSendBufferSize(1024, CERR));
+-    TSUNIT_ASSERT(sock.setReceiveBufferSize(1024, CERR));
+-    TSUNIT_ASSERT(sock.reusePort(true, CERR));
+-    TSUNIT_ASSERT(sock.setTTL(1, false, CERR));
+-    TSUNIT_ASSERT(sock.bind(ts::IPSocketAddress(ts::IPAddress::LocalHost4, portNumber), CERR));
+-
+-    CERR.debug(u"UDPSocketTest: main thread: starting client thread");
+-    UDPClient client(portNumber);
+-    client.start();
+-
+-    CERR.debug(u"UDPSocketTest: main thread: waiting for message");
+-    ts::IPSocketAddress sender;
+-    ts::IPSocketAddress destination;
+-    char buffer [1024];
+-    size_t size;
+-    TSUNIT_ASSERT(sock.receive(buffer, sizeof(buffer), size, sender, destination, nullptr, CERR));
+-    CERR.debug(u"UDPSocketTest: main thread: request received, %d bytes, sender: %s, destination: %s", size, sender, destination);
+-    TSUNIT_ASSERT(ts::IPAddress(sender) == ts::IPAddress::LocalHost4);
+-
+-    TSUNIT_ASSERT(sock.send(buffer, size, sender, CERR));
+-    CERR.debug(u"UDPSocketTest: main thread: reply sent");
+-}
+-
+ TSUNIT_DEFINE_TEST(IPHeader)
+ {
+     static const uint8_t reference_header[] = {
+diff --git a/src/utest/utestSysUtils.cpp b/src/utest/utestSysUtils.cpp
+index e3434d45b..a609e05c7 100644
+--- a/src/utest/utestSysUtils.cpp
++++ b/src/utest/utestSysUtils.cpp
+@@ -48,7 +48,6 @@ class SysUtilsTest: public tsunit::Test
+     TSUNIT_DECLARE_TEST(FileTime);
+     TSUNIT_DECLARE_TEST(Wildcard);
+     TSUNIT_DECLARE_TEST(SearchWildcard);
+-    TSUNIT_DECLARE_TEST(HomeDirectory);
+     TSUNIT_DECLARE_TEST(ProcessCpuTime);
+     TSUNIT_DECLARE_TEST(ProcessVirtualSize);
+     TSUNIT_DECLARE_TEST(IsTerminal);
+@@ -567,16 +566,6 @@ TSUNIT_DEFINE_TEST(SearchWildcard)
+ #endif
+ }
+ 
+-TSUNIT_DEFINE_TEST(HomeDirectory)
+-{
+-    const ts::UString dir(ts::UserHomeDirectory());
+-    debug() << "SysUtilsTest: UserHomeDirectory() = \"" << dir << "\"" << std::endl;
+-
+-    TSUNIT_ASSERT(!dir.empty());
+-    TSUNIT_ASSERT(fs::exists(dir));
+-    TSUNIT_ASSERT(fs::is_directory(dir));
+-}
+-
+ TSUNIT_DEFINE_TEST(ProcessCpuTime)
+ {
+     const cn::milliseconds t1 = ts::GetProcessCpuTime();
+diff --git a/src/utest/utestSystemRandomGenerator.cpp b/src/utest/utestSystemRandomGenerator.cpp
+index 0d7ff13dd..7e9d5b6ef 100644
+--- a/src/utest/utestSystemRandomGenerator.cpp
++++ b/src/utest/utestSystemRandomGenerator.cpp
+@@ -23,7 +23,6 @@
+ class SystemRandomGeneratorTest: public tsunit::Test
+ {
+     TSUNIT_DECLARE_TEST(SystemRandomGenerator);
+-    TSUNIT_DECLARE_TEST(BetterSystemRandomGenerator);
+     TSUNIT_DECLARE_TEST(Range);
+ 
+ private:
+@@ -87,11 +86,6 @@ TSUNIT_DEFINE_TEST(SystemRandomGenerator)
+     testRandom(gen);
+ }
+ 
+-TSUNIT_DEFINE_TEST(BetterSystemRandomGenerator)
+-{
+-    testRandom(ts::BetterSystemRandomGenerator::Instance());
+-}
+-
+ void SystemRandomGeneratorTest::testRandomRange(ts::RandomGenerator& prng, int64_t min, int64_t max)
+ {
+     TSUNIT_ASSERT(prng.ready());
+diff --git a/src/utest/utestWebRequest.cpp b/src/utest/utestWebRequest.cpp
+index d496c8eca..a691910ca 100644
+--- a/src/utest/utestWebRequest.cpp
++++ b/src/utest/utestWebRequest.cpp
+@@ -28,10 +28,6 @@
+ 
+ class WebRequestTest: public tsunit::Test
+ {
+-    TSUNIT_DECLARE_TEST(GitHub);
+-    TSUNIT_DECLARE_TEST(Google);
+-    TSUNIT_DECLARE_TEST(ReadMeFile);
+-    TSUNIT_DECLARE_TEST(NoRedirection);
+     TSUNIT_DECLARE_TEST(NonExistentHost);
+     TSUNIT_DECLARE_TEST(InvalidURL);
+ 
+@@ -89,7 +85,6 @@ void WebRequestTest::testURL(const ts::UString& url, bool expectRedirection, boo
+ 
+     // Test binary download
+     ts::ByteBlock data;
+-    TSUNIT_ASSERT(request.downloadBinaryContent(url, data));
+ 
+     debug() << "WebRequestTest::testURL:" << std::endl
+             << "    Original URL: " << request.originalURL() << std::endl
+@@ -155,59 +150,12 @@ void WebRequestTest::testURL(const ts::UString& url, bool expectRedirection, boo
+ // Test cases
+ //----------------------------------------------------------------------------
+ 
+-TSUNIT_DEFINE_TEST(GitHub)
+-{
+-    testURL(u"http://www.github.com/",
+-            true,     // expectRedirection
+-            true,     // expectSSL
+-            true,     // expectTextContent
+-            false);   // expectInvariant
+-}
+-
+-TSUNIT_DEFINE_TEST(Google)
+-{
+-    testURL(u"http://www.google.com/",
+-            false,    // expectRedirection
+-            false,    // expectSSL
+-            true,     // expectTextContent
+-            false);   // expectInvariant
+-}
+-
+-TSUNIT_DEFINE_TEST(ReadMeFile)
+-{
+-    testURL(u"https://raw.githubusercontent.com/tsduck/tsduck/master/README.md",
+-            false,    // expectRedirection
+-            true,     // expectSSL
+-            true,     // expectTextContent
+-            true);    // expectInvariant
+-}
+-
+-TSUNIT_DEFINE_TEST(NoRedirection)
+-{
+-    ts::WebRequest request(report());
+-    request.setAutoRedirect(false);
+-
+-    ts::ByteBlock data;
+-    TSUNIT_ASSERT(request.downloadBinaryContent(u"http://www.github.com/", data));
+-
+-    debug() << "WebRequestTest::testNoRedirection:" << std::endl
+-            << "    Original URL: " << request.originalURL() << std::endl
+-            << "    Final URL: " << request.finalURL() << std::endl
+-            << "    HTTP status: " << request.httpStatus() << std::endl
+-            << "    Content size: " << request.contentSize() << std::endl;
+-
+-    TSUNIT_EQUAL(3, request.httpStatus() / 100);
+-    TSUNIT_ASSERT(!request.finalURL().empty());
+-    TSUNIT_ASSERT(request.finalURL() != request.originalURL());
+-}
+-
+ TSUNIT_DEFINE_TEST(NonExistentHost)
+ {
+     ts::ReportBuffer<ts::ThreadSafety::None> rep;
+     ts::WebRequest request(rep);
+ 
+     ts::ByteBlock data;
+-    TSUNIT_ASSERT(!request.downloadBinaryContent(u"http://non.existent.fake-domain/", data));
+ 
+     debug() << "WebRequestTest::testNonExistentHost: " << rep.messages() << std::endl;
+ }
+@@ -218,7 +166,6 @@ TSUNIT_DEFINE_TEST(InvalidURL)
+     ts::WebRequest request(rep);
+ 
+     ts::ByteBlock data;
+-    TSUNIT_ASSERT(!request.downloadBinaryContent(u"pouette://tagada/tsoin/tsoin", data));
+ 
+     debug() << "WebRequestTest::testInvalidURL: " << rep.messages() << std::endl;
+ }
diff --git a/pkgs/by-name/tu/tuba/package.nix b/pkgs/by-name/tu/tuba/package.nix
index 93ff59a89383..d3f9e53b1c2e 100644
--- a/pkgs/by-name/tu/tuba/package.nix
+++ b/pkgs/by-name/tu/tuba/package.nix
@@ -27,7 +27,7 @@
   webp-pixbuf-loader,
   icu,
   gst_all_1,
-  clapper,
+  clapper-unwrapped,
   # clapper support is still experimental and has bugs.
   # See https://github.com/GeopJr/Tuba/pull/931
   clapperSupport ? false,
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
       gst-plugins-bad
     ])
     ++ lib.optionals clapperSupport [
-      clapper
+      clapper-unwrapped
     ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index e6006ebb4df6..11804121cc81 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -86,7 +86,10 @@ stdenv.mkDerivation rec {
     description = "Free and open source karaoke game";
     mainProgram = "ultrastardx";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ Profpatsch ];
+    maintainers = with maintainers; [
+      diogotcorreia
+      Profpatsch
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/wa/wayclip/package.nix b/pkgs/by-name/wa/wayclip/package.nix
index 43e75ad16b87..d5279ddce99b 100644
--- a/pkgs/by-name/wa/wayclip/package.nix
+++ b/pkgs/by-name/wa/wayclip/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromSourcehut,
-  nix-update-script,
+  gitUpdater,
   wayland,
   wayland-scanner,
 }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gitUpdater { };
   };
 
   meta = {
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index d0ba6ade99bb..08eff3ae9e67 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -17,7 +17,6 @@ let
   python = python3.override {
     packageOverrides = final: prev: {
       django = prev.django_5;
-      sentry-sdk = prev.sentry-sdk_2;
       djangorestframework = prev.djangorestframework.overridePythonAttrs (old: {
         # https://github.com/encode/django-rest-framework/discussions/9342
         disabledTests = (old.disabledTests or [ ]) ++ [ "test_invalid_inputs" ];
diff --git a/pkgs/by-name/ya/yaak/package.nix b/pkgs/by-name/ya/yaak/package.nix
index 5ac65e3922ae..a9e64db116a2 100644
--- a/pkgs/by-name/ya/yaak/package.nix
+++ b/pkgs/by-name/ya/yaak/package.nix
@@ -11,7 +11,6 @@
   webkitgtk_4_1,
   glib,
   gtk3,
-  libsoup_2_4,
   openssl,
   pango,
   cairo,
@@ -59,7 +58,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     glib
     gtk3
     openssl
-    libsoup_2_4
     webkitgtk_4_1
     pango
     cairo
diff --git a/pkgs/development/compilers/fpc/default.nix b/pkgs/development/compilers/fpc/default.nix
index d5167b52a700..63a6102a0ece 100644
--- a/pkgs/development/compilers/fpc/default.nix
+++ b/pkgs/development/compilers/fpc/default.nix
@@ -56,6 +56,10 @@ stdenv.mkDerivation rec {
     # substitute the markers set by the mark-paths patch
     substituteInPlace fpcsrc/compiler/systems/t_linux.pas --subst-var-by dynlinker-prefix "${glibc}"
     substituteInPlace fpcsrc/compiler/systems/t_linux.pas --subst-var-by syslibpath "${glibc}/lib"
+
+    substituteInPlace fpcsrc/compiler/systems/t_darwin.pas \
+      --replace-fail "LibrarySearchPath.AddLibraryPath(sysrootpath,'=/usr/lib',true)" "LibrarySearchPath.AddLibraryPath(sysrootpath,'$SDKROOT/usr/lib',true)"
+
     # Replace the `codesign --remove-signature` command with a custom script, since `codesign` is not available
     # in nixpkgs
     # Remove the -no_uuid strip flag which does not work on llvm-strip, only
diff --git a/pkgs/development/compilers/fstar/default.nix b/pkgs/development/compilers/fstar/default.nix
deleted file mode 100644
index 0dd7a1819fa9..000000000000
--- a/pkgs/development/compilers/fstar/default.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  callPackage,
-  fetchFromGitHub,
-  installShellFiles,
-  lib,
-  makeWrapper,
-  ocamlPackages,
-  removeReferencesTo,
-  stdenv,
-  writeScript,
-  z3,
-}:
-
-let
-
-  version = "2024.09.05";
-
-  src = fetchFromGitHub {
-    owner = "FStarLang";
-    repo = "FStar";
-    rev = "v${version}";
-    hash = "sha256-yaA6WpP2XIQhjK7kpXBdBFUgKZyvtThd6JmSchUCfbI=";
-  };
-
-  fstar-dune = ocamlPackages.callPackage ./dune.nix { inherit version src; };
-
-  fstar-ulib = callPackage ./ulib.nix {
-    inherit
-      version
-      src
-      fstar-dune
-      z3
-      ;
-  };
-
-in
-
-stdenv.mkDerivation {
-  pname = "fstar";
-  inherit version src;
-
-  nativeBuildInputs = [
-    installShellFiles
-    makeWrapper
-    removeReferencesTo
-  ];
-
-  inherit (fstar-dune) propagatedBuildInputs;
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir $out
-
-    CP="cp -r --no-preserve=mode"
-    $CP ${fstar-dune}/* $out
-    $CP ${fstar-ulib}/* $out
-
-    PREFIX=$out make -C src/ocaml-output install-sides
-
-    chmod +x $out/bin/fstar.exe
-    wrapProgram $out/bin/fstar.exe --prefix PATH ":" ${z3}/bin
-    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
-
-    substituteInPlace $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/fstar/dune-package \
-      --replace ${fstar-dune} $out
-
-    installShellCompletion --bash .completion/bash/fstar.exe.bash
-    installShellCompletion --fish .completion/fish/fstar.exe.fish
-    installShellCompletion --zsh --name _fstar.exe .completion/zsh/__fstar.exe
-  '';
-
-  passthru.updateScript = writeScript "update-fstar" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p git gnugrep common-updater-scripts
-    set -eu -o pipefail
-
-    version="$(git ls-remote --tags git@github.com:FStarLang/FStar.git | grep -Po 'v\K\d{4}\.\d{2}\.\d{2}' | sort | tail -n1)"
-    update-source-version fstar "$version"
-  '';
-
-  meta = with lib; {
-    description = "ML-like functional programming language aimed at program verification";
-    homepage = "https://www.fstar-lang.org";
-    changelog = "https://github.com/FStarLang/FStar/raw/v${version}/CHANGES.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
-    mainProgram = "fstar.exe";
-    platforms = with platforms; darwin ++ linux;
-  };
-}
diff --git a/pkgs/development/compilers/fstar/dune.nix b/pkgs/development/compilers/fstar/dune.nix
deleted file mode 100644
index 3bdd62e88c47..000000000000
--- a/pkgs/development/compilers/fstar/dune.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  batteries,
-  buildDunePackage,
-  memtrace,
-  menhir,
-  menhirLib,
-  pprint,
-  ppx_deriving,
-  ppx_deriving_yojson,
-  ppxlib,
-  process,
-  sedlex,
-  src,
-  stdint,
-  version,
-  yojson,
-  zarith,
-}:
-
-buildDunePackage {
-  pname = "fstar";
-  inherit version src;
-
-  postPatch = ''
-    patchShebangs ocaml/fstar-lib/make_fstar_version.sh
-    cd ocaml
-  '';
-
-  nativeBuildInputs = [
-    menhir
-  ];
-
-  buildInputs = [
-    memtrace
-  ];
-
-  propagatedBuildInputs = [
-    batteries
-    menhirLib
-    pprint
-    ppx_deriving
-    ppx_deriving_yojson
-    ppxlib
-    process
-    sedlex
-    stdint
-    yojson
-    zarith
-  ];
-
-  enableParallelBuilding = true;
-}
diff --git a/pkgs/development/compilers/fstar/ulib.nix b/pkgs/development/compilers/fstar/ulib.nix
deleted file mode 100644
index cc7651800df2..000000000000
--- a/pkgs/development/compilers/fstar/ulib.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  fstar-dune,
-  src,
-  stdenv,
-  version,
-  z3,
-}:
-
-stdenv.mkDerivation {
-  pname = "fstar-ulib";
-  inherit version src;
-
-  nativeBuildInputs = [
-    z3
-  ];
-
-  postPatch = ''
-    mkdir -p bin
-    cp ${fstar-dune}/bin/fstar.exe bin
-    patchShebangs ulib/install-ulib.sh
-    cd ulib
-  '';
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  enableParallelBuilding = true;
-}
diff --git a/pkgs/development/libraries/qmlbox2d/default.nix b/pkgs/development/libraries/qmlbox2d/default.nix
index 5f6cf45351f2..3a1552d6596a 100644
--- a/pkgs/development/libraries/qmlbox2d/default.nix
+++ b/pkgs/development/libraries/qmlbox2d/default.nix
@@ -7,20 +7,23 @@
   cmake,
   pkg-config,
   box2d,
+  unstableGitUpdater,
 }:
 
 let
   inherit (lib) cmakeBool;
 
   # 2.3.1 is the only supported version
-  box2d' = (box2d.override { settingsFile = "Box2D/Common/b2Settings.h"; }).overrideAttrs (old: rec {
+  box2d' = box2d.overrideAttrs (old: rec {
     version = "2.3.1";
     src = fetchFromGitHub {
       owner = "erincatto";
       repo = "box2d";
-      rev = "v${version}";
+      tag = "v${version}";
       hash = "sha256-Z2J17YMzQNZqABIa5eyJDT7BWfXveymzs+DWsrklPIs=";
     };
+    patches = [ ];
+    postPatch = "";
     sourceRoot = "${src.name}/Box2D";
     cmakeFlags = old.cmakeFlags or [ ] ++ [
       (cmakeBool "BOX2D_INSTALL" true)
@@ -32,13 +35,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "qml-box2d";
-  version = "unstable-2022-08-25";
+  version = "0-unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "qml-box2d";
     repo = "qml-box2d";
-    rev = "0bb88a6f871eef72b3b9ded9329c15f1da1f4fd7";
-    hash = "sha256-sfSVetpHIAIujpgjvRScAkJRlQQYjQ/yQrkWvp7Yu0s=";
+    rev = "3a85439726d1ac4d082308feba45f23859ba71e0";
+    hash = "sha256-lTgzPJWSwNfPRj5Lc63C69o4ILuyhVRLvltTo5E7yq0=";
   };
 
   dontWrapQtApps = true;
@@ -58,11 +61,17 @@ stdenv.mkDerivation {
     (cmakeBool "USE_SYSTEM_BOX2D" true)
   ];
 
-  meta = with lib; {
+  passthru = {
+    updateScript = unstableGitUpdater {
+      hardcodeZeroVersion = true;
+    };
+  };
+
+  meta = {
     description = "QML plugin for Box2D engine";
     homepage = "https://github.com/qml-box2d/qml-box2d";
-    maintainers = with maintainers; [ guibou ];
-    platforms = platforms.linux;
-    license = licenses.zlib;
+    maintainers = with lib.maintainers; [ guibou ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.zlib;
   };
 }
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 301f22512cf8..9bbbc35c7fcc 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -5,8 +5,6 @@
   click,
   click-log,
   fetchFromGitHub,
-  pure-pcapy3,
-  pyserial-asyncio,
   pytest-asyncio,
   pytest-timeout,
   pytestCheckHook,
@@ -18,16 +16,14 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.44.0";
+  version = "0.44.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "bellows";
     tag = version;
-    hash = "sha256-9CuZGorTqay09ZHrUDoorYew8vvDV6pyxMuik7/QKJ4=";
+    hash = "sha256-LxwKS4jh/ehYGxhU4lpmzXBWGacLtjq6c/lhBybLaRE=";
   };
 
   postPatch = ''
@@ -41,8 +37,6 @@ buildPythonPackage rec {
   dependencies = [
     click
     click-log
-    pure-pcapy3
-    pyserial-asyncio
     voluptuous
     zigpy
   ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
@@ -58,7 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to implement EZSP for EmberZNet devices";
     homepage = "https://github.com/zigpy/bellows";
-    changelog = "https://github.com/zigpy/bellows/releases/tag/${version}";
+    changelog = "https://github.com/zigpy/bellows/releases/tag/${src.tag}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ mvnetbiz ];
     mainProgram = "bellows";
diff --git a/pkgs/development/python-modules/bidsschematools/default.nix b/pkgs/development/python-modules/bidsschematools/default.nix
index 5ea063ff2359..52bf112f37c0 100644
--- a/pkgs/development/python-modules/bidsschematools/default.nix
+++ b/pkgs/development/python-modules/bidsschematools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "bidsschematools";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "bidsschematools";
     inherit version;
-    hash = "sha256-dEPJircy7RDRa1Q7lgUhgfj2ewVo1rsUu1A1mnSi6vw=";
+    hash = "sha256-LKStxCh7TY7rSx6T9EnPJqCNxuj5dHvlK6E+m8D21BE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 69705997f4f9..00f2fc0a9055 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -3,6 +3,7 @@
   aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
+  freezegun,
   geopy,
   imageio,
   lxml,
@@ -13,6 +14,7 @@
   python-dateutil,
   pythonOlder,
   setuptools,
+  syrupy,
   voluptuous,
 }:
 
@@ -27,7 +29,7 @@ buildPythonPackage rec {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = version;
-    hash = "sha256-4PztYdQmMH2n3dlV8arJ2UFGp08nkIK80L460UdNhV8=";
+    hash = "sha256-YDosRPROWpjG27MyCErCTvP99mAlzg/GfmU73cBVUTo=";
   };
 
   build-system = [ setuptools ];
@@ -44,7 +46,11 @@ buildPythonPackage rec {
     voluptuous
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    freezegun
+    pytestCheckHook
+    syrupy
+  ];
 
   disabledTests = [
     # Tests require network access
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
index 937c54b5c103..da9b102da053 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
@@ -77,6 +77,7 @@ buildPythonPackage rec {
   '';
 
   meta = {
+    broken = true; # ModuleNotFoundError: No module named 'proton.vpn.local_agent'
     description = "Provides the necessary functionality for other ProtonVPN components to interact with NetworkManager";
     homepage = "https://github.com/ProtonVPN/python-proton-vpn-network-manager";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index e7c8750ad8ee..0dbe1e1c884d 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   setuptools,
   formulaic,
+  frozendict,
   click,
   num2words,
   numpy,
@@ -19,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "pybids";
-  version = "0.18.1";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bids-standard";
     repo = "pybids";
-    rev = version;
-    hash = "sha256-nSBc4vhkCdRo7CNBwvJreCiwoxJK6ztyI5gvcpzYZ/Y=";
+    tag = version;
+    hash = "sha256-x1OlqfuRZvfWwOt+WTR8lAtOPWcrsymQyXPfiEj4lk4=";
   };
 
   postPatch = ''
@@ -48,6 +49,7 @@ buildPythonPackage rec {
     bids-validator
     click
     formulaic
+    frozendict
     nibabel
     num2words
     numpy
diff --git a/pkgs/development/python-modules/pybind11-protobuf/add-install-target-for-cmake-builds.patch b/pkgs/development/python-modules/pybind11-protobuf/add-install-target-for-cmake-builds.patch
new file mode 100644
index 000000000000..62e8e13af539
--- /dev/null
+++ b/pkgs/development/python-modules/pybind11-protobuf/add-install-target-for-cmake-builds.patch
@@ -0,0 +1,78 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4ec0f64..48b619a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -39,3 +39,54 @@ add_subdirectory(cmake/dependencies dependencies)
+ set(TOP_LEVEL_DIR ${CMAKE_CURRENT_LIST_DIR})
+ include_directories(${TOP_LEVEL_DIR} ${pybind11_INCLUDE_DIRS})
+ add_subdirectory(pybind11_protobuf)
++
++# ============================================================================
++
++# pybind11_protobuf CMake Config module
++include(CMakePackageConfigHelpers)
++configure_package_config_file(
++  ${CMAKE_CURRENT_SOURCE_DIR}/cmake/Config.cmake.in
++  "${CMAKE_CURRENT_BINARY_DIR}/pybind11_protobuf-config.cmake"
++  INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/pybind11_protobuf
++  NO_CHECK_REQUIRED_COMPONENTS_MACRO)
++install(FILES "${CMAKE_CURRENT_BINARY_DIR}/pybind11_protobuf-config.cmake"
++        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/pybind11_protobuf)
++
++# ============================================================================
++
++add_library(pybind11_protobuf::native ALIAS pybind11_native_proto_caster)
++
++install(
++  TARGETS pybind11_native_proto_caster
++  EXPORT pybind11_protobuf_native_targets
++  DESTINATION ${CMAKE_INSTALL_LIBDIR}
++  INCLUDES
++  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/pybind11_protobuf)
++install(
++  FILES pybind11_protobuf/native_proto_caster.h
++        pybind11_protobuf/check_unknown_fields.h
++        pybind11_protobuf/enum_type_caster.h
++        pybind11_protobuf/proto_caster_impl.h
++        pybind11_protobuf/proto_cast_util.h
++  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/pybind11_protobuf)
++install(
++  EXPORT pybind11_protobuf_native_targets
++  FILE pybind11_protobuf_native-targets.cmake
++  NAMESPACE pybind11_protobuf::
++  DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/pybind11_protobuf)
++
++add_library(pybind11_protobuf::wrapped ALIAS pybind11_wrapped_proto_caster)
++
++install(
++  TARGETS pybind11_wrapped_proto_caster
++  EXPORT pybind11_protobuf_wrapped_targets
++  DESTINATION ${CMAKE_INSTALL_LIBDIR}
++  INCLUDES
++  DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/pybind11_protobuf)
++install(FILES pybind11_protobuf/wrapped_proto_caster.h
++        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/pybind11_protobuf)
++install(
++  EXPORT pybind11_protobuf_wrapped_targets
++  FILE pybind11_protobuf_wrapped-targets.cmake
++  NAMESPACE pybind11_protobuf::
++  DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/pybind11_protobuf)
+diff --git a/cmake/Config.cmake.in b/cmake/Config.cmake.in
+new file mode 100644
+index 0000000..00dae69
+--- /dev/null
++++ b/cmake/Config.cmake.in
+@@ -0,0 +1,13 @@
++@PACKAGE_INIT@
++
++set(_pybind11_protobuf_supported_components native wrapped)
++
++foreach(_comp ${pybind11_protobuf_FIND_COMPONENTS})
++  if(NOT _comp IN_LIST _pybind11_protobuf_supported_components)
++    set(pybind11_protobuf_FOUND False)
++    set(pybind11_protobuf_NOT_FOUND_MESSAGE "Unsupported component: ${_comp}")
++  endif()
++endforeach()
++foreach(_comp ${_pybind11_protobuf_supported_components})
++  include("${CMAKE_CURRENT_LIST_DIR}/pybind11_protobuf_${_comp}-targets.cmake")
++endforeach()
diff --git a/pkgs/development/python-modules/pybind11-protobuf/default.nix b/pkgs/development/python-modules/pybind11-protobuf/default.nix
index eef20b7c3744..60318f12f221 100644
--- a/pkgs/development/python-modules/pybind11-protobuf/default.nix
+++ b/pkgs/development/python-modules/pybind11-protobuf/default.nix
@@ -1,47 +1,57 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
-  abseil-cpp_202301,
-  protobuf_23,
+  abseil-cpp,
+  protobuf,
   pybind11,
+  zlib,
 }:
 
 buildPythonPackage {
   pname = "pybind11-protobuf";
-  version = "0-unstable-2024-11-01";
+  version = "0-unstable-2025-02-10";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = "pybind11_protobuf";
-    rev = "90b1a5b9de768340069c15b603d467c21cac5e0b";
-    hash = "sha256-3OuwRP9MhxmcfeDx+p74Fz6iLqi9FXbR3t3BtafesKk=";
+    rev = "f02a2b7653bc50eb5119d125842a3870db95d251";
+    hash = "sha256-jlZcxQKYYYvTOGhk+0Sgtek4oKy6R1wDGiBOf2t+KiU=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "0006-Add-install-target-for-CMake-builds.patch";
-      url = "https://build.opensuse.org/public/source/openSUSE:Factory/pybind11_protobuf/0006-Add-install-target-for-CMake-builds.patch?rev=2";
-      hash = "sha256-tjaOr6f+JCRft0SWd0Zfte7FEOYOP7RrW0Vjz34rX6I=";
-    })
-    (fetchpatch {
-      name = "0007-CMake-Use-Python-Module.patch";
-      url = "https://build.opensuse.org/public/source/openSUSE:Factory/pybind11_protobuf/0007-CMake-Use-Python-Module.patch?rev=2";
-      hash = "sha256-A1dhfh31FMBHBdCfoYmQrInZvO/DeuVMUL57PpUHYfA=";
-    })
+    # Rebase of the OpenSUSE patch: https://build.opensuse.org/projects/openSUSE:Factory/packages/pybind11_protobuf/files/0006-Add-install-target-for-CMake-builds.patch?expand=1
+    # on top of: https://github.com/pybind/pybind11_protobuf/pull/188/commits/5f0ac3d8c10cbb8b3b81063467c71085cd39624f
+    ./add-install-target-for-cmake-builds.patch
   ];
 
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    abseil-cpp_202301
-    protobuf_23
+    abseil-cpp
+    protobuf
     pybind11
+    zlib
   ];
 
+  cmakeFlags =
+    [
+      (lib.cmakeBool "USE_SYSTEM_ABSEIL" true)
+      (lib.cmakeBool "USE_SYSTEM_PROTOBUF" true)
+      (lib.cmakeBool "USE_SYSTEM_PYBIND" true)
+
+      # The find_package calls are local to the dependencies subdirectory
+      (lib.cmakeBool "CMAKE_FIND_PACKAGE_TARGETS_GLOBAL" true)
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Without it, Cmake prefers using Find-module which is mysteriously broken
+      # But the generated Config works
+      (lib.cmakeBool "CMAKE_FIND_PACKAGE_PREFER_CONFIG" true)
+    ];
+
   meta = {
     description = "Pybind11 bindings for Google's Protocol Buffers";
     homepage = "https://github.com/pybind/pybind11_protobuf";
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index a841a73f4d91..ce5a284b3017 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -22,6 +22,9 @@
 
   # tests
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
+  mako,
+  pocl,
 }:
 
 buildPythonPackage rec {
@@ -49,8 +52,9 @@ buildPythonPackage rec {
 
   buildInputs = [
     opencl-headers
+    ocl-icd
     pybind11
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ ocl-icd ];
+  ];
 
   dependencies = [
     numpy
@@ -58,19 +62,23 @@ buildPythonPackage rec {
     pytools
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pocl
+    mako
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ] ++ pytools.optional-dependencies.siphash;
+
+  env = {
+    CL_INC_DIR = "${opencl-headers}/include";
+    CL_LIB_DIR = "${ocl-icd}/lib";
+    CL_LIBNAME = "${ocl-icd}/lib/libOpenCL${stdenv.hostPlatform.extensions.sharedLibrary}";
+  };
 
   preCheck = ''
-    export HOME=$(mktemp -d)
-
-    # https://github.com/NixOS/nixpkgs/issues/255262
-    cd $out
+    rm -rf pyopencl
   '';
 
-  # https://github.com/inducer/pyopencl/issues/784 Note that these failing
-  # tests are all the tests that are available.
-  doCheck = false;
-
   pythonImportsCheck = [
     "pyopencl"
     "pyopencl.array"
@@ -86,10 +94,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
-    badPlatforms = [
-      # ld: symbol(s) not found for architecture arm64/x86_64
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/sentry-sdk/1.nix b/pkgs/development/python-modules/sentry-sdk/1.nix
deleted file mode 100644
index a5b722ef1816..000000000000
--- a/pkgs/development/python-modules/sentry-sdk/1.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  lib,
-  stdenv,
-  aiohttp,
-  apache-beam,
-  asttokens,
-  blinker,
-  bottle,
-  buildPythonPackage,
-  celery,
-  certifi,
-  chalice,
-  django,
-  executing,
-  falcon,
-  fetchFromGitHub,
-  flask,
-  gevent,
-  httpx,
-  jsonschema,
-  mock,
-  pure-eval,
-  pyrsistent,
-  pyspark,
-  pysocks,
-  pytest-forked,
-  pytest-localserver,
-  pytest-watch,
-  pytestCheckHook,
-  pythonOlder,
-  quart,
-  rq,
-  sanic,
-  setuptools,
-  sqlalchemy,
-  tornado,
-  urllib3,
-}:
-
-buildPythonPackage rec {
-  pname = "sentry-sdk";
-  version = "1.45.1";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "getsentry";
-    repo = "sentry-python";
-    rev = "refs/tags/${version}";
-    hash = "sha256-ZNJsxbQcW5g/bKqN18z+BspKyI34+vkj6vQ9akE1Ook=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    certifi
-    urllib3
-  ];
-
-  optional-dependencies = {
-    aiohttp = [ aiohttp ];
-    beam = [ apache-beam ];
-    bottle = [ bottle ];
-    celery = [ celery ];
-    chalice = [ chalice ];
-    django = [ django ];
-    falcon = [ falcon ];
-    flask = [
-      flask
-      blinker
-    ];
-    httpx = [ httpx ];
-    pyspark = [ pyspark ];
-    pure_eval = [
-      asttokens
-      executing
-      pure-eval
-    ];
-    quart = [
-      quart
-      blinker
-    ];
-    rq = [ rq ];
-    sanic = [ sanic ];
-    sqlalchemy = [ sqlalchemy ];
-    tornado = [ tornado ];
-  };
-
-  nativeCheckInputs = [
-    asttokens
-    executing
-    gevent
-    jsonschema
-    mock
-    pure-eval
-    pyrsistent
-    pysocks
-    pytest-forked
-    pytest-localserver
-    pytest-watch
-    pytestCheckHook
-  ];
-
-  doCheck = pythonOlder "3.13" && !stdenv.hostPlatform.isDarwin;
-
-  disabledTests = [
-    # Issue with the asseration
-    "test_auto_enabling_integrations_catches_import_error"
-    "test_default_release"
-  ];
-
-  disabledTestPaths =
-    [
-      # Various integration tests fail every once in a while when we
-      # upgrade dependencies, so don't bother testing them.
-      "tests/integrations/"
-    ]
-    ++ lib.optionals (stdenv.buildPlatform != "x86_64-linux") [
-      # test crashes on aarch64
-      "tests/test_transport.py"
-    ];
-
-  pythonImportsCheck = [ "sentry_sdk" ];
-
-  meta = with lib; {
-    description = "Python SDK for Sentry.io";
-    homepage = "https://github.com/getsentry/sentry-python";
-    changelog = "https://github.com/getsentry/sentry-python/blob/${version}/CHANGELOG.md";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [
-      fab
-    ];
-  };
-}
diff --git a/pkgs/development/python-modules/swh-core/default.nix b/pkgs/development/python-modules/swh-core/default.nix
index aa0ca05d0318..c56bbba926f7 100644
--- a/pkgs/development/python-modules/swh-core/default.nix
+++ b/pkgs/development/python-modules/swh-core/default.nix
@@ -9,7 +9,7 @@
   python-magic,
   pyyaml,
   requests,
-  sentry-sdk_2,
+  sentry-sdk,
   tenacity,
   setuptools,
   setuptools-scm,
@@ -65,7 +65,7 @@ buildPythonPackage rec {
     python-magic
     pyyaml
     requests
-    sentry-sdk_2
+    sentry-sdk
     tenacity
   ];
 
diff --git a/pkgs/development/python-modules/voluptuous-openapi/default.nix b/pkgs/development/python-modules/voluptuous-openapi/default.nix
index d9a824b30388..41853b4bb637 100644
--- a/pkgs/development/python-modules/voluptuous-openapi/default.nix
+++ b/pkgs/development/python-modules/voluptuous-openapi/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "voluptuous-openapi";
-  version = "0.0.6";
+  version = "0.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "voluptuous-openapi";
     tag = "v${version}";
-    hash = "sha256-D8TafOOGiZO2IpSE7aGB1CVey2zpZgGzZpUvagT9B6Q=";
+    hash = "sha256-shgLUO4dFuvVG8K3yuK8FUsohIb4zgh7h6nvNiaYws0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index ff06d4e43051..524f49e5a7ef 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -28,7 +28,7 @@
   pydantic,
   pyyaml,
   requests,
-  sentry-sdk_2,
+  sentry-sdk,
   setproctitle,
   setuptools,
   pythonOlder,
@@ -188,7 +188,7 @@ buildPythonPackage rec {
       pydantic
       pyyaml
       requests
-      sentry-sdk_2
+      sentry-sdk
       setproctitle
       # setuptools is necessary since pkg_resources is required at runtime.
       setuptools
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index 527283d544f3..374c903ffbb3 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "zha";
-  version = "0.0.55";
+  version = "0.0.56";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha";
     tag = version;
-    hash = "sha256-LiHJk7xVdIqNl6BTfwlch3jqQm/MvbrKSExhOR5KD0c=";
+    hash = "sha256-k6Zegn7YUw5Wueb/8Z1RJ7teRMQ6Owdm8obM6XHI/aY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index a9b9fde8ec90..dad6edf4dc1f 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -12,9 +12,7 @@
   fetchFromGitHub,
   freezegun,
   frozendict,
-  importlib-resources,
   jsonschema,
-  pycryptodome,
   pyserial-asyncio,
   pytest-asyncio,
   pytest-timeout,
@@ -27,16 +25,14 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.78.0";
+  version = "0.78.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy";
     tag = version;
-    hash = "sha256-7ckpg1ukuASWtTdQn/P0KfXaMo5l2NyB9alCXeTarEU=";
+    hash = "sha256-b+4KqcswAKUNJb4e450VwmAR0mca9ApW4n+kif7BR7o=";
   };
 
   postPatch = ''
@@ -47,22 +43,18 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  dependencies =
-    [
-      attrs
-      aiohttp
-      aiosqlite
-      crccheck
-      cryptography
-      frozendict
-      jsonschema
-      pyserial-asyncio
-      typing-extensions
-      pycryptodome
-      voluptuous
-    ]
-    ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ]
-    ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
+  dependencies = [
+    attrs
+    aiohttp
+    aiosqlite
+    crccheck
+    cryptography
+    frozendict
+    jsonschema
+    pyserial-asyncio
+    typing-extensions
+    voluptuous
+  ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
 
   nativeCheckInputs = [
     aioresponses
diff --git a/pkgs/development/tools/godot/common.nix b/pkgs/development/tools/godot/common.nix
index dea54a9fd638..bab845d6af5d 100644
--- a/pkgs/development/tools/godot/common.nix
+++ b/pkgs/development/tools/godot/common.nix
@@ -241,6 +241,14 @@ let
         runHook post Install
       '';
 
+    # patching $debug can crash patchelf
+    # (https://github.com/NixOS/patchelf/issues/373), so explicitly patch $out
+    dontAutoPatchelf = true;
+
+    postFixup = ''
+      autoPatchelf "$out"
+    '';
+
     passthru = {
       tests =
         let
diff --git a/pkgs/development/tools/spr/default.nix b/pkgs/development/tools/spr/default.nix
index 5df228765c87..fe450c314568 100644
--- a/pkgs/development/tools/spr/default.nix
+++ b/pkgs/development/tools/spr/default.nix
@@ -19,8 +19,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Submit pull requests for individual, amendable, rebaseable commits to GitHub";
     mainProgram = "spr";
-    homepage = "https://github.com/getcord/spr";
+    homepage = "https://github.com/spacedentist/spr";
     license = licenses.mit;
-    maintainers = with maintainers; [ sven-of-cord ];
+    maintainers = with maintainers; [ spacedentist ];
   };
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 81d31a96bdf2..eb021ce9cab5 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.4.2";
+  version = "2025.4.3";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
index be9ae7010515..a3e7f431134a 100644
--- a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "jwillemsen";
   domain = "daikin_onecta";
-  version = "4.2.3";
+  version = "4.2.6";
 
   src = fetchFromGitHub {
     owner = "jwillemsen";
     repo = "daikin_onecta";
     tag = "v${version}";
-    hash = "sha256-ylVHgmE6zDLE73KpuIag0iUx77w6ujp3cF/+x2bJiA8=";
+    hash = "sha256-JBo2205wHeC+5+kontzqgRLTss2Naht/TbkuEAs2nSQ=";
   };
 
   meta = {
diff --git a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
index 9befc39ade5e..848ff9370fc6 100644
--- a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "mill1000";
   domain = "midea_ac";
-  version = "2025.3.1";
+  version = "2025.4.0";
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-ac-py";
     tag = version;
-    hash = "sha256-oO+t0my72PwWWUAzr8blA3Q8uJyICZNcfoOHsLFL3MQ=";
+    hash = "sha256-ZkLC0GhfN+jp1DWv30LNVCP+NEZywt9Pxycs2RWBzrM=";
   };
 
   dependencies = [ msmart-ng ];
diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
index 2934a25d1b6b..ec21ff0f6b57 100644
--- a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marcolivierarsenault";
   domain = "moonraker";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "marcolivierarsenault";
     repo = "moonraker-home-assistant";
     tag = version;
-    hash = "sha256-J/MHT+yzV08sJMJCDoH6tpE86Mgz4fxpgbyWNge0n54=";
+    hash = "sha256-BPlHMTGb1xSxFydeLsHKBlXSqgh1qmTrenPo+XPx2IM=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index 5bcb72bda07c..d1998fc8bf20 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2025.3.0";
+  version = "2025.4.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-CkH2Njv9qdGlnEo3RP64Lz4ys62W6DxYC/TSl/lndPI=";
+    hash = "sha256-lvDiB/kVlPsKI28muv03B8j/0RD7U4I4ZNiucji8/e4=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
index d94ffcb7b480..a251d82fd730 100644
--- a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-wsc1XSq1KYq7Rs99XK/wL2PYWrxbMblWPHzgopeQ5IM=";
+    hash = "sha256-jiskzH2MsddF1rdCnrdJyALQQxFrFUBpOjdR/zbTxh0=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index c401f0a9bbaa..c526ac3a9418 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -377,7 +377,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.4.2";
+  hassVersion = "2025.4.3";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -398,13 +398,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-7OwkZ2KF1IxSNCXvr7Ex0nIKWWr78Zvma2WGaKM5cJE=";
+    hash = "sha256-KyPWEGXSoB9BJolR4+Kq9K9urhXN4YcgV0SQYaAEjiA=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-IBJxyPZgFrCiARgOzYEcC6Eu/hwoOFTH87lkb+6UYJ4=";
+    hash = "sha256-xo1f2GDeafOaXiJ1+l+NsJkpU0FvbSnflsp2BE/JKC4=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index fafad5d28d6a..b7fcf1de9ff2 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -18,16 +18,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.233";
+  version = "0.13.235";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
+  disabled = pythonOlder "3.13";
 
   src = fetchFromGitHub {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     rev = "refs/tags/${version}";
-    hash = "sha256-Yi865ZCK1Rr9Nto0HpqRqwCE6t/UPLR8lqfPv0P+bcs=";
+    hash = "sha256-hr9GZsyXj7ewEevyXs2PCMKFQahcco+gVFQi8kSxf9A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 9f8475721a76..6244ed72f939 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.4.2";
+  version = "2025.4.3";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-SFMGBPVjgoLkPlYHuTKZLbhTMbKGEeE1wYsFJ0ssbgg=";
+    hash = "sha256-IvtkEZLVngSHNb0nGJri/EW1t29KcrFvxdm6gjmrtz4=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 9660ad0f6424..2c3ab38831ea 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -14,7 +14,7 @@ let
       ibeacon-ble
     ];
     hassio = getComponentDeps "homeassistant_yellow";
-    homeassistant_hardware = getComponentDeps "zha";
+    homeassistant_hardware = getComponentDeps "otbr" ++ getComponentDeps "zha";
     homeassistant_sky_connect = getComponentDeps "zha";
     homeassistant_yellow = getComponentDeps "zha";
     husqvarna_automower_ble = getComponentDeps "gardena_bluetooth";
@@ -78,6 +78,14 @@ let
   };
 
   extraPytestFlagsArray = {
+    backup = [
+      # outdated snapshot
+      "--deselect tests/components/backup/test_sensors.py::test_sensors"
+    ];
+    bmw_connected_drive = [
+      # outdated snapshot
+      "--deselect tests/components/bmw_connected_drive/test_select.py::test_entity_state_attrs"
+    ];
     dnsip = [
       # Tries to resolve DNS entries
       "--deselect tests/components/dnsip/test_config_flow.py::test_options_flow"
@@ -88,6 +96,10 @@ let
       "--deselect tests/components/jellyfin/test_media_source.py::test_audio_codec_resolve"
       "--deselect tests/components/jellyfin/test_media_source.py::test_music_library"
     ];
+    matter = [
+      # outdated snapshot in eve_weather_sensor variant
+      "--deselect tests/components/matter/test_number.py::test_numbers"
+    ];
     modem_callerid = [
       # aioserial mock produces wrong state
       "--deselect tests/components/modem_callerid/test_init.py::test_setup_entry"
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index e4f8cff0fcb8..f3ed67b07248 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -54,20 +54,20 @@ let
 in
 {
   nextcloud29 = generic {
-    version = "29.0.15";
-    hash = "sha256-iqvCDILYxxJk7oxAmXaaBbwzUWKAAd5aNHAswRKBfMA=";
+    version = "29.0.16";
+    hash = "sha256-SZv2GrGe3NTlQq+GYJJDxbT0QOtbsGwrp9oML6pSUyI=";
     packages = nextcloud29Packages;
   };
 
   nextcloud30 = generic {
-    version = "30.0.9";
-    hash = "sha256-gkWL1whsCCqHrR8UldkjuJ4jMRCajZXosA5jm70OHxY=";
+    version = "30.0.10";
+    hash = "sha256-40ldF8X1yRZFQtk/Y21pasyPOLYL7HDPGtLnnHbZlbo=";
     packages = nextcloud30Packages;
   };
 
   nextcloud31 = generic {
-    version = "31.0.3";
-    hash = "sha256-koOuvY/aWtc5zaVvfKuqg1zDv5j3lTbDbczXMJ4rMFo=";
+    version = "31.0.4";
+    hash = "sha256-pHVBVm1casb2Pk9hfifaKVFW2kfaos0i7uNAD9KtElE=";
     packages = nextcloud31Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index f827afb20f4d..e74c8b8e33c2 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -240,10 +240,10 @@
     ]
   },
   "notes": {
-    "hash": "sha256-dpMCehjhPQoOA+MVdLeGc370hmqWzmsMczgV08m/cO4=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.11.0/notes-v4.11.0.tar.gz",
-    "version": "4.11.0",
-    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
+    "hash": "sha256-UdqK6DiC67YPcy84wFEZaT8AQLDhhNndLiEesQeBY7M=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.0/notes-v4.12.0.tar.gz",
+    "version": "4.12.0",
+    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
       "agpl"
@@ -340,9 +340,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-M2sITpieWvl2WPjxWHtyyZRNQPagYLahVaJcDoiTsh8=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.9.2/release.tar.gz",
-    "version": "5.9.2",
+    "hash": "sha256-DNf48YmVJ49v+lynTCIBTZhPi/S1mjyIF5OWf+UVKeY=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.0.1/release.tar.gz",
+    "version": "6.0.1",
     "description": "# Social login\n\nMake possible create users and login via Telegram, OAuth or OpenID\n\nFor OAuth you must create app for certain providers. Login button appear at login page if app id specified. Settings are in \"Social login\" section of settings page.\n\n## Installation\n\nLogin to your NextCloud installation as an administrator and under \"Apps\" click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n\n\n## Custom OAuth2/OIDC groups\n\nYou can use groups from your custom provider. For that you should specify \"Groups claim\" in custom OAuth2/OIDC provider settings. That claim should be returned from provider in `id_token` or at user info endpoint. Format should be `array` or comma separated string. Eg (with claim named `roles`)\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nAlso nested claims is supported. For example `resource_access.client-id.roles` for\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\nThere is also support for setting the displayName:\n```\n{\"roles\": [{gid: 1, displayName: \"admin\"}, {gid: 2, displayName: \"user\"}]}\n```\n\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing nextcloud groups\n2. Create provider groups in nextcloud and associate it to user (if appropriate option specified)\n\nIf you want sync groups on every login do not forget to check \"Update user profile every login\" setting\n\n## Examples for groups\n\n* You can find example how to configure WSO2IS for return roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff)\n* [GitLab OIDC allowing specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n\n## Built-in OAuth providers\n\nYou can copy link of certain login button to get proper \"redirect url\" for OAuth app setting.\n\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n* [GitHub](https://github.com/settings/developers)\n* [Discord](#configure-discord)\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* PlexTv - you can use any title as app id\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n\nDetails about \"Allow login only from specified domain\" google setting you can find here [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44)\nYou can use comma separated list for multiple domains\n\n## Config\n\nYou can use `'social_login_auto_redirect' => true` setting in `config.php` for auto redirect unauthorized users to social login if only one provider is configured.\nIf you want to temporary disable this function (e.g. for login as local admin), you can add `noredir=1` query parameter in url for login page. Something like `https://cloud.domain.com/login?noredir=1`\n\nTo set options for http client, you can use\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // Check https://curl.se/libcurl/c/CURLOPT_PROXY.html for allowed variants\n  ],\n```\nin `config.php`\n\n### Configurate a provider via CLI\n\nYou can configure everything from commandline by using the occ utility. To setup a oidc-provider replace the variables and URLs with values that match your deployment.\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nto do this with docker you just need to add `docker exec -t -uwww-data CONTAINER_NAME` in front of the command, or run it interactively from `docker exec -it -uwww-data CONTAINER_NAME sh`\n\nTo find out how to configure other providers, just configure them in the GUI and take a look at the database afterwards:\n```\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\n\nOr just run\n\n`docker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers`\n\n### Configure Discord\n\nTo properly configure discord you have to:\n\n1. Create new discord application on [DiscordApp developers](https://discordapp.com/developers/applications/me#top)\n2. Open tab `Settings -> OAuth2 -> General`. In `Redirects` add new redirection link looking like this: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy `CLIENT ID` and generate and copy `CLIENT SECRET`\n4. Open in Nextcloud `Settings -> Social Login` and paste `CLIENT ID` into field `App id` and `CLIENT SECRET` into `Secret`.\n5. Select default group for users created this way.\n6. For group mapping check [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395)\n\n## Hint\n\n### About Callback(Reply) Url\nYou can copy link from specific login button on login page and paste it on provider's website as callback url. To make proper button visible, just fill certain provider settings with random data and change it later.\n\nSome users may get strange reply(Callback) url error from provider even if you pasted the right url, that's because your nextcloud server may generate http urls when you are actually using https.\nPlease set 'overwriteprotocol' => 'https', in your config.php file.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/30.json b/pkgs/servers/nextcloud/packages/30.json
index 98b5701a119c..f9af7efcd5a3 100644
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-suiKZfa+nL9xMFkkZwlrrGiicoIf5zyxpNXS3q7nCC8=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.5/contacts-v7.0.5.tar.gz",
-    "version": "7.0.5",
+    "hash": "sha256-3G1di/PnOAIML2vwKglmuMApvn8+nXYjdqnySSSoLDI=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.6/contacts-v7.0.6.tar.gz",
+    "version": "7.0.6",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -190,9 +190,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-PeDfYIaU1HNONCI/aNwsMv0gBUArATj/dXKUW52ejW8=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.6/mail-v4.3.6.tar.gz",
-    "version": "4.3.6",
+    "hash": "sha256-AV0vrDU4zeg7AQQpJkj5mHQatxCa2RMON5tY4Q/OjyM=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.0.0/mail-v5.0.0.tar.gz",
+    "version": "5.0.0",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -240,10 +240,10 @@
     ]
   },
   "notes": {
-    "hash": "sha256-dpMCehjhPQoOA+MVdLeGc370hmqWzmsMczgV08m/cO4=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.11.0/notes-v4.11.0.tar.gz",
-    "version": "4.11.0",
-    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
+    "hash": "sha256-UdqK6DiC67YPcy84wFEZaT8AQLDhhNndLiEesQeBY7M=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.0/notes-v4.12.0.tar.gz",
+    "version": "4.12.0",
+    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
       "agpl"
@@ -340,9 +340,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-M2sITpieWvl2WPjxWHtyyZRNQPagYLahVaJcDoiTsh8=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.9.2/release.tar.gz",
-    "version": "5.9.2",
+    "hash": "sha256-DNf48YmVJ49v+lynTCIBTZhPi/S1mjyIF5OWf+UVKeY=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.0.1/release.tar.gz",
+    "version": "6.0.1",
     "description": "# Social login\n\nMake possible create users and login via Telegram, OAuth or OpenID\n\nFor OAuth you must create app for certain providers. Login button appear at login page if app id specified. Settings are in \"Social login\" section of settings page.\n\n## Installation\n\nLogin to your NextCloud installation as an administrator and under \"Apps\" click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n\n\n## Custom OAuth2/OIDC groups\n\nYou can use groups from your custom provider. For that you should specify \"Groups claim\" in custom OAuth2/OIDC provider settings. That claim should be returned from provider in `id_token` or at user info endpoint. Format should be `array` or comma separated string. Eg (with claim named `roles`)\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nAlso nested claims is supported. For example `resource_access.client-id.roles` for\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\nThere is also support for setting the displayName:\n```\n{\"roles\": [{gid: 1, displayName: \"admin\"}, {gid: 2, displayName: \"user\"}]}\n```\n\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing nextcloud groups\n2. Create provider groups in nextcloud and associate it to user (if appropriate option specified)\n\nIf you want sync groups on every login do not forget to check \"Update user profile every login\" setting\n\n## Examples for groups\n\n* You can find example how to configure WSO2IS for return roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff)\n* [GitLab OIDC allowing specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n\n## Built-in OAuth providers\n\nYou can copy link of certain login button to get proper \"redirect url\" for OAuth app setting.\n\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n* [GitHub](https://github.com/settings/developers)\n* [Discord](#configure-discord)\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* PlexTv - you can use any title as app id\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n\nDetails about \"Allow login only from specified domain\" google setting you can find here [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44)\nYou can use comma separated list for multiple domains\n\n## Config\n\nYou can use `'social_login_auto_redirect' => true` setting in `config.php` for auto redirect unauthorized users to social login if only one provider is configured.\nIf you want to temporary disable this function (e.g. for login as local admin), you can add `noredir=1` query parameter in url for login page. Something like `https://cloud.domain.com/login?noredir=1`\n\nTo set options for http client, you can use\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // Check https://curl.se/libcurl/c/CURLOPT_PROXY.html for allowed variants\n  ],\n```\nin `config.php`\n\n### Configurate a provider via CLI\n\nYou can configure everything from commandline by using the occ utility. To setup a oidc-provider replace the variables and URLs with values that match your deployment.\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nto do this with docker you just need to add `docker exec -t -uwww-data CONTAINER_NAME` in front of the command, or run it interactively from `docker exec -it -uwww-data CONTAINER_NAME sh`\n\nTo find out how to configure other providers, just configure them in the GUI and take a look at the database afterwards:\n```\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\n\nOr just run\n\n`docker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers`\n\n### Configure Discord\n\nTo properly configure discord you have to:\n\n1. Create new discord application on [DiscordApp developers](https://discordapp.com/developers/applications/me#top)\n2. Open tab `Settings -> OAuth2 -> General`. In `Redirects` add new redirection link looking like this: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy `CLIENT ID` and generate and copy `CLIENT SECRET`\n4. Open in Nextcloud `Settings -> Social Login` and paste `CLIENT ID` into field `App id` and `CLIENT SECRET` into `Secret`.\n5. Select default group for users created this way.\n6. For group mapping check [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395)\n\n## Hint\n\n### About Callback(Reply) Url\nYou can copy link from specific login button on login page and paste it on provider's website as callback url. To make proper button visible, just fill certain provider settings with random data and change it later.\n\nSome users may get strange reply(Callback) url error from provider even if you pasted the right url, that's because your nextcloud server may generate http urls when you are actually using https.\nPlease set 'overwriteprotocol' => 'https', in your config.php file.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index f006317c2fb7..de6056cfc19a 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-suiKZfa+nL9xMFkkZwlrrGiicoIf5zyxpNXS3q7nCC8=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.5/contacts-v7.0.5.tar.gz",
-    "version": "7.0.5",
+    "hash": "sha256-3G1di/PnOAIML2vwKglmuMApvn8+nXYjdqnySSSoLDI=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.6/contacts-v7.0.6.tar.gz",
+    "version": "7.0.6",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -190,9 +190,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-PeDfYIaU1HNONCI/aNwsMv0gBUArATj/dXKUW52ejW8=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.6/mail-v4.3.6.tar.gz",
-    "version": "4.3.6",
+    "hash": "sha256-AV0vrDU4zeg7AQQpJkj5mHQatxCa2RMON5tY4Q/OjyM=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.0.0/mail-v5.0.0.tar.gz",
+    "version": "5.0.0",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -230,10 +230,10 @@
     ]
   },
   "notes": {
-    "hash": "sha256-dpMCehjhPQoOA+MVdLeGc370hmqWzmsMczgV08m/cO4=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.11.0/notes-v4.11.0.tar.gz",
-    "version": "4.11.0",
-    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
+    "hash": "sha256-UdqK6DiC67YPcy84wFEZaT8AQLDhhNndLiEesQeBY7M=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.0/notes-v4.12.0.tar.gz",
+    "version": "4.12.0",
+    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
       "agpl"
@@ -330,9 +330,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-M2sITpieWvl2WPjxWHtyyZRNQPagYLahVaJcDoiTsh8=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.9.2/release.tar.gz",
-    "version": "5.9.2",
+    "hash": "sha256-DNf48YmVJ49v+lynTCIBTZhPi/S1mjyIF5OWf+UVKeY=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.0.1/release.tar.gz",
+    "version": "6.0.1",
     "description": "# Social login\n\nMake possible create users and login via Telegram, OAuth or OpenID\n\nFor OAuth you must create app for certain providers. Login button appear at login page if app id specified. Settings are in \"Social login\" section of settings page.\n\n## Installation\n\nLogin to your NextCloud installation as an administrator and under \"Apps\" click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n\n\n## Custom OAuth2/OIDC groups\n\nYou can use groups from your custom provider. For that you should specify \"Groups claim\" in custom OAuth2/OIDC provider settings. That claim should be returned from provider in `id_token` or at user info endpoint. Format should be `array` or comma separated string. Eg (with claim named `roles`)\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nAlso nested claims is supported. For example `resource_access.client-id.roles` for\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\nThere is also support for setting the displayName:\n```\n{\"roles\": [{gid: 1, displayName: \"admin\"}, {gid: 2, displayName: \"user\"}]}\n```\n\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing nextcloud groups\n2. Create provider groups in nextcloud and associate it to user (if appropriate option specified)\n\nIf you want sync groups on every login do not forget to check \"Update user profile every login\" setting\n\n## Examples for groups\n\n* You can find example how to configure WSO2IS for return roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff)\n* [GitLab OIDC allowing specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n\n## Built-in OAuth providers\n\nYou can copy link of certain login button to get proper \"redirect url\" for OAuth app setting.\n\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n* [GitHub](https://github.com/settings/developers)\n* [Discord](#configure-discord)\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* PlexTv - you can use any title as app id\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n\nDetails about \"Allow login only from specified domain\" google setting you can find here [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44)\nYou can use comma separated list for multiple domains\n\n## Config\n\nYou can use `'social_login_auto_redirect' => true` setting in `config.php` for auto redirect unauthorized users to social login if only one provider is configured.\nIf you want to temporary disable this function (e.g. for login as local admin), you can add `noredir=1` query parameter in url for login page. Something like `https://cloud.domain.com/login?noredir=1`\n\nTo set options for http client, you can use\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // Check https://curl.se/libcurl/c/CURLOPT_PROXY.html for allowed variants\n  ],\n```\nin `config.php`\n\n### Configurate a provider via CLI\n\nYou can configure everything from commandline by using the occ utility. To setup a oidc-provider replace the variables and URLs with values that match your deployment.\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nto do this with docker you just need to add `docker exec -t -uwww-data CONTAINER_NAME` in front of the command, or run it interactively from `docker exec -it -uwww-data CONTAINER_NAME sh`\n\nTo find out how to configure other providers, just configure them in the GUI and take a look at the database afterwards:\n```\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\n\nOr just run\n\n`docker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers`\n\n### Configure Discord\n\nTo properly configure discord you have to:\n\n1. Create new discord application on [DiscordApp developers](https://discordapp.com/developers/applications/me#top)\n2. Open tab `Settings -> OAuth2 -> General`. In `Redirects` add new redirection link looking like this: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy `CLIENT ID` and generate and copy `CLIENT SECRET`\n4. Open in Nextcloud `Settings -> Social Login` and paste `CLIENT ID` into field `App id` and `CLIENT SECRET` into `Secret`.\n5. Select default group for users created this way.\n6. For group mapping check [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395)\n\n## Hint\n\n### About Callback(Reply) Url\nYou can copy link from specific login button on login page and paste it on provider's website as callback url. To make proper button visible, just fill certain provider settings with random data and change it later.\n\nSome users may get strange reply(Callback) url error from provider even if you pasted the right url, that's because your nextcloud server may generate http urls when you are actually using https.\nPlease set 'overwriteprotocol' => 'https', in your config.php file.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix b/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
deleted file mode 100644
index f916716c3eb5..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-import ./versions.nix (
-  { version, sha256 }:
-  buildGoModule {
-    pname = "honeymarker";
-    inherit version;
-    vendorHash = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
-
-    src = fetchFromGitHub {
-      owner = "honeycombio";
-      repo = "honeymarker";
-      rev = "v${version}";
-      hash = sha256;
-    };
-
-    meta = with lib; {
-      description = "provides a simple CRUD interface for dealing with per-dataset markers on honeycomb.io";
-      homepage = "https://honeycomb.io/";
-      license = licenses.asl20;
-      maintainers = [ maintainers.iand675 ];
-    };
-  }
-)
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix b/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
deleted file mode 100644
index 60e6a537e42e..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-generic: {
-  v0_2_1 = generic {
-    version = "0.2.1";
-    sha256 = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
-  };
-}
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/default.nix b/pkgs/servers/tracing/honeycomb/honeytail/default.nix
deleted file mode 100644
index cebed31d7213..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeytail/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-import ./versions.nix (
-  { version, sha256 }:
-  buildGoModule {
-    pname = "honeytail";
-    inherit version;
-    vendorHash = "sha256-LtiiLGLjhbfT49A6Fw5CbSbnmTHMxtcUssr+ayCVrvY=";
-
-    src = fetchFromGitHub {
-      owner = "honeycombio";
-      repo = "honeytail";
-      rev = "v${version}";
-      hash = sha256;
-    };
-
-    meta = with lib; {
-      description = "agent for ingesting log file data into honeycomb.io and making it available for exploration";
-      homepage = "https://honeycomb.io/";
-      license = licenses.asl20;
-      maintainers = [ maintainers.iand675 ];
-    };
-  }
-)
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix b/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
deleted file mode 100644
index 295cc7c6353e..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-generic: {
-  v1_6_0 = generic {
-    version = "1.6.0";
-    sha256 = "sha256-S0hIgNNzF1eNe+XJs+PT7EUIl5oJCXu+B/zQago4sf8=";
-  };
-}
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix b/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
deleted file mode 100644
index 7f083e5c377f..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-import ./versions.nix (
-  { version, sha256 }:
-  buildGoModule {
-    pname = "honeyvent";
-    inherit version;
-    vendorHash = null;
-
-    src = fetchFromGitHub {
-      owner = "honeycombio";
-      repo = "honeyvent";
-      rev = "v${version}";
-      hash = sha256;
-    };
-
-    meta = with lib; {
-      description = "CLI for sending individual events to honeycomb.io";
-      homepage = "https://honeycomb.io/";
-      license = licenses.asl20;
-      maintainers = [ maintainers.iand675 ];
-    };
-  }
-)
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix b/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
deleted file mode 100644
index 1bf2443aa183..000000000000
--- a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-generic: {
-  v1_1_0 = generic {
-    version = "1.1.0";
-    sha256 = "sha256-yFQEOshjaH6fRCQ7IZChANI9guZlTXk35p1NzQvxUdI=";
-  };
-}
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 192f668b5ae8..0d6db8985019 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -108,7 +108,10 @@ let
 
   hasUnfreeLicense = attrs: hasLicense attrs && isUnfree attrs.meta.license;
 
-  hasNoMaintainers = attrs: attrs ? meta.maintainers && (length attrs.meta.maintainers) == 0;
+  hasNoMaintainers =
+    attrs:
+    (attrs ? meta.maintainers && (length attrs.meta.maintainers) == 0)
+    && (attrs ? meta.teams && (length attrs.meta.teams) == 0);
 
   isMarkedBroken = attrs: attrs.meta.broken or false;
 
@@ -368,6 +371,7 @@ let
         ];
       sourceProvenance = listOf attrs;
       maintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
+      teams = listOf (attrsOf any); # TODO similar to maintainers, use a teams type
       priority = int;
       pkgConfigModules = listOf str;
       inherit platforms;
@@ -534,7 +538,7 @@ let
       {
         valid = "warn";
         reason = "maintainerless";
-        errormsg = "has no maintainers";
+        errormsg = "has no maintainers or teams";
       }
     # -----
     else
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 528b96420475..fd5d8f6afc75 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2025,10 +2025,11 @@ with pkgs;
 
   birdtray = libsForQt5.callPackage ../applications/misc/birdtray { };
 
-  charles = charles4;
+  charles = charles5;
   inherit (callPackages ../applications/networking/charles { })
     charles3
     charles4
+    charles5
     ;
 
   quaternion-qt5 =
@@ -6070,11 +6071,6 @@ with pkgs;
     stdenv = gcc10Stdenv;
   };
 
-  fstar = callPackage ../development/compilers/fstar {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
-    z3 = z3_4_8_5;
-  };
-
   dotnetPackages = recurseIntoAttrs (callPackage ./dotnet-packages.nix { });
 
   gopro-tool = callPackage ../by-name/go/gopro-tool/package.nix {
@@ -8420,8 +8416,6 @@ with pkgs;
     botan3
     ;
 
-  box2d = callPackage ../development/libraries/box2d { };
-
   c-ares = callPackage ../development/libraries/c-ares { };
 
   c-aresMinimal = callPackage ../development/libraries/c-ares {
@@ -16944,19 +16938,13 @@ with pkgs;
   isabelle = callPackage ../by-name/is/isabelle/package.nix {
     polyml = polyml.overrideAttrs {
       pname = "polyml-for-isabelle";
-      version = "2024";
+      version = "2025";
       configureFlags = [
         "--enable-intinf-as-int"
         "--with-gmp"
         "--disable-shared"
       ];
       buildFlags = [ "compiler" ];
-      src = fetchFromGitHub {
-        owner = "polyml";
-        repo = "polyml";
-        rev = "v5.9.1";
-        hash = "sha256-72wm8dt+Id59A5058mVE5P9TkXW5/LZRthZoxUustVA=";
-      };
     };
 
     java = openjdk21;
@@ -18062,12 +18050,6 @@ with pkgs;
     inherit (plasma5Packages) breeze-icons;
   };
 
-  honeymarker = callPackage ../servers/tracing/honeycomb/honeymarker { };
-
-  honeytail = callPackage ../servers/tracing/honeycomb/honeytail { };
-
-  honeyvent = callPackage ../servers/tracing/honeycomb/honeyvent { };
-
   swift-corelibs-libdispatch = swiftPackages.Dispatch;
 
   aitrack = libsForQt5.callPackage ../applications/misc/aitrack { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 43c91f01609a..44cef4e10582 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -694,6 +694,7 @@ mapAliases ({
   scikits-samplerate = throw "scikits-samplerate has been removed, it was unsed and unmaintained since 2015"; # added 2024-05-23
   selectors2 = throw "selectors2 has been removed: archived by upstream."; # added 2024-07-27
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
+  sentry-sdk_2 = sentry-sdk; # added 2025-04-20
   sequoia = throw "python3Packages.sequoia was replaced by pysequoia - built from a dedicated repository, with a new API."; # added 2023-06-24
   setuptools_dso = setuptools-dso; # added 2024-03-03
   setuptools_scm = setuptools-scm; # added 2021-06-03
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 46873cef1f45..08927d57cb69 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7274,6 +7274,13 @@ self: super: with self; {
 
   kaggle = callPackage ../development/python-modules/kaggle { };
 
+  kahip = toPythonModule (
+    pkgs.kahip.override {
+      pythonSupport = true;
+      python3Packages = self;
+    }
+  );
+
   kaitaistruct = callPackage ../development/python-modules/kaitaistruct { };
 
   kajiki = callPackage ../development/python-modules/kajiki { };
@@ -15538,11 +15545,7 @@ self: super: with self; {
 
   sentinels = callPackage ../development/python-modules/sentinels { };
 
-  sentry-sdk = sentry-sdk_1;
-
-  sentry-sdk_1 = callPackage ../development/python-modules/sentry-sdk/1.nix { };
-
-  sentry-sdk_2 = callPackage ../development/python-modules/sentry-sdk/default.nix { };
+  sentry-sdk = callPackage ../development/python-modules/sentry-sdk/default.nix { };
 
   sepaxml = callPackage ../development/python-modules/sepaxml { };