diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 025a10a69825..8f9868a16ce3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5413,6 +5413,12 @@
     githubId = 64467514;
     name = "Daniel Krywult";
   };
+  danilobuerger = {
+    email = "info@danilobuerger.de";
+    github = "danilobuerger";
+    githubId = 996231;
+    name = "Danilo Bürger";
+  };
   daniyalsuri6 = {
     email = "daniyal.suri@gmail.com";
     github = "daniyalsuri6";
diff --git a/pkgs/applications/audio/bambootracker/default.nix b/pkgs/applications/audio/bambootracker/default.nix
deleted file mode 100644
index 5bf7445d2682..000000000000
--- a/pkgs/applications/audio/bambootracker/default.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  gitUpdater,
-  pkg-config,
-  qmake,
-  qt5compat ? null,
-  qtbase,
-  qttools,
-  qtwayland,
-  rtaudio_6,
-  rtmidi,
-  wrapQtAppsHook,
-}:
-
-assert lib.versionAtLeast qtbase.version "6.0" -> qt5compat != null;
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "bambootracker";
-  version = "0.6.4";
-
-  src = fetchFromGitHub {
-    owner = "BambooTracker";
-    repo = "BambooTracker";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-tFUliKR55iZybNyYIF1FXh8RGf8jKEsGrWBuldB277g=";
-  };
-
-  postPatch = lib.optionalString (lib.versionAtLeast qtbase.version "6.0") ''
-    # Work around lrelease finding in qmake being broken by using pre-Qt5.12 code path
-    # https://github.com/NixOS/nixpkgs/issues/214765
-    substituteInPlace BambooTracker/lang/lang.pri \
-      --replace 'equals(QT_MAJOR_VERSION, 5):lessThan(QT_MINOR_VERSION, 12)' 'if(true)'
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    qmake
-    qttools
-    wrapQtAppsHook
-  ];
-
-  buildInputs =
-    [
-      qtbase
-      rtaudio_6
-      rtmidi
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      qtwayland
-    ]
-    ++ lib.optionals (lib.versionAtLeast qtbase.version "6.0") [
-      qt5compat
-    ];
-
-  qmakeFlags =
-    [
-      "CONFIG+=system_rtaudio"
-      "CONFIG+=system_rtmidi"
-    ]
-    ++ lib.optionals (stdenv.cc.isClang || (lib.versionAtLeast qtbase.version "6.0")) [
-      # Clang is extra-strict about some deprecations
-      # Latest Qt6 deprecated QCheckBox::stateChanged(int)
-      "CONFIG+=no_warnings_are_errors"
-    ];
-
-  postConfigure = "make qmake_all";
-
-  # Wrapping the inside of the app bundles, avoiding double-wrapping
-  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    mv $out/{bin,Applications}/BambooTracker.app
-    ln -s $out/{Applications/BambooTracker.app/Contents/MacOS,bin}/BambooTracker
-    wrapQtApp $out/Applications/BambooTracker.app/Contents/MacOS/BambooTracker
-  '';
-
-  passthru = {
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-    };
-  };
-
-  meta = with lib; {
-    description = "Tracker for YM2608 (OPNA) which was used in NEC PC-8801/9801 series computers";
-    mainProgram = "BambooTracker";
-    homepage = "https://bambootracker.github.io/BambooTracker/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ OPNA2608 ];
-  };
-})
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index e4562b1713e7..1056575f1476 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.11.9";
-    hash = "sha256-+Bi9nHRXXZGKGvTS8o0CbtS6KBJmQz+Wiiinqs16vZA=";
+    version = "3.11.12";
+    hash = "sha256-f7IPxeF/UxywMm8yVEZV/sHTKILZ3n788bhwH4xx89I=";
   };
 
   passthru.updateScript = vscode-extensions-update-script { };
diff --git a/pkgs/applications/misc/protonup-qt/default.nix b/pkgs/applications/misc/protonup-qt/default.nix
deleted file mode 100644
index ac0fd3ad52f3..000000000000
--- a/pkgs/applications/misc/protonup-qt/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  appimageTools,
-  fetchurl,
-  lib,
-}:
-let
-  pname = "protonup-qt";
-  version = "2.12.0";
-  src = fetchurl {
-    url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-    hash = "sha256-8MeHSy3XW1oXAD2xrDSIB0ZLJxtk5UBIMpDRTPF9ksU=";
-  };
-  appimageContents = appimageTools.extractType2 { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    mkdir -p $out/share/{applications,pixmaps}
-    cp ${appimageContents}/net.davidotek.pupgui2.desktop $out/share/applications/${pname}.desktop
-    cp ${appimageContents}/net.davidotek.pupgui2.png $out/share/pixmaps/${pname}.png
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=net.davidotek.pupgui2' 'Exec=${pname}' \
-      --replace 'Icon=net.davidotek.pupgui2' 'Icon=${pname}'
-  '';
-
-  extraPkgs = pkgs: with pkgs; [ zstd ];
-
-  meta = with lib; {
-    homepage = "https://davidotek.github.io/protonup-qt/";
-    description = "Install and manage Proton-GE and Luxtorpeda for Steam and Wine-GE for Lutris with this graphical user interface";
-    license = licenses.gpl3;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    mainProgram = "protonup-qt";
-    changelog = "https://github.com/DavidoTek/ProtonUp-Qt/releases/tag/v${version}";
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ michaelBelsanti ];
-  };
-}
diff --git a/pkgs/applications/science/biology/ants/default.nix b/pkgs/applications/science/biology/ants/default.nix
index fabcfbd708dd..1f7966a64271 100644
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ANTs";
-  version = "2.5.4";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7df9RcZZwfSkokG8dMQg65bCOk2atDGkJpPo8SrRrfY=";
+    hash = "sha256-3k9EOylOAUwxBNpzi6U/XZGarCZlbh9PdecKyJh81Yk=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     for file in $out/bin/*; do
-      wrapProgram $file --set PATH "$out/bin"
+      wrapProgram $file --prefix PATH : "$out/bin"
     done
   '';
 
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 11497db66ecb..16cdee665d0d 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -18,7 +18,6 @@
   makeSetupHook,
   cacert,
   callPackage,
-  nixForLinking,
 }:
 
 let
@@ -55,7 +54,6 @@ in
           lib.makeBinPath [
             coreutils
             nix-prefetch-git
-            nixForLinking
           ]
         }
 
diff --git a/pkgs/by-name/an/anvil-editor/extras.nix b/pkgs/by-name/an/anvil-editor/extras.nix
deleted file mode 100644
index 4e130565fe4c..000000000000
--- a/pkgs/by-name/an/anvil-editor/extras.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  buildGoModule,
-  anvil-editor,
-}:
-
-buildGoModule {
-  inherit (anvil-editor) version src meta;
-
-  pname = "anvil-editor-extras";
-
-  modRoot = "anvil-extras";
-
-  vendorHash = "sha256-PH7HSMlCAHn4L1inJDbDcj6n+i6LXakIOqwdUkRjf9E=";
-}
diff --git a/pkgs/by-name/an/anvil-editor/package.nix b/pkgs/by-name/an/anvil-editor/package.nix
index 2466eb283aa0..918554209356 100644
--- a/pkgs/by-name/an/anvil-editor/package.nix
+++ b/pkgs/by-name/an/anvil-editor/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo123Module,
   fetchzip,
   pkg-config,
   copyDesktopItems,
@@ -12,26 +12,31 @@
   vulkan-headers,
   libGL,
   xorg,
-  callPackage,
   buildPackages,
-  anvilExtras ? callPackage ./extras.nix { },
 }:
 
-buildGoModule rec {
+buildGo123Module (finalAttrs: {
   pname = "anvil-editor";
-  version = "0.4";
+  version = "0.6";
 
   # has to update vendorHash of extra package manually
   # nixpkgs-update: no auto update
   src = fetchzip {
-    url = "https://anvil-editor.net/releases/anvil-src-v${version}.tar.gz";
-    hash = "sha256-0fi6UeppWC9KbWibjQYlPlRqsl9xsvij8YpJUS0S/wY=";
+    url = "https://anvil-editor.net/releases/anvil-src-v${finalAttrs.version}.tar.gz";
+    hash = "sha256-i0S5V3j6OPpu4z1ljDKP3WYa9L+EKwo/MBNgW2ENYk8=";
   };
 
   modRoot = "anvil/src/anvil";
 
   vendorHash = "sha256-1oFBV7D7JgOt5yYAxVvC4vL4ccFv3JrNngZbo+5pzrk=";
 
+  anvilExtras = buildGo123Module {
+    pname = "anvil-editor-extras";
+    inherit (finalAttrs) version src meta;
+    vendorHash = "sha256-4pfk5XuwDbCWFZIF+1l+dy8NfnGNjgHmSg9y6/RnTSo=";
+    modRoot = "anvil-extras";
+  };
+
   nativeBuildInputs =
     [
       pkg-config
@@ -60,8 +65,11 @@ buildGoModule rec {
       exec = "anvil";
       icon = "anvil";
       desktopName = "Anvil";
-      comment = meta.description;
-      categories = [ "TextEditor" ];
+      comment = finalAttrs.meta.description;
+      categories = [
+        "Utility"
+        "TextEditor"
+      ];
       startupWMClass = "anvil";
     })
   ];
@@ -76,13 +84,9 @@ buildGoModule rec {
         install -Dm644 anvil_''${square}x32.png $out/share/icons/hicolor/''${square}/apps/anvil.png
       done
     popd
-    cp ${anvilExtras}/bin/* $out/bin
+    cp ${finalAttrs.anvilExtras}/bin/* $out/bin
   '';
 
-  passthru = {
-    inherit anvilExtras;
-  };
-
   meta = {
     description = "Graphical, multi-pane tiling editor inspired by Acme";
     homepage = "https://anvil-editor.net";
@@ -91,4 +95,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = with lib.platforms; unix ++ windows;
   };
-}
+})
diff --git a/pkgs/by-name/ba/bambootracker/package.nix b/pkgs/by-name/ba/bambootracker/package.nix
new file mode 100644
index 000000000000..5b96caa3e842
--- /dev/null
+++ b/pkgs/by-name/ba/bambootracker/package.nix
@@ -0,0 +1,125 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  gitUpdater,
+  libsForQt5,
+  pkg-config,
+  qt6Packages,
+  rtaudio_6,
+  rtmidi,
+  withQt6 ? false,
+}:
+
+let
+  qtPackages = if withQt6 then qt6Packages else libsForQt5;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bambootracker" + lib.optionalString withQt6 "-qt6";
+  version = "0.6.5";
+
+  src = fetchFromGitHub {
+    owner = "BambooTracker";
+    repo = "BambooTracker";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-WoyOqInOOOIEwsMOc2yoTdh9UhJOvFKE1GfkxOuXDe0=";
+  };
+
+  patches = [
+    # Remove when version > 0.6.5
+    (fetchpatch {
+      name = "0001-bambootracker-Fix-compiler-warnings.patch";
+      url = "https://github.com/BambooTracker/BambooTracker/commit/d670cf8b6113318cd938cf19be76b6b14d3635f1.patch";
+      hash = "sha256-yyOMaOYKSc1hbbCL7wjFNPDmX2oMYo10J4hjZJss2zs=";
+    })
+
+    # Remove when version > 0.6.5
+    (fetchpatch {
+      name = "0002-bambootracker-Fix-GCC15-compat.patch";
+      url = "https://github.com/BambooTracker/BambooTracker/commit/92c0a7d1cfb05d1c6ae9482181c5c378082b772c.patch";
+      hash = "sha256-6K0RZD0LevggxFr92LaNmq+eMgOFJgFX60IgAw7tYdM=";
+    })
+
+    # Remove when version > 0.6.5
+    (fetchpatch {
+      name = "0003-bambootracker-Drop-unused-property.patch";
+      url = "https://github.com/BambooTracker/BambooTracker/commit/de4459f0315f099d3e0a2d20b938ec76285f2d46.patch";
+      hash = "sha256-zTh6i+hgQZ3kEid0IzQaR/PsrYlnhplccdlaS5g8FeA=";
+    })
+  ];
+
+  postPatch = lib.optionalString withQt6 ''
+    # Work around lrelease finding in qmake being broken by using pre-Qt5.12 code path
+    # https://github.com/NixOS/nixpkgs/issues/214765
+    substituteInPlace BambooTracker/lang/lang.pri \
+      --replace 'equals(QT_MAJOR_VERSION, 5):lessThan(QT_MINOR_VERSION, 12)' 'if(true)'
+  '';
+
+  nativeBuildInputs =
+    [
+      pkg-config
+    ]
+    ++ (with qtPackages; [
+      qmake
+      qttools
+      wrapQtAppsHook
+    ]);
+
+  buildInputs =
+    [
+      rtaudio_6
+      rtmidi
+    ]
+    ++ (
+      with qtPackages;
+      [
+        qtbase
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        qtwayland
+      ]
+      ++ lib.optionals withQt6 [
+        qt5compat
+      ]
+    );
+
+  qmakeFlags =
+    [
+      "CONFIG+=system_rtaudio"
+      "CONFIG+=system_rtmidi"
+    ]
+    ++ lib.optionals stdenv.cc.isClang [
+      # Clang is extra-strict about some deprecations
+      # https://github.com/BambooTracker/BambooTracker/issues/506
+      "CONFIG+=no_warnings_are_errors"
+    ];
+
+  postConfigure = "make qmake_all";
+
+  # Wrapping the inside of the app bundles, avoiding double-wrapping
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    mv $out/{bin,Applications}/BambooTracker.app
+    ln -s $out/{Applications/BambooTracker.app/Contents/MacOS,bin}/BambooTracker
+    wrapQtApp $out/Applications/BambooTracker.app/Contents/MacOS/BambooTracker
+  '';
+
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+  };
+
+  meta = {
+    description = "Tracker for YM2608 (OPNA) which was used in NEC PC-8801/9801 series computers";
+    mainProgram = "BambooTracker";
+    homepage = "https://bambootracker.github.io/BambooTracker/";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+  };
+})
diff --git a/pkgs/by-name/bs/bstone/package.nix b/pkgs/by-name/bs/bstone/package.nix
index f0bf4886ae6f..667d52a09088 100644
--- a/pkgs/by-name/bs/bstone/package.nix
+++ b/pkgs/by-name/bs/bstone/package.nix
@@ -3,8 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  SDL2,
-  libGL,
+  sdl2-compat,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -23,8 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    libGL
-    SDL2
+    sdl2-compat
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/bu/buffrs/package.nix b/pkgs/by-name/bu/buffrs/package.nix
new file mode 100644
index 000000000000..0b17c5e9d2cd
--- /dev/null
+++ b/pkgs/by-name/bu/buffrs/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "buffrs";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "helsing-ai";
+    repo = "buffrs";
+    tag = "v${version}";
+    hash = "sha256-c9GjSqVp2wEFgoy8j+Gy5FA3SG4JYEfeSwPWjW81w3Y=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-E7kskULt2eOY+mZjh6jAftj8ciExUF7d1z1pePTBzvQ=";
+
+  # Disabling tests meant to work over the network, as they will fail
+  # inside the builder.
+  checkFlags = [
+    "--skip=cmd::install::upgrade::fixture"
+    "--skip=cmd::publish::lib::fixture"
+    "--skip=cmd::publish::local::fixture"
+    "--skip=cmd::tuto::fixture"
+  ];
+
+  meta = {
+    description = "Modern protobuf package management";
+    homepage = "https://github.com/helsing-ai/buffrs";
+    license = lib.licenses.asl20;
+    mainProgram = "buffrs";
+    maintainers = with lib.maintainers; [ danilobuerger ];
+  };
+}
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index bdf13f371b85..33a053d1e725 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.104";
+  version = "1.0.106";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     rev = version;
-    hash = "sha256-PSiuTw3H3vl4Tnts5eOTd1v8SLPvYZCkuQ/pTSa3O18=";
+    hash = "sha256-7j8i0wvbbAFPNgHamy+lybQpz1ht+n90oidVGSXP6MA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-apFOBEao2DKsdjdth+vGzzRa9Mw7fTb/88TetY0vp6E=";
+  cargoHash = "sha256-e6K97VUsCYx56Y9r7QPVBV3eMwWnjEhZoEKpmuKmkJk=";
 
   meta = with lib; {
     description = "Cargo subcommand to show result of macro expansion";
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 31be64525d5e..bef80f5a04bb 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  sound-theme-freedesktop,
   rustPlatform,
   libcosmicAppHook,
   pulseaudio,
@@ -20,6 +21,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-ezOeRgqI/GOWFknUVZI7ZLEy1GYaBI+/An83HWKL6ho=";
   };
 
+  postPatch = ''
+    substituteInPlace src/components/app.rs \
+      --replace-fail '/usr/share/sounds/freedesktop/stereo/audio-volume-change.oga' '${sound-theme-freedesktop}/share/sounds/freedesktop/stereo/audio-volume-change.oga'
+  '';
+
   useFetchCargoVendor = true;
   cargoHash = "sha256-vYehF2RjPrTZiuGcRUe4XX3ftRo7f+SIoKizD/kOtR8=";
 
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index 16aa5fd8d4f5..5453a266f42e 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,12 +21,12 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-03-27";
+  version = "0-unstable-2025-04-07";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "779126e8670cb471fc35e07c9f6a958638bbd9e3";
-    hash = "sha256-xYd4KSLcuc1u6JV67UgW9FgkQGwQZLjlvpmngnWc0ew=";
+    rev = "7cb0f63341ca728c2d0f53c94fadfd20dd307186";
+    hash = "sha256-xEKOEEGyfrfCGzI2+brkVwHcKKKLctNU+adgzVNGses=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/db/dbus-cpp/package.nix b/pkgs/by-name/db/dbus-cpp/package.nix
index b9ab77c35dd5..976125f91625 100644
--- a/pkgs/by-name/db/dbus-cpp/package.nix
+++ b/pkgs/by-name/db/dbus-cpp/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   testers,
   boost186,
@@ -20,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-cpp";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lib-cpp/dbus-cpp";
-    rev = finalAttrs.version;
-    hash = "sha256-t8SzPRUuKeEchT8vAsITf8MwbgHA+mR5C9CnkdVyX7s=";
+    tag = finalAttrs.version;
+    hash = "sha256-ki4bnwRpvmB9yzt/Mn3MQs1Dr6Vrcs2D0tvCjvvfmq4=";
   };
 
   outputs = [
@@ -36,39 +35,22 @@ stdenv.mkDerivation (finalAttrs: {
     "examples"
   ];
 
-  patches = [
-    # Handle already-stolen dbus call better
-    # Remove when version > 5.0.3
-    (fetchpatch {
-      name = "0001-dbus-cpp-src-Dont-steal-a-pending-dbus-call-more-then-once.patch";
-      url = "https://gitlab.com/ubports/development/core/lib-cpp/dbus-cpp/-/commit/9f3d1ff2b1c6c732285949c3dbb35e40cf55ea92.patch";
-      hash = "sha256-xzOCIJVsK2J+X9RsV930R9uw6h4UxqwSaNOgv8v4qQU=";
-    })
-
-    # Fix GCC13 compilation
-    # Remove when version > 5.0.3
-    (fetchpatch {
-      name = "0002-dbus-cpp-Add-missing-headers-for-GCC13.patch";
-      url = "https://gitlab.com/ubports/development/core/lib-cpp/dbus-cpp/-/commit/c761b1eec084962dbe64d35d7f7b86dcbe57a3f7.patch";
-      hash = "sha256-/tKe3iHWxP9jWtpdgwwRynj8565u9LxCt4WXJDXzgX4=";
-    })
-  ];
-
   postPatch =
     ''
       substituteInPlace doc/CMakeLists.txt \
-        --replace 'DESTINATION share/''${CMAKE_PROJECT_NAME}/doc' 'DESTINATION ''${CMAKE_INSTALL_DOCDIR}'
+        --replace-fail 'DESTINATION share/''${CMAKE_PROJECT_NAME}/doc' 'DESTINATION ''${CMAKE_INSTALL_DOCDIR}'
 
       # Warning on aarch64-linux breaks build due to -Werror
       substituteInPlace CMakeLists.txt \
-        --replace '-Werror' ""
+        --replace-fail '-Werror' ""
 
       # pkg-config output patching hook expects prefix variable here
       substituteInPlace data/dbus-cpp.pc.in \
-        --replace 'includedir=''${exec_prefix}' 'includedir=''${prefix}'
+        --replace-fail 'includedir=''${exec_prefix}' 'includedir=''${prefix}'
     ''
     + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
-      sed -i -e '/add_subdirectory(tests)/d' CMakeLists.txt
+      substituteInPlace CMakeLists.txt \
+        --replace-fail 'add_subdirectory(tests)' '# add_subdirectory(tests)'
     '';
 
   strictDeps = true;
@@ -98,11 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DDBUS_CPP_ENABLE_DOC_GENERATION=ON"
+    (lib.cmakeBool "DBUS_CPP_ENABLE_DOC_GENERATION" true)
   ];
 
-  # Too flaky on ARM CI & for some amd64 users
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   # DBus, parallelism messes with communication
   enableParallelChecking = false;
@@ -112,17 +93,21 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
     updateScript = gitUpdater { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Dbus-binding leveraging C++-11";
     homepage = "https://gitlab.com/ubports/development/core/lib-cpp/dbus-cpp";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ OPNA2608 ];
+    changelog = "https://gitlab.com/ubports/development/core/lib-cpp/dbus-cpp/-/blob/${finalAttrs.version}/ChangeLog";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
     mainProgram = "dbus-cppc";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     pkgConfigModules = [
       "dbus-cpp"
     ];
diff --git a/pkgs/by-name/fa/fanficfare/package.nix b/pkgs/by-name/fa/fanficfare/package.nix
index 3b9290e1bb51..5593fbf59678 100644
--- a/pkgs/by-name/fa/fanficfare/package.nix
+++ b/pkgs/by-name/fa/fanficfare/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "fanficfare";
-  version = "4.43.0";
+  version = "4.44.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uaYMmb896gJ31nbcGJs42jlSpvHUTvpLlD00r1icXRY=";
+    hash = "sha256-3+2T3qUk9tbQD+GxM2S+iDWNlKE+f3GplBoYIJGAJKE=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/gi/gitea/package.nix b/pkgs/by-name/gi/gitea/package.nix
index 5420ca4ae351..36806807c20e 100644
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@@ -35,13 +35,13 @@ let
 in
 buildGoModule rec {
   pname = "gitea";
-  version = "1.23.6";
+  version = "1.23.7";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${gitea.version}";
-    hash = "sha256-psVny0qmx2wPiNK1qIXQiW0gdRsZs16MEfIgBXTWgFI=";
+    hash = "sha256-pdmRujcLnQBIQXc26MPpoLbbV00KMaVHPY4xTsitaCA=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/go/gops/package.nix b/pkgs/by-name/go/gops/package.nix
index 2aeb490fa3f6..0975a213b853 100644
--- a/pkgs/by-name/go/gops/package.nix
+++ b/pkgs/by-name/go/gops/package.nix
@@ -2,22 +2,23 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gops";
   version = "0.3.28";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gops";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-HNM487WSfNWNF31ccDIdotsEG8Mj2C7V85UI47a9drU=";
   };
 
   vendorHash = "sha256-ptC2G7cXcAjthJcAXvuBqI2ZpPuSMBqzO+gJiyaAUP0=";
 
-  preCheck = "export HOME=$(mktemp -d)";
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   meta = with lib; {
     description = "Tool to list and diagnose Go processes currently running on your system";
@@ -26,4 +27,4 @@ buildGoModule rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ pborzenkov ];
   };
-}
+})
diff --git a/pkgs/by-name/ht/html-minifier/package.nix b/pkgs/by-name/ht/html-minifier/package.nix
index 81bf3e65fdf8..45d4e247bebb 100644
--- a/pkgs/by-name/ht/html-minifier/package.nix
+++ b/pkgs/by-name/ht/html-minifier/package.nix
@@ -19,6 +19,10 @@ buildNpmPackage rec {
 
   npmFlags = [ "--ignore-scripts" ];
 
+  postInstall = ''
+    find $out/lib/node_modules -xtype l -delete
+  '';
+
   dontNpmBuild = true;
 
   meta = {
diff --git a/pkgs/by-name/ic/icestudio/package.nix b/pkgs/by-name/ic/icestudio/package.nix
index c1f3d027e7b4..37255829871d 100644
--- a/pkgs/by-name/ic/icestudio/package.nix
+++ b/pkgs/by-name/ic/icestudio/package.nix
@@ -118,7 +118,7 @@ buildNpmPackage rec {
         rcoeurjoly
         amerino
       ]
-      ++ [ lib.teams.ngi ];
+      ++ lib.teams.ngi.members;
     mainProgram = "icestudio";
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ju/judy/package.nix b/pkgs/by-name/ju/judy/package.nix
index df21e56c30ba..df3e01552303 100644
--- a/pkgs/by-name/ju/judy/package.nix
+++ b/pkgs/by-name/ju/judy/package.nix
@@ -23,11 +23,6 @@ stdenv.mkDerivation rec {
     ./fix-source-date.patch
   ];
 
-  # fixes non-determinism between builds on macos
-  preConfigure = lib.optional stdenv.hostPlatform.isDarwin ''
-    export LDFLAGS="$LDFLAGS -Wl,-no_uuid -Wl,-install_name,@rpath/libJudy.1.dylib"
-  '';
-
   # Disable parallel builds as manpages lack some dependencies:
   #    ../tool/jhton ext/JudyHS_funcs_3.htm | grep -v '^[   ]*$' | sed -e 's/\.C//' > man/man3/JudyHS_funcs
   #    make[2]: *** No rule to make target 'man/man3/JSLD', needed by 'all-am'.  Stop.
diff --git a/pkgs/by-name/ka/kargo/package.nix b/pkgs/by-name/ka/kargo/package.nix
index 64e66069958e..cb74557dc06a 100644
--- a/pkgs/by-name/ka/kargo/package.nix
+++ b/pkgs/by-name/ka/kargo/package.nix
@@ -11,22 +11,22 @@
 
 buildGoModule rec {
   pname = "kargo";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${version}";
-    hash = "sha256-sLcNY6TopRObyU+TAFsX8odRJTo9BufCKb/pKhg9pwA=";
+    hash = "sha256-1zPSYvAhobhcZWIeIh0zTYPMg32r4PATvBIfKEcg9IU=";
   };
 
-  vendorHash = "sha256-Xb+9zu2uivOYETtz3ryMnBUJ3gJ/1ta1dLEpsD00jpU=";
+  vendorHash = "sha256-+c7cUCI6Yy3qzDOWWvqEGss6QvTrS3gYScm8M48rGVA=";
 
   subPackages = [ "cmd/cli" ];
 
   ldflags =
     let
-      package_url = "github.com/akuity/kargo/internal/version";
+      package_url = "github.com/akuity/kargo/pkg/x/version";
     in
     [
       "-s"
diff --git a/pkgs/by-name/ma/mathgl/package.nix b/pkgs/by-name/ma/mathgl/package.nix
index 45095e7f2bf7..6d5f8cee965a 100644
--- a/pkgs/by-name/ma/mathgl/package.nix
+++ b/pkgs/by-name/ma/mathgl/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "mathgl";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mathgl/mathgl-${version}.tar.gz";
-    sha256 = "sha256-cWYJlWhKawooI/Z49sQ4q6ukdKEVJGzfX5sLRgq/ysE=";
+    sha256 = "sha256-m7qe5qD4bRuPPzugN008t3b3ctu28aAWhMpsC9ViBNY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/morgen/package.nix b/pkgs/by-name/mo/morgen/package.nix
index af0a0de53770..048c9ed7710e 100644
--- a/pkgs/by-name/mo/morgen/package.nix
+++ b/pkgs/by-name/mo/morgen/package.nix
@@ -16,12 +16,12 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "3.6.10";
+  version = "3.6.11";
 
   src = fetchurl {
     name = "morgen-${version}.deb";
     url = "https://dl.todesktop.com/210203cqcj00tw1/versions/${version}/linux/deb";
-    hash = "sha256-//HXWx0vi2lbCeZr+QMfif6B8MiCAdRDullQ1QlIZu8=";
+    hash = "sha256-vn3V7TXWMPesZt+65FAeNzUo8n4P9XfSIFnCDvLaZOI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index c0bea6fdd240..50bf731bdeae 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -184,6 +184,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
     tests = {
       pythonMujoco = python3Packages.mujoco;
+      pythonMujocoMjx = python3Packages.mujoco-mjx;
     };
   };
 
diff --git a/pkgs/by-name/mu/mum/package.nix b/pkgs/by-name/mu/mum/package.nix
new file mode 100644
index 000000000000..0cc9ce86e3ab
--- /dev/null
+++ b/pkgs/by-name/mu/mum/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  gdk-pixbuf,
+  glib,
+  libnotify,
+  libopus,
+  openssl,
+  versionCheckHook,
+  nix-update-script,
+  installShellFiles,
+
+  withNotifications ? true,
+  withOgg ? true,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mum";
+  version = "0.5.1";
+  src = fetchFromGitHub {
+    owner = "mum-rs";
+    repo = "mum";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-r2isuwXq79dOQQWB+CsofYCLQYu9VKm7kzoxw103YV4=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ey3nT6vZ5YOZGk08HykK9RxI7li+Sz+sER3HioGSXP0=";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    installShellFiles
+  ];
+
+  buildInputs = [
+    alsa-lib
+    gdk-pixbuf
+    glib
+    libopus
+    openssl
+  ] ++ lib.optional withNotifications libnotify;
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = lib.optional withNotifications "notifications" ++ lib.optional withOgg "ogg";
+
+  postInstall = ''
+    installManPage documentation/*.{1,5}
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mumctl";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Daemon/cli mumble client";
+    homepage = "https://github.com/mum-rs/mum";
+    changelog = "https://github.com/mum-rs/mum/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ lykos153 ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/by-name/na/nauty/package.nix b/pkgs/by-name/na/nauty/package.nix
index 0963586a049d..bff4157ce7b8 100644
--- a/pkgs/by-name/na/nauty/package.nix
+++ b/pkgs/by-name/na/nauty/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nauty";
-  version = "2.8.8";
+  version = "2.8.9";
 
   src = fetchurl {
     url = "https://pallini.di.uniroma1.it/nauty${
       builtins.replaceStrings [ "." ] [ "_" ] version
     }.tar.gz";
-    sha256 = "sha256-FZ0hVoEKa7JAQQzWHrZBrdhQiNnxXIiM2qN7hoH5Kc4=";
+    sha256 = "sha256-yXq0K/SHlqhqWYvOPpJpBHyisywU/CPgcgiiRP5SxO4=";
   };
 
   outputs = [
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
+  # HACK: starting from 2.8.9, the makefile tries to copy .libs/*.a files unconditionally
+  dontDisableStatic = true;
+
   configureFlags = [
     # Prevent nauty from sniffing some cpu features. While those are very
     # widely available, it can lead to nasty bugs when they are not available:
diff --git a/pkgs/tools/security/netexec/default.nix b/pkgs/by-name/ne/netexec/package.nix
similarity index 96%
rename from pkgs/tools/security/netexec/default.nix
rename to pkgs/by-name/ne/netexec/package.nix
index f3145427148f..0b7913cd8657 100644
--- a/pkgs/tools/security/netexec/default.nix
+++ b/pkgs/by-name/ne/netexec/package.nix
@@ -98,12 +98,12 @@ python.pkgs.buildPythonApplication rec {
     export HOME=$(mktemp -d)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Network service exploitation tool (maintained fork of CrackMapExec)";
     homepage = "https://github.com/Pennyw0rth/NetExec";
     changelog = "https://github.com/Pennyw0rth/NetExec/releases/tag/v${version}";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ vncsb ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ vncsb ];
     mainProgram = "nxc";
     # FIXME: failing fixupPhase:
     # $ Rewriting #!/nix/store/<hash>-python3-3.11.7/bin/python3.11 to #!/nix/store/<hash>-python3-3.11.7
diff --git a/pkgs/by-name/on/onionshare/package.nix b/pkgs/by-name/on/onionshare/package.nix
index d025d96e35a6..640caf9ed2a1 100644
--- a/pkgs/by-name/on/onionshare/package.nix
+++ b/pkgs/by-name/on/onionshare/package.nix
@@ -15,6 +15,7 @@
   versionCheckHook,
   gitUpdater,
   onionshare-gui,
+  writableTmpDirAsHomeHook,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "onionshare-cli";
@@ -95,16 +96,12 @@ python3Packages.buildPythonApplication rec {
   nativeCheckInputs =
     [
       versionCheckHook
+      writableTmpDirAsHomeHook
     ]
     ++ (with python3Packages; [
       pytestCheckHook
     ]);
 
-  preCheck = ''
-    # Tests use the home directory
-    export HOME="$(mktemp -d)"
-  '';
-
   disabledTests =
     lib.optionals stdenv.hostPlatform.isLinux [
       "test_get_tor_paths_linux" # expects /usr instead of /nix/store
diff --git a/pkgs/applications/science/electronics/openroad/default.nix b/pkgs/by-name/op/openroad/package.nix
similarity index 55%
rename from pkgs/applications/science/electronics/openroad/default.nix
rename to pkgs/by-name/op/openroad/package.nix
index ef9db55ef3f5..2023f2606825 100644
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/by-name/op/openroad/package.nix
@@ -1,50 +1,45 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   bison,
   cmake,
   doxygen,
   flex,
-  git,
-  python3,
+  gitMinimal,
+  gtest,
+  libsForQt5,
+  pkg-config,
   swig,
+
+  # buildInputs
   boost186, # 1.87.0 broken https://github.com/boostorg/asio/issues/442
   cbc, # for clp
   cimg,
   clp, # for or-tools
   cudd,
   eigen,
-  gtest,
   glpk,
   lcov,
   lemon-graph,
-  libsForQt5,
   libjpeg,
   or-tools,
   pcre,
-  pkg-config,
+  python3,
   re2, # for or-tools
   readline,
   spdlog,
   tcl,
   tclPackages,
-  xorg,
   yosys,
   zlib,
+  xorg,
   llvmPackages,
-  stdenv,
 }:
 
-let
-  or-tools-static = or-tools.overrideAttrs (oldAttrs: {
-    cmakeFlags = oldAttrs.cmakeFlags ++ [
-      # https://github.com/google/or-tools/issues/3709
-      "-DBUILD_SHARED_LIBS=OFF"
-    ];
-  });
-in
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "openroad";
   version = "2.0-unstable-2025-03-01";
 
@@ -61,39 +56,42 @@ mkDerivation rec {
     cmake
     doxygen
     flex
-    git
+    gitMinimal
     gtest
+    libsForQt5.wrapQtAppsHook
     pkg-config
     swig
   ];
 
-  buildInputs = [
-    boost186
-    cbc
-    cimg
-    clp
-    cudd
-    eigen
-    glpk
-    lcov
-    lemon-graph
-    libjpeg
-    or-tools-static
-    pcre
-    python3
-    libsForQt5.qtbase
-    libsForQt5.qtcharts
-    libsForQt5.qtsvg
-    libsForQt5.qtdeclarative
-    re2
-    readline
-    spdlog
-    tcl
-    tclPackages.tclreadline
-    yosys
-    xorg.libX11
-    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
+  buildInputs =
+    [
+      boost186
+      cbc
+      cimg
+      clp
+      cudd
+      eigen
+      glpk
+      lcov
+      lemon-graph
+      libjpeg
+      libsForQt5.qtbase
+      libsForQt5.qtcharts
+      libsForQt5.qtdeclarative
+      libsForQt5.qtsvg
+      or-tools
+      pcre
+      python3
+      re2
+      readline
+      spdlog
+      tcl
+      tclPackages.tclreadline
+      yosys
+      zlib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
 
   postPatch = ''
     patchShebangs --build etc/find_messages.py
@@ -103,18 +101,18 @@ mkDerivation rec {
 
   cmakeFlags =
     [
-      "-DENABLE_TESTS=ON"
-      "-DUSE_SYSTEM_BOOST=ON"
-      "-DUSE_SYSTEM_ABC=OFF"
-      "-DABC_SKIP_TESTS=ON" # it attempts to download gtest
-      "-DUSE_SYSTEM_OPENSTA=OFF"
-      "-DOPENROAD_VERSION=${version}_${src.rev}"
-      "-DCMAKE_RULE_MESSAGES=OFF"
-      "-DTCL_HEADER=${tcl}/include/tcl.h"
-      "-DTCL_LIBRARY=${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}"
+      (lib.cmakeBool "ENABLE_TESTS" true)
+      (lib.cmakeBool "USE_SYSTEM_BOOST" true)
+      (lib.cmakeBool "USE_SYSTEM_ABC" false)
+      (lib.cmakeBool "ABC_SKIP_TESTS" true) # it attempts to download gtest
+      (lib.cmakeBool "USE_SYSTEM_OPENSTA" false)
+      (lib.cmakeFeature "OPENROAD_VERSION" "${version}_${src.rev}")
+      (lib.cmakeBool "CMAKE_RULE_MESSAGES" false)
+      (lib.cmakeFeature "TCL_HEADER" "${tcl}/include/tcl.h")
+      (lib.cmakeFeature "TCL_LIBRARY" "${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}")
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "-DCMAKE_CXX_FLAGS=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED"
+      (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED")
     ];
 
   # Resynthesis needs access to the Yosys binaries.
@@ -130,18 +128,22 @@ mkDerivation rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
+    runHook preInstallCheck
+
     $out/bin/openroad -version
     $out/bin/sta -version
+
+    runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     description = "OpenROAD's unified application implementing an RTL-to-GDS flow";
     homepage = "https://theopenroadproject.org";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
       trepetti
       hzeller
     ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/pd/pdi/package.nix b/pkgs/by-name/pd/pdi/package.nix
index a759cf478556..3e78fa6de6c9 100644
--- a/pkgs/by-name/pd/pdi/package.nix
+++ b/pkgs/by-name/pd/pdi/package.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdi";
-  version = "1.8.3";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "pdidev";
     repo = "pdi";
     tag = finalAttrs.version;
-    hash = "sha256-oiHkCXQZGeijoJf8XpbBPdxmxClWyCsnv6laDdMXk6U=";
+    hash = "sha256-eWBbhHBDS2NbY74vbeD/+UDdpam4XiX7loYb1chjryo=";
   };
 
   # Current hdf5 version in nixpkgs is 1.14.4.3 which is 4 numbers long and doesn't match the 3 number regex. :')
diff --git a/pkgs/servers/peertube/default.nix b/pkgs/by-name/pe/peertube/package.nix
similarity index 95%
rename from pkgs/servers/peertube/default.nix
rename to pkgs/by-name/pe/peertube/package.nix
index e62bf9005deb..0f99e03bab15 100644
--- a/pkgs/servers/peertube/default.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@@ -10,7 +10,7 @@
   fixup-yarn-lock,
   jq,
   fd,
-  nodejs,
+  nodejs_18,
   which,
   yarn,
 }:
@@ -48,33 +48,33 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peertube";
-  version = "6.3.3";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "Chocobozzz";
     repo = "PeerTube";
     tag = "v${version}";
-    hash = "sha256-kPZcCJtnoqE1g0fAuM98IhuDy1E9QBDkFNWrWIpFIDA=";
+    hash = "sha256-DoUSzqb8lrU+s5R95rxCN/5A8sgb11edAhv0T6YACRo=";
   };
 
   yarnOfflineCacheServer = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-I6TC5KO+NQ0NAtoJzYQPLelp8/hYUtIeof+UI45qpdk=";
+    hash = "sha256-WLaIIyz6SEekLFeVO39Swpny5/x5Jc1zoxy/6bmOXTk=";
   };
 
   yarnOfflineCacheClient = fetchYarnDeps {
     yarnLock = "${src}/client/yarn.lock";
-    hash = "sha256-ADck9+5TDZ3OGInZ+NYYpBg9XXHugtiwyxYCYqSIOzM=";
+    hash = "sha256-/ZdORSnwk29ubsgKKB7RfHCetODNOH9DzkflQdDsMz0=";
   };
 
   yarnOfflineCacheAppsCli = fetchYarnDeps {
     yarnLock = "${src}/apps/peertube-cli/yarn.lock";
-    hash = "sha256-t5MwysPVLbtIfDhvnwWoGocck1ntP8OP9Vf9DF6L7Cg=";
+    hash = "sha256-lcWtZGE/6XGm8KXmzSowCHAb/vGwBoqkwk32Ru3mMYU=";
   };
 
   yarnOfflineCacheAppsRunner = fetchYarnDeps {
     yarnLock = "${src}/apps/peertube-runner/yarn.lock";
-    hash = "sha256-x5qFCprn8q0xC88HudLV7W53X1Nkbz3F52RMp2PxIu8=";
+    hash = "sha256-R7oXJUT698l2D1WkQGTWfkmbC7bC1XJ04xT0O8bwuI8=";
   };
 
   outputs = [
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     fd
   ];
 
-  buildInputs = [ nodejs ];
+  buildInputs = [ nodejs_18 ];
 
   buildPhase = ''
     # Build node modules
diff --git a/pkgs/by-name/pk/pkg/package.nix b/pkgs/by-name/pk/pkg/package.nix
index 8a3739410c4c..af42943ebc52 100644
--- a/pkgs/by-name/pk/pkg/package.nix
+++ b/pkgs/by-name/pk/pkg/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pkg";
-  version = "2.0.6";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "freebsd";
     repo = "pkg";
     rev = finalAttrs.version;
-    hash = "sha256-NTjAhqCUN2bN4ilijoeHHIkl58XXP5nSj/yLUL0N2fw=";
+    hash = "sha256-tOHt5Ra628qg/4N7fkUnL/xq4qV6Vmv2vsJpwSaDba8=";
   };
 
   setOutputFlags = false;
diff --git a/pkgs/by-name/pl/planarity/package.nix b/pkgs/by-name/pl/planarity/package.nix
index c7e11394511b..32c19c891b0d 100644
--- a/pkgs/by-name/pl/planarity/package.nix
+++ b/pkgs/by-name/pl/planarity/package.nix
@@ -3,21 +3,23 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
+  pkg-config,
 }:
 
 stdenv.mkDerivation rec {
   pname = "planarity";
-  version = "3.0.2.0";
+  version = "4.0.0.0";
 
   src = fetchFromGitHub {
     owner = "graph-algorithms";
     repo = "edge-addition-planarity-suite";
     rev = "Version_${version}";
-    sha256 = "sha256-cUAh2MXCSmtxFtV6iTHgSRgsq/26DjWwxhWJH1+367A=";
+    sha256 = "sha256-A7huHvMgUyvw2zM9qA7Ax/1Ai5VZ6A1PZIo3eiCpu44=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
+    pkg-config
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index 8e5de5a58e6d..c656b6c5f7fd 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YDYVjAbizmo1+E1DVeyISKM4Jb/HkKY/On9RanJBuvI=";
+    hash = "sha256-SQ2jf0YWmDN0Yce2lmTpD11zLdUz2otm98TO/agaY28=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/protonup-qt/package.nix b/pkgs/by-name/pr/protonup-qt/package.nix
new file mode 100644
index 000000000000..2034a0f939af
--- /dev/null
+++ b/pkgs/by-name/pr/protonup-qt/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  makeWrapper,
+}:
+
+appimageTools.wrapAppImage rec {
+  pname = "protonup-qt";
+  version = "2.12.0";
+
+  src = appimageTools.extractType2 {
+    inherit pname version;
+    src = fetchurl {
+      url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
+      hash = "sha256-8MeHSy3XW1oXAD2xrDSIB0ZLJxtk5UBIMpDRTPF9ksU=";
+    };
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  extraInstallCommands = ''
+    install -Dm644 ${src}/net.davidotek.pupgui2.desktop $out/share/applications/protonup-qt.desktop
+    install -Dm644 ${src}/net.davidotek.pupgui2.png $out/share/pixmaps/protonup-qt.png
+    substituteInPlace $out/share/applications/protonup-qt.desktop \
+      --replace-fail "Exec=net.davidotek.pupgui2" "Exec=protonup-qt" \
+      --replace-fail "Icon=net.davidotek.pupgui2" "Icon=protonup-qt"
+    wrapProgram $out/bin/protonup-qt \
+      --unset QT_PLUGIN_PATH \
+      --unset QML2_IMPORT_PATH
+  '';
+
+  extraPkgs = pkgs: with pkgs; [ zstd ];
+
+  meta = {
+    homepage = "https://davidotek.github.io/protonup-qt/";
+    description = "Install and manage Proton-GE and Luxtorpeda for Steam and Wine-GE for Lutris with this graphical user interface";
+    license = lib.licenses.gpl3Plus;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "protonup-qt";
+    changelog = "https://github.com/DavidoTek/ProtonUp-Qt/releases/tag/v${version}";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ michaelBelsanti ];
+  };
+}
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index ffbd140a6627..2fc8cc93982b 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.230.0";
+  version = "0.236.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-aWml3iTcci1V8RkiCrvv+E7zmW5JJCDzDNv2RaDhjAg=";
+    sha256 = "sha256-sL/TBcUtHYqZuUp5JlcKshwlyVSf0t0XukMmRkWRyvk=";
   };
 
-  vendorHash = "sha256-soDM7IfgTKWZnFNfGSlKH4aScGr1A26OZrgqiJ5UAlA=";
+  vendorHash = "sha256-Uw4A6RBq0OiBHWRfmj9wKI2FenDN6C8CWEsKicGS/1Q=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sb/sbom-utility/name.patch b/pkgs/by-name/sb/sbom-utility/name.patch
new file mode 100644
index 000000000000..0edbb05706d4
--- /dev/null
+++ b/pkgs/by-name/sb/sbom-utility/name.patch
@@ -0,0 +1,13 @@
+diff --git a/cmd/root.go b/cmd/root.go
+index 5ef5d46..e99b245 100644
+--- a/cmd/root.go
++++ b/cmd/root.go
+@@ -139,7 +139,7 @@ const (
+ )
+ 
+ var rootCmd = &cobra.Command{
+-	Use:           fmt.Sprintf("%s [command] [flags]", utils.GlobalFlags.Project),
++	Use:           fmt.Sprintf("sbom-utility [command] [flags]"),
+ 	SilenceErrors: false,
+ 	SilenceUsage:  false,
+ 	Short:         MSG_APP_NAME,
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
index e6f4ac7a5701..6ebfbcbfe73d 100644
--- a/pkgs/by-name/sb/sbom-utility/package.nix
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -2,11 +2,18 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  fetchpatch,
+  versionCheckHook,
+  installShellFiles,
+  stdenv,
 }:
 
-buildGoModule rec {
-  pname = "sbom-utility";
+let
   version = "0.17.0";
+in
+buildGoModule {
+  pname = "sbom-utility";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
@@ -17,10 +24,40 @@ buildGoModule rec {
 
   vendorHash = "sha256-vyYSir5u6d5nv+2ScrHpasQGER4VFSoLb1FDUDIrtDM=";
 
+  patches = [
+    # work around https://github.com/CycloneDX/sbom-utility/issues/121, which otherwise
+    # breaks shell completions
+    ./name.patch
+    # Output logs to stderr rather than stdout.
+    # Patch of https://github.com/CycloneDX/sbom-utility/pull/122, adapted to apply
+    # against v0.17.0
+    ./stderr.patch
+  ];
+
+  ldflags = [
+    "-X main.Version=${version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   preCheck = ''
     cd test
   '';
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    for shell in bash fish zsh; do
+      installShellCompletion --cmd sbom-utility \
+        --$shell <($out/bin/sbom-utility -q completion $shell)
+    done
+  '';
+
   meta = with lib; {
     description = "Utility that provides an API platform for validating, querying and managing BOM data";
     homepage = "https://github.com/CycloneDX/sbom-utility";
diff --git a/pkgs/by-name/sb/sbom-utility/stderr.patch b/pkgs/by-name/sb/sbom-utility/stderr.patch
new file mode 100644
index 000000000000..779c53d624d9
--- /dev/null
+++ b/pkgs/by-name/sb/sbom-utility/stderr.patch
@@ -0,0 +1,67 @@
+diff --git a/log/log.go b/log/log.go
+index 2615f0a..c82b6c5 100644
+--- a/log/log.go
++++ b/log/log.go
+@@ -104,7 +104,7 @@ func NewDefaultLogger() *MiniLogger {
+ 		tagEnter:        DEFAULT_ENTER_TAG,
+ 		tagExit:         DEFAULT_EXIT_TAG,
+ 		tagColor:        color.New(color.FgMagenta),
+-		outputFile:      os.Stdout,
++		outputFile:      os.Stderr,
+ 		maxStrLength:    64,
+ 	}
+ 
+@@ -361,7 +361,7 @@ func (log MiniLogger) dumpInterface(lvl Level, tag string, value interface{}, sk
+ 			}
+ 
+ 			// TODO: use a general output writer (set to stdout, stderr, or file stream)
+-			fmt.Println(sb.String())
++			fmt.Fprintln(log.outputFile, sb.String())
+ 		} else {
+ 			os.Stderr.WriteString("Error: Unable to retrieve call stack. Exiting...")
+ 			os.Exit(-2)
+@@ -370,7 +370,7 @@ func (log MiniLogger) dumpInterface(lvl Level, tag string, value interface{}, sk
+ }
+ 
+ func (log MiniLogger) DumpString(value string) {
+-	fmt.Print(value)
++	fmt.Fprint(log.outputFile, value)
+ }
+ 
+ func (log MiniLogger) DumpStruct(structName string, field interface{}) error {
+@@ -389,7 +389,7 @@ func (log MiniLogger) DumpStruct(structName string, field interface{}) error {
+ 	}
+ 
+ 	// TODO: print to output stream
+-	fmt.Println(sb.String())
++	fmt.Fprintln(log.outputFile, sb.String())
+ 
+ 	return nil
+ }
+@@ -398,8 +398,8 @@ func (log MiniLogger) DumpArgs() {
+ 	args := os.Args
+ 	for i, a := range args {
+ 		// TODO: print to output stream
+-		fmt.Print(log.indentRunes)
+-		fmt.Printf("os.Arg[%d]: `%v`\n", i, a)
++		fmt.Fprint(log.outputFile, log.indentRunes)
++		fmt.Fprintf(log.outputFile, "os.Arg[%d]: `%v`\n", i, a)
+ 	}
+ }
+ 
+@@ -409,7 +409,7 @@ func (log MiniLogger) DumpSeparator(sep byte, repeat int) (string, error) {
+ 		for i := 0; i < repeat; i++ {
+ 			sb.WriteByte(sep)
+ 		}
+-		fmt.Println(sb.String())
++		fmt.Fprintln(log.outputFile, sb.String())
+ 		return sb.String(), nil
+ 	} else {
+ 		return "", errors.New("invalid repeat length (>80)")
+@@ -417,5 +417,5 @@ func (log MiniLogger) DumpSeparator(sep byte, repeat int) (string, error) {
+ }
+ 
+ func (log *MiniLogger) DumpStackTrace() {
+-	fmt.Println(string(debug.Stack()))
++	fmt.Fprintln(log.outputFile, string(debug.Stack()))
+ }
diff --git a/pkgs/by-name/so/sou/package.nix b/pkgs/by-name/so/sou/package.nix
new file mode 100644
index 000000000000..0ee536e93a07
--- /dev/null
+++ b/pkgs/by-name/so/sou/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "sou";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "knqyf263";
+    repo = "sou";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uGYCmW60OvEfserujQMXC9r8S8W+EN+w9EXUGjk1vtw=";
+  };
+
+  vendorHash = "sha256-6kgiZx/g1PA7R50z7noG+ql+S9wSgTuVTkY5DIqeJHY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheck = [ versionCheckHook ];
+
+  # Some of the tests use localhost networking
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for exploring files in container image layers";
+    homepage = "https://github.com/knqyf263/sou";
+    changelog = "https://github.com/knqyf263/sou/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nicolas-goudry ];
+    mainProgram = "sou";
+  };
+})
diff --git a/pkgs/by-name/sy/syndicate-server/package.nix b/pkgs/by-name/sy/syndicate-server/package.nix
index 51df682001f9..480de7622fed 100644
--- a/pkgs/by-name/sy/syndicate-server/package.nix
+++ b/pkgs/by-name/sy/syndicate-server/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "syndicate-server";
-  version = "0.48.0";
+  version = "0.50.1";
   src = fetchFromGitea {
     domain = "git.syndicate-lang.org";
     owner = "syndicate-lang";
     repo = "syndicate-rs";
     rev = "${pname}-v${version}";
-    hash = "sha256-DVgFlJCqaTmQ7eL2LQ8rkIbvaEfwx+NDeXRA8qB+/Qo=";
+    hash = "sha256-orQN83DE+ZNgdx2PVcYrte/rVDFFtuQuRDKzeumpsLo=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-P/NYyoH/9kkyBwCGORK9bxEjyye12SP3hRDnL9c6i78=";
+  cargoHash = "sha256-lR36UAMedPdfvX613adxxRzJe+Ri09hiZYanyu7xbLU=";
   nativeBuildInputs = [
     pkg-config
     versionCheckHook
@@ -27,6 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
+  doCheck = false;
   doInstallCheck = true;
 
   meta = {
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 30ed1b44393a..0a46eeb6575e 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.25.6";
+  version = "1.25.7";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${version}";
-    hash = "sha256-9mj88mUCpMPBIUrwAL61/XAtn3OQ3EtdP8ZlQBHE4/I=";
+    hash = "sha256-lTUS3sAMq5FPxC8Moi6a+S71XtG+9AlBTO/cDVTrncM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-K/vtA6Gr015xwuJBge+QDW3MQMJNyKyfxtkV6fs/zmE=";
+  cargoHash = "sha256-3oallbuiRrBDAWsIl8vGz3xbjPIb5ceBmQsNHVOWbTE=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/tr/trojan-go/package.nix b/pkgs/by-name/tr/trojan-go/package.nix
index 40087b8834b7..7724ca0924a6 100644
--- a/pkgs/by-name/tr/trojan-go/package.nix
+++ b/pkgs/by-name/tr/trojan-go/package.nix
@@ -19,6 +19,20 @@ buildGoModule rec {
 
   vendorHash = "sha256-c6H/8/dmCWasFKVR15U/kty4AzQAqmiL/VLKrPtH+s4=";
 
+  ldflags = [
+    "-X github.com/p4gefau1t/trojan-go/constant.Version=v${version}"
+    "-X github.com/p4gefau1t/trojan-go/constant.Commit=v${version}"
+  ];
+
+  tags = [
+    "api"
+    "client"
+    "server"
+    "forward"
+    "nat"
+    "other"
+  ];
+
   # tests fail due to requiring networking
   doCheck = false;
 
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 66ef766b6532..6fc2ca44b045 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "updatecli";
-  version = "0.96.0";
+  version = "0.97.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${version}";
-    hash = "sha256-znl0yUqnN9eQHY18wPfcYiUnsGw349tLSkZNa/Wz2KA=";
+    hash = "sha256-3I7SRtbMKPm/j8bdIvVHkRy/5Jq8goZ0hyREsfsM5OU=";
   };
 
-  vendorHash = "sha256-jUVoNTA1wVHNjxkLBgERo8650dxpzmuVBGiAw5sUql0=";
+  vendorHash = "sha256-LUc73GyBj72kwQXUEnwkkGPmkIXhAhiKJiLcc1IiAps=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/zi/zircolite/package.nix b/pkgs/by-name/zi/zircolite/package.nix
index ba0623617869..687126aa0187 100644
--- a/pkgs/by-name/zi/zircolite/package.nix
+++ b/pkgs/by-name/zi/zircolite/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "zircolite";
-  version = "2.30.1";
+  version = "2.40.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "wagga40";
     repo = "Zircolite";
     tag = version;
-    hash = "sha256-9stQa0EMNA/qEN+bU7qBOdcwUR1vMGk70Br6wxRK8cs=";
+    hash = "sha256-11jNd7Ids2aB+R+Hv6n8Wfm2hDuKCxC0EMZSBWJfDos=";
   };
 
   __darwinAllowLocalNetworking = true;
@@ -58,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "SIGMA-based detection tool for EVTX, Auditd, Sysmon and other logs";
     mainProgram = "zircolite";
     homepage = "https://github.com/wagga40/Zircolite";
-    changelog = "https://github.com/wagga40/Zircolite/releases/tag/${version}";
+    changelog = "https://github.com/wagga40/Zircolite/releases/tag/${src.tag}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/compilers/dotnet/combine-packages.nix b/pkgs/development/compilers/dotnet/combine-packages.nix
index d040faab1069..f755c1065410 100644
--- a/pkgs/development/compilers/dotnet/combine-packages.nix
+++ b/pkgs/development/compilers/dotnet/combine-packages.nix
@@ -26,6 +26,7 @@ mkWrapper "sdk" (
     paths = dotnetPackages;
     pathsToLink = map (x: "/share/dotnet/${x}") [
       "host"
+      "metadata"
       "packs"
       "sdk"
       "sdk-manifests"
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 40ba605fe792..c3ec333ba589 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -549,24 +549,24 @@ self: super:
 
   # Manually maintained
   cachix-api = overrideCabal (drv: {
-    version = "1.7.7";
+    version = "1.7.8";
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
-      rev = "v1.7.7";
-      hash = "sha256-D0gP8srrX0qj+wNYNPdtVJsQuFzIng3q43thnHXQ/es=";
+      tag = "v1.7.8";
+      hash = "sha256-pb5aYkE8FOoa4n123slgHiOf1UbNSnKe5pEZC+xXD5g=";
     };
     postUnpack = "sourceRoot=$sourceRoot/cachix-api";
   }) super.cachix-api;
   cachix = (
     overrideCabal
       (drv: {
-        version = "1.7.7";
+        version = "1.7.8";
         src = pkgs.fetchFromGitHub {
           owner = "cachix";
           repo = "cachix";
-          rev = "v1.7.7";
-          hash = "sha256-D0gP8srrX0qj+wNYNPdtVJsQuFzIng3q43thnHXQ/es=";
+          tag = "v1.7.8";
+          hash = "sha256-pb5aYkE8FOoa4n123slgHiOf1UbNSnKe5pEZC+xXD5g=";
         };
         postUnpack = "sourceRoot=$sourceRoot/cachix";
       })
diff --git a/pkgs/development/libraries/sundials/default.nix b/pkgs/development/libraries/sundials/default.nix
index d06696d71709..c02d10409b6f 100644
--- a/pkgs/development/libraries/sundials/default.nix
+++ b/pkgs/development/libraries/sundials/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "sundials";
-  version = "7.2.1";
+  version = "7.3.0";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LLNL/sundials/releases/download/v${version}/sundials-${version}.tar.gz";
-    hash = "sha256-N4Hj983zcsoS9/vmT1Yai5pQe4qLLE1s4o2OTfS+++o=";
+    hash = "sha256-/ZcKkCP46je4HFBlwGe/Fyb2VrOfWQe0gWmm+Y0wa6c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index ac310bb2e652..2218b5e0f82f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -3564,15 +3564,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lze";
-      version = "0.11.0-1";
+      version = "0.11.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lze-0.11.0-1.rockspec";
-          sha256 = "05465ndcfvvyvvxz8h7xm9vrcfbfhvs6sbrcy73cl5s44r46ym00";
+          url = "mirror://luarocks/lze-0.11.1-1.rockspec";
+          sha256 = "1wikzksjz7nqshnc6pbdaq5yfa4cxc5kh06shvahfxxwz2n3q7i4";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/BirdeeHub/lze/archive/v0.11.0.zip";
-        sha256 = "1awqix5xx4pkv09gba5xwv67qyi2qzf9aji48bk2xr431vshz5jv";
+        url = "https://github.com/BirdeeHub/lze/archive/v0.11.1.zip";
+        sha256 = "14lx8addmi1zr57141gvwlv0i7rgachybfynmmw8bqkadhwaz470";
       };
 
       disabled = luaOlder "5.1";
@@ -3595,15 +3595,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lzextras";
-      version = "0.3.0-1";
+      version = "0.4.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lzextras-0.3.0-1.rockspec";
-          sha256 = "1w8ar8qi1hnbnj70f3lhrzf0hp1d0jbvya9v318pqcd16wh7x6ii";
+          url = "mirror://luarocks/lzextras-0.4.0-1.rockspec";
+          sha256 = "12s4jy3xqzb1dcan0gmgza6c9wyh44h348f4m3zzj29icffx4vyv";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/BirdeeHub/lzextras/archive/v0.3.0.zip";
-        sha256 = "0942wnlk7cf74z2ni3dhv2zm8ld4nazs9ciaql00vvbswh4a9z2w";
+        url = "https://github.com/BirdeeHub/lzextras/archive/v0.4.0.zip";
+        sha256 = "1c92vm5q9vrr1imc3h9z9vvpkhlayywgk1n3wfkqbfi37ni066kw";
       };
 
       disabled = luaOlder "5.1";
diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
new file mode 100644
index 000000000000..5610ee08f322
--- /dev/null
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  stdenv,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
+  dm-env,
+  etils,
+  flask,
+  flask-cors,
+  flax,
+  grpcio,
+  gym,
+  jax,
+  jaxlib,
+  jaxopt,
+  jinja2,
+  ml-collections,
+  mujoco,
+  mujoco-mjx,
+  numpy,
+  optax,
+  orbax-checkpoint,
+  pillow,
+  pytinyrenderer,
+  scipy,
+  tensorboardx,
+  trimesh,
+
+  # tests
+  pytestCheckHook,
+  pytest-xdist,
+  transforms3d,
+}:
+
+buildPythonPackage rec {
+  pname = "brax";
+  version = "0.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "brax";
+    tag = "v${version}";
+    hash = "sha256-whkkqTTy5CY6soyS5D7hWtBZuVHc6si1ArqwLgzHDkw=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    absl-py
+    # TODO: remove dm_env after dropping legacy v1 code
+    dm-env
+    etils
+    flask
+    flask-cors
+    flax
+    # TODO: remove grpcio and gym after dropping legacy v1 code
+    grpcio
+    gym
+    jax
+    jaxlib
+    jaxopt
+    jinja2
+    ml-collections
+    mujoco
+    mujoco-mjx
+    numpy
+    optax
+    orbax-checkpoint
+    pillow
+    # TODO: remove pytinyrenderer after dropping legacy v1 code
+    pytinyrenderer
+    scipy
+    tensorboardx
+    trimesh
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-xdist
+    transforms3d
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isAarch64 [
+    # Flaky:
+    # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
+    "test_pendulum_period2"
+  ];
+
+  disabledTestPaths = [
+    # ValueError: matmul: Input operand 1 has a mismatch in its core dimension
+    "brax/generalized/constraint_test.py"
+  ];
+
+  pythonImportsCheck = [
+    "brax"
+  ];
+
+  meta = {
+    description = "Massively parallel rigidbody physics simulation on accelerator hardware";
+    homepage = "https://github.com/google/brax";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+}
diff --git a/pkgs/development/python-modules/marimo/default.nix b/pkgs/development/python-modules/marimo/default.nix
index b7b65365794f..40c8b266e840 100644
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@@ -33,13 +33,13 @@
 
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.12.0";
+  version = "0.12.2";
   pyproject = true;
 
   # The github archive does not include the static assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cZK0Z4pN8oYdBvJd5JeSAMdexiF4H/fVIj7bVLp5Ww8=";
+    hash = "sha256-FrOuujO0YUneQYQdnVKKzJIGqfcUoHDWpf28SJlAgOY=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/mujoco-mjx/default.nix b/pkgs/development/python-modules/mujoco-mjx/default.nix
new file mode 100644
index 000000000000..7073dc4484d1
--- /dev/null
+++ b/pkgs/development/python-modules/mujoco-mjx/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+
+  # src / metadata
+  mujoco-main,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
+  etils,
+  importlib-resources,
+  jax,
+  jaxlib,
+  mujoco,
+  scipy,
+  trimesh,
+}:
+
+buildPythonPackage {
+  pname = "mujoco-mjx";
+  inherit (mujoco-main) src version;
+
+  pyproject = true;
+
+  sourceRoot = "${mujoco-main.src.name}/mjx";
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    absl-py
+    etils
+    importlib-resources
+    jax
+    jaxlib
+    mujoco
+    scipy
+    trimesh
+  ] ++ etils.optional-dependencies.epath;
+
+  pythonImportsCheck = [ "mujoco.mjx" ];
+
+  meta = {
+    description = "MuJoCo XLA (MJX)";
+    inherit (mujoco.meta) homepage changelog license;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyghmi/default.nix b/pkgs/development/python-modules/pyghmi/default.nix
index 5919b94fbeb9..002585da278f 100644
--- a/pkgs/development/python-modules/pyghmi/default.nix
+++ b/pkgs/development/python-modules/pyghmi/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "pyghmi";
-  version = "1.5.76";
+  version = "1.5.77";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nJEL9x/+fZT/vpAKL5qVLXYVPcMvUXT9WSEvHzOrGZU=";
+    hash = "sha256-RGV3d944MKrbuBM/eX9NIyHiasmLkkHH+zyeEjkIt7U=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytinyrenderer/default.nix b/pkgs/development/python-modules/pytinyrenderer/default.nix
new file mode 100644
index 000000000000..c2dc075095de
--- /dev/null
+++ b/pkgs/development/python-modules/pytinyrenderer/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pytinyrenderer";
+  version = "0.0.14";
+  pyproject = true;
+
+  # github has no tags
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-X+20eYUJy5EaA6O8no3o1NWqNrHeUuuHjv7xBLlaPRU=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pytinyrenderer"
+  ];
+
+  # There are no tests in the pypi archive
+  doCheck = false;
+
+  meta = {
+    description = "Python bindings for Tiny Renderer";
+    homepage = "https://pypi.org/project/pytinyrenderer/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+}
diff --git a/pkgs/tools/security/ecryptfs/helper.nix b/pkgs/tools/security/ecryptfs/helper.nix
deleted file mode 100644
index 4f2070f8bd28..000000000000
--- a/pkgs/tools/security/ecryptfs/helper.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  makeWrapper,
-  python2,
-}:
-
-stdenv.mkDerivation {
-  pname = "ecryptfs-helper";
-  version = "20160722";
-
-  src = fetchurl {
-    url = "https://gist.githubusercontent.com/obadz/ec053fdb00dcb48441d8313169874e30/raw/4b657a4b7c3dc684e4d5e3ffaf46ced1b7675163/ecryptfs-helper.py";
-    sha256 = "0gp4m22zc80814ng80s38hp930aa8r4zqihr7jr23m0m2iq4pdpg";
-  };
-
-  dontUnpack = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  # Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers/bin
-  installPhase = ''
-    mkdir -p $out/bin $out/libexec
-    cp $src $out/libexec/ecryptfs-helper.py
-    makeWrapper "${python2.interpreter}" "$out/bin/ecryptfs-helper" --add-flags "$out/libexec/ecryptfs-helper.py"
-  '';
-
-  meta = with lib; {
-    description = "Helper script to create/mount/unemount encrypted directories using eCryptfs without needing root permissions";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ obadz ];
-    platforms = platforms.linux;
-    hydraPlatforms = [ ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1a578c9a45bb..316906540e2e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -533,6 +533,7 @@ mapAliases {
   ec2_api_tools = throw "'ec2_api_tools' has been renamed to/replaced by 'ec2-api-tools'"; # Converted to throw 2024-10-17
   ec2-utils = amazon-ec2-utils; # Added 2022-02-01
 
+  ecryptfs-helper = throw "'ecryptfs-helper' has been removed, for filesystem-level encryption, use fscrypt"; # Added 2025-04-08
   edUnstable = throw "edUnstable was removed; use ed instead"; # Added 2024-07-01
   edgedb = throw "edgedb replaced to gel because of change of upstream"; # Added 2025-02-24
   elasticsearch7Plugins = elasticsearchPlugins;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 89d21cf89714..95ea8417ef57 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3251,8 +3251,6 @@ with pkgs;
 
   ecryptfs = callPackage ../tools/security/ecryptfs { };
 
-  ecryptfs-helper = callPackage ../tools/security/ecryptfs/helper.nix { };
-
   eid-mw = callPackage ../tools/security/eid-mw {
     autoreconfHook = buildPackages.autoreconfHook269;
   };
@@ -4183,8 +4181,6 @@ with pkgs;
 
   nanoemoji = with python3Packages; toPythonApplication nanoemoji;
 
-  netexec = callPackage ../tools/security/netexec { };
-
   netdata = callPackage ../tools/system/netdata {
     protobuf = protobuf_21;
   };
@@ -13837,8 +13833,7 @@ with pkgs;
 
   av-98 = callPackage ../applications/networking/browsers/av-98 { };
 
-  bambootracker = libsForQt5.callPackage ../applications/audio/bambootracker { };
-  bambootracker-qt6 = qt6Packages.callPackage ../applications/audio/bambootracker { };
+  bambootracker-qt6 = bambootracker.override { withQt6 = true; };
 
   schismtracker = callPackage ../applications/audio/schismtracker {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
@@ -14758,8 +14753,6 @@ with pkgs;
 
   pixinsight = qt6Packages.callPackage ../applications/graphics/pixinsight { };
 
-  protonup-qt = python3Packages.callPackage ../applications/misc/protonup-qt { };
-
   inherit (callPackage ../applications/virtualization/singularity/packages.nix { })
     apptainer
     singularity
@@ -15775,10 +15768,6 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
-  peertube = callPackage ../servers/peertube {
-    nodejs = nodejs_18;
-  };
-
   photoflare = libsForQt5.callPackage ../applications/graphics/photoflare { };
 
   phototonic = libsForQt5.callPackage ../applications/graphics/phototonic { };
@@ -18503,8 +18492,6 @@ with pkgs;
     qcsxcad = libsForQt5.qcsxcad;
   };
 
-  openroad = libsForQt5.callPackage ../applications/science/electronics/openroad { };
-
   qucs-s = qt6Packages.callPackage ../applications/science/electronics/qucs-s { };
 
   xyce = callPackage ../applications/science/electronics/xyce { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e13cf1dbdae3..a3aa35983e4f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2025,6 +2025,8 @@ self: super: with self; {
 
   bravia-tv = callPackage ../development/python-modules/bravia-tv { };
 
+  brax = callPackage ../development/python-modules/brax { };
+
   breathe = callPackage ../development/python-modules/breathe { };
 
   breezy = callPackage ../development/python-modules/breezy { };
@@ -9089,6 +9091,8 @@ self: super: with self; {
 
   mujoco = callPackage ../development/python-modules/mujoco { inherit (pkgs) mujoco; };
 
+  mujoco-mjx = callPackage ../development/python-modules/mujoco-mjx { mujoco-main = pkgs.mujoco; };
+
   mujson = callPackage ../development/python-modules/mujson { };
 
   mullvad-api = callPackage ../development/python-modules/mullvad-api { };
@@ -14268,6 +14272,8 @@ self: super: with self; {
 
   pytimeparse2 = callPackage ../development/python-modules/pytimeparse2 { };
 
+  pytinyrenderer = callPackage ../development/python-modules/pytinyrenderer { };
+
   pytlv = callPackage ../development/python-modules/pytlv { };
 
   pytm = callPackage ../development/python-modules/pytm { };