diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 7f4b38f06f2a..428f2e247bcc 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
+      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 19bfdd4f9f79..f9fd85a58dab 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Build codeowners validator
         run: nix-build base/ci -A codeownersValidator
 
-      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
+      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -96,7 +96,7 @@ jobs:
       # This is intentional, because we need to request the review of owners as declared in the base branch.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
+      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index a9fecb67b645..beb993655af9 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -241,7 +241,7 @@ jobs:
     steps:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
+      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 12c6907f95e6..84ef484d969f 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
+      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/ci/OWNERS b/ci/OWNERS
index c64ef4208e30..170bc964a3a7 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -443,3 +443,9 @@ pkgs/by-name/lx/lxc*                    @adamcstephens
 /pkgs/by-name/ap/apple-sdk                     @NixOS/darwin-core
 /pkgs/os-specific/darwin/apple-source-releases @NixOS/darwin-core
 /pkgs/stdenv/darwin                            @NixOS/darwin-core
+
+# BEAM
+pkgs/development/beam-modules/          @NixOS/beam
+pkgs/development/interpreters/erlang/   @NixOS/beam
+pkgs/development/interpreters/elixir/   @NixOS/beam
+pkgs/development/interpreters/lfe/      @NixOS/beam
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5653007c42b0..9d90ff6dd4f4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23466,6 +23466,12 @@
     github = "tie";
     githubId = 14792994;
   };
+  tiferrei = {
+    name = "Tiago Ferreira";
+    email = "me@tiferrei.com";
+    github = "tiferrei";
+    githubId = 8849915;
+  };
   tilcreator = {
     name = "TilCreator";
     email = "contact.nixos@tc-j.de";
diff --git a/nixos/modules/image/images.nix b/nixos/modules/image/images.nix
index 6040a5c76182..3f57b2dcf606 100644
--- a/nixos/modules/image/images.nix
+++ b/nixos/modules/image/images.nix
@@ -45,7 +45,7 @@ let
     sd-card = {
       imports =
         let
-          module = ../. + "/installer/sd-card/sd-image-${pkgs.targetPlatform.linuxArch}.nix";
+          module = ../. + "/installer/sd-card/sd-image-${pkgs.targetPlatform.qemuArch}.nix";
         in
         if builtins.pathExists module then [ module ] else throw "The module ${module} does not exist.";
     };
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index a0b59e0362a9..e14391b857e1 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3422,112 +3422,21 @@ let
         };
       };
 
-      ms-pyright.pyright = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "pyright";
-          publisher = "ms-pyright";
-          version = "1.1.300";
-          hash = "sha256-GzRJeV4qfgM2kBv6U3MH7lMWl3CL6LWPI/9GaVWZL+o=";
-        };
-        meta = {
-          description = "VS Code static type checking for Python";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-pyright.pyright";
-          homepage = "https://github.com/Microsoft/pyright#readme";
-          changelog = "https://marketplace.visualstudio.com/items/ms-pyright.pyright/changelog";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.ratsclub ];
-        };
-      };
+      ms-pyright.pyright = callPackage ./ms-pyright.pyright { };
 
-      ms-python.black-formatter = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "black-formatter";
-          publisher = "ms-python";
-          version = "2024.2.0";
-          hash = "sha256-qIO+YqTXjwgznzUlnPSts1R2BM6iN8B9vESkelGPgZM=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/ms-python.black-formatter/changelog";
-          description = "Formatter extension for Visual Studio Code using black";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.black-formatter";
-          homepage = "https://github.com/microsoft/vscode-black-formatter";
-          license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [
-            amadejkastelic
-            sikmir
-          ];
-        };
-      };
+      ms-python.black-formatter = callPackage ./ms-python.black-formatter { };
 
-      ms-python.flake8 = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "flake8";
-          publisher = "ms-python";
-          version = "2023.10.0";
-          hash = "sha256-4Vjw8yJPrxLg0hcoTw8AEBEcmQ9sEUNqFaHLxICks0E=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/ms-python.flake8/changelog";
-          description = "Python linting support for VS Code using Flake8";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.flake8";
-          homepage = "https://github.com/microsoft/vscode-flake8";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.amadejkastelic ];
-        };
-      };
+      ms-python.flake8 = callPackage ./ms-python.flake8 { };
 
-      ms-python.isort = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "isort";
-          publisher = "ms-python";
-          version = "2023.10.1";
-          hash = "sha256-NRsS+mp0pIhGZiqxAMXNZ7SwLno9Q8pj+RS1WB92HzU=";
-        };
-        meta = with lib; {
-          description = "Import sorting extension for Visual Studio Code using isort";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.isort";
-          homepage = "https://github.com/microsoft/vscode-isort";
-          license = licenses.mit;
-          maintainers = with maintainers; [ sikmir ];
-        };
-      };
+      ms-python.isort = callPackage ./ms-python.isort { };
 
-      ms-python.pylint = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "pylint";
-          publisher = "ms-python";
-          version = "2023.10.1";
-          hash = "sha256-1tI5u33c5CHFQxkJZ/OxW3ZA5qPr4RoCIf6dqIMPykQ=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/ms-python.pylint/changelog";
-          description = "Python linting support for VS Code using Pylint";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.pylint";
-          homepage = "https://github.com/microsoft/vscode-pylint";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.amadejkastelic ];
-        };
-      };
+      ms-python.pylint = callPackage ./ms-python.pylint { };
 
       ms-python.mypy-type-checker = callPackage ./ms-python.mypy-type-checker { };
 
       ms-python.python = callPackage ./ms-python.python { };
 
-      ms-python.debugpy = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "debugpy";
-          publisher = "ms-python";
-          version = "2024.6.0";
-          hash = "sha256-VlPe65ViBur5P6L7iRKdGnmbNlSCwYrdZAezStx8Bz8=";
-        };
-        meta = {
-          description = "Python debugger (debugpy) extension for VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.debugpy";
-          homepage = "https://github.com/Microsoft/vscode-python-debugger";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.carlthome ];
-        };
-      };
+      ms-python.debugpy = callPackage ./ms-python.debugpy { };
 
       ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };
 
diff --git a/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix b/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
new file mode 100644
index 000000000000..5dce86ab3a80
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ms-pyright";
+    name = "pyright";
+    version = "1.1.394";
+    hash = "sha256-LQYC4dZ0lJ+NkQjRGW0HQ16TK2NI0ZK2IYytkxoBhR0=";
+  };
+
+  meta = {
+    description = "VS Code static type checking for Python";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-pyright.pyright";
+    homepage = "https://github.com/Microsoft/pyright#readme";
+    changelog = "https://marketplace.visualstudio.com/items/ms-pyright.pyright/changelog";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ratsclub ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.black-formatter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.black-formatter/default.nix
new file mode 100644
index 000000000000..01fc206f6217
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.black-formatter/default.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ms-python";
+    name = "black-formatter";
+    version = "2024.6.0";
+    hash = "sha256-Waw+WhazNqVoihC/K/tPFH4tCeYYVOFDBfg+AWvs3q4=";
+  };
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/ms-python.black-formatter/changelog";
+    description = "Formatter extension for Visual Studio Code using black";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.black-formatter";
+    homepage = "https://github.com/microsoft/vscode-black-formatter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      amadejkastelic
+      sikmir
+    ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
new file mode 100644
index 000000000000..a6b60a7e8663
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "debugpy";
+    publisher = "ms-python";
+    version = "2024.6.0";
+    hash = "sha256-VlPe65ViBur5P6L7iRKdGnmbNlSCwYrdZAezStx8Bz8=";
+  };
+
+  meta = {
+    description = "Python debugger (debugpy) extension for VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.debugpy";
+    homepage = "https://github.com/Microsoft/vscode-python-debugger";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.carlthome ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
new file mode 100644
index 000000000000..c667d8bd8fae
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ms-python";
+    name = "flake8";
+    version = "2025.1.10441012";
+    hash = "sha256-Ed5cojxQzH0+j3oW7EnEk4ptsngYwTLz52Pcb3G6bNs=";
+  };
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/ms-python.flake8/changelog";
+    description = "Python linting support for VS Code using Flake8";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.flake8";
+    homepage = "https://github.com/microsoft/vscode-flake8";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.amadejkastelic ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix
new file mode 100644
index 000000000000..06b7c1dceab7
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix
@@ -0,0 +1,20 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ms-python";
+    name = "isort";
+    version = "2023.13.13171013";
+    hash = "sha256-UBV9i3LPVv60+toy+kJvESAuJHRmH/uEIwjTidYUXLc=";
+  };
+  meta = with lib; {
+    description = "Import sorting extension for Visual Studio Code using isort";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.isort";
+    homepage = "https://github.com/microsoft/vscode-isort";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
index 67f045c70787..6bbd336d3b2f 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
@@ -5,10 +5,10 @@
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
-    name = "mypy-type-checker";
     publisher = "ms-python";
-    version = "2025.1.10381011";
-    hash = "sha256-boKUxLOAgQJP13zX/NMhg1MtcrPVQJt5gLbxI7gVSu4=";
+    name = "mypy-type-checker";
+    version = "2025.1.10451009";
+    hash = "sha256-Q6wfbm3FMNe0VB29QOf5ulTelGVmZVHUnmK17vbrqWc=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix
new file mode 100644
index 000000000000..e9c7d050c8ef
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ms-python";
+    name = "pylint";
+    version = "2024.2.0";
+    hash = "sha256-z9bfV2JPFyDk+bgWFYua2462df36MZy3GSVKhrm2Q6Q=";
+  };
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/ms-python.pylint/changelog";
+    description = "Python linting support for VS Code using Pylint";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.pylint";
+    homepage = "https://github.com/microsoft/vscode-pylint";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.amadejkastelic ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
index 19f8a59e37ec..aeddb79a2792 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@@ -21,8 +21,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2024.15.2024091301";
-    hash = "sha256-MB8Vq2rjO37yW3Zh+f8ek/yz0qT+ZYHn/JnF5ZA6CXQ=";
+    version = "2025.1.2025021102";
+    hash = "sha256-qXQrBEKzZthZu1fdnRJXjryyHjpcxJA4c5LrhOI3deM=";
   };
 
   buildInputs = [ icu ];
diff --git a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
index ceece0447b0f..039847f85ca9 100644
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@@ -10,26 +10,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-q9ubYkhrV28sB9CV1dyBEIFEkTrkGHRXdz5+4xjeVzI=";
+          hash = "sha256-ub19F5vWUWg2eWUg/lst/+GrCsw6o6yeRQ9Lnb83Oow=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-vV5u1QBICz3GIYRgH9UWM38a8YXtvW0u8r7c1SaKwxM=";
+          hash = "sha256-sNxpfCZbT4rCBn7fYBimFiNsMg72i8GmLfK7EP+8hHg=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-fgT4brIhHI6gNCcsbHpz+v4/diyox2VoFlvCnhPIbPM=";
+          hash = "sha256-snPaNPNTHFHZmaXckcjQuHTw/LvwaEj9irRLXnyrGHU=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
+          hash = "sha256-wcNms02vhe3WSWn0HE7owf/0W25EZvkLvRn2oQJewd4=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.13.4";
+      version = "0.13.6";
     }
     // sources.${stdenvNoCC.system} or (throw "Unsupported system ${stdenvNoCC.system}");
 
diff --git a/pkgs/by-name/ba/backblaze-b2/package.nix b/pkgs/by-name/ba/backblaze-b2/package.nix
index 54c2e9f1ef3d..e2bb597d683f 100644
--- a/pkgs/by-name/ba/backblaze-b2/package.nix
+++ b/pkgs/by-name/ba/backblaze-b2/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "4.2.0";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "B2_Command_Line_Tool";
     tag = "v${version}";
-    hash = "sha256-a0XJq8M1yw4GmD5ndIAJtmHFKqS0rYdvYIxK7t7oyZw=";
+    hash = "sha256-ZDjKDLxzz6sHH0VnLlVvmQ0BSbmDBpujDgrtCEmZ2hU=";
   };
 
   nativeBuildInputs = with python3Packages; [
@@ -44,6 +44,8 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
+  pythonRelaxDeps = [ "phx-class-registry" ];
+
   nativeCheckInputs = with python3Packages; [
     backoff
     more-itertools
diff --git a/pkgs/by-name/be/bend/package.nix b/pkgs/by-name/be/bend/package.nix
index 0a2a095bd384..7f0c34b0fcc0 100644
--- a/pkgs/by-name/be/bend/package.nix
+++ b/pkgs/by-name/be/bend/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "Bend";
-  version = "0.2.36";
+  version = "0.2.37";
 
   src = fetchFromGitHub {
     owner = "HigherOrderCO";
     repo = "Bend";
     tag = version;
-    hash = "sha256-j4YMdeSxIbhp7xT42L42/y0ZncFPKBkxTh0LgO/RjkY=";
+    hash = "sha256-8uBEI9GKUETk8t6Oanb0OECe3MlJ486QnccOuhIxPuY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mGpH08VMmqoxXm8EUPdsBvSW/CFyRPY4bfyr8JI1es0=";
+  cargoHash = "sha256-xac5Gb0hcamT3vymq6SKaMiuEn8NU9Bfhu+t/dcjhTE=";
 
   nativeBuildInputs = [
     hvm
diff --git a/pkgs/by-name/bo/boundary/package.nix b/pkgs/by-name/bo/boundary/package.nix
index ebc99ceddaeb..fa832eb72b7c 100644
--- a/pkgs/by-name/bo/boundary/package.nix
+++ b/pkgs/by-name/bo/boundary/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "boundary";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src =
     let
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-Wp1gPFQkOv+ZCEy0D2Tw9l6aCZekdpkXYcTZNheJHEg=";
-        aarch64-linux = "sha256-jBYu4m3L+j/coJ4D9cPA8mSBYiLiUyVKp98x6mdrrrk=";
-        x86_64-darwin = "sha256-OuiF1pgutt69ghlkLkEwkWMIFjvAsY7YUZERHNiToMs=";
-        aarch64-darwin = "sha256-sYKA02euri/K8FM8GoY7Y/WWLE2nBSoiNoxSdUPunWA=";
+        x86_64-linux = "sha256-tqgY0308n3F/ZYGhn3bAsHa4cBdFz0oGgSHI6y6J1LY=";
+        aarch64-linux = "sha256-vvc8rOpyOd91crZTQQofj3RixUuWHe7SbMM0BZDkdRw=";
+        x86_64-darwin = "sha256-wsI8hqULVN+W6zwQsXcWQHbxmocrijsl5eUJgUxLxf8=";
+        aarch64-darwin = "sha256-S0QXBBiO2qgSazjtwd1bWgL/6gJUimKYPv369L419UU=";
       };
     in
     fetchzip {
diff --git a/pkgs/by-name/br/brush/package.nix b/pkgs/by-name/br/brush/package.nix
new file mode 100644
index 000000000000..34dc141a49bd
--- /dev/null
+++ b/pkgs/by-name/br/brush/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  testers,
+  runCommand,
+  writeText,
+  nix-update-script,
+  brush,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "brush";
+  version = "0.2.15";
+
+  src = fetchFromGitHub {
+    owner = "reubeno";
+    repo = "brush";
+    tag = "brush-shell-v${version}";
+    hash = "sha256-hPF2nXYXAM+5Lz2VJw9vZ6RFZ40y+YkO94Jc/sLUYsg=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-A4v4i6U6BwUMNTI/TO7wTQvNVtQYKGiQfDXOCy8hFTE=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = [ "--version" ];
+
+  # Found argument '--test-threads' which wasn't expected, or isn't valid in this context
+  doCheck = false;
+
+  passthru = {
+    tests = {
+      complete = testers.testEqualContents {
+        assertion = "brushinfo performs to inspect completions";
+        expected = writeText "expected" ''
+          brush
+          brushctl
+          brushinfo
+        '';
+        actual =
+          runCommand "actual"
+            {
+              nativeBuildInputs = [ brush ];
+            }
+            ''
+              brush -c 'brushinfo complete line bru' >$out
+            '';
+      };
+    };
+
+    updateScript = nix-update-script { extraArgs = [ "--version-regex=brush-shell-v([\\d\\.]+)" ]; };
+  };
+
+  meta = {
+    description = "Bash/POSIX-compatible shell implemented in Rust";
+    homepage = "https://github.com/reubeno/brush";
+    changelog = "https://github.com/reubeno/brush/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kachick ];
+    mainProgram = "brush";
+  };
+}
diff --git a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
index e5b499f20f8a..fe64e911576b 100644
--- a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-mcbopomofo";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "openvanilla";
     repo = "fcitx5-mcbopomofo";
     rev = version;
-    hash = "sha256-4z6kSzmtuypbT7oXBJqiOMwU6PVRH+vEBYcBWtv4fGE=";
+    hash = "sha256-xW3nxAfhdW7S0UJNl/NKhB1vzm0mMd92cA5ksPn7+QI=";
   };
 
   nativeBuildInputs = [
@@ -39,8 +39,6 @@ stdenv.mkDerivation rec {
     json_c
   ];
 
-  strictDeps = true;
-
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
   ];
diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
new file mode 100644
index 000000000000..8aeda3eb7495
--- /dev/null
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -0,0 +1,88 @@
+{
+  stdenv,
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  nix-update-script,
+  nixosTests,
+  systemd,
+  testers,
+  grafana-loki,
+}:
+
+buildGoModule rec {
+  version = "3.4.2";
+  pname = "grafana-loki";
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "loki";
+    rev = "v${version}";
+    hash = "sha256-GE92NlFCOk6qFtrgeBvLDI0OkmWaJ1j07Q14+jgi9+w=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [
+    # TODO split every executable into its own package
+    "cmd/loki"
+    "cmd/loki-canary"
+    "clients/cmd/promtail"
+    "cmd/logcli"
+    "cmd/lokitool"
+  ];
+
+  tags = [ "promtail_journal_enabled" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ systemd.dev ];
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram $out/bin/promtail \
+      --prefix LD_LIBRARY_PATH : "${lib.getLib systemd}/lib"
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) loki;
+      version = testers.testVersion {
+        command = "loki --version";
+        package = grafana-loki;
+      };
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  ldflags =
+    let
+      t = "github.com/grafana/loki/v3/pkg/util/build";
+    in
+    [
+      "-s"
+      "-w"
+      "-X ${t}.Version=${version}"
+      "-X ${t}.BuildUser=nix@nixpkgs"
+      "-X ${t}.BuildDate=unknown"
+      "-X ${t}.Branch=unknown"
+      "-X ${t}.Revision=unknown"
+    ];
+
+  meta = with lib; {
+    description = "Like Prometheus, but for logs";
+    mainProgram = "promtail";
+    license = with licenses; [
+      agpl3Only
+      asl20
+    ];
+    homepage = "https://grafana.com/oss/loki/";
+    changelog = "https://github.com/grafana/loki/releases/tag/v${version}";
+    maintainers = with maintainers; [
+      willibutz
+      globin
+      mmahut
+      emilylange
+    ];
+  };
+}
diff --git a/pkgs/by-name/hv/hvm/package.nix b/pkgs/by-name/hv/hvm/package.nix
index 071fbdf149b9..a6a9d39cb309 100644
--- a/pkgs/by-name/hv/hvm/package.nix
+++ b/pkgs/by-name/hv/hvm/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hvm";
-  version = "2.0.19";
+  version = "2.0.22";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-+Cx+2v4JrQflDBaNZ9Fu8734Zr4rrgtnojUS4dkx7Ck=";
+    hash = "sha256-AD8mv47m4E6H8BVkxTExyhrR7VEnuB/KxnRl2puPnX4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-HpQQLFb9vUAGIEKrkGKOfUUNALYGnKCR3/HqA+qvamw=";
+  cargoHash = "sha256-nLcT+o6xrxPmQqK7FQpCqTlxOOUA1FzqRGQIypcq4fo=";
 
   meta = with lib; {
     description = "Massively parallel, optimal functional runtime in Rust";
diff --git a/pkgs/by-name/in/integrity-scrub/package.nix b/pkgs/by-name/in/integrity-scrub/package.nix
new file mode 100644
index 000000000000..3df0878be2c9
--- /dev/null
+++ b/pkgs/by-name/in/integrity-scrub/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "integrity-scrub";
+  version = "0.6.5";
+
+  src = fetchFromGitHub {
+    owner = "illdefined";
+    repo = "integrity-scrub";
+    tag = version;
+    hash = "sha256-oWS6HxdZ8tGeIRGpfHHkNhNdepBjhhdgTjKmxElNPbk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-3LC3eZNmHG6OFIvQzmvs4BCSX0CVpwaYhZM2H2YoY4M=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  # Requires unstable features
+  env.RUSTC_BOOTSTRAP = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/illdefined/integrity-scrub";
+    description = "Scrub dm-integrity devices";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ mvs ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/k9/k9s/package.nix b/pkgs/by-name/k9/k9s/package.nix
index 79898bbab638..02632e186ab8 100644
--- a/pkgs/by-name/k9/k9s/package.nix
+++ b/pkgs/by-name/k9/k9s/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.32.7";
+  version = "0.40.3";
 
   src = fetchFromGitHub {
     owner = "derailed";
     repo = "k9s";
     rev = "v${version}";
-    hash = "sha256-0S6FomP1WVqYl5nP0FcaElgghMcZmE0V8iLhghERF6A=";
+    hash = "sha256-7juy1j2YULP76YIjwzaXRPfbzZ/cIIzH1v5nddl0bKk=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-ENn2BpGFEpiTNZbnNVt4hv4R6NTT3GivFd3rTy3xEH8=";
+  vendorHash = "sha256-I0gUTyLLOiTm6LiEFHwylYA1I8+/365GxFs8nSARcy0=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);
diff --git a/pkgs/by-name/li/libime/package.nix b/pkgs/by-name/li/libime/package.nix
index db80dc81742f..073c3f603628 100644
--- a/pkgs/by-name/li/libime/package.nix
+++ b/pkgs/by-name/li/libime/package.nix
@@ -17,10 +17,10 @@ let
     url = "https://download.fcitx-im.org/data/table-${tableVer}.tar.zst";
     hash = "sha256-Pp2HsEo5PxMXI0csjqqGDdI8N4o9T2qQBVE7KpWzYUs=";
   };
-  arpaVer = "20241001";
+  arpaVer = "20250113";
   arpa = fetchurl {
     url = "https://download.fcitx-im.org/data/lm_sc.arpa-${arpaVer}.tar.zst";
-    hash = "sha256-VJNOc5Zus46k/o6unGHf5IavN9octTFqBrGcfSieMGM=";
+    hash = "sha256-7oPs8g1S6LzNukz2zVcYPVPCV3E6Xrd+46Y9UPw3lt0=";
   };
   dictVer = "20241001";
   dict = fetchurl {
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libime";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     rev = version;
-    hash = "sha256-Ky4ERYQRUiPn+EYrgfmfHxdVp31a1oD4nevDniPOT20=";
+    hash = "sha256-liVJEBUYcVYjjJCMW68xXbEHKQpAgTLCPm2yIdWG3IQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index dcabe80c261b..a8ae69195fc9 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -15,7 +15,7 @@
 
 buildGoModule rec {
   pname = "mautrix-meta";
-  version = "0.4.3";
+  version = "0.4.4";
 
   subPackages = [ "cmd/mautrix-meta" ];
 
@@ -23,13 +23,13 @@ buildGoModule rec {
     owner = "mautrix";
     repo = "meta";
     rev = "v${version}";
-    hash = "sha256-aq1tmw19evTxmSNpDQyFdjyc0ow1Rsm2jlodglcj084=";
+    hash = "sha256-S8x3TGQEs+oh/3Q1Gz00M8dOcjjuHSgzVhqlbikZ8QE=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-1ulBTkhb/MDmu26R8v8HUt1HkRNpsufpp+EzTQrlaCQ=";
+  vendorHash = "sha256-sUnvwPJQOoVzxbo2lS3CRcTrWsPjgYPsKClVw1wZJdM=";
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/ma/mautrix-whatsapp/package.nix b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
index f0b4ec1f0654..ff862f38d5f6 100644
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  nix-update-script,
   buildGoModule,
   fetchFromGitHub,
   olm,
@@ -13,22 +14,24 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-3S4aNoxK99iExhTJQP/JNq0GajCUjbdq4cUgCBudyXI=";
+    hash = "sha256-b56WCt71A1+TUN7ug3E/F8A99vqGJLJfHN49klZzx9I=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-9iX+pzken+/7+nqYa71rcc1olCdpmu3UfR09ag3KSKs=";
+  vendorHash = "sha256-8Iu5rL42TFFqlClQf01kT86Hhb46qsPObjE1snuz1So=";
 
   doCheck = false;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "https://github.com/tulir/mautrix-whatsapp";
     description = "Matrix <-> Whatsapp hybrid puppeting/relaybot bridge";
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index 53d8446cfbbf..f12464d809ef 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "misconfig-mapper";
-  version = "1.13.0";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${version}";
-    hash = "sha256-WheKF6IG4quJpNBPXbOMKGEUkR6wr3cVi97Gtpaz+LA=";
+    hash = "sha256-WBZE99CbM0uCmse6FVLK+OxxwBajWEs2pqoOf1EIckc=";
   };
 
-  vendorHash = "sha256-omnWQfriaPqz51xrUKZM5112ZEHJZgAm68hnqUyzR6A=";
+  vendorHash = "sha256-fEmf+d9oBXz7KymNVmC+CM7OyPD9QV1uN4ReTNhei7A=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index c89ed2d78265..18911f8b0ea2 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.92";
+  version = "10.96";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-xb+L+X1N6/t7ohodFefIT5zvc/GMjMnkqCNMJukEIFg=";
+    hash = "sha256-LRkvcx+h3dv7WTd2YvdxsQndgdWY9CBve8GSd1rV+yg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 8ccbe1f069da..7a00ae7dab49 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -44,13 +44,13 @@ let
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "movim";
-  version = "0.29.1";
+  version = "0.29.2";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8YbRqlppD4tWqCki6v3F1cP8BcG66kAa3njEdPIRPhs=";
+    hash = "sha256-/u8/9tn0X+IwXKyK3S5uA9X8IRsg5xDdUPpnvxOIaYc=";
   };
 
   php = php.buildEnv (
@@ -98,7 +98,7 @@ php.buildComposerProject2 (finalAttrs: {
   # pinned commonmark
   composerStrictValidation = false;
 
-  vendorHash = "sha256-Y1H7jvO/P4R+Rb4V87pha3Icd2Iy7VyzwVDPX72aMqA=";
+  vendorHash = "sha256-ikIAIPq8Yj27vGmJxeViYJ5SWiZtE68CIE526glZPlo=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;
diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
index a5aeebf9e1da..742b692a16c5 100644
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
@@ -66,11 +66,11 @@ let
 
   derivation = stdenv.mkDerivation rec {
     pname = "onlyoffice-desktopeditors";
-    version = "8.2.0";
+    version = "8.3.0";
     minor = null;
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-      hash = "sha256-sKjPxrPdnEX/EuZMQJP+PN/Mi1MRV3psK8Jje7V/ecI=";
+      hash = "sha256-rx9jh2jWA7+EOoNackHEUsLg1lX+VXbqp+cCUQAoQuM=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ow/owncast/package.nix b/pkgs/by-name/ow/owncast/package.nix
index a7407bc783b5..66a2c11e9210 100644
--- a/pkgs/by-name/ow/owncast/package.nix
+++ b/pkgs/by-name/ow/owncast/package.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "0.1.3";
+  version = "0.2.0";
 in
 buildGoModule {
   pname = "owncast";
@@ -19,9 +19,9 @@ buildGoModule {
     owner = "owncast";
     repo = "owncast";
     rev = "v${version}";
-    hash = "sha256-VoItAV/8hzrqj4bIgMum9Drr/kAafH63vXw3GO6nSOc=";
+    hash = "sha256-MdquhDdbOdP1shnKHBlzQrSDe41fp0qnMzgaqL89jTk=";
   };
-  vendorHash = "sha256-JitvKfCLSravW5WRE0QllJTrRPLaaBg1GxJi3kmtiIU=";
+  vendorHash = "sha256-ERilQZ8vnhGW1IEcLA4CcmozDooHKbnmASMw87tjYD4=";
 
   propagatedBuildInputs = [ ffmpeg ];
 
diff --git a/pkgs/servers/monitoring/loki/promtail.nix b/pkgs/by-name/pr/promtail/package.nix
similarity index 100%
rename from pkgs/servers/monitoring/loki/promtail.nix
rename to pkgs/by-name/pr/promtail/package.nix
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 1d1a1d10a476..a9e6eebd7d3a 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -7,11 +7,11 @@
 renode.overrideAttrs (
   finalAttrs: _: {
     pname = "renode-unstable";
-    version = "1.15.3+20250202git50d499e4e";
+    version = "1.15.3+20250214git71a264d7b";
 
     src = fetchurl {
       url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-      hash = "sha256-aLeBd506FRuTTIS0ZAlJQ1OBNWrK8YY4vfmLj6YpUI0=";
+      hash = "sha256-QDicOg49zK0RHmmGxN5NGi/hqTTnVv49EZ6ZymfhLVA=";
     };
 
     passthru.updateScript =
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 1288743c3c1f..ae32c7eb1a18 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   doctest,
   fmt_11,
@@ -39,6 +40,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-id5nmxdqx+0m0JCCvwaEuUAQkMLTlWadfieJ0wO/wJI=";
   };
 
+  patches = [
+    # remove https://www.nixspam.net/ because it has been shutdown
+    (fetchpatch {
+      url = "https://github.com/rspamd/rspamd/commit/dc6e7494c2440cd6c4e474b5ee3c4fabdad1f6bf.patch";
+      hash = "sha256-7zY+l5ADLWgPTTBNG/GxX23uX2OwQ33hyzSuokTLgqc=";
+    })
+  ];
+
   hardeningEnable = [ "pie" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/simple64-netplay-server/package.nix b/pkgs/by-name/si/simple64-netplay-server/package.nix
index 9b03d00e6655..e22c47979e9a 100644
--- a/pkgs/by-name/si/simple64-netplay-server/package.nix
+++ b/pkgs/by-name/si/simple64-netplay-server/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "simple64-netplay-server";
-  version = "2025.01.3";
+  version = "2025.02.3";
 
   src = fetchFromGitHub {
     owner = "simple64";
     repo = "simple64-netplay-server";
     tag = "v${version}";
-    hash = "sha256-6+apLOy/hlLkvQjVxi4qpIVhfImdevyCFGAo6rBCc6k=";
+    hash = "sha256-mtyIGS7i4+HRpjE8Z3puoIOGhv21Th27iCXpO2LxtAg=";
   };
 
   vendorHash = "sha256-lcKOAPCyWKNg+l1YjziaMTn4DjLB0P+dz3FqyAy0sFk=";
diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index f815d91a4ab4..ff6afa1c594e 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -12,7 +12,7 @@
   polkit,
 }:
 let
-  version = "0.1.1";
+  version = "0.1.2";
 in
 rustPlatform.buildRustPackage {
   pname = "soteria";
@@ -22,11 +22,11 @@ rustPlatform.buildRustPackage {
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-T6bJOXSXFWZYAxZ+nTDu+H8Wi75QRKddXkXdSOPwHbI=";
+    hash = "sha256-i7g2my0hP54Tj86UVEEFQIb5ih26djKgLg++I1n9Sfs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5f915lrymOwg5bPsTp6sxKikCcTpbeia1fQzKnLYGOs=";
+  cargoHash = "sha256-Z9ycfFhnff0z2ZG+tqf+qGUL7gDJQ+kC+e+WZ21qN1Y=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/su/suitesparse-graphblas/package.nix b/pkgs/by-name/su/suitesparse-graphblas/package.nix
index 5d0d7097260e..df89b8b50bd2 100644
--- a/pkgs/by-name/su/suitesparse-graphblas/package.nix
+++ b/pkgs/by-name/su/suitesparse-graphblas/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "suitesparse-graphblas";
-  version = "9.4.2";
+  version = "9.4.4";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${version}";
-    hash = "sha256-qUN5z797IAsP/OW6LmMUDETyJCJ3j8rgeDfj1dCaiyM=";
+    hash = "sha256-4k5s4cFPZUetvXkyEojB/ellqZrmyXpdQdlBJ93W0Jk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/swaylock-plugin/package.nix b/pkgs/by-name/sw/swaylock-plugin/package.nix
new file mode 100644
index 000000000000..4e4e7fa258e7
--- /dev/null
+++ b/pkgs/by-name/sw/swaylock-plugin/package.nix
@@ -0,0 +1,88 @@
+{
+  cairo,
+  fetchFromGitHub,
+  gdk-pixbuf,
+  lib,
+  libxcrypt,
+  libxkbcommon,
+  makeWrapper,
+  meson,
+  ninja,
+  nix-update-script,
+  pam,
+  pkg-config,
+  scdoc,
+  stdenv,
+  swaybg,
+  systemd,
+  versionCheckHook,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+}:
+
+stdenv.mkDerivation {
+  pname = "swaylock-plugin";
+  version = "unstable-2025-01-28";
+  src = fetchFromGitHub {
+    owner = "mstoeckl";
+    repo = "swaylock-plugin";
+    rev = "ac02c528bce8f529f33c85065d77eac1aceccbe5";
+    hash = "sha256-e4iQ7yCPkkJBpgD0aE94lsID8v3kXhr7YmAszfFi7zA=";
+  };
+
+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+    scdoc
+    wayland-scanner
+  ];
+  buildInputs = [
+    cairo
+    libxcrypt
+    gdk-pixbuf
+    libxkbcommon
+    pam
+    systemd
+    wayland
+    wayland-protocols
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/swaylock-plugin \
+      --prefix PATH : "${lib.makeBinPath [ swaybg ]}"
+  '';
+
+  mesonFlags = [
+    "-Dpam=enabled"
+    "-Dgdk-pixbuf=enabled"
+    "-Dman-pages=enabled"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Screen locker for Wayland, forked from swaylock";
+    longDescription = ''
+      swaylock-pulgins is a fork of swaylock, a screen locking utility for Wayland compositors.
+      On top of the usual swaylock features, it allow you to use a
+      subcommand to generate the lockscreen background.
+
+      Important note: You need to set "security.pam.services.swaylock-plugin = {};" manually.
+    '';
+    homepage = "https://github.com/mstoeckl/swaylock-plugin";
+    mainProgram = "swaylock-plugin";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ picnoir ];
+  };
+}
diff --git a/pkgs/by-name/td/tdlib/package.nix b/pkgs/by-name/td/tdlib/package.nix
index 1b05ff79b37f..6507b93506b4 100644
--- a/pkgs/by-name/td/tdlib/package.nix
+++ b/pkgs/by-name/td/tdlib/package.nix
@@ -36,7 +36,7 @@ in
 
 stdenv.mkDerivation {
   pname = "tdlib";
-  version = "1.8.44";
+  version = "1.8.45";
 
   src = fetchFromGitHub {
     owner = "tdlib";
@@ -45,8 +45,8 @@ stdenv.mkDerivation {
     # The tdlib authors do not set tags for minor versions, but
     # external programs depending on tdlib constrain the minor
     # version, hence we set a specific commit with a known version.
-    rev = "28c6f2e9c045372d50217919bf5768b7fbbe0294";
-    hash = "sha256-IZ/VplO7PSzYVYmUa6nhJdI4kni8x5TZ7XWkf8JcmYI=";
+    rev = "8e29c4d7d21db3ab2c7a88c384626e95ef789f61";
+    hash = "sha256-R/OkKj65PEDrFOTvybv3tQ/cyqBZDzusnd5RJgrgspo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix
index e9c48eb9505f..36733a0a0a5c 100644
--- a/pkgs/by-name/te/tempo/package.nix
+++ b/pkgs/by-name/te/tempo/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule rec {
   pname = "tempo";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-aCtITq5qT0a1DuoSDK3F46cPvfVsvXOPkZELEuRYi5w=";
+    hash = "sha256-U+cURfcLoZOB0lgZ/Ky1qcKR8aWbai84ZyHQYQeONVc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/tg/tgpt/package.nix b/pkgs/by-name/tg/tgpt/package.nix
index c0f0a1d3104d..62bf5d675e83 100644
--- a/pkgs/by-name/tg/tgpt/package.nix
+++ b/pkgs/by-name/tg/tgpt/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     tag = "v${version}";
-    hash = "sha256-8R6rb4GvSf4nw78Yxcuh9Vct/qUTkQNatRolT1m7JR4=";
+    hash = "sha256-6kJwJedFnALP4hpoaQ5DR/zN1KijgwFpYSBb1o+XCHw=";
   };
 
-  vendorHash = "sha256-HObEC0SqSHJOgiJxlniN4yJ3U8ksv1HeiMhtOiZRq50=";
+  vendorHash = "sha256-hPbvzhYHOxytQs3NkSVaZhFH0TbOlr4U/QiH+vemTrc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index 2cae4225b483..97b90004cddf 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "virtnbdbackup";
-  version = "2.18";
+  version = "2.20";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${version}";
-    hash = "sha256-0ZM3Xu3CbAuN60d0L32odNu9DfnOEDx3X03mFpDFZ6Y=";
+    hash = "sha256-owYQ6BzIVkfHskZ715R6o0PFzrcQH91FfmjwXQAut4s=";
   };
 
   build-system = with python3Packages; [
@@ -40,7 +40,7 @@ python3Packages.buildPythonApplication rec {
   meta = {
     description = "Backup utility for Libvirt/qemu/kvm";
     homepage = "https://github.com/abbbi/virtnbdbackup";
-    changelog = "https://github.com/abbbi/virtnbdbackup/releases/tag/v${version}";
+    changelog = "https://github.com/abbbi/virtnbdbackup/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ genga898 ];
     mainProgram = "virtnbdbackup";
diff --git a/pkgs/by-name/wi/wings/package.nix b/pkgs/by-name/wi/wings/package.nix
index ee8df8dea284..c6c9fb52fa5f 100644
--- a/pkgs/by-name/wi/wings/package.nix
+++ b/pkgs/by-name/wi/wings/package.nix
@@ -1,21 +1,48 @@
-{ lib, stdenv, fetchurl, fetchpatch, erlang, cl, libGL, libGLU, runtimeShell }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  erlang,
+  cl,
+  libGL,
+  libGLU,
+  runtimeShell,
+  git,
+  eigen,
+  libigl,
+  nix-update-script,
+}:
 
 stdenv.mkDerivation rec {
   pname = "wings";
-  version = "2.2.4";
+  version = "2.4.1";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/wings/wings-${version}.tar.bz2";
-    sha256 = "1xcmifs4vq2810pqqvsjsm8z3lz24ys4c05xkh82nyppip2s89a3";
+  src = fetchFromGitHub {
+    owner = "dgud";
+    repo = "wings";
+    tag = "v${version}";
+    hash = "sha256-3ulWbAOtYujaymN50u7buvnBdtYMEAe8Ji3arvPUH/s=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/dgud/wings/commit/94b3a3c6a0cfdcdbd98edce055d5c83ecb361f37.patch";
-      hash = "sha256-DHT1TiYoowloIWrdutBu70mL+557cTFr1dRcNgwbkpE=";
-    })
+  nativeBuildInputs = [ git ];
+  buildInputs = [
+    erlang
+    cl
+    libGL
+    libGLU
+    eigen
+    libigl
+    cl
   ];
 
+  preBuildPhases = [ "setupDepsPhase" ];
+  setupDepsPhase = ''
+    mkdir -p _deps/eigen _deps/libigl
+    ln -s ${eigen}/include/eigen3/* _deps/eigen/
+    ln -s ${libigl}/include/* _deps/libigl/
+    ln -s ${cl}/lib/erlang/lib/cl* _deps/cl
+  '';
+
   postPatch = ''
     find . -type f -name "Makefile" -exec sed -i 's,-Werror ,,' {} \;
     sed -i 's,../../wings/,../,' icons/Makefile
@@ -25,31 +52,65 @@ stdenv.mkDerivation rec {
     find . -type f -name "*.[eh]rl" -exec sed -i 's,wings/src/,../src/,' {} \;
     find . -type f -name "*.[eh]rl" -exec sed -i 's,wings/e3d/,../e3d/,' {} \;
     find . -type f -name "*.[eh]rl" -exec sed -i 's,wings/intl_tools/,../intl_tools/,' {} \;
+    echo "${version}" > version
   '';
 
-  buildInputs = [ erlang cl libGL libGLU ];
+  makeFlags = [
+    "TYPE=opt"
+    "WINGS_VSN=${version}"
+  ];
 
-  ERL_LIBS = "${cl}/lib/erlang/lib";
+  preBuild = ''
+    mkdir -p priv
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    make TYPE=opt WINGS_VSN=${version}
+    cd c_src
+    make
+    cd ..
+
+    runHook postBuild
+  '';
+
+  postBuild = ''
+    test -d ebin || exit 1
+    test -d priv || exit 1
+  '';
 
   # I did not test the *cl* part. I added the -pa just by imitation.
   installPhase = ''
-    mkdir -p $out/bin $out/lib/wings-${version}/ebin
-    cp ebin/* $out/lib/wings-${version}/ebin
-    cp -R textures shaders plugins $out/lib/wings-${version}
+    runHook preInstall
+
+    mkdir -p $out/bin $out/lib/wings-${version}/ebin $out/lib/wings-${version}/priv
+    cp -R ebin/* $out/lib/wings-${version}/ebin/
+    cp -R textures shaders plugins $out/lib/wings-${version}/
+    cp -R priv/* $out/lib/wings-${version}/priv/ || true
+    if [ -d c_src ]; then
+      find c_src -name "*.so" -exec cp {} $out/lib/wings-${version}/priv/ \;
+    fi
     cat << EOF > $out/bin/wings
     #!${runtimeShell}
     ${erlang}/bin/erl \
       -pa $out/lib/wings-${version}/ebin -run wings_start start_halt "$@"
     EOF
     chmod +x $out/bin/wings
+
+    runHook postInstall
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     homepage = "https://www.wings3d.com/";
     description = "Subdivision modeler inspired by Nendo and Mirai from Izware";
     license = lib.licenses.tcltk;
-    maintainers = [ ];
-    platforms = with lib.platforms; linux;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
     mainProgram = "wings";
   };
 }
diff --git a/pkgs/development/libraries/science/math/trilinos/default.nix b/pkgs/development/libraries/science/math/trilinos/default.nix
index e4c7f587eaef..25de281cffb4 100644
--- a/pkgs/development/libraries/science/math/trilinos/default.nix
+++ b/pkgs/development/libraries/science/math/trilinos/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "trilinos";
     repo = "Trilinos";
-    rev = "${pname}-release-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    tag = "trilinos-release-${lib.replaceStrings [ "." ] [ "-" ] version}";
     sha256 = "sha256-Nqjr7RAlUHm6vs87a1P84Y7BIZEL0Vs/A1Z6dykfv+o=";
   };
 
@@ -94,6 +94,11 @@ stdenv.mkDerivation rec {
         cmakeFlagsArray+=(${flagsBase})
       '';
 
+  postInstall = ''
+    # remove dangling symlink
+    rm $out/lib/cmake/tribits/doc/developers_guide/TribitsBuildReference.html
+  '';
+
   passthru = {
     inherit withMPI;
   };
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 213e018d75b2..aba68e183815 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -501,10 +501,10 @@ in
       final.nlua
       final.busted
       gitMinimal
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua --lpath='lua/?.lua' --lpath='lua/?/init.lua' tests/
       runHook postCheck
     '';
@@ -696,10 +696,10 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua
       runHook postCheck
     '';
@@ -710,10 +710,10 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua
       runHook postCheck
     '';
@@ -741,11 +741,11 @@ in
       final.nlua
       final.busted
       neovim-unwrapped
+      writableTmpDirAsHomeHook
     ];
 
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       export LUA_PATH="./lua/?.lua;./lua/?/init.lua;$LUA_PATH"
       nvim --headless -i NONE \
         --cmd "set rtp+=${vimPlugins.plenary-nvim}" \
@@ -760,10 +760,10 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua
       runHook postCheck
     '';
@@ -782,12 +782,12 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
 
     # upstream uses PlenaryBusted which is a pain to setup
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua --lpath='lua/?.lua' --lpath='lua/?/init.lua' tests/
       runHook postCheck
     '';
@@ -807,13 +807,13 @@ in
       neovim-unwrapped
       coreutils
       findutils
+      writableTmpDirAsHomeHook
     ];
 
     checkPhase = ''
       runHook preCheck
       # remove failing tests, need internet access for instance
       rm tests/plenary/job_spec.lua tests/plenary/scandir_spec.lua tests/plenary/curl_spec.lua
-      export HOME="$TMPDIR"
       make test
       runHook postCheck
     '';
@@ -982,10 +982,10 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua
       runHook postCheck
     '';
@@ -996,10 +996,10 @@ in
     nativeCheckInputs = [
       final.nlua
       final.busted
+      writableTmpDirAsHomeHook
     ];
     checkPhase = ''
       runHook preCheck
-      export HOME=$(mktemp -d)
       busted --lua=nlua
       runHook postCheck
     '';
@@ -1010,6 +1010,7 @@ in
     nativeCheckInputs = [
       final.plenary-nvim
       neovim-unwrapped
+      writableTmpDirAsHomeHook
     ];
 
     # the plugin loads the library from either the LIBSQLITE env
@@ -1021,8 +1022,6 @@ in
 
     # we override 'luarocks test' because otherwise neovim doesn't find/load the plenary plugin
     checkPhase = ''
-      export HOME="$TMPDIR";
-
       nvim --headless -i NONE \
         -u test/minimal_init.vim --cmd "set rtp+=${vimPlugins.plenary-nvim}" \
         -c "PlenaryBustedDirectory test/auto/ { sequential = true, minimal_init = './test/minimal_init.vim' }"
@@ -1093,9 +1092,9 @@ in
         tree-sitter
       ];
 
-    preInstall = ''
-      export HOME="$TMPDIR";
-    '';
+    nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [
+      writableTmpDirAsHomeHook
+    ];
   });
 
   tree-sitter-norg = prev.tree-sitter-norg.overrideAttrs (oa: {
@@ -1123,10 +1122,9 @@ in
         lua.pkgs.luarocks-build-treesitter-parser
         tree-sitter
       ];
-
-    preInstall = ''
-      export HOME="$TMPDIR";
-    '';
+    nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [
+      writableTmpDirAsHomeHook
+    ];
   });
 
   vstruct = prev.vstruct.overrideAttrs (_: {
diff --git a/pkgs/development/ocaml-modules/nice_parser/default.nix b/pkgs/development/ocaml-modules/nice_parser/default.nix
new file mode 100644
index 000000000000..bb47fe25eb31
--- /dev/null
+++ b/pkgs/development/ocaml-modules/nice_parser/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  stdio,
+}:
+
+buildDunePackage rec {
+  pname = "nice_parser";
+  version = "1.0.0";
+  minimalOCamlVersion = "4.07";
+
+  src = fetchFromGitHub {
+    owner = "smolkaj";
+    repo = "nice-parser";
+    tag = version;
+    hash = "sha256-h1rqdv19tUH3CsL3OLsTmKir7YCYt4PaW19ymotEvIY=";
+  };
+
+  propagatedBuildInputs = [
+    stdio
+  ];
+
+  meta = {
+    inherit (src.meta) homepage;
+    description = "Nice parsers without the boilerplate";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.tiferrei ];
+  };
+}
diff --git a/pkgs/development/python-modules/acres/default.nix b/pkgs/development/python-modules/acres/default.nix
new file mode 100644
index 000000000000..666299b4dd31
--- /dev/null
+++ b/pkgs/development/python-modules/acres/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pdm-backend,
+  importlib-resources,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "acres";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nipreps";
+    repo = "acres";
+    tag = version;
+    hash = "sha256-DSDTOUNInLMR6C1P4NT+121sU+BYBLw67xRCtKobEaM=";
+  };
+
+  build-system = [
+    pdm-backend
+  ];
+
+  dependencies = [
+    importlib-resources
+  ];
+
+  pythonImportsCheck = [
+    "acres"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Data-loading utility for Python";
+    homepage = "https://github.com/nipreps/acres";
+    changelog = "https://github.com/nipreps/acres/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/aocd-example-parser/default.nix b/pkgs/development/python-modules/aocd-example-parser/default.nix
index a78e66980bcd..3914a8c492f1 100644
--- a/pkgs/development/python-modules/aocd-example-parser/default.nix
+++ b/pkgs/development/python-modules/aocd-example-parser/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aocd-example-parser";
-  version = "2023.12.20";
+  version = "2024.12.25";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -16,21 +16,18 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "wimglenn";
     repo = "aocd-example-parser";
-    rev = "07330183f3e43401444fe17b08d72eb6168504e1";
-    hash = "sha256-iOxqzZj29aY/xyigir1KOU6GcBBvnlxEOBLHChEQjf4=";
+    rev = "c86bfc714d2f413965a46a2caf3483e823ea9ade";
+    hash = "sha256-1Le1jrLCFRJcUngoq5bt22gM1lpAMBNBRWjOl3yLlsw=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
   # Circular dependency with aocd
-  # pythonImportsCheck = [
-  #   "aocd_example_parser"
-  # ];
 
-  meta = with lib; {
+  meta = {
     description = "Default implementation of an example parser plugin for advent-of-code-data";
     homepage = "https://github.com/wimglenn/aocd-example-parser";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/aocd/default.nix b/pkgs/development/python-modules/aocd/default.nix
index 88aa990fb644..d8a5ffd3cc30 100644
--- a/pkgs/development/python-modules/aocd/default.nix
+++ b/pkgs/development/python-modules/aocd/default.nix
@@ -9,6 +9,7 @@
   pook,
   pytest-freezegun,
   pytest-mock,
+  pytest-cov-stub,
   pytest-raisin,
   pytest-socket,
   pytestCheckHook,
@@ -36,9 +37,9 @@ buildPythonPackage rec {
     hash = "sha256-xR9CfyOUsKSSA/1zYi6kCK3oAaX6Kd625mKMWI+ZFMA=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aocd-example-parser
     beautifulsoup4
     pebble
@@ -57,56 +58,22 @@ buildPythonPackage rec {
     pytest-raisin
     pytest-socket
     pytestCheckHook
+    pytest-cov-stub
     requests-mock
   ];
 
-  # Too many failing tests
-  preCheck = "rm pytest.ini";
-
-  disabledTests = [
-    "test_results"
-    "test_results_xmas"
-    "test_run_error"
-    "test_run_and_autosubmit"
-    "test_run_and_no_autosubmit"
-    "test_load_input_from_file"
-    "test_examples_cache" # IndexError: list index out of range
-    "test_example_partial" # ValueError: not enough values to unpack (expected 1, got 0)
-    "test_run_against_examples" # AssertionError: assert '2022/25 - The Puzzle Title' in ''
-    "test_aocd_no_examples" # SystemExit: 2
-    "test_aocd_examples" # SystemExit: 2
-    "test_aoce" # SystemExit: 1
-
-    # TypeError: sequence item 0: expected str instance, bool found
-    # Likely because they use `pook.get` to get a webpage
-    "test_submit_prevents_bad_guesses_too_high"
-    "test_submit_prevents_bad_guesses_too_low"
-    "test_submit_prevents_bad_guesses_known_incorrect"
-    "test_submit_correct_answer"
-    "test_correct_submit_reopens_browser_on_answer_page"
-    "test_server_error"
-    "test_submit_when_already_solved"
-    "test_submitted_too_recently_autoretry"
-    "test_submitted_too_recently_autoretry_quiet"
-    "test_submit_when_submitted_too_recently_no_autoretry"
-    "test_submit_wrong_answer "
-    "test_correct_submit_records_good_answer"
-    "test_submits_for_partb_when_already_submitted_parta"
-    "test_submit_when_parta_solved_but_answer_unsaved"
-    "test_submit_saves_both_answers_if_possible"
-    "test_submit_puts_level1_by_default"
-    "test_cannot_submit_same_bad_answer_twice"
-    "test_submit_float_warns"
+  pytestFlagsArray = [
+    "tests/"
   ];
 
   pythonImportsCheck = [ "aocd" ];
 
-  meta = with lib; {
+  meta = {
     description = "Get your Advent of Code data with a single import statement";
     homepage = "https://github.com/wimglenn/advent-of-code-data";
     changelog = "https://github.com/wimglenn/advent-of-code-data/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ aadibajpai ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aadibajpai ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 3681904179e9..f123d3ccdd50 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "av";
-  version = "13.1.0";
+  version = "14.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "PyAV-Org";
     repo = "PyAV";
     tag = "v${version}";
-    hash = "sha256-x2a9SC4uRplC6p0cD7fZcepFpRidbr6JJEEOaGSWl60=";
+    hash = "sha256-GYdt6KMMmDSyby447MbShL2GbrH8R1UuOeiVlztGuS4=";
   };
 
   build-system = [
@@ -57,11 +57,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # av.error.InvalidDataError: [Errno 1094995529] Invalid data found when processing input: 'custom_io_output.mpd'
-    "test_writing_to_custom_io_dash"
-  ];
-
   # `__darwinAllowLocalNetworking` doesn’t work for these; not sure why.
   disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
     "tests/test_timeout.py"
@@ -78,7 +73,6 @@ buildPythonPackage rec {
     "av.datasets"
     "av.descriptor"
     "av.dictionary"
-    "av.enum"
     "av.error"
     "av.filter"
     "av.format"
diff --git a/pkgs/development/python-modules/beancount/default.nix b/pkgs/development/python-modules/beancount/default.nix
index d621cf7ed7f6..0422014ac36f 100644
--- a/pkgs/development/python-modules/beancount/default.nix
+++ b/pkgs/development/python-modules/beancount/default.nix
@@ -18,7 +18,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.0.0";
+  version = "2.3.6";
   format = "setuptools";
   pname = "beancount";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z2aGhpx+o+78CU7hPthmv196K7DGHk1PXfPjX4Rs/98=";
+    hash = "sha256-gB+Tvta1fS4iQ2aIxInVob8fduIQ887RhoB1fmDTR1o=";
   };
 
   # Tests require files not included in the PyPI archive.
@@ -49,6 +49,10 @@ buildPythonPackage rec {
     pytest
   ];
 
+  # beancount cannot be directly bumped to 3.x
+  # e.g. https://github.com/NixOS/nixpkgs/issues/380197
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     homepage = "https://github.com/beancount/beancount";
     description = "Double-entry bookkeeping computer language";
diff --git a/pkgs/development/python-modules/clr-loader/default.nix b/pkgs/development/python-modules/clr-loader/default.nix
index b0921179df4b..d20dcaa51e2a 100644
--- a/pkgs/development/python-modules/clr-loader/default.nix
+++ b/pkgs/development/python-modules/clr-loader/default.nix
@@ -20,6 +20,11 @@ let
     hash = "sha256-t6iz+PuxvLu2OC2IfiHRdC1PELXqIJ5K2VVo/pfhx8Y=";
   };
   patches = [ ./dotnet-8-upgrade.patch ];
+  # This stops msbuild from picking up $version from the environment
+  postPatch = ''
+    echo '<Project><PropertyGroup><Version/></PropertyGroup></Project>' > \
+      Directory.Build.props
+  '';
 
   # This buildDotnetModule is used only to get nuget sources, the actual
   # build is done in `buildPythonPackage` below.
@@ -29,6 +34,7 @@ let
       version
       src
       patches
+      postPatch
       ;
     projectFile = [
       "netfx_loader/ClrLoader.csproj"
@@ -44,6 +50,7 @@ buildPythonPackage {
     version
     src
     patches
+    postPatch
     ;
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/deid/default.nix b/pkgs/development/python-modules/deid/default.nix
index 8d60dd9aa3e9..4158e30b6948 100644
--- a/pkgs/development/python-modules/deid/default.nix
+++ b/pkgs/development/python-modules/deid/default.nix
@@ -2,22 +2,20 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
-  pytestCheckHook,
+  setuptools,
   matplotlib,
   pydicom,
   python-dateutil,
-  setuptools,
+  pytestCheckHook,
+  versionCheckHook,
 }:
 
 let
-  deid-data = buildPythonPackage rec {
+  deid-data = buildPythonPackage {
     pname = "deid-data";
     version = "unstable-2022-12-06";
     pyproject = true;
 
-    disabled = pythonOlder "3.7";
-
     build-system = [ setuptools ];
 
     dependencies = [ pydicom ];
@@ -39,18 +37,16 @@ let
 in
 buildPythonPackage rec {
   pname = "deid";
-  version = "0.3.25";
+  version = "0.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   # Pypi version has no tests
   src = fetchFromGitHub {
     owner = "pydicom";
-    repo = pname;
+    repo = "deid";
     # the github repo does not contain Pypi version tags:
-    rev = "830966d52846c6b721fabb4cc1c75f39eabd55cc";
-    hash = "sha256-+slwnQSeRHpoCsvZ24Gq7rOBpQL37a6Iqrj4Mqj6PCo=";
+    rev = "14d1e4eb70f2c9fda43fca411794be9d8a5a8516";
+    hash = "sha256-YsLWHIO6whcBQriMYb0tDD9s/RrxlfeKGORF1UCOilI=";
   };
 
   build-system = [ setuptools ];
@@ -64,7 +60,9 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     deid-data
     pytestCheckHook
+    versionCheckHook
   ];
+  versionCheckProgramArg = [ "--version" ];
 
   pythonImportsCheck = [ "deid" ];
 
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index a69ae736a22a..70dc31735c67 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -31,25 +31,16 @@
 
 buildPythonPackage rec {
   pname = "devito";
-  version = "4.8.11";
+  version = "4.8.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${version}";
-    hash = "sha256-c8/b2dRwfH4naSVRaRon6/mBDva7RSDmi/TJUJp26g0=";
+    hash = "sha256-Eqyq96mVB5ZhPaLASesWhzjjHcXz/tAIOPP//8yGoBM=";
   };
 
-  # packaging.metadata.InvalidMetadata: 'python_version_3.8_' is invalid for 'provides-extra'
-  postPatch = ''
-    substituteInPlace requirements-testing.txt \
-      --replace-fail 'pooch; python_version >= "3.8"' "pooch"
-
-    substituteInPlace tests/test_builtins.py \
-      --replace-fail "from scipy.misc import ascent" "from scipy.datasets import ascent"
-  '';
-
   pythonRemoveDeps = [ "pip" ];
 
   pythonRelaxDeps = true;
@@ -125,6 +116,10 @@ buildPythonPackage rec {
       # Numerical tests
       "test_lm_fb"
       "test_lm_ds"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+      # Numerical error
+      "test_pow_precision"
     ];
 
   disabledTestPaths =
diff --git a/pkgs/development/python-modules/dicom2nifti/default.nix b/pkgs/development/python-modules/dicom2nifti/default.nix
index 6df9a652fb6f..bb426fd4d483 100644
--- a/pkgs/development/python-modules/dicom2nifti/default.nix
+++ b/pkgs/development/python-modules/dicom2nifti/default.nix
@@ -2,16 +2,22 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
-  pytestCheckHook,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   gdcm,
   nibabel,
   numpy,
   pydicom,
+  scipy,
+
+  # tests
+  pillow,
   pylibjpeg,
   pylibjpeg-libjpeg,
-  scipy,
-  setuptools,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -19,8 +25,6 @@ buildPythonPackage rec {
   version = "2.5.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
   # no tests in PyPI dist
   src = fetchFromGitHub {
     owner = "icometrix";
@@ -29,9 +33,14 @@ buildPythonPackage rec {
     hash = "sha256-lPaBKqYO8B138fCgeKH6vpwGQhN3JCOnDj5PgaYfRPA=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/test_generic.py --replace-fail "from common" "from dicom2nifti.common"
+    substituteInPlace tests/test_ge.py --replace-fail "import convert_generic" "import dicom2nifti.convert_generic as convert_generic"
+  '';
+
   build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     gdcm
     nibabel
     numpy
@@ -39,24 +48,37 @@ buildPythonPackage rec {
     scipy
   ];
 
-  postPatch = ''
-    substituteInPlace tests/test_generic.py --replace-fail "from common" "from dicom2nifti.common"
-    substituteInPlace tests/test_ge.py --replace-fail "import convert_generic" "import dicom2nifti.convert_generic as convert_generic"
-  '';
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pylibjpeg
-    pylibjpeg-libjpeg
-  ];
-
   pythonImportsCheck = [ "dicom2nifti" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    pillow
+    pylibjpeg
+    pylibjpeg-libjpeg
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # OverflowError: Python integer -1024 out of bounds for uint16
+    "test_not_a_volume"
+    "test_resampling"
+    "test_validate_orthogonal_disabled"
+
+    # RuntimeError: Unable to decompress 'JPEG 2000 Image Compression (Lossless O...
+    "test_anatomical"
+    "test_compressed_j2k"
+    "test_main_function"
+    "test_rgb"
+
+    # Missing script 'dicom2nifti_scrip'
+    "test_gantry_option"
+    "test_gantry_resampling"
+  ];
+
+  meta = {
     homepage = "https://github.com/icometrix/dicom2nifti";
     description = "Library for converting dicom files to nifti";
     mainProgram = "dicom2nifti";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/hvplot/default.nix b/pkgs/development/python-modules/hvplot/default.nix
index 6c5010fc61b0..b258af4f6c59 100644
--- a/pkgs/development/python-modules/hvplot/default.nix
+++ b/pkgs/development/python-modules/hvplot/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
+  fetchFromGitHub,
 
   # build-system
   setuptools-scm,
@@ -30,11 +29,11 @@ buildPythonPackage rec {
   version = "0.11.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-t60fLxxwXkfiayLInBFxGoT3d0+qq6t1a0Xo0eAKYBA=";
+  src = fetchFromGitHub {
+    owner = "holoviz";
+    repo = "hvplot";
+    tag = "v${version}";
+    hash = "sha256-3zACW2RDRhdGi5RBPOVQJJHT78DwcgHaCHp27gIEnjA=";
   };
 
   build-system = [
@@ -60,7 +59,20 @@ buildPythonPackage rec {
     plotly
   ];
 
+  disabledTests = [
+    # Legacy dask-expr implementation is deprecated
+    # NotImplementedError: The legacy implementation is no longer supported
+    "test_dask_dataframe_patched"
+    "test_dask_series_patched"
+  ];
+
   disabledTestPaths = [
+    # Legacy dask-expr implementation is deprecated
+    # NotImplementedError: The legacy implementation is no longer supported
+    "hvplot/tests/plotting/testcore.py"
+    "hvplot/tests/testcharts.py"
+    "hvplot/tests/testgeowithoutgv.py"
+
     # All of the following below require xarray.tutorial files that require
     # downloading files from the internet (not possible in the sandbox).
     "hvplot/tests/testgeo.py"
diff --git a/pkgs/development/python-modules/manim/default.nix b/pkgs/development/python-modules/manim/default.nix
index d4f476145303..ce0268daca80 100644
--- a/pkgs/development/python-modules/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@@ -268,6 +268,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "manim" ];
 
   meta = {
+    # https://github.com/ManimCommunity/manim/pull/4037
+    broken = lib.versionAtLeast av.version "14";
     description = "Animation engine for explanatory math videos - Community version";
     longDescription = ''
       Manim is an animation engine for explanatory math videos. It's used to
diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index 129cef19d5ad..45f128abb7e8 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -5,6 +5,7 @@
   pytestCheckHook,
   pythonOlder,
   setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
@@ -21,6 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-gXCFBe58Ij6CiwTddsI4tkPsGBR2z9D8dnxlvTXGSMw=";
   };
 
+  dependencies = lib.optionals (pythonOlder "3.11") [
+    typing-extensions
+  ];
+
   build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index 9473c4aae69a..0e9ed03cd15b 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-sdk";
-  version = "1.20.0";
+  version = "1.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${version}";
-    hash = "sha256-kZ+m75oNTh/AJ+hl8Nhulzvk62CWVOx0hJKRFyc0CSI=";
+    hash = "sha256-e8LeFQroHCHcHDnVnIlz1FTkb4XJ2ANuT4z/82t3P54=";
   };
 
   build-system = [ flit-core ];
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Microsoft Graph SDK for Python";
     homepage = "https://github.com/microsoftgraph/msgraph-sdk-python";
-    changelog = "https://github.com/microsoftgraph/msgraph-sdk-python/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/microsoftgraph/msgraph-sdk-python/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/nilearn/default.nix b/pkgs/development/python-modules/nilearn/default.nix
index 63a3fd62c2f3..535321edb909 100644
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@@ -1,19 +1,24 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
-  pytestCheckHook,
+  fetchFromGitHub,
+
+  # build-system
   hatch-vcs,
+  hatchling,
+
+  # dependencies
+  joblib,
   lxml,
-  matplotlib,
   nibabel,
   numpy,
   pandas,
+  requests,
   scikit-learn,
   scipy,
-  joblib,
-  requests,
+  packaging,
+
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -21,36 +26,53 @@ buildPythonPackage rec {
   version = "0.11.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-oB3wj8bI3tPNb7eiEWNGA61Gpt94BQS20FIiwuepcv4=";
+  src = fetchFromGitHub {
+    owner = "nilearn";
+    repo = "nilearn";
+    tag = version;
+    hash = "sha256-ZvodSRJkKwPwpYHOLmxAYIIv7f9AlrjmZS9KLPjz5rM=";
   };
 
-  nativeBuildInputs = [ hatch-vcs ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail " --template=maint_tools/templates/index.html" ""
+  '';
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  disabledTests = [ "test_clean_confounds" ]; # https://github.com/nilearn/nilearn/issues/2608
-  # do subset of tests which don't fetch resources
-  pytestFlagsArray = [ "nilearn/connectome/tests" ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     joblib
     lxml
-    matplotlib
     nibabel
     numpy
     pandas
     requests
     scikit-learn
     scipy
+    packaging
   ];
 
-  meta = with lib; {
-    homepage = "https://nilearn.github.io";
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # https://github.com/nilearn/nilearn/issues/2608
+    "test_clean_confounds"
+
+    # [XPASS(strict)] invalid checks should fail
+    "test_check_estimator_invalid_group_sparse_covariance"
+  ];
+
+  # do subset of tests which don't fetch resources
+  pytestFlagsArray = [ "nilearn/connectome/tests" ];
+
+  meta = {
     description = "Module for statistical learning on neuroimaging data";
+    homepage = "https://nilearn.github.io";
     changelog = "https://github.com/nilearn/nilearn/releases/tag/${version}";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/niworkflows/default.nix b/pkgs/development/python-modules/niworkflows/default.nix
index 05e21f2834ab..5811062df376 100644
--- a/pkgs/development/python-modules/niworkflows/default.nix
+++ b/pkgs/development/python-modules/niworkflows/default.nix
@@ -2,9 +2,13 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatch-vcs,
   hatchling,
-  pytestCheckHook,
+
+  # dependencies
+  acres,
   attrs,
   importlib-resources,
   jinja2,
@@ -26,18 +30,24 @@
   templateflow,
   traits,
   transforms3d,
+
+  # tests
+  pytest-cov-stub,
+  pytest-env,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "niworkflows";
-  version = "1.12.0";
+  version = "1.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nipreps";
     repo = "niworkflows";
     tag = version;
-    hash = "sha256-OWsfz5YDPy1qPpXomr4YiuCDf40Fy1pW8cNHPjHfqp4=";
+    hash = "sha256-rgnfp12SHlL3LFFMSrHlTd0tWNnA4ekxZ9kKYRvZWlw=";
   };
 
   pythonRelaxDeps = [ "traits" ];
@@ -48,6 +58,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    acres
     attrs
     importlib-resources
     jinja2
@@ -73,29 +84,38 @@ buildPythonPackage rec {
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  preCheck = ''export HOME=$(mktemp -d)'';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytest-env
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
   pytestFlagsArray = [ "niworkflows" ];
-  # try to download data:
+
   disabledTests = [
-    "test_GenerateCifti"
+    # try to download data:
     "ROIsPlot"
     "ROIsPlot2"
+    "niworkflows.interfaces.cifti._prepare_cifti"
+    "niworkflows.utils.misc.get_template_specs"
+    "test_GenerateCifti"
     "test_SimpleShowMaskRPT"
     "test_cifti_surfaces_plot"
-    "niworkflows.utils.misc.get_template_specs"
-    "niworkflows.interfaces.cifti._prepare_cifti"
   ];
-  disabledTestPaths = [ "niworkflows/tests/test_registration.py" ];
+
+  disabledTestPaths = [
+    "niworkflows/tests/test_registration.py"
+  ];
 
   pythonImportsCheck = [ "niworkflows" ];
 
-  meta = with lib; {
+  meta = {
     description = "Common workflows for MRI (anatomical, functional, diffusion, etc.)";
     mainProgram = "niworkflows-boldref";
     homepage = "https://github.com/nipreps/niworkflows";
     changelog = "https://github.com/nipreps/niworkflows/blob/${src.tag}/CHANGES.rst";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/pydicom-seg/default.nix b/pkgs/development/python-modules/pydicom-seg/default.nix
index 420c4505e706..0797548a190f 100644
--- a/pkgs/development/python-modules/pydicom-seg/default.nix
+++ b/pkgs/development/python-modules/pydicom-seg/default.nix
@@ -3,13 +3,18 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
-  pythonOlder,
-  pytest7CheckHook,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   jsonschema,
   numpy,
   pydicom,
   simpleitk,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -17,14 +22,12 @@ buildPythonPackage rec {
   version = "0.4.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "razorx89";
-    repo = pname;
+    repo = "pydicom-seg";
     tag = "v${version}";
-    hash = "sha256-2Y3fZHKfZqdp5EU8HfVsmJ5JFfVGZuAR7+Kj7qaTiPM=";
     fetchSubmodules = true;
+    hash = "sha256-2Y3fZHKfZqdp5EU8HfVsmJ5JFfVGZuAR7+Kj7qaTiPM=";
   };
 
   patches = [
@@ -36,7 +39,10 @@ buildPythonPackage rec {
     })
   ];
 
-  pythonRelaxDeps = [ "jsonschema" ];
+  pythonRelaxDeps = [
+    "jsonschema"
+    "numpy"
+  ];
 
   build-system = [ poetry-core ];
 
@@ -47,15 +53,17 @@ buildPythonPackage rec {
     simpleitk
   ];
 
-  nativeCheckInputs = [ pytest7CheckHook ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pydicom_seg" ];
 
-  meta = with lib; {
+  meta = {
     description = "Medical segmentation file reading and writing";
     homepage = "https://github.com/razorx89/pydicom-seg";
     changelog = "https://github.com/razorx89/pydicom-seg/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    # ModuleNotFoundError: No module named 'pydicom._storage_sopclass_uids'
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pydicom/default.nix b/pkgs/development/python-modules/pydicom/default.nix
index 13fbb8e4d0d5..f1c42f7579c9 100644
--- a/pkgs/development/python-modules/pydicom/default.nix
+++ b/pkgs/development/python-modules/pydicom/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
   flit-core,
   numpy,
   pytestCheckHook,
@@ -11,8 +10,8 @@
   # optional/test dependencies
   gdcm,
   pillow,
-  pylibjpeg,
   pylibjpeg-libjpeg,
+  writableTmpDirAsHomeHook,
 }:
 let
   # Pydicom needs pydicom-data to run some tests. If these files aren't downloaded
@@ -29,8 +28,6 @@ buildPythonPackage rec {
   version = "3.0.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "pydicom";
     repo = "pydicom";
@@ -55,13 +52,15 @@ buildPythonPackage rec {
     ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.pixeldata;
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ] ++ optional-dependencies.pixeldata;
 
   # Setting $HOME to prevent pytest to try to create a folder inside
   # /homeless-shelter which is read-only.
   # Linking pydicom-data dicom files to $HOME/.pydicom/data
   preCheck = ''
-    export HOME=$TMP/test-home
     mkdir -p $HOME/.pydicom/
     ln -s ${test_data}/data_store/data $HOME/.pydicom/data
   '';
@@ -90,12 +89,20 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pydicom" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python package for working with DICOM files";
     mainProgram = "pydicom";
     homepage = "https://pydicom.github.io";
     changelog = "https://github.com/pydicom/pydicom/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    badPlatforms = [
+      # > 200 tests are failing with errors like:
+      # AttributeError: 'FileDataset' object has no attribute 'BitsStored'
+      # AttributeError: 'FileDataset' object has no attribute 'Rows'
+      # AttributeError: The dataset has no 'Pixel Data', 'Float Pixel Data' or 'Double Float Pixel Data' element, no pixel data to decode
+      # pydicom.errors.InvalidDicomError: File is missing DICOM File Meta Information header or the 'DICM' prefix is missing from the header.
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/pyorthanc/default.nix b/pkgs/development/python-modules/pyorthanc/default.nix
index 09ef97b0b058..3e84ec6edf34 100644
--- a/pkgs/development/python-modules/pyorthanc/default.nix
+++ b/pkgs/development/python-modules/pyorthanc/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
   poetry-core,
   httpx,
   pydicom,
@@ -10,20 +9,23 @@
 
 buildPythonPackage rec {
   pname = "pyorthanc";
-  version = "1.19.0";
-  disabled = pythonOlder "3.8";
+  version = "1.19.1";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gacou54";
-    repo = pname;
+    repo = "pyorthanc";
     tag = "v${version}";
-    hash = "sha256-6//kmkurtaXRGvnYnk/kU2j9F6V1Aui6IEdl+3DHGH0=";
+    hash = "sha256-97i341NXb7QsgN0X808mtz1rSKYSP+SMoGJy43Tkwug=";
   };
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [
+    "pydicom"
+  ];
+
   dependencies = [
     httpx
     pydicom
@@ -33,11 +35,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pyorthanc" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python library that wraps the Orthanc REST API";
     homepage = "https://github.com/gacou54/pyorthanc";
-    changelog = "https://github.com/gacou54/pyorthanc/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bcdarwin ];
+    changelog = "https://github.com/gacou54/pyorthanc/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/torchio/default.nix b/pkgs/development/python-modules/torchio/default.nix
index 9a2c22ffc736..3627c923ad6f 100644
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@@ -1,42 +1,54 @@
 {
-  stdenv,
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
-  pythonOlder,
+
+  # build-system
+  hatchling,
+
+  # dependencies
   deprecated,
-  humanize,
   matplotlib,
   nibabel,
   numpy,
-  parameterized,
+  packaging,
+  rich,
   scipy,
   simpleitk,
   torch,
   tqdm,
   typer,
+
+  # tests
+  humanize,
+  parameterized,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "torchio";
-  version = "0.20.3";
+  version = "0.20.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "fepegar";
     repo = "torchio";
     tag = "v${version}";
-    hash = "sha256-I91KcrCwHkjY7oh5RFWfV93pRgd4iQVCBVTtd4TqXGo=";
+    hash = "sha256-pcUc0pnpb3qQLMOYU9yh7cljyCQ+Ngf8fJDcrRrK8LQ=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
     deprecated
     humanize
     nibabel
     numpy
+    packaging
+    rich
     scipy
     simpleitk
     torch
@@ -45,10 +57,11 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     matplotlib
     parameterized
+    pytestCheckHook
   ];
+
   disabledTests =
     [
       # tries to download models:
@@ -58,15 +71,17 @@ buildPythonPackage rec {
       # RuntimeError: DataLoader worker (pid(s) <...>) exited unexpectedly
       "test_queue_multiprocessing"
     ];
+
   pythonImportsCheck = [
     "torchio"
     "torchio.data"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Medical imaging toolkit for deep learning";
     homepage = "https://torchio.readthedocs.io";
-    license = licenses.asl20;
-    maintainers = [ maintainers.bcdarwin ];
+    changelog = "https://github.com/TorchIO-project/torchio/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.bcdarwin ];
   };
 }
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index d63bd6a7b1e5..6864efed6579 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -131,6 +131,13 @@ let
     ]
   );
 
+  # Fix read out of range on aarch64 16k pages builds
+  # https://github.com/NixOS/nixpkgs/pull/365364
+  # https://github.com/NixOS/nixpkgs/pull/380991
+  # Can likely be removed when v34.2.1 (or v32.3.0?) releases:
+  # https://github.com/electron/electron/pull/45571
+  needsAarch64PageSizeFix = lib.versionAtLeast version "34" && stdenv.hostPlatform.isAarch64;
+
   linux = finalAttrs: {
     buildInputs = [
       glib
@@ -153,6 +160,19 @@ let
       chmod u-x $out/libexec/electron/*.so*
     '';
 
+    # We use null here to not cause unnecessary rebuilds.
+    dontWrapGApps = if needsAarch64PageSizeFix then true else null;
+    preFixup =
+      if needsAarch64PageSizeFix then
+        ''
+          wrapProgram "$out/libexec/electron/chrome_crashpad_handler" "''${gappsWrapperArgs[@]}"
+          wrapProgram "$out/libexec/electron/chrome-sandbox" "''${gappsWrapperArgs[@]}"
+          wrapProgram "$out/libexec/electron/electron" "''${gappsWrapperArgs[@]}" \
+            --add-flags "--js-flags=--no-decommit-pooled-pages"
+        ''
+      else
+        null;
+
     postFixup = ''
       patchelf \
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index f817e8020dec..22043a48c759 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -67,35 +67,35 @@
     },
     "32": {
         "hashes": {
-            "aarch64-darwin": "7b0071f5162fe81cc020e76b3e71aa18e5e888edacca6a0c92f389199097534c",
-            "aarch64-linux": "292740690b445bf8e3b13c37c74ff2c9820e8d30f6d0ac8e03a62421746f189c",
-            "armv7l-linux": "efc6bfdbd92e76cde23bfa0967809593ae32e74ed1897765f1105e3761db9478",
-            "headers": "0pmgcns26pvvp7ihqkl9llpdr8l871p7m6r72scia93siwnyvrvv",
-            "x86_64-darwin": "a7070ea98e5a4c5d53b2184229428d29109682165be62b17faf0bcdd9547174f",
-            "x86_64-linux": "8fb72c1d19a51552438eb42fdaae915643c2e310fa3090d8d5293ad6fc94b8c5"
+            "aarch64-darwin": "9d2de7531f8b4baa513c8622f37415855c889b0e99e59cbdc9570f8056f148fe",
+            "aarch64-linux": "63aca27373f86044d82bb54a531288d94cb5a248438d222ee3fe4e2282667ea7",
+            "armv7l-linux": "d6152c0e36ddeea3d23fd945c6c382507fdb95bf8f0a4d2f2b00966ce59aca66",
+            "headers": "0j87666by9hbqkb3c0wxcjp5g8b7da807al9j4gjrspzp3r96a91",
+            "x86_64-darwin": "9221ca22b8902508092581c59c9910abd9324e9234699107566e5913bccebc1b",
+            "x86_64-linux": "4619dd27038abd1165c4f84caa013a0826445428c11cc29d524c5737476edaa3"
         },
-        "version": "32.3.0"
+        "version": "32.3.1"
     },
     "33": {
         "hashes": {
-            "aarch64-darwin": "90044a7aa13f18ca4077a33131190b55fdf3ca5cb0704c537ca630fd0e06369e",
-            "aarch64-linux": "6542b3152ea9d8dd005a1b8f55b6971dee0f954b3b4e0bab4d625d501a946093",
-            "armv7l-linux": "95d79d2d2a154783fa6435d937a3e98b4408f2ce75f6706e5781d0d7e2e49d44",
-            "headers": "00v71c9fy3na040bnp5llp6951fsqls6hnlvbds5gckw3wfdcymc",
-            "x86_64-darwin": "d66a1400fe3c446f93eabf51b9520a300cdd25805a03d96a4528bda089f4988e",
-            "x86_64-linux": "f854ceb7362f7eeafdcdfc4a8898493adb72e3433595c59f072427912115d41b"
+            "aarch64-darwin": "6613ca0dc9f4e0a4488113efcb9a6d81ea32b18842eaac879d2d15f6f6776b8d",
+            "aarch64-linux": "194c26e79668ba176e1a641a8a0184cc7c0509b3eda9db64137a33f7b29f23a2",
+            "armv7l-linux": "78ebab80ea5f9b0407179fdbf65a6a533e9e8cc67324eba1916d197a0f163c51",
+            "headers": "1qlsrljlw08253hpiiccmb0kafnbihyxc7hlvakbhnbwils393xr",
+            "x86_64-darwin": "723dd6e1b136fc6a4c00432769114fcae80a261a985934311ce730910d0c4df1",
+            "x86_64-linux": "91950f2c5bd17f03920a20d6e2d57676f341c7ad27fb828570f4e00a1566f407"
         },
-        "version": "33.4.0"
+        "version": "33.4.1"
     },
     "34": {
         "hashes": {
-            "aarch64-darwin": "a38a624bee92ee601777c20e6bdbf040d1b2a5506ba1ccac8be1447b1c6b0bfd",
-            "aarch64-linux": "37d68cef35888c8ca8bbe2002be0a122e8e8ccaf762b60ade1af5e71918e080b",
-            "armv7l-linux": "741374570bd9e435037f41b42aea7ab640f7ef1e75afb4705cc12344f43ed04c",
-            "headers": "0b0djna1bprfff0y1pb2wdzsx82v1c1zk20gl2vivgjhslxf0igl",
-            "x86_64-darwin": "a2ba4f91882819801da2d499de3426dbb191a22f2fe4a6ec92b756f1a0dc2de8",
-            "x86_64-linux": "9fbca20baea84800f7f50a9b245302dddbfab3425dd762c482d79e867a5a6dbe"
+            "aarch64-darwin": "ee447c17b2ac545e48083113d7e39a916821c1316f60f42cbcbee4fffe7c022a",
+            "aarch64-linux": "818c91309da8ff948c43df58a996c05c0d27daa690e1d659355d9db01e351919",
+            "armv7l-linux": "0c75996c6bf2d37d0441d3e1021386a9348f8d21783d75571cdb10ede606424f",
+            "headers": "17f06fx4yidshmkdicis6k4azph95mxs1rwpm0ll53szpcs7rdss",
+            "x86_64-darwin": "8ef741819c8a5370dabc3b9df5e6ac217366477c5d5c656ed23c800bc984d887",
+            "x86_64-linux": "f12a02d86cc657500978d263ec6d1841b6e2085cd3bd4d30a97cfe14685396f3"
         },
-        "version": "34.1.1"
+        "version": "34.2.0"
     }
 }
diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index 58ff11fa1758..272ff6f99a3c 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -34,35 +34,35 @@
     },
     "32": {
         "hashes": {
-            "aarch64-darwin": "679a286100f2121a3566f7d0988894611628e93920843c873de36d3e37f1b0e9",
-            "aarch64-linux": "6a297a8db6f64ac3c95ddc17d2a9f95bff3d2fddef2aae565ebf91bcca960f3a",
-            "armv7l-linux": "c76c9ec01fff88a9cda3aedfd8251880a835d326c349b108f09e02a419dd9a52",
-            "headers": "0pmgcns26pvvp7ihqkl9llpdr8l871p7m6r72scia93siwnyvrvv",
-            "x86_64-darwin": "495b3f0e0459badba8f6e3406edd4bcf7e688eb9d11d4b544426fb25d1e22f43",
-            "x86_64-linux": "af9e3a6aac492827e1ace64fc50744f82523f09842b2414ad00d9a97f06d7a85"
+            "aarch64-darwin": "606a20ba0c4ca3ff5143d84114c76701866da9d6ca5563c4f230024a9fad107b",
+            "aarch64-linux": "027d2c4bafbce2903a52bef70a8aadce6bdee8f32cf3e9aa043cef58114bf4f1",
+            "armv7l-linux": "2084fe0130e0d32a94d7181b9ee0d38b67e38852efe72a44768bfd541074d631",
+            "headers": "0j87666by9hbqkb3c0wxcjp5g8b7da807al9j4gjrspzp3r96a91",
+            "x86_64-darwin": "8846b009c7f86dd40630fde6b914dbcd7e1acaf79bfbf6c69b5408a0c91f22f3",
+            "x86_64-linux": "53f7ca0ee2bc52d7e22d75c3c3815f62f1616e82cfe030b11399549beb85f623"
         },
-        "version": "32.3.0"
+        "version": "32.3.1"
     },
     "33": {
         "hashes": {
-            "aarch64-darwin": "0b87f00cf22d2c73a795af554cf9548e0204769d22ffdc7f28183572d4f7fef0",
-            "aarch64-linux": "5387c7a22c93dfcac348ea5ec604fb8350926e8e2681ca189e0500ff993d58d0",
-            "armv7l-linux": "53e1fa127812bcfb5a095f781368ee2d9cceb4a91d83dcb32a7ecf072cf39034",
-            "headers": "00v71c9fy3na040bnp5llp6951fsqls6hnlvbds5gckw3wfdcymc",
-            "x86_64-darwin": "9a8ec97a21d41b146b010dfe7e4df71907a23bdf0500619036de623b4ddb1ce1",
-            "x86_64-linux": "ea57c5bafecd8502fa95df73c977efb2a061068eac965d97f99b824479d55de2"
+            "aarch64-darwin": "df7713ab2e4a7d3b059c507abcd1bb5ec8b71274407035658100529555a6ac65",
+            "aarch64-linux": "e6f369ceebe049c7c119f943cc36617de3094b45eaf495259599ef65352d2eb5",
+            "armv7l-linux": "41f9241f412c842027128f1260bb2f07799ddb0e6dfd22171296ccfc5c1d3ce6",
+            "headers": "1qlsrljlw08253hpiiccmb0kafnbihyxc7hlvakbhnbwils393xr",
+            "x86_64-darwin": "1fda63a3a64d68cb83c6619dafbf4ba4434b99b1c273c3ecdc3cc8de0ff2f422",
+            "x86_64-linux": "e3d6fd631f5c1ff63850b7f0af8f3cf325200f66bdf3371c911b8f14f8a44673"
         },
-        "version": "33.4.0"
+        "version": "33.4.1"
     },
     "34": {
         "hashes": {
-            "aarch64-darwin": "c2aa24978fbe0c3dfb8ae36816633a75f498b4af5052b059631a626925951e41",
-            "aarch64-linux": "df87d6f0b91a549996c764bb60eaf692c59e087496406562e3bcbb3f90a52d50",
-            "armv7l-linux": "74b53fff1d210066024476ebbfef7476b05c2c71cd141953b5b7e0a35d129a02",
-            "headers": "0b0djna1bprfff0y1pb2wdzsx82v1c1zk20gl2vivgjhslxf0igl",
-            "x86_64-darwin": "95239f35723eeca036ed1e29f7871a4de843c6eda16bccc04436402dddd938aa",
-            "x86_64-linux": "62734cb681a6da3c73b20504f49c7759c9dbb1c923e250d67c11888426e3cad0"
+            "aarch64-darwin": "c0a187acca68906c4a6387e8fabd052cb031ace6132d60a71001d9a0e891958e",
+            "aarch64-linux": "61e03d4fa570976d80f740637f56192b6448a05a73d1fba9717900b29f2b1b4d",
+            "armv7l-linux": "ec774d9b1a1b828a0db1502a1017fcab1dfed99b1b6b2fd2308dd600a1efa98a",
+            "headers": "17f06fx4yidshmkdicis6k4azph95mxs1rwpm0ll53szpcs7rdss",
+            "x86_64-darwin": "fa5a46d752267d8497d375e19079e8b6a8df70c234a79b2d6b48f5862e1a0abc",
+            "x86_64-linux": "cc15a6e6206485a2d96649ceb60509b9da04fa2811c4824b2e0eb43d1f4b1417"
         },
-        "version": "34.1.1"
+        "version": "34.2.0"
     }
 }
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 06f50a74c5d0..ea2ec1579b31 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -161,13 +161,14 @@ in
 
   env =
     base.env
-    // lib.optionalAttrs (lib.versionOlder info.version "33" && stdenv.hostPlatform.isAarch64) {
+    // lib.optionalAttrs (lib.versionOlder info.version "33") {
       # Hydra fails to build electron_32.aarch64-linux as of 2025-01-05 due to
       # clang spamming deprecation warnings mid-build, causing the build log to
       # grow beyond the limit of 64mb and then getting killed by Hydra. This
       # renders our clang both too old for the latest chromium without the use
       # of -Wno-unknown-warning-option and also too new for electron_32 (M128).
-      # For some reason, this is exclusively happening on aarch64-linux. To
+      # For some reason, the log size limit appears to only be enforced on
+      # aarch64-linux. x86_64-linux happily succeeds to build with ~180mb. To
       # unbreak the build on h.n.o, we simply disable those warnings for now.
       # https://hydra.nixos.org/build/283952243
       NIX_CFLAGS_COMPILE = base.env.NIX_CFLAGS_COMPILE + " -Wno-deprecated";
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 07190692cd02..1a1fcb674405 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -47,10 +47,10 @@
             },
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-pOWNw6MLjy7ucMGtF/sVPNmlmje0ozqRhEwOPkfW1oM=",
+                "hash": "sha256-3W6F30x90mLX1BdL9zY/YLShFRUGirokadzEg5QX6TU=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v32.3.0"
+                "rev": "v32.3.1"
             },
             "src/media/cdm/api": {
                 "fetcher": "fetchFromGitiles",
@@ -938,7 +938,7 @@
         "electron_yarn_hash": "122y1vnizwg0rwz8qf37mvpa0i78141y98wn4h11l6b9gyshrs65",
         "modules": "128",
         "node": "20.18.1",
-        "version": "32.3.0"
+        "version": "32.3.1"
     },
     "33": {
         "chrome": "130.0.6723.191",
@@ -988,10 +988,10 @@
             },
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-1Sl36LYp/tePk5ChWKv9ZCVcoEZECMEDKKiKvpO8ea8=",
+                "hash": "sha256-cOiflmkAzX0U7wFoGwxYDKMMrmSdjn18oXvguS6RSeY=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v33.4.0"
+                "rev": "v33.4.1"
             },
             "src/media/cdm/api": {
                 "fetcher": "fetchFromGitiles",
@@ -1891,6 +1891,6 @@
         "electron_yarn_hash": "0bzsswcg62b39xinq5vikk7qz7d15276s2vc15v1gcb5wvh05ff8",
         "modules": "130",
         "node": "20.18.1",
-        "version": "33.4.0"
+        "version": "33.4.1"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 630cc673e791..3284b4d54aa0 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.14-rc2",
-        "hash": "sha256:1i7zxjz0vckl31cb6anb0b9m0k7l3y2gk6r5y6in41p8mjf4rrpk"
+        "version": "6.14-rc3",
+        "hash": "sha256:19w0hzb4bbfsckd189p4fvsm6nhsrsbsrwr9ca2k2gxmdjdyd9hi"
     },
     "6.1": {
         "version": "6.1.128",
@@ -20,19 +20,19 @@
         "hash": "sha256:0mm4q8f6kbqddy4zaxjf5xyqpnla5qprvsf7v3vq01gmlzr3rivc"
     },
     "6.6": {
-        "version": "6.6.77",
-        "hash": "sha256:0km855dnimg1clilnpcz293bd2gpbycvn3llm9kyynhjrzgqj408"
+        "version": "6.6.78",
+        "hash": "sha256:1vckmam50nw8gms1wj18p5mv7rkpl849k3q587bkl4smsndrm8ss"
     },
     "6.11": {
         "version": "6.11.11",
         "hash": "sha256:1z2913y38clnlmhvwj49h7p4pic24s4d8np7nmd4lk7m2xz8w532"
     },
     "6.12": {
-        "version": "6.12.13",
-        "hash": "sha256:1fpvfj4q2v3przxj5lkb3ra28h3g0mq9dqj4rvx4qnsmkvmdxszk"
+        "version": "6.12.14",
+        "hash": "sha256:054gi5fp60d2536z06b1lmys9zlraixh22yb75z42xfqnjzz88wl"
     },
     "6.13": {
-        "version": "6.13.2",
-        "hash": "sha256:01g73bnif9ynccb772628sca01y8zkww8wzb39qfkfvbj20jkxnd"
+        "version": "6.13.3",
+        "hash": "sha256:0b60rbii83lx2h455nm66hhlnygckprbaw3qifmala16xlazncys"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 088c7ef0fe50..9b6afa18763d 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.1.127-rt48"; # updated by ./update-rt.sh
+  version = "6.1.128-rt49"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "0xkqpwhvz6qhaxzg1j993lv1iyvb2zydgq6d8mhdbfkz38fx9c0q";
+      sha256 = "1wshgkgcxaf4mnm4ngngsj8gq1cg8kq56f5kqsdfcw0m339nfkc7";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1sq79iibjsph3jmmihabamzmm4sr68sw87jqqa3khzq7f2s6cwmg";
+            sha256 = "1gyy9zwfcczy9v8790f06kaz7gg75a4cf4qpyjffqx3s21lwzbjf";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 3210da6a022b..7e217a23ea28 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.6.74-rt48"; # updated by ./update-rt.sh
+  version = "6.6.77-rt50"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "0ka9snxl0y57fajy8vszwa4ggn48pid8m1879d4vl3mbicd2nppi";
+      sha256 = "0km855dnimg1clilnpcz293bd2gpbycvn3llm9kyynhjrzgqj408";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1rpbbm9fln2v6xigxrsajivr4zmh0nika3nmm1y7ws31njkg57gq";
+            sha256 = "10kzns1c6yqn7az2i7zwm1lnss56mi6w44rw7xm2kk6n1h80590n";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 935fcb4001fc..0de175e9025a 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -20,6 +20,7 @@
   netcat,
   timetrap,
   util-linux,
+  wayland,
 }:
 
 let
@@ -29,6 +30,7 @@ let
   libPath = lib.concatStringsSep ":" [
     "${glib.out}/lib"
     "${xorg.libXrandr}/lib"
+    "${wayland.out}/lib"
   ];
   scriptPath = lib.concatStringsSep ":" [
     "${bash}/bin"
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
index 829f8f96ca82..bbfe36d70956 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@@ -6,18 +6,18 @@
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.3.8";
+  version = "4.3.9";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-fu+0O5WXzsy/HN2j7M2zBg8YgPUcSuzeOhOf1akATes=";
+    hash = "sha256-7Eoa1CVruVDuNHvvcdxMERWtq1S+HIFPXMFc+GZu4ns=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-AwJmFsVFOV6rapnLm9Y660TFiX9HIOIU4049EIyWWuM=";
+  npmDepsHash = "sha256-jjN8VFVw4wFAArUzdxjmH6w9M9WUtpKUgjPqfE3jTOw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 1b68751b13e9..38d9e3c57829 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -108,6 +108,16 @@ let
         };
       });
 
+      av = super.av.overridePythonAttrs (rec {
+        version = "13.1.0";
+        src = fetchFromGitHub {
+          owner = "PyAV-Org";
+          repo = "PyAV";
+          tag = "v${version}";
+          hash = "sha256-x2a9SC4uRplC6p0cD7fZcepFpRidbr6JJEEOaGSWl60=";
+        };
+      });
+
       eq3btsmart = super.eq3btsmart.overridePythonAttrs (oldAttrs: rec {
         version = "1.4.1";
         src = fetchFromGitHub {
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index a45707b4cdb6..9660ad0f6424 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -67,6 +67,10 @@ let
       # tries to retrieve file from github
       "test_non_text_stdout_capture"
     ];
+    stream = [
+      # crashes with x265>=4.0
+      "test_h265_video_is_hvc1"
+    ];
     websocket_api = [
       # AssertionError: assert 'unknown_error' == 'template_error'
       "test_render_template_with_timeout"
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
deleted file mode 100644
index d5434daeef38..000000000000
--- a/pkgs/servers/monitoring/loki/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ stdenv
-, lib
-, buildGoModule
-, fetchFromGitHub
-, makeWrapper
-, nixosTests
-, systemd
-, testers
-, grafana-loki
-}:
-
-buildGoModule rec {
-  version = "3.4.0";
-  pname = "grafana-loki";
-
-  src = fetchFromGitHub {
-    owner = "grafana";
-    repo = "loki";
-    rev = "v${version}";
-    hash = "sha256-fFdp2QZQgrLPcgzY833TfGvW7QPR/Omq0wwvcejMXac=";
-  };
-
-  vendorHash = null;
-
-  subPackages = [
-    # TODO split every executable into its own package
-    "cmd/loki"
-    "cmd/loki-canary"
-    "clients/cmd/promtail"
-    "cmd/logcli"
-    "cmd/lokitool"
-  ];
-
-  tags = ["promtail_journal_enabled"];
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ systemd.dev ];
-
-  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    wrapProgram $out/bin/promtail \
-      --prefix LD_LIBRARY_PATH : "${lib.getLib systemd}/lib"
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) loki;
-    version = testers.testVersion {
-      command = "loki --version";
-      package = grafana-loki;
-    };
-  };
-
-  ldflags = let t = "github.com/grafana/loki/v3/pkg/util/build"; in [
-    "-s"
-    "-w"
-    "-X ${t}.Version=${version}"
-    "-X ${t}.BuildUser=nix@nixpkgs"
-    "-X ${t}.BuildDate=unknown"
-    "-X ${t}.Branch=unknown"
-    "-X ${t}.Revision=unknown"
-  ];
-
-  meta = with lib; {
-    description = "Like Prometheus, but for logs";
-    mainProgram = "promtail";
-    license = with licenses; [ agpl3Only asl20 ];
-    homepage = "https://grafana.com/oss/loki/";
-    changelog = "https://github.com/grafana/loki/releases/tag/v${version}";
-    maintainers = with maintainers; [ willibutz globin mmahut emilylange ];
-  };
-}
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 6267021e208c..a6c11b3ddbc7 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5";
-  version = "5.1.11";
+  version = "5.1.12";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-8J2gr2quZvJELd3zzhgwZUowjkOylpM6VZGJ1G3VomI=";
+    hash = "sha256-Jk7YY6nrY1Yn9KeNlRJbMF/fCMIlUVg/Elt7SymlK84=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix
index b604a7e838bf..2b73d1f179c8 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-anthy";
-  version = "5.1.5";
+  version = "5.1.6";
 
   src = fetchurl {
     url = "https://download.fcitx-im.org/fcitx5/fcitx5-anthy/${pname}-${version}.tar.zst";
-    hash = "sha256-heSO2eArdSnOmIg7JG8vOo5y3g5dSPOuXkUfeNqKzSA=";
+    hash = "sha256-XIgzYHiSE/PHNGUt68IZXKahPwYOZ3O0bq/KO1MrnCI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
index 33b4571da34d..163c922359da 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-chewing";
-  version = "5.1.6";
+  version = "5.1.7";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-WSu78k0udlXxiQ1sAqB/LKmVfThxizshH5C9q2CfZLI=";
+    hash = "sha256-QL1rRMsaDP98as0zlmoDPoVnbqbKQFoUFSCX+j31JcM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
index 101db511b155..4203126e72e5 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@@ -34,13 +34,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-chinese-addons";
-  version = "5.1.7";
+  version = "5.1.8";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-vtIzm8ia5hC0JdsGNopIHdAd8RDVgrbtVvj1Jh+gE94=";
+    hash = "sha256-QO136EbUFxT7yA1Fs4DvV0CKpdCMw/s5s9sW3vRzGD8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix
index 86271423a841..61ac278d0239 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-hangul";
-  version = "5.1.5";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-+IXsMT87Dc+Ad4r6/U+NLYo+04j+I58Cqz99v4Yr0uc=";
+    hash = "sha256-WTTMW86KsrncfDHttri2eSA0bp/Vm4QVyl9tWkJn00E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
index ec040d344998..4a6b3dc7268b 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "fcitx5-lua";
-  version = "5.0.13";
+  version = "5.0.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-XRfYQquR9SVlYr2sX6ii8JjMyjJZWSMf1u2oKUmOhf8=";
+    hash = "sha256-7FBUOsaKr9cuEaqd4dqnAGL5sd3RF+qV6GEkOUQ1/k4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix
index 8d6640b3254a..7eaaa0fc818d 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-m17n";
-  version = "5.1.2";
+  version = "5.1.3";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-LBFPkkBaKcVtTLKswLlr1EdCoY63nToa8I7ea1/MZeg=";
+    hash = "sha256-kHMCMsJ8+rI0AtS9zEE5knGvKALhgfmgS8lC/CTmYs0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index e7ada4963a1a..f8c7d6742d19 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.8";
+  version = "5.1.9";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-up4EC4GLzDjd9QJzeV2b2uVZNxYa268D/FotCyy1sos=";
+    hash = "sha256-cOCLPsWRcwukGCKAYHrZSRUYlmfYxdyspX5Y0rqbD2w=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
index 1ef0ac41f321..d6c7eda599a4 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-rime";
-  version = "5.1.9";
+  version = "5.1.10";
 
   src = fetchurl {
     url = "https://download.fcitx-im.org/fcitx5/${pname}/${pname}-${version}.tar.zst";
-    hash = "sha256-+aIb7ktmhKb6ixhvzCG6GLeEUfS3QHJmEZ3YGE5YrZg=";
+    hash = "sha256-ACW79fLgrS+Qv8YJjGr4WldTJsnnGhC0WWf8ia9khYk=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
index 34bfa097dca2..0978efc04c07 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-skk";
-  version = "5.1.5";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-wv5vX9eFlBUY7x4v9U+OuhKgX6V/b3iTaCvAIwJO10o=";
+    hash = "sha256-1gfR0wXBXM6Gttwldg2vm8DUUW4OciqKMQkpFQHqLoE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix
index 07ae7b36fb77..c6b43043956b 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-unikey";
-  version = "5.1.5";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-unikey";
     rev = version;
-    hash = "sha256-CcyDK+knBXh2P+g3aB0Cv8F5BX7uCRbYwHjMEYo9k8A=";
+    hash = "sha256-hx3GXoloO3eQP9yhLY8v1ahwvOTCe5XcBey+ZbReRjE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4401ad85e6be..82a3a7d601d5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11256,9 +11256,6 @@ with pkgs;
   grafana = callPackage ../servers/monitoring/grafana { };
   grafanaPlugins = callPackages ../servers/monitoring/grafana/plugins { };
 
-  grafana-loki = callPackage ../servers/monitoring/loki { };
-  promtail = callPackage ../servers/monitoring/loki/promtail.nix { };
-
   hasura-graphql-engine = haskell.lib.compose.justStaticExecutables haskell.packages.ghc810.graphql-engine;
 
   hasura-cli = callPackage ../servers/hasura/cli.nix { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 10651337cb3e..9eff14a8fea6 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1269,6 +1269,8 @@ let
 
     netchannel = callPackage ../development/ocaml-modules/netchannel { };
 
+    nice_parser = callPackage ../development/ocaml-modules/nice_parser { };
+
     ninja_utils = callPackage ../development/ocaml-modules/ninja_utils { };
 
     nonstd =  callPackage ../development/ocaml-modules/nonstd { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5d524cae7cd8..b26f800094b5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -51,6 +51,8 @@ self: super: with self; {
 
   acquire = callPackage ../development/python-modules/acquire { };
 
+  acres = callPackage ../development/python-modules/acres { };
+
   actdiag = callPackage ../development/python-modules/actdiag { };
 
   acunetix = callPackage ../development/python-modules/acunetix { };