diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 90b2f335206b..88199611a21f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -20357,6 +20357,11 @@
     githubId = 3958212;
     name = "Tom Sorlie";
   };
+  scd31 = {
+    name = "scd31";
+    github = "scd31";
+    githubId = 57571338;
+  };
   schinmai-akamai = {
     email = "schinmai@akamai.com";
     github = "tchinmai7";
@@ -25035,6 +25040,12 @@
     githubId = 58453832;
     keys = [ { fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4"; } ];
   };
+  yechielw = {
+    name = "yechielw";
+    email = "yechielworen@gmail.com";
+    github = "yechielw";
+    githubId = 41305372;
+  };
   yelite = {
     name = "Lite Ye";
     email = "yelite958@gmail.com";
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index b404fa35052f..a7ebb49b62b8 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -875,6 +875,12 @@
   "module-services-networking-dnsmasq-references": [
     "index.html#module-services-networking-dnsmasq-references"
   ],
+  "module-service-doh-server": [
+    "index.html#module-service-doh-server"
+  ],
+  "module-service-doh-server-quick-start": [
+    "index.html#module-service-doh-server-quick-start"
+  ],
   "module-services-samba": [
     "index.html#module-services-samba"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 280b3ddb9488..772f7daa8d79 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -53,6 +53,8 @@
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
+- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
+
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index be529602d675..b5b6fd8c0e2f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1055,6 +1055,7 @@
   ./services/networking/dnsmasq.nix
   ./services/networking/dnsproxy.nix
   ./services/networking/doh-proxy-rust.nix
+  ./services/networking/doh-server.nix
   ./services/networking/ejabberd.nix
   ./services/networking/envoy.nix
   ./services/networking/epmd.nix
diff --git a/nixos/modules/services/networking/doh-server.md b/nixos/modules/services/networking/doh-server.md
new file mode 100644
index 000000000000..2ac1630aa29d
--- /dev/null
+++ b/nixos/modules/services/networking/doh-server.md
@@ -0,0 +1,69 @@
+# DNS-over-HTTPS Server {#module-service-doh-server}
+
+[DNS-over-HTTPS](https://github.com/m13253/dns-over-https) is a high performance DNS over HTTPS client & server. This module enables its server part (`doh-server`).
+
+## Quick Start {#module-service-doh-server-quick-start}
+
+Setup with Nginx + ACME (recommended):
+
+```nix
+{
+  services.doh-server = {
+    enable = true;
+    settings = {
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."doh.example.com" = {
+      enableACME = true;
+      forceSSL = true;
+      http2 = true;
+      locations."/".return = 404;
+      locations."/dns-query" = {
+        proxyPass = "http://127.0.0.1:8053/dns-query";
+        recommendedProxySettings = true;
+      };
+    };
+    # and other virtual hosts ...
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "you@example.com";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
+```
+
+`doh-server` can also work as a standalone HTTPS web server (with SSL cert and key specified), but this is not recommended as `doh-server` does not do OCSP Stabbing.
+
+Setup a standalone instance with ACME:
+
+```nix
+let
+  domain = "doh.example.com";
+in
+{
+  security.acme.certs.${domain} = {
+    dnsProvider = "cloudflare";
+    credentialFiles."CF_DNS_API_TOKEN_FILE" = "/run/secrets/cf-api-token";
+  };
+
+  services.doh-server = {
+    enable = true;
+    settings = {
+      listen = [ ":443" ];
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+    useACMEHost = domain;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 443 ];
+}
+```
+
+See a full configuration in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf.
diff --git a/nixos/modules/services/networking/doh-server.nix b/nixos/modules/services/networking/doh-server.nix
new file mode 100644
index 000000000000..baa3e1844946
--- /dev/null
+++ b/nixos/modules/services/networking/doh-server.nix
@@ -0,0 +1,175 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.doh-server;
+  toml = pkgs.formats.toml { };
+in
+{
+  options.services.doh-server = {
+    enable = lib.mkEnableOption "DNS-over-HTTPS server";
+
+    package = lib.mkPackageOption pkgs "dns-over-https" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = toml.type;
+        options = {
+
+          listen = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "127.0.0.1:8053"
+              "[::1]:8053"
+            ];
+            example = [ ":443" ];
+            description = "HTTP listen address and port";
+          };
+
+          path = lib.mkOption {
+            type = lib.types.str;
+            default = "/dns-query";
+            example = "/dns-query";
+            description = "HTTP path for resolve application";
+          };
+
+          upstream = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "udp:1.1.1.1:53"
+              "udp:1.0.0.1:53"
+              "udp:8.8.8.8:53"
+              "udp:8.8.4.4:53"
+            ];
+            example = [ "udp:127.0.0.1:53" ];
+            description = ''
+              Upstream DNS resolver.
+              If multiple servers are specified, a random one will be chosen each time.
+              You can use "udp", "tcp" or "tcp-tls" for the type prefix.
+              For "udp", UDP will first be used, and switch to TCP when the server asks to or the response is too large.
+              For "tcp", only TCP will be used.
+              For "tcp-tls", DNS-over-TLS (RFC 7858) will be used to secure the upstream connection.
+            '';
+          };
+
+          timeout = lib.mkOption {
+            type = lib.types.int;
+            default = 10;
+            example = 15;
+            description = "Upstream timeout";
+          };
+
+          tries = lib.mkOption {
+            type = lib.types.int;
+            default = 3;
+            example = 5;
+            description = "Number of tries if upstream DNS fails";
+          };
+
+          verbose = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = "Enable logging";
+          };
+
+          log_guessed_client_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
+              Note: http uri/useragent log cannot be controlled by this config
+            '';
+          };
+
+          ecs_allow_non_global_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              By default, non global IP addresses are never forwarded to upstream servers.
+              This is to prevent two things from happening:
+                1. the upstream server knowing your private LAN addresses;
+                2. the upstream server unable to provide geographically near results,
+                  or even fail to provide any result.
+              However, if you are deploying a split tunnel corporation network environment, or for any other reason you want to inhibit this behavior and allow local (eg RFC1918) address to be forwarded, change the following option to "true".
+            '';
+          };
+
+          ecs_use_precise_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask. This option is to be used only on private networks where knowledge of the terminal endpoint may be required for security purposes (eg. DNS Firewalling). Not a good option on the internet where IP address may be used to identify the user and not only the approximate location.
+            '';
+          };
+        };
+      };
+      default = { };
+      example = {
+        listen = [ ":8153" ];
+        upstream = [ "udp:127.0.0.1:53" ];
+      };
+      description = "Configuration of doh-server in toml. See example in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf";
+    };
+
+    useACMEHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "doh.example.com";
+      description = ''
+        A host of an existing Let's Encrypt certificate to use.
+        *Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using [](#opt-security.acme.certs).*
+      '';
+    };
+
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/path/to/doh-server.conf";
+      description = ''
+        The config file for the doh-server.
+        Setting this option will override any configuration applied by the `settings` option.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.doh-server.configFile = lib.mkDefault (toml.generate "doh-server.conf" cfg.settings);
+    services.doh-server.settings = lib.mkIf (cfg.useACMEHost != null) (
+      let
+        sslCertDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
+      in
+      {
+        cert = "${sslCertDir}/cert.pem";
+        key = "${sslCertDir}/key.pem";
+      }
+    );
+    systemd.services.doh-server = {
+      description = "DNS-over-HTTPS Server";
+      documentation = [ "https://github.com/m13253/dns-over-https" ];
+      after = [
+        "network.target"
+      ] ++ lib.optional (cfg.useACMEHost != null) "acme-${cfg.useACMEHost}.service";
+      wants = lib.optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        ExecStart = "${cfg.package}/bin/doh-server -conf ${cfg.configFile}";
+        LimitNOFILE = 1048576;
+        Restart = "always";
+        RestartSec = 3;
+        Type = "simple";
+        DynamicUser = true;
+        SupplementaryGroups = lib.optional (cfg.useACMEHost != null) "acme";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ DictXiong ];
+  meta.doc = ./doh-server.md;
+}
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
index e29f2a1fb93e..f9a586b23b8d 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix
@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "edraw";
-  version = "1.2.0-unstable-2024-12-18";
+  version = "1.2.0-unstable-2025-01-06";
 
   src = fetchFromGitHub {
     owner = "misohena";
     repo = "el-easydraw";
-    rev = "1c46469d0ea3642958eaf7cea1016fcf05b4daec";
-    hash = "sha256-Z7LPC112FXHtDop1HXPnR6S+cSqfEW1HuYS8YD/qM+c=";
+    rev = "9a5b5e2b071be99350bfc8db6fbc2c9c667f3725";
+    hash = "sha256-lQYSUQFAv6rqvZySsFbe8B7ZqEaa2L+L3HXB231D4OQ=";
   };
 
   propagatedUserEnvPkgs = [ gzip ];
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2d0e4413d46a..17825ae97ff2 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,24 +9,24 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.78";
+        stable = "0.0.79";
         ptb = "0.0.124";
-        canary = "0.0.549";
-        development = "0.0.60";
+        canary = "0.0.556";
+        development = "0.0.61";
       }
     else
       {
-        stable = "0.0.330";
-        ptb = "0.0.153";
-        canary = "0.0.661";
-        development = "0.0.68";
+        stable = "0.0.331";
+        ptb = "0.0.154";
+        canary = "0.0.668";
+        development = "0.0.70";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-1G9NM0Z6dN2LtunHkkIzNNA+xFslxhnI8GVrjXlNZK8=";
+        hash = "sha256-gQVx+PueGDofUjKSvyorCu73myNujcKz9gugMKB9koY=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -34,29 +34,29 @@ let
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-hwgvPNoEGjfg6uLlC/k3iYfxfjbja5H2F2aSiEcGZ/o=";
+        hash = "sha256-5qn0YL0+1uE6kmQO3Fh2DD0gNjk6MT+yAdIoMK7Y8Tw=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-SL+lWMSXC1Y11Sk59sE7F8n04DED2365RKKeKFU8R6o=";
+        hash = "sha256-9ssgue3Y8StyKnc1dvr6b0Z3hjPYtJCNuVsruqFx8ug=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-wLDr2jtjPsV3rUsFCNKKHXTwGPdoR/whLmr4w8I7x+U=";
+        hash = "sha256-U37JyZwPmsk6ArD8Lz0xAiy/I78H+wHSig3+1BpD9iA=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-EvIEMyqOotnyqBC8w4XbF+RuP+g2Bjt4hD4aEeEzZGU=";
+        hash = "sha256-BVKhyLoz/EoaZ6LgCaJuZZ37u9ProXOPddrfg171Eu4=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-dCeLnfgvaKngO8r/VIDgQLkMKgV7BDOOKcXUdo91Eeo=";
+        hash = "sha256-1eCHufW68AuYuYWzfq6Tt+YylFgCLT88DrvrNZvQG8A=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-5sUkGN9ucyYArGkfbGBdJokoqpHKBrkwxH055LpMlrs=";
+        hash = "sha256-UdHwa/ALOOt/bNA6UmVJB8GNe+yHJ1xFoyF0nT1Zn3g=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/by-name/bi/bigloo/package.nix b/pkgs/by-name/bi/bigloo/package.nix
index 53f76870a4fc..054acfa7c8f1 100644
--- a/pkgs/by-name/bi/bigloo/package.nix
+++ b/pkgs/by-name/bi/bigloo/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bigloo";
-  version = "4.4b";
+  version = "4.5b";
 
   src = fetchurl {
     url = "ftp://ftp-sop.inria.fr/indes/fp/Bigloo/bigloo-${version}.tar.gz";
-    sha256 = "sha256-oxOSJwKWmwo7PYAwmeoFrKaYdYvmvQquWXyutolc488=";
+    sha256 = "sha256-hk1SXuan/zOf2ajJc8xGv5piOjgn2Ev7bgSikiNwfaU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index c4e672e62b7b..869ce53a5255 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.35.0";
+  version = "11.36.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-WBzl3DyjPr5vV9oobqZx1pprs4gkVN9BafOMIMqqb7E=";
+    hash = "sha256-LISy9xMAv9Wal+iRF9qoCLrQnq0r4HOqCir/w0uTrAA=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-rgjYpiTWp9KqC7gX05Fx5h2hKT1ah2GQorPzPhJpQH0=";
+  vendorHash = "sha256-JweIdmjnybaOyL5GOxCmP8TpyMYTG9qD5aFbabAJ4h8=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/de/debootstrap/package.nix b/pkgs/by-name/de/debootstrap/package.nix
index 08b65af738b2..09c5c65c6f19 100644
--- a/pkgs/by-name/de/debootstrap/package.nix
+++ b/pkgs/by-name/de/debootstrap/package.nix
@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "debootstrap";
-  version = "1.0.138";
+  version = "1.0.140";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "debootstrap";
     rev = "refs/tags/${version}";
-    hash = "sha256-2NUFt39isGThOqlg1LNOFxYJOPm93jDCvIztJoE5Vts=";
+    hash = "sha256-kusY42HwyMFuzwJimdVzuwx9XGjKssGAR7guB4E0TbQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
index 983408cab16c..e9cb4d5526e9 100644
--- a/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
+++ b/pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch
@@ -1,4 +1,4 @@
-From 47406ebaf0260e5b66a92baac3717936c8386b69 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:52:59 +0200
 Subject: [PATCH] nixpkgs: use system Python
@@ -10,7 +10,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  2 files changed, 5 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 9f2b336b1a..53a2c93c59 100644
+index 9f2b336b1a36ca0d2f04a40ac1809b30ff21df27..53a2c93c59492a12ef4a6ecfc0c8a679f0df73f7 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
 @@ -1,28 +1,25 @@
@@ -47,7 +47,7 @@ index 9f2b336b1a..53a2c93c59 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index b92dd461ba..cef32b3140 100644
+index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f131184fe4 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
 @@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
diff --git a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
index 0e42864dadba..b3f66ac22552 100644
--- a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
+++ b/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
@@ -1,4 +1,4 @@
-From 4be181e96199529a36e9a93c837af7173c827493 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:58:00 +0200
 Subject: [PATCH] nixpkgs: use system Go
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index c68eb4bf3e..addee4f6af 100644
+index c68eb4bf3ed2d39d46d38d7bd0eeab2c74a507fa..addee4f6af74ea78ae778b73384e01db83ac6694 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -20,7 +20,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
diff --git a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
index 8b1a0b016259..b8be06be0730 100644
--- a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
+++ b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
@@ -1,4 +1,4 @@
-From 3ecb08a7603a07310d1a38c0f47bc54bbe1f11c8 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:59:22 +0200
 Subject: [PATCH] nixpkgs: use system C/C++ toolchains
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index addee4f6af..dc1967e43b 100644
+index addee4f6af74ea78ae778b73384e01db83ac6694..dc1967e43b2b71358d2767a3d83b52819987290d 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -26,7 +26,11 @@ JQ_VERSION = "1.7"
diff --git a/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
new file mode 100644
index 000000000000..4c31f1e8a90c
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch
@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <katexochen0@gmail.com>
+Date: Thu, 2 Jan 2025 09:32:41 +0100
+Subject: [PATCH] nixpkgs: patch boringssl for gcc14
+
+Signed-off-by: Paul Meyer <katexochen0@gmail.com>
+---
+ bazel/boringssl-gcc14.patch | 25 +++++++++++++++++++++++++
+ bazel/repositories.bzl      |  1 +
+ 2 files changed, 26 insertions(+)
+ create mode 100644 bazel/boringssl-gcc14.patch
+
+diff --git a/bazel/boringssl-gcc14.patch b/bazel/boringssl-gcc14.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..8dcad4cc11f691eec93efa29075c1d356732e58b
+--- /dev/null
++++ b/bazel/boringssl-gcc14.patch
+@@ -0,0 +1,25 @@
++diff --git a/crypto/internal.h b/crypto/internal.h
++index a77102d..a45f97b 100644
++--- a/crypto/internal.h
+++++ b/crypto/internal.h
++@@ -1174,6 +1174,11 @@
++ 
++ // Arithmetic functions.
++ 
+++// The most efficient versions of these functions on GCC and Clang depend on C11
+++// |_Generic|. If we ever need to call these from C++, we'll need to add a
+++// variant that uses C++ overloads instead.
+++#if !defined(__cplusplus)
+++
++ // CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
++ // bit. |carry| must be zero or one.
++ #if OPENSSL_HAS_BUILTIN(__builtin_addc)
++@@ -1275,6 +1280,8 @@
++ #define CRYPTO_subc_w CRYPTO_subc_u32
++ #endif
++ 
+++#endif  // !__cplusplus
+++
++ 
++ // FIPS functions.
++ 
+diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
+index 5cb573770f0aeac7b42d803673c8c520b5e35131..e864ef24db4bf837ef50d90c8eca316eba939d74 100644
+--- a/bazel/repositories.bzl
++++ b/bazel/repositories.bzl
+@@ -264,6 +264,7 @@ def _boringssl():
+         patch_args = ["-p1"],
+         patches = [
+             "@envoy//bazel:boringssl_static.patch",
++            "@envoy//bazel:boringssl-gcc14.patch",
+         ],
+     )
+ 
diff --git a/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch b/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
new file mode 100644
index 000000000000..5537128a4582
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch
@@ -0,0 +1,128 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "dependency-envoy[bot]"
+ <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Date: Fri, 8 Nov 2024 21:09:22 +0000
+Subject: [PATCH] deps: Bump `rules_rust` -> 0.54.1 (#37056)
+
+Fix #37054
+
+Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Signed-off-by: Ryan Northey <ryan@synca.io>
+---
+ bazel/repository_locations.bzl                | 10 ++++++---
+ .../dynamic_modules/sdk/rust/Cargo.Bazel.lock | 21 +++++++++++--------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
+index 85a125d44ece6c655f94aab3d986d96ab837897f..cfe7d145b59b691f6455b58b1baaae48276b7e9f 100644
+--- a/bazel/repository_locations.bzl
++++ b/bazel/repository_locations.bzl
+@@ -1465,12 +1465,16 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         license = "Emscripten SDK",
+         license_url = "https://github.com/emscripten-core/emsdk/blob/{version}/LICENSE",
+     ),
++    # After updating you may need to run:
++    #
++    #     CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
++    #
+     rules_rust = dict(
+         project_name = "Bazel rust rules",
+         project_desc = "Bazel rust rules (used by Wasm)",
+         project_url = "https://github.com/bazelbuild/rules_rust",
+-        version = "0.51.0",
+-        sha256 = "042acfb73469b2d1848fe148d81c3422c61ea47a9e1900f1c9ec36f51e8e7193",
++        version = "0.54.1",
++        sha256 = "af4f56caae50a99a68bfce39b141b509dd68548c8204b98ab7a1cafc94d5bb02",
+         # Note: rules_rust should point to the releases, not archive to avoid the hassle of bootstrapping in crate_universe.
+         # This is described in https://bazelbuild.github.io/rules_rust/crate_universe.html#setup, otherwise bootstrap
+         # is required which in turn requires a system CC toolchains, not the bazel controlled ones.
+@@ -1482,7 +1486,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         ],
+         implied_untracked_deps = ["rules_cc"],
+         extensions = ["envoy.wasm.runtime.wasmtime"],
+-        release_date = "2024-09-19",
++        release_date = "2024-11-07",
+         cpe = "N/A",
+         license = "Apache-2.0",
+         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",
+diff --git a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+index fa6012f406464428b37d548eecd6cec3fdaf901b..6af752304b65af39aa621fa201a8c0108931dad0 100644
+--- a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
++++ b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+@@ -1,5 +1,5 @@
+ {
+-  "checksum": "96b309ddded40cf6f46a62829d15a02d7253b4cc94af2ac1890e492f9c07e93f",
++  "checksum": "b550022ca979d6b55c6dbee950bbf18368e4b8da16973c4e88e292b4d6f28e81",
+   "crates": {
+     "aho-corasick 1.1.3": {
+       "name": "aho-corasick",
+@@ -2149,9 +2149,6 @@
+     "aarch64-apple-ios-sim": [
+       "aarch64-apple-ios-sim"
+     ],
+-    "aarch64-fuchsia": [
+-      "aarch64-fuchsia"
+-    ],
+     "aarch64-linux-android": [
+       "aarch64-linux-android"
+     ],
+@@ -2159,6 +2156,9 @@
+     "aarch64-pc-windows-msvc": [
+       "aarch64-pc-windows-msvc"
+     ],
++    "aarch64-unknown-fuchsia": [
++      "aarch64-unknown-fuchsia"
++    ],
+     "aarch64-unknown-linux-gnu": [
+       "aarch64-unknown-linux-gnu"
+     ],
+@@ -2197,8 +2197,8 @@
+       "aarch64-apple-darwin",
+       "aarch64-apple-ios",
+       "aarch64-apple-ios-sim",
+-      "aarch64-fuchsia",
+       "aarch64-linux-android",
++      "aarch64-unknown-fuchsia",
+       "aarch64-unknown-linux-gnu",
+       "aarch64-unknown-nixos-gnu",
+       "aarch64-unknown-nto-qnx710",
+@@ -2213,9 +2213,9 @@
+       "s390x-unknown-linux-gnu",
+       "x86_64-apple-darwin",
+       "x86_64-apple-ios",
+-      "x86_64-fuchsia",
+       "x86_64-linux-android",
+       "x86_64-unknown-freebsd",
++      "x86_64-unknown-fuchsia",
+       "x86_64-unknown-linux-gnu",
+       "x86_64-unknown-nixos-gnu"
+     ],
+@@ -2264,15 +2264,15 @@
+     "wasm32-wasi": [
+       "wasm32-wasi"
+     ],
++    "wasm32-wasip1": [
++      "wasm32-wasip1"
++    ],
+     "x86_64-apple-darwin": [
+       "x86_64-apple-darwin"
+     ],
+     "x86_64-apple-ios": [
+       "x86_64-apple-ios"
+     ],
+-    "x86_64-fuchsia": [
+-      "x86_64-fuchsia"
+-    ],
+     "x86_64-linux-android": [
+       "x86_64-linux-android"
+     ],
+@@ -2283,6 +2283,9 @@
+     "x86_64-unknown-freebsd": [
+       "x86_64-unknown-freebsd"
+     ],
++    "x86_64-unknown-fuchsia": [
++      "x86_64-unknown-fuchsia"
++    ],
+     "x86_64-unknown-linux-gnu": [
+       "x86_64-unknown-linux-gnu"
+     ],
diff --git a/pkgs/by-name/en/envoy/0006-gcc-warnings.patch b/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
new file mode 100644
index 000000000000..a0c7dd94a263
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0006-gcc-warnings.patch
@@ -0,0 +1,127 @@
+From 448e4e14f4f188687580362a861ae4a0dbb5b1fb Mon Sep 17 00:00:00 2001
+From: "Krinkin, Mike" <krinkin.m.u@gmail.com>
+Date: Sat, 16 Nov 2024 00:40:40 +0000
+Subject: [PATCH] [contrib] Disable GCC warnings and broken features (#37131)
+
+Currently contrib does not build with GCC because of various false
+positive compiler warnings turned to errors and a GCC compiler bug.
+
+Let's first start with the bug, in GCC apparently
+using -gsplit-dwarf (debug fission) and -fdebug-types-section (used to
+optimize the size of debug inforamtion), when used together, can result
+in a linker failure.
+
+Refer to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885 for the GCC
+bug report of this issue. When it comes to Envoy, optimized builds with
+GCC are affected on at least GCC 11 (used by --config=docker-gcc) and
+GCC 12 (and I'm pretty sure the bug isn't fixed in any newer versions
+either, though I didn't check each version).
+
+Given that we cannot have both debug fission and a debug types section,
+we decided to abandon the debug types sections and keep the fission.
+
+That being said, apparently both of those options are unmaintained in
+GCC which poses a question of long term viability of using those or GCC.
+
+Other changes in this commit disable GCC compiler errors for various
+warnings that happen when building contrib. I checked those warnings and
+didn't find any true
+positive.
+
+And additionally, for warnings that exists in both Clang and GCC, Clang
+warnings don't trigger, so Clang also disagrees with GCC here.
+
+Additionally missing-requires warning is new and does not exist in GCC
+11, but exists in later versions of GCC, so to avoid breaking on this
+warning for future versions of GCC I disabled it, but also tell GCC to
+not complain if it sees a flag related to an unknwon diagnostic.
+
+This is the last change required to make GCC contrib builds work (you
+can find more context and discussions in
+https://github.com/envoyproxy/envoy/issues/31807)
+
+Risk Level: Low
+Testing: building with --config=gcc and --config=docker-gcc
+Docs Changes: N/A
+Release Notes: N/A
+Platform Specific Features: N/A
+Fixes #31807
+
+Signed-off-by: Mikhail Krinkin <krinkin.m.u@gmail.com>
+---
+ .bazelrc                 | 18 +++++++++++++++++-
+ bazel/envoy_internal.bzl | 16 +++++++++++++++-
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/.bazelrc b/.bazelrc
+index e0e4899cecf1..7df94c77944c 100644
+--- a/.bazelrc
++++ b/.bazelrc
+@@ -57,9 +57,9 @@ test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
+ # Allow tags to influence execution requirements
+ common --experimental_allow_tags_propagation
+ 
++build:linux --copt=-fdebug-types-section
+ # Enable position independent code (this is the default on macOS and Windows)
+ # (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
+-build:linux --copt=-fdebug-types-section
+ build:linux --copt=-fPIC
+ build:linux --copt=-Wno-deprecated-declarations
+ build:linux --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
+@@ -95,6 +95,21 @@ build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
+ build:gcc --test_env=HEAPCHECK=
+ build:gcc --action_env=BAZEL_COMPILER=gcc
+ build:gcc --action_env=CC=gcc --action_env=CXX=g++
++# This is to work around a bug in GCC that makes debug-types-section
++# option not play well with fission:
++# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885
++build:gcc --copt=-fno-debug-types-section
++# These trigger errors in multiple places both in Envoy dependecies
++# and in Envoy code itself when using GCC.
++# And in all cases the reports appear to be clear false positives.
++build:gcc --copt=-Wno-error=restrict
++build:gcc --copt=-Wno-error=uninitialized
++build:gcc --cxxopt=-Wno-missing-requires
++# We need this because -Wno-missing-requires options is rather new
++# in GCC, so flags -Wno-missing-requires exists in GCC 12, but does
++# not in GCC 11 and GCC 11 is what is used in docker-gcc
++# configuration currently
++build:gcc --cxxopt=-Wno-unknown-warning
+ 
+ # Clang-tidy
+ # TODO(phlax): enable this, its throwing some errors as well as finding more issues
+@@ -375,6 +390,7 @@ build:docker-clang-libc++ --config=docker-sandbox
+ build:docker-clang-libc++ --config=rbe-toolchain-clang-libc++
+ 
+ build:docker-gcc --config=docker-sandbox
++build:docker-gcc --config=gcc
+ build:docker-gcc --config=rbe-toolchain-gcc
+ 
+ build:docker-asan --config=docker-sandbox
+diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
+index 015659851c1b..27ecaa0bbf47 100644
+--- a/bazel/envoy_internal.bzl
++++ b/bazel/envoy_internal.bzl
+@@ -68,7 +68,21 @@ def envoy_copts(repository, test = False):
+                    "-Wc++2a-extensions",
+                    "-Wrange-loop-analysis",
+                ],
+-               repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
++               repository + "//bazel:gcc_build": [
++                   "-Wno-maybe-uninitialized",
++                   # GCC implementation of this warning is too noisy.
++                   #
++                   # It generates warnings even in cases where there is no ambiguity
++                   # between the overloaded version of a method and the hidden version
++                   # from the base class. E.g., when the two have different number of
++                   # arguments or incompatible types and therefore a wrong function
++                   # cannot be called by mistake without triggering a compiler error.
++                   #
++                   # As a safeguard, this warning is only disabled for GCC builds, so
++                   # if Clang catches a problem in the code we would get a warning
++                   # anyways.
++                   "-Wno-error=overloaded-virtual",
++               ],
+                # Allow 'nodiscard' function results values to be discarded for test code only
+                # TODO(envoyproxy/windows-dev): Replace /Zc:preprocessor with /experimental:preprocessor
+                # for msvc versions between 15.8 through 16.4.x. see
diff --git a/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch b/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
new file mode 100644
index 000000000000..196a499ec651
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch
@@ -0,0 +1,19 @@
+diff -Naur a/bazel/protobuf.patch b/bazel/protobuf.patch
+--- a/bazel/protobuf.patch	2025-01-06 23:00:26.683972526 +0100
++++ b/bazel/protobuf.patch	2025-01-07 00:53:33.997482569 +0100
+@@ -149,3 +149,15 @@
+  #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
+  #define PROTOBUF_DEBUG true
+  #else
++diff -Naur a/build_defs/cpp_opts.bzl b/build_defs/cpp_opts.bzl
++--- a/build_defs/cpp_opts.bzl	2025-01-06 23:02:56.356552216 +0100
+++++ b/build_defs/cpp_opts.bzl	2025-01-07 00:23:30.534047300 +0100
++@@ -22,7 +22,7 @@
++         "-Woverloaded-virtual",
++         "-Wno-sign-compare",
++         "-Wno-nonnull",
++-        "-Werror",
+++        "-Wno-maybe-uninitialized",
++     ],
++ })
++ 
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index c2e5025e298b..823e2c180b41 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -4,6 +4,7 @@
   bazel-gazelle,
   buildBazelPackage,
   fetchFromGitHub,
+  applyPatches,
   stdenv,
   cacert,
   cargo,
@@ -29,32 +30,66 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.32.0";
-    rev = "86dc7ef91ca15fb4957a74bd599397413fc26a24";
-    hash = "sha256-Wcbt62RfaNcTntmPjaAM0cP3LJangm4ht7Q0bzEpu5A=";
+    version = "1.32.3";
+    rev = "58bd599ebd5918d4d005de60954fcd2cb00abd95";
+    hash = "sha256-5HpxcsAPoyVOJ3Aem+ZjSLa8Zu6s76iCMiWJbp8RjHc=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-LkDNPFT7UUCsGPG1dMnwzdIw0lzc5+3JYDoblF5oZVk=";
-      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
+      x86_64-linux = "sha256-YFXNatolLM9DdwkMnc9SWsa6Z6/aGzqLmo/zKE7OFy0=";
+      aarch64-linux = "sha256-AjG1OBjPjiSwWCmIJgHevSQHx8+rzRgmLsw3JwwD0hk=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
   bazel = bazel_6;
-  src = fetchFromGitHub {
-    owner = "envoyproxy";
-    repo = "envoy";
-    inherit (srcVer) hash rev;
 
-    postFetch = ''
-      chmod -R +w $out
-      rm $out/.bazelversion
-      echo ${srcVer.rev} > $out/SOURCE_VERSION
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "envoyproxy";
+      repo = "envoy";
+      inherit (srcVer) hash rev;
+    };
+    patches = [
+      # use system Python, not bazel-fetched binary Python
+      ./0001-nixpkgs-use-system-Python.patch
+
+      # use system Go, not bazel-fetched binary Go
+      ./0002-nixpkgs-use-system-Go.patch
+
+      # use system C/C++ tools
+      ./0003-nixpkgs-use-system-C-C-toolchains.patch
+
+      # patch boringssl to work with GCC 14
+      # vendored patch from https://boringssl.googlesource.com/boringssl/+/c70190368c7040c37c1d655f0690bcde2b109a0d
+      ./0004-nixpkgs-patch-boringssl-for-gcc14.patch
+
+      # update rust rules to work with rustc v1.83
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/019f589da2cc8da7673edd077478a100b4d99436
+      # drop with v1.33.x
+      ./0005-deps-Bump-rules_rust-0.54.1-37056.patch
+
+      # patch gcc flags to work with GCC 14
+      # (silences erroneus -Werror=maybe-uninitialized and others)
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/448e4e14f4f188687580362a861ae4a0dbb5b1fb
+      # drop with v1.33.x
+      ./0006-gcc-warnings.patch
+
+      # Remove "-Werror" from protobuf build
+      # This is fixed in protobuf v28 and later:
+      # https://github.com/protocolbuffers/protobuf/commit/f5a1b178ad52c3e64da40caceaa4ca9e51045cb4
+      # drop with v1.33.x
+      ./0007-protobuf-remove-Werror.patch
+    ];
+    postPatch = ''
+      chmod -R +w .
+      rm ./.bazelversion
+      echo ${srcVer.rev} > ./SOURCE_VERSION
     '';
   };
 
@@ -80,17 +115,6 @@ buildBazelPackage rec {
     mv bazel/nix/rules_rust.patch bazel/rules_rust.patch
   '';
 
-  patches = [
-    # use system Python, not bazel-fetched binary Python
-    ./0001-nixpkgs-use-system-Python.patch
-
-    # use system Go, not bazel-fetched binary Go
-    ./0002-nixpkgs-use-system-Go.patch
-
-    # use system C/C++ tools
-    ./0003-nixpkgs-use-system-C-C-toolchains.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     python3
@@ -194,6 +218,8 @@ buildBazelPackage rec {
       "--noexperimental_strict_action_env"
       "--cxxopt=-Wno-error"
       "--linkopt=-Wl,-z,noexecstack"
+      "--config=gcc"
+      "--verbose_failures"
 
       # Force use of system Java.
       "--extra_toolchains=@local_jdk//:all"
diff --git a/pkgs/by-name/hy/hyfetch/package.nix b/pkgs/by-name/hy/hyfetch/package.nix
index b35d874fea04..6e11e1c0d7ea 100644
--- a/pkgs/by-name/hy/hyfetch/package.nix
+++ b/pkgs/by-name/hy/hyfetch/package.nix
@@ -3,12 +3,18 @@
   fetchFromGitHub,
   python3Packages,
   pciutils,
+  installShellFiles,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "hyfetch";
   version = "1.99.0";
   pyproject = true;
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
@@ -24,6 +30,10 @@ python3Packages.buildPythonApplication rec {
     python3Packages.typing-extensions
   ];
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   # No test available
   doCheck = false;
 
@@ -31,6 +41,15 @@ python3Packages.buildPythonApplication rec {
     "hyfetch"
   ];
 
+  # NOTE: The HyFetch project maintains an updated version of neofetch renamed
+  # to "neowofetch" which is included in this package. However, the man page
+  # included is still named "neofetch", so to prevent conflicts and confusion
+  # we rename the file to "neowofetch" before installing it:
+  postInstall = ''
+    mv ./docs/neofetch.1 ./docs/neowofetch.1
+    installManPage ./docs/hyfetch.1 ./docs/neowofetch.1
+  '';
+
   postFixup = ''
     wrapProgram $out/bin/neowofetch \
       --prefix PATH : ${lib.makeBinPath [ pciutils ]}
@@ -53,6 +72,7 @@ python3Packages.buildPythonApplication rec {
     maintainers = with lib.maintainers; [
       yisuidenghua
       isabelroses
+      nullcube
     ];
   };
 }
diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index 7229a0fb1515..956e97365bcc 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -91,6 +91,8 @@ buildNpmPackage rec {
         -c.electronVersion=${electron.version}
   '';
 
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/li/libmsquic/package.nix b/pkgs/by-name/li/libmsquic/package.nix
new file mode 100644
index 000000000000..965df2d62ad0
--- /dev/null
+++ b/pkgs/by-name/li/libmsquic/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  lttng-tools,
+  libatomic_ops,
+  perl,
+  coreutils,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmsquic";
+  version = "2.4.7";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "msquic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WveyZ9rMevLTc5C4cgMFcnj0O6Hd+HcfU8ccD6VBgyU=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+
+  buildInputs = [
+    lttng-tools
+    libatomic_ops
+  ];
+
+  postUnpack = ''
+    for f in "$(find . -type f -name "*.pl")"; do
+      patchShebangs --build $f 2>&1 > /dev/null
+    done
+
+    for g in $(find . -type f -name "*" ); do
+      if test -f $g; then
+        sed -i "s|/usr/bin/env|${coreutils}/bin/env|g" $g
+      fi
+    done
+  '';
+
+  meta = {
+    description = "Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust";
+    homepage = "https://github.com/microsoft/msquic";
+    changelog = "https://github.com/microsoft/msquic/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ SohamG ];
+  };
+})
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 4aff832dda89..8f286b23454b 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-tRLT/jR6e9fwmQWAZ1OwjAOMiLy7us9WjiGpS8NBOzHO7jJ4TofSRvvSwpohr9YsnLiLnqANdlWtuabRpQhLLw==";
+    hash = "sha512-Gpm17h5U9Cw9r5EHE1wF5e0aza9yaGPUf+rhMVAhXjrVYBqiUsc/UG11TXWqarKlLpRmPDe+BvCF0qqTtTEZhw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/minio-warp/package.nix b/pkgs/by-name/mi/minio-warp/package.nix
index 1f7df3303d83..6b5ad34ee504 100644
--- a/pkgs/by-name/mi/minio-warp/package.nix
+++ b/pkgs/by-name/mi/minio-warp/package.nix
@@ -3,20 +3,21 @@
   fetchFromGitHub,
   buildGoModule,
   versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "minio-warp";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "warp";
     rev = "v${version}";
-    hash = "sha256-TqgF8WkWz+OZGSwrjIMFg4WaSdunOrcjuYDhWuPZTU8=";
+    hash = "sha256-kME4yafNZtHDF/EAIG8qR4PH6HlokIfdBAJH+ibl5ro=";
   };
 
-  vendorHash = "sha256-i0npOEo+rplC+hU4yxGRpY8gX+VGjR7HwKbiv5mQ28M=";
+  vendorHash = "sha256-073ssCOh0CiiJaatwzhNrwpe2QO21iC6GSkwVtsmYjs=";
 
   # See .goreleaser.yml
   ldflags = [
@@ -37,6 +38,8 @@ buildGoModule rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = [ "--version" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "S3 benchmarking tool";
     homepage = "https://github.com/minio/warp";
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index 699ca788c733..5e64db8b9542 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,13 +23,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.58";
+  version = "0.9.59";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-zYxZk3j8ODrK52aLSI+qA9tmJbH/eFfKYXMyd0V1LzM=";
+    hash = "sha256-ey0Fb9ilm7I2QWG1gQpnHTlMPoQswNlkrZ/WhUaLbDk=";
   };
 
   # No tests
diff --git a/pkgs/by-name/sm/smap/package.nix b/pkgs/by-name/sm/smap/package.nix
new file mode 100644
index 000000000000..bad8a00ece3a
--- /dev/null
+++ b/pkgs/by-name/sm/smap/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+}:
+
+buildGoModule rec {
+  pname = "smap";
+  version = "0.1.12";
+
+  src = fetchFromGitHub {
+    owner = "s0md3v";
+    repo = "Smap";
+    tag = version;
+    hash = "sha256-GLw0zgjWnEwtwRV4vTHqGUS6TqcFhhZ1zeThKe6S0CY=";
+  };
+
+  vendorHash = "sha256-19plbD+ibjoqAA6gGhCvpO52z/VejJkRRh8ljBHN+qY=";
+
+  subPackages = [ "cmd/smap" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Drop-in replacement for Nmap powered by shodan.io";
+    homepage = "https://github.com/s0md3v/Smap";
+    changelog = "https://github.com/s0md3v/Smap/releases/tag/${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yechielw ];
+    mainProgram = "smap";
+  };
+}
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 9f4e711cbd0f..60c4e08c658f 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
-    rev = "refs/tags/" + version;
-    hash = "sha256-LzO6LpKsox5U2IHYZXDDkUbPeZmAa/gBpG6nk78tIzQ=";
+    tag = version;
+    hash = "sha256-p6RuLuhtgVOa8+l0JU5byQ4SHG/TmURPlZUMNVqvfp8=";
   };
 
-  cargoHash = "sha256-I0muMgPfk72dnR4iufipjt+C7v6X/IMOdLCH12qHjA8=";
+  cargoHash = "sha256-0tXsoKSQ0c3po75oMd6LTG+HSkKr5UvI0lBg6FySwfs=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/uc/ucspi-tcp/package.nix b/pkgs/by-name/uc/ucspi-tcp/package.nix
index 40a5533d332f..971f85f8eff0 100644
--- a/pkgs/by-name/uc/ucspi-tcp/package.nix
+++ b/pkgs/by-name/uc/ucspi-tcp/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
+  quilt,
 }:
 
 stdenv.mkDerivation rec {
@@ -13,21 +15,22 @@ stdenv.mkDerivation rec {
     sha256 = "171yl9kfm8w7l17dfxild99mbf877a9k5zg8yysgb1j8nz51a1ja";
   };
 
-  # Plain upstream tarball doesn't build, get patches from Debian
   patches = [
-    (fetchurl {
-      url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-3.diff.gz";
-      sha256 = "0mzmhz8hjkrs0khmkzs5i0s1kgmgaqz07h493bd5jj5fm5njxln6";
-    })
     ./remove-setuid.patch
   ];
 
-  # Apply Debian patches
+  debian = fetchzip {
+    url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-11.debian.tar.xz";
+    sha256 = "0x8h46wkm62dvyj1acsffcl4s06k5zh6139qxib3zzhk716hv5xg";
+  };
+
+  nativeBuildInputs = [
+    quilt
+  ];
+
+  # Plain upstream tarball doesn't build, apply patches from Debian
   postPatch = ''
-    for fname in debian/diff/*.diff; do
-        echo "Applying patch $fname"
-        patch < "$fname"
-    done
+    QUILT_PATCHES=$debian/patches quilt push -a
   '';
 
   # The build system is weird; 'make install' doesn't install anything, instead
@@ -40,7 +43,7 @@ stdenv.mkDerivation rec {
   preBuild = ''
     echo "$out" > conf-home
 
-    echo "main() { return 0; }" > chkshsgr.c
+    echo "int main() { return 0; }" > chkshsgr.c
   '';
 
   installPhase = ''
@@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
     ./install
 
     # Install Debian man pages (upstream has none)
-    cp debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
+    cp $debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ws/wsjtz/package.nix b/pkgs/by-name/ws/wsjtz/package.nix
new file mode 100644
index 000000000000..a58b8fda01a5
--- /dev/null
+++ b/pkgs/by-name/ws/wsjtz/package.nix
@@ -0,0 +1,31 @@
+{
+  wsjtx,
+  fetchzip,
+  lib,
+}:
+
+wsjtx.overrideAttrs (old: rec {
+  pname = "wsjtz";
+  version = "2.7.0-rc7-1.43";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/wsjt-z/Source/wsjtz-${version}.zip";
+    hash = "sha256-m+P83S5P9v3NPtifc+XjZm/mAOs+NT9fTWXisxuWtZo=";
+  };
+
+  postFixup = ''
+    mv $out/bin/wsjtx $out/bin/wsjtz
+    mv $out/bin/wsjtx_app_version $out/bin/wsjtz_app_version
+  '';
+
+  meta = {
+    description = "WSJT-X fork, primarily focused on automation and enhanced functionality";
+    homepage = "https://sourceforge.net/projects/wsjt-z/";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      scd31
+    ];
+    mainProgram = "wsjtz";
+  };
+})
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index 2237a8a24497..679b060fb7c1 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -3,25 +3,22 @@
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
-  openssl,
   testers,
   zizmor,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zizmor";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = "zizmor";
     tag = "v${version}";
-    hash = "sha256-95YtFlnC8xFBz1v+qC3rh7jEUp+4JBoMGgVQd/6IFwE=";
+    hash = "sha256-1NpwBjJlpaP3iyTfrgMwO/1qR74/MNBYjtf4+wCe4m8=";
   };
 
-  cargoHash = "sha256-imq7ElZcC9E4nDkHaaFiBf8r1VuMtw5zOn9O7EzIPkQ=";
-
-  buildInputs = [ openssl ];
+  cargoHash = "sha256-feAfHkcLvEdFblehPGtLO01Vl9QpOueuJrpEujlv4qY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/python-modules/face/default.nix b/pkgs/development/python-modules/face/default.nix
index 731479b3bf4b..f3889cc5faa9 100644
--- a/pkgs/development/python-modules/face/default.nix
+++ b/pkgs/development/python-modules/face/default.nix
@@ -5,12 +5,13 @@
   boltons,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "face";
   version = "22.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,7 +20,9 @@ buildPythonPackage rec {
     hash = "sha256-1daS+QvI9Zh7Y25H42OEubvaSZqvCneqCwu+g0x2kj0=";
   };
 
-  propagatedBuildInputs = [ boltons ];
+  build-system = [ setuptools ];
+
+  dependencies = [ boltons ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/frelatage/default.nix b/pkgs/development/python-modules/frelatage/default.nix
index 3f8d64f9e464..be04e82e7aa6 100644
--- a/pkgs/development/python-modules/frelatage/default.nix
+++ b/pkgs/development/python-modules/frelatage/default.nix
@@ -23,9 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-eHVqp6govBV9FvSQyaZuEEImHQRs/mbLaW86RCvtDbM=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  pythonRelaxDeps = [ "numpy" ];
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     numpy
     timeout-decorator
   ];
diff --git a/pkgs/development/python-modules/glom/default.nix b/pkgs/development/python-modules/glom/default.nix
index 04a8a1649f89..acd0da2f0b59 100644
--- a/pkgs/development/python-modules/glom/default.nix
+++ b/pkgs/development/python-modules/glom/default.nix
@@ -9,12 +9,14 @@
   pythonAtLeast,
   pythonOlder,
   pyyaml,
+  setuptools,
+  tomli,
 }:
 
 buildPythonPackage rec {
   pname = "glom";
   version = "24.11.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,42 +25,45 @@ buildPythonPackage rec {
     hash = "sha256-QyX5Z1mpEgRK97bGvQ26RK2MHrYDiqsFcylmHSAhuyc=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "face==20.1.1" "face"
-  '';
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     boltons
     attrs
     face
   ];
 
+  optional-dependencies = {
+    toml = lib.optionals (pythonOlder "3.11") [ tomli ];
+    yaml = [ pyyaml ];
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
-    pyyaml
-  ];
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck = ''
     # test_cli.py checks the output of running "glom"
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTests =
-    [
-      # Test is outdated (was made for PyYAML 3.x)
-      "test_main_yaml_target"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.11") [
-      "test_regular_error_stack"
-      "test_long_target_repr"
-    ];
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    "test_regular_error_stack"
+    "test_long_target_repr"
+    "test_glom_error_stack"
+    "test_glom_error_double_stack"
+    "test_branching_stack"
+    "test_midway_branch"
+    "test_partially_failing_branch"
+    "test_coalesce_stack"
+    "test_nesting_stack"
+    "test_3_11_byte_code_caret"
+  ];
 
   pythonImportsCheck = [ "glom" ];
 
   meta = with lib; {
-    description = "Restructuring data, the Python way";
-    mainProgram = "glom";
+    description = "Module for restructuring data";
     longDescription = ''
       glom helps pull together objects from other objects in a
       declarative, dynamic, and downright simple way.
@@ -67,5 +72,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/mahmoud/glom/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ twey ];
+    mainProgram = "glom";
   };
 }
diff --git a/pkgs/development/python-modules/jellyfish/Cargo.lock b/pkgs/development/python-modules/jellyfish/Cargo.lock
new file mode 100644
index 000000000000..b8e248240923
--- /dev/null
+++ b/pkgs/development/python-modules/jellyfish/Cargo.lock
@@ -0,0 +1,337 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "csv"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+
+[[package]]
+name = "itoa"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+
+[[package]]
+name = "jellyfish"
+version = "1.1.2"
+dependencies = [
+ "ahash",
+ "csv",
+ "num-traits",
+ "pyo3",
+ "smallvec",
+ "unicode-normalization",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.169"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "portable-atomic"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "serde"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "syn"
+version = "2.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tinyvec"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unindent"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/pkgs/development/python-modules/jellyfish/default.nix b/pkgs/development/python-modules/jellyfish/default.nix
index 8517c239de44..ca47c0ca312b 100644
--- a/pkgs/development/python-modules/jellyfish/default.nix
+++ b/pkgs/development/python-modules/jellyfish/default.nix
@@ -1,49 +1,56 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
-  fetchPypi,
-  isPy3k,
-  pytest,
-  unicodecsv,
+  cargo,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  rustc,
   rustPlatform,
-  libiconv,
+  unicodecsv,
 }:
 
 buildPythonPackage rec {
   pname = "jellyfish";
-  version = "1.0.4";
+  version = "1.1.2";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.11";
 
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cqq7O+3VE83SBxIkL9URc7WZcsCxRregucbzLxZWKT8=";
+  src = fetchFromGitHub {
+    owner = "jamesturk";
+    repo = "jellyfish";
+    rev = version;
+    hash = "sha256-xInjoTXYgZuHyvyKm+N4PAwHozE5BOkxoYhRzZnPs3Q=";
   };
 
-  nativeBuildInputs = with rustPlatform; [
-    maturinBuildHook
-    cargoSetupHook
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}-rust-dependencies";
-    hash = "sha256-HtzgxTO6tbN/tohaiTm9B9jrFYGTt1Szo9qRzpcy8BA=";
-  };
-
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
     unicodecsv
   ];
 
+  pythonImportsCheck = [ "jellyfish" ];
+
   meta = {
-    homepage = "https://github.com/sunlightlabs/jellyfish";
-    description = "Approximate and phonetic matching of strings";
+    description = "A python library for doing approximate and phonetic matching of strings";
+    homepage = "https://github.com/jamesturk/jellyfish";
+    changelog = "https://github.com/jamesturk/jellyfish/releases/tag/v${version}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ koral ];
   };
 }
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index acd07a2e2795..f4cd85fd778c 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.33.0";
+  version = "0.33.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     tag = "v${version}";
-    hash = "sha256-Eo1KBpSek1FnSp21vpsJEwISvUYEqOaodwrbarVcu7c=";
+    hash = "sha256-8x6Q0nGFz1pJ1jPfbepE7YL6z/HPkeyRYvwS9jJblRI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyliblo/default.nix b/pkgs/development/python-modules/pyliblo/default.nix
index 7caead892995..d5756f745b27 100644
--- a/pkgs/development/python-modules/pyliblo/default.nix
+++ b/pkgs/development/python-modules/pyliblo/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
       url = "https://git.alpinelinux.org/aports/plain/community/py3-pyliblo/py3.11.patch?id=a7e1eca5533657ddd7e37c43e67e8126e3447258";
       hash = "sha256-4yCWNQaE/9FHGTVuvNEimBNuViWZ9aSJMcpTOP0fnM0=";
     })
+    # Fix compile error due to  incompatible pointer type 'lo_blob_dataptr'
+    (fetchurl {
+      url = "https://github.com/dsacre/pyliblo/commit/ebbb255d6a73384ec2560047eab236660d4589db.patch?full_index=1";
+      hash = "sha256-ZBAmBxSUT2xgoDVqSjq8TxW2jz3xR/pdCf2O3wMKvls=";
+    })
   ];
 
   build-system = [ cython_0 ];
diff --git a/pkgs/development/python-modules/whispers/default.nix b/pkgs/development/python-modules/whispers/default.nix
index fba9a13a4551..da58f753f27c 100644
--- a/pkgs/development/python-modules/whispers/default.nix
+++ b/pkgs/development/python-modules/whispers/default.nix
@@ -16,6 +16,7 @@
   wrapt,
   semgrep,
   setuptools,
+  six,
 }:
 
 buildPythonPackage rec {
@@ -38,9 +39,12 @@ buildPythonPackage rec {
   '';
 
   pythonRelaxDeps = [
+    "jellyfish"
     "lxml"
     "pyyaml"
     "semgrep"
+    "six"
+    "wrapt"
   ];
 
   build-system = [ setuptools ];
@@ -54,8 +58,9 @@ buildPythonPackage rec {
     luhn
     lxml
     pyyaml
-    wrapt
     semgrep
+    six
+    wrapt
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/games/curseofwar/default.nix b/pkgs/games/curseofwar/default.nix
index 0a74065cec93..2bf91002024e 100644
--- a/pkgs/games/curseofwar/default.nix
+++ b/pkgs/games/curseofwar/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast-paced action strategy game";
     homepage = "https://a-nikolaev.github.io/curseofwar/";
     license = licenses.gpl3;
+    mainProgram = if SDL != null then "curseofwar-sdl" else "curseofwar";
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
   };
diff --git a/pkgs/kde/third-party/krohnkite/default.nix b/pkgs/kde/third-party/krohnkite/default.nix
index ddf7c3b2f121..75c3b01995a8 100644
--- a/pkgs/kde/third-party/krohnkite/default.nix
+++ b/pkgs/kde/third-party/krohnkite/default.nix
@@ -9,16 +9,16 @@
 }:
 buildNpmPackage rec {
   pname = "krohnkite";
-  version = "0.9.8.4";
+  version = "0.9.8.5";
 
   src = fetchFromGitHub {
     owner = "anametologin";
     repo = "krohnkite";
     tag = version;
-    hash = "sha256-VVHusFuQ/awfFV4izId7VPYCrS8riTavhpB2KpJ9084=";
+    hash = "sha256-DcNU0nx6KHztfMPFs5PZtZIeu4hDxNYIJa5E1fwMa0Q=";
   };
 
-  npmDepsHash = "sha256-k44SltKLR/Y8qWFCLW2jBWElk9JGn+0azQn0G1f0vuY=";
+  npmDepsHash = "sha256-Q/D6s0wOPSEziE1dBXgTakjhXCGvzhvLVS7zXcZlPCI=";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/kde/third-party/krohnkite/package-lock.json b/pkgs/kde/third-party/krohnkite/package-lock.json
index 114667dcd9d1..3360fa3a9c42 100644
--- a/pkgs/kde/third-party/krohnkite/package-lock.json
+++ b/pkgs/kde/third-party/krohnkite/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "krohnkite",
-  "version": "0.9.8.4",
+  "version": "0.9.8.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "krohnkite",
-      "version": "0.9.8.4",
+      "version": "0.9.8.5",
       "license": "MIT",
       "devDependencies": {
         "mocha": "^10.4.0",
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
index 3c5243386135..58a5fae706d7 100644
--- a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-V7GPxyRPeyHXJErW/q9o7a+kbhrE46nDjYiSKvEMKnw=";
+    hash = "sha256-DTIXhs5gPN96C/fWz3s7ZTOybp7Mx+/NbNGXIOGyMmk=";
   };
 
   dependencies = [