diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ddecf2a644bd..a26e5c1c7106 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14701,6 +14701,14 @@
     githubId = 8263431;
     name = "Matt Miemiec";
   };
+  mel = {
+    email = "mel@rnrd.eu";
+    github = "melnary";
+    githubId = 10659529;
+    matrix = "@mel:rnrd.eu";
+    name = "Mel G.";
+    keys = [ { fingerprint = "D75A C286 ACA7 00B4 D8EC  377D 2082 F8EC 11CC 009B"; } ];
+  };
   melchips = {
     email = "truphemus.francois@gmail.com";
     github = "melchips";
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 54224302e008..6be3346d9850 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -734,6 +734,7 @@ let
                 texinfo
                 unionfs-fuse
                 xorg.lndir
+                shellcheck-minimal
 
                 # add curl so that rather than seeing the test attempt to download
                 # curl's tarball, we see what it's trying to download
diff --git a/pkgs/applications/audio/goattracker/default.nix b/pkgs/applications/audio/goattracker/default.nix
index 7580bf86dfb0..492f1e8fafd5 100644
--- a/pkgs/applications/audio/goattracker/default.nix
+++ b/pkgs/applications/audio/goattracker/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     if isStereo then
       "2.77" # stereo
     else
-      "2.76"; # normal
+      "2.77"; # normal
 
   src = fetchurl {
     url = "mirror://sourceforge/goattracker2/GoatTracker_${finalAttrs.version}${lib.optionalString isStereo "_Stereo"}.zip";
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
       if isStereo then
         "1hiig2d152sv9kazwz33i56x1c54h5sh21ipkqnp6qlnwj8x1ksy" # stereo
       else
-        "0d7a3han4jw4bwiba3j87racswaajgl3pj4sb5lawdqdxicv3dn1"; # normal
+        "sha256-lsK9amqzrKL1uxixx2SsbqaawkXK4UACpyzYfFVFYe8="; # normal
   };
   sourceRoot = "src";
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index af82ec225bc4..6cf9976d9c6f 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5219,6 +5219,18 @@ final: prev:
     meta.homepage = "https://github.com/pimalaya/himalaya-vim/";
   };
 
+  hlchunk-nvim = buildVimPlugin {
+    pname = "hlchunk.nvim";
+    version = "2024-11-23";
+    src = fetchFromGitHub {
+      owner = "shellRaining";
+      repo = "hlchunk.nvim";
+      rev = "5465dd33ade8676d63f6e8493252283060cd72ca";
+      sha256 = "0vksi1idliaxk5l3hksfhhbps4sw6d8lk58m5ja4wrnmjxz5b5bz";
+    };
+    meta.homepage = "https://github.com/shellRaining/hlchunk.nvim/";
+  };
+
   hlint-refactor-vim = buildVimPlugin {
     pname = "hlint-refactor-vim";
     version = "2015-12-05";
@@ -6290,6 +6302,18 @@ final: prev:
     meta.homepage = "https://github.com/smjonas/live-command.nvim/";
   };
 
+  llama-vim = buildVimPlugin {
+    pname = "llama.vim";
+    version = "2025-01-24";
+    src = fetchFromGitHub {
+      owner = "ggml-org";
+      repo = "llama.vim";
+      rev = "81e6802ebd00f177a8db73d62c7eeaf14a30819a";
+      sha256 = "0fcg0xmdjc9z25ssjmg9pl5q0vk1h1k65ipd4dfzxchvmfzirl5j";
+    };
+    meta.homepage = "https://github.com/ggml-org/llama.vim/";
+  };
+
   llm-nvim = buildVimPlugin {
     pname = "llm.nvim";
     version = "2025-01-09";
@@ -10458,7 +10482,7 @@ final: prev:
     meta.homepage = "https://github.com/salkin-mada/openscad.nvim/";
   };
 
-  orgmode = buildVimPlugin {
+  orgmode = buildNeovimPlugin {
     pname = "orgmode";
     version = "2025-01-19";
     src = fetchFromGitHub {
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/sg-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/sg-nvim/default.nix
index 05922d1adaad..7a2f1101decc 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/sg-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/sg-nvim/default.nix
@@ -9,19 +9,19 @@
   vimUtils,
 }:
 let
-  version = "1.1.0-unstable-2024-12-15";
+  version = "1.1.0-unstable-2025-01-21";
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "sg.nvim";
-    rev = "7c423ebeb028b3534eb20fe54972825384dbe7d6";
-    hash = "sha256-ALAYX/1MTk0fCA8THunoHz8QTlWkg+pgiSp2n3B4KrU=";
+    rev = "775f22b75a9826eabf69b0094dd1d51d619fe552";
+    hash = "sha256-i5g+pzxB8pAORLbr1wlYWUTsrJJmVj9UwlCg8pU3Suw=";
   };
 
   sg-nvim-rust = rustPlatform.buildRustPackage {
     pname = "sg-nvim-rust";
     inherit version src;
 
-    cargoHash = "sha256-t0+0Zw8NjCD1VB1hTrSjOa1130IVanoTALdFoTloFe4=";
+    cargoHash = "sha256-4GaBrIMPuPOPeMVlDlb9XBe2txeM4196sdZ1r8bu7Kk=";
 
     nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index b97ec9349a3b..1b682954f6c1 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -3822,6 +3822,7 @@ in
       maintainers = with maintainers; [
         marcweber
         jagajaga
+        mel
       ];
       platforms = platforms.unix;
     };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 0a373bd6064a..4ebe4530e035 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -432,6 +432,7 @@ https://github.com/RaafatTurki/hex.nvim/,HEAD,
 https://github.com/Yggdroot/hiPairs/,,
 https://github.com/tzachar/highlight-undo.nvim/,HEAD,
 https://github.com/pimalaya/himalaya-vim/,,
+https://github.com/shellRaining/hlchunk.nvim/,HEAD,
 https://github.com/mpickering/hlint-refactor-vim/,,
 https://github.com/calops/hmts.nvim/,,
 https://github.com/edluffy/hologram.nvim/,,
@@ -521,6 +522,7 @@ https://github.com/ldelossa/litee-filetree.nvim/,,
 https://github.com/ldelossa/litee-symboltree.nvim/,,
 https://github.com/ldelossa/litee.nvim/,,
 https://github.com/smjonas/live-command.nvim/,HEAD,
+https://github.com/ggml-org/llama.vim/,HEAD,
 https://github.com/huggingface/llm.nvim/,HEAD,
 https://github.com/folke/lsp-colors.nvim/,,
 https://github.com/lukas-reineke/lsp-format.nvim/,HEAD,
diff --git a/pkgs/applications/graphics/hugin/default.nix b/pkgs/applications/graphics/hugin/default.nix
index 16d4cc923b5f..f6d038f3a984 100644
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@@ -14,7 +14,6 @@
 , flann
 , gettext
 , glew
-, ilmbase
 , lcms2
 , lensfun
 , libjpeg
@@ -25,7 +24,7 @@
 , libXmu
 , libGLU
 , libGL
-, openexr_3
+, openexr
 , panotools
 , perlPackages
 , sqlite
@@ -52,7 +51,6 @@ stdenv.mkDerivation rec {
     flann
     gettext
     glew
-    ilmbase
     lcms2
     lensfun
     libjpeg
@@ -63,7 +61,7 @@ stdenv.mkDerivation rec {
     libXmu
     libGLU
     libGL
-    openexr_3
+    openexr
     panotools
     sqlite
     vigra
@@ -78,8 +76,6 @@ stdenv.mkDerivation rec {
   # disable installation of the python scripting interface
   cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];
 
-  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
-
   postInstall = ''
     for p in $out/bin/*; do
       wrapProgram "$p" \
diff --git a/pkgs/by-name/be/bespokesynth/2001-bespokesynth-fix-pipewire-jack.patch b/pkgs/by-name/be/bespokesynth/2001-bespokesynth-fix-pipewire-jack.patch
new file mode 100644
index 000000000000..c14848843bdc
--- /dev/null
+++ b/pkgs/by-name/be/bespokesynth/2001-bespokesynth-fix-pipewire-jack.patch
@@ -0,0 +1,30 @@
+diff --git a/libs/JUCE/modules/juce_audio_devices/native/juce_JackAudio_linux.cpp b/libs/JUCE/modules/juce_audio_devices/native/juce_JackAudio_linux.cpp
+index 4cce7016f..25554a7cd 100644
+--- a/libs/JUCE/modules/juce_audio_devices/native/juce_JackAudio_linux.cpp
++++ b/libs/JUCE/modules/juce_audio_devices/native/juce_JackAudio_linux.cpp
+@@ -291,7 +291,6 @@ public:
+         juce::jack_on_info_shutdown (client, infoShutdownCallback, this);
+         juce::jack_set_xrun_callback (client, xrunCallback, this);
+         juce::jack_activate (client);
+-        deviceIsOpen = true;
+ 
+         if (! inputChannels.isZero())
+         {
+@@ -336,6 +335,7 @@ public:
+         }
+ 
+         updateActivePorts();
++        deviceIsOpen = true;
+ 
+         return lastError;
+     }
+@@ -525,7 +525,8 @@ private:
+     static void portConnectCallback (jack_port_id_t, jack_port_id_t, int, void* arg)
+     {
+         if (JackAudioIODevice* device = static_cast<JackAudioIODevice*> (arg))
+-            device->mainThreadDispatcher.updateActivePorts();
++            if (device->isOpen())
++                device->mainThreadDispatcher.updateActivePorts();
+     }
+ 
+     static void threadInitCallback (void* /* callbackArgument */)
diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/by-name/be/bespokesynth/package.nix
similarity index 66%
rename from pkgs/applications/audio/bespokesynth/default.nix
rename to pkgs/by-name/be/bespokesynth/package.nix
index 8eb63539040c..29ff82de7e2f 100644
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/by-name/be/bespokesynth/package.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchFromGitHub,
   fetchzip,
+  gitUpdater,
+  apple-sdk_11,
   cmake,
   pkg-config,
   ninja,
@@ -11,6 +13,7 @@
   alsa-lib,
   alsa-tools,
   freetype,
+  jsoncpp,
   libusb1,
   libX11,
   libXrandr,
@@ -31,13 +34,6 @@
   pcre,
   mount,
   zenity,
-  Accelerate,
-  Cocoa,
-  WebKit,
-  CoreServices,
-  CoreAudioKit,
-  IOBluetooth,
-  MetalKit,
   # It is not allowed to distribute binaries with the VST2 SDK plugin without a license
   # (the author of Bespoke has such a licence but not Nix). VST3 should work out of the box.
   # Read more in https://github.com/NixOS/nixpkgs/issues/145607
@@ -58,24 +54,47 @@ let
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bespokesynth";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "BespokeSynth";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-vDvNm9sW9BfWloB0CA+JHTp/bfDWAP/T0hDXjoMZ3X4=";
+    repo = "bespokesynth";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ad8wdLos3jM0gRMpcfRKeaiUxJsPGqWd/7XeDz87ToQ=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix compatibility with pipewire's JACK emulation
+    # https://github.com/BespokeSynth/BespokeSynth/issues/1405#issuecomment-1721437868
+    ./2001-bespokesynth-fix-pipewire-jack.patch
+  ];
+
+  # Linux builds are sandboxed properly, this always returns "localhost" there.
+  # Darwin builds doesn't have the same amount of sandboxing by default, and the builder's hostname is returned.
+  # In case this ever gets embedded into VersionInfoBld.cpp, hardcode it to the Linux value
+  postPatch = ''
+    substituteInPlace Source/cmake/versiontools.cmake \
+      --replace-fail 'cmake_host_system_information(RESULT BESPOKE_BUILD_FQDN QUERY FQDN)' 'set(BESPOKE_BUILD_FQDN "localhost")'
+  '';
+
   cmakeBuildType = "Release";
 
-  cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
+  cmakeFlags =
+    [
+      (lib.cmakeBool "BESPOKE_SYSTEM_PYBIND11" true)
+      (lib.cmakeBool "BESPOKE_SYSTEM_JSONCPP" true)
+    ]
+    ++ lib.optionals enableVST2 [
+      (lib.cmakeFeature "BESPOKE_VST2_SDK_LOCATION" "${vst-sdk}/VST2_SDK")
+    ];
+
+  strictDeps = true;
 
   nativeBuildInputs = [
-    python3
+    python3 # interpreter
     makeWrapper
     cmake
     pkg-config
@@ -83,7 +102,16 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
+    [
+      jsoncpp
+      # library & headers
+      (python3.withPackages (
+        ps: with ps; [
+          pybind11
+        ]
+      ))
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       # List obtained from https://github.com/BespokeSynth/BespokeSynth/blob/main/azure-pipelines.yml
       libX11
       libXrandr
@@ -110,25 +138,14 @@ stdenv.mkDerivation rec {
       mount
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      Cocoa
-      WebKit
-      CoreServices
-      CoreAudioKit
-      IOBluetooth
-      MetalKit
+      apple-sdk_11
     ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
-    # Fails to find fp.h on its own
-    "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/CarbonCore.framework/Versions/Current/Headers/"
-  ]);
-
   postInstall =
     if stdenv.hostPlatform.isDarwin then
       ''
         mkdir -p $out/{Applications,bin}
-        mv Source/BespokeSynth_artefacts/${cmakeBuildType}/BespokeSynth.app $out/Applications/
+        mv Source/BespokeSynth_artefacts/${finalAttrs.cmakeBuildType}/BespokeSynth.app $out/Applications/
         # Symlinking confuses the resource finding about the actual location of the binary
         # Resources are looked up relative to the executed file's location
         makeWrapper $out/{Applications/BespokeSynth.app/Contents/MacOS,bin}/BespokeSynth
@@ -158,24 +175,29 @@ stdenv.mkDerivation rec {
       libXScrnSaver
     ])
   }";
+
   dontPatchELF = true; # needed or nix will try to optimize the binary by removing "useless" rpath
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = {
     description = "Software modular synth with controllers support, scripting and VST";
     homepage = "https://www.bespokesynth.com/";
     license =
-      with licenses;
+      with lib.licenses;
       [
         gpl3Plus
       ]
       ++ lib.optional enableVST2 unfree;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       astro
       tobiasBora
       OPNA2608
       PowerUser64
     ];
     mainProgram = "BespokeSynth";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index 721ddd3c0ad8..83b1fb8451f1 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.101.0";
+  version = "1.102.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-4pGdb7CZTYjaGgrwRwI9mtmqJaFY7AwGk36PLASUDFU=";
+    hash = "sha256-hnmQR9Buu+2z1UkeStVFazbl/czUhV8E7sZrkcPGKFo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/co/connman-gtk/package.nix b/pkgs/by-name/co/connman-gtk/package.nix
index 9475a30d849f..fb784c8aae7a 100644
--- a/pkgs/by-name/co/connman-gtk/package.nix
+++ b/pkgs/by-name/co/connman-gtk/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoconf,
   automake,
   intltool,
@@ -37,6 +38,13 @@ stdenv.mkDerivation rec {
     connman
   ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/nickm/connman-gtk/-/raw/ef01b52fa02c5cca199b2e47c0cf360691266fd8/debian/patches/incompatible-pointer-type";
+      hash = "sha256-T+N9FfDyROBA4/HLK+l/fpnju2imDU4y6nGSbF+JDiA=";
+    })
+  ];
+
   preConfigure = ''
     # m4/intltool.m4 is an invalid symbolic link
     rm m4/intltool.m4
diff --git a/pkgs/by-name/ec/ecapture/package.nix b/pkgs/by-name/ec/ecapture/package.nix
index 091c65abdaf4..c28ba718d735 100644
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@@ -16,18 +16,19 @@
   mariadb,
   openssl,
   bash,
+  zsh,
   nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "ecapture";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "gojue";
     repo = "ecapture";
     tag = "v${version}";
-    hash = "sha256-UPWREeyB2YLYU3B4Rxr5oPoOfksL/lnllWyaFxhAe/0=";
+    hash = "sha256-nqNFbZrmCleWcRM2HsbgmCHqsar3KmiGYxt55ZqhY+U=";
     fetchSubmodules = true;
   };
 
@@ -73,6 +74,12 @@ buildGoModule rec {
     substituteInPlace user/config/config_nspr_linux.go \
       --replace-fail '/usr/lib/firefox/libnspr4.so' '${lib.getLib nspr}/lib/libnspr4.so'
 
+    substituteInPlace user/config/config_zsh.go \
+      --replace-fail '/bin/zsh' '${lib.getExe zsh}'
+
+    substituteInPlace user/module/probe_zsh.go \
+      --replace-fail '/bin/zsh' '${lib.getExe zsh}'
+
     substituteInPlace cli/cmd/postgres.go \
       --replace-fail '/usr/bin/postgres' '${postgresql}/bin/postgres'
 
diff --git a/pkgs/by-name/er/erlang-language-platform/package.nix b/pkgs/by-name/er/erlang-language-platform/package.nix
index 39f9538b1100..d106725a4067 100644
--- a/pkgs/by-name/er/erlang-language-platform/package.nix
+++ b/pkgs/by-name/er/erlang-language-platform/package.nix
@@ -14,14 +14,14 @@ let
 
   hashes = {
     linux-aarch64-unknown-linux-gnu = "sha256-Fte7oZD5+aFph5xGrKtbSimb3aHewkjsJRXB+64IW5A=";
-    linux-x86_64-unknown-linux-gnu = "sha256-GFf1YybZRyZ3D6ZnLf+op6KRPYbwBHSPh1groxdNZks=";
+    linux-x86_64-unknown-linux-gnu = "sha256-slnXUEtHJjq6wRQTt1EwqlOO/2zIGmGwa/HCi3F0YMA=";
     macos-aarch64-apple-darwin = "sha256-3K3sPizBR/+DJIX67GsYqm2X5k7kq3kBRg8P2WALTZs=";
     macos-x86_64-apple-darwin = "sha256-j+AVmLfe/yCvKvYhL5ikhXA1g+zQ1CDlMl1FYO6q1yA=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "erlang-language-platform";
-  version = "2024-12-09";
+  version = "2025-01-21";
 
   src = fetchurl {
     url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz";
diff --git a/pkgs/by-name/fl/fly/package.nix b/pkgs/by-name/fl/fly/package.nix
index 67e3f25c2e01..79ad4b5c6899 100644
--- a/pkgs/by-name/fl/fly/package.nix
+++ b/pkgs/by-name/fl/fly/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.12.0";
+  version = "7.12.1";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    hash = "sha256-lAx9TZVRkPMa5swB74zI0xJ7pbRDApZoens747XcuJk=";
+    hash = "sha256-3RsFtU2C3XxBddyW5liAwia9I7Fc8f2+TsziiJy6rHg=";
   };
 
-  vendorHash = "sha256-dXjee2rZn1lVEmL8Cy8rrdpSX1OpS9GHKZo53ur3kew=";
+  vendorHash = "sha256-up77TV/A/C39LjgQ+1uQExWfMlbruLhY3H6820cRnt0=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/by-name/gh/gh-dash/package.nix b/pkgs/by-name/gh/gh-dash/package.nix
index 6b9bf2a6d8a8..568f7f658ba4 100644
--- a/pkgs/by-name/gh/gh-dash/package.nix
+++ b/pkgs/by-name/gh/gh-dash/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "4.9.0";
+  version = "4.9.1";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-25Ik5VsTYLssI9u235pBWD1XNABvWCzbXma04pJX2nQ=";
+    hash = "sha256-n0+I1URuIOKqBj+BSE6bD3wOxpaKWM9t1X3PkPhawKY=";
   };
 
   vendorHash = "sha256-lqmz+6Cr9U5IBoJ5OeSN6HKY/nKSAmszfvifzbxG7NE=";
diff --git a/pkgs/by-name/lu/lucenepp/package.nix b/pkgs/by-name/lu/lucenepp/package.nix
index 5e9688571ce7..89e719e2295d 100644
--- a/pkgs/by-name/lu/lucenepp/package.nix
+++ b/pkgs/by-name/lu/lucenepp/package.nix
@@ -4,25 +4,25 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
-  boost,
+  boost186,
   gtest,
   zlib,
 }:
 
 stdenv.mkDerivation rec {
   pname = "lucene++";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchFromGitHub {
     owner = "luceneplusplus";
     repo = "LucenePlusPlus";
     rev = "rel_${version}";
-    sha256 = "12v7r62f7pqh5h210pb74sfx6h70lj4pgfpva8ya2d55fn0qxrr2";
+    hash = "sha256-VxEV45OXHRldFdIt2OC6O7ey5u98VQzlzeOb9ZiKfd8=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
-    boost
+    boost186
     gtest
     zlib
   ];
@@ -30,32 +30,33 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ];
 
   patches = [
-    (fetchpatch {
-      name = "pkgconfig_use_correct_LIBDIR_for_destination_library";
-      url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/39cd44bd54e918d25ee464477992ad0dc234dcba.patch";
-      sha256 = "sha256-PP6ENNhPJMWrYDlTnr156XV8d5aX/VNX8v4vvi9ZiWo";
-    })
-    (fetchpatch {
-      name = "fix-visibility-on-mac.patch";
-      url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/bc436842227aea561b68c6ae89fbd1fdefcac7b3.patch";
-      sha256 = "sha256-/S7tFZ4ht5p0cv036xF2NKZQwExbPaGINyWZiUg/lS4=";
-    })
     (fetchpatch {
       name = "fix-build-with-boost-1_85_0.patch";
       url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/76dc90f2b65d81be018c499714ff11e121ba5585.patch";
-      sha256 = "sha256-SNAngHwy7yxvly8d6u1LcPsM6NYVx3FrFiSHLmkqY6Q=";
+      hash = "sha256-SNAngHwy7yxvly8d6u1LcPsM6NYVx3FrFiSHLmkqY6Q=";
+    })
+    (fetchpatch {
+      name = "fix-install-path-for-liblucene_pc.patch";
+      url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/f40f59c6e169b4e16b7a6439ecb26a629c6540d1.patch";
+      hash = "sha256-YtZMqh/cnkGikatcgRjOWXj570M5ZOnCqgW8/K0/nVo=";
+    })
+    (fetchpatch {
+      name = "migrate-to-boost_asio_io_context.patch";
+      url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/e6a376836e5c891577eae6369263152106b9bc02.patch";
+      hash = "sha256-0mdVvrS0nTxSJXRzVdx2Zb/vm9aVxGfARG/QliRx7tA=";
     })
   ];
 
   # Don't use the built in gtest - but the nixpkgs one requires C++14.
   postPatch = ''
     substituteInPlace src/test/CMakeLists.txt \
-      --replace "add_subdirectory(gtest)" ""
+      --replace-fail "add_subdirectory(gtest)" ""
     substituteInPlace CMakeLists.txt \
-      --replace "set(CMAKE_CXX_STANDARD 11)" "set(CMAKE_CXX_STANDARD 14)"
+      --replace-fail "set(CMAKE_CXX_STANDARD 11)" "set(CMAKE_CXX_STANDARD 14)"
   '';
 
-  doCheck = true;
+  # FIXME: Stuck for several hours after passing 1472 tests
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
@@ -64,11 +65,6 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
-  postInstall = ''
-    mv $out/include/pkgconfig $out/lib/
-    cp $src/src/contrib/include/*h $out/include/lucene++/
-  '';
-
   meta = {
     description = "C++ port of the popular Java Lucene search engine";
     homepage = "https://github.com/luceneplusplus/LucenePlusPlus";
@@ -77,5 +73,6 @@ stdenv.mkDerivation rec {
       lgpl3Plus
     ];
     platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ rewine ];
   };
 }
diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index f432f03702f5..9d643eb54e65 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
 
@@ -11,8 +12,6 @@
   oniguruma,
   openssl,
   mkl,
-  stdenv,
-  darwin,
 
   # env
   fetchurl,
@@ -68,32 +67,26 @@ let
     (acceleration == "metal")
     || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && (acceleration == null));
 
-  darwinBuildInputs =
-    with darwin.apple_sdk.frameworks;
-    [
-      Accelerate
-      CoreVideo
-      CoreGraphics
-    ]
-    ++ lib.optionals metalSupport [
-      MetalKit
-      MetalPerformanceShaders
-    ];
 in
-
 rustPlatform.buildRustPackage rec {
   pname = "mistral-rs";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "EricLBuehler";
     repo = "mistral.rs";
     tag = "v${version}";
-    hash = "sha256-aflzpJZ48AFBqNTssZl2KxkspQb662nGkEU6COIluxk=";
+    hash = "sha256-dsqW0XpZN2FGZlmNKgAEYGcdY5iGvRwNUko2OuU87Gw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-USp8siEXVjtkPoCHfQjDYPtgLfNHcy02LSUNdwDbxgs=";
+  cargoHash = "sha256-Fp/5xQ1ib2TTBSayxR5EDKkk7G+5c1QdnVW+kzcE5Jo=";
+
+  # Otherwise, fails with
+  # failed to get `anyhow` as a dependency of package
+  postPatch = ''
+    rm "$cargoDepsCopy"/llguidance-*/build.rs
+  '';
 
   nativeBuildInputs = [
     pkg-config
@@ -111,19 +104,12 @@ rustPlatform.buildRustPackage rec {
       cudaPackages.libcublas
       cudaPackages.libcurand
     ]
-    ++ lib.optionals mklSupport [ mkl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin darwinBuildInputs;
+    ++ lib.optionals mklSupport [ mkl ];
 
-  cargoBuildFlags =
-    [
-      # This disables the plotly crate which fails to build because of the kaleido feature requiring
-      # network access at build-time.
-      # See https://github.com/NixOS/nixpkgs/pull/323788#issuecomment-2206085825
-      "--no-default-features"
-    ]
-    ++ lib.optionals cudaSupport [ "--features=cuda" ]
-    ++ lib.optionals mklSupport [ "--features=mkl" ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && metalSupport) [ "--features=metal" ];
+  buildFeatures =
+    lib.optionals cudaSupport [ "cuda" ]
+    ++ lib.optionals mklSupport [ "mkl" ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && metalSupport) [ "metal" ];
 
   env =
     {
@@ -163,16 +149,15 @@ rustPlatform.buildRustPackage rec {
     rm -rf target/${stdenv.hostPlatform.config}/release/build/
   '';
 
+  # Prevent checkFeatures from inheriting buildFeatures because
+  # - `cargo check ... --features=cuda` requires access to a real GPU
+  # - `cargo check ... --features=metal` (on darwin) requires the sandbox to be completely disabled
+  checkFeatures = [ ];
+
   # Try to access internet
   checkFlags = [
-    "--skip=gguf::gguf_tokenizer::tests::test_decode_gpt2"
-    "--skip=gguf::gguf_tokenizer::tests::test_decode_llama"
     "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_gpt2"
     "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_llama"
-    "--skip=gguf::gguf_tokenizer::tests::test_encode_gpt2"
-    "--skip=gguf::gguf_tokenizer::tests::test_encode_llama"
-    "--skip=sampler::tests::test_argmax"
-    "--skip=sampler::tests::test_gumbel_speculative"
     "--skip=util::tests::test_parse_image_url"
   ];
 
@@ -187,7 +172,6 @@ rustPlatform.buildRustPackage rec {
     tests = {
       version = testers.testVersion { package = mistral-rs; };
 
-      # TODO: uncomment when mkl support will be fixed
       withMkl = lib.optionalAttrs (stdenv.hostPlatform == "x86_64-linux") (
         mistral-rs.override { acceleration = "mkl"; }
       );
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index a128c63adce0..b8f1af9891cb 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-r8OT5cbHicJVAVIJ9cfDHPLcJrZGPVYdZ42Sbvu8Jvc=";
+    hash = "sha256-KTz6Tip6kz8AcRW73+MUHUvwr/QT9Z2CvHQNyFXD054=";
   };
 
-  vendorHash = "sha256-LmWuztR6X3x0aOYCqRv3aLiFEZQkaSnh3LT7IOu2Xa0=";
+  vendorHash = "sha256-cTRyQu3lXrIrBHtEYYQIdv0F705KrgyXgDS8meHVRJw=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/na/nautilus/package.nix b/pkgs/by-name/na/nautilus/package.nix
index 3a1f30dfb909..ea90bf63a177 100644
--- a/pkgs/by-name/na/nautilus/package.nix
+++ b/pkgs/by-name/na/nautilus/package.nix
@@ -100,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags = [
     "-Ddocs=true"
+    "-Dtests=${if finalAttrs.finalPackage.doCheck then "all" else "none"}"
   ];
 
   preFixup = ''
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index 29f009ac5624..85d9952b8c52 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -112,15 +112,21 @@ let
         provider:
         if provider ? override then
           # use opentofu plugin registry over terraform's
-          provider.override (oldArgs: {
-            provider-source-address =
-              lib.replaceStrings
-                [ "https://registry.terraform.io/providers" ]
-                [
-                  "registry.opentofu.org"
-                ]
-                oldArgs.homepage;
-          })
+          provider.override (
+            oldArgs:
+            if (builtins.hasAttr "homepage" oldArgs) then
+              {
+                provider-source-address =
+                  lib.replaceStrings
+                    [ "https://registry.terraform.io/providers" ]
+                    [
+                      "registry.opentofu.org"
+                    ]
+                    oldArgs.homepage;
+              }
+            else
+              { }
+          )
         else
           provider
       ) (plugins package.plugins);
diff --git a/pkgs/by-name/pa/packcc/package.nix b/pkgs/by-name/pa/packcc/package.nix
index 682bc519238e..182413401fb3 100644
--- a/pkgs/by-name/pa/packcc/package.nix
+++ b/pkgs/by-name/pa/packcc/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "packcc";
-  version = "2.0.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "arithy";
     repo = "packcc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k1C/thvr/5fYrgu/j8YN3kwXp4k26sC9AhYhYAKQuX0=";
+    hash = "sha256-fmZL34UL7epFFGo0gCsj8TcyhBt5uCfnLCLCQugXF6U=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index e7af30a64cba..08e95d1f341f 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -15,14 +15,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.1.3";
+  version = "25.1.5";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-A/cjkjwHP0bCWZOjzZdIVUzb1Gh8B0rJHsntVdj4hF4=";
+    hash = "sha256-Qr5pkKznosUGO7HvUkZhemWwtKpyYA79Vz1jU6YhODE=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/sa/satysfi/package.nix b/pkgs/by-name/sa/satysfi/package.nix
index 4b0c4ddab839..b2a393939a60 100644
--- a/pkgs/by-name/sa/satysfi/package.nix
+++ b/pkgs/by-name/sa/satysfi/package.nix
@@ -6,16 +6,18 @@
   junicode,
   lmodern,
   lmmath,
+  which,
 }:
 let
-  camlpdf = ocamlPackages.camlpdf.overrideAttrs {
+  camlpdf = ocamlPackages.camlpdf.overrideAttrs (o: {
     src = fetchFromGitHub {
       owner = "gfngfn";
       repo = "camlpdf";
       rev = "v2.3.1+satysfi";
       sha256 = "1s8wcqdkl1alvfcj67lhn3qdz8ikvd1v64f4q6bi4c0qj9lmp30k";
     };
-  };
+    nativeBuildInputs = [ which ] ++ o.nativeBuildInputs;
+  });
   yojson-with-position = ocamlPackages.buildDunePackage {
     pname = "yojson-with-position";
     version = "1.4.2";
diff --git a/pkgs/by-name/sq/squid/package.nix b/pkgs/by-name/sq/squid/package.nix
index c03043400d75..d38921626061 100644
--- a/pkgs/by-name/sq/squid/package.nix
+++ b/pkgs/by-name/sq/squid/package.nix
@@ -14,6 +14,7 @@
   pkg-config,
   systemd,
   cppunit,
+  esi ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -57,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
       "--enable-x-accelerator-vary"
       "--enable-htcp"
     ]
+    ++ lib.optional (!esi) "--disable-esi"
     ++ lib.optional (
       stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl
     ) "--enable-linux-netfilter";
diff --git a/pkgs/by-name/st/stract/package.nix b/pkgs/by-name/st/stract/package.nix
index ac809562dd9f..bcd2b0fedfe7 100644
--- a/pkgs/by-name/st/stract/package.nix
+++ b/pkgs/by-name/st/stract/package.nix
@@ -1,36 +1,79 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
+  fetchurl,
   rustPlatform,
   pkg-config,
+  oniguruma,
   openssl,
-  curl,
+  zstd,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "stract";
-  version = "0-unstable-2024-09-14";
+  version = "0-unstable-2024-12-11";
 
   src = fetchFromGitHub {
     owner = "StractOrg";
     repo = "stract";
-    rev = "21d28ea86d9ff19ccb4c25b1bdde67e5ec302d79";
-    hash = "sha256-7Uvo5+saxwTMQjfDliyOYC6j6LbpMf/FiONfX38xepI=";
+    rev = "ecb495a66cf6c2f66d817803df38385a3001a38d";
+    hash = "sha256-UeIziIihDCjGoz2IdfROnO9/N82S4yextnF4Sbtrn24=";
+    fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-7Skbeeev/xBAhlcyOsYpDJB9LnZpT66D0Fu1I/jIBso=";
+  cargoHash = "sha256-UArPGrcEfFZBOZ4Tv7NraqPzdMtyJXVFsfUM32eSGic=";
+  useFetchCargoVendor = true;
 
-  cargoDepsName = "stract";
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
+    oniguruma
     openssl
-    curl
+    zstd
   ];
 
+  env = {
+    RUSTONIG_SYSTEM_LIBONIG = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    SWAGGER_UI_DOWNLOAD_URL =
+      let
+        # When updating:
+        # - Look for the version of `utoipa-swagger-ui` at:
+        #   https://github.com/StractOrg/stract/blob/<STRACT-REV>/Cargo.toml#L183
+        # - Look at the corresponding version of `swagger-ui` at:
+        #   https://github.com/juhaku/utoipa/blob/utoipa-swagger-ui-<UTOPIA-SWAGGER-UI-VERSION>/utoipa-swagger-ui/build.rs#L21-L22
+        swaggerUiVersion = "5.17.12";
+        swaggerUi = fetchurl {
+          url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v${swaggerUiVersion}.zip";
+          hash = "sha256-HK4z/JI+1yq8BTBJveYXv9bpN/sXru7bn/8g5mf2B/I=";
+        };
+      in
+      "file://${swaggerUi}";
+  };
+
+  # swagger-ui will once more be copied in the target directory during the check phase
+  # Not deleting the existing unpacked archive leads to a `PermissionDenied` error
+  preCheck = ''
+    rm -rf target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/build/
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
-    description = "Open source web search engine hosted at stract.com targeted towards tinkerers and developers.";
+    description = "Open source web search engine";
+    longDescription = ''
+      Stract is an open source web search engine targeted towards tinkerers and
+      developers, with an official instance hosted at stract.com
+    '';
     homepage = "https://github.com/StractOrg/stract";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ ailsa-sun ];
+    maintainers =
+      with lib.maintainers;
+      [
+        ailsa-sun
+      ]
+      ++ lib.teams.ngi.members;
   };
 }
diff --git a/pkgs/by-name/sy/systemctl-tui/package.nix b/pkgs/by-name/sy/systemctl-tui/package.nix
index 8a1d05f3338c..3cd1dab47fe9 100644
--- a/pkgs/by-name/sy/systemctl-tui/package.nix
+++ b/pkgs/by-name/sy/systemctl-tui/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systemctl-tui";
-  version = "0.3.10";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "rgwood";
     repo = "systemctl-tui";
     tag = "v${version}";
-    hash = "sha256-7I4PM4ZQVtDESfchX0/HGu0Y94BxMCLNIrPw8bSokCQ=";
+    hash = "sha256-1KYaw4q1+dPHImjjCnUPXNu7ihdEfNuzQfHfPi1uDOw=";
   };
 
-  cargoHash = "sha256-Ur1/3AAN55doW8xyeoeuU6C1KvjTQQjooCl9WVDAGuM=";
+  cargoHash = "sha256-QogpwX/s2469h24WO9B84D4ezHD0Rln5lt8naUAZ5rY=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/tr/tre/package.nix b/pkgs/by-name/tr/tre/package.nix
index e016e510e841..969b17817d71 100644
--- a/pkgs/by-name/tr/tre/package.nix
+++ b/pkgs/by-name/tr/tre/package.nix
@@ -1,30 +1,55 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
+  autoconf,
+  automake,
+  darwin,
+  gettext,
+  libiconv,
+  libtool,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tre";
-  version = "0.8.0";
-  src = fetchurl {
-    url = "https://laurikari.net/tre/${pname}-${version}.tar.gz";
-    sha256 = "1pd7qsa7vc3ybdc6h2gr4pm9inypjysf92kab945gg4qa6jp11my";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "laurikari";
+    repo = "tre";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5O8yqzv+SR8x0X7GtC2Pjo94gp0799M2Va8wJ4EKyf8=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/t/tre/0.8.0-6/debian/patches/03-cve-2016-8859";
-      sha256 = "0navhizym6qxd4gngrsslbij8x9r3s67p1jzzhvsnq6ky49j7w3p";
-    })
+  outputs = [
+    "out"
+    "dev"
   ];
 
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+  ];
+
+  buildInputs =
+    [
+      gettext
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+    ];
+
+  preConfigure = ''
+    ./utils/autogen.sh
+  '';
+
   meta = {
     description = "Lightweight and robust POSIX compliant regexp matching library";
     homepage = "https://laurikari.net/tre/";
+    changelog = "https://github.com/laurikari/tre/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd2;
     mainProgram = "agrep";
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index e87d91e0cc3d..5d44a274a3d5 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.5.23";
+  version = "0.5.24";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = version;
-    hash = "sha256-0uYAokw9hjgI+eU/1GrWdCDtFl1qWqkhvh+1qjeGSCQ=";
+    hash = "sha256-a4SemtzExhQing7CKjNvakoZSkI7wX01JPz4xWwEraQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yv5asWS6XLI22Z1kkGB6xJ6XFFMfOvFYcvvFvjRu8D4=";
+  cargoHash = "sha256-UdS3SiviF3j3XUd1hUD9eIurKaC9ZX7DrvvE158zS5w=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 1864b34a499b..3d26e8728778 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "2.19.0";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-bNh2Rg77yWWBgXTnAo1IVU0RzieFOYtM5k0G1ltn3+Y=";
+    hash = "sha256-43ZN2bMzVBpliXjDDJrVZqdiWBS3rT5mYEd0440wp4s=";
   };
 
-  vendorHash = "sha256-ICZneCPV858wRThUaSBmS9oApemKlUiA4SEWsH2sOak=";
+  vendorHash = "sha256-Qy5Tjg/QETeN8leTaWZXSUauK2LkPUUZbpztC79v6Jo=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/wi/wire-desktop/package.nix b/pkgs/by-name/wi/wire-desktop/package.nix
index ec93ba9600b1..0f89a5bb4881 100644
--- a/pkgs/by-name/wi/wire-desktop/package.nix
+++ b/pkgs/by-name/wi/wire-desktop/package.nix
@@ -28,23 +28,23 @@ let
 
   version =
     let
-      x86_64-darwin = "3.37.5164";
+      x86_64-darwin = "3.39.5211";
     in
     {
       inherit x86_64-darwin;
       aarch64-darwin = x86_64-darwin;
-      x86_64-linux = "3.37.3607";
+      x86_64-linux = "3.39.3653";
     }
     .${system} or throwSystem;
 
   hash =
     let
-      x86_64-darwin = "sha256-xQ6EaZFE6qdpgFj1Lom37wT8URd5FsRwG89YeM/+U7k=";
+      x86_64-darwin = "sha256-k6CIqHt67AFL70zdK0/91aQcpbb00OIggk5TF7y1IOY=";
     in
     {
       inherit x86_64-darwin;
       aarch64-darwin = x86_64-darwin;
-      x86_64-linux = "sha256-mckFxxrWnxeVGgJ//efPTdtHt5nVII1lXu/BT61TKxE=";
+      x86_64-linux = "sha256-BbY+7fGAWW5CR/z4GeoBl5aOewCRuWzQjpQX4x1rzls=";
     }
     .${system} or throwSystem;
 
diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index 590055955881..1484fd64239c 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -6,8 +6,8 @@
 , python
 , withGodef ? true
 , godef
-, withGotools ? true
-, gotools
+, withGopls ? true
+, gopls
 , withRustAnalyzer ? true
 , rust-analyzer
 , withTypescript ? true
@@ -80,10 +80,10 @@ stdenv.mkDerivation {
     TARGET=$out/lib/ycmd/third_party/godef
     mkdir -p $TARGET
     ln -sf ${godef}/bin/godef $TARGET
-  '' + lib.optionalString withGotools ''
-    TARGET=$out/lib/ycmd/third_party/go/src/golang.org/x/tools/cmd/gopls
+  '' + lib.optionalString withGopls ''
+    TARGET=$out/lib/ycmd/third_party/go/bin
     mkdir -p $TARGET
-    ln -sf ${gotools}/bin/gopls $TARGET
+    ln -sf ${gopls}/bin/gopls $TARGET
   '' + lib.optionalString withRustAnalyzer ''
     TARGET=$out/lib/ycmd/third_party/rust-analyzer
     mkdir -p $TARGET
@@ -105,7 +105,7 @@ stdenv.mkDerivation {
     mainProgram = "ycmd";
     homepage = "https://github.com/ycm-core/ycmd";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ rasendubi lnl7 siriobalmelli ];
+    maintainers = with maintainers; [ rasendubi lnl7 mel ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/ocaml-modules/camlpdf/default.nix b/pkgs/development/ocaml-modules/camlpdf/default.nix
index 7f4cbe4cf5cc..003e2c0263bc 100644
--- a/pkgs/development/ocaml-modules/camlpdf/default.nix
+++ b/pkgs/development/ocaml-modules/camlpdf/default.nix
@@ -1,21 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, which, ocaml, findlib }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib }:
 
 if lib.versionOlder ocaml.version "4.10"
 then throw "camlpdf is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-  version = "2.7.1";
+  version = "2.8";
   pname = "ocaml${ocaml.version}-camlpdf";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "camlpdf";
     rev = "v${version}";
-    hash = "sha256-/ZKL80HqLZ9ObOvgfg+ZHFZ8m2CRe0zWT8zHIf9CXes=";
+    hash = "sha256-+SFuFqlrP0nwm199y0QFWYvlwD+Cbh0PHA5bmXIWdNk=";
   };
 
-  nativeBuildInputs = [ which ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/ocaml-modules/cpdf/default.nix b/pkgs/development/ocaml-modules/cpdf/default.nix
index 7e917482379d..66823ce21fa1 100644
--- a/pkgs/development/ocaml-modules/cpdf/default.nix
+++ b/pkgs/development/ocaml-modules/cpdf/default.nix
@@ -5,7 +5,6 @@
   ocaml,
   findlib,
   camlpdf,
-  ncurses,
 }:
 
 if lib.versionOlder ocaml.version "4.10" then
@@ -14,20 +13,19 @@ else
 
   stdenv.mkDerivation rec {
     pname = "ocaml${ocaml.version}-cpdf";
-    version = "2.7.1";
+    version = "2.8";
 
     src = fetchFromGitHub {
       owner = "johnwhitington";
       repo = "cpdf-source";
       rev = "v${version}";
-      hash = "sha256-lFI7f1t70Pw0LJjDrhaB7yQKR1N5906xNYB+fnrz55M=";
+      hash = "sha256-DvTY5EQcvnL76RlQTcVqBiycqbCdGQCXzarSMH2P/pg=";
     };
 
     nativeBuildInputs = [
       ocaml
       findlib
     ];
-    buildInputs = [ ncurses ];
     propagatedBuildInputs = [ camlpdf ];
 
     strictDeps = true;
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index 48db179f7240..6eb47812b1df 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
     hash = "sha256-ZuVq4WERXsRFUPNNTNp/eisWX1MyI7UtwqEI8X93wYI=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "poetry-core>=1.0.0,<2" "poetry-core"
+  '';
+
   build-system = [ poetry-core ];
 
   dependencies = [
@@ -78,7 +83,7 @@ buildPythonPackage rec {
     "test_binary_compatibility"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Code generator & library for Protobuf 3 and async gRPC";
     mainProgram = "protoc-gen-python_betterproto";
     longDescription = ''
@@ -88,7 +93,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/danielgtaylor/python-betterproto";
     changelog = "https://github.com/danielgtaylor/python-betterproto/blob/v.${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ nikstur ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nikstur ];
   };
 }
diff --git a/pkgs/development/python-modules/flax/default.nix b/pkgs/development/python-modules/flax/default.nix
index ec9b429b8931..e82e53219bc3 100644
--- a/pkgs/development/python-modules/flax/default.nix
+++ b/pkgs/development/python-modules/flax/default.nix
@@ -102,19 +102,15 @@ buildPythonPackage rec {
     "flax/nnx/examples/*"
     # See https://github.com/google/flax/issues/3232.
     "tests/jax_utils_test.py"
-    # Too old version of tensorflow:
-    # ModuleNotFoundError: No module named 'keras.api._v2'
-    "tests/tensorboard_test.py"
   ];
 
   disabledTests =
     [
-      # ValueError: Checkpoint path should be absolute
-      "test_overwrite_checkpoints0"
-      # Fixed in more recent versions of jax: https://github.com/google/flax/issues/4211
-      # TODO: Re-enable when jax>0.4.28 will be available in nixpkgs
-      "test_vmap_and_cond_passthrough" # ValueError: vmap has mapped output but out_axes is None
-      "test_vmap_and_cond_passthrough_error" # AssertionError: "at vmap.*'broadcast'.*got axis spec ...
+      # Failing with AssertionError since the jax update to 0.5.0
+      "test_basic_demo_single"
+      "test_batch_norm_multi_init"
+      "test_multimetric"
+      "test_split_merge"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
diff --git a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix
index 67f5774a2f49..b22e6fc6350f 100644
--- a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix
+++ b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix
@@ -33,7 +33,7 @@ let
   srcs = {
     "x86_64-linux" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_x86_64.whl";
-      hash = "sha256-g75MWfvPMAd6YAhdmOfVncc4sckeDWKOSsF3n94VrCs=";
+      hash = "sha256-0jgzwbiF2WwnZAAOlQUvK1gnx31JLqaPZ+kDoTJlbbs=";
     };
     "aarch64-linux" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_aarch64.whl";
diff --git a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix
index 0b63fac213a1..572ec530f6d3 100644
--- a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix
+++ b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix
@@ -39,7 +39,7 @@ let
     "3.10-x86_64-linux" = getSrcFromPypi {
       platform = "manylinux2014_x86_64";
       dist = "cp310";
-      hash = "sha256-nULpmc1k3VZ8FJ7Wj3k5K6iGRDZCGLtjbNzvoBl8kv4=";
+      hash = "sha256-D0Q6azcpjt+weW/NvR+GzoWksIS2vT8fUKT7/Wfe2Gs=";
     };
     "3.10-aarch64-linux" = getSrcFromPypi {
       platform = "manylinux2014_aarch64";
@@ -49,7 +49,7 @@ let
     "3.11-x86_64-linux" = getSrcFromPypi {
       platform = "manylinux2014_x86_64";
       dist = "cp311";
-      hash = "sha256-cEZUOG8OYAoCgdquqViCqmekfttoOTthsbFzx+jKdKg=";
+      hash = "sha256-qYE1oCIwZLj1xoU+It3BpOOGIVLTf7aF8Nve/+DIASI=";
     };
     "3.11-aarch64-linux" = getSrcFromPypi {
       platform = "manylinux2014_aarch64";
@@ -59,7 +59,7 @@ let
     "3.12-x86_64-linux" = getSrcFromPypi {
       platform = "manylinux2014_x86_64";
       dist = "cp312";
-      hash = "sha256-Ufas/3Ew63LrsCU039NYGg9eoGlx3lLX68Ia1Nh/5x4=";
+      hash = "sha256-QwWN/FZdjJ2mn0fNTkuVxJXxaG8onvRYTCtygD5vFgc=";
     };
     "3.12-aarch64-linux" = getSrcFromPypi {
       platform = "manylinux2014_aarch64";
@@ -69,7 +69,7 @@ let
     "3.13-x86_64-linux" = getSrcFromPypi {
       platform = "manylinux2014_x86_64";
       dist = "cp313";
-      hash = "sha256-CSKKTCtEO3aozZqOwikGAInEzINuBiSWh1ptb9xm0x8=";
+      hash = "sha256-3zbEsXbi01qCqfOM13zDadJx5gBR43GgqO9FFD+PWLY=";
     };
     "3.13-aarch64-linux" = getSrcFromPypi {
       platform = "manylinux2014_aarch64";
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 99154a8ea86a..7c83e9be3a12 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -40,7 +40,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.38";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     tag = "jax-v${version}";
-    hash = "sha256-H8I9Mkz6Ia1RxJmnuJOSevLGHN2J8ey59ZTlFx8YfnA=";
+    hash = "sha256-D6n9Z34nrCbBd9IS8YW6uio5Yi9GLCo9PViO3YYbkQ8=";
   };
 
   build-system = [ setuptools ];
@@ -154,6 +154,7 @@ buildPythonPackage rec {
       "testInAxesPyTreePrefixMismatchErrorKwargs"
       "testOutAxesPyTreePrefixMismatchError"
       "test_tree_map"
+      "test_tree_prefix_error"
       "test_vjp_rule_inconsistent_pytree_structures_error"
       "test_vmap_in_axes_tree_prefix_error"
       "test_vmap_mismatched_axis_sizes_error_message_issue_705"
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index dd82358f03b7..7cc8578a01d3 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  version = "0.4.38";
+  version = "0.5.0";
   inherit (python) pythonVersion;
 
   # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the
@@ -49,85 +49,65 @@ let
       "3.10-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp310";
-        hash = "sha256-Ya7MuaJ8Z/24RQ9jVyQAGc1FEcudYqROR2R1bThIU60=";
+        hash = "sha256-dEQLYyEHM2QA1Pl6Fkgddn8T6pFMU7oU5UTG/aVIGbM=";
       };
       "3.10-aarch64-linux" = getSrcFromPypi {
         platform = "manylinux2014_aarch64";
         dist = "cp310";
-        hash = "sha256-7hnBY6j98IOdTBi4il+/tOcxunxDdBbT5Ug+Vwu3ZOQ=";
+        hash = "sha256-Wy7+Pf6/GKhMRR04A6yITuJCAhwRE7J5wT9LvDeMPcA=";
       };
       "3.10-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp310";
-        hash = "sha256-MLL1LLUNdHNK8vR3wlM6elg+O7eyyKzes2Hud9lAV3o=";
-      };
-      "3.10-x86_64-darwin" = getSrcFromPypi {
-        platform = "macosx_10_14_x86_64";
-        dist = "cp310";
-        hash = "sha256-VcGbnT8zpvxZ9kSqWiH7oCY5zN13bLSptVJmJfV4Of8=";
+        hash = "sha256-G4psQ0XxN/OHZQ3i28SIwgJRt0ErVd1kjhpPE7z1B/s=";
       };
 
       "3.11-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp311";
-        hash = "sha256-J1H/cDfWqZfQvg53zEvjgcWp+buLMU7bdVwTpv2Wn0U=";
+        hash = "sha256-CRE+8Vgro018vEQP7bMY9IVbWbd2cRqKuiRzyXJ9MCU=";
       };
       "3.11-aarch64-linux" = getSrcFromPypi {
         platform = "manylinux2014_aarch64";
         dist = "cp311";
-        hash = "sha256-Q9tYxMQnYnKWNmpWwQMY4fAPUDaQ4X+Uu0NEKT4ZleA=";
+        hash = "sha256-YwiNv6qFu1bNUhqSWjRy/XMosY7JPC2P+oWvMxCVyZU=";
       };
       "3.11-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp311";
-        hash = "sha256-P7DqrnNpFXr+y+rVCq8p5z/936d6IzXXIb2XlPPFEOQ=";
-      };
-      "3.11-x86_64-darwin" = getSrcFromPypi {
-        platform = "macosx_10_14_x86_64";
-        dist = "cp311";
-        hash = "sha256-tn/eq9bf7Qi3do873/tSEWAIX4MFZpvRl77vYdCN4Is=";
+        hash = "sha256-bNdi7RYjEySZ+nAcQgNEYQLgqcgsojGUuHKI90bRKik=";
       };
 
       "3.12-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp312";
-        hash = "sha256-2tbAqWVnwG0IPARp/sQPIBIQsJk2W9aYvjGm0uyI/Vk=";
+        hash = "sha256-+YDHM+mMmYqNqHyajMYbZybQvmZ6WL1mTB1xe0tOrnU=";
       };
       "3.12-aarch64-linux" = getSrcFromPypi {
         platform = "manylinux2014_aarch64";
         dist = "cp312";
-        hash = "sha256-SW9FsOABojQTCc0MdK8LZwU33O15wWjLIwz8x3PwqoY";
+        hash = "sha256-S0sBr7Dd7JbAg1a/8rtoXdvpf9/+Ttbi2DSzCrqXLyI=";
       };
       "3.12-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp312";
-        hash = "sha256-8zvK/jLJelYuz2iU18QWdMgMCs3t+lQj1Jr1EUcUmHQ=";
-      };
-      "3.12-x86_64-darwin" = getSrcFromPypi {
-        platform = "macosx_10_14_x86_64";
-        dist = "cp312";
-        hash = "sha256-P+/qmF8EFYFvO7r9PwOkNwUCde+brJpywTFOFkSsV8E=";
+        hash = "sha256-c+M1cVdgxW5jUQnWFCZDWl1/RvM2OhFdrqCUJ9XNDv0=";
       };
 
       "3.13-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp313";
-        hash = "sha256-LOd7qM2pJZpLypevwcci5CkabEY6Y/jTcsbtyFEX1iU=";
+        hash = "sha256-Ee7wHTfA8cUwYmW3byB/EALRNIDe0uMf1j7HaRLJPKI=";
       };
       "3.13-aarch64-linux" = getSrcFromPypi {
         platform = "manylinux2014_aarch64";
         dist = "cp313";
-        hash = "sha256-JIzKN3Hr8ksHD0lwE2TOraM+YTlEWwbHgsylrFrZK/Q=";
+        hash = "sha256-fZsXp+oZNV1F7Nsv8NtdcHqG8MWoYtlLibRWjWxFMRo=";
       };
       "3.13-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp313";
-        hash = "sha256-b+MmuK82Y4fdR8zzElg7Kxf+0ScSybdKZIsYoTy9ur8=";
-      };
-      "3.13-x86_64-darwin" = getSrcFromPypi {
-        platform = "macosx_10_14_x86_64";
-        dist = "cp313";
-        hash = "sha256-QeVa5YGKiC5XiehI9vFmh6wTK8+7Wl+hFKXRi3jQXy0=";
+        hash = "sha256-7RjqcWHQOqj9TRtVSUiC8hQg79/qaOXymMSuvPKsPzQ=";
       };
     };
 in
diff --git a/pkgs/development/python-modules/numpyro/default.nix b/pkgs/development/python-modules/numpyro/default.nix
index 89d0c2e0d18b..8decec762030 100644
--- a/pkgs/development/python-modules/numpyro/default.nix
+++ b/pkgs/development/python-modules/numpyro/default.nix
@@ -90,6 +90,30 @@ buildPythonPackage rec {
     "test_kl_dirichlet_dirichlet"
     "test_kl_univariate"
     "test_mean_var"
+    # since jax update to 0.5.0
+    "test_analytic_kl_2"
+    "test_analytic_kl_3"
+    "test_apply_kernel"
+    "test_beta_bernoulli"
+    "test_biject_to"
+    "test_bijective_transforms"
+    "test_change_point_x64"
+    "test_cholesky_update"
+    "test_dais_vae"
+    "test_discrete_gibbs_multiple_sites_chain"
+    "test_entropy_categorical"
+    "test_gaussian_model"
+    "test_get_proposal_loc_and_scale"
+    "test_guide_plate_contraction"
+    "test_kernel_forward"
+    "test_laplace_approximation_warning"
+    "test_log_prob_gradient"
+    "test_logistic_regression"
+    "test_logistic_regression_x64"
+    "test_scale"
+    "test_scan_svi"
+    "test_stein_particle_loss"
+    "test_weight_convergence"
 
     # Tests want to download data
     "data_load"
diff --git a/pkgs/development/python-modules/rfc3161-client/default.nix b/pkgs/development/python-modules/rfc3161-client/default.nix
new file mode 100644
index 000000000000..6d56846dbee0
--- /dev/null
+++ b/pkgs/development/python-modules/rfc3161-client/default.nix
@@ -0,0 +1,52 @@
+{
+  buildPythonPackage,
+  lib,
+  fetchFromGitHub,
+  perl,
+  cryptography,
+  rustPlatform,
+  pretend,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "rfc3161-client";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trailofbits";
+    repo = "rfc3161-client";
+    tag = "v${version}";
+    hash = "sha256-fdNpM5fQnvwBgeL/adIb74pywtK6+8dLxc6kIVgCOCw=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src pname;
+    hash = "sha256-jpysrco+dybMwiKOa21uLKqsOeYFFERL7XKND7gPwX8=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    perl
+  ];
+
+  dependencies = [
+    cryptography
+    pretend
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/trailofbits/rfc3161-client";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    changelog = "https://github.com/trailofbits/rfc3161-client/releases/tag/v${version}";
+    description = "Opinionated Python RFC3161 Client";
+  };
+}
diff --git a/pkgs/development/python-modules/sigstore-rekor-types/default.nix b/pkgs/development/python-modules/sigstore-rekor-types/default.nix
index ba523fe259a1..d1a46c8b5d24 100644
--- a/pkgs/development/python-modules/sigstore-rekor-types/default.nix
+++ b/pkgs/development/python-modules/sigstore-rekor-types/default.nix
@@ -28,11 +28,14 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Python models for Rekor's API types";
     homepage = "https://github.com/trailofbits/sigstore-rekor-types";
     changelog = "https://github.com/trailofbits/sigstore-rekor-types/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      fab
+      bot-wxt1221
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/sigstore/default.nix b/pkgs/development/python-modules/sigstore/default.nix
index f4983e93590c..2bcc833a541a 100644
--- a/pkgs/development/python-modules/sigstore/default.nix
+++ b/pkgs/development/python-modules/sigstore/default.nix
@@ -19,6 +19,7 @@
   securesystemslib,
   sigstore-protobuf-specs,
   sigstore-rekor-types,
+  rfc3161-client,
   tuf,
   rfc8785,
   pyasn1,
@@ -27,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "sigstore-python";
-  version = "3.5.3";
+  version = "3.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,10 +37,13 @@ buildPythonPackage rec {
     owner = "sigstore";
     repo = "sigstore-python";
     tag = "v${version}";
-    hash = "sha256-pAzS/LU5me3qoJo6EmuSFPDO/lqRDKIl5hjFiysWTdM=";
+    hash = "sha256-BdVX2LWCsMx9r0bDTJjMdrvy4Hqn6hrw9wAcub0nRMk=";
   };
 
-  pythonRelaxDeps = [ "sigstore-rekor-types" ];
+  pythonRelaxDeps = [
+    "sigstore-rekor-types"
+    "rfc3161-client"
+  ];
 
   build-system = [ flit-core ];
 
@@ -53,6 +57,7 @@ buildPythonPackage rec {
     pyopenssl
     pyasn1
     rfc8785
+    rfc3161-client
     platformdirs
     requests
     rich
@@ -88,6 +93,7 @@ buildPythonPackage rec {
     "test_trust_root_bundled_get"
     "test_fix_bundle_upgrades_bundle"
     "test_trust_root_tuf_caches_and_requests"
+    "test_regression_verify_legacy_bundle"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix b/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
index fc7e14205f9f..993f6c0b3588 100644
--- a/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
+++ b/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
@@ -2,11 +2,11 @@
 
 mkTclDerivation {
   pname = "wapp";
-  version = "0-unstable-2024-05-23";
+  version = "0-unstable-2024-11-22";
 
   src = fetchurl {
-    url = "https://wapp.tcl-lang.org/home/raw/98f23b2160bafc41f34be8e5d8ec414c53d33412eb2f724a07f2476eaf04ac6f?at=wapp.tcl";
-    hash = "sha256-A+Ml5h5C+OMoDQtAoB9lHgYEK1A7qHExT3p46PHRTYg=";
+    url = "https://wapp.tcl-lang.org/home/raw/3b1ce7c0234b4b2750deadc80f524ed28e835aa5e741bf3fe63b416a16a55699?at=wapp.tcl";
+    hash = "sha256-0e9yTVFYj1tYGU7EiXRPw35qfDzckzz4i3RV/8TttGw=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index aed03b72322a..69a6961b55c0 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "15.0.0";
+  version = "15.0.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-I7HGtHjKdgmX7N3Uxyjw2igLBpYAipvd2aEGjxbUj3I=";
+    hash = "sha256-dDutW7417X9QCffOFh8dovJsF7tRMUc+BhzmWzp64JM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/openxray/default.nix b/pkgs/games/openxray/default.nix
index 5d761fbf7f71..340e1bbf68b0 100644
--- a/pkgs/games/openxray/default.nix
+++ b/pkgs/games/openxray/default.nix
@@ -18,16 +18,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openxray";
-  version = "2188-november-2023-rc1";
+  version = "2921-january-2025-rc1";
 
   src = fetchFromGitHub {
     owner = "OpenXRay";
     repo = "xray-16";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-rRxw/uThACmT2qI8NUwJU+WbJ3BWUss6CH13R5aaHco=";
+    hash = "sha256-PYRC1t4gjT2d41ZZOZJF4u3vc0Pq7DpivEnnfbcSQYk=";
   };
 
+  # Don't force-override these please
+  postPatch = ''
+    substituteInPlace Externals/LuaJIT-proj/CMakeLists.txt \
+      --replace-fail 'set(CMAKE_OSX_SYSROOT' '#set(CMAKE_OSX_SYSROOT' \
+      --replace-fail 'set(ENV{SDKROOT}' '#set(ENV{SDKROOT}'
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -47,6 +54,16 @@ stdenv.mkDerivation (finalAttrs: {
     pcre
   ];
 
+  cmakeFlags =
+    [
+      # Breaks on Darwin
+      (lib.cmakeBool "USE_LTO" (!stdenv.hostPlatform.isDarwin))
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # This seemingly only gets set properly by CMake when using the XCode generator
+      (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" "${stdenv.hostPlatform.darwinMinVersion}")
+    ];
+
   # Crashes can happen, we'd like them to be reasonably debuggable
   cmakeBuildType = "RelWithDebInfo";
   dontStrip = true;
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 2344057f8241..c14ac3ab6357 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,42 +2,42 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.10.232-hardened1.patch",
-            "sha256": "1bfhnj6k65q6kjlxbxqfzq2l81dvbfdc4khn7n0zp6vm37a34c74",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.232-hardened1/linux-hardened-v5.10.232-hardened1.patch"
+            "name": "linux-hardened-v5.10.233-hardened1.patch",
+            "sha256": "1dchzjp4dvdla2mpac8bk6cj4ymx2vkwllck9wvlsbi15897a50y",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.233-hardened1/linux-hardened-v5.10.233-hardened1.patch"
         },
-        "sha256": "1w5ycdh24j4gsjc2zk7nhbmya59vhi49lbh8333ziprqlj4lb97x",
-        "version": "5.10.232"
+        "sha256": "0lkz2g8r032f027j3gih3f7crx991mrpng9qgqc5k4cc1wl5g7i3",
+        "version": "5.10.233"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.175-hardened1.patch",
-            "sha256": "1j7z487n26jd8npylddflpdksrwk7b7xck2gblsd1rp1zgpd0q4g",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.175-hardened1/linux-hardened-v5.15.175-hardened1.patch"
+            "name": "linux-hardened-v5.15.176-hardened1.patch",
+            "sha256": "10r86rxixrvclzfpzp449ry7j79gr0n75zvh4x9bzr1860f0mha6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.176-hardened1/linux-hardened-v5.15.176-hardened1.patch"
         },
-        "sha256": "1l59x1f1b29mayhzxxkh9vlba41h51mmfh1vram31bks1v4bpn4g",
-        "version": "5.15.175"
+        "sha256": "1cfk55469swywnf4r6pl7b3njxws8w3np81r99f0wnlaihrbajm8",
+        "version": "5.15.176"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.4.288-hardened1.patch",
-            "sha256": "0zqc0xblfy2rj1n8mr2q07apcq1rmqshsi15881df4ml5lkq4y62",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.288-hardened1/linux-hardened-v5.4.288-hardened1.patch"
+            "name": "linux-hardened-v5.4.289-hardened1.patch",
+            "sha256": "1gg4awiiggks5biyhkqdlxm7xxkpd754lxibflk3nwfj1rs44iwn",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.289-hardened1/linux-hardened-v5.4.289-hardened1.patch"
         },
-        "sha256": "1zhsb6gwhb6cvijzh7s8rnm4b06klyhb2mxb06gcyfvj0givlvw7",
-        "version": "5.4.288"
+        "sha256": "043dl195h06hs3zdjd6j1m1zgvmky3s0plrpma75zqf8ab05yghy",
+        "version": "5.4.289"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.123-hardened1.patch",
-            "sha256": "0ara8rw6l77wfsc0ccz74q22693dhbj7pxw7k12i2an3vy10y16j",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.123-hardened1/linux-hardened-v6.1.123-hardened1.patch"
+            "name": "linux-hardened-v6.1.126-hardened1.patch",
+            "sha256": "096bchjy9n7q48r7xzzky9pmicdzz9pvmg5sk6943s4q5icrhi6s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.126-hardened1/linux-hardened-v6.1.126-hardened1.patch"
         },
-        "sha256": "1g5k9q113nyid3a347abb36v2xfv5vf74ic88af7kf04kzbsr9rk",
-        "version": "6.1.123"
+        "sha256": "140pprw2fkyz9qi5wnhi0yzpj65lzwi3zbmnvsk2yhgc9arj06f9",
+        "version": "6.1.126"
     },
     "6.11": {
         "patch": {
@@ -52,21 +52,21 @@
     "6.12": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.8-hardened1.patch",
-            "sha256": "1hb2rvf6p1hwqyb5rhgwd9nwkxw1axjg0x47ym453rs6zddxyqlb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.8-hardened1/linux-hardened-v6.12.8-hardened1.patch"
+            "name": "linux-hardened-v6.12.10-hardened1.patch",
+            "sha256": "1m48sf0ihzpcj4ca9420rmhrihhchd2qrv86vw8llq3jmv7xqij5",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.10-hardened1/linux-hardened-v6.12.10-hardened1.patch"
         },
-        "sha256": "0y992b484rkkaqdkz5mw2is1l0izxhm3cl7fi5f72jx0bh3dm492",
-        "version": "6.12.8"
+        "sha256": "15xjjn8ff7g9q0ljr2g8k098ppxnpvxlgv22rdrplls8sxg6wlaa",
+        "version": "6.12.10"
     },
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.69-hardened1.patch",
-            "sha256": "06rr4r927sdzlyixs4blwxdgygb5akm76a81px5xj8a754iaws8x",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.69-hardened1/linux-hardened-v6.6.69-hardened1.patch"
+            "name": "linux-hardened-v6.6.73-hardened1.patch",
+            "sha256": "18jy2acz7gh4f8gqc6ifq1rkgxqlc53wmrhs0m8ndi5p70wswr6v",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.73-hardened1/linux-hardened-v6.6.73-hardened1.patch"
         },
-        "sha256": "0d2gilgh8myavzfdjnx7az4dbwvkk7irvsz6rla9bnbmgdb0aqww",
-        "version": "6.6.69"
+        "sha256": "141428a3bxks9w5jj17w8jmp7zp90p3v33dyk046a0f2j2qqs0nj",
+        "version": "6.6.73"
     }
 }
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index 8e2eb98f4bd8..65ae74386203 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "5.2.0";
+  version = "5.3.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-M2WbqXHAL77fu9khTgb7BOe0mLgmU0Rcf9KN4KmvYAU=";
+    hash = "sha256-TMvQb2cU+uz4CeyWksWYfueyQ7NpUsG4saoJVXVkd7Y=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c947998b9e58..17092f5dee69 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12997,10 +12997,6 @@ with pkgs;
 
   barrier = libsForQt5.callPackage ../applications/misc/barrier { };
 
-  bespokesynth = darwin.apple_sdk_11_0.callPackage ../applications/audio/bespokesynth {
-    inherit (darwin.apple_sdk_11_0.frameworks) Accelerate Cocoa WebKit CoreServices CoreAudioKit IOBluetooth MetalKit;
-  };
-
   bespokesynth-with-vst2 = bespokesynth.override {
     enableVST2 = true;
   };
@@ -13787,6 +13783,7 @@ with pkgs;
 
   hugin = callPackage ../applications/graphics/hugin {
     wxGTK = wxGTK32;
+    openexr = openexr_3;
   };
 
   huggle = libsForQt5.callPackage ../applications/misc/huggle { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 54ea65a96643..ff3cd8bb7b51 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14144,6 +14144,8 @@ self: super: with self; {
 
   reverse-geocode = callPackage ../development/python-modules/reverse-geocode { };
 
+  rfc3161-client = callPackage ../development/python-modules/rfc3161-client { };
+
   rfc3339 = callPackage ../development/python-modules/rfc3339 { };
 
   rfc3339-validator = callPackage ../development/python-modules/rfc3339-validator { };