diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 79384daa6b3e..abf9b7c33704 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -171,11 +171,11 @@ jobs:
         run: |
           # Get the latest eval.yml workflow run for the PR's target commit
           if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
-            -f head_sha="$BASE_SHA" -f event=push \
+            -f head_sha="$TARGET_SHA" -f event=push \
             --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
             || [[ -z "$run" ]]; then
-            echo "Could not find an eval.yml workflow run for $BASE_SHA, cannot make comparison"
-            exit 0
+            echo "Could not find an eval.yml workflow run for $TARGET_SHA, cannot make comparison"
+            exit 1
           fi
           echo "Comparing against $(jq .html_url <<< "$run")"
           runId=$(jq .id <<< "$run")
@@ -189,13 +189,13 @@ jobs:
 
           if [[ "$conclusion" != "success" ]]; then
             echo "Workflow was not successful (conclusion: $conclusion), cannot make comparison"
-            exit 0
+            exit 1
           fi
 
           echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
         env:
           REPOSITORY: ${{ github.repository }}
-          BASE_SHA: ${{ needs.attrs.outputs.targetSha }}
+          TARGET_SHA: ${{ needs.attrs.outputs.targetSha }}
           GH_TOKEN: ${{ github.token }}
 
       - uses: actions/download-artifact@v4
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2627c363fee7..f3d03f99db7f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5974,6 +5974,12 @@
     githubId = 523628;
     name = "Jonathan Strickland";
   };
+  djds = {
+    email = "git@djds.dev";
+    github = "djds";
+    githubId = 4218822;
+    name = "djds";
+  };
   Dje4321 = {
     email = "dje4321@gmail.com";
     github = "dje4321";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 3bc2eb6ec3f5..39b337d55744 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -149,6 +149,8 @@
 
 - [git-worktree-switcher](https://github.com/mateusauler/git-worktree-switcher), switch between git worktrees with speed. Available as [programs.git-worktree-switcher](#opt-programs.git-worktree-switcher.enable)
 
+- [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](options.html#opt-services.glpiAgent.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index bd3b27c00b55..05c4785400fb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -925,6 +925,7 @@
   ./services/monitoring/gatus.nix
   ./services/monitoring/gitwatch.nix
   ./services/monitoring/glances.nix
+  ./services/monitoring/glpi-agent.nix
   ./services/monitoring/goss.nix
   ./services/monitoring/grafana-agent.nix
   ./services/monitoring/grafana-image-renderer.nix
diff --git a/nixos/modules/services/blockchain/ethereum/geth.nix b/nixos/modules/services/blockchain/ethereum/geth.nix
index 0c406c595a74..570c556ef849 100644
--- a/nixos/modules/services/blockchain/ethereum/geth.nix
+++ b/nixos/modules/services/blockchain/ethereum/geth.nix
@@ -126,11 +126,8 @@ let
         network = lib.mkOption {
           type = lib.types.nullOr (
             lib.types.enum [
-              "goerli"
               "holesky"
-              "rinkeby"
-              "yolov2"
-              "ropsten"
+              "sepolia"
             ]
           );
           default = null;
diff --git a/nixos/modules/services/misc/recyclarr.nix b/nixos/modules/services/misc/recyclarr.nix
new file mode 100644
index 000000000000..4df6266e70b5
--- /dev/null
+++ b/nixos/modules/services/misc/recyclarr.nix
@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.recyclarr;
+  format = pkgs.formats.yaml { };
+  stateDir = "/var/lib/recyclarr";
+  configPath = "${stateDir}/config.json";
+in
+{
+  options.services.recyclarr = {
+    enable = lib.mkEnableOption "recyclarr service";
+
+    package = lib.mkPackageOption pkgs "recyclarr" { };
+
+    configuration = lib.mkOption {
+      type = format.type;
+      default = { };
+      example = {
+        sonarr = [
+          {
+            instance_name = "main";
+            base_url = "http://localhost:8989";
+            api_key = {
+              _secret = "/run/credentials/recyclarr.service/sonarr-api_key";
+            };
+          }
+        ];
+        radarr = [
+          {
+            instance_name = "main";
+            base_url = "http://localhost:7878";
+            api_key = {
+              _secret = "/run/credentials/recyclarr.service/radarr-api_key";
+            };
+          }
+        ];
+      };
+      description = lib.mdDoc ''
+        Recyclarr YAML configuration as a Nix attribute set.
+
+        For detailed configuration options and examples, see the
+        [official configuration reference](https://recyclarr.dev/wiki/yaml/config-reference/).
+
+        The configuration is processed using [utils.genJqSecretsReplacementSnippet](https://github.com/NixOS/nixpkgs/blob/master/nixos/lib/utils.nix#L232-L331) to handle secret substitution.
+
+        To avoid permission issues, secrets should be provided via systemd's credential mechanism:
+
+        ```nix
+        systemd.services.recyclarr.serviceConfig.LoadCredential = [
+          "radarr-api_key:''${config.sops.secrets.radarr-api_key.path}"
+        ];
+      '';
+    };
+
+    schedule = lib.mkOption {
+      type = lib.types.str;
+      default = "daily";
+      description = "When to run recyclarr in systemd calendar format.";
+    };
+
+    command = lib.mkOption {
+      type = lib.types.str;
+      default = "sync";
+      description = "The recyclarr command to run (e.g., sync).";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "recyclarr";
+      description = "User account under which recyclarr runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "recyclarr";
+      description = "Group under which recyclarr runs.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    users.users = lib.mkIf (cfg.user == "recyclarr") {
+      recyclarr = {
+        isSystemUser = true;
+        description = "recyclarr user";
+        home = stateDir;
+        group = cfg.group;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "recyclarr") {
+      ${cfg.group} = { };
+    };
+
+    systemd.services.recyclarr = {
+      description = "Recyclarr Service";
+
+      # YAML is a JSON super-set
+      preStart = utils.genJqSecretsReplacementSnippet cfg.configuration configPath;
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "recyclarr";
+        ExecStart = "${lib.getExe cfg.package} ${cfg.command} --app-data ${stateDir} --config ${configPath}";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+
+        PrivateNetwork = false;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+
+        NoNewPrivileges = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+
+        ReadWritePaths = [ stateDir ];
+
+        CapabilityBoundingSet = "";
+
+        LockPersonality = true;
+        RestrictRealtime = true;
+      };
+    };
+
+    systemd.timers.recyclarr = {
+      description = "Recyclarr Timer";
+      wantedBy = [ "timers.target" ];
+      partOf = [ "recyclarr.service" ];
+
+      timerConfig = {
+        OnCalendar = cfg.schedule;
+        Persistent = true;
+        RandomizedDelaySec = "5m";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/glpi-agent.nix b/nixos/modules/services/monitoring/glpi-agent.nix
new file mode 100644
index 000000000000..8ee18b5599bf
--- /dev/null
+++ b/nixos/modules/services/monitoring/glpi-agent.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.glpiAgent;
+
+  settingsType =
+    with lib.types;
+    attrsOf (oneOf [
+      bool
+      int
+      str
+      (listOf str)
+    ]);
+
+  formatValue =
+    v:
+    if lib.isBool v then
+      if v then "1" else "0"
+    else if lib.isList v then
+      lib.concatStringsSep "," v
+    else
+      toString v;
+
+  configContent = lib.concatStringsSep "\n" (
+    lib.mapAttrsToList (k: v: "${k} = ${formatValue v}") cfg.settings
+  );
+
+  configFile = pkgs.writeText "agent.cfg" configContent;
+
+in
+{
+  options = {
+    services.glpiAgent = {
+      enable = lib.mkEnableOption "GLPI Agent";
+
+      package = lib.mkPackageOption pkgs "glpi-agent" { };
+
+      settings = lib.mkOption {
+        type = settingsType;
+        default = { };
+        description = ''
+          GLPI Agent configuration options.
+          See https://glpi-agent.readthedocs.io/en/latest/configuration.html for all available options.
+
+          The 'server' option is mandatory and must point to your GLPI server.
+        '';
+        example = lib.literalExpression ''
+          {
+            server = [ "https://glpi.example.com/inventory" ];
+            delaytime = 3600;
+            tag = "production";
+            logger = [ "stderr" "file" ];
+            debug = 1;
+            "no-category" = [ "printer" "software" ];
+          }
+        '';
+      };
+
+      stateDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/glpi-agent";
+        description = "Directory where GLPI Agent stores its state.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings ? server;
+        message = "GLPI Agent requires a server to be configured in services.glpiAgent.settings.server";
+      }
+    ];
+
+    systemd.services.glpi-agent = {
+      description = "GLPI Agent";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --conf-file ${configFile} --vardir ${cfg.stateDir} --daemon --no-fork";
+        Restart = "on-failure";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/geth.nix b/nixos/tests/geth.nix
index 984b46935b86..7fa7b97ed3bb 100644
--- a/nixos/tests/geth.nix
+++ b/nixos/tests/geth.nix
@@ -15,7 +15,8 @@ import ./make-test-python.nix (
             enable = true;
           };
         };
-        services.geth."testnet" = {
+
+        services.geth."holesky" = {
           enable = true;
           port = 30304;
           network = "holesky";
@@ -28,15 +29,31 @@ import ./make-test-python.nix (
             port = 18551;
           };
         };
+
+        services.geth."sepolia" = {
+          enable = true;
+          port = 30305;
+          network = "sepolia";
+          http = {
+            enable = true;
+            port = 28545;
+          };
+          authrpc = {
+            enable = true;
+            port = 28551;
+          };
+        };
       };
 
     testScript = ''
       start_all()
 
       machine.wait_for_unit("geth-mainnet.service")
-      machine.wait_for_unit("geth-testnet.service")
+      machine.wait_for_unit("geth-holesky.service")
+      machine.wait_for_unit("geth-sepolia.service")
       machine.wait_for_open_port(8545)
       machine.wait_for_open_port(18545)
+      machine.wait_for_open_port(28545)
 
       machine.succeed(
           'geth attach --exec "eth.blockNumber" http://localhost:8545 | grep \'^0$\' '
@@ -45,6 +62,10 @@ import ./make-test-python.nix (
       machine.succeed(
           'geth attach --exec "eth.blockNumber" http://localhost:18545 | grep \'^0$\' '
       )
+
+      machine.succeed(
+          'geth attach --exec "eth.blockNumber" http://localhost:28545 | grep \'^0$\' '
+      )
     '';
   }
 )
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 484722aedf2d..e85c7cb9e89f 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,7 +9,7 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.82";
+        stable = "0.0.83";
         ptb = "0.0.128";
         canary = "0.0.581";
         development = "0.0.68";
@@ -26,7 +26,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-L8Lwe5UavmbW1s3gsSJiHjbiZnNtyEsEJzlrN0Fgc3w=";
+        hash = "sha256-thBnSYjYa2QEHyxIhEiA73hMs/S8n808oq8IAKtA7VI=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
diff --git a/pkgs/applications/science/logic/why3/default.nix b/pkgs/applications/science/logic/why3/default.nix
index 40547a2f664c..93cff7b35fde 100644
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = with ocamlPackages; [
     camlzip
     menhirLib
-    num
+    (if lib.versionAtLeast version "1.8.0" then zarith else num)
     re
     sexplib
   ];
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 3a65fdff9388..2e9a7042d6e3 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "17.8.0",
-  "repo_hash": "0a6a05hip2f505yvfi4v7849cmpb1kzghsf6ivy6lrhc06ksxs19",
+  "version": "17.8.1",
+  "repo_hash": "17m0aw8gd58gs1vxzk6pbqnhrhkvc172kn47pj5p6sgq3li3mcgf",
   "yarn_hash": "0d1nzgji3y90gcx92pl0bnqlj5h9ra3r7k1z673fvsj6lzppnx8v",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.8.0-ee",
+  "rev": "v17.8.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.8.0",
-    "GITLAB_PAGES_VERSION": "17.8.0",
+    "GITALY_SERVER_VERSION": "17.8.1",
+    "GITLAB_PAGES_VERSION": "17.8.1",
     "GITLAB_SHELL_VERSION": "14.39.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.4.0",
-    "GITLAB_WORKHORSE_VERSION": "17.8.0"
+    "GITLAB_WORKHORSE_VERSION": "17.8.1"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index a9c921a6c994..cb1d66938b5c 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.8.0";
+  version = "17.8.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/as/astroterm/package.nix b/pkgs/by-name/as/astroterm/package.nix
index 3cdde4b2e995..bc5e88b15479 100644
--- a/pkgs/by-name/as/astroterm/package.nix
+++ b/pkgs/by-name/as/astroterm/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astroterm";
-  version = "1.0.4";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "da-luce";
     repo = "astroterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CYKW/RAQ3a5238cojbpGfTenMQApfaZOHnQMrZ6LWzA=";
+    hash = "sha256-BjqurPp0WI/wI5n2TibnyOqZ3NjRcLYB2MxqqNvTQtw=";
   };
 
   bsc5File = fetchurl {
diff --git a/pkgs/by-name/au/audible-cli/package.nix b/pkgs/by-name/au/audible-cli/package.nix
index 88a8bfd55c0d..4405384f234b 100644
--- a/pkgs/by-name/au/audible-cli/package.nix
+++ b/pkgs/by-name/au/audible-cli/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  addBinToPathHook,
   installShellFiles,
   nix-update-script,
 }:
@@ -24,6 +25,7 @@ python3Packages.buildPythonApplication rec {
       setuptools
     ]
     ++ [
+      addBinToPathHook
       installShellFiles
     ];
 
@@ -46,7 +48,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   postInstall = ''
-    export PATH=$out/bin:$PATH
     installShellCompletion --cmd audible \
       --bash <(source utils/code_completion/audible-complete-bash.sh) \
       --fish <(source utils/code_completion/audible-complete-zsh-fish.sh) \
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index 254ad69d2c23..cf610094f78f 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -126,9 +126,9 @@
 
   storage-preview = mkAzExtension rec {
     pname = "storage-preview";
-    version = "1.0.0b2";
+    version = "1.0.0b5";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
-    hash = "sha256-Lej6QhYikoowi7cASMP99AQAutOzSv1gHQs6/Ni4J2Q=";
+    hash = "sha256-gs4uQrnpXm03iPyP+i5DnFWvQ43+ZHN4wSZiNRVZU7g=";
     description = "Provides a preview for upcoming storage features";
     propagatedBuildInputs = with python3Packages; [ azure-core ];
     meta.maintainers = with lib.maintainers; [ katexochen ];
diff --git a/pkgs/by-name/ce/cedar/package.nix b/pkgs/by-name/ce/cedar/package.nix
index 62de16aef0d8..4eefcc70335d 100644
--- a/pkgs/by-name/ce/cedar/package.nix
+++ b/pkgs/by-name/ce/cedar/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cedar";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "cedar-policy";
     repo = "cedar";
     tag = "v${version}";
-    hash = "sha256-E3x+FfjLNUpfu00D+UALc73STodNW2Kvfo/4x6hORiY=";
+    hash = "sha256-1EJvLQDQQTiNwPe0Ynt6VI3RD/3jGbt/0H7pzGcl1wA=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/cl/cloud-hypervisor/package.nix b/pkgs/by-name/cl/cloud-hypervisor/package.nix
index 322ab3b48c42..a0d1304d52fc 100644
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   pkg-config,
   dtc,
@@ -11,25 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-drxJtlvBpkK3I7Ob3+pH4KLUq53GWXe1pmv7CI3bbP4=";
+    hash = "sha256-2nA8bhezmGa6Gu420nxDrgW0SonTQv1WoGYmBwm7/bI=";
   };
 
-  cargoPatches = [
-    (fetchpatch {
-      name = "kvm-ioctls-0.19.1.patch";
-      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/eaa21946993276434403d41419a34e564935c8e9.patch";
-      hash = "sha256-G7B0uGl/RAkwub8x1jNNgBrC0dwq/Gv46XpbtTZWD5M=";
-    })
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-F6ukvSwMHRHXoZKgXEFnTAN1B80GsQDW8iqZAvsREr4=";
+  cargoHash = "sha256-e2VbzBPfoy5+YrqZ5mkbxMLpQIOG0x5tIhNG6Tv+u0M=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/da/daq/package.nix b/pkgs/by-name/da/daq/package.nix
index 40401df9ba88..40e7fec92598 100644
--- a/pkgs/by-name/da/daq/package.nix
+++ b/pkgs/by-name/da/daq/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
     "--with-dnet-libraries=${libdnet}/lib"
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-incompatible-pointer-types";
+
   meta = {
     description = "Data AcQuisition library (DAQ), for packet I/O";
     mainProgram = "daq-modules-config";
diff --git a/pkgs/by-name/el/eliot-tree/package.nix b/pkgs/by-name/el/eliot-tree/package.nix
index 3a8c809f933c..637f4af95be0 100644
--- a/pkgs/by-name/el/eliot-tree/package.nix
+++ b/pkgs/by-name/el/eliot-tree/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchPypi,
+  addBinToPathHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -32,15 +33,11 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = with python3Packages; [
+    addBinToPathHook
     pytestCheckHook
     testtools
   ];
 
-  # Tests run eliot-tree in out/bin.
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
   pythonImportsCheck = [ "eliottree" ];
 
   meta = {
diff --git a/pkgs/by-name/en/ente-auth/fetch-git-hashes.py b/pkgs/by-name/en/ente-auth/fetch-git-hashes.py
new file mode 100755
index 000000000000..ff666a672370
--- /dev/null
+++ b/pkgs/by-name/en/ente-auth/fetch-git-hashes.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p nix-prefetch-git
+
+from dataclasses import dataclass
+import json
+import subprocess
+
+
+@dataclass
+class GitDependency:
+    name: str
+    url: str
+    revision: str
+
+
+def get_git_deps(lock_data):
+    for name, data in lock_data["packages"].items():
+        if data["source"] == "git":
+            desc = data["description"]
+            yield GitDependency(
+                name=name,
+                url=desc["url"],
+                revision=desc["resolved-ref"],
+            )
+
+
+def nix_prefetch_git(url: str, rev: str):
+    result = subprocess.run(
+        ["nix-prefetch-git", url, rev],
+        check=True,
+        text=True,
+        stdout=subprocess.PIPE,
+    )
+    return json.loads(result.stdout)
+
+
+if __name__ == "__main__":
+    with open("pubspec.lock.json") as lock_file:
+        lock_data = json.load(lock_file)
+    git_hashes = {}
+    for dep in get_git_deps(lock_data):
+        data = nix_prefetch_git(dep.url, dep.revision)
+        git_hashes[dep.name] = data["hash"]
+    with open("git-hashes.json", "w") as output_file:
+        json.dump(git_hashes, output_file, indent=2)
+        output_file.write("\n")
diff --git a/pkgs/by-name/en/ente-auth/git-hashes.json b/pkgs/by-name/en/ente-auth/git-hashes.json
new file mode 100644
index 000000000000..ff429e3de18f
--- /dev/null
+++ b/pkgs/by-name/en/ente-auth/git-hashes.json
@@ -0,0 +1,6 @@
+{
+  "ente_crypto_dart": "sha256-xBBK9BdXh4+OTj+Jkf3zh5sMZjXtvhyuE1R5LFE8iTY=",
+  "flutter_local_authentication": "sha256-r50jr+81ho+7q2PWHLf4VnvNJmhiARZ3s4HUpThCgc0=",
+  "flutter_secure_storage_linux": "sha256-Rp+b6ZRH7F5AnM5UvYzfVjprXkpeeA7V6Ep/oYqDeiM=",
+  "sqflite": "sha256-+XTVtkFJ94VifwnutvUuAqqiyWwrcEiZ3Uz0H4D9zWA="
+}
diff --git a/pkgs/by-name/en/ente-auth/package.nix b/pkgs/by-name/en/ente-auth/package.nix
index 705b43691443..4a369c142f02 100644
--- a/pkgs/by-name/en/ente-auth/package.nix
+++ b/pkgs/by-name/en/ente-auth/package.nix
@@ -17,19 +17,20 @@ let
 in
 flutter324.buildFlutterApplication rec {
   pname = "ente-auth";
-  version = "4.2.8";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "auth" ];
     tag = "auth-v${version}";
-    hash = "sha256-1vIM2MrQF0DO+5SEzIAUeZxOks6PKs3kkTdc09aCk2A=";
+    hash = "sha256-/WWodQcMibwXVexI+XbTZYRkIMtfNHk3bJVBPJHcoqI=";
   };
 
   sourceRoot = "${src.name}/auth";
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = lib.importJSON ./git-hashes.json;
 
   patches = [
     # Disable update notifications and auto-update functionality
@@ -41,14 +42,6 @@ flutter324.buildFlutterApplication rec {
     ln -s ${simple-icons} assets/simple-icons
   '';
 
-  gitHashes = {
-    desktop_webview_window = "sha256-jdNMpzFBgw53asWlGzWUS+hoPdzcL6kcJt2KzjxXf2E=";
-    ente_crypto_dart = "sha256-XBzQ268E0cYljJH6gDS5O0Pmie/GwuhMDlQPfopSqJM=";
-    flutter_local_authentication = "sha256-r50jr+81ho+7q2PWHLf4VnvNJmhiARZ3s4HUpThCgc0=";
-    flutter_secure_storage_linux = "sha256-x45jrJ7pvVyhZlpqRSy3CbwT4Lna6yi/b2IyAilWckg=";
-    sqflite = "sha256-+XTVtkFJ94VifwnutvUuAqqiyWwrcEiZ3Uz0H4D9zWA=";
-  };
-
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
diff --git a/pkgs/by-name/en/ente-auth/pubspec.lock.json b/pkgs/by-name/en/ente-auth/pubspec.lock.json
index dfbe0b416411..e04e4f9a1544 100644
--- a/pkgs/by-name/en/ente-auth/pubspec.lock.json
+++ b/pkgs/by-name/en/ente-auth/pubspec.lock.json
@@ -481,7 +481,7 @@
       "description": {
         "path": ".",
         "ref": "HEAD",
-        "resolved-ref": "e2e66ffd03f23bef5e0bb138b5f01b32d8e9b7bb",
+        "resolved-ref": "f91e1545f8263df127762240c4da54a0c42835b2",
         "url": "https://github.com/ente-io/ente_crypto_dart.git"
       },
       "source": "git",
@@ -1623,16 +1623,6 @@
       "source": "hosted",
       "version": "4.1.0"
     },
-    "scan": {
-      "dependency": "direct main",
-      "description": {
-        "name": "scan",
-        "sha256": "b343ec36f863a88d41eb4c174b810c055c6bd1f1822b2188ab31aab684fb7cdb",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.6.0"
-    },
     "screen_retriever": {
       "dependency": "transitive",
       "description": {
diff --git a/pkgs/by-name/en/ente-auth/update.sh b/pkgs/by-name/en/ente-auth/update.sh
index 7f79ffae58f4..ed5d30529b60 100755
--- a/pkgs/by-name/en/ente-auth/update.sh
+++ b/pkgs/by-name/en/ente-auth/update.sh
@@ -19,16 +19,23 @@ echo "Updating to $short_version"
 # Subtree needed for lockfile and icons
 auth_tree="$(gh-curl "https://api.github.com/repos/ente-io/ente/git/trees/$version" | gojq '.tree[] | select(.path == "auth") | .url' --raw-output)"
 
+pushd "$pkg_dir"
+
 # Get lockfile, filter out incompatible sqlite dependency and convert to JSON
 echo "Updating lockfile"
 pubspec_lock="$(gh-curl "$auth_tree" | gojq '.tree[] | select(.path == "pubspec.lock") | .url' --raw-output)"
-gh-curl "$pubspec_lock" | gojq '.content | @base64d' --raw-output | gojq --yaml-input 'del(.packages.sqlite3_flutter_libs)' > "$pkg_dir/pubspec.lock.json"
+gh-curl "$pubspec_lock" | gojq '.content | @base64d' --raw-output | gojq --yaml-input 'del(.packages.sqlite3_flutter_libs)' > pubspec.lock.json
+
+echo "Updating git hashes"
+./fetch-git-hashes.py
 
 # Get rev and hash of simple-icons submodule
 echo "Updating icons"
 assets_tree="$(gh-curl "$auth_tree" | gojq '.tree[] | select(.path == "assets") | .url' --raw-output)"
 simple_icons_rev="$(gh-curl "$assets_tree" | gojq '.tree[] | select(.path == "simple-icons") | .sha' --raw-output)"
-nix-prefetch-github --rev "$simple_icons_rev" simple-icons simple-icons > "$pkg_dir/simple-icons.json"
+nix-prefetch-github --rev "$simple_icons_rev" simple-icons simple-icons > simple-icons.json
+
+popd
 
 # Update package version and hash
 echo "Updating package source"
diff --git a/pkgs/by-name/fl/flye/package.nix b/pkgs/by-name/fl/flye/package.nix
index 443c66488e23..1f7bde7a2aa5 100644
--- a/pkgs/by-name/fl/flye/package.nix
+++ b/pkgs/by-name/fl/flye/package.nix
@@ -8,6 +8,7 @@
   libdeflate,
   bash,
   coreutils,
+  addBinToPathHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -54,11 +55,10 @@ python3Packages.buildPythonApplication rec {
 
   pythonImportsCheck = [ "flye" ];
 
-  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
-
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
+  nativeCheckInputs = [
+    addBinToPathHook
+    python3Packages.pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "De novo assembler for single molecule sequencing reads using repeat graphs";
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 49a542ed132d..e378de515de1 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -117,7 +117,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.4";
+  version = "2.0.5";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -135,7 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-0+2B8/ZuniZCeP1LMzLcJsvE3RzlHuw0jd6rlkoW6zY=";
+    hash = "sha256-V07alPn2+bOkKx+oh8qoX4Ie6/5ujO6h/TDzvL3UhvQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gallia/package.nix b/pkgs/by-name/ga/gallia/package.nix
index 0878b750a958..7268e0475165 100644
--- a/pkgs/by-name/ga/gallia/package.nix
+++ b/pkgs/by-name/ga/gallia/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   python3,
   cacert,
+  addBinToPathHook,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -43,17 +44,18 @@ python3.pkgs.buildPythonApplication rec {
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
-    pytest-asyncio
-  ];
+  nativeCheckInputs =
+    with python3.pkgs;
+    [
+      pytestCheckHook
+      pytest-asyncio
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   pythonImportsCheck = [ "gallia" ];
 
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
   meta = with lib; {
     description = "Extendable Pentesting Framework for the Automotive Domain";
     homepage = "https://github.com/Fraunhofer-AISEC/gallia";
diff --git a/pkgs/by-name/gd/gdtoolkit_3/package.nix b/pkgs/by-name/gd/gdtoolkit_3/package.nix
index a25eddbcac1b..8469a1a647d7 100644
--- a/pkgs/by-name/gd/gdtoolkit_3/package.nix
+++ b/pkgs/by-name/gd/gdtoolkit_3/package.nix
@@ -2,6 +2,8 @@
   lib,
   python3,
   fetchFromGitHub,
+  addBinToPathHook,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -31,7 +33,7 @@ python.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Scony";
     repo = "godot-gdscript-toolkit";
-    rev = version;
+    tag = version;
     hash = "sha256-cMGD5Xdf9ElS1NT7Q0NPB//EvUO0MI0VTtps5JRisZ4=";
   };
 
@@ -46,18 +48,16 @@ python.pkgs.buildPythonApplication rec {
 
   doCheck = true;
 
-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-    hypothesis
-  ];
-
-  preCheck = ''
-    # The tests want to run the installed executables
-    export PATH=$out/bin:$PATH
-
-    # gdtoolkit tries to write cache variables to $HOME/.cache
-    export HOME=$TMP
-  '';
+  nativeCheckInputs =
+    with python.pkgs;
+    [
+      pytestCheckHook
+      hypothesis
+    ]
+    ++ [
+      addBinToPathHook
+      writableTmpDirAsHomeHook
+    ];
 
   # The tests are not working on NixOS
   disabledTests = [
diff --git a/pkgs/by-name/gd/gdtoolkit_4/package.nix b/pkgs/by-name/gd/gdtoolkit_4/package.nix
index 301f9013409e..3c51104343c8 100644
--- a/pkgs/by-name/gd/gdtoolkit_4/package.nix
+++ b/pkgs/by-name/gd/gdtoolkit_4/package.nix
@@ -2,6 +2,8 @@
   lib,
   python3,
   fetchFromGitHub,
+  addBinToPathHook,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -30,7 +32,7 @@ python.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Scony";
     repo = "godot-gdscript-toolkit";
-    rev = version;
+    tag = version;
     hash = "sha256-XK6s/WnbTzjCAtV8dbRPLe5olpKUglPLQdttRRMvX70=";
   };
 
@@ -45,18 +47,16 @@ python.pkgs.buildPythonApplication rec {
 
   doCheck = true;
 
-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-    hypothesis
-  ];
-
-  preCheck = ''
-    # The tests want to run the installed executables
-    export PATH=$out/bin:$PATH
-
-    # gdtoolkit tries to write cache variables to $HOME/.cache
-    export HOME=$TMP
-  '';
+  nativeCheckInputs =
+    with python.pkgs;
+    [
+      pytestCheckHook
+      hypothesis
+    ]
+    ++ [
+      addBinToPathHook
+      writableTmpDirAsHomeHook
+    ];
 
   # The tests are not working on NixOS
   disabledTestPaths = [
diff --git a/pkgs/by-name/ge/gemmi/package.nix b/pkgs/by-name/ge/gemmi/package.nix
index 4082147ec513..17e4cebd94eb 100644
--- a/pkgs/by-name/ge/gemmi/package.nix
+++ b/pkgs/by-name/ge/gemmi/package.nix
@@ -5,6 +5,7 @@
   cmake,
   zlib,
   enablePython ? true,
+  addBinToPathHook,
   python3Packages,
   testers,
 }:
@@ -44,15 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = enablePython;
 
-  nativeInstallCheckInputs = with python3Packages; [
-    # biopython
-    numpy
-    pytestCheckHook
-  ];
-
-  preInstallCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
+  nativeInstallCheckInputs =
+    with python3Packages;
+    [
+      # biopython
+      numpy
+      pytestCheckHook
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   pytestFlagsArray = [ "../tests" ];
 
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 08b29fe93903..559fdd8166a3 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "17.8.0";
+  version = "17.8.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-Ofmhyz4sCcho+tVhAD/X+3BtsrUoysvxHpxwc52Abwc=";
+      hash = "sha256-ahYvfA1PvB/OP3swTABH++pZubejsb3Cohy+Z5fcAo4=";
     };
 
     vendorHash = "sha256-rR3dsKUoIVDj0NviN8p8g3mSAW8PTNChBacqd23yDf8=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 7e83d179ecd3..cd7a28d1b957 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.8.0";
+  version = "17.8.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-jQwHVSedAtBL5A0Y6OTtpRonSG1k69wdZO011S0D8/E=";
+    hash = "sha256-h+8sgBWYBClrfIsvnD1cUMRE9cxOtfjrGpss2tYdzDg=";
   };
 
   vendorHash = "sha256-2UtdooVoyoWr4yOPCRBAjkftn29DhJonpJSguHwfHNE=";
diff --git a/pkgs/by-name/go/go-ethereum/package.nix b/pkgs/by-name/go/go-ethereum/package.nix
index bd9a740f73d4..abff2184e684 100644
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -72,8 +72,8 @@ buildGoModule rec {
     homepage = "https://geth.ethereum.org/";
     description = "Official golang implementation of the Ethereum protocol";
     license = with licenses; [
-      lgpl3Plus
-      gpl3Plus
+      lgpl3Only
+      gpl3Only
     ];
     maintainers = with maintainers; [ RaghavSood ];
     mainProgram = "geth";
diff --git a/pkgs/by-name/le/lean4/package.nix b/pkgs/by-name/le/lean4/package.nix
index 5feafb9d2969..23a1e9033ec3 100644
--- a/pkgs/by-name/le/lean4/package.nix
+++ b/pkgs/by-name/le/lean4/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Xzuk41voBP93vsl3u/bBii9Y6DMfvi6UazKiLLABgHA=";
+    hash = "sha256-RdFTxLk0Yahwhu/oQeTappvWnUtnim63dxN7gmU8Jt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ma/mangojuice/package.nix b/pkgs/by-name/ma/mangojuice/package.nix
index 5643fb8effca..5822ac2ceeb2 100644
--- a/pkgs/by-name/ma/mangojuice/package.nix
+++ b/pkgs/by-name/ma/mangojuice/package.nix
@@ -22,13 +22,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangojuice";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "radiolamp";
     repo = "mangojuice";
     tag = finalAttrs.version;
-    hash = "sha256-LSwn6PIAGX1FIofnmoM2eqnhZBa3gkhlOBUJtdR9gWE=";
+    hash = "sha256-nMLymCOkml5LIvZgvp1NNHyG06KVlmQBMU+N4A4/Xus=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/mubeng/package.nix b/pkgs/by-name/mu/mubeng/package.nix
index 833a47cdafee..4a3f8e010157 100644
--- a/pkgs/by-name/mu/mubeng/package.nix
+++ b/pkgs/by-name/mu/mubeng/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "mubeng";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = "mubeng";
     tag = "v${version}";
-    hash = "sha256-LApviKG6sgIYtosU0xW4lkBH0iB7MGB4bfG9fPI16iQ=";
+    hash = "sha256-YK3a975l/gMCaWxTB4gEQWAzzX+GRnYSvKksPmp3ZRA=";
   };
 
-  vendorHash = "sha256-Uvxkvj5hodVQ0j05HZdSKammGWy9DxEIBT0VnCW8QuI=";
+  vendorHash = "sha256-qv8gAq7EohMNbwTfLeNhucKAzkYKzRbTpkoG5jTgKI0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mu/multiqc/package.nix b/pkgs/by-name/mu/multiqc/package.nix
index be3f8ad6ea86..6d49ccda1d43 100644
--- a/pkgs/by-name/mu/multiqc/package.nix
+++ b/pkgs/by-name/mu/multiqc/package.nix
@@ -5,6 +5,7 @@
   procps,
   stdenv,
   versionCheckHook,
+  addBinToPathHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -77,19 +78,23 @@ python3Packages.buildPythonApplication rec {
   preCheck = ''
     chmod -R u+w ../test-data
     ln -s ../test-data .
-    export PATH=$out/bin:$PATH
   '';
 
   # Some tests run subprocess.run() with "ps"
-  nativeCheckInputs = with python3Packages; [
-    procps
-    pytest-cov
-    pytest-xdist
-    pytestCheckHook
-    syrupy
-    pygithub
-    versionCheckHook
-  ];
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      procps
+      pytest-cov
+      pytest-xdist
+      pytestCheckHook
+      syrupy
+      pygithub
+      versionCheckHook
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   versionCheckProgramArg = [ "--version" ];
 
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index b8f1af9891cb..dd9cc91fd33f 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.3.1";
+  version = "4.4.2";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-KTz6Tip6kz8AcRW73+MUHUvwr/QT9Z2CvHQNyFXD054=";
+    hash = "sha256-95vqUViXUdLLnpsX81bwS1/EAiJA4XzOCIEd43E4wIQ=";
   };
 
   vendorHash = "sha256-cTRyQu3lXrIrBHtEYYQIdv0F705KrgyXgDS8meHVRJw=";
diff --git a/pkgs/by-name/ne/nexusmods-app/deps.json b/pkgs/by-name/ne/nexusmods-app/deps.json
index b83c979c76d3..d0f50a18e4fe 100644
--- a/pkgs/by-name/ne/nexusmods-app/deps.json
+++ b/pkgs/by-name/ne/nexusmods-app/deps.json
@@ -779,11 +779,21 @@
     "version": "2.5.2",
     "hash": "sha256-idb2hvuDlxl83x0yttGHnTgEQmwLLdUT7QfMeGDXVJE="
   },
+  {
+    "pname": "Jamarino.IntervalTree",
+    "version": "1.2.2",
+    "hash": "sha256-L8vFWl+1OUviHB+TOkw7Po0+IBLnJMZ1fnvqcYQOuRQ="
+  },
   {
     "pname": "JetBrains.Annotations",
     "version": "2024.3.0",
     "hash": "sha256-BQYhE7JDJ9Bw588KyWzOvQFvQTiRa0K9maVkI9lZgBc="
   },
+  {
+    "pname": "Jitbit.FastCache",
+    "version": "1.1.0",
+    "hash": "sha256-UJjNHEyBsi+XRkTF/D5EIIhVMchybD9INtXthXo49bg="
+  },
   {
     "pname": "K4os.Compression.LZ4",
     "version": "1.3.7-beta",
@@ -799,6 +809,11 @@
     "version": "0.3.1",
     "hash": "sha256-Yyt1uShHigHVCIjPT8jL2Kth9L9yq1MGrCM5w2+tj9o="
   },
+  {
+    "pname": "LinuxDesktopUtils.XDGDesktopPortal",
+    "version": "1.0.0",
+    "hash": "sha256-DTxWI/DI01Flb4yfSxukaEw6roSzD9iy4Twy1I8/5Mg="
+  },
   {
     "pname": "LiveChartsCore",
     "version": "2.0.0-rc2",
@@ -894,6 +909,11 @@
     "version": "7.0.0",
     "hash": "sha256-1e031E26iraIqun84ad0fCIR4MJZ1hcQo4yFN+B7UfE="
   },
+  {
+    "pname": "Microsoft.Bcl.AsyncInterfaces",
+    "version": "8.0.0",
+    "hash": "sha256-9aWmiwMJKrKr9ohD1KSuol37y+jdDxPGJct3m2/Bknw="
+  },
   {
     "pname": "Microsoft.Build.Tasks.Git",
     "version": "8.0.0",
@@ -1606,18 +1626,18 @@
   },
   {
     "pname": "NexusMods.MnemonicDB",
-    "version": "0.9.97",
-    "hash": "sha256-b0k/hM6UYvMTZN2QMk53QN9Fw/pomXJ88k9QqfrAF+s="
+    "version": "0.9.98",
+    "hash": "sha256-1B1PBH/iUuLOPsUo5WAsSAkDGWQBTlY8sk/sAiugpB0="
   },
   {
     "pname": "NexusMods.MnemonicDB.Abstractions",
-    "version": "0.9.97",
-    "hash": "sha256-EnWQMeXMKwziMoBXKf7t+Ru6EHZBml4Pt3h1eSP1Ud0="
+    "version": "0.9.98",
+    "hash": "sha256-rZ9UP6BcxYPlHKqyGj0G5q+woEjvpRS/jg69UY4aWDE="
   },
   {
     "pname": "NexusMods.MnemonicDB.SourceGenerator",
-    "version": "0.9.97",
-    "hash": "sha256-KOZVhS3H/qY6bRW9HmSF1Ud4fXv5oEWORDdYET9Ochw="
+    "version": "0.9.98",
+    "hash": "sha256-jP07gJZQ9ZT9DXyWIQOlgmZx0onqiUe3w2JiN55NA94="
   },
   {
     "pname": "NexusMods.Paths",
@@ -1639,6 +1659,11 @@
     "version": "0.15.0",
     "hash": "sha256-xUZIAND1Ob0SRuoTTuJqw7N2j/4ncIlck3lgfeWxd5M="
   },
+  {
+    "pname": "NLog",
+    "version": "5.2.8",
+    "hash": "sha256-IrCChiy703DRIebN//M4wwXW7gayuCVD/dHKXCoQcPw="
+  },
   {
     "pname": "NLog",
     "version": "5.3.4",
@@ -2164,6 +2189,11 @@
     "version": "2.88.9",
     "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
   },
+  {
+    "pname": "SmartFormat",
+    "version": "3.5.1",
+    "hash": "sha256-NwvJBCT2BBfJgGa/LMbvan0XqZhRBYzlpMLtC3l5SOM="
+  },
   {
     "pname": "Spectre.Console",
     "version": "0.49.1",
@@ -3079,6 +3109,11 @@
     "version": "1.0.64",
     "hash": "sha256-ykBZOyvaX1/iFmZjue754qJG4jfPx38ZdHevEZvh7w8="
   },
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.18.0",
+    "hash": "sha256-u5bRK7XbxU/NdMu8PZqxb3fmRdPTbimQ/YIe5/scPOo="
+  },
   {
     "pname": "Tmds.DBus.Protocol",
     "version": "0.20.0",
diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 30eba95da65e..8278059128b8 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -25,12 +25,12 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname;
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchgit {
     url = "https://github.com/Nexus-Mods/NexusMods.App.git";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-Kss1K1ZqXLZ/WbbyY3ZQRe8Kvmjdu3tRGfcagE7Q42Q=";
+    hash = "sha256-p3MTxuLR/mkVrL+hwW2R13/eVHWWulZPRh9OsuHq9kU=";
     fetchSubmodules = true;
     fetchLFS = true;
   };
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 88c029ef65a7..59b38088fe9c 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.7.3";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-kCvNUvU3fR3v/uRPl3y9HlNXMartNb23kfj1YYY2BWg=";
+    hash = "sha256-2YXecurdmlho5LvkkMc97GiyrSy/kTZINTPtC+J+eL0=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
diff --git a/pkgs/by-name/no/novelwriter/package.nix b/pkgs/by-name/no/novelwriter/package.nix
index dd0773161216..5cac7a547273 100644
--- a/pkgs/by-name/no/novelwriter/package.nix
+++ b/pkgs/by-name/no/novelwriter/package.nix
@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 let
-  version = "2.6";
+  version = "2.6.1";
 in
 python3.pkgs.buildPythonApplication {
   pname = "novelwriter";
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
     owner = "vkbo";
     repo = "novelWriter";
     rev = "v${version}";
-    hash = "sha256-eQ0az+4SEpf07rlCHGvK8Fp8ECimpTblWNlxwANNisE=";
+    hash = "sha256-z2iDRTWiqdjEpqCn4pNthNFl/zGGoVLU/XsRJaQ3Ys4=";
   };
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
diff --git a/pkgs/by-name/op/openmpi/package.nix b/pkgs/by-name/op/openmpi/package.nix
index 719247b58a43..9baf7dd3b6c8 100644
--- a/pkgs/by-name/op/openmpi/package.nix
+++ b/pkgs/by-name/op/openmpi/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   removeReferencesTo,
   gfortran,
   perl,
@@ -47,6 +48,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-vUGD/LxDR3wlR5m0Kd8abldsBC50otL4s31Tey/5gVc=";
   };
 
+  patches = [
+    # This patch can be removed with the next openmpi update (>5.0.6)
+    # See https://github.com/open-mpi/ompi/issues/12784 and https://github.com/open-mpi/ompi/pull/13003
+    # Fixes issue where the shared memory backing file cannot be created because directory trees are never created
+    (fetchpatch {
+      name = "fix-singletons-session-dir";
+      url = "https://github.com/open-mpi/ompi/commit/4d4f7212decd0d0ca719688b15dc9b3ee7553a52.patch";
+      hash = "sha256-Mb8qXtAUhAQ90v0SdL24BoTASsKRq2Gu8nYqoeSc9DI=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs ./
 
diff --git a/pkgs/by-name/pa/parquet-tools/package.nix b/pkgs/by-name/pa/parquet-tools/package.nix
index df25bfd14705..92771bad07f5 100644
--- a/pkgs/by-name/pa/parquet-tools/package.nix
+++ b/pkgs/by-name/pa/parquet-tools/package.nix
@@ -2,11 +2,10 @@
   lib,
   fetchFromGitHub,
   python3Packages,
+  addBinToPathHook,
 }:
 
-with python3Packages;
-
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "parquet-tools";
   version = "0.2.16";
 
@@ -27,7 +26,7 @@ buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace tests/test_inspect.py \
-      --replace "parquet-cpp-arrow version 5.0.0" "parquet-cpp-arrow version ${pyarrow.version}" \
+      --replace "parquet-cpp-arrow version 5.0.0" "parquet-cpp-arrow version ${python3Packages.pyarrow.version}" \
       --replace "serialized_size: 2222" "serialized_size: 2221" \
       --replace "format_version: 1.0" "format_version: 2.6"
   '';
@@ -38,11 +37,11 @@ buildPythonApplication rec {
     "thrift"
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     boto3
     colorama
     halo
@@ -52,16 +51,16 @@ buildPythonApplication rec {
     thrift
   ];
 
-  # TestGetMetaData.test_inspect shells out to `parquet-tools` CLI entrypoint
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
-  nativeCheckInputs = [
-    moto
-    pytest-mock
-    pytestCheckHook
-  ];
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      moto
+      pytest-mock
+      pytestCheckHook
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   disabledTests = [
     # test file is 2 bytes bigger than expected
diff --git a/pkgs/by-name/pd/pdal/package.nix b/pkgs/by-name/pd/pdal/package.nix
index d72dead10d60..eec8a789ed9e 100644
--- a/pkgs/by-name/pd/pdal/package.nix
+++ b/pkgs/by-name/pd/pdal/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdal";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "PDAL";
     repo = "PDAL";
     rev = finalAttrs.version;
-    hash = "sha256-i4Kk9T9MwMGshyGtHrSDhnzqeeThRCKXsjpW3rIDVVc=";
+    hash = "sha256-52v7oDmvq820mJ91XAZI1rQEwssWcHagcd2QNVV6zPA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/pifpaf/package.nix b/pkgs/by-name/pi/pifpaf/package.nix
index 18bdd1d2fa73..232a6bde2871 100644
--- a/pkgs/by-name/pi/pifpaf/package.nix
+++ b/pkgs/by-name/pi/pifpaf/package.nix
@@ -1,10 +1,11 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchPypi,
+  addBinToPathHook,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pifpaf";
   version = "3.2.3";
   format = "setuptools";
@@ -14,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-L039ZAFnYLCU52h1SczJU0T7+1gufxQlVzQr1EPCqc8=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     click
     daiquiri
     fixtures
@@ -24,14 +25,15 @@ python3.pkgs.buildPythonApplication rec {
     xattr
   ];
 
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
-  nativeCheckInputs = with python3.pkgs; [
-    requests
-    testtools
-  ];
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      requests
+      testtools
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   pythonImportsCheck = [ "pifpaf" ];
 
diff --git a/pkgs/by-name/pr/precice/package.nix b/pkgs/by-name/pr/precice/package.nix
index 2f5572a2eab7..c79c90475fe7 100644
--- a/pkgs/by-name/pr/precice/package.nix
+++ b/pkgs/by-name/pr/precice/package.nix
@@ -2,8 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
-  gcc,
   boost,
   eigen,
   libxml2,
@@ -24,26 +24,28 @@ stdenv.mkDerivation rec {
     hash = "sha256-KpmcQj8cv5V5OXCMhe2KLTsqUzKWtTeQyP+zg+Y+yd0=";
   };
 
-  cmakeFlags = [
-    "-DPRECICE_PETScMapping=OFF"
-    "-DBUILD_SHARED_LIBS=ON"
-    "-DPYTHON_LIBRARIES=${python3.libPrefix}"
-    "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
+  patches = lib.optionals (!lib.versionOlder "3.1.2" version) [
+    (fetchpatch {
+      name = "boost-187-fixes.patch";
+      url = "https://github.com/precice/precice/commit/23788e9eeac49a2069e129a0cb1ac846e8cbeb9f.patch";
+      hash = "sha256-Z8qOGOkXoCui8Wy0H/OeE+NaTDvyRuPm2A+VJKtjH4s=";
+    })
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.hostPlatform.isDarwin [ "-D_GNU_SOURCE" ]
-    # libxml2-2.12 changed const qualifiers
-    ++ [ "-fpermissive" ]
-  );
+  cmakeFlags = [
+    (lib.cmakeBool "PRECICE_PETScMapping" false)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+    (lib.cmakeFeature "PYTHON_LIBRARIES" python3.libPrefix)
+    (lib.cmakeFeature "PYTHON_INCLUDE_DIR" "${python3}/include/${python3.libPrefix}")
+  ];
 
   nativeBuildInputs = [
     cmake
-    gcc
     pkg-config
     python3
     python3.pkgs.numpy
   ];
+
   buildInputs = [
     boost
     eigen
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
index 3dec004d870d..cb8eeb120561 100644
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "prowler";
-  version = "5.1.5";
+  version = "5.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "prowler-cloud";
     repo = "prowler";
     tag = version;
-    hash = "sha256-yVoVfJGO+96ck8T63O0ubeTtdhpfziZFHYVXGFNENds=";
+    hash = "sha256-gEkD3lMOLpi2NeZBN4V2RJ/aqcuSLSQFSFYFSyDgizc=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
index c2a1e7c32ee6..ec79ecd73169 100644
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -9,7 +9,7 @@
   rainfrog,
 }:
 let
-  version = "0.2.11";
+  version = "0.2.13";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -19,11 +19,11 @@ rustPlatform.buildRustPackage {
     owner = "achristmascarl";
     repo = "rainfrog";
     tag = "v${version}";
-    hash = "sha256-gtiwkgNyqq+KMATkzaLOjPB6jcjVAM2qq6zwZ1WGkPE=";
+    hash = "sha256-CNxaCA7xrAkSCiVao+s5jAp3fheRCYK+/3Yekr1xUKk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7LhCNlbO9MTz2SxxQozdyvxG1uBum9oXaUjXXFS0USs=";
+  cargoHash = "sha256-Tl4T5EJGzrPal6ufgbtBwe6wfqI7SC5KbPZslCHe0Qs=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks;
diff --git a/pkgs/by-name/sa/sad/package.nix b/pkgs/by-name/sa/sad/package.nix
index c2f59c6c469a..07917e201eba 100644
--- a/pkgs/by-name/sa/sad/package.nix
+++ b/pkgs/by-name/sa/sad/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sad";
-  version = "0.4.31";
+  version = "0.4.32";
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "sad";
     tag = "v${version}";
-    hash = "sha256-frsOfv98VdetlwgNA6O0KEhcCSY9tQeEwkl2am226ko=";
+    hash = "sha256-c5TYIVUrfKrVuyolVe7+EhiM/SOFNahz8X6F8WrKEa0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ea/jimyghG7bqe9iRhYL13RQ4gwp9Ke3IjpSI8dTyr8=";
+  cargoHash = "sha256-hS66/bPRUpwmW/wSpZCq4kVKFkIhttsozIr3SCyZqQI=";
 
   nativeBuildInputs = [ python3 ];
 
diff --git a/pkgs/by-name/sh/shellhub-agent/package.nix b/pkgs/by-name/sh/shellhub-agent/package.nix
index 5ac4dac1fc48..84f152c06e07 100644
--- a/pkgs/by-name/sh/shellhub-agent/package.nix
+++ b/pkgs/by-name/sh/shellhub-agent/package.nix
@@ -12,18 +12,18 @@
 
 buildGoModule rec {
   pname = "shellhub-agent";
-  version = "0.17.2";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    hash = "sha256-zMAAimFrOMcBVKuFwl/UpJLEWJHrjH7DNno5KCEvGrM=";
+    hash = "sha256-BIcdloW0ab/hNvgUtjL7Xdz2MNFqKmi+umcUjM5gTR8=";
   };
 
   modRoot = "./agent";
 
-  vendorHash = "sha256-jQNWuOwaAx//wDUVOrMc+ETWWbTCTp/SLwL2guERJB8=";
+  vendorHash = "sha256-L+oww1HlPWgAYK16OG5bWiDb/OW7uarY8LZyw9b85ac=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sq/sqlite_orm/package.nix b/pkgs/by-name/sq/sqlite_orm/package.nix
index 2d2ce1dd9024..2c5151d9f7f5 100644
--- a/pkgs/by-name/sq/sqlite_orm/package.nix
+++ b/pkgs/by-name/sq/sqlite_orm/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlite_orm";
-  version = "1.9";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fnc12";
     repo = "sqlite_orm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jgRCYOtCyXj2E5J3iYBffX2AyBwvhune+i4Pb2eCBrA=";
+    hash = "sha256-tlmUYHH0V4qsKSTdrg/OrS9eOEseIDAIU/HN8YK36go=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taskserver/package.nix b/pkgs/by-name/ta/taskserver/package.nix
index 48a71b304180..7d424cc874c0 100644
--- a/pkgs/by-name/ta/taskserver/package.nix
+++ b/pkgs/by-name/ta/taskserver/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   passthru.tests = { inherit (nixosTests) taskserver; };
 
   meta = {
-    description = "Server for synchronising Taskwarrior clients";
+    description = "Server for synchronising Taskwarrior 2 clients";
     homepage = "https://taskwarrior.org";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index efa31c0d2b81..43309734f1ac 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -7,12 +7,12 @@
 
 buildGo123Module rec {
   pname = "traefik";
-  version = "3.3.2";
+  version = "3.3.3";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-7qS+rOBYDyYI8t0rVNmM0sJjGSdtIVelaIJuW1jaL+g=";
+    hash = "sha256-R9fiCLqzrd9SS6LoQt3jOoEchRnPuhmJqIob8JhzqEU=";
     stripRoot = false;
   };
 
@@ -44,7 +44,10 @@ buildGo123Module rec {
     description = "Modern reverse proxy";
     changelog = "https://github.com/traefik/traefik/raw/v${version}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ vdemeester ];
+    maintainers = with maintainers; [
+      djds
+      vdemeester
+    ];
     mainProgram = "traefik";
   };
 }
diff --git a/pkgs/by-name/tt/tts/package.nix b/pkgs/by-name/tt/tts/package.nix
index 26ad68675736..f4ce01fe7cdc 100644
--- a/pkgs/by-name/tt/tts/package.nix
+++ b/pkgs/by-name/tt/tts/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   espeak-ng,
   tts,
+  addBinToPathHook,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -111,18 +113,20 @@ python.pkgs.buildPythonApplication rec {
     doCheck = true;
   });
 
-  nativeCheckInputs = with python.pkgs; [
-    espeak-ng
-    pytestCheckHook
-  ];
+  nativeCheckInputs =
+    with python.pkgs;
+    [
+      espeak-ng
+      pytestCheckHook
+    ]
+    ++ [
+      addBinToPathHook
+      writableTmpDirAsHomeHook
+    ];
 
   preCheck = ''
     # use the installed TTS in $PYTHONPATH instead of the one from source to also have cython modules.
     mv TTS{,.old}
-    export PATH=$out/bin:$PATH
-
-    # numba tries to write to HOME directory
-    export HOME=$TMPDIR
 
     for file in $(grep -rl 'python TTS/bin' tests); do
       substituteInPlace "$file" \
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index ca2069e898c7..d097bc8629ea 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.5.26";
+  version = "0.5.27";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = version;
-    hash = "sha256-Rp6DexvMbUdE7i8hik4MC2sW/VFmpxJFfF7ukc49VlE=";
+    hash = "sha256-UqwXLAo99ZtvNNIfd5eO+IfdL2fksf0LTrRU2G1/j/8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MZKrkxy7bXQ3lTrPwCRT8nAR8fP+SeZmBEMQrXlvkYo=";
+  cargoHash = "sha256-TS823jBGtHNUZzeRJpir6G8F8Cgq7fuxw6pPk8RrE3o=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index b7439e413c9a..aac22888bc86 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20241221105938";
+    version = "20250124154827";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-k42qnHQY9bfSjyGGtaqKdIxlvU/C7TiN8sD0AiRQmVU=";
+      hash = "sha256-E69X6ktgZvW3xrZl+jmQMoPwRQlqU+0RW2epJHyFgeQ=";
     };
     vendorHash = "sha256-NLh14rXRci4hgDkBJVJDIDvobndB7KYRKAX7UjyqSsg=";
     meta = with lib; {
diff --git a/pkgs/by-name/vr/vrcx/package.nix b/pkgs/by-name/vr/vrcx/package.nix
index b55772ddc7f9..e7c618d6b28b 100644
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@@ -6,10 +6,11 @@
 }:
 let
   pname = "vrcx";
-  version = "2025-01-27T00.10-0ee8137";
+  version = "2025.01.31";
+  filename = builtins.replaceStrings [ "." ] [ "" ] version;
   src = fetchurl {
-    url = "https://github.com/Natsumi-sama/VRCX/releases/download/${version}/VRCX_${version}.AppImage";
-    hash = "sha256-kaQOME3jBLr7QJjc7rubNqFu3z+LmiP+UHe2EWYC7ek=";
+    hash = "sha256-hrAsy/yv8GW0mIDA5PJLUs4EYNufPiOplLlmb9pFwX4=";
+    url = "https://github.com/vrcx-team/VRCX/releases/download/v${version}/VRCX_${filename}.AppImage";
   };
   appimageContents = appimageTools.extract {
     inherit pname src version;
@@ -19,12 +20,13 @@ appimageTools.wrapType2 rec {
   inherit pname version src;
   extraPkgs = pkgs: [ dotnet-runtime ];
   extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/vrcx.desktop $out/share/applications/vrcx.desktop
+    install -m 444 -D ${appimageContents}/vrcx.desktop \
+      $out/share/applications/vrcx.desktop
     install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/256x256/apps/vrcx.png \
       $out/share/icons/hicolor/256x256/apps/vrcx.png
+
     substituteInPlace $out/share/applications/vrcx.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=${pname}'
-    # Fix icon path
     substituteInPlace $out/share/applications/vrcx.desktop \
       --replace-fail 'Icon=VRCX' "Icon=$out/share/icons/hicolor/256x256/apps/vrcx.png"
   '';
diff --git a/pkgs/by-name/wa/waytrogen/package.nix b/pkgs/by-name/wa/waytrogen/package.nix
index 036633da5da2..9d364711b59f 100644
--- a/pkgs/by-name/wa/waytrogen/package.nix
+++ b/pkgs/by-name/wa/waytrogen/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "waytrogen";
-  version = "0.6.3";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "nikolaizombie1";
     repo = "waytrogen";
     tag = version;
-    hash = "sha256-jkrvtwkzlsQgbw8/N4uzeqQ3fVSur2oa21IOXRRgh9I=";
+    hash = "sha256-JlqRlB/iMeFp229bF4u7M+Z9m9zlizHgqbfmszNwd9k=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iCcYlBqXo76QLuzdd1/YbLL99eCOnniHDAOllX8XyXQ=";
+  cargoHash = "sha256-S4DPvQ2unFt13eLFS91z7TyfFz7uwMMIgsEQ/JPe0e8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xo/xonsh/unwrapped.nix b/pkgs/by-name/xo/xonsh/unwrapped.nix
index 93544f928fd6..3992262d873c 100644
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -2,10 +2,12 @@
   lib,
   coreutils,
   fetchFromGitHub,
-  git,
+  gitMinimal,
   glibcLocales,
   nix-update-script,
   pythonPackages,
+  addBinToPathHook,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -19,7 +21,7 @@ let
     src = fetchFromGitHub {
       owner = "xonsh";
       repo = "xonsh";
-      rev = "refs/tags/${argset.version}";
+      tag = argset.version;
       hash = "sha256-20egNKlJjJO1wdy1anApz0ADBnaHPUSqhfrsPe3QQIs=";
     };
 
@@ -39,8 +41,10 @@ let
 
     nativeCheckInputs =
       [
-        git
+        addBinToPathHook
+        gitMinimal
         glibcLocales
+        writableTmpDirAsHomeHook
       ]
       ++ (with pythonPackages; [
         pip
@@ -77,6 +81,9 @@ let
 
       # https://github.com/xonsh/xonsh/issues/5569
       "test_spec_decorator_alias_output_format"
+
+      # Broken test
+      "test_repath_backslash"
     ];
 
     disabledTestPaths = [
@@ -103,11 +110,6 @@ let
       patchShebangs .
     '';
 
-    preCheck = ''
-      export HOME=$TMPDIR
-      export PATH=$out/bin:$PATH
-    '';
-
     passthru = {
       shellPath = "/bin/xonsh";
       python = pythonPackages.python; # To the wrapper
diff --git a/pkgs/by-name/zx/zxpy/package.nix b/pkgs/by-name/zx/zxpy/package.nix
index 070c0d22ca25..f107171d1185 100644
--- a/pkgs/by-name/zx/zxpy/package.nix
+++ b/pkgs/by-name/zx/zxpy/package.nix
@@ -1,10 +1,12 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   deterministic-uname,
+  addBinToPathHook,
 }:
-python3.pkgs.buildPythonApplication rec {
+
+python3Packages.buildPythonApplication rec {
   pname = "zxpy";
   version = "1.6.4";
   pyproject = true;
@@ -16,18 +18,19 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-/VITHN517lPUmhLYgJHBYYvvlJdGg2Hhnwk47Mp9uc0=";
   };
 
-  build-system = [
-    python3.pkgs.setuptools
+  build-system = with python3Packages; [
+    setuptools
   ];
 
-  nativeCheckInputs = [
-    deterministic-uname
-    python3.pkgs.pytestCheckHook
-  ];
-
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      deterministic-uname
+      pytestCheckHook
+    ]
+    ++ [
+      addBinToPathHook
+    ];
 
   pythonImportsCheck = [ "zx" ];
 
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index a01cc726f223..fdc2f1f7b7ed 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -33,11 +33,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "4.2.3";
+  version = "4.3.0";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-egGRgMUdFzitnF2NRSMU3mXoKO4kC8stH4DemmW+iKg=";
+    hash = "sha256-XgQTKYStg8q5zFP3YHLSte9abSSwqf+QR6j/lhIbzGM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index d392915f05f8..bbdd6bf08cfc 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -11,12 +11,32 @@
   pycparser,
 }:
 
+let
+  version = "1.17.1";
+in
 if isPyPy then
-  null
+  buildPythonPackage {
+    pname = "cffi";
+    inherit version;
+    pyproject = false;
+
+    # cffi is bundled with PyPy.
+    dontUnpack = true;
+
+    # Some dependent packages expect to have pycparser available when using cffi.
+    dependencies = [ pycparser ];
+
+    meta = {
+      description = "Foreign Function Interface for Python calling C code (bundled with PyPy, placeholder package)";
+      homepage = "https://cffi.readthedocs.org/";
+      license = lib.licenses.mit;
+      maintainers = lib.teams.python.members;
+    };
+  }
 else
   buildPythonPackage rec {
     pname = "cffi";
-    version = "1.17.1";
+    inherit version;
     pyproject = true;
 
     src = fetchPypi {
diff --git a/pkgs/development/python-modules/eliot/default.nix b/pkgs/development/python-modules/eliot/default.nix
index 5f9be70540aa..d8d5a1d9bb87 100644
--- a/pkgs/development/python-modules/eliot/default.nix
+++ b/pkgs/development/python-modules/eliot/default.nix
@@ -14,6 +14,7 @@
   zope-interface,
 
   daemontools,
+  addBinToPathHook,
   dask,
   distributed,
   hypothesis,
@@ -47,6 +48,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    addBinToPathHook
     dask
     distributed
     hypothesis
@@ -60,11 +62,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "eliot" ];
 
-  # Tests run eliot-prettyprint in out/bin.
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
   disabledTests = [
     # Fails since dask's bump to 2024.12.2
     # Reported upstream: https://github.com/itamarst/eliot/issues/507
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index 7c438e960d4d..a7ba7a675988 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -6,6 +6,7 @@
   numpy,
   pydantic,
   jsonschema,
+  opencv-python-headless,
   sentencepiece,
   typing-extensions,
   tiktoken,
@@ -37,6 +38,7 @@ buildPythonPackage rec {
     numpy
     pydantic
     jsonschema
+    opencv-python-headless
     sentencepiece
     typing-extensions
     tiktoken
diff --git a/pkgs/development/python-modules/pyprecice/default.nix b/pkgs/development/python-modules/pyprecice/default.nix
index c005eaaa23d3..48bf841129f8 100644
--- a/pkgs/development/python-modules/pyprecice/default.nix
+++ b/pkgs/development/python-modules/pyprecice/default.nix
@@ -1,15 +1,18 @@
 {
   lib,
   buildPythonPackage,
-  setuptools,
-  pip,
-  cython,
   fetchFromGitHub,
+
+  # build-system
+  cython,
+  pip,
+  pkgconfig,
+  setuptools,
+
+  # dependencies
   mpi4py,
   numpy,
   precice,
-  pkgconfig,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -17,8 +20,6 @@ buildPythonPackage rec {
   version = "3.1.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "precice";
     repo = "python-bindings";
@@ -26,14 +27,24 @@ buildPythonPackage rec {
     hash = "sha256-/atuMJVgvY4kgvrB+LuQZmJuSK4O8TJdguC7NCiRS2Y=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    pip
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=61,<72" "setuptools" \
+      --replace-fail "numpy<2" "numpy"
+  '';
+
+  build-system = [
     cython
+    pip
     pkgconfig
+    setuptools
   ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "numpy"
+  ];
+
+  dependencies = [
     numpy
     mpi4py
     precice
@@ -44,10 +55,11 @@ buildPythonPackage rec {
 
   # Do not use pythonImportsCheck because this will also initialize mpi which requires a network interface
 
-  meta = with lib; {
+  meta = {
     description = "Python language bindings for preCICE";
     homepage = "https://github.com/precice/python-bindings";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ Scriptkiddi ];
+    changelog = "https://github.com/precice/python-bindings/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ Scriptkiddi ];
   };
 }
diff --git a/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch b/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch
deleted file mode 100644
index edaebfce508c..000000000000
--- a/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From f6a7748bee79fc2e1898968fef844daacfa7860b Mon Sep 17 00:00:00 2001
-From: SomeoneSerge <else@someonex.net>
-Date: Wed, 31 Jul 2024 12:02:53 +0000
-Subject: [PATCH 1/2] setup.py: don't ask for hipcc --version
-
----
- setup.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/setup.py b/setup.py
-index 72ef26f1..01e006f9 100644
---- a/setup.py
-+++ b/setup.py
-@@ -279,6 +279,7 @@ def _install_punica() -> bool:
- 
- 
- def get_hipcc_rocm_version():
-+    return "0.0" # `hipcc --version` misbehaves ("unresolved paths") inside the nix sandbox
-     # Run the hipcc --version command
-     result = subprocess.run(['hipcc', '--version'],
-                             stdout=subprocess.PIPE,
--- 
-2.45.1
-
diff --git a/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
new file mode 100644
index 000000000000..9edf6021f5d4
--- /dev/null
+++ b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
@@ -0,0 +1,12 @@
+diff --git a/vllm/model_executor/models/registry.py b/vllm/model_executor/models/registry.py
+index f5a02a5b..e830f987 100644
+--- a/vllm/model_executor/models/registry.py
++++ b/vllm/model_executor/models/registry.py
+@@ -482,6 +482,7 @@ def _run_in_subprocess(fn: Callable[[], _T]) -> _T:
+         returned = subprocess.run(
+             [sys.executable, "-m", "vllm.model_executor.models.registry"],
+             input=input_bytes,
++            env={'PYTHONPATH': ':'.join(sys.path)},
+             capture_output=True)
+ 
+         # check if the subprocess is successful
diff --git a/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch b/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
new file mode 100644
index 000000000000..3c80f8e24e65
--- /dev/null
+++ b/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
@@ -0,0 +1,18 @@
+--- a/setup.py
++++ b/setup.py
+@@ -340,14 +340,7 @@ def _is_hpu() -> bool:
+         out = subprocess.run(["hl-smi"], capture_output=True, check=True)
+         is_hpu_available = out.returncode == 0
+     except (FileNotFoundError, PermissionError, subprocess.CalledProcessError):
+-        if sys.platform.startswith("linux"):
+-            try:
+-                output = subprocess.check_output(
+-                    'lsmod | grep habanalabs | wc -l', shell=True)
+-                is_hpu_available = int(output) > 0
+-            except (ValueError, FileNotFoundError, PermissionError,
+-                    subprocess.CalledProcessError):
+-                pass
++        is_hpu_available = False
+     return is_hpu_available
+ 
+ 
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 6b363451cef1..9643cfdd9560 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -5,14 +5,21 @@
   buildPythonPackage,
   pythonRelaxDepsHook,
   fetchFromGitHub,
+  symlinkJoin,
+  autoAddDriverRunpath,
+
+  # build system
+  packaging,
+  setuptools,
+  wheel,
+
+  # dependencies
   which,
   ninja,
   cmake,
-  packaging,
-  setuptools,
+  setuptools-scm,
   torch,
   outlines,
-  wheel,
   psutil,
   ray,
   pandas,
@@ -21,43 +28,174 @@
   numpy,
   transformers,
   xformers,
+  xgrammar,
   fastapi,
   uvicorn,
   pydantic,
   aioprometheus,
+  pynvml,
   openai,
   pyzmq,
   tiktoken,
+  torchaudio,
   torchvision,
   py-cpuinfo,
   lm-format-enforcer,
   prometheus-fastapi-instrumentator,
   cupy,
-  writeShellScript,
+  gguf,
+  einops,
+  importlib-metadata,
+  partial-json-parser,
+  compressed-tensors,
+  mistral-common,
+  msgspec,
+  numactl,
+  tokenizers,
+  oneDNN,
+  blake3,
+  depyf,
+  opencv-python-headless,
 
   config,
 
   cudaSupport ? config.cudaSupport,
   cudaPackages ? { },
-
-  # Has to be either rocm or cuda, default to the free one
-  rocmSupport ? !config.cudaSupport,
+  rocmSupport ? config.rocmSupport,
   rocmPackages ? { },
   gpuTargets ? [ ],
 }@args:
 
 let
+  inherit (lib)
+    lists
+    strings
+    trivial
+    ;
+
+  inherit (cudaPackages) cudaFlags;
+
+  shouldUsePkg =
+    pkg: if pkg != null && lib.meta.availableOn stdenv.hostPlatform pkg then pkg else null;
+
+  # see CMakeLists.txt, grepping for GIT_TAG near cutlass
+  # https://github.com/vllm-project/vllm/blob/${version}/CMakeLists.txt
   cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    rev = "refs/tags/v3.5.0";
-    sha256 = "sha256-D/s7eYsa5l/mfx73tE4mnFcTQdYqGmXa9d9TCryw4e4=";
+    tag = "v3.7.0";
+    hash = "sha256-GUTRXmv3DiM/GN5Bvv2LYovMLKZMlMhoKv4O0g627gs=";
   };
+
+  vllm-flash-attn = stdenv.mkDerivation rec {
+    pname = "vllm-flash-attn";
+    version = "2.6.2";
+
+    # see CMakeLists.txt, grepping for GIT_TAG near vllm-flash-attn
+    # https://github.com/vllm-project/vllm/blob/${version}/CMakeLists.txt
+    src = fetchFromGitHub {
+      owner = "vllm-project";
+      repo = "flash-attention";
+      rev = "d4e09037abf588af1ec47d0e966b237ee376876c";
+      hash = "sha256-KFEsZlrwvCgvPzQ/pCLWcnbGq89mWE3yTDdtJSV9MII=";
+    };
+
+    dontConfigure = true;
+
+    # vllm-flash-attn normally relies on `git submodule update` to fetch cutlass
+    buildPhase = ''
+      rm -rf csrc/cutlass
+      ln -sf ${cutlass} csrc/cutlass
+    '';
+
+    installPhase = ''
+      cp -rva . $out
+    '';
+  };
+
+  cpuSupport = !cudaSupport && !rocmSupport;
+
+  # https://github.com/pytorch/pytorch/blob/v2.4.0/torch/utils/cpp_extension.py#L1953
+  supportedTorchCudaCapabilities =
+    let
+      real = [
+        "3.5"
+        "3.7"
+        "5.0"
+        "5.2"
+        "5.3"
+        "6.0"
+        "6.1"
+        "6.2"
+        "7.0"
+        "7.2"
+        "7.5"
+        "8.0"
+        "8.6"
+        "8.7"
+        "8.9"
+        "9.0"
+        "9.0a"
+      ];
+      ptx = lists.map (x: "${x}+PTX") real;
+    in
+    real ++ ptx;
+
+  # NOTE: The lists.subtractLists function is perhaps a bit unintuitive. It subtracts the elements
+  #   of the first list *from* the second list. That means:
+  #   lists.subtractLists a b = b - a
+
+  # For CUDA
+  supportedCudaCapabilities = lists.intersectLists cudaFlags.cudaCapabilities supportedTorchCudaCapabilities;
+  unsupportedCudaCapabilities = lists.subtractLists supportedCudaCapabilities cudaFlags.cudaCapabilities;
+
+  isCudaJetson = cudaSupport && cudaPackages.cudaFlags.isJetsonBuild;
+
+  # Use trivial.warnIf to print a warning if any unsupported GPU targets are specified.
+  gpuArchWarner =
+    supported: unsupported:
+    trivial.throwIf (supported == [ ]) (
+      "No supported GPU targets specified. Requested GPU targets: "
+      + strings.concatStringsSep ", " unsupported
+    ) supported;
+
+  # Create the gpuTargetString.
+  gpuTargetString = strings.concatStringsSep ";" (
+    if gpuTargets != [ ] then
+      # If gpuTargets is specified, it always takes priority.
+      gpuTargets
+    else if cudaSupport then
+      gpuArchWarner supportedCudaCapabilities unsupportedCudaCapabilities
+    else if rocmSupport then
+      rocmPackages.clr.gpuTargets
+    else
+      throw "No GPU targets specified"
+  );
+
+  mergedCudaLibraries = with cudaPackages; [
+    cuda_cudart # cuda_runtime.h, -lcudart
+    cuda_cccl
+    libcusparse # cusparse.h
+    libcusolver # cusolverDn.h
+    cuda_nvtx
+    cuda_nvrtc
+    libcublas
+  ];
+
+  # Some packages are not available on all platforms
+  nccl = shouldUsePkg (cudaPackages.nccl or null);
+
+  getAllOutputs = p: [
+    (lib.getBin p)
+    (lib.getLib p)
+    (lib.getDev p)
+  ];
+
 in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.6.2";
+  version = "0.7.1";
   pyproject = true;
 
   stdenv = if cudaSupport then cudaPackages.backendStdenv else args.stdenv;
@@ -65,30 +203,54 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-zUkqAPPhDRdN9rDQ2biCl1B+trV0xIHXub++v9zsQGo=";
+    tag = "v${version}";
+    hash = "sha256-CImXKMEv+jHqngvcr8W6fQLiCo1mqmcZ0Ho0bfAgfbg=";
   };
 
   patches = [
-    ./0001-setup.py-don-t-ask-for-hipcc-version.patch
     ./0002-setup.py-nix-support-respect-cmakeFlags.patch
+    ./0003-propagate-pythonpath.patch
+    ./0004-drop-lsmod.patch
   ];
 
   # Ignore the python version check because it hard-codes minor versions and
   # lags behind `ray`'s python interpreter support
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'set(PYTHON_SUPPORTED_VERSIONS' \
-        'set(PYTHON_SUPPORTED_VERSIONS "${lib.versions.majorMinor python.version}"'
-  '';
+  postPatch =
+    ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail \
+          'set(PYTHON_SUPPORTED_VERSIONS' \
+          'set(PYTHON_SUPPORTED_VERSIONS "${lib.versions.majorMinor python.version}"'
 
-  nativeBuildInputs = [
-    cmake
-    ninja
-    pythonRelaxDepsHook
-    which
-  ] ++ lib.optionals rocmSupport [ rocmPackages.hipcc ];
+      # Relax torch dependency manually because the nonstandard requirements format
+      # is not caught by pythonRelaxDeps
+      substituteInPlace requirements*.txt pyproject.toml \
+        --replace-warn 'torch==2.5.1' 'torch==${lib.getVersion torch}' \
+        --replace-warn 'torch == 2.5.1' 'torch == ${lib.getVersion torch}'
+    ''
+    + lib.optionalString (nccl == null) ''
+      # On platforms where NCCL is not supported (e.g. Jetson), substitute Gloo (provided by Torch)
+      substituteInPlace vllm/distributed/parallel_state.py \
+        --replace-fail '"nccl"' '"gloo"'
+    '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+      pythonRelaxDepsHook
+      which
+    ]
+    ++ lib.optionals rocmSupport [
+      rocmPackages.hipcc
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
+      autoAddDriverRunpath
+    ]
+    ++ lib.optionals isCudaJetson [
+      cudaPackages.autoAddCudaCompatRunpath
+    ];
 
   build-system = [
     packaging
@@ -97,18 +259,22 @@ buildPythonPackage rec {
   ];
 
   buildInputs =
-    (lib.optionals cudaSupport (
-      with cudaPackages;
-      [
-        cuda_cudart # cuda_runtime.h, -lcudart
-        cuda_cccl
-        libcusparse # cusparse.h
-        libcusolver # cusolverDn.h
-        cuda_nvcc
-        cuda_nvtx
-        libcublas
-      ]
-    ))
+    [
+      setuptools-scm
+      torch
+    ]
+    ++ (lib.optionals cpuSupport ([
+      numactl
+      oneDNN
+    ]))
+    ++ (
+      lib.optionals cudaSupport mergedCudaLibraries
+      ++ (with cudaPackages; [
+        nccl
+        cudnn
+        libcufile
+      ])
+    )
     ++ (lib.optionals rocmSupport (
       with rocmPackages;
       [
@@ -123,10 +289,13 @@ buildPythonPackage rec {
   dependencies =
     [
       aioprometheus
+      blake3
+      depyf
       fastapi
       lm-format-enforcer
       numpy
       openai
+      opencv-python-headless
       outlines
       pandas
       prometheus-fastapi-instrumentator
@@ -138,27 +307,64 @@ buildPythonPackage rec {
       ray
       sentencepiece
       tiktoken
+      tokenizers
+      msgspec
+      gguf
+      einops
+      importlib-metadata
+      partial-json-parser
+      compressed-tensors
+      mistral-common
       torch
+      torchaudio
       torchvision
       transformers
       uvicorn
       xformers
+      xgrammar
     ]
     ++ uvicorn.optional-dependencies.standard
     ++ aioprometheus.optional-dependencies.starlette
     ++ lib.optionals cudaSupport [
       cupy
+      pynvml
     ];
 
   dontUseCmakeConfigure = true;
-  cmakeFlags = [ (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CUTLASS" "${lib.getDev cutlass}") ];
+  cmakeFlags =
+    [
+      (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CUTLASS" "${lib.getDev cutlass}")
+      (lib.cmakeFeature "VLLM_FLASH_ATTN_SRC_DIR" "${lib.getDev vllm-flash-attn}")
+    ]
+    ++ lib.optionals cudaSupport [
+      (lib.cmakeFeature "TORCH_CUDA_ARCH_LIST" "${gpuTargetString}")
+      (lib.cmakeFeature "CUTLASS_NVCC_ARCHS_ENABLED" "${cudaPackages.cudaFlags.cmakeCudaArchitecturesString
+      }")
+      (lib.cmakeFeature "CUDA_TOOLKIT_ROOT_DIR" "${symlinkJoin {
+        name = "cuda-merged-${cudaPackages.cudaVersion}";
+        paths = builtins.concatMap getAllOutputs mergedCudaLibraries;
+      }}")
+      (lib.cmakeFeature "CAFFE2_USE_CUDNN" "ON")
+      (lib.cmakeFeature "CAFFE2_USE_CUFILE" "ON")
+      (lib.cmakeFeature "CUTLASS_ENABLE_CUBLAS" "ON")
+    ]
+    ++ lib.optionals cpuSupport [
+      (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ONEDNN" "${lib.getDev oneDNN}")
+    ];
 
   env =
-    lib.optionalAttrs cudaSupport { CUDA_HOME = "${lib.getDev cudaPackages.cuda_nvcc}"; }
+    lib.optionalAttrs cudaSupport {
+      VLLM_TARGET_DEVICE = "cuda";
+      CUDA_HOME = "${lib.getDev cudaPackages.cuda_nvcc}";
+    }
     // lib.optionalAttrs rocmSupport {
+      VLLM_TARGET_DEVICE = "rocm";
       # Otherwise it tries to enumerate host supported ROCM gfx archs, and that is not possible due to sandboxing.
       PYTORCH_ROCM_ARCH = lib.strings.concatStringsSep ";" rocmPackages.clr.gpuTargets;
       ROCM_HOME = "${rocmPackages.clr}";
+    }
+    // lib.optionalAttrs cpuSupport {
+      VLLM_TARGET_DEVICE = "cpu";
     };
 
   pythonRelaxDeps = true;
@@ -177,8 +383,8 @@ buildPythonPackage rec {
       happysalada
       lach
     ];
-    # RuntimeError: Unknown runtime environment
-    broken = true;
-    # broken = !cudaSupport && !rocmSupport;
+
+    # CPU support relies on unpackaged dependency `intel_extension_for_pytorch`
+    broken = cpuSupport;
   };
 }
diff --git a/pkgs/development/python-modules/xgrammar/default.nix b/pkgs/development/python-modules/xgrammar/default.nix
new file mode 100644
index 000000000000..a06f11da928c
--- /dev/null
+++ b/pkgs/development/python-modules/xgrammar/default.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  python,
+  pythonOlder,
+  pythonAtLeast,
+  pydantic,
+  sentencepiece,
+  tiktoken,
+  torch,
+  transformers,
+  triton,
+}:
+
+let
+  pyShortVersion = "cp" + builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
+  platforms = rec {
+    aarch64-darwin = "macosx_13_0_arm64";
+    x86_64-darwin = "macosx_10_15_x86_64";
+    x86_64-linux = "manylinux_2_27_x86_64.manylinux_2_28_x86_64";
+  };
+  platform = platforms.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  # hashes retrieved via the following command
+  # curl https://pypi.org/pypi/xgrammar/${version}/json | jq -r '.urls[] | "\(.digests.sha256)  \(.filename)"'
+  hashes = rec {
+    cp39-aarch64-darwin = "12dd579a7073c14981e01aeee566d20e60001bf90af23024e0e6692a770ff535";
+    cp39-x86_64-darwin = "035ec93306543b99bf2141dcc7f1a6dd0c255753fc8b5a2b5f3289a59fed8e37";
+    cp39-x86_64-linux = "3b3975dcf4b3ed7b16bbe3c068738b09847f841793e1c5e1b4a07dff36bbdc37";
+    cp310-aarch64-darwin = "93bb6c10cbdf1a2bda3b458d97b47436657d780f98dccf3d266e17e13568c0a9";
+    cp310-x86_64-darwin = "5ed31db2669dc499d9d29bb16f30b3395332ff9d0fb80b759697190a5ef5258b";
+    cp310-x86_64-linux = "9c6f571121e4af45e3b5dc55f3dadd751cffff1f85f1c6fc5c4276db2bbed222";
+    cp311-aarch64-darwin = "b293443725eddad31cf7b407bb24d5f3156c4b12a2c8041743cb7068a69fadcb";
+    cp311-x86_64-darwin = "b2106bceb2ce313628af915f2c2b1c9865612026dd3c9feddbfcc69e4ee6c971";
+    cp311-x86_64-linux = "7934c968371d55759cac35be3b218cdf4b13f323f535ea0faa233240bab803b9";
+    cp312-aarch64-darwin = "561f8d4307db8cf5d3c3b3ff46eda6d95379f6e801278dbf9153a9d5e8b6126c";
+    cp312-x86_64-darwin = "6ac3cbb0a82a3a9d07f0739f63b2e26cbef7855149d236057dcc7fee74b37970";
+    cp312-x86_64-linux = "1854d0fe6b908a3d2d42251a62e627224dbf6035a4322b844b1b5a277e3d0461";
+  };
+  hash =
+    hashes."${pyShortVersion}-${stdenv.system}"
+      or (throw "Unsupported Python version: ${python.pythonVersion}");
+in
+buildPythonPackage rec {
+  pname = "xgrammar";
+  version = "0.1.11";
+  format = "wheel";
+
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.13";
+
+  src = fetchPypi {
+    inherit pname version format;
+    dist = pyShortVersion;
+    python = pyShortVersion;
+    abi = pyShortVersion;
+    platform = platform;
+    sha256 = hash;
+  };
+
+  pythonImportCheck = [ "xgrammar" ];
+
+  dependencies = [
+    pydantic
+    sentencepiece
+    tiktoken
+    torch
+    transformers
+    triton
+  ];
+
+  meta = with lib; {
+    description = "Efficient, Flexible and Portable Structured Generation";
+    homepage = "https://xgrammar.mlc.ai";
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/os-specific/linux/tuxedo-drivers/default.nix b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
index 9c80d1dc7767..eef374b27cf1 100644
--- a/pkgs/os-specific/linux/tuxedo-drivers/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tuxedo-drivers-${kernel.version}";
-  version = "4.11.3";
+  version = "4.12.1";
 
   src = fetchFromGitLab {
     group = "tuxedocomputers";
     owner = "development/packages";
     repo = "tuxedo-drivers";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ylHREVzQY9U/YHmVYQ4qO+A8tUcWXOTspS4g9qn314o=";
+    hash = "sha256-ZsfPs8VvvgguyNLSVi6n5hs0OzNwiK3bkooQ267mKtA=";
   };
 
   buildInputs = [ pahole ];
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       blanky0230
       keksgesicht
       xaverdh
+      XBagon
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix b/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
index 8c000321857a..635045677c03 100644
--- a/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
+++ b/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.85.1";
+  version = "2.86.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     tag = "v${version}";
-    hash = "sha256-ix3GyY7xIcrdwzECO6kD7fjccf9OK6Ey+NsSWWcH9ns=";
+    hash = "sha256-IXwy6iRjrXVxpZiAYLMVmAgwm7Z8Ck/B0Mwi1UlRcSs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5c1ed45a7b9b..48aca03fb635 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10738,6 +10738,8 @@ with pkgs;
     openexr = openexr_3;
   };
 
+  vllm = with python3Packages; toPythonApplication vllm;
+
   vte-gtk4 = vte.override {
     gtkVersion = "4";
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 170d35c9050d..3b151907928e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18395,6 +18395,8 @@ self: super: with self; {
     inherit (pkgs) xgboost;
   };
 
+  xgrammar = callPackage ../development/python-modules/xgrammar { };
+
   xhtml2pdf = callPackage ../development/python-modules/xhtml2pdf { };
 
   xiaomi-ble = callPackage ../development/python-modules/xiaomi-ble { };