diff --git a/lib/customisation.nix b/lib/customisation.nix
index 99c02ddeea89..be6585d5fa6e 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -2,19 +2,41 @@
 
 let
   inherit (builtins)
-    intersectAttrs;
+    intersectAttrs
+    ;
   inherit (lib)
-    functionArgs isFunction mirrorFunctionArgs isAttrs setFunctionArgs
-    optionalAttrs attrNames filter elemAt concatStringsSep sortOn take length
-    filterAttrs optionalString flip pathIsDirectory head pipe isDerivation listToAttrs
-    mapAttrs seq flatten deepSeq warnIf isInOldestRelease extends
+    functionArgs
+    isFunction
+    mirrorFunctionArgs
+    isAttrs
+    setFunctionArgs
+    optionalAttrs
+    attrNames
+    filter
+    elemAt
+    concatStringsSep
+    sortOn
+    take
+    length
+    filterAttrs
+    optionalString
+    flip
+    pathIsDirectory
+    head
+    pipe
+    isDerivation
+    listToAttrs
+    mapAttrs
+    seq
+    flatten
+    deepSeq
+    extends
     ;
   inherit (lib.strings) levenshtein levenshteinAtMost;
 
 in
 rec {
 
-
   /**
     `overrideDerivation drv f` takes a derivation (i.e., the result
     of a call to the builtin function `derivation`) and returns a new
@@ -40,7 +62,6 @@ rec {
     You should in general prefer `drv.overrideAttrs` over this function;
     see the nixpkgs manual for more information on overriding.
 
-
     # Inputs
 
     `drv`
@@ -74,20 +95,21 @@ rec {
 
     :::
   */
-  overrideDerivation = drv: f:
+  overrideDerivation =
+    drv: f:
     let
       newDrv = derivation (drv.drvAttrs // (f drv));
-    in flip (extendDerivation (seq drv.drvPath true)) newDrv (
-      { meta = drv.meta or {};
-        passthru = if drv ? passthru then drv.passthru else {};
+    in
+    flip (extendDerivation (seq drv.drvPath true)) newDrv (
+      {
+        meta = drv.meta or { };
+        passthru = if drv ? passthru then drv.passthru else { };
       }
-      //
-      (drv.passthru or {})
-      //
-      optionalAttrs (drv ? __spliced) {
-        __spliced = {} // (mapAttrs (_: sDrv: overrideDerivation sDrv f) drv.__spliced);
-      });
-
+      // (drv.passthru or { })
+      // optionalAttrs (drv ? __spliced) {
+        __spliced = { } // (mapAttrs (_: sDrv: overrideDerivation sDrv f) drv.__spliced);
+      }
+    );
 
   /**
     `makeOverridable` takes a function from attribute set to attribute set and
@@ -97,7 +119,6 @@ rec {
     Please refer to  documentation on [`<pkg>.overrideDerivation`](#sec-pkg-overrideDerivation) to learn about `overrideDerivation` and caveats
     related to its use.
 
-
     # Inputs
 
     `f`
@@ -128,37 +149,42 @@ rec {
 
     :::
   */
-  makeOverridable = f:
+  makeOverridable =
+    f:
     let
       # Creates a functor with the same arguments as f
       mirrorArgs = mirrorFunctionArgs f;
     in
-    mirrorArgs (origArgs:
-    let
-      result = f origArgs;
+    mirrorArgs (
+      origArgs:
+      let
+        result = f origArgs;
 
-      # Changes the original arguments with (potentially a function that returns) a set of new attributes
-      overrideWith = newArgs: origArgs // (if isFunction newArgs then newArgs origArgs else newArgs);
+        # Changes the original arguments with (potentially a function that returns) a set of new attributes
+        overrideWith = newArgs: origArgs // (if isFunction newArgs then newArgs origArgs else newArgs);
 
-      # Re-call the function but with different arguments
-      overrideArgs = mirrorArgs (newArgs: makeOverridable f (overrideWith newArgs));
-      # Change the result of the function call by applying g to it
-      overrideResult = g: makeOverridable (mirrorArgs (args: g (f args))) origArgs;
-    in
+        # Re-call the function but with different arguments
+        overrideArgs = mirrorArgs (newArgs: makeOverridable f (overrideWith newArgs));
+        # Change the result of the function call by applying g to it
+        overrideResult = g: makeOverridable (mirrorArgs (args: g (f args))) origArgs;
+      in
       if isAttrs result then
-        result // {
+        result
+        // {
           override = overrideArgs;
           overrideDerivation = fdrv: overrideResult (x: overrideDerivation x fdrv);
-          ${if result ? overrideAttrs then "overrideAttrs" else null} = fdrv:
-            overrideResult (x: x.overrideAttrs fdrv);
+          ${if result ? overrideAttrs then "overrideAttrs" else null} =
+            fdrv: overrideResult (x: x.overrideAttrs fdrv);
         }
       else if isFunction result then
         # Transform the result into a functor while propagating its arguments
-        setFunctionArgs result (functionArgs result) // {
+        setFunctionArgs result (functionArgs result)
+        // {
           override = overrideArgs;
         }
-      else result);
-
+      else
+        result
+    );
 
   /**
     Call the package function in the file `fn` with the required
@@ -188,7 +214,6 @@ rec {
 
     <!-- TODO: Apply "Example:" tag to the examples above -->
 
-
     # Inputs
 
     `autoArgs`
@@ -209,7 +234,8 @@ rec {
     callPackageWith :: AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a
     ```
   */
-  callPackageWith = autoArgs: fn: args:
+  callPackageWith =
+    autoArgs: fn: args:
     let
       f = if isFunction fn then fn else import fn;
       fargs = functionArgs f;
@@ -222,59 +248,72 @@ rec {
       # wouldn't be passed to it
       missingArgs =
         # Filter out arguments that have a default value
-        (filterAttrs (name: value: ! value)
-        # Filter out arguments that would be passed
-        (removeAttrs fargs (attrNames allArgs)));
+        (
+          filterAttrs (name: value: !value)
+            # Filter out arguments that would be passed
+            (removeAttrs fargs (attrNames allArgs))
+        );
 
       # Get a list of suggested argument names for a given missing one
-      getSuggestions = arg: pipe (autoArgs // args) [
-        attrNames
-        # Only use ones that are at most 2 edits away. While mork would work,
-        # levenshteinAtMost is only fast for 2 or less.
-        (filter (levenshteinAtMost 2 arg))
-        # Put strings with shorter distance first
-        (sortOn (levenshtein arg))
-        # Only take the first couple results
-        (take 3)
-        # Quote all entries
-        (map (x: "\"" + x + "\""))
-      ];
+      getSuggestions =
+        arg:
+        pipe (autoArgs // args) [
+          attrNames
+          # Only use ones that are at most 2 edits away. While mork would work,
+          # levenshteinAtMost is only fast for 2 or less.
+          (filter (levenshteinAtMost 2 arg))
+          # Put strings with shorter distance first
+          (sortOn (levenshtein arg))
+          # Only take the first couple results
+          (take 3)
+          # Quote all entries
+          (map (x: "\"" + x + "\""))
+        ];
 
-      prettySuggestions = suggestions:
-        if suggestions == [] then ""
-        else if length suggestions == 1 then ", did you mean ${elemAt suggestions 0}?"
-        else ", did you mean ${concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
+      prettySuggestions =
+        suggestions:
+        if suggestions == [ ] then
+          ""
+        else if length suggestions == 1 then
+          ", did you mean ${elemAt suggestions 0}?"
+        else
+          ", did you mean ${concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
 
-      errorForArg = arg:
+      errorForArg =
+        arg:
         let
           loc = builtins.unsafeGetAttrPos arg fargs;
           # loc' can be removed once lib/minver.nix is >2.3.4, since that includes
           # https://github.com/NixOS/nix/pull/3468 which makes loc be non-null
-          loc' = if loc != null then loc.file + ":" + toString loc.line
-            else if ! isFunction fn then
+          loc' =
+            if loc != null then
+              loc.file + ":" + toString loc.line
+            else if !isFunction fn then
               toString fn + optionalString (pathIsDirectory fn) "/default.nix"
-            else "<unknown location>";
-        in "Function called without required argument \"${arg}\" at "
+            else
+              "<unknown location>";
+        in
+        "Function called without required argument \"${arg}\" at "
         + "${loc'}${prettySuggestions (getSuggestions arg)}";
 
       # Only show the error for the first missing argument
       error = errorForArg (head (attrNames missingArgs));
 
-    in if missingArgs == {}
-       then makeOverridable f allArgs
-       # This needs to be an abort so it can't be caught with `builtins.tryEval`,
-       # which is used by nix-env and ofborg to filter out packages that don't evaluate.
-       # This way we're forced to fix such errors in Nixpkgs,
-       # which is especially relevant with allowAliases = false
-       else abort "lib.customisation.callPackageWith: ${error}";
-
+    in
+    if missingArgs == { } then
+      makeOverridable f allArgs
+    # This needs to be an abort so it can't be caught with `builtins.tryEval`,
+    # which is used by nix-env and ofborg to filter out packages that don't evaluate.
+    # This way we're forced to fix such errors in Nixpkgs,
+    # which is especially relevant with allowAliases = false
+    else
+      abort "lib.customisation.callPackageWith: ${error}";
 
   /**
     Like callPackage, but for a function that returns an attribute
     set of derivations. The override function is added to the
     individual attributes.
 
-
     # Inputs
 
     `autoArgs`
@@ -295,7 +334,8 @@ rec {
     callPackagesWith :: AttrSet -> ((AttrSet -> AttrSet) | Path) -> AttrSet -> AttrSet
     ```
   */
-  callPackagesWith = autoArgs: fn: args:
+  callPackagesWith =
+    autoArgs: fn: args:
     let
       f = if isFunction fn then fn else import fn;
       auto = intersectAttrs (functionArgs f) autoArgs;
@@ -304,18 +344,19 @@ rec {
       pkgs = f origArgs;
       mkAttrOverridable = name: _: makeOverridable (mirrorArgs (newArgs: (f newArgs).${name})) origArgs;
     in
-      if isDerivation pkgs then throw
-        ("function `callPackages` was called on a *single* derivation "
-          + ''"${pkgs.name or "<unknown-name>"}";''
-          + " did you mean to use `callPackage` instead?")
-      else mapAttrs mkAttrOverridable pkgs;
-
+    if isDerivation pkgs then
+      throw (
+        "function `callPackages` was called on a *single* derivation "
+        + ''"${pkgs.name or "<unknown-name>"}";''
+        + " did you mean to use `callPackage` instead?"
+      )
+    else
+      mapAttrs mkAttrOverridable pkgs;
 
   /**
     Add attributes to each output of a derivation without changing
     the derivation itself and check a given condition when evaluating.
 
-
     # Inputs
 
     `condition`
@@ -336,34 +377,48 @@ rec {
     extendDerivation :: Bool -> Any -> Derivation -> Derivation
     ```
   */
-  extendDerivation = condition: passthru: drv:
+  extendDerivation =
+    condition: passthru: drv:
     let
       outputs = drv.outputs or [ "out" ];
 
-      commonAttrs = drv // (listToAttrs outputsList) //
-        ({ all = map (x: x.value) outputsList; }) // passthru;
+      commonAttrs =
+        drv // (listToAttrs outputsList) // ({ all = map (x: x.value) outputsList; }) // passthru;
 
-      outputToAttrListElement = outputName:
-        { name = outputName;
-          value = commonAttrs // {
+      outputToAttrListElement = outputName: {
+        name = outputName;
+        value =
+          commonAttrs
+          // {
             inherit (drv.${outputName}) type outputName;
             outputSpecified = true;
-            drvPath = assert condition; drv.${outputName}.drvPath;
-            outPath = assert condition; drv.${outputName}.outPath;
-          } //
+            drvPath =
+              assert condition;
+              drv.${outputName}.drvPath;
+            outPath =
+              assert condition;
+              drv.${outputName}.outPath;
+          }
+          //
             # TODO: give the derivation control over the outputs.
             #       `overrideAttrs` may not be the only attribute that needs
             #       updating when switching outputs.
-            optionalAttrs (passthru?overrideAttrs) {
+            optionalAttrs (passthru ? overrideAttrs) {
               # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
               overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
             };
-        };
+      };
 
       outputsList = map outputToAttrListElement outputs;
-    in commonAttrs // {
-      drvPath = assert condition; drv.drvPath;
-      outPath = assert condition; drv.outPath;
+    in
+    commonAttrs
+    // {
+      drvPath =
+        assert condition;
+        drv.drvPath;
+      outPath =
+        assert condition;
+        drv.outPath;
     };
 
   /**
@@ -372,7 +427,6 @@ rec {
     result to ensure that there are no thunks kept alive to prevent
     garbage collection.
 
-
     # Inputs
 
     `drv`
@@ -385,21 +439,29 @@ rec {
     hydraJob :: (Derivation | Null) -> (Derivation | Null)
     ```
   */
-  hydraJob = drv:
+  hydraJob =
+    drv:
     let
-      outputs = drv.outputs or ["out"];
+      outputs = drv.outputs or [ "out" ];
 
       commonAttrs =
-        { inherit (drv) name system meta; inherit outputs; }
+        {
+          inherit (drv) name system meta;
+          inherit outputs;
+        }
         // optionalAttrs (drv._hydraAggregate or false) {
           _hydraAggregate = true;
           constituents = map hydraJob (flatten drv.constituents);
         }
         // (listToAttrs outputsList);
 
-      makeOutput = outputName:
-        let output = drv.${outputName}; in
-        { name = outputName;
+      makeOutput =
+        outputName:
+        let
+          output = drv.${outputName};
+        in
+        {
+          name = outputName;
           value = commonAttrs // {
             outPath = output.outPath;
             drvPath = output.drvPath;
@@ -411,8 +473,8 @@ rec {
       outputsList = map makeOutput outputs;
 
       drv' = (head outputsList).value;
-    in if drv == null then null else
-      deepSeq drv' drv';
+    in
+    if drv == null then null else deepSeq drv' drv';
 
   /**
     Make an attribute set (a "scope") from functions that take arguments from that same attribute set.
@@ -538,19 +600,21 @@ rec {
     makeScope :: (AttrSet -> ((AttrSet -> a) | Path) -> AttrSet -> a) -> (AttrSet -> AttrSet) -> scope
     ```
   */
-  makeScope = newScope: f:
-    let self = f self // {
-          newScope = scope: newScope (self // scope);
-          callPackage = self.newScope {};
-          overrideScope = g: makeScope newScope (extends g f);
-          packages = f;
-        };
-    in self;
+  makeScope =
+    newScope: f:
+    let
+      self = f self // {
+        newScope = scope: newScope (self // scope);
+        callPackage = self.newScope { };
+        overrideScope = g: makeScope newScope (extends g f);
+        packages = f;
+      };
+    in
+    self;
 
   /**
     backward compatibility with old uncurried form; deprecated
 
-
     # Inputs
 
     `splicePackages`
@@ -579,9 +643,14 @@ rec {
   */
   makeScopeWithSplicing =
     splicePackages: newScope: otherSplices: keep: extra: f:
-    makeScopeWithSplicing'
-    { inherit splicePackages newScope; }
-    { inherit otherSplices keep extra f; };
+    makeScopeWithSplicing' { inherit splicePackages newScope; } {
+      inherit
+        otherSplices
+        keep
+        extra
+        f
+        ;
+    };
 
   /**
     Like makeScope, but aims to support cross compilation. It's still ugly, but
@@ -608,30 +677,32 @@ rec {
     ```
   */
   makeScopeWithSplicing' =
-    { splicePackages
-    , newScope
+    {
+      splicePackages,
+      newScope,
     }:
-    { otherSplices
-    # Attrs from `self` which won't be spliced.
-    # Avoid using keep, it's only used for a python hook workaround, added in PR #104201.
-    # ex: `keep = (self: { inherit (self) aAttr; })`
-    , keep ? (_self: {})
-    # Additional attrs to add to the sets `callPackage`.
-    # When the package is from a subset (but not a subset within a package IS #211340)
-    # within `spliced0` it will be spliced.
-    # When using an package outside the set but it's available from `pkgs`, use the package from `pkgs.__splicedPackages`.
-    # If the package is not available within the set or in `pkgs`, such as a package in a let binding, it will not be spliced
-    # ex:
-    # ```
-    # nix-repl> darwin.apple_sdk.frameworks.CoreFoundation
-    #   «derivation ...CoreFoundation-11.0.0.drv»
-    # nix-repl> darwin.CoreFoundation
-    #   error: attribute 'CoreFoundation' missing
-    # nix-repl> darwin.callPackage ({ CoreFoundation }: CoreFoundation) { }
-    #   «derivation ...CoreFoundation-11.0.0.drv»
-    # ```
-    , extra ? (_spliced0: {})
-    , f
+    {
+      otherSplices,
+      # Attrs from `self` which won't be spliced.
+      # Avoid using keep, it's only used for a python hook workaround, added in PR #104201.
+      # ex: `keep = (self: { inherit (self) aAttr; })`
+      keep ? (_self: { }),
+      # Additional attrs to add to the sets `callPackage`.
+      # When the package is from a subset (but not a subset within a package IS #211340)
+      # within `spliced0` it will be spliced.
+      # When using an package outside the set but it's available from `pkgs`, use the package from `pkgs.__splicedPackages`.
+      # If the package is not available within the set or in `pkgs`, such as a package in a let binding, it will not be spliced
+      # ex:
+      # ```
+      # nix-repl> darwin.apple_sdk.frameworks.CoreFoundation
+      #   «derivation ...CoreFoundation-11.0.0.drv»
+      # nix-repl> darwin.CoreFoundation
+      #   error: attribute 'CoreFoundation' missing
+      # nix-repl> darwin.callPackage ({ CoreFoundation }: CoreFoundation) { }
+      #   «derivation ...CoreFoundation-11.0.0.drv»
+      # ```
+      extra ? (_spliced0: { }),
+      f,
     }:
     let
       spliced0 = splicePackages {
@@ -648,13 +719,15 @@ rec {
         callPackage = newScope spliced; # == self.newScope {};
         # N.B. the other stages of the package set spliced in are *not*
         # overridden.
-        overrideScope = g: (makeScopeWithSplicing'
-          { inherit splicePackages newScope; }
-          { inherit otherSplices keep extra;
+        overrideScope =
+          g:
+          (makeScopeWithSplicing' { inherit splicePackages newScope; } {
+            inherit otherSplices keep extra;
             f = extends g f;
           });
         packages = f;
       };
-    in self;
+    in
+    self;
 
 }
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 4292662a9152..1a29e6ee104e 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -81,38 +81,42 @@ let
     fdSize2MB = true;
   };
   ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
-  ovmf = pkgs.linkFarm "incus-ovmf" [
-    # 2MB must remain the default or existing VMs will fail to boot. New VMs will prefer 4MB
-    {
-      name = "OVMF_CODE.fd";
-      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_VARS.fd";
-      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.ms.fd";
-      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
+  ovmf = pkgs.linkFarm "incus-ovmf" (
+    [
+      # 2MB must remain the default or existing VMs will fail to boot. New VMs will prefer 4MB
+      {
+        name = "OVMF_CODE.fd";
+        path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_CODE.fd";
+      }
+      {
+        name = "OVMF_VARS.fd";
+        path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+      }
+      {
+        name = "OVMF_VARS.ms.fd";
+        path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+      }
 
-    {
-      name = "OVMF_CODE.4MB.fd";
-      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.fd";
-      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.ms.fd";
-      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "seabios.bin";
-      path = "${pkgs.seabios-qemu}/share/seabios/bios.bin";
-    }
-  ];
+      {
+        name = "OVMF_CODE.4MB.fd";
+        path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
+      }
+      {
+        name = "OVMF_VARS.4MB.fd";
+        path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+      }
+      {
+        name = "OVMF_VARS.4MB.ms.fd";
+        path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+      }
+    ]
+    ++ lib.optionals pkgs.stdenv.hostPlatform.isx86_64 [
+      {
+        name = "seabios.bin";
+        path = "${pkgs.seabios-qemu}/share/seabios/bios.bin";
+      }
+    ]
+  );
 
   environment = lib.mkMerge [
     {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index de55c8294fb2..6c7d59cabbf0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2018,6 +2018,22 @@ let
         };
       };
 
+      geequlim.godot-tools = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "godot-tools";
+          publisher = "geequlim";
+          version = "2.3.0";
+          hash = "sha256-iuSec4PoVxyu1KB2jfCYOd98UrqQjH3q24zOR4VCPgs=";
+        };
+        meta = {
+          description = "VS Code extension for game development with Godot Engine and GDScript";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=geequlim.godot-tools";
+          homepage = "https://github.com/godotengine/godot-vscode-plugin";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ thtrf ];
+        };
+      };
+
       gencer.html-slim-scss-css-class-completion = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "html-slim-scss-css-class-completion";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 5c9ad9c8d5e7..f978311a44a9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -197,6 +197,15 @@
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
+  "btp": {
+    "hash": "sha256-71i7iRTAsSZnq72ew4cEcDGFbsRPKWvEJ7y6onN1V68=",
+    "homepage": "https://registry.terraform.io/providers/SAP/btp",
+    "owner": "SAP",
+    "repo": "terraform-provider-btp",
+    "rev": "v1.8.0",
+    "spdx": "Apache-2.0",
+    "vendorHash": "sha256-A6/YN/iFxdfGjYO8Pum5nWysGmEeLaxgFPe8zaoPfjA="
+  },
   "buildkite": {
     "hash": "sha256-ogwUk5zYE3tdJB8zylkPpzfnUgmAhFQ4K0Vj3Jl0aog=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index a61cd55edb7a..6912f03d0527 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.47.2";
+  version = "1.48.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     rev = "v${version}";
-    hash = "sha256-rEz39E6sid9nNV5lzXwLh/GHrz5aVl67+BKfooH3+Nk=";
+    hash = "sha256-F1ZmhVAjm8KVFePXLeOnyvh1TvjXBDCwUizwQSpp6L4=";
   };
 
-  vendorHash = "sha256-dSNmMc7iWtrItFuz341FpYWo5AyExgO7e7Fbib2gCS8=";
+  vendorHash = "sha256-M5q93hJjEsdMG4N+bjHTTUqBLgy2b7oIRmkizuGxeoE=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/by-name/df/dftd4/package.nix b/pkgs/by-name/df/dftd4/package.nix
index 57fa3723d3a6..ecfbda766454 100644
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@@ -18,13 +18,13 @@ assert !blas.isILP64 && !lapack.isILP64;
 
 stdenv.mkDerivation rec {
   pname = "dftd4";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "dftd4";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VIV9953hx0MZupOARdH+P1h7JtZeJmTlqtO8si+lwdU=";
+    hash = "sha256-dixPCLH5dWkE2/7ghGEXJmX2/g1DN30dB4jX2d7fmio=";
   };
 
   patches = [
diff --git a/pkgs/by-name/dn/dnsdbq/package.nix b/pkgs/by-name/dn/dnsdbq/package.nix
new file mode 100644
index 000000000000..fed65506ec3d
--- /dev/null
+++ b/pkgs/by-name/dn/dnsdbq/package.nix
@@ -0,0 +1,60 @@
+{
+  curl,
+  dnsdbq,
+  fetchFromGitHub,
+  jansson,
+  lib,
+  nix-update-script,
+  stdenv,
+  testers,
+}:
+stdenv.mkDerivation rec {
+  pname = "dnsdbq";
+  version = "2.6.7";
+
+  src = fetchFromGitHub {
+    owner = "dnsdb";
+    repo = "dnsdbq";
+    rev = "v${version}";
+    hash = "sha256-VeoLgDLly5bDIzvcf6Xb+tqCaQxIzeSpoW3ij+Hq4O8=";
+  };
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      version = testers.testVersion {
+        package = dnsdbq;
+        command = "dnsdbq -v";
+      };
+    };
+  };
+
+  nativeBuildInputs = [
+    curl # curl-config
+  ];
+
+  buildInputs = [
+    curl
+    jansson
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp dnsdbq $out/bin
+    mkdir -p $out/man/man1
+    cp dnsdbq.man $out/man/man1/dnsdbq.1
+    runHook postInstall
+  '';
+
+  extraOutputsToInstall = [ "man" ];
+
+  meta = {
+    description = "C99 program that accesses passive DNS database systems";
+    homepage = "https://github.com/dnsdb/dnsdbq";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ x123 ];
+    mainProgram = "dnsdbq";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/fc/fcgi/package.nix b/pkgs/by-name/fc/fcgi/package.nix
index 95ab22961ce4..9096aa413c93 100644
--- a/pkgs/by-name/fc/fcgi/package.nix
+++ b/pkgs/by-name/fc/fcgi/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fcgi";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "FastCGI-Archives";
     repo = "fcgi2";
     rev = finalAttrs.version;
-    hash = "sha256-4U/Mc2U7tK/fo4B9NBwYKzDuLApvSzWR4mqWzZ00H8o=";
+    hash = "sha256-P8wkiURBc5gV0PxwemkIIpTPOpug6YIZE//3j5U76K0=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/ff/fflogs/package.nix b/pkgs/by-name/ff/fflogs/package.nix
index 1fa42f43a3d9..ef6bb3d62e48 100644
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.14.49";
+  version = "8.15.4";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-pgI6xiTz1Gm5OMUnJsXD/B2eBm3MkPKIYQ6DgyVdwYo=";
+    hash = "sha256-/lpt4pZT7etNCmT1lg5Vfx0IP9pbaqBUppJlu8HN47E=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/jc/jcli/package.nix b/pkgs/by-name/jc/jcli/package.nix
index 6de7a5096d9a..e1fb1130b73f 100644
--- a/pkgs/by-name/jc/jcli/package.nix
+++ b/pkgs/by-name/jc/jcli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "jcli";
-  version = "0.0.42";
+  version = "0.0.44";
 
   src = fetchFromGitHub {
     owner = "jenkins-zh";
     repo = "jenkins-cli";
-    rev = "v${version}";
-    hash = "sha256-t9NE911TjAvoCsmf9F989DNQ+s9GhgUF7cwuyHefWts=";
+    tag = "v${version}";
+    hash = "sha256-lsYLUgjpHcURiMTA4we9g+a6dFimOupAYMw0TcmABk4=";
   };
 
-  vendorHash = "sha256-bmPnxFvdKU5zuMsCDboSOxP5f7NnMRwS/gN0sW7eTRA=";
+  vendorHash = "sha256-f2f/Qi6aav7LPpO9ERYkejygz0XiPQ8YrKLB63EpaoY=";
 
   ldflags = [
     "-s"
@@ -43,7 +43,7 @@ buildGoModule rec {
     description = "Jenkins CLI allows you to manage your Jenkins in an easy way";
     mainProgram = "jcli";
     homepage = "https://github.com/jenkins-zh/jenkins-cli";
-    changelog = "https://github.com/jenkins-zh/jenkins-cli/releases/tag/${src.rev}";
+    changelog = "https://github.com/jenkins-zh/jenkins-cli/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
   };
diff --git a/pkgs/by-name/po/polarity/Cargo.lock b/pkgs/by-name/po/polarity/Cargo.lock
index 43879de673ac..1061dc760357 100644
--- a/pkgs/by-name/po/polarity/Cargo.lock
+++ b/pkgs/by-name/po/polarity/Cargo.lock
@@ -355,6 +355,14 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
+[[package]]
+name = "backend"
+version = "0.1.0"
+dependencies = [
+ "ast",
+ "url",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.74"
@@ -752,6 +760,7 @@ name = "docs"
 version = "0.1.0"
 dependencies = [
  "askama",
+ "askama_escape",
  "ast",
  "driver",
  "opener",
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 99a5b49de1a6..282b4e85e5f6 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2024-12-09";
+  version = "latest-unstable-2024-12-20";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "4ac254214e0b8b1cc0a4782ecac751bc41e514a9";
-    hash = "sha256-vuC40ez45KrB+F4La2SG9XRAhFCaFJQnlRc4kY4Ky0o=";
+    rev = "e679bff1d40b2d145fdc5206c74e59321a70efd2";
+    hash = "sha256-KiwK9rBYfOtsEiUF+e62L/j1Yc4KloRLXbXZ+5axiEM=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/sd/sd-switch/package.nix b/pkgs/by-name/sd/sd-switch/package.nix
index 2a142f4ad298..623d138c11c6 100644
--- a/pkgs/by-name/sd/sd-switch/package.nix
+++ b/pkgs/by-name/sd/sd-switch/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.5.2";
+  version = "0.5.3";
 in
 rustPlatform.buildRustPackage {
   pname = "sd-switch";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "~rycee";
     repo = "sd-switch";
     rev = version;
-    hash = "sha256-vxDb5NkzmcWL6ECueultg6NoYMObW/54UuMLJe+AjVs=";
+    hash = "sha256-9aIu37mmf4ZnmZZrU0GA6z+bHKwtfkA5KnLRLY0c2r8=";
   };
 
-  cargoHash = "sha256-Oh4thw4NOjYjdLJWHG4wH7VDYjD89apl4S2JFM14WWw=";
+  cargoHash = "sha256-3XolxgnTIySucopogAzgf13IUCguJE6W17q506tUF6U=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/st/steamguard-cli/package.nix b/pkgs/by-name/st/steamguard-cli/package.nix
index 9e8dd22612d3..d8da7cca9fb8 100644
--- a/pkgs/by-name/st/steamguard-cli/package.nix
+++ b/pkgs/by-name/st/steamguard-cli/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "steamguard-cli";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "dyc3";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SrMg/4bTAvk+2fLck8SJBMQ3bELu1OBB7pDZmk+rCbA=";
+    hash = "sha256-Cxl6FczWr5kAYt+q1m3HLEKCBeQz3TcW/aaOxsBcuwc=";
   };
 
-  cargoHash = "sha256-MSN0xQj6IfOjI0qQqVBaGhh0BQJa4z24El2rGLlFBSM=";
+  cargoHash = "sha256-YKlTEKk2pbwLIFZjK/sBIIYwu0DYarVeJsIB9FSR9XM=";
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index 6f80ac7be89d..fda72fbfcd02 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.2.26";
-      hash = "sha256-vlfDR9RRyQW8tDNoMqhk2ZKN0OIJibhycF/qC6ZHbGs=";
+      version = "8.2.27";
+      hash = "sha256-blfbr3aafz3rTw9IuMU15nHMChgCLtf2/yO1DpQdS2A=";
     }
   );
 in
diff --git a/pkgs/development/interpreters/php/8.4.nix b/pkgs/development/interpreters/php/8.4.nix
index 13c3b101f5aa..f51c712eecfe 100644
--- a/pkgs/development/interpreters/php/8.4.nix
+++ b/pkgs/development/interpreters/php/8.4.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.4.1";
-      hash = "sha256-74onARjtEot2X8MfGYx/RlDIFxQRsPajoaOroR/KzCM=";
+      version = "8.4.2";
+      hash = "sha256-70/pkhuIXOOwR3kqtgJg6vZX4igSvlEdGdDkXt+YR4M=";
     }
   );
 in
diff --git a/pkgs/development/libraries/science/chemistry/tblite/python.nix b/pkgs/development/libraries/science/chemistry/tblite/python.nix
index b0cd26e4c1a7..09f921cc4ae7 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/python.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/python.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonAtLeast,
   meson,
   ninja,
   pkg-config,
@@ -28,18 +27,15 @@ buildPythonPackage {
     meta
     ;
 
-  nativeBuildInputs =
-    [
-      tblite
-      meson
-      ninja
-      pkg-config
-      gfortran
-      mctc-lib
-    ]
-    ++ lib.optionals (pythonAtLeast "3.12") [
-      setuptools
-    ];
+  nativeBuildInputs = [
+    tblite
+    meson
+    ninja
+    pkg-config
+    gfortran
+    mctc-lib
+    setuptools
+  ];
 
   buildInputs = [
     tblite
diff --git a/pkgs/development/python-modules/azure-mgmt-reservations/default.nix b/pkgs/development/python-modules/azure-mgmt-reservations/default.nix
index d382ded7d810..d88fccddc20c 100644
--- a/pkgs/development/python-modules/azure-mgmt-reservations/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-reservations/default.nix
@@ -2,19 +2,18 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   msrest,
-  msrestazure,
   azure-common,
   azure-mgmt-core,
+  typing-extensions,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-reservations";
   version = "2.3.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -22,20 +21,21 @@ buildPythonPackage rec {
     hash = "sha256-BHCFEFst5jfyIEo0hm86belpxW7EygZCBJ8PTqzqHKc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     msrest
-    msrestazure
     azure-common
     azure-mgmt-core
-  ];
+  ] ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
 
   # has no tests
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "This is the Microsoft Azure Reservations Client Library";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
-    license = licenses.mit;
-    maintainers = with maintainers; [ maxwilson ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ maxwilson ];
   };
 }
diff --git a/pkgs/development/python-modules/craft-platforms/default.nix b/pkgs/development/python-modules/craft-platforms/default.nix
index 8b5e5cc5b0f9..90b568600487 100644
--- a/pkgs/development/python-modules/craft-platforms/default.nix
+++ b/pkgs/development/python-modules/craft-platforms/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "craft-platforms";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-platforms";
     rev = "refs/tags/${version}";
-    hash = "sha256-MzHjnOvsloT1Vf5NjI5jyFBvCo3v5ovvpWuwOJ/O/0A=";
+    hash = "sha256-P7GC+t/rs49/a85Bxy6x4cRyCEaHG4b7SIb85sMj7Yk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hcs-utils/default.nix b/pkgs/development/python-modules/hcs-utils/default.nix
index 0a424e7424bd..203f98503f62 100644
--- a/pkgs/development/python-modules/hcs-utils/default.nix
+++ b/pkgs/development/python-modules/hcs-utils/default.nix
@@ -6,7 +6,8 @@
   pythonOlder,
   setuptools,
   six,
-  versioneer,
+  poetry-core,
+  fetchFromGitLab,
 }:
 
 buildPythonPackage rec {
@@ -16,33 +17,32 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    pname = "hcs_utils";
-    inherit version;
-    hash = "sha256-a2xO+hdyJQjgIEcjtmDZLicyz2kzKRjtpEhge5yaa7M=";
+  src = fetchFromGitLab {
+    owner = "hcs";
+    repo = "hcs_utils";
+    rev = "77668de42895dedb6b4baddf4207f331776de897"; # No tags for 2.1
+    hash = "sha256-T0a2lYi3umRZQInEsxnLf5p6+IxkUmGJhgW8l2ESDd0=";
   };
 
-  postPatch = ''
-    # Remove vendorized versioneer.py
-    rm versioneer.py
-  '';
-
   build-system = [
     setuptools
-    versioneer
+    poetry-core
   ];
 
-  dependencies = [ six ];
+  dependencies = [
+    six
+  ];
+
+  disabledTests = [
+    "test_expand" # It depends on FHS
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  disabledTests = [ "test_expand" ];
-
-  meta = with lib; {
+  meta = {
     description = "Library collecting some useful snippets";
     homepage = "https://gitlab.com/hcs/hcs_utils";
-    license = licenses.isc;
-    maintainers = with maintainers; [ lovek323 ];
-    platforms = platforms.unix;
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ lovek323 ];
   };
 }
diff --git a/pkgs/development/python-modules/pins/default.nix b/pkgs/development/python-modules/pins/default.nix
index 34d224669b3c..1db545017f95 100644
--- a/pkgs/development/python-modules/pins/default.nix
+++ b/pkgs/development/python-modules/pins/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "pins";
-  version = "0.8.6";
+  version = "0.8.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "rstudio";
     repo = "pins-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TRwdd0vxqXZgongjooJG5rzTnopUsjfl2I8z3nBocdg=";
+    hash = "sha256-79TVAfr872Twc7D2iej51jiKNwZ9ESOa66ItNDmyfFM=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 411eef88eb76..9e5ead326420 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   kernel,
   libdrm,
   python3,
@@ -17,22 +16,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "evdi";
-  version = "1.14.7-unstable-2024-11-30";
+  version = "1.14.8";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = "evdi";
-    rev = "59a3a864f7476cd61d9c65bfd012d1e9ed90e2b1";
-    hash = "sha256-0xEh0Tb5QFReW5lXO/Mb3gn1z87+baR8Tix+dQjUZMw=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-57DP8kKsPEK1C5A6QfoZZDmm76pn4SaUKEKu9cicyKI=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/DisplayLink/evdi/commit/e41240cf62d7188643bc95e5d69e1c4cfa6ddb84.patch?full_index=1";
-      hash = "sha256-6V3QJZMAhXqfGLW2eWkIzJnOdBPvLLNVzg6DW1M3IaA=";
-    })
-  ];
-
   env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error"
     "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index a0fff7037f6a..5645edcb8461 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,17 +60,17 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.97";
-    hash = "sha256-tV3K9poCQ38ORtlgxaQT6P7SaRUswgrWV2XTGiM6Dec=";
+    version = "9.0.98";
+    hash = "sha256-HZoRBMLiNaW6/26cqOKL49hkgD+vxHj1wTwq5qXtPW8=";
   };
 
   tomcat10 = common {
-    version = "10.1.33";
-    hash = "sha256-Oysh1hzVh7X4ONoYQ3Y/6qXoZP4Fl1oQHa3gki3lCJU=";
+    version = "10.1.34";
+    hash = "sha256-95lUE4C//ytnTO/YbFN20tfVZrOi58RXnStJHejsbDY=";
   };
 
   tomcat11 = common {
-    version = "11.0.0";
-    hash = "sha256-0MoxmvNJg49ZAJqcXtNwnwI0QgEFnbwm3OQxPulpzSA=";
+    version = "11.0.2";
+    hash = "sha256-wbMaaYnTCnNEwaNlXadGec6fm0iicehkZHoUHeO3jLg=";
   };
 }
diff --git a/pkgs/servers/sql/percona-server/8_0.nix b/pkgs/servers/sql/percona-server/8_0.nix
index 3c9e97d5eea0..e7b948f4e8db 100644
--- a/pkgs/servers/sql/percona-server/8_0.nix
+++ b/pkgs/servers/sql/percona-server/8_0.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  gitUpdater,
   bison,
   cmake,
   pkg-config,
@@ -182,7 +183,13 @@ stdenv.mkDerivation (finalAttrs: {
     connector-c = finalAttrs.finalPackage;
     server = finalAttrs.finalPackage;
     mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.percona-server = nixosTests.mysql.percona-server_8_0;
+    tests.percona-server =
+      nixosTests.mysql."percona-server_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
+    updateScript = gitUpdater {
+      url = "https://github.com/percona/percona-server";
+      rev-prefix = "Percona-Server-";
+      allowedVersions = "${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\..+";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index 9b8621e40900..9fef5c2ca522 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  gitUpdater,
   bison,
   cmake,
   pkg-config,
@@ -50,11 +51,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.2-2";
+  version = "8.4.3-3";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-KdaF2+vZfWf6fW8HWi+c97SHW+WqmlcpdPzUUgX94EY=";
+    hash = "sha256-37W0b8zYKErToJBU+aYtCmQjorcDtvuG0YbOwJzuZgo=";
   };
 
   nativeBuildInputs = [
@@ -204,7 +205,13 @@ stdenv.mkDerivation (finalAttrs: {
     connector-c = finalAttrs.finalPackage;
     server = finalAttrs.finalPackage;
     mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.percona-server = nixosTests.mysql.percona-server_8_4;
+    tests.percona-server =
+      nixosTests.mysql."percona-server_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
+    updateScript = gitUpdater {
+      url = "https://github.com/percona/percona-server";
+      rev-prefix = "Percona-Server-";
+      allowedVersions = "${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\..+";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index c1fdf27b7a60..90493e72e608 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, writeText, plugins ? [ ], nixosTests }:
 
 let
-  version = "4.4.4";
+  version = "4.4.5";
 
   versionParts = lib.take 2 (lib.splitVersion version);
   # 4.2 -> 402, 3.11 -> 311
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/download.php/direct/stable${stableVersion}/${pname}-${version}.tgz";
-    hash = "sha256-9ZMQvv0fL6JwUD5ZJnzfzZkiGOfOV9zMc0hX3PKttBw=";
+    hash = "sha256-CronmobN0OFZHhMCmruPae34j1FNrvMLO02q1VlQfgY=";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/tools/backup/percona-xtrabackup/8_4.nix b/pkgs/tools/backup/percona-xtrabackup/8_4.nix
index 47efd663a1d4..82f2ab5ea95d 100644
--- a/pkgs/tools/backup/percona-xtrabackup/8_4.nix
+++ b/pkgs/tools/backup/percona-xtrabackup/8_4.nix
@@ -3,8 +3,8 @@
 callPackage ./generic.nix (
   args
   // {
-    version = "8.4.0-1";
-    hash = "sha256-2tWRRYH0P0HZsWTxeuvDeVWvDwqjjdv6J7YiZwoTKtM=";
+    version = "8.4.0-2";
+    hash = "sha256-ClW/B175z/sxF/MT9iHW1Wtr0ere63tIgUpcMp1IfTs=";
 
     # includes https://github.com/Percona-Lab/libkmip.git
     fetchSubmodules = true;
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index f3a27b5ca4c5..a7fe7db23777 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -22,17 +22,17 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.32.6";
+  version = "1.32.7";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     rev = version;
-    hash = "sha256-amb2wzCVZPDlR9UbH5jh3IAg0XbJmyQNTSJdZiktWCU=";
+    hash = "sha256-mxZQ1San8zlyvZoBRF9Eb7/mbs374MOgC4baOCFyPoc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hKnm14OlXDVJcxGKHkvOZWOqAwi1lWBa1IZ0MR+0nso=";
+  cargoHash = "sha256-OKfu+G+bS72HJDDLhRp9PMji/baBsh7JaYEZgQYdjTw=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = version;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6f198227fe99..10a30c672c2c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -15060,7 +15060,7 @@ with self; {
       url = "mirror://cpan/authors/id/M/MB/MBRADSHAW/Mail-DKIM-1.20230911.tar.gz";
       hash = "sha256-kecxcoK3JM+9LJtuZjDvFDKISLb8UgPv1w3sL7hyaMo=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRSA MailAuthenticationResults MailTools NetDNS ];
+    propagatedBuildInputs = [ CryptOpenSSLRSA CryptX MailAuthenticationResults MailTools NetDNS ];
     doCheck = false; # tries to access the domain name system
     buildInputs = [ NetDNSResolverMock TestRequiresInternet YAMLLibYAML ];
     meta = {