diff --git a/maintainers/README.md b/maintainers/README.md
index 7f5b6ee6fcb6..2759b0aa7dc1 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -40,6 +40,10 @@ In order to do so, add yourself to the
 [`maintainer-list.nix`](./maintainer-list.nix), and then to the desired
 package's `meta.maintainers` list, and send a PR with the changes.
 
+If you're adding yourself as a maintainer as part of another PR (in which
+you become a maintainer of a package, for example), make your change to
+`maintainer-list.nix` in a separate commit.
+
 ### How to lose maintainer status
 
 Maintainers who have become inactive on a given package can be removed. This
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c709550db2fd..bc4380ec360c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13649,6 +13649,12 @@
     github = "L0L1P0P1";
     githubId = 73695812;
   };
+  l0r3v = {
+    email = "l0r3v@pasqui.casa";
+    github = "l0r3v";
+    githubId = 27364685;
+    name = "Lorenzo Pasqui";
+  };
   l1npengtul = {
     email = "l1npengtul@l1npengtul.lol";
     github = "l1npengtul";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 0094ba222251..883ccb4e7abb 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -48,43 +48,43 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [scanservjs](https://github.com/sbs20/scanservjs/), a web UI for SANE scanners. Available at [services.scanservjs](#opt-services.scanservjs.enable).
 
-- [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
+- [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](#opt-services.kimai.sites).
 
 - [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as [services.kismet](#opt-services.kismet.enable).
 
 - [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as [services.vwifi](#opt-services.vwifi.client.enable).
 
-- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
+- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](#opt-services.oncall.enable).
 
-- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
+- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](#opt-services.homer.enable).
 
-- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
+- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](#opt-programs.ghidra.enable).
 
-- [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](options.html#opt-services.omnom.enable).
+- [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](#opt-services.omnom.enable).
 
 - [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper), an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes. Available as [services.yggdrasil-jumper](#opt-services.yggdrasil-jumper.enable).
 
-- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the `xone` driver and an Xbox 360 controller under the `xpad` driver at the same time. Available as [hardware.xpad-noone](options.html#hardware.xpad-noone).
+- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the `xone` driver and an Xbox 360 controller under the `xpad` driver at the same time. Available as [hardware.xpad-noone](#opt-hardware.xpad-noone.enable).
 
-- [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](options.html#opt-services.umurmur).
+- [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](#opt-services.umurmur.enable).
 
-- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](options.html#opt-services.zenohd.enable).
+- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](#opt-services.zenohd.enable).
 
-- [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](options.html#opt-services.ytdl-sub.instances).
+- [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](#opt-services.ytdl-sub.instances).
 
-- [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).
+- [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](#opt-services.marytts.enable).
 
 - [Continuwuity](https://continuwuity.org/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-continuwuity](#opt-services.matrix-continuwuity.enable).
 
-- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
+- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](#opt-services.reposilite.enable).
 
-- [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
+- [networking.modemmanager](#opt-networking.modemmanager.enable) has been split out of [networking.networkmanager](#opt-networking.networkmanager.enable). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
-- [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data.
+- [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data. Available as [services.routinator](#opt-services.routinator.enable).
 
-- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
+- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](#opt-services.doh-server.enable).
 
-- [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
+- [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](#opt-services.ncps.enable).
 
 - [Readeck](https://readeck.org/), a read-it later web-application. Available as [services.readeck](#opt-services.readeck.enable).
 
@@ -102,21 +102,21 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Pinchflat](https://github.com/kieraneglin/pinchflat), a selfhosted YouTube media manager used to track channels and download videos on release. Available as [services.pinchflat](#opt-services.pinchflat.enable).
 
-- [Amazon CloudWatch Agent](https://github.com/aws/amazon-cloudwatch-agent), the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as [services.amazon-cloudwatch-agent](options.html#opt-services.amazon-cloudwatch-agent.enable).
+- [Amazon CloudWatch Agent](https://github.com/aws/amazon-cloudwatch-agent), the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as [services.amazon-cloudwatch-agent](#opt-services.amazon-cloudwatch-agent.enable).
 
 - [Fluent Bit](https://github.com/fluent/fluent-bit), a fast Log, Metrics and Traces Processor and Forwarder. Available as [services.fluent-bit](#opt-services.fluent-bit.enable).
 
-- [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](options.html#opt-programs.bat).
+- [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](#opt-programs.bat.enable).
 
-- [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).
+- [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](#opt-services.autotierfs.enable).
 
-- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](options.html#opt-services.postgrest.enable).
+- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](#opt-services.postgrest.enable).
 
-- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilities on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](options.html#opt-services.postgres-websockets.enable).
+- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilities on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](#opt-services.postgres-websockets.enable).
 
-- [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).
+- [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](#opt-services.ustreamer.enable).
 
-- [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
+- [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](#opt-services.whoogle-search.enable).
 
 - [autobrr](https://autobrr.com), a modern download automation tool for torrents and usenets. Available as [services.autobrr](#opt-services.autobrr.enable).
 
@@ -124,31 +124,31 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Froide-Govplan](https://github.com/okfde/froide-govplan), a web application government planer. Available as [services.froide-govplan](#opt-services.froide-govplan.enable).
 
-- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
+- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](#opt-services.agorakit.enable).
 
 - [vivid](https://github.com/sharkdp/vivid), a generator for `LS_COLOR`. Available as [programs.vivid](#opt-programs.vivid.enable).
 
-- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](options.html#opt-services.matrix-alertmanager.enable).
+- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](#opt-services.matrix-alertmanager.enable).
 
-- [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
+- [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](#opt-services.waagent.enable).
 
 - [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
 
-- [grav](https://getgrav.org/), a modern flat-file CMS. Available with [services.grav](options.html#opt-services.grav.enable).
+- [grav](https://getgrav.org/), a modern flat-file CMS. Available with [services.grav](#opt-services.grav.enable).
 
-- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable).
+- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](#opt-services.duckdns.enable).
 
-- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](options.html#opt-programs.zoxide.enable).
+- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](#opt-programs.zoxide.enable).
 
 - [victorialogs](https://docs.victoriametrics.com/victorialogs/), log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable).
 
-- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable).
+- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](#opt-services.gokapi.enable).
 
-- [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
+- [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](#opt-services.nostr-rs-relay.enable).
 
-- [haven](https://github.com/bitvora/haven), is a high availability vault for events on nostr. Available as [services.haven](options.html#opt-services.haven.enable).
+- [haven](https://github.com/bitvora/haven), is a high availability vault for events on nostr. Available as [services.haven](#opt-services.haven.enable).
 
-- [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](options.html#opt-services.strfry.enable).
+- [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](#opt-services.strfry.enable).
 
 - [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available as [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
 
@@ -172,9 +172,9 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Fider](https://fider.io/), an open platform to collect and prioritize feedback. Available as [services.fider](#opt-services.fider.enable).
 
-- [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](option.html#opt-services.pds).
+- [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](#opt-services.pds.enable).
 
-- [Anubis](https://github.com/TecharoHQ/anubis), a scraper defense software. Available as [services.anubis](options.html#opt-services.anubis).
+- [Anubis](https://github.com/TecharoHQ/anubis), a scraper defense software. Available as [services.anubis](#opt-services.anubis.defaultOptions).
 
 - [synapse-auto-compressor](https://github.com/matrix-org/rust-synapse-compress-state?tab=readme-ov-file#automated-tool-synapse_auto_compressor), a rust-based matrix-synapse state compressor for postgresql. Available as [services.synapse-auto-compressor](#opt-services.synapse-auto-compressor.enable).
 
@@ -204,15 +204,15 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [LiteLLM](https://github.com/BerriAI/litellm), a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as [services.litellm](#opt-services.litellm.enable).
 
-- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).
+- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](#opt-services.buffyboard.enable).
 
 - [KanBoard](https://github.com/kanboard/kanboard), a project management tool that focuses on the Kanban methodology. Available as [services.kanboard](#opt-services.kanboard.enable).
 
 - [git-worktree-switcher](https://github.com/mateusauler/git-worktree-switcher), switch between git worktrees with speed. Available as [programs.git-worktree-switcher](#opt-programs.git-worktree-switcher.enable).
 
-- [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](options.html#opt-services.glpiAgent.enable).
+- [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](#opt-services.glpiAgent.enable).
 
-- [pgBackRest](https://pgbackrest.org), a reliable backup and restore solution for PostgreSQL. Available as [services.pgbackrest](options.html#opt-services.pgbackrest.enable).
+- [pgBackRest](https://pgbackrest.org), a reliable backup and restore solution for PostgreSQL. Available as [services.pgbackrest](#opt-services.pgbackrest.enable).
 
 - [Recyclarr](https://github.com/recyclarr/recyclarr) a TRaSH Guides synchronizer for Sonarr and Radarr. Available as [services.recyclarr](#opt-services.recyclarr.enable).
 
@@ -232,7 +232,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [bitbox-bridge](https://github.com/BitBoxSwiss/bitbox-bridge), a bridge software that connects BitBox hardware wallets to computers & web wallets like [Rabby](https://rabby.io/). Allows one to interact & transact with smart contracts, Web3 websites & financial services without storing private keys anywhere other than the hardware wallet. Available as [services.bitbox-bridge](#opt-services.bitbox-bridge.enable).
 
-- [GoDNS](https://github.com/TimothyYe/godns), a dynamic DNS client written in Go, which supports multiple DNS providers. Available as [services.godns](option.html#opt-services.godns.enable).
+- [GoDNS](https://github.com/TimothyYe/godns), a dynamic DNS client written in Go, which supports multiple DNS providers. Available as [services.godns](#opt-services.godns.enable).
 
 - [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes. Available as [services.cook-cli](#opt-services.cook-cli.enable).
 
@@ -258,7 +258,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=24.11, `pkgs.nextcloud30` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=24.05, `pkgs.nextcloud31` will be installed by default.
-  - Please note that an upgrade from v29 (or older) to v31 directly is not possible. Please upgrade to `nextcloud30` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud30;`](options.html#opt-services.nextcloud.package).
+  - Please note that an upgrade from v29 (or older) to v31 directly is not possible. Please upgrade to `nextcloud30` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud30;`](#opt-services.nextcloud.package).
 
 - `services.cloudflare-dyndns.apiTokenFile` now must be just your Cloudflare api token. Previously it was supposed to be a file of the form `CLOUDFLARE_API_TOKEN=...`.
 
@@ -446,7 +446,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
 
-- [`hardware.xone`](options.html#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](options.html#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
+- [`hardware.xone`](#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
 
 - `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.
 
@@ -525,7 +525,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - Exposed the `paperless-manage` script package via the `services.paperless.manage` read-only option.
 
-- New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](options.html#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
+- New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
   Note: these are intended for users not running a sound server like PulseAudio or PipeWire, but having ALSA as their only sound system.
 
 - `services.k3s` now provides the `autoDeployCharts` option that allows to automatically deploy Helm charts via the k3s Helm controller.
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 1eb3e47a46ae..636ff2655a65 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -477,7 +477,7 @@ let
         (mkIf config.isNormalUser {
           group = mkDefault "users";
           createHome = mkDefault true;
-          home = mkDefault "/home/${config.name}";
+          home = mkDefault "${cfg.defaultUserHome}/${config.name}";
           homeMode = mkDefault "700";
           useDefaultShell = mkDefault true;
           isSystemUser = mkDefault false;
@@ -753,6 +753,14 @@ in
       '';
     };
 
+    users.defaultUserHome = mkOption {
+      type = types.str;
+      default = "/home";
+      description = ''
+        The default home directory for normal users.
+      '';
+    };
+
     # systemd initrd
     boot.initrd.systemd.users = mkOption {
       description = ''
diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
index dbace6c4fdaa..021ce805d376 100644
--- a/nixos/modules/programs/feedbackd.nix
+++ b/nixos/modules/programs/feedbackd.nix
@@ -17,10 +17,15 @@ in
         Your user needs to be in the `feedbackd` group to trigger effects
       '';
       package = lib.mkPackageOption pkgs "feedbackd" { };
+      theme-package = lib.mkPackageOption pkgs "feedbackd-device-themes" {
+        nullable = true;
+      };
     };
   };
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [
+      cfg.package
+    ] ++ (if cfg.theme-package != null then [ cfg.theme-package ] else [ ]);
 
     services.dbus.packages = [ cfg.package ];
     services.udev.packages = [ cfg.package ];
diff --git a/nixos/modules/programs/nh.nix b/nixos/modules/programs/nh.nix
index 321893f4bd23..fd9229bd71d1 100644
--- a/nixos/modules/programs/nh.nix
+++ b/nixos/modules/programs/nh.nix
@@ -19,10 +19,10 @@ in
     package = lib.mkPackageOption pkgs "nh" { };
 
     flake = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
-        The path that will be used for the `NH_FLAKE` environment variable.
+        The string that will be used for the `NH_FLAKE` environment variable.
 
         `NH_FLAKE` is used by nh as the default flake for performing actions, such as
         `nh os switch`. This behaviour can be overriden per-command with environment
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 44e0f44dfecc..e8eb756f8f59 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -217,7 +217,7 @@ in
           # /etc/default/useradd: configuration for useradd.
           "default/useradd".source = pkgs.writeText "useradd" ''
             GROUP=100
-            HOME=/home
+            HOME=${config.users.defaultUserHome}
             SHELL=${utils.toShellPath config.users.defaultUserShell}
           '';
         };
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index d2d49ee2eeb9..803cc741ce15 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -239,6 +239,14 @@ in
         '';
       };
 
+      enableDefaultPlugins = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable a set of recommended plugins.
+        '';
+      };
+
       dhcp = mkOption {
         type = types.enum [
           "dhcpcd"
@@ -660,7 +668,7 @@ in
         useDHCP = false;
       })
 
-      {
+      (mkIf cfg.enableDefaultPlugins {
         networkmanager.plugins = with pkgs; [
           networkmanager-fortisslvpn
           networkmanager-iodine
@@ -670,7 +678,7 @@ in
           networkmanager-vpnc
           networkmanager-sstp
         ];
-      }
+      })
 
       (mkIf cfg.enableStrongSwan {
         networkmanager.plugins = [ pkgs.networkmanager_strongswan ];
diff --git a/nixos/modules/system/boot/emergency-mode.nix b/nixos/modules/system/boot/emergency-mode.nix
index 34058bc17a6b..ec4e39a9a59e 100644
--- a/nixos/modules/system/boot/emergency-mode.nix
+++ b/nixos/modules/system/boot/emergency-mode.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  options,
+  ...
+}:
 {
 
   ###### interface
@@ -15,6 +20,8 @@
         instances) have no console of any kind, emergency mode doesn't
         make sense, and it's better to continue with the boot insofar
         as possible.
+
+        For initrd emergency access, use ${options.boot.initrd.systemd.emergencyAccess} instead.
       '';
     };
 
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index b82a79376e07..95d8b77d2a36 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -258,6 +258,8 @@ in
 
         Can also be set to a hashed super user password to allow
         authenticated access to the emergency mode.
+
+        For emergency access after initrd, use `${options.systemd.enableEmergencyMode}` instead.
       '';
       default = false;
     };
diff --git a/pkgs/README.md b/pkgs/README.md
index 878db5df8397..bcadafd73f0a 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -113,6 +113,8 @@ Now that this is out of the way. To add a package to Nixpkgs:
 
    - Add yourself as the maintainer of the package.
 
+     - If this is your first time contributing (welcome!), [add yourself to the maintainers list](../maintainers/README.md#how-to-become-a-maintainer) in a separate commit.
+
    - All other [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are optional, but it’s still a good idea to provide at least the `description`, `homepage` and [`license`](https://nixos.org/manual/nixpkgs/stable/#sec-meta-license).
 
    - The exact syntax and semantics of the Nix expression language, including the built-in functions, are [Nix language reference](https://nixos.org/manual/nix/stable/language/).
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 82ff1403965f..9ac536343140 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.2.10";
+  version = "1.2.11";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-ByZHyHkMlU571QSu1bbYZC7aEX4Jc8N3j05WbXRQaBY=";
+    hash = "sha256-AhNx2CdfE7ff3+L47X6lYPD8GA7imkDIJD5ESndn/cc=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
diff --git a/pkgs/applications/editors/rstudio/boost-1.86.patch b/pkgs/applications/editors/rstudio/boost-1.86.patch
deleted file mode 100644
index 058eaf42e96d..000000000000
--- a/pkgs/applications/editors/rstudio/boost-1.86.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-diff --git a/src/cpp/core/json/JsonRpc.cpp b/src/cpp/core/json/JsonRpc.cpp
-index d034ffe..4b08486 100644
---- a/src/cpp/core/json/JsonRpc.cpp
-+++ b/src/cpp/core/json/JsonRpc.cpp
-@@ -193,7 +193,7 @@ void JsonRpcResponse::setAfterResponse(
-    
- bool JsonRpcResponse::hasAfterResponse() const
- {
--   return afterResponse_;
-+   return !afterResponse_.empty();
- }
-    
-    
-diff --git a/src/cpp/session/modules/rmarkdown/NotebookExec.cpp b/src/cpp/session/modules/rmarkdown/NotebookExec.cpp
-index 5631a1f..0e3030b 100644
---- a/src/cpp/session/modules/rmarkdown/NotebookExec.cpp
-+++ b/src/cpp/session/modules/rmarkdown/NotebookExec.cpp
-@@ -193,7 +193,7 @@ void ChunkExecContext::connect()
- 
-    // leave an execution lock in this folder so it won't be moved if the notebook
-    // is saved while executing
--   auto lock = make_unique<ScopedFileLock>(
-+   auto lock = rstudio::core::make_unique<ScopedFileLock>(
-        FileLock::createDefault(),
-        outputPath_.completePath(kExecutionLock));
-    locks_.push_back(std::move(lock));
-@@ -204,7 +204,7 @@ void ChunkExecContext::connect()
-       initializeOutput();
- 
-    // capture conditions
--   auto pConditionCapture = make_unique<ConditionCapture>();
-+   auto pConditionCapture = rstudio::core::make_unique<ConditionCapture>();
-    pConditionCapture->connect();
-    captures_.push_back(std::move(pConditionCapture));
-    connections_.push_back(events().onCondition.connect(
-@@ -234,7 +234,7 @@ void ChunkExecContext::connect()
-          boost::bind(&ChunkExecContext::onFileOutput, this, _1, _2, 
-                      _3, ChunkOutputPlot, _4)));
- 
--   auto pPlotCapture = make_unique<PlotCapture>();
-+   auto pPlotCapture = rstudio::core::make_unique<PlotCapture>();
-    if (figWidth > 0 || figHeight > 0)
-    {
-       // user specified plot size, use it
-@@ -261,7 +261,7 @@ void ChunkExecContext::connect()
-          boost::bind(&ChunkExecContext::onFileOutput, this, _1, _2, _3, 
-                      ChunkOutputHtml, 0)));
- 
--   auto pHtmlCapture = make_unique<HtmlCapture>();
-+   auto pHtmlCapture = rstudio::core::make_unique<HtmlCapture>();
-    error = pHtmlCapture->connectHtmlCapture(
-             outputPath_,
-             outputPath_.getParent().completePath(kChunkLibDir),
-@@ -316,14 +316,14 @@ void ChunkExecContext::connect()
-    prevCharWidth_ = r::options::getOptionWidth();
-    r::options::setOptionWidth(charWidth_);
- 
--   auto pDirCapture = make_unique<DirCapture>();
-+   auto pDirCapture = rstudio::core::make_unique<DirCapture>();
-    error = pDirCapture->connectDir(docId_, workingDir_);
-    if (error)
-       LOG_ERROR(error);
-    captures_.push_back(std::move(pDirCapture));
- 
-    // begin capturing errors
--   auto pErrorCapture = make_unique<ErrorCapture>();
-+   auto pErrorCapture = rstudio::core::make_unique<ErrorCapture>();
-    pErrorCapture->connect();
-    captures_.push_back(std::move(pErrorCapture));
- 
-@@ -341,7 +341,7 @@ void ChunkExecContext::connect()
-          boost::bind(&ChunkExecContext::onFileOutput, this, _1, _2, _3, 
-                      ChunkOutputData, 0)));
- 
--   auto pDataCapture = make_unique<DataCapture>();
-+   auto pDataCapture = rstudio::core::make_unique<DataCapture>();
-    error = pDataCapture->connectDataCapture(
-             outputPath_,
-             options_.mergedOptions());
-@@ -661,7 +661,7 @@ void ChunkExecContext::initializeOutput()
- 
-    // leave an execution lock in this folder so it won't be moved if the notebook
-    // is saved while executing
--   auto lock = make_unique<ScopedFileLock>(
-+   auto lock = rstudio::core::make_unique<ScopedFileLock>(
-        FileLock::createDefault(),
-        outputPath.completePath(kExecutionLock));
-    locks_.push_back(std::move(lock));
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index ff70de589826..8ba7f9df78f5 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -1,47 +1,50 @@
 {
   lib,
   stdenv,
-  runCommand,
-  fetchzip,
+
+  server ? false, # build server version
+
   fetchFromGitHub,
+  fetchNpmDeps,
+  fetchYarnDeps,
+  fetchzip,
   replaceVars,
-  cmake,
-  boost186,
-  zlib,
-  openssl,
-  R,
-  fontconfig,
-  quarto,
-  libuuid,
-  hunspellDicts,
+  runCommand,
+
   ant,
+  cacert,
+  cmake,
+  git,
   jdk,
-  gnumake,
-  pandoc,
-  llvmPackages,
-  yaml-cpp,
-  soci,
-  sqlite,
-  apple-sdk_11,
-  xcbuild,
+  makeWrapper,
   nodejs,
   npmHooks,
-  fetchNpmDeps,
+  xcbuild,
   yarn,
   yarnConfigHook,
-  fetchYarnDeps,
   zip,
-  git,
-  makeWrapper,
+
+  apple-sdk_11,
+  boost187,
   electron_34,
-  server ? false, # build server version
+  fontconfig,
+  gnumake,
+  hunspellDicts,
+  libuuid,
+  llvmPackages,
+  openssl,
   pam,
+  pandoc,
+  quarto,
+  R,
+  soci,
+  sqlite,
+  zlib,
+
   nixosTests,
 }:
 
 let
-  # Note: we shouldn't use the latest electron here, since the node-abi dependency might
-  # need to be updated every time the latest electron gets a new abi version number
   electron = electron_34;
 
   mathJaxSrc = fetchzip {
@@ -53,8 +56,8 @@ let
   quartoSrc = fetchFromGitHub {
     owner = "quarto-dev";
     repo = "quarto";
-    rev = "7d1582d06250216d18696145879415e473a2ae4d";
-    hash = "sha256-AaE9EDT3tJieI403QGxAf+A/PEw1rmUdhdpy4WNf40o=";
+    rev = "8ee12b5d6bd49c7b212eae894bd011ffbeea1c48";
+    hash = "sha256-pTrWedYeG2SWQ4jl2fstKjsweWhj4aAvVDiSfkdU3No=";
   };
 
   hunspellDictionaries = lib.filter lib.isDerivation (lib.unique (lib.attrValues hunspellDicts));
@@ -76,62 +79,106 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "RStudio";
-  version = "2024.12.1+563";
-
-  RSTUDIO_VERSION_MAJOR = lib.versions.major version;
-  RSTUDIO_VERSION_MINOR = lib.versions.minor version;
-  RSTUDIO_VERSION_PATCH = lib.versions.patch version;
-  RSTUDIO_VERSION_SUFFIX = "+" + toString (lib.tail (lib.splitString "+" version));
+  version = "2025.05.0+496";
 
   src = fetchFromGitHub {
     owner = "rstudio";
     repo = "rstudio";
     tag = "v${version}";
-    hash = "sha256-fguomJHs7FBffYfMlgWgnjLWK3uDZYX4Ip4asKZ8XVQ=";
+    hash = "sha256-yZy/fEYln/jGxErwJiWFgr9w0GvwtMwzpmmHf71chBQ=";
+  };
+
+  # sources fetched into _deps via cmake's FetchContent
+  extSrcs = stdenv.mkDerivation {
+    name = "${pname}-${version}-ext-srcs";
+    inherit src;
+
+    nativeBuildInputs = [
+      cacert
+      cmake
+      git
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      # this will fail, since this is not meant to be a cmake entrypoint
+      # but it will fetch the dependencies regardless
+      cmake -S src/cpp/ext -B build || true
+
+      mkdir -p "$out"
+      cp -r build/_deps/*-src "$out/"
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+
+      runHook postInstall
+    '';
+
+    dontConfigure = true;
+    dontBuild = true;
+    dontFixup = true;
+
+    outputHash = "sha256-YW+l0/RZf8ek217pfWTwsR4PTugMGHyW+vaZEwGjMas=";
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
   };
 
   nativeBuildInputs =
     [
       cmake
+      git
+
       ant
       jdk
+
       nodejs
       yarn
       yarnConfigHook
       zip
-      git
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      xcbuild
+    ]
     ++ lib.optionals (!server) [
+      makeWrapper
       (nodejs.python.withPackages (ps: [ ps.setuptools ]))
       npmHooks.npmConfigHook
-      makeWrapper
     ];
 
   buildInputs =
     [
-      boost186
-      zlib
+      boost187
+      libuuid
       openssl
       R
-      libuuid
-      yaml-cpp
       soci
       sqlite.dev
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ]
-    ++ lib.optionals server [ pam ]
-    ++ lib.optionals (!server) [ fontconfig ];
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_11
+    ]
+    ++ lib.optionals (!server) [
+      fontconfig
+    ]
+    ++ lib.optionals server [
+      pam
+      zlib
+    ];
 
   cmakeFlags =
     [
       (lib.cmakeFeature "RSTUDIO_TARGET" (if server then "Server" else "Electron"))
-      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_SOCI" true)
+
+      # don't try fetching the external dependencies already fetched in extSrcs
+      (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+
       (lib.cmakeBool "RSTUDIO_USE_SYSTEM_BOOST" true)
-      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_YAML_CPP" true)
+      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_SOCI" true)
+
       (lib.cmakeBool "RSTUDIO_DISABLE_CHECK_FOR_UPDATES" true)
       (lib.cmakeBool "QUARTO_ENABLED" true)
+      (lib.cmakeBool "RSTUDIO_ENABLE_COPILOT" false) # copilot-language-server is unfree
       (lib.cmakeBool "RSTUDIO_CRASHPAD_ENABLED" false) # This is a NOOP except on x86_64-darwin
+
       (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" (
         (placeholder "out") + (if stdenv.hostPlatform.isDarwin then "/Applications" else "/lib/rstudio")
       ))
@@ -140,8 +187,17 @@ stdenv.mkDerivation rec {
       (lib.cmakeBool "RSTUDIO_INSTALL_FREEDESKTOP" stdenv.hostPlatform.isLinux)
     ];
 
-  # on Darwin, cmake uses find_library to locate R instead of using the PATH
-  env.NIX_LDFLAGS = "-L${R}/lib/R/lib";
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    # on Darwin, cmake uses find_library to locate R instead of using the PATH
+    NIX_LDFLAGS = "-L${R}/lib/R/lib";
+
+    RSTUDIO_VERSION_MAJOR = lib.versions.major version;
+    RSTUDIO_VERSION_MINOR = lib.versions.minor version;
+    RSTUDIO_VERSION_PATCH = lib.versions.patch version;
+    RSTUDIO_VERSION_SUFFIX = "+" + toString (lib.tail (lib.splitString "+" version));
+  };
 
   patches = [
     # Hack RStudio to only use the input R and provided libclang.
@@ -154,10 +210,7 @@ stdenv.mkDerivation rec {
 
     ./ignore-etc-os-release.patch
     ./dont-yarn-install.patch
-    ./boost-1.86.patch
     ./fix-darwin.patch
-    # needed for rebuilding for later electron versions
-    ./update-nan-and-node-abi.patch
   ];
 
   postPatch = ''
@@ -172,7 +225,7 @@ stdenv.mkDerivation rec {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = quartoSrc + "/yarn.lock";
-    hash = "sha256-48Q2MkfzXZSL3ly56WSjRVwU3fgRD8xivQobStBkk6Y=";
+    hash = "sha256-F+gqVNNhLmyrC+tJuElw7cpx5z/WLHOiYow/y86KR5c=";
   };
 
   dontYarnInstallDeps = true; # will call manually in preConfigure
@@ -187,14 +240,16 @@ stdenv.mkDerivation rec {
   npmDeps = fetchNpmDeps {
     name = "rstudio-${version}-npm-deps";
     inherit src;
-    patches = [ ./update-nan-and-node-abi.patch ];
     postPatch = "cd ${npmRoot}";
-    hash = "sha256-9VHse+nxr5A1EWuszQ6cnJAMqYiHFqHQ4OJ/TJq+XoI=";
+    hash = "sha256-ispV6FJdtOELtFNIZDn1lKbwvO/iTO8mrZ8nIOs2uhs=";
   };
 
-  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-
   preConfigure = ''
+    # populate the directories used by cmake's FetchContent
+    mkdir -p build/_deps
+    cp -r "$extSrcs"/* build/_deps
+    chmod -R u+w build/_deps
+
     # set up node_modules directory inside quarto so that panmirror can be built
     mkdir src/gwt/lib/quarto
     cp -r --no-preserve=all ${quartoSrc}/* src/gwt/lib/quarto
@@ -221,12 +276,7 @@ stdenv.mkDerivation rec {
     mkdir -p dependencies/common/node
     # node used by cmake
     # version in cmake/globals.cmake (RSTUDIO_NODE_VERSION)
-    ln -s ${nodejs} dependencies/common/node/20.15.1
-
-    # node used at runtime
-    # version in cmake/globals.cmake (RSTUDIO_INSTALLED_NODE_VERSION)
-    # upstream uses the -patched suffix for the runtime node directory
-    ln -s ${nodejs} dependencies/common/node/20.15.1-patched
+    ln -s ${nodejs} dependencies/common/node/22.13.1
 
     ${lib.optionalString (!server) ''
       pushd $npmRoot
@@ -301,12 +351,13 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit server;
-    tests = {
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
       inherit (nixosTests) rstudio-server;
     };
   };
 
   meta = {
+    changelog = "https://github.com/rstudio/rstudio/tree/${src.rev}/version/news";
     description = "Set of integrated tools for the R language";
     homepage = "https://www.rstudio.com/";
     license = lib.licenses.agpl3Only;
@@ -316,6 +367,7 @@ stdenv.mkDerivation rec {
       tomasajt
     ];
     mainProgram = "rstudio" + lib.optionalString server "-server";
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    # rstudio-server on darwin is only partially supported by upstream
+    platforms = lib.platforms.linux ++ lib.optionals (!server) lib.platforms.darwin;
   };
 }
diff --git a/pkgs/applications/editors/rstudio/update-nan-and-node-abi.patch b/pkgs/applications/editors/rstudio/update-nan-and-node-abi.patch
deleted file mode 100644
index bdb62dfa8a5e..000000000000
--- a/pkgs/applications/editors/rstudio/update-nan-and-node-abi.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-diff --git a/src/node/desktop/package-lock.json b/src/node/desktop/package-lock.json
-index a210521..9543abb 100644
---- a/src/node/desktop/package-lock.json
-+++ b/src/node/desktop/package-lock.json
-@@ -18,7 +18,7 @@
-         "line-reader": "0.4.0",
-         "lodash.debounce": "4.0.8",
-         "net-ipc": "2.2.0",
--        "node-abi": "3.71.0",
-+        "node-abi": "^3.74.0",
-         "node-addon-api": "8.3.0",
-         "node-system-fonts": "1.0.1",
-         "properties-reader": "2.3.0",
-@@ -56,7 +56,7 @@
-         "json-schema-to-typescript": "14.1.0",
-         "lint-staged": "15.2.10",
-         "mocha": "10.8.2",
--        "nan": "2.22.0",
-+        "nan": "^2.22.1",
-         "node-loader": "2.1.0",
-         "nyc": "17.1.0",
-         "prettier": "3.3.3",
-@@ -9538,9 +9538,9 @@
-       }
-     },
-     "node_modules/nan": {
--      "version": "2.22.0",
--      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.0.tgz",
--      "integrity": "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==",
-+      "version": "2.22.1",
-+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.1.tgz",
-+      "integrity": "sha512-pfRR4ZcNTSm2ZFHaztuvbICf+hyiG6ecA06SfAxoPmuHjvMu0KUIae7Y8GyVkbBqeEIidsmXeYooWIX9+qjfRQ==",
-       "license": "MIT"
-     },
-     "node_modules/nanoid": {
-@@ -9667,9 +9667,9 @@
-       }
-     },
-     "node_modules/node-abi": {
--      "version": "3.71.0",
--      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.71.0.tgz",
--      "integrity": "sha512-SZ40vRiy/+wRTf21hxkkEjPJZpARzUMVcJoQse2EF8qkUWbbO2z7vd5oA/H6bVH6SZQ5STGcu0KRDS7biNRfxw==",
-+      "version": "3.74.0",
-+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.74.0.tgz",
-+      "integrity": "sha512-c5XK0MjkGBrQPGYG24GBADZud0NCbznxNx0ZkS+ebUTrmV1qTDxPxSL8zEAPURXSbLRWVexxmP4986BziahL5w==",
-       "license": "MIT",
-       "dependencies": {
-         "semver": "^7.3.5"
-diff --git a/src/node/desktop/package.json b/src/node/desktop/package.json
-index 8b8ef47..287d879 100644
---- a/src/node/desktop/package.json
-+++ b/src/node/desktop/package.json
-@@ -54,7 +54,7 @@
-     "json-schema-to-typescript": "14.1.0",
-     "lint-staged": "15.2.10",
-     "mocha": "10.8.2",
--    "nan": "2.22.0",
-+    "nan": "^2.22.1",
-     "node-loader": "2.1.0",
-     "nyc": "17.1.0",
-     "prettier": "3.3.3",
-@@ -76,7 +76,7 @@
-     "line-reader": "0.4.0",
-     "lodash.debounce": "4.0.8",
-     "net-ipc": "2.2.0",
--    "node-abi": "3.71.0",
-+    "node-abi": "^3.74.0",
-     "node-addon-api": "8.3.0",
-     "node-system-fonts": "1.0.1",
-     "properties-reader": "2.3.0",
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 2c6a4d755db3..84678c9b97fd 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4044,15 +4044,7 @@ let
         };
       };
 
-      redhat.vscode-xml = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          publisher = "redhat";
-          name = "vscode-xml";
-          version = "0.29.0";
-          hash = "sha256-I6ZRtt43Qo3m8OfmjkVfBIaNWWvLULlwnJZqIp/WEuI=";
-        };
-        meta.license = lib.licenses.epl20;
-      };
+      redhat.vscode-xml = callPackage ./redhat.vscode-xml { };
 
       redhat.vscode-yaml = buildVscodeMarketplaceExtension {
         mktplcRef = {
diff --git a/pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix b/pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix
new file mode 100644
index 000000000000..7748faff86b1
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenvNoCC,
+  vscode-utils,
+  vscode-extension-update-script,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-FnMTpDXC/UIMPfcBbpZRo/T0LljFP0+syv2aTZjOczc=";
+        };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-bPkRzOpd7nlIg3oLvrfIrcvrxJqnRhNZNzgao8ga+OM=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-UnRWxjmicfizn8SUspkhjjiYDJDFGI4ItIPLTnRZEy0=";
+        };
+      };
+    in
+    {
+      publisher = "redhat";
+      name = "vscode-xml";
+      version = "0.29.0";
+    }
+    // sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+  passthru.updateScript = vscode-extension-update-script {
+    extraArgs = [
+      "--override-filename"
+      "pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix"
+    ];
+  };
+
+  meta = {
+    license = lib.licenses.epl20;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 885627bbfb7a..a1eba6e7bc33 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -110,6 +110,9 @@ stdenv.mkDerivation {
   # Firefox uses "relrhack" to manually process relocations from a fixed offset
   patchelfFlags = [ "--no-clobber-old-sections" ];
 
+  # don't break code signing
+  dontFixup = stdenv.hostPlatform.isDarwin;
+
   installPhase =
     if stdenv.hostPlatform.isDarwin then
       ''
diff --git a/pkgs/tools/filesystems/android-file-transfer/darwin-dont-vendor-dependencies.patch b/pkgs/by-name/an/android-file-transfer/darwin-dont-vendor-dependencies.patch
similarity index 100%
rename from pkgs/tools/filesystems/android-file-transfer/darwin-dont-vendor-dependencies.patch
rename to pkgs/by-name/an/android-file-transfer/darwin-dont-vendor-dependencies.patch
diff --git a/pkgs/tools/filesystems/android-file-transfer/default.nix b/pkgs/by-name/an/android-file-transfer/package.nix
similarity index 78%
rename from pkgs/tools/filesystems/android-file-transfer/default.nix
rename to pkgs/by-name/an/android-file-transfer/package.nix
index d270cd8e7a6d..75c7db22608e 100644
--- a/pkgs/tools/filesystems/android-file-transfer/default.nix
+++ b/pkgs/by-name/an/android-file-transfer/package.nix
@@ -1,26 +1,23 @@
 {
   lib,
   stdenv,
-  mkDerivation,
   fetchFromGitHub,
   cmake,
-  fuse,
+  fuse3,
   readline,
   pkg-config,
-  qtbase,
-  qttools,
-  wrapQtAppsHook,
+  qt6,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "android-file-transfer";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "whoozle";
     repo = "android-file-transfer-linux";
     rev = "v${version}";
-    sha256 = "sha256-1euoWM9KMauOkAp7g1FvY4olMiOg+La/Uk1QlQ3mKi8=";
+    sha256 = "sha256-G+ErwZ/F8Cl8WLSzC+5LrEWWqNZL3xDMBvx/gjkgAXk=";
   };
 
   patches = [ ./darwin-dont-vendor-dependencies.patch ];
@@ -29,12 +26,12 @@ mkDerivation rec {
     cmake
     readline
     pkg-config
-    wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
   buildInputs = [
-    fuse
-    qtbase
-    qttools
+    fuse3
+    qt6.qtbase
+    qt6.qttools
   ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/at/atac/package.nix b/pkgs/by-name/at/atac/package.nix
index 5b54a99a2cf7..43498f062114 100644
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "atac";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "Julien-cpsn";
     repo = "ATAC";
     rev = "v${version}";
-    hash = "sha256-Hw93XI//d+ubVZvNPpq6z2P5XLSzw/EqzrrifSEmWUM=";
+    hash = "sha256-1Y32uz/GF981mRpVNRsix1xTz3kLihMdnzd4i/QGE7s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OrTPHfMFF5A9SGBcjcNIOC/JGLtkJzSk9EEVcv6NwOs=";
+  cargoHash = "sha256-s7Iu0ZxahQekG02oCvI0WH0OiqAez+l7wvJq1xCQINY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/bu/butterfly/package.nix b/pkgs/by-name/bu/butterfly/package.nix
index 96af2dc290b8..0b6a923d5d49 100644
--- a/pkgs/by-name/bu/butterfly/package.nix
+++ b/pkgs/by-name/bu/butterfly/package.nix
@@ -11,13 +11,13 @@
 
 flutter329.buildFlutterApplication rec {
   pname = "butterfly";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "LinwoodDev";
     repo = "Butterfly";
     tag = "v${version}";
-    hash = "sha256-ih+oADHEBB8fOt1Uoxc98BNr6BuoONnFNt8wHQxgpfA=";
+    hash = "sha256-/lwMKanoSM8oARBqQJ3hL23Z5sobLDwtL5RsxFgN5ew=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -26,15 +26,14 @@ flutter329.buildFlutterApplication rec {
 
   gitHashes = {
     dart_leap = "sha256-oO5851cIdrW/asgOePxvwUgjn1XchkH9CKJUruvlLYI=";
-    lw_file_system = "sha256-l04sXm9FXHF0ZUdQplnGoih483PczMQvlFF0r/UEuao=";
+    lw_file_system = "sha256-YWAInZw2FQzqGnopZr4oB1ZM5q0gjM65fvC4uhzl7gE=";
     networker = "sha256-/3jFIZj66hWbTcIQx9OB5QRrukcBT4zpek+56AVaGIA=";
     lw_file_system_api = "sha256-/Ur9zu4Ovb4x8j1n6Q6FWFuJ9yp92YQG3b7H5CMf3II=";
-    lw_sysapi = "sha256-OYVHBiAshYKRH/6BEcY+BXm9VIfSAFnFBOBWlQIO5Tc=";
-    material_leap = "sha256-l04sXm9FXHF0ZUdQplnGoih483PczMQvlFF0r/UEuao=";
+    lw_sysapi = "sha256-oGs5q8N46WNcRzbsgsPB/6fVBH3g9utK4tlXBpwU4Qc=";
+    material_leap = "sha256-AHkXi+ENvLmJBXyF8jdXOCn/CThb6/LDr18gl9sL0XE=";
     networker_crypto = "sha256-nI0luldloScjjix75kR5yOE1ZX8KFxMIC2N4whKlXUg=";
     networker_socket = "sha256-5y1oy0IYDs7nhiIx653vI5Gfh5jrVewkRFxB1mjxlE4=";
     perfect_freehand = "sha256-eBiid097rkF82n65Yg6a4VkKPv+70HIOYJT+9sCD//U=";
-    network_info_plus = "sha256-fOh/Qm7T65jDtckMTB3ZP2xT7UH6Wi/x5i61xXNbWac=";
     swamp_api = "sha256-ONaCXeMwEEHDvVmbo3o66O3CTCx4xGR3T5ZtSEwPvaw=";
     reorderable_grid = "sha256-g30DSPL/gsk0r8c2ecoKU4f1P3BF15zLnBVO6RXvDGQ=";
   };
@@ -54,7 +53,10 @@ flutter329.buildFlutterApplication rec {
           cat $src/app/pubspec.lock | yq > $out
         '';
     updateScript = _experimental-update-script-combinators.sequence [
-      (gitUpdater { rev-prefix = "v"; })
+      (gitUpdater {
+        ignoredVersions = ".*rc.*";
+        rev-prefix = "v";
+      })
       (_experimental-update-script-combinators.copyAttrOutputToFile "butterfly.pubspecSource" ./pubspec.lock.json)
     ];
   };
diff --git a/pkgs/by-name/bu/butterfly/pubspec.lock.json b/pkgs/by-name/bu/butterfly/pubspec.lock.json
index ce0cb1fe92b7..8e9c6ab8b4b2 100644
--- a/pkgs/by-name/bu/butterfly/pubspec.lock.json
+++ b/pkgs/by-name/bu/butterfly/pubspec.lock.json
@@ -14,11 +14,11 @@
       "dependency": "transitive",
       "description": {
         "name": "analyzer",
-        "sha256": "f4c21c94eb4623b183c1014a470196b3910701bea9b926e6c91270d756e6fc60",
+        "sha256": "904ae5bb474d32c38fb9482e2d925d5454cda04ddd0e55d2e6826bc72f6ba8c0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.4.1"
+      "version": "7.4.5"
     },
     "animations": {
       "dependency": "direct main",
@@ -34,11 +34,11 @@
       "dependency": "direct main",
       "description": {
         "name": "archive",
-        "sha256": "a7f37ff061d7abc2fcf213554b9dcaca713c5853afa5c065c44888bc9ccaf813",
+        "sha256": "2fde1607386ab523f7a36bb3e7edb43bd58e6edaf2ffb29d8a6d578b297fdbbd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.6"
+      "version": "4.0.7"
     },
     "args": {
       "dependency": "direct main",
@@ -197,7 +197,7 @@
         "relative": true
       },
       "source": "path",
-      "version": "2.3.0"
+      "version": "2.3.1"
     },
     "camera": {
       "dependency": "direct main",
@@ -213,21 +213,21 @@
       "dependency": "transitive",
       "description": {
         "name": "camera_android_camerax",
-        "sha256": "26673643ed8f4a468a81ebd7ca760bc1d8c4c741df6d731cc958585ac1983126",
+        "sha256": "9fb44e73e0fea3647a904dc26d38db24055e5b74fc68fd2b6d3abfa1bd20f536",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.15"
+      "version": "0.6.17"
     },
     "camera_avfoundation": {
       "dependency": "transitive",
       "description": {
         "name": "camera_avfoundation",
-        "sha256": "a33cd9a250296271cdf556891b7c0986a93772426f286595eccd5f45b185933c",
+        "sha256": "ca36181194f429eef3b09de3c96280f2400693f9735025f90d1f4a27465fdd72",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.18+14"
+      "version": "0.9.19"
     },
     "camera_platform_interface": {
       "dependency": "transitive",
@@ -313,11 +313,11 @@
       "dependency": "direct main",
       "description": {
         "name": "connectivity_plus",
-        "sha256": "04bf81bb0b77de31557b58d052b24b3eee33f09a6e7a8c68a3e247c7df19ec27",
+        "sha256": "051849e2bd7c7b3bc5844ea0d096609ddc3a859890ec3a9ac4a65a2620cc1f99",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.3"
+      "version": "6.1.4"
     },
     "connectivity_plus_platform_interface": {
       "dependency": "transitive",
@@ -404,11 +404,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "27eb0ae77836989a3bc541ce55595e8ceee0992807f14511552a898ddd0d88ac",
+        "sha256": "5b236382b47ee411741447c1f1e111459c941ea1b3f2b540dde54c210a3662af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.1"
+      "version": "3.1.0"
     },
     "dbus": {
       "dependency": "transitive",
@@ -424,11 +424,11 @@
       "dependency": "transitive",
       "description": {
         "name": "device_info_plus",
-        "sha256": "306b78788d1bb569edb7c55d622953c2414ca12445b41c9117963e03afc5c513",
+        "sha256": "0c6396126421b590089447154c5f98a5de423b70cfb15b1578fd018843ee6f53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.3.3"
+      "version": "11.4.0"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
@@ -610,11 +610,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_bloc",
-        "sha256": "1046d719fbdf230330d3443187cc33cc11963d15c9089f6cc56faa42a4c5f0cc",
+        "sha256": "cf51747952201a455a1c840f8171d273be009b932c75093020f9af64f2123e38",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.1.0"
+      "version": "9.1.1"
     },
     "flutter_driver": {
       "dependency": "direct dev",
@@ -790,11 +790,11 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "f02fd7d2a4dc512fec615529824fdd217fecb3a3d3de68360293a551f21634b3",
+        "sha256": "0b1e06223bee260dee31a171fb1153e306907563a0b0225e8c1733211911429a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.8.1"
+      "version": "15.1.2"
     },
     "graphs": {
       "dependency": "transitive",
@@ -810,11 +810,11 @@
       "dependency": "direct main",
       "description": {
         "name": "http",
-        "sha256": "fe7ab022b76f3034adc518fb6ea04a82387620e19977665ea18d30a1cf43442f",
+        "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.0"
     },
     "http_multi_server": {
       "dependency": "transitive",
@@ -986,8 +986,8 @@
       "dependency": "direct main",
       "description": {
         "path": "packages/lw_file_system",
-        "ref": "d5c41c874b0758cb8fb623cdd095c032f04f5740",
-        "resolved-ref": "d5c41c874b0758cb8fb623cdd095c032f04f5740",
+        "ref": "08f472ba88112647b4a7b94dff57d74ed897e062",
+        "resolved-ref": "08f472ba88112647b4a7b94dff57d74ed897e062",
         "url": "https://github.com/LinwoodDev/dart_pkgs.git"
       },
       "source": "git",
@@ -1008,8 +1008,8 @@
       "dependency": "direct main",
       "description": {
         "path": "packages/lw_sysapi",
-        "ref": "ebf47114a4d63fc06a6be0dbbfd5594ed82e7ee5",
-        "resolved-ref": "ebf47114a4d63fc06a6be0dbbfd5594ed82e7ee5",
+        "ref": "82ef4b4f68a18e55226b3030293e26c28b4964c2",
+        "resolved-ref": "82ef4b4f68a18e55226b3030293e26c28b4964c2",
         "url": "https://github.com/LinwoodDev/dart_pkgs.git"
       },
       "source": "git",
@@ -1049,8 +1049,8 @@
       "dependency": "direct main",
       "description": {
         "path": "packages/material_leap",
-        "ref": "d5c41c874b0758cb8fb623cdd095c032f04f5740",
-        "resolved-ref": "d5c41c874b0758cb8fb623cdd095c032f04f5740",
+        "ref": "792044f51747d7d078203904e460d4ef504a9db9",
+        "resolved-ref": "792044f51747d7d078203904e460d4ef504a9db9",
         "url": "https://github.com/LinwoodDev/dart_pkgs.git"
       },
       "source": "git",
@@ -1089,13 +1089,12 @@
     "network_info_plus": {
       "dependency": "direct main",
       "description": {
-        "path": "packages/network_info_plus/network_info_plus",
-        "ref": "9bd0c023f2dc209576dc66bf989048ba218127b6",
-        "resolved-ref": "9bd0c023f2dc209576dc66bf989048ba218127b6",
-        "url": "https://github.com/CodeDoctorDE/plus_plugins.git"
+        "name": "network_info_plus",
+        "sha256": "f926b2ba86aa0086a0dfbb9e5072089bc213d854135c1712f1d29fc89ba3c877",
+        "url": "https://pub.dev"
       },
-      "source": "git",
-      "version": "6.1.3"
+      "source": "hosted",
+      "version": "6.1.4"
     },
     "network_info_plus_platform_interface": {
       "dependency": "transitive",
@@ -1405,11 +1404,11 @@
       "dependency": "transitive",
       "description": {
         "name": "provider",
-        "sha256": "489024f942069c2920c844ee18bb3d467c69e48955a4f32d1677f71be103e310",
+        "sha256": "4abbd070a04e9ddc287673bf5a030c7ca8b685ff70218720abab8b092f53dd84",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.4"
+      "version": "6.1.5"
     },
     "pub_semver": {
       "dependency": "transitive",
@@ -1536,21 +1535,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "fce43200aa03ea87b91ce4c3ac79f0cecd52e2a7a56c7a4185023c271fbfa6da",
+        "sha256": "b2961506569e28948d75ec346c28775bb111986bb69dc6a20754a457e3d97fa0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.4"
+      "version": "11.0.0"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "cc012a23fc2d479854e6c80150696c4a5f5bb62cb89af4de1c505cf78d0a5d0b",
+        "sha256": "1032d392bc5d2095a77447a805aa3f804d2ae6a4d5eef5e6ebb3bd94c1bc19ef",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.2"
+      "version": "6.0.0"
     },
     "shared_preferences": {
       "dependency": "direct main",
@@ -1893,11 +1892,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_web",
-        "sha256": "3ba963161bd0fe395917ba881d320b9c4f6dd3c4a233da62ab18a5025c85f1e9",
+        "sha256": "4bd2b7b4dc4d4d0b94e5babfffbca8eac1a126c7f3d6ecbc1a11013faa3abba2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.1"
     },
     "url_launcher_windows": {
       "dependency": "transitive",
@@ -1993,11 +1992,11 @@
       "dependency": "transitive",
       "description": {
         "name": "web_socket",
-        "sha256": "bfe6f435f6ec49cb6c01da1e275ae4228719e59a6b067048c51e72d9d63bcc4b",
+        "sha256": "34d64019aa8e36bf9842ac014bb5d2f5586ca73df5e4d9bf5c936975cae6982c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0"
+      "version": "1.0.1"
     },
     "web_socket_channel": {
       "dependency": "transitive",
@@ -2023,11 +2022,11 @@
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "dc6ecaa00a7c708e5b4d10ee7bec8c270e9276dfcab1783f57e9962d7884305f",
+        "sha256": "329edf97fdd893e0f1e3b9e88d6a0e627128cc17cc316a8d67fda8f1451178ba",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.12.0"
+      "version": "5.13.0"
     },
     "win32_registry": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/ca/cantata/dont-check-for-perl-in-PATH.diff b/pkgs/by-name/ca/cantata/dont-check-for-perl-in-PATH.diff
index effb0f3b502c..3e1f1b83d0c8 100644
--- a/pkgs/by-name/ca/cantata/dont-check-for-perl-in-PATH.diff
+++ b/pkgs/by-name/ca/cantata/dont-check-for-perl-in-PATH.diff
@@ -1,17 +1,16 @@
 diff --git a/playlists/dynamicplaylists.cpp b/playlists/dynamicplaylists.cpp
-index 07b6dce3..6a3f97c9 100644
+index b85e93b5..3c29f775 100644
 --- a/playlists/dynamicplaylists.cpp
 +++ b/playlists/dynamicplaylists.cpp
-@@ -211,11 +211,6 @@ void DynamicPlaylists::start(const QString &name)
-         return;
-     }
+@@ -205,11 +205,6 @@ void DynamicPlaylists::start(const QString& name)
+ 		return;
+ 	}
  
--    if (Utils::findExe("perl").isEmpty()) {
--        emit error(tr("You need to install \"perl\" on your system in order for Cantata's dynamic mode to function."));
--        return;
--    }
+-	if (Utils::findExe("perl").isEmpty()) {
+-		emit error(tr("You need to install \"perl\" on your system in order for Cantata's dynamic mode to function."));
+-		return;
+-	}
 -
-     QString fName(Utils::dataDir(rulesDir, false)+name+constExtension);
+ 	QString fName(Utils::dataDir(rulesDir, false) + name + constExtension);
  
-     if (!QFile::exists(fName)) {
-
+ 	if (!QFile::exists(fName)) {
diff --git a/pkgs/by-name/ca/cantata/package.nix b/pkgs/by-name/ca/cantata/package.nix
index cb96570ca55b..db7fa65c00d3 100644
--- a/pkgs/by-name/ca/cantata/package.nix
+++ b/pkgs/by-name/ca/cantata/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
-  qt5,
+  qt6,
   perl,
 
   # Cantata doesn't build with cdparanoia enabled so we disable that
@@ -22,6 +22,7 @@
   taglib_1,
   taglib_extras,
   withHttpStream ? true,
+  gst_all_1,
   withReplaygain ? true,
   ffmpeg,
   speex,
@@ -33,7 +34,7 @@
   udisks2,
   withDynamic ? true,
   withHttpServer ? true,
-  withLibVlc ? false,
+  withLibVlc ? true,
   libvlc,
   withStreams ? true,
 }:
@@ -53,6 +54,14 @@ let
 
   withUdisks = (withTaglib && withDevices && stdenv.hostPlatform.isLinux);
 
+  gst = with gst_all_1; [
+    gstreamer
+    gst-libav
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+  ];
+
   options = [
     {
       names = [ "CDDB" ];
@@ -100,7 +109,7 @@ let
     {
       names = [ "HTTP_STREAM_PLAYBACK" ];
       enable = withHttpStream;
-      pkgs = [ qt5.qtmultimedia ];
+      pkgs = [ qt6.qtmultimedia ];
     }
     {
       names = [ "LAME" ];
@@ -153,13 +162,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cantata";
-  version = "2.5.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
-    owner = "CDrummond";
+    owner = "nullobsi";
     repo = "cantata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UaZEKZvCA50WsdQSSJQQ11KTK6rM4ouCHDX7pn3NlQw=";
+    hash = "sha256-4lkfY+87lEE2A863JogG5PtO5SyGn7Hb8shQljSqq3Q=";
   };
 
   patches = [
@@ -174,24 +183,29 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildInputs = [
-    qt5.qtbase
-    qt5.qtsvg
+    qt6.qtbase
+    qt6.qtsvg
+    qt6.qtwayland
     (perl.withPackages (ppkgs: with ppkgs; [ URI ]))
   ] ++ lib.flatten (builtins.catAttrs "pkgs" (builtins.filter (e: e.enable) options));
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    qt5.qttools
-    qt5.wrapQtAppsHook
+    qt6.qttools
+    qt6.wrapQtAppsHook
   ];
 
   cmakeFlags = lib.flatten (map (e: map (f: fstat e.enable f) e.names) options);
 
+  qtWrapperArgs = lib.optionals (withHttpStream && !withLibVlc) [
+    "--prefix GST_PLUGIN_PATH : ${lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst}"
+  ];
+
   meta = {
     description = "Graphical client for MPD";
     mainProgram = "cantata";
-    homepage = "https://github.com/cdrummond/cantata";
+    homepage = "https://github.com/nullobsi/cantata";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ peterhoeg ];
     # Technically, Cantata should run on Darwin/Windows so if someone wants to
diff --git a/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock b/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock
index d00f13df1877..81f594ba3082 100644
--- a/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock
+++ b/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock
@@ -1,7 +1,16 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
 
 [[package]]
 name = "chroot-realpath"
 version = "0.1.0"
+dependencies = [
+ "anyhow",
+]
diff --git a/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml b/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml
index 52348e7596e9..aeefcfa4b449 100644
--- a/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml
+++ b/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
+anyhow = "1.0.98"
 
 [profile.release]
 opt-level = "z"
diff --git a/pkgs/by-name/ch/chroot-realpath/src/src/main.rs b/pkgs/by-name/ch/chroot-realpath/src/src/main.rs
index 4e7873bf0798..140ad4aaf689 100644
--- a/pkgs/by-name/ch/chroot-realpath/src/src/main.rs
+++ b/pkgs/by-name/ch/chroot-realpath/src/src/main.rs
@@ -1,24 +1,26 @@
 use std::env;
-use std::io::{stdout, Error, ErrorKind, Write};
+use std::io::{stdout, Write};
 use std::os::unix::ffi::OsStrExt;
 use std::os::unix::fs;
 
-fn main() -> std::io::Result<()> {
+use anyhow::{bail, Context, Result};
+
+fn main() -> Result<()> {
     let args: Vec<String> = env::args().collect();
 
     if args.len() != 3 {
-        return Err(Error::new(
-            ErrorKind::InvalidInput,
-            format!("Usage: {} <chroot> <path>", args[0]),
-        ));
+        bail!("Usage: {} <chroot> <path>", args[0]);
     }
 
-    fs::chroot(&args[1])?;
-    std::env::set_current_dir("/")?;
+    fs::chroot(&args[1]).context("Failed to chroot")?;
+    std::env::set_current_dir("/").context("Failed to change directory")?;
 
-    let path = std::fs::canonicalize(&args[2])?;
+    let path = std::fs::canonicalize(&args[2])
+        .with_context(|| format!("Failed to canonicalize {}", args[2]))?;
 
-    stdout().write_all(path.into_os_string().as_bytes())?;
+    stdout()
+        .write_all(path.into_os_string().as_bytes())
+        .context("Failed to write output")?;
 
     Ok(())
 }
diff --git a/pkgs/by-name/ci/cider-2/package.nix b/pkgs/by-name/ci/cider-2/package.nix
index 3a66cd3c6a3d..3bb4747be8e9 100644
--- a/pkgs/by-name/ci/cider-2/package.nix
+++ b/pkgs/by-name/ci/cider-2/package.nix
@@ -7,12 +7,12 @@
 
 appimageTools.wrapType2 rec {
   pname = "cider-2";
-  version = "2.6.1";
+  version = "3.0.2";
 
   src = requireFile {
     name = "cider-linux-x64.AppImage";
     url = "https://cidercollective.itch.io/cider";
-    sha256 = "0qjhsssccxiq92zs04zhi53bkaf2qwfq7ryic1w9sha59ffyxqbf";
+    sha256 = "1rfraf1r1zmp163kn8qg833qxrxmx1m1hycw8q9hc94d0hr62l2x";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -42,7 +42,10 @@ appimageTools.wrapType2 rec {
     homepage = "https://cider.sh";
     license = lib.licenses.unfree;
     mainProgram = "cider-2";
-    maintainers = with lib.maintainers; [ itsvic-dev ];
+    maintainers = with lib.maintainers; [
+      itsvic-dev
+      l0r3v
+    ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/by-name/co/cobang/package.nix b/pkgs/by-name/co/cobang/package.nix
index 826bbe609b7b..1b8bacc1ce9a 100644
--- a/pkgs/by-name/co/cobang/package.nix
+++ b/pkgs/by-name/co/cobang/package.nix
@@ -18,14 +18,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cobang";
-  version = "1.6.2";
+  version = "1.7.1";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "hongquan";
     repo = "CoBang";
     tag = "v${version}";
-    hash = "sha256-M32bGVPOkbx93gDPQcin+Dv9P8zfx1Ory+DTJY+bypI=";
+    hash = "sha256-rBGz9g6+6jguJggBQKlyOWoME3VHOP8Gq4VtYywoVdI=";
   };
 
   # https://github.com/hongquan/CoBang/issues/117
diff --git a/pkgs/by-name/de/defuddle-cli/package.nix b/pkgs/by-name/de/defuddle-cli/package.nix
new file mode 100644
index 000000000000..871042e46e55
--- /dev/null
+++ b/pkgs/by-name/de/defuddle-cli/package.nix
@@ -0,0 +1,30 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+}:
+
+buildNpmPackage rec {
+  pname = "defuddle-cli";
+  version = "0.6.4";
+
+  src = fetchFromGitHub {
+    owner = "kepano";
+    repo = "defuddle-cli";
+    tag = "${version}";
+    hash = "sha256-28XmpFKzBKNhRkPOGaacJVw8hjQUZq2nwuR0vNo8aW0=";
+  };
+
+  npmDepsHash = "sha256-rRo+ty/E09OS+cWDnKQkROEdDc0hiB5g1h/+NbJe+/M=";
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Command line utility to extract clean html, markdown and metadata from web pages";
+    homepage = "https://github.com/kepano/defuddle-cli";
+    license = lib.licenses.mit;
+    mainProgram = "defuddle";
+    maintainers = with lib.maintainers; [ surfaceflinger ];
+  };
+}
diff --git a/pkgs/by-name/fe/feedbackd-device-themes/package.nix b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
new file mode 100644
index 000000000000..711e77962b09
--- /dev/null
+++ b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  meson,
+  ninja,
+  json-glib,
+  feedbackd,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "feedbackd-device-themes";
+  version = "0.8.3";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "agx";
+    repo = "feedbackd-device-themes";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-z+A2G1g2gNfC0cVWUO/LT3QVvXeotcBd+5UEpEtcPfY=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    json-glib # Provides json-glib-validate
+  ];
+
+  nativeCheckInputs = [
+    feedbackd # Provides fbd-theme-validate
+  ];
+
+  mesonFlags = [
+    (lib.mesonOption "validate" (if finalAttrs.doCheck then "enabled" else "disabled"))
+  ];
+
+  doCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  strictDeps = true;
+
+  meta = with lib; {
+    description = "Device specific feedback themes for Feedbackd";
+    homepage = "https://gitlab.freedesktop.org/agx/feedbackd-device-themes";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [
+      pacman99
+      Luflosi
+    ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fe/feedbackd/package.nix b/pkgs/by-name/fe/feedbackd/package.nix
index 80df650792dc..5092424b39e9 100644
--- a/pkgs/by-name/fe/feedbackd/package.nix
+++ b/pkgs/by-name/fe/feedbackd/package.nix
@@ -20,21 +20,13 @@
   dbus,
   gmobile,
   umockdev,
+  feedbackd-device-themes,
   nix-update-script,
 }:
 
-let
-  themes = fetchFromGitLab {
-    domain = "source.puri.sm";
-    owner = "Librem5";
-    repo = "feedbackd-device-themes";
-    rev = "v0.4.0";
-    hash = "sha256-kY/+DyRxKEUzq7ctl6Va14AKUCpWU7NRQhJOwhtkJp8=";
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd";
-  version = "0.8.1";
+  version = "0.8.2";
 
   outputs = [
     "out"
@@ -43,11 +35,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   src = fetchFromGitLab {
-    domain = "source.puri.sm";
-    owner = "Librem5";
+    domain = "gitlab.freedesktop.org";
+    owner = "agx";
     repo = "feedbackd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-J2BNDF9TyW+srW0pGbGt4/Uw4KPVf/Ke+HJVBldmfCA=";
+    hash = "sha256-Hd+kHLr+d1+mg9BbD1pCfVZuwmf7Hk02xmDTmR3foh4=";
   };
 
   depsBuildBuild = [
@@ -93,7 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir -p $out/lib/udev/rules.d
     sed "s|/usr/libexec/|$out/libexec/|" < $src/data/90-feedbackd.rules > $out/lib/udev/rules.d/90-feedbackd.rules
-    cp ${themes}/data/* $out/share/feedbackd/themes/
   '';
 
   postFixup = ''
@@ -111,10 +102,18 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  strictDeps = true;
+
   meta = with lib; {
-    description = "Daemon to provide haptic (and later more) feedback on events";
-    homepage = "https://source.puri.sm/Librem5/feedbackd";
-    license = licenses.gpl3Plus;
+    description = "Theme based Haptic, Visual and Audio Feedback";
+    homepage = "https://gitlab.freedesktop.org/agx/feedbackd/";
+    license = with licenses; [
+      # feedbackd
+      gpl3Plus
+
+      # libfeedback library
+      lgpl21Plus
+    ];
     maintainers = with maintainers; [
       pacman99
       Luflosi
diff --git a/pkgs/by-name/fu/furnace/package.nix b/pkgs/by-name/fu/furnace/package.nix
index f6364c9db281..1a30bce02c33 100644
--- a/pkgs/by-name/fu/furnace/package.nix
+++ b/pkgs/by-name/fu/furnace/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "furnace";
-  version = "0.6.8.1";
+  version = "0.6.8.2";
 
   src = fetchFromGitHub {
     owner = "tildearrow";
     repo = "furnace";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-R4yQqTPVNx5i9AeY06T0QdNN22ImLvD0bH96r5ojPLo=";
+    hash = "sha256-lhtuNYZySq5MHJiNIMNmUmGLjwE8696tpNyUoAvY94E=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index 34a157cec600..2f075b546bde 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -9,18 +9,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "4.2.10";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6ZOwAP6VB/uBrV6Yjc9jvzTNdfInekbLO/9PO57S9X8=";
+    hash = "sha256-mqwPCp7C5n2fOE8kgUnW3SYuuaY8ZkJtuhYXP4HevnM=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-uEyET3y8LfjTasaJ+Hl206/Q7ov69mA7oNa0mhgcUEQ=";
+    hash = "sha256-Jzwarti+WwKecWn3fPcF9LV+mbU22rgiTP7mslyoqRk=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index 83fe0368f370..b39900869faa 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -3,6 +3,7 @@
   python313,
   fetchFromGitLab,
   fetchFromGitHub,
+  fetchPypi,
   rustPlatform,
   callPackage,
   stdenv,
@@ -14,7 +15,19 @@ let
   python = python313.override {
     self = python;
     packageOverrides = final: prev: {
-      django = final.django_5;
+      django = final.django_5_2;
+      django-csp = prev.django-csp.overridePythonAttrs rec {
+        version = "4.0";
+        src = fetchPypi {
+          inherit version;
+          pname = "django_csp";
+          hash = "sha256-snAQu3Ausgo9rTKReN8rYaK4LTOLcPvcE8OjvShxKDM=";
+        };
+      };
+      django-ninja-cursor-pagination = prev.django-ninja-cursor-pagination.overridePythonAttrs {
+        # checks are failing with django 5
+        doCheck = false;
+      };
       symbolic = prev.symbolic.overridePythonAttrs rec {
         version = "10.2.1";
         src = fetchFromGitHub {
@@ -55,7 +68,9 @@ let
       django-import-export
       django-ipware
       django-ninja
+      django-ninja-cursor-pagination
       django-organizations
+      django-postgres-partition
       django-prometheus
       django-redis
       django-storages
@@ -87,14 +102,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "4.2.10";
+  version = "5.0.1";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EGk/mhDlqGrJm/j5rTKeKRkJ/fRTspwtPJ+5OHwplfM=";
+    hash = "sha256-vfsuJn6lpaesK40nqCdJMCDiaaqS1EdZdvgmy9jPuo8=";
   };
 
   propagatedBuildInputs = pythonPackages;
diff --git a/pkgs/by-name/gl/glpng/package.nix b/pkgs/by-name/gl/glpng/package.nix
index 30f274367e26..35fc6c6e4dc8 100644
--- a/pkgs/by-name/gl/glpng/package.nix
+++ b/pkgs/by-name/gl/glpng/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "glpng";
-  version = "1.46";
+  version = "1.47";
 
   src = fetchFromRepoOrCz {
     repo = "glpng";
     rev = "v${version}";
-    hash = "sha256-C7EHaBN0PE/HJB6zcIaYU63+o7/MEz4WU1xr/kIOanM=";
+    hash = "sha256-mwh0E8OZKBf6UcRScAeco8dfQ4LJ+7TG0IPuRi3Mzfc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 1138f7e9e390..a9dc1a5ce219 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -276,11 +276,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "136.0.7103.114";
+    version = "137.0.7151.41";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/iwktnyywqpn7dye3zjzgosvevq_136.0.7103.114/GoogleChrome-136.0.7103.114.dmg";
-      hash = "sha256-myJawlgVBQlLtgBfSfCL5XfdnH8d7xd+j8JV2+2MZ/s=";
+      url = "http://dl.google.com/release2/chrome/acracoudzvaateoc4hi5umv6pobq_137.0.7151.41/GoogleChrome-137.0.7151.41.dmg";
+      hash = "sha256-egOl4mjsIxjWxYTLI38U2LqrIs85+cmZG9oEXe/bF7Q=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/he/heatseeker/package.nix b/pkgs/by-name/he/heatseeker/package.nix
index 7843e5f8660e..4ae24b8f6aab 100644
--- a/pkgs/by-name/he/heatseeker/package.nix
+++ b/pkgs/by-name/he/heatseeker/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "heatseeker";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "rschmitt";
     repo = "heatseeker";
     rev = "v${version}";
-    sha256 = "sha256-SU5HLAFA7IHnVhsmVtxskteeKKIEvvVSqHIeEk5BkfA=";
+    sha256 = "sha256-ZKwRXtfIYEblsGjSSiVCl9XztM43rzBofQpPNGMPu+w=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1DquXOdtSGXSU9bYzSW1J3ElpUIYB71NVBcGxnREy/k=";
+  cargoHash = "sha256-X4OTzgInh0D+EYCPkN2qyizzhARIOGwxJ2N9ZcrX/Ak=";
 
   # https://github.com/rschmitt/heatseeker/issues/42
   # I've suggested using `/usr/bin/env stty`, but doing that isn't quite as simple
diff --git a/pkgs/by-name/he/helio-workstation/package.nix b/pkgs/by-name/he/helio-workstation/package.nix
index 1a229e61fca7..6da23268d0ec 100644
--- a/pkgs/by-name/he/helio-workstation/package.nix
+++ b/pkgs/by-name/he/helio-workstation/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation rec {
   pname = "helio-workstation";
-  version = "3.15";
+  version = "3.16";
 
   src = fetchFromGitHub {
     owner = "helio-fm";
     repo = "helio-workstation";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-SDK3lLcMCmxu1FwkPduNzlgmDU7LKitPqIvsr6rOYDc=";
+    hash = "sha256-JzJA9Y710upgzvsgPEV9QzpRUTYI0i2yi6thnUAcrL0=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ic/icewm/package.nix b/pkgs/by-name/ic/icewm/package.nix
index af4beddf775d..78343cb0a49d 100644
--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.7.4";
+  version = "3.7.5";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     tag = finalAttrs.version;
-    hash = "sha256-lrYMx7UlVXQg6HlyajuxpV9liHXka0K/pJLrquTX2XQ=";
+    hash = "sha256-YGEgAO/H21yfv75LnCKYqCRtQtV6bqA7HRFXxDIll/c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index b7481d859cb0..65415a7751b4 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -60,7 +60,7 @@ let
 
     extraInstallCommands = ''
       wrapProgram $out/bin/joplin-desktop \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
       install -Dm644 ${appimageContents}/joplin.desktop $out/share/applications/joplin.desktop
       install -Dm644 ${appimageContents}/joplin.png $out/share/pixmaps/joplin.png
       substituteInPlace $out/share/applications/joplin.desktop \
diff --git a/pkgs/by-name/la/lact/package.nix b/pkgs/by-name/la/lact/package.nix
index 85a5c338e4c9..8da5d876e930 100644
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -3,71 +3,117 @@
   rustPlatform,
   stdenv,
   fetchFromGitHub,
-  blueprint-compiler,
   pkg-config,
   wrapGAppsHook4,
   gdk-pixbuf,
   gtk4,
   libdrm,
+  ocl-icd,
   vulkan-loader,
+  vulkan-tools,
   coreutils,
+  systemdMinimal,
+  nix-update-script,
+  hwdata,
+  fuse3,
+  autoAddDriverRunpath,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lact";
-  version = "0.6.0";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "ilya-zlobintsev";
     repo = "LACT";
-    rev = "v${version}";
-    hash = "sha256-goNwLtVjNY3O/BhFrCcM3X11dtM34XgfHL6bh+YFoIY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zOvFWl78INlpCcEHiB3qZdxPNHXfUeKxfHyrO+wVNN0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rgpBmoGCNMU5nFVxzNtqsPaOn93mHW5P2isKgbP9UN4=";
+  cargoHash = "sha256-10FdXUpLL+8xN818toShccgB5NfpzrOLfEeDAX5oMFw=";
 
   nativeBuildInputs = [
-    blueprint-compiler
     pkg-config
     wrapGAppsHook4
+    rustPlatform.bindgenHook
+    autoAddDriverRunpath
   ];
 
   buildInputs = [
     gdk-pixbuf
     gtk4
     libdrm
+    ocl-icd
     vulkan-loader
+    vulkan-tools
+    hwdata
+    fuse3
   ];
 
-  checkFlags = [
-    # tries and fails to initialize gtk
-    "--skip=app::pages::thermals_page::fan_curve_frame::tests::set_get_curve"
-  ];
+  # we do this here so that the binary is usable during integration tests
+  RUSTFLAGS = lib.optionalString stdenv.targetPlatform.isElf (
+    lib.concatStringsSep " " [
+      "-C link-arg=-Wl,-rpath,${
+        lib.makeLibraryPath [
+          vulkan-loader
+          libdrm
+        ]
+      }"
+      "-C link-arg=-Wl,--add-needed,${vulkan-loader}/lib/libvulkan.so"
+      "-C link-arg=-Wl,--add-needed,${libdrm}/lib/libdrm.so"
+    ]
+  );
 
   postPatch = ''
     substituteInPlace lact-daemon/src/server/system.rs \
       --replace-fail 'Command::new("uname")' 'Command::new("${coreutils}/bin/uname")'
+    substituteInPlace lact-daemon/src/server/profiles.rs \
+      --replace-fail 'Command::new("uname")' 'Command::new("${coreutils}/bin/uname")'
+
+    substituteInPlace lact-daemon/src/server/handler.rs \
+      --replace-fail 'Command::new("journalctl")' 'Command::new("${systemdMinimal}/bin/journalctl")'
+
+    substituteInPlace lact-daemon/src/server/vulkan.rs \
+      --replace-fail 'Command::new("vulkaninfo")' 'Command::new("${vulkan-tools}/bin/vulkaninfo")'
 
     substituteInPlace res/lactd.service \
       --replace-fail ExecStart={lact,$out/bin/lact}
 
-    substituteInPlace res/io.github.lact-linux.desktop \
+    substituteInPlace res/io.github.ilya_zlobintsev.LACT.desktop \
       --replace-fail Exec={lact,$out/bin/lact}
+
+    # read() looks for the database in /usr/share so we use read_from_file() instead
+    substituteInPlace lact-daemon/src/server/handler.rs \
+      --replace-fail 'Database::read()' 'Database::read_from_file("${hwdata}/share/hwdata/pci.ids")'
   '';
 
   postInstall = ''
     install -Dm444 res/lactd.service -t $out/lib/systemd/system
-    install -Dm444 res/io.github.lact-linux.desktop -t $out/share/applications
-    install -Dm444 res/io.github.lact-linux.png -t $out/share/pixmaps
+    install -Dm444 res/io.github.ilya_zlobintsev.LACT.desktop -t $out/share/applications
+    install -Dm444 res/io.github.ilya_zlobintsev.LACT.svg -t $out/share/pixmaps
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ vulkan-tools ]}"
+    )
   '';
 
   postFixup = lib.optionalString stdenv.targetPlatform.isElf ''
-    patchelf $out/bin/.lact-wrapped --add-needed libvulkan.so --add-rpath ${
-      lib.makeLibraryPath [ vulkan-loader ]
+    patchelf $out/bin/.lact-wrapped \
+    --add-needed libvulkan.so \
+    --add-needed libdrm.so \
+    --add-rpath ${
+      lib.makeLibraryPath [
+        vulkan-loader
+        libdrm
+      ]
     }
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Linux GPU Configuration Tool for AMD and NVIDIA";
     homepage = "https://github.com/ilya-zlobintsev/LACT";
@@ -75,8 +121,10 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [
       figsoda
       atemu
+      cything
+      johnrtitor
     ];
     platforms = lib.platforms.linux;
     mainProgram = "lact";
   };
-}
+})
diff --git a/pkgs/by-name/le/learn6502/missing-hashes.json b/pkgs/by-name/le/learn6502/missing-hashes.json
new file mode 100644
index 000000000000..aaf3219ba641
--- /dev/null
+++ b/pkgs/by-name/le/learn6502/missing-hashes.json
@@ -0,0 +1,81 @@
+{
+  "@esbuild/aix-ppc64@npm:0.25.0": "468ba76b20f43118a11fd589ef162ff12c3c9f988a861045cc421b3100f9ade27103a0743fa9e9882c54dfe2ec647ca9b209cfc17ef61b5c9bc48be95e5856c1",
+  "@esbuild/aix-ppc64@npm:0.25.2": "e25252d47d27d5e15a09ba7e7e906fe35d90a363e1eec7bc1e054c066bea6f89364139385008f78e8b4523ebaecb1f7a678213c8fcc2cd0309d539bbc455fd05",
+  "@esbuild/android-arm64@npm:0.25.0": "599fcb6b815a9bc8f83687663653c15ceb1c0f9ea0587da03976972281cd040c23b551a9f772d459809c22f7e218e04f1b159f8da1298b9c79b822f5636eff59",
+  "@esbuild/android-arm64@npm:0.25.2": "b387ab30ec70902c81ca1231a7838ccc993ad8dff9561a5ec7d7d4e5f03426153d42e496985a02539bce55f6d1048156f36e24a29f61fa5fd8e0587f62696703",
+  "@esbuild/android-arm@npm:0.25.0": "ff6124350b732afe0f59087d5a50afb0c05d0d3951b4fc0f7c52c19ccacef504d7998217d8d7594dcfd4872748350a49ba611e8f2de3fe9e47a3df4393cb67eb",
+  "@esbuild/android-arm@npm:0.25.2": "8e7efb22407ad9a985ff5a09dc0d2b895126c6ccca470db671ca0a3e3026f79666af20ce5d296311f5d056e95ca71e743feeae526f94dcaacb5a6969f9963283",
+  "@esbuild/android-x64@npm:0.25.0": "7015f561e36c4fe142a4047184776344def5f25369c0bce8abd1de3d623d84cf7ddc09e5f7bac8294a8aea457ec23414e169648579382e6fd1aa39590ffe6e01",
+  "@esbuild/android-x64@npm:0.25.2": "66256eee6168c2f903c45c82863f1377f525dc7de0fc902fca412a44d0abbb8a25761fb9e10c8663b25b0f816d86b7e353d2b77ab39eae95234333f9d233ddc4",
+  "@esbuild/darwin-arm64@npm:0.25.0": "ba18b48c2c652a930a436a872b40cb0999fc0c4788dcda908f467d47555b080043e9ba1f9a7f080eb8d91ea8a3a399216aeea95539829a58885c412131025597",
+  "@esbuild/darwin-arm64@npm:0.25.2": "36a568a779000133d077e2272181232f52939c3e0b0b986ad3f3fd6ab29628c148e88cd857f6de41a16e22e6a252bb16680f91c00c7d813690fa9bc060f58386",
+  "@esbuild/darwin-x64@npm:0.25.0": "83470576dc815364e8f2a6f2ed9c62496fa8112ee4905ccc3b142e36d28c9c90310ad179055d87e2e880e1bf9a3be0e9eb2129d6a88fdacf38181bfab6cf75c0",
+  "@esbuild/darwin-x64@npm:0.25.2": "b761a20f8db7bf0499f6cba51c72104e733d9186d6f34a7f5e4590c02ecc2f9b84cd02c4e7bd3dade4156b7f92015cdbddc516dd1e4859233e3155cb0fecda58",
+  "@esbuild/freebsd-arm64@npm:0.25.0": "646f3abba09e87c4555359200af913bbda9fac43629f6ade6adefdbd0d915707a375314e1d25ed0d951e6024d7d19fe0ecdd10caf4ff6177f3f6450e7132a6a9",
+  "@esbuild/freebsd-arm64@npm:0.25.2": "8f869d6200dba388ac4c008c7a5b6522f44797370a12f94fd19e37b6cd76bdbdf48d0fa893b5ce200a538a151281e9f71e985f82ec8b8c96f16075e45266c718",
+  "@esbuild/freebsd-x64@npm:0.25.0": "4b769e23981e5ec010f9c4670b1194e26e8bf98cc0bb70962fe8c160da508b40561c0b97911072c5de82954a4164af9d885e45e597e39ae379b5cad2d0a8c69e",
+  "@esbuild/freebsd-x64@npm:0.25.2": "6cdfb6c6d6f6ead324a9ee75ab1068305672207cf1d3189bcf5599ec158e0eb07d74ff63597e389777163b4399da1cc6164b918a7ea9e798e7fd45eee6aad9bb",
+  "@esbuild/linux-arm64@npm:0.25.0": "508ca15315c4d7b7db28fc8e17247ebe5c816c270496d1354f0d97baafdf774ec055c2d9ac51e06fb02fed93ce4f94d109b92fe80a62e42bf51a2c5046fc76c8",
+  "@esbuild/linux-arm64@npm:0.25.2": "a0d51ec6e91e97461916eb6c25b12a8ea6b58ec2f3d91199c0c3f02ec569e98ff1389700250d4664d8394d3d5b5a051d695b34bfe77ab4a12985dfc18f315b73",
+  "@esbuild/linux-arm@npm:0.25.0": "3756d3974f5b5a6453f2ece2fa012f530b32b6af78cc0b6466bf0582b3da718803dae41bdb5cc4cdc360882bd791b63bb79e5f4a6f8c44ee053fc93b8dd6ea7f",
+  "@esbuild/linux-arm@npm:0.25.2": "5a4cf4045a2a5949dc8875dbad9a82fde7333d3f59b66d8cb614b34b76a7fb715a8d74e41f0788104bcef0436108ca548d71a543f582073e0458e20370dbb802",
+  "@esbuild/linux-ia32@npm:0.25.0": "d220829704167772688a93568738d0887fc45d88cce7a4f2e4de992f161e9aa679294bfdf2dd3d70fa6549b548a023d98a90f19270cd8ebd5b365efe04b7027c",
+  "@esbuild/linux-ia32@npm:0.25.2": "535c1755ed95a47b05b865361d2efbef3490f05815743c0d2372f55a2e14f0cc1d5ed6e5dd6f91c7aea871ea2f64cea021eea6e714027148489c54edc6e2b19f",
+  "@esbuild/linux-loong64@npm:0.25.0": "e7f1a54ea77c9307f54d7172a03b1e77ec18b3f6622077fe3dcb4d53435ea47fc60e82b9da7b8efe375c0e46f4c07169686262af2eaea6557cf033c973f6fbcd",
+  "@esbuild/linux-loong64@npm:0.25.2": "8ff82f5cdd7a9490dfb3be64c990841d2a8e1a0ce83d76fa8d5e9b0ba7aa91ca725f338ff43b4d69a18744905f1730adf87a7f8359ae839030663e0bbe2807e2",
+  "@esbuild/linux-mips64el@npm:0.25.0": "d51dc06bc3da38fb046986019c6b1a8aa1b43a835089f1f8d8ce4242c9417e1d3d25fa593708cd61f66f8665be27829316b37ecf9e08dc48718aacc00608aac1",
+  "@esbuild/linux-mips64el@npm:0.25.2": "382520bf655329d04f65e041f9bf774d11a2232bdf5125934732db915c179b1172ec3429722d9f02f46ee5bad7b70372872bfd003d7c1cc5ec95b7ca6ec8a983",
+  "@esbuild/linux-ppc64@npm:0.25.0": "a19514e5b21c5f70e6b5b6ccdacb09922e9c397e80e3b1ac8e55ed283f9f3a5325a9e4dcf284d033954f3c51a88411fa95473c83b2b69990e02e351fa971b63f",
+  "@esbuild/linux-ppc64@npm:0.25.2": "c5736195867e9c441cabd0a2cbaa62f91c4e4963ed7490018d09a932d549e1d281411ddf9dbd4a4b68f0c0298c1321ba15fd4e493cdc3dea3e14b7a6207b12f8",
+  "@esbuild/linux-riscv64@npm:0.25.0": "4b275bb4d2442a68b62a93926a4da04bde06795fc7f5719555c7a9d2cf0e8a2cd6a50c0e574f1285e55e126f0be29cf6017d829c571c2fb31728fb1961c45f70",
+  "@esbuild/linux-riscv64@npm:0.25.2": "c72879775daded232fb2e36a6fe26058ec1ccd1f5dd6a76b4e8da700c6dd20cb15b684bce34569cadd41f25a0a53bd2037994279856bb3148f8c16055adcaf68",
+  "@esbuild/linux-s390x@npm:0.25.0": "7bd0fefc75c72d6d657aa9fec2322f1b8744936fc77da7e32027f0f1aff4b5fdaa8ae19a060fa4d465a79f14e13a4e10f3eeaf1ca64dc4c3cf08494b3e26100b",
+  "@esbuild/linux-s390x@npm:0.25.2": "d8810561312c4c7705f3c580ef8cd38e2768feb19ebf2899595a227f59dfb6ca35182f8ad7ca65d503cc5d9c688fe742002243387aa09b98b8c32aabc522ac4e",
+  "@esbuild/linux-x64@npm:0.25.0": "f9562d7e1d25b9a69faa40aaa7dd607b820836f88733b26b27a48b14b8a526cc5ec033c1869386419bd609c96442974c339ccbb03b4a23ea205927b2243d3b6c",
+  "@esbuild/linux-x64@npm:0.25.2": "32c8a5f7d0640655ebf60f379ee2b037fe83f3f0edad911a9098505e6ac589c5f2873ff441017183626a19d334e3bb59f58411f2d5474eb7222917575593abea",
+  "@esbuild/netbsd-arm64@npm:0.25.0": "4f2502bbcf5967cf2a07c712f9fd87a0ec1e60356ea115dc8b69ea7364e88edae5758bb7cba4049065bb8e78d69d0f6bce09f42f146a50b2dcc6069e14ba66d5",
+  "@esbuild/netbsd-arm64@npm:0.25.2": "0b7f77ec46163feac839b17b94e7db87edf61441bd9a67115722bf72781021c8220576a2e2c70bbca45b89a1e69a6b132f5489b59e84241b197272c1ee080304",
+  "@esbuild/netbsd-x64@npm:0.25.0": "82e3e256ac495620890867e85b63f4327e3f5cd5876c868dd4690094c7e4c233bc2359835e512443b8a44f44fc15d98ef3e63914efae8128d3a348d0ebaa66ec",
+  "@esbuild/netbsd-x64@npm:0.25.2": "6d6686f5d2eb79b042bd4f38dc95e73a8e290a057be1b6afc42867830c9cf2313600b4fd53287f2f418c9f454bf5df02154b16dcfbfc33a6eb2ce9722a4eecc1",
+  "@esbuild/openbsd-arm64@npm:0.25.0": "6c8de60d94a53fa4c37f7cbfca04baf06a14bb4b4360ab711b2235ec33b624e268cd39aad84382648eabae4db5727495806221211d663c36f1710579f504f967",
+  "@esbuild/openbsd-arm64@npm:0.25.2": "8a08c16440c6389623bbacb717412635aff61a1552c917e707d71da1dc92c618eea9a9aa1606a4a4f322216f100ede658523baec2e82b1f11b4efd523d491173",
+  "@esbuild/openbsd-x64@npm:0.25.0": "ed2beae58658aa2146a9cae2152a38f52f34e2dd929e79a298f8ce4b3c2c6fcf8e2ac98b458fb0fe5baf87c08df12b162c74b52b4c95f5f54f5a073da1668ebe",
+  "@esbuild/openbsd-x64@npm:0.25.2": "43baf3248bb460e169cb1b5f26f5eb720088fa0d467c77f4f72c6cfa8e6d7b7794c52ed5e4a9a2113db53313c5fec86e352c94939abf601ab22d5e6e9addc4e5",
+  "@esbuild/sunos-x64@npm:0.25.0": "9a0d0569ea65171983b0daadbf8ec6dd31341db7bee50fc4c2b85521eb09ff7597279d9dda4b4f25c3bfd6f4f77d558b6a6f36dcfb6794e7fc2177df9770a17e",
+  "@esbuild/sunos-x64@npm:0.25.2": "0babbb99d3bc3ed818b2b01fbf65ebbf5930defb850e5a5a94a3ba5fc7bc2463d561c07af0d3ac6d6d0197c86682750ceb47abf7d293dd3222b1bd33da9f8aa5",
+  "@esbuild/win32-arm64@npm:0.25.0": "5484d8ad74479f8cc8c7b5d14d5f8ced3e50d6ef7fc12a45406ae6c6e5199784267bfccbe0173b598c1b512ea20ecd5de20579cf04d3e07848df3db7ccffd8e6",
+  "@esbuild/win32-arm64@npm:0.25.2": "205aab6fc7b0ca7ee992cd24d73550110c1f79dc2ca724384bb52aa95111248df022375cd648314bd7eeb42083d576c55572f3d39d4ddcd82fc7372f1e7688b0",
+  "@esbuild/win32-ia32@npm:0.25.0": "206eb14fd607c5a5116a49eaf4ed3ca7c34c0372729d7d34aa07bbc2a5792afabfd62873212213b17607165bd4ecbe4366066de0ddedd50a46a27a3c5cb830e5",
+  "@esbuild/win32-ia32@npm:0.25.2": "aa38c0e082e3111e84929a64638cce1c3e1114218726e41c99bf239f2c05be94fb6fe1083366aa342bbd8e75fd449a6a3bcae9b6b3b84066a3a3882dcbaa0090",
+  "@esbuild/win32-x64@npm:0.25.0": "a129e6ad07bbcc791fda365e71634aa45cf3989ded1f05ed1ecb99efa625b09081ef410d236fdd279037d001f2e5e5049c98bfbe6a2242c818463222df85cc54",
+  "@esbuild/win32-x64@npm:0.25.2": "2f2d147c610a3c3ab0f0f97132e4421464d3d38b835d989e8c324b7397e2592cd05485ec1998ae352f06d3191dd1d71c24f94f63f7c70cd8ea8a4c85441502a9",
+  "@rollup/rollup-android-arm-eabi@npm:4.34.8": "1d21d3ba13ed2cff8b4955b9d7c5fb91fa954be9cdd8f4e5bedc4e1d95733af3249bb7f3f000b9c69e89128a9439bb35990fd5c737372bc9b7fdbea906ac63dd",
+  "@rollup/rollup-android-arm64@npm:4.34.8": "b3c44e5aaab2b429716d58b93353b0429a131a0b7e08ee39f25ceca1faf3cc453346c9cb91dd1cc278eb5621fb701da87608cc3ce323c24d5f3d191781694ec3",
+  "@rollup/rollup-darwin-arm64@npm:4.34.8": "a117920a3f06b6fb3e57f3a240a38ea3184811f931105185942e1cb9865d609662e3849ee53bdf7265d4555b9c9d2b6723fb4c94a9b1e494b522253246767b72",
+  "@rollup/rollup-darwin-x64@npm:4.34.8": "70862e22270122f61690fcf69f07a32f3cce9028c7c296cc6a37bd5ae2fe2e021cf86df877274acf07a927889faf3ffc8721871d749087ea86941853c66a1f27",
+  "@rollup/rollup-freebsd-arm64@npm:4.34.8": "42e5a9a8fb20585ee5fc1a94f758fdfe4d1dde03a4f6476686b1a8835167e2e210192fb8ffd733dd12baaec928a3fc753bf05609798df99bb4d8b2f6ea44f997",
+  "@rollup/rollup-freebsd-x64@npm:4.34.8": "984baffa0968907090146b0237697ee76b64eb18dbde512304e83d793030f2cec01bb08658ccb2e12ff6ecd88dccc4886acaaf8117345e564c9b7752c20a7d51",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.34.8": "3a7fe8a7c80608ee54bc2c5b40424b15b0a3da8ec8201e3303f56bedbf3a34f8446b9968da849705373c02c3bd35c56ca22117c3549c8968b2cd1ad54f2d82ed",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.34.8": "27fbc7ec1a8ac9d44661d4024d704bc1af8c257bd454b3b56cbcf43afe60a617ac4dec50e6c5906a07945d2bed60c8d44b972aee9f53186b24b7df2b9c99e3f3",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.34.8": "7ce7073fa830540fc67616b44b3155bacfe84463268ba948aa68719a197684da4ef60882ac1623d168597c3178f936262386de67425c60d645bf66eabf743351",
+  "@rollup/rollup-linux-arm64-musl@npm:4.34.8": "1acb2a29e1a190c2df27c5e1a30424f22ca98dd5c4e12c2103e2810659c95b8e027b5b34dd0127e55b8c818bb28c49dfc9fe6586c508f85b98350ded6bb60717",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.34.8": "50c416ca41ed0df3d54ccf11c7e5487c64f9e2fee97deb21741086c61a99007ee3dc011d34a6261a3d32cff3f46483bce930ae92e96d54abe607576095bc3906",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.34.8": "b80e0473848b7d26ab845368e75fd834f71fe6b03f1753450a9c521fe99024a5caa40a85ce8bce1bce079971b31dc2266c718e05ff950143f98a3310944863f4",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.34.8": "1efd1e6142b2bbaa986f5c9edc1caee98f3fbd18160da02fd6c05b324b683eec0d8a9b0d4525b67de70873375988d1a4986dfdaf94ec847d9f30a82e5bac1bcd",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.34.8": "d536c327ad26cf9ad586ad68e146f4cbd64b6bb1daf146f8124f6257f70f42e1d05e37afab902f97049cf8d0b7e60458480a8cf2e49379f1efa1568ac13f6107",
+  "@rollup/rollup-linux-x64-gnu@npm:4.34.8": "9c8e0c8ae968e8400641d782d7cb0b9b06cdec0c0a366c20259e49da0984ffea2a6af15de3e1fdfc92c1906a97044ea676195b945750848c8ddf34abf675eebf",
+  "@rollup/rollup-linux-x64-musl@npm:4.34.8": "994b3a904c79fa72a3c331c983c27296ebb302b08f6c624ecbbf91cfa136f03cbdad4be904fd1a80b44d521e49399aff6e7902b594146a8c73cb6d1ad13dce08",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.34.8": "5d09e6b59d1b08bb85922170aad0b8ada8bff7a5d63bed3b1ba49d4bbe32fd2557527d85c1bb97bf8d7f20778c2266b35c86bb4b0c035835099a3f6b222bc26c",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.34.8": "d4817c6e0744f2a53c24ea6855ed061fb03437fa0187f86363768d0edffc7e1bd281f9003e684779ac5662627daab1f2816084a257a13ade5bc0fd7e63912d94",
+  "@rollup/rollup-win32-x64-msvc@npm:4.34.8": "47679da18b7676a91d123a73298047fca019b4a9dfc4e026c43ba0dfea763ed972a9ce0cd46766317af45ef4d2a09cccc6284c4226a006b05d2e6fb712dad29c",
+  "lightningcss-darwin-arm64@npm:1.29.3": "599581a267d180e23c3a08652666a62c1a47b2c7d2cff892f22675a3705886f728c596c7fe51867649736b15ac29a79cb97d7aba58a9fd8c75b3cb73d10a8c85",
+  "lightningcss-darwin-x64@npm:1.29.3": "c9868e863c72d8e60edbb21c88146928da1ad89e8a6f642ec8cc14d20b1d623961270707a94bca0332ef3d2b57d3ef8346523ec619b587db655d204341677ced",
+  "lightningcss-freebsd-x64@npm:1.29.3": "f04a9f4b401db4879134c6b7e96c56301f485fb0c65bc2ef753d89e3ba40c5eeefdc006cd4787e5a40efb7409555a400f469898133ad7d947a09eb5bfa20f9c0",
+  "lightningcss-linux-arm-gnueabihf@npm:1.29.3": "2ebd119afe472d0e43bcb530fa87a23124716f9134d34b03b73ff71a0b145d39c350780ab630b0dbdafdd420b08159dc3f672623099c07b072417c5c8216c18f",
+  "lightningcss-linux-arm64-gnu@npm:1.29.3": "617df6a4bf3f76db3e2ed826120ecfc81db270947a785db57a63633a9e14e7e8d55e2e35adabb3ef98db4a5f572b7a2eadcf31f93ae08182e949480f9c1c9c83",
+  "lightningcss-linux-arm64-musl@npm:1.29.3": "f31c4f11fafee941f7077df9a7669f4eb7e299f0ef8e194b6fbe91d4847fe90dcb16eff5b245520bc56e1486377ff95a2a53dfdb5cb36fd0d4aeb1828b7b53e3",
+  "lightningcss-linux-x64-gnu@npm:1.29.3": "95872955cdc86a3401e36a7871a050e84908b27c1809277c2f86e3bb8fc5ba10d11c442f0df6c6ba5a5b2ec64ffeffd1b941135d515e8b37d873ce342a0a7f2c",
+  "lightningcss-linux-x64-musl@npm:1.29.3": "6dc4817256841b7b98da88833c9575d87339f6c3b56d16b25cef0eddbe3b03cb7d12121187a1ac4443d6b5f52161bb6177a50e017a86d320278e7524b4394179",
+  "lightningcss-win32-arm64-msvc@npm:1.29.3": "64ed3c716814064ef13f804468dc4def41f86695b0131fb8fa1cfd295036b885ca92122e488758c8ff88feb61e5a8ce05371281cb18e3d77b92abeb434d61857",
+  "lightningcss-win32-x64-msvc@npm:1.29.3": "84b8711c3371d96d096c826cbfca21d253bc4de6f40afec951f64a457154feeed8c57fcca9835977c907b208015b0635b035c5a0fbb78852947e4f8f6bfc5806"
+}
diff --git a/pkgs/by-name/le/learn6502/package.nix b/pkgs/by-name/le/learn6502/package.nix
new file mode 100644
index 000000000000..f11969aa70bb
--- /dev/null
+++ b/pkgs/by-name/le/learn6502/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  yarn-berry_4,
+  nodejs,
+  meson,
+  ninja,
+  blueprint-compiler,
+  gtksourceview5,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  pkg-config,
+  writableTmpDirAsHomeHook,
+  gjs,
+  libadwaita,
+  nix-update-script,
+}:
+
+let
+  yarn-berry = yarn-berry_4;
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "learn6502";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "JumpLink";
+    repo = "Learn6502";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2c8dUhxCNaDlvQlYwqebfAAlClrnJpGFs9EukdiVgy0=";
+  };
+
+  missingHashes = ./missing-hashes.json;
+
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-nbahJ+nwpHVvw8pCqhg1W+4lmgSH7o7BjjhujF7yyQs=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarn-berry.yarnBerryConfigHook
+    meson
+    ninja
+    blueprint-compiler
+    wrapGAppsHook4
+    desktop-file-utils
+    pkg-config
+    writableTmpDirAsHomeHook
+    gjs # gjs-console
+  ];
+
+  buildInputs = [
+    gjs
+    gtksourceview5
+    libadwaita
+  ];
+
+  strictDeps = true;
+
+  # yarnBerryConfigHook needs to run in the yarn.lock directory
+  postConfigure = ''
+    pushd ..
+  '';
+
+  # meson needs to enter the subdirectory
+  preBuild = ''
+    popd
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Modern 6502 Assembly Learning Environment for GNOME";
+    homepage = "https://github.com/JumpLink/Learn6502";
+    mainProgram = "eu.jumplink.Learn6502";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+})
diff --git a/pkgs/by-name/li/lifeograph/package.nix b/pkgs/by-name/li/lifeograph/package.nix
index 7e26c1ddfbca..440f1d92cd76 100644
--- a/pkgs/by-name/li/lifeograph/package.nix
+++ b/pkgs/by-name/li/lifeograph/package.nix
@@ -16,12 +16,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lifeograph";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchgit {
     url = "https://git.launchpad.net/lifeograph";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tcq1A1P8sJ57Tr2MLxsFIru+VJdORuvPBq6fMgBmuY0=";
+    hash = "sha256-eb31/ncGH5+Wz1vPCHeEFP1AiKe29rAOg5SL2cjabCc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lo/lobster/package.nix b/pkgs/by-name/lo/lobster/package.nix
index 31c69279915a..bc20e8e21f42 100644
--- a/pkgs/by-name/lo/lobster/package.nix
+++ b/pkgs/by-name/lo/lobster/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lobster";
-  version = "2025.1";
+  version = "2025.2";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "lobster";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ia/xPyPX5lwSkiFCsJ48baCfxv6z6jL5/CIMVRWo/og=";
+    sha256 = "sha256-F6py2zhNk88PUGxjWim+LHVTOpYHViV7d70LV77QgdU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mc/mcat-unwrapped/package.nix b/pkgs/by-name/mc/mcat-unwrapped/package.nix
new file mode 100644
index 000000000000..9732a5dfd3ab
--- /dev/null
+++ b/pkgs/by-name/mc/mcat-unwrapped/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mcat-unwrapped";
+  version = "0.2.8";
+
+  src = fetchFromGitHub {
+    owner = "Skardyy";
+    repo = "mcat";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XvZBikp+Q/pe80eOTQj2rKZ14kXEUBjIroWsh8xmr8A=";
+  };
+
+  cargoHash = "sha256-DIvKCPyqD82IgOqs7+fsAz3sj5IkXacxfZOttSEQ1aA=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "cat command for documents / images / videos and more!";
+    homepage = "https://github.com/Skardyy/mcat";
+    changelog = "https://github.com/Skardyy/mcat/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "mcat";
+    maintainers = with lib.maintainers; [
+      louis-thevenet
+    ];
+  };
+})
diff --git a/pkgs/by-name/mc/mcat/package.nix b/pkgs/by-name/mc/mcat/package.nix
new file mode 100644
index 000000000000..9af71573fb08
--- /dev/null
+++ b/pkgs/by-name/mc/mcat/package.nix
@@ -0,0 +1,24 @@
+{
+  runCommand,
+  mcat-unwrapped,
+  makeWrapper,
+  lib,
+  chromium,
+  ffmpeg-headless,
+  useChromium ? false,
+  useFfmpeg ? false,
+}:
+
+runCommand "mcat"
+  {
+    pname = "mcat";
+    inherit (mcat-unwrapped) version meta;
+
+    nativeBuildInputs = [ makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe mcat-unwrapped} $out/bin/mcat --prefix PATH : ${
+      lib.makeBinPath ((lib.optional useChromium chromium) ++ (lib.optional useFfmpeg ffmpeg-headless))
+    }
+  ''
diff --git a/pkgs/by-name/mi/mill/package.nix b/pkgs/by-name/mi/mill/package.nix
index 17a9165ec1aa..4968f0cffd84 100644
--- a/pkgs/by-name/mi/mill/package.nix
+++ b/pkgs/by-name/mi/mill/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mill";
-  version = "0.12.11";
+  version = "0.12.14";
 
   src = fetchurl {
-    url = "https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/${finalAttrs.version}/mill-dist-${finalAttrs.version}-assembly.jar";
-    hash = "sha256-VnpEvukAaslD+MvsGMOGN8VEFEcmzcaZqk81hO1SrpM=";
+    url = "https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/${finalAttrs.version}/mill-dist-${finalAttrs.version}.exe";
+    hash = "sha256-2MyufFcgKH/bxVB83qXNESByAdgbzhyIHqAr36Bb9o0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 514d05453314..d32e1f6df35d 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.142.0",
+  "version": "3.142.2",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.0/mirrord_linux_x86_64",
-      "hash": "sha256-XR9zqZLoM2ZNCCMiiIcAfthSg1a9l90Df9IHsod4Oc0="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.2/mirrord_linux_x86_64",
+      "hash": "sha256-lTY28QpoC7/CosXRHFwTdwL4Jd5OKGMaaSPaVrUnHco="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.0/mirrord_linux_aarch64",
-      "hash": "sha256-P4Gt7xBGeDQFP5x7fRX9UzHkKq2ILuMoHfritzI+EiM="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.2/mirrord_linux_aarch64",
+      "hash": "sha256-svFAYPSLM9ykk8hTwU6ITmB5uBewGG8rHy97R95D02w="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.0/mirrord_mac_universal",
-      "hash": "sha256-Buw+QJ86e9vR1qDKiHUr6u/nlFrLYfUJ3Uu/GCsrm3Q="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.2/mirrord_mac_universal",
+      "hash": "sha256-hHCDq+rcJhuF1lnJTXfM4jcBenDHz5YTSX1tYptZREg="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.0/mirrord_mac_universal",
-      "hash": "sha256-Buw+QJ86e9vR1qDKiHUr6u/nlFrLYfUJ3Uu/GCsrm3Q="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.142.2/mirrord_mac_universal",
+      "hash": "sha256-hHCDq+rcJhuF1lnJTXfM4jcBenDHz5YTSX1tYptZREg="
     }
   }
 }
diff --git a/pkgs/by-name/mp/mpv-subs-popout/package.nix b/pkgs/by-name/mp/mpv-subs-popout/package.nix
index 9f1d5d11fdea..b4831561b7af 100644
--- a/pkgs/by-name/mp/mpv-subs-popout/package.nix
+++ b/pkgs/by-name/mp/mpv-subs-popout/package.nix
@@ -8,13 +8,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "mpv-subs-popout";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "sdaqo";
     repo = "mpv-subs-popout";
     rev = "v${version}";
-    hash = "sha256-Z8IWiYKitkbEFdjca5G6P0I6j4Fg2fIHco6fD90UoBw=";
+    hash = "sha256-ELxI1pn1o+SQNtCKbZ0NFffqhJwRJzoeLSQHli9ZYwM=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/na/nanoboyadvance/package.nix b/pkgs/by-name/na/nanoboyadvance/package.nix
index 6b0efdc8b717..13cc6db32b77 100644
--- a/pkgs/by-name/na/nanoboyadvance/package.nix
+++ b/pkgs/by-name/na/nanoboyadvance/package.nix
@@ -22,28 +22,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nanoboyadvance";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "nba-emu";
     repo = "NanoBoyAdvance";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-du3dPTg3OxNTWXDQo2m9W0rJxtrkn+lQSh/XGiu/eGg=";
+    hash = "sha256-IH2X0B3HwEG0/wvKacLVPBQad14W0HBy5VFHjk8vgJk=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "add-missing-gcc14-include.patch";
-      url = "https://github.com/nba-emu/NanoBoyAdvance/commit/f5551cc1aa6a12b3d65dd56d186c73a67f3d9dd6.patch";
-      hash = "sha256-TCyN0qz7o7BDhVZtaTsWCZAcKThi5oVqUM0NGmj44FI=";
-    })
-    (fetchpatch {
-      name = "fix-darwin-bundle-install-path.patch";
-      url = "https://github.com/nba-emu/NanoBoyAdvance/commit/bd07a261141cd1f67b828d20f6d01a97adf91c16.patch";
-      hash = "sha256-Nqz35PGfPBZ3Lg6szez4k3R/NkgObNndvbxY8JCY40Y";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     python3Packages.jinja2
diff --git a/pkgs/by-name/ne/neothesia/package.nix b/pkgs/by-name/ne/neothesia/package.nix
index c51fca410df8..f8531e58d232 100644
--- a/pkgs/by-name/ne/neothesia/package.nix
+++ b/pkgs/by-name/ne/neothesia/package.nix
@@ -56,8 +56,10 @@ rustPlatform.buildRustPackage {
         xorg.libXrender
       ]
     }"
+
     install -Dm 644 flatpak/com.github.polymeilex.neothesia.desktop $out/share/applications/com.github.polymeilex.neothesia.desktop
     install -Dm 644 flatpak/com.github.polymeilex.neothesia.png $out/share/icons/hicolor/256x256/apps/com.github.polymeilex.neothesia.png
+    install -Dm 644 default.sf2 $out/share/neothesia/default.sf2
   '';
 
   meta = {
diff --git a/pkgs/by-name/nm/nmap/package.nix b/pkgs/by-name/nm/nmap/package.nix
index fc929197ebe9..7593868d50d0 100644
--- a/pkgs/by-name/nm/nmap/package.nix
+++ b/pkgs/by-name/nm/nmap/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmap";
-  version = "7.96";
+  version = "7.97";
 
   src = fetchurl {
     url = "https://nmap.org/dist/nmap-${version}.tar.bz2";
-    hash = "sha256-mK56Ty+2bBo9SCr48AE3KDuRciNEa0bnogsG6r7fjIo=";
+    hash = "sha256-r5jyeSXGcMJX3Zap3fJyTgbLebL9Hg0IySBjFr4WRcA=";
   };
 
   prePatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/nu/nut/package.nix b/pkgs/by-name/nu/nut/package.nix
index bdb6a0f792ef..6f5e774b74a7 100644
--- a/pkgs/by-name/nu/nut/package.nix
+++ b/pkgs/by-name/nu/nut/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nut";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchurl {
     url = "https://networkupstools.org/source/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5LSwy+fdObqQl75/fXh7sv/74132Tf9Ttf45PWWcWX0=";
+    sha256 = "sha256-1soX8LOQA7rHZJ6xerSnE+TV/KqP0a7cooNX1Z3wle0=";
   };
 
   patches = [
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
     "--with-all"
     "--with-ssl"
     "--without-powerman" # Until we have it ...
+    "--with-systemdsystempresetdir=$(out)/lib/systemd/system-preset"
     "--with-systemdsystemunitdir=$(out)/lib/systemd/system"
     "--with-systemdshutdowndir=$(out)/lib/systemd/system-shutdown"
     "--with-systemdtmpfilesdir=$(out)/lib/tmpfiles.d"
diff --git a/pkgs/applications/office/PageEdit/default.nix b/pkgs/by-name/pa/pageedit/package.nix
similarity index 83%
rename from pkgs/applications/office/PageEdit/default.nix
rename to pkgs/by-name/pa/pageedit/package.nix
index d090520684db..7ebc9c53ba6f 100644
--- a/pkgs/applications/office/PageEdit/default.nix
+++ b/pkgs/by-name/pa/pageedit/package.nix
@@ -3,30 +3,27 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  qtsvg,
-  qtwebengine,
-  wrapQtAppsHook,
-  qttools,
+  qt6Packages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pageedit";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "Sigil-Ebook";
     repo = "pageedit";
     tag = finalAttrs.version;
-    hash = "sha256-BsK+agn8O2WeftiEHfT5B1hzsP5Av4DkIZqVKoQxb70=";
+    hash = "sha256-Tkc8iOH+HG3ULrdUvVdeOzAl0i1R3QFaZ1U/vjCKGjo=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with qt6Packages; [
     cmake
     wrapQtAppsHook
     qttools
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with qt6Packages; [
     qtsvg
     qtwebengine
   ];
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 24869c436da3..4d2f1730cd49 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -26,13 +26,13 @@
   xorg,
 }:
 let
-  version = "2.16.1";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-wdcwSWaixNceVqrCXStf+0jnWbigd3k5FXRF0o2UbW0=";
+    hash = "sha256-w6VS3m661EvLGk1lVbTAYNzwVgXjvegn0KByGDBFjz0=";
   };
 
   python = python3.override {
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index 3bfe5d14d269..c94b612280a4 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-pass";
-  version = "1.31.2";
+  version = "1.31.4";
 
   src = fetchurl {
     url = "https://proton.me/download/pass/linux/x64/proton-pass_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-o6BNweQQzis2OnaLQj9A1gHs8zPo2rF75msnTGrBfc0=";
+    hash = "sha256-gl4qCj9BAN9B09b+F78v0f3tUyxRU4/IpsSvtK0CZOM=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/qd/qdiskinfo/package.nix b/pkgs/by-name/qd/qdiskinfo/package.nix
index a102d6efe50e..60d1afe2a319 100644
--- a/pkgs/by-name/qd/qdiskinfo/package.nix
+++ b/pkgs/by-name/qd/qdiskinfo/package.nix
@@ -36,13 +36,13 @@ assert
 
 stdenv.mkDerivation {
   pname = "qdiskinfo";
-  version = "0.3-unstable-2025-05-08";
+  version = "0.3-unstable-2025-05-22";
 
   src = fetchFromGitHub {
     owner = "edisionnano";
     repo = "QDiskInfo";
-    rev = "3416cc7ac19b25bb78eab135cf5e0b281e506de0";
-    hash = "sha256-loL6fzOSoZyCmrs7joHQCsCStLGgKxmMuqFmtADWTW0=";
+    rev = "9b7f4fb44e888dde7c9d0e82300d275e8671769d";
+    hash = "sha256-GqHDTEeZ+dEmCeyFehaNKB8af5PN8ZTSKxm00mkqouk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index 941f2f13c9f5..a6eb1001ea5e 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -63,7 +63,7 @@ lib.fix (
   self:
   lib.makeOverridable (
     {
-      npmDepsHash ? "sha256-XBWwTgfiQX3oW8f4bhfjn85M6KbC6mcIxmwRg224asM=",
+      npmDepsHash ? "sha256-pPbN/goBsRHGAnDzof50PlQtS0RMux4dq1b8Gn5jEP4=",
       patches ? [ ],
     }@args:
     buildNpmPackage {
@@ -77,7 +77,7 @@ lib.fix (
       # separate hash.
       src = fetchgit {
         inherit (radicle-httpd.src) url rev;
-        hash = "sha256-HQbyQWkp8YikSMMcX+zBfbscuUqDEGIe3oATtaHikZk=";
+        hash = "sha256-jxiGL9gEbl4n+GmFeRc8cVljfD8hrFRfSrA9GnOeE40=";
       };
 
       postPatch = ''
diff --git a/pkgs/by-name/ra/radicle-httpd/package.nix b/pkgs/by-name/ra/radicle-httpd/package.nix
index 262de4fba351..23be36f33645 100644
--- a/pkgs/by-name/ra/radicle-httpd/package.nix
+++ b/pkgs/by-name/ra/radicle-httpd/package.nix
@@ -12,14 +12,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "radicle-httpd";
-  version = "0.18.1";
+  version = "0.18.2";
   env.RADICLE_VERSION = version;
 
   # You must update the radicle-explorer source hash when changing this.
   src = fetchgit {
     url = "https://seed.radicle.xyz/z4V1sjrXqjvFdnCUbxPFqd5p4DtH5.git";
     rev = "refs/namespaces/z6MkkfM3tPXNPrPevKr3uSiQtHPuwnNhu2yUVjgd2jXVsVz5/refs/tags/v${version}";
-    hash = "sha256-sXVeDlGY6jyi5/z7ilPwlU7b3pyLSKIqUfi0Usx6NT8=";
+    hash = "sha256-s4QZi3/EEKzlvfhlU9KMuSeH8Al4kFnhADk10WLUilA=";
     sparseCheckout = [ "radicle-httpd" ];
   };
 
diff --git a/pkgs/by-name/re/repomix/package.nix b/pkgs/by-name/re/repomix/package.nix
index 38d946dd74c9..5d7b83c81d8b 100644
--- a/pkgs/by-name/re/repomix/package.nix
+++ b/pkgs/by-name/re/repomix/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "repomix";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "yamadashy";
     repo = "repomix";
     tag = "v${version}";
-    hash = "sha256-gB4Z3IEzPUoHXI1a/JFBOmn+twIq469X0uQOSIs13LU=";
+    hash = "sha256-OTbExzeBHqYVvxXMQVAv+WM4Brvg4BZx2iLGRK6YyIk=";
   };
 
-  npmDepsHash = "sha256-bO37po20j7wZbjT1LEY+yz0DGfVL3E3y+MjaFyK+LEE=";
+  npmDepsHash = "sha256-Q9j5cGEldwb93+ddsLjDF4FW/U6QkT7xiJLp4eA4Uc0=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/re/restinio/package.nix b/pkgs/by-name/re/restinio/package.nix
index 02d09bad25ea..486fc3c9287c 100644
--- a/pkgs/by-name/re/restinio/package.nix
+++ b/pkgs/by-name/re/restinio/package.nix
@@ -21,13 +21,13 @@ assert !with_boost_asio -> asio != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "restinio";
-  version = "0.7.4";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "Stiffstream";
     repo = "restinio";
-    rev = "v.${finalAttrs.version}";
-    hash = "sha256-AwAynNLSr0oBDhrKFguYG3O2aL1fnJ6g/kgAFxqYDqI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wQIJsybPz5GNcQMECcYhs8nh/h8gWEocS+M+lnP8EOE=";
   };
 
   # https://www.github.com/Stiffstream/restinio/issues/230
diff --git a/pkgs/by-name/ro/rotonda/package.nix b/pkgs/by-name/ro/rotonda/package.nix
index 436eea306ac8..382906cf36d3 100644
--- a/pkgs/by-name/ro/rotonda/package.nix
+++ b/pkgs/by-name/ro/rotonda/package.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rotonda";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "rotonda";
     tag = "v${version}";
-    hash = "sha256-rSIjlLr1mtgyFKRAkcnDKV/MwtYb/ifXewLXhZ4zp7E=";
+    hash = "sha256-DpFrJH37ysNc3hv7UrDktqRWrucAX6ZlpwUAT0PDm5k=";
   };
 
   passthru.updateScript = nix-update-script { };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MKFSvmU3lgQZ1c5L1GmMmzXiXK28uCgYtrjIjhAhcfY=";
+  cargoHash = "sha256-cWPsFUa31hcNzqSSBbnhWccJqYGQbpbZNcVr0G14cqE=";
 
   meta = {
     description = "Rotonda - composable, programmable BGP Engine";
diff --git a/pkgs/by-name/si/sish/package.nix b/pkgs/by-name/si/sish/package.nix
index 93e517a19599..8a8f78bc14b9 100644
--- a/pkgs/by-name/si/sish/package.nix
+++ b/pkgs/by-name/si/sish/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "sish";
-  version = "2.18.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "antoniomika";
     repo = "sish";
     tag = "v${version}";
-    hash = "sha256-SSBGyfaG59/7SqUFnvFdkhno4pTTLHHxVWBEPTz0m1Q=";
+    hash = "sha256-RolkaMIhAZmUJtbB7218iAeEWS4a4NJOl2ZbPufZakQ=";
   };
 
   vendorHash = "sha256-0dtfZp8hzoPc3oQN6E7T8ZOhDmU2JeZ3YcB3QMUoPKI=";
diff --git a/pkgs/by-name/sm/smartsynchronize/package.nix b/pkgs/by-name/sm/smartsynchronize/package.nix
index 5dffdf8e96b8..9cdf139c0b23 100644
--- a/pkgs/by-name/sm/smartsynchronize/package.nix
+++ b/pkgs/by-name/sm/smartsynchronize/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "smartsynchronize";
-  version = "4.6.1";
+  version = "4.6.2";
 
   src = fetchurl {
     url = "https://www.syntevo.com/downloads/smartsynchronize/smartsynchronize-linux-${
       builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }.tar.gz";
-    hash = "sha256-oc1GFwiA6LPbCsCsGGENEz9ktcu0NINfQ9dsL27VIpI=";
+    hash = "sha256-78CidB6d7FJH17rRT3N9tCCHNZyeyOy7DOepxVDLPUM=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 ];
diff --git a/pkgs/by-name/sp/spacer/package.nix b/pkgs/by-name/sp/spacer/package.nix
index c195e03b3f6e..bccbceb1ace5 100644
--- a/pkgs/by-name/sp/spacer/package.nix
+++ b/pkgs/by-name/sp/spacer/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spacer";
-  version = "0.3.8";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "samwho";
     repo = "spacer";
     rev = "v${version}";
-    hash = "sha256-N6HNPuEYcbuqpHv8Qr43iRtRdtyBo4TP7YccIcbpIpc=";
+    hash = "sha256-8c8l8SJlh3z8spembPavO4fhzPcpCfaZVvU8dl3PUTc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/sUQy5dn83KLzBXZ2+QEMM6hOqE7T3tZ80Q3M510jjQ=";
+  cargoHash = "sha256-WNqzOZ38ogeeEYB6B58+C2VptJ/HNj5+DpWvvHBhTAQ=";
 
   meta = with lib; {
     description = "CLI tool to insert spacers when command output stops";
diff --git a/pkgs/by-name/sp/spotify/darwin.nix b/pkgs/by-name/sp/spotify/darwin.nix
index 264c8386e588..f85900acc360 100644
--- a/pkgs/by-name/sp/spotify/darwin.nix
+++ b/pkgs/by-name/sp/spotify/darwin.nix
@@ -4,24 +4,25 @@
   meta,
   fetchurl,
   undmg,
+  updateScript,
   lib,
 }:
 
 stdenv.mkDerivation {
   inherit pname;
 
-  version = "1.2.40.599.g606b7f29";
+  version = "1.2.64.408";
 
   src =
     if stdenv.hostPlatform.isAarch64 then
       (fetchurl {
-        url = "https://web.archive.org/web/20240622065234/https://download.scdn.co/SpotifyARM64.dmg";
-        hash = "sha256-mmjxKYmsX0rFlIU19JOfPbNgOhlcZs5slLUhDhlON1c=";
+        url = "https://web.archive.org/web/20250522123639/https://download.scdn.co/SpotifyARM64.dmg";
+        hash = "sha256-28T+AxhnM1K6W50JUu9RdFRKsBRDTQulKK2+kk2RTMQ=";
       })
     else
       (fetchurl {
-        url = "https://web.archive.org/web/20240622065548/https://download.scdn.co/Spotify.dmg";
-        hash = "sha256-hvS0xnmJQoQfNJRFsLBQk8AJjDOzDy+OGwNOq5Ms/O0=";
+        url = "https://web.archive.org/web/20250522130546/https://download.scdn.co/Spotify.dmg";
+        hash = "sha256-P8itkT2w7xQl0WfMLcNHgi1zcoYMqOdGmNDXdwhZBUs=";
       });
 
   nativeBuildInputs = [ undmg ];
@@ -37,7 +38,12 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  passthru = { inherit updateScript; };
+
   meta = meta // {
-    maintainers = with lib.maintainers; [ matteopacini ];
+    maintainers = with lib.maintainers; [
+      matteopacini
+      Enzime
+    ];
   };
 }
diff --git a/pkgs/by-name/sp/spotify/linux.nix b/pkgs/by-name/sp/spotify/linux.nix
index b179de1ebf8d..3990510bdfd1 100644
--- a/pkgs/by-name/sp/spotify/linux.nix
+++ b/pkgs/by-name/sp/spotify/linux.nix
@@ -44,23 +44,10 @@
   # High-DPI support: Spotify's --force-device-scale-factor argument
   # not added if `null`, otherwise, should be a number.
   deviceScaleFactor ? null,
+  updateScript,
 }:
 
 let
-  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
-  # "rev" decides what is actually being downloaded
-  # If an update breaks things, one of those might have valuable info:
-  # https://aur.archlinux.org/packages/spotify/
-  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.59.514.g834e17d4";
-  # To get the latest stable revision:
-  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
-  # To get general information:
-  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
-  # More examples of api usage:
-  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "86";
-
   deps = [
     alsa-lib
     at-spi2-atk
@@ -109,11 +96,24 @@ let
     xorg.libXtst
     zlib
   ];
-
 in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname;
 
-stdenv.mkDerivation {
-  inherit pname version;
+  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
+  # "rev" decides what is actually being downloaded
+  # If an update breaks things, one of those might have valuable info:
+  # https://aur.archlinux.org/packages/spotify/
+  # https://community.spotify.com/t5/Desktop-Linux
+  version = "1.2.60.564.gcc6305cb";
+
+  # To get the latest stable revision:
+  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
+  # To get general information:
+  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
+  # More examples of api usage:
+  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
+  rev = "87";
 
   # fetch from snapcraft instead of the debian repository most repos fetch from.
   # That is a bit more cumbersome. But the debian repository only keeps the last
@@ -124,9 +124,9 @@ stdenv.mkDerivation {
   # spotify ourselves:
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
-    name = "spotify-${version}-${rev}.snap";
-    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-b9VlPwZ6JJ7Kt2p0ji1qtTJQHZE9d4KBO3iqQwsYh6k+ljtV/mSdinZi+B//Yb+KXhMErd0oaVzIpCCMqft6FQ==";
+    name = "spotify-${finalAttrs.version}-${finalAttrs.rev}.snap";
+    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${finalAttrs.rev}.snap";
+    hash = "sha512-hdJOko/0EHkPiNgWO+WB3nP+0MO9D2fxgM/X/Ri6fM1ODJxz3XYY84Xf2Ru6iGqdA9XUNRcd/qi+Gfaj9Ez0Ug==";
   };
 
   nativeBuildInputs = [
@@ -150,10 +150,10 @@ stdenv.mkDerivation {
       echo "You probably chose the wrong revision."
       exit 1
     fi
-    if ! grep -q '${version}' meta/snap.yaml; then
+    if ! grep -q '${finalAttrs.version}' meta/snap.yaml; then
       echo "Package version differs from version found in snap metadata:"
       grep 'version: ' meta/snap.yaml
-      echo "While the nix package specifies: ${version}."
+      echo "While the nix package specifies: ${finalAttrs.version}."
       echo "You probably chose the wrong revision or forgot to update the nix version."
       exit 1
     fi
@@ -227,6 +227,8 @@ stdenv.mkDerivation {
     runHook postFixup
   '';
 
+  passthru = { inherit updateScript; };
+
   meta = meta // {
     maintainers = with lib.maintainers; [
       ftrvxmtrx
@@ -235,4 +237,4 @@ stdenv.mkDerivation {
       ma27
     ];
   };
-}
+})
diff --git a/pkgs/by-name/sp/spotify/package.nix b/pkgs/by-name/sp/spotify/package.nix
index 2e43a880cf2c..f9771e12201f 100644
--- a/pkgs/by-name/sp/spotify/package.nix
+++ b/pkgs/by-name/sp/spotify/package.nix
@@ -10,6 +10,8 @@ let
 
   pname = "spotify";
 
+  updateScript = ./update.sh;
+
   meta = with lib; {
     homepage = "https://www.spotify.com/";
     description = "Play music from the Spotify music service";
@@ -25,6 +27,6 @@ let
 
 in
 if stdenv.hostPlatform.isDarwin then
-  callPackage ./darwin.nix (extraArgs // { inherit pname meta; })
+  callPackage ./darwin.nix (extraArgs // { inherit pname updateScript meta; })
 else
-  callPackage ./linux.nix (extraArgs // { inherit pname meta; })
+  callPackage ./linux.nix (extraArgs // { inherit pname updateScript meta; })
diff --git a/pkgs/by-name/sp/spotify/update.sh b/pkgs/by-name/sp/spotify/update.sh
index d7f40c782902..65f986f5668a 100755
--- a/pkgs/by-name/sp/spotify/update.sh
+++ b/pkgs/by-name/sp/spotify/update.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p curl jq git gnused gnugrep
+#! nix-shell -i bash -p common-updater-scripts curl jq git gnused gnugrep libplist undmg
+set -euo pipefail
 
 
 # executing this script without arguments will
@@ -20,69 +21,96 @@
 
 channel="${1:-stable}" # stable/candidate/edge
 nixpkgs="$(git rev-parse --show-toplevel)"
-spotify_nix="$nixpkgs/pkgs/by-name/sp/spotify/linux.nix"
 
+update_linux() {
+  nix_file="$nixpkgs/pkgs/by-name/sp/spotify/linux.nix"
+  #
+  # find the newest stable spotify version available on snapcraft
+  #
 
-#
-# find the newest stable spotify version avaiable on snapcraft
-#
+  # create bash array from snap info
+  snap_info=($(
+    curl -s -H 'X-Ubuntu-Series: 16' \
+      "https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=$channel" \
+    | jq --raw-output \
+      '.revision,.download_sha512,.version,.last_updated'
+  ))
 
-# create bash array from snap info
-snap_info=($(
-  curl -s -H 'X-Ubuntu-Series: 16' \
-    "https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=$channel" \
-  | jq --raw-output \
-    '.revision,.download_sha512,.version,.last_updated'
-))
+  # "revision" is the actual version identifier on snapcraft, the "version" is
+  # just for human consumption. Revision is just an integer that gets increased
+  # by one every (stable or unstable) release.
+  revision="${snap_info[0]}"
+  # We need to escape the slashes
+  hash="$(nix-hash --to-sri --type sha512 ${snap_info[1]} | sed 's|/|\\/|g')"
+  upstream_version="${snap_info[2]}"
+  last_updated="${snap_info[3]}"
+  echo "Latest $channel release for Spotify on Linux is $upstream_version from $last_updated."
+  #
+  # read the current spotify version from the currently *committed* nix expression
+  #
 
-# "revision" is the actual version identifier on snapcraft, the "version" is
-# just for human consumption. Revision is just an integer that gets increased
-# by one every (stable or unstable) release.
-revision="${snap_info[0]}"
-# We need to escape the slashes
-hash="$(nix-hash --to-sri --type sha512 ${snap_info[1]} | sed 's|/|\\/|g')"
-upstream_version="${snap_info[2]}"
-last_updated="${snap_info[3]}"
-echo "Latest $channel release is $upstream_version from $last_updated."
-#
-# read the current spotify version from the currently *committed* nix expression
-#
+  current_nix_version=$(
+    grep 'version\s*=' "$nix_file" \
+    | sed -Ene 's/.*"(.*)".*/\1/p'
+  )
 
-current_nix_version=$(
-  grep 'version\s*=' "$spotify_nix" \
-  | sed -Ene 's/.*"(.*)".*/\1/p'
-)
+  echo "Current Spotify for Linux version in Nixpkgs: $current_nix_version"
 
-echo "Current nix version: $current_nix_version"
+  #
+  # update the nix expression if the versions differ
+  #
 
-#
-# update the nix expression if the versions differ
-#
+  if [[ "$current_nix_version" = "$upstream_version" ]]; then
+    echo "Spotify on Linux is already up-to-date"
+    return
+  fi
 
-if [[ "$current_nix_version" = "$upstream_version" ]]; then
-  echo "Spotify is already up-to-date"
-  exit 0
-fi
+  echo "Updating Spotify on Linux from ${current_nix_version} to ${upstream_version}, released on ${last_updated}"
 
-echo "Updating from ${current_nix_version} to ${upstream_version}, released on ${last_updated}"
+  # search-and-replace revision, hash and version
+  sed --regexp-extended \
+    -e 's/rev\s*=\s*"[0-9]+"\s*;/rev = "'"${revision}"'";/' \
+    -e 's/hash\s*=\s*"[^"]*"\s*;/hash = "'"${hash}"'";/' \
+    -e 's/version\s*=\s*".*"\s*;/version = "'"${upstream_version}"'";/' \
+    -i "$nix_file"
+}
 
-# search-and-replace revision, hash and version
-sed --regexp-extended \
-  -e 's/rev\s*=\s*"[0-9]+"\s*;/rev = "'"${revision}"'";/' \
-  -e 's/hash\s*=\s*"[^"]*"\s*;/hash = "'"${hash}"'";/' \
-  -e 's/version\s*=\s*".*"\s*;/version = "'"${upstream_version}"'";/' \
-  -i "$spotify_nix"
+update_macos() {
+  nix_file="$nixpkgs/pkgs/by-name/sp/spotify/darwin.nix"
 
-#
-# try to build the updated version
-#
+  tmp_dir=$(mktemp -d)
+  trap 'rm -rf "$tmp_dir"' EXIT
 
-export NIXPKGS_ALLOW_UNFREE=1
-if ! nix-build -A spotify "$nixpkgs"; then
-  echo "The updated spotify failed to build."
-  exit 1
-fi
+  pushd $tmp_dir
 
-# Commit changes
-git add "$spotify_nix"
-git commit -m "spotify: ${current_nix_version} -> ${upstream_version}"
+  x86_64_url="https://download.scdn.co/Spotify.dmg"
+  aarch64_url="https://download.scdn.co/SpotifyARM64.dmg"
+
+  curl -OL $aarch64_url
+  undmg SpotifyARM64.dmg
+  upstream_version=$(plistutil -i Spotify.app/Contents/Info.plist -f json -o - | jq -r '.CFBundleVersion')
+
+  popd
+
+  current_nix_version=$(
+    grep 'version\s*=' "$nix_file" \
+    | sed -Ene 's/.*"(.*)".*/\1/p'
+  )
+
+  if [[ "$current_nix_version" != "$upstream_version" ]]; then
+    archive_url="https://web.archive.org/save"
+    archived_x86_64_url=$(curl -s -I -L -o /dev/null "$archive_url/$x86_64_url" -w '%{url_effective}')
+    archived_aarch64_url=$(curl -s -I -L -o /dev/null "$archive_url/$aarch64_url" -w '%{url_effective}')
+
+    update-source-version "pkgsCross.x86_64-darwin.spotify" "$upstream_version" "" "$archived_x86_64_url" \
+      --file=$nix_file \
+      --ignore-same-version
+
+    update-source-version "pkgsCross.aarch64-darwin.spotify" "$upstream_version" "" "$archived_aarch64_url" \
+      --file=$nix_file \
+      --ignore-same-version
+  fi
+}
+
+update_linux
+update_macos
diff --git a/pkgs/by-name/ta/taldir/package.nix b/pkgs/by-name/ta/taldir/package.nix
new file mode 100644
index 000000000000..b6cd48430368
--- /dev/null
+++ b/pkgs/by-name/ta/taldir/package.nix
@@ -0,0 +1,50 @@
+{
+  fetchgit,
+  lib,
+  recutils,
+  buildGoModule,
+}:
+buildGoModule (finalAttrs: {
+  pname = "taldir";
+  version = "1.0.5";
+
+  src = fetchgit {
+    url = "https://git.taler.net/taldir.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZKNkMV0IV6E+yCQeabGXpIQclx1S4YEgFn4whGXTaks=";
+  };
+
+  vendorHash = "sha256-QCwakJTpRP7VT69EzQeInCCGBuNu3WsNCytnQcBdKQw=";
+
+  nativeBuildInputs = [
+    recutils
+  ];
+
+  # From Makefile
+  preBuild = ''
+    mkdir -p internal/gana
+
+    pushd third_party/gana/gnu-taler-error-codes
+    make taler_error_codes.go
+    popd
+
+    cp third_party/gana/gnu-taler-error-codes/taler_error_codes.go internal/gana/
+  '';
+
+  subPackages = [
+    "cmd/taldir-cli"
+    "cmd/taldir-server"
+  ];
+
+  # dial error (dial tcp [::1]:5432: connect: connection refused)
+  doCheck = false;
+
+  meta = {
+    homepage = "https://git.taler.net/taldir.git";
+    description = "Directory service to resolve wallet mailboxes by messenger addresses";
+    teams = with lib.teams; [ ngi ];
+    # themadbit will maintain after being added to maintainers
+    maintainers = with lib.maintainers; [ ];
+    license = lib.licenses.agpl3Plus;
+  };
+})
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index 37ce00ca4bad..3636cf56306f 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${version}";
-    hash = "sha256-szu/tr97T9pBFmw/D9muh3KAP/yN9rk7DvyscAw3gIQ=";
+    hash = "sha256-8qruYf59oFvLO892T89GbayTpq9V1J+Tu08jgIaod18=";
   };
 
-  vendorHash = "sha256-i+lUT/+ICqojOZo08uNfP7CFZM7eeZ9s5v6qL/pZUho=";
+  vendorHash = "sha256-sRa8P6vGjXg3fL4f3CFjtaTvESP8DPd7/E98Z+7i0mw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/termius/package.nix b/pkgs/by-name/te/termius/package.nix
index 3a6ee9dd6524..5135a55bdc33 100644
--- a/pkgs/by-name/te/termius/package.nix
+++ b/pkgs/by-name/te/termius/package.nix
@@ -16,8 +16,8 @@
 
 stdenv.mkDerivation rec {
   pname = "termius";
-  version = "9.19.4";
-  revision = "225";
+  version = "9.20.0";
+  revision = "226";
 
   src = fetchurl {
     # find the latest version with
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     # and the sha512 with
     # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
     url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-lArp7yoQrQKc84zh8/EdLv5FuKbwQka9uy1JgeZzA7kbZzV3evcpav67HNSqp+BhUxp9ViD8TK1USGViJN5Tpg==";
+    hash = "sha512-e+czt4ZoXirtRV63uL4Mc3DFcq3/XRxU7R7wyd/EZBtZOb5uW0CT84u9v3b8xM/0jJyY3ZQBR4lJS05vuXvzpw==";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/ti/timewarrior/package.nix b/pkgs/by-name/ti/timewarrior/package.nix
index a525b591c614..51c68203282f 100644
--- a/pkgs/by-name/ti/timewarrior/package.nix
+++ b/pkgs/by-name/ti/timewarrior/package.nix
@@ -29,7 +29,9 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     installShellCompletion --cmd timew \
-      --bash completion/timew-completion.bash
+      --bash completion/timew-completion.bash \
+      --fish completion/timew.fish \
+      --zsh completion/timew.zsh
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 238d77561386..581d92c0847f 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.3.6";
+  version = "3.4.0";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-HA/JSwcss5ytGPqe2dqsKTZxuhWeC/yi8Mva4YVFeDs=";
+    hash = "sha256-9OCrIkeiqX8Kc21wWDy6cuSOw7l27YzgD/u8IiPc70w=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-23BkkfJ6XLAygeeKipJk4puV5sGILb8rXEEA4qJWZS4=";
+  vendorHash = "sha256-KtLWecErTstGpzByzDRvHXdq9qi9L4Q1iIfy0Lx7EOE=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/by-name/uv/uv-sort/package.nix b/pkgs/by-name/uv/uv-sort/package.nix
index 52ce3dd9471d..ed3e901a7efc 100644
--- a/pkgs/by-name/uv/uv-sort/package.nix
+++ b/pkgs/by-name/uv/uv-sort/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "uv-sort";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   # Build from GitHub does not work. Use fetchPypi instead of fetchFromGitHub.
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchPypi {
     pname = "uv_sort";
     inherit version;
-    hash = "sha256-d0mI3BQQaoG5pPnqBqyAI2LQffkS9fxX+itD9UEL050=";
+    hash = "sha256-umKMcQcQST0bBGf7ZXxNcWq/5/ht3jp+3JVjowBdeO0=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/va/varia/package.nix b/pkgs/by-name/va/varia/package.nix
index f3bca6c67f59..407bd7882632 100644
--- a/pkgs/by-name/va/varia/package.nix
+++ b/pkgs/by-name/va/varia/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "varia";
-  version = "2025.4.22";
+  version = "2025.5.14";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "giantpinkrobots";
     repo = "varia";
     tag = "v${version}";
-    hash = "sha256-y14I/K1fw7Skiuq+CglTRsotqafpP9yabuHhywB2WXE=";
+    hash = "sha256-x2612aq/8YwDT3UYKW2P3PCVjhKhZJxH3JbY3A4IGq8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index d466ff1ba7ac..118a02e2c6b8 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "0-unstable-2025-02-23";
+  version = "0-unstable-2025-05-18";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = "wezterm";
-    rev = "4ff581a8aa3460d04f859fdadb50f29b3c507763";
+    rev = "5663e749948df3ed3c2d8ee0bfea6c85226310d9";
     fetchSubmodules = true;
-    hash = "sha256-KKfGB1vM8ytpNieWD6CHD5zVyUe17tFAegZFzLx7QfE=";
+    hash = "sha256-SQ1H16jy6GVjM8tEKZZC7AGIADLR1NyGfOT/6pFcFA0=";
   };
 
   postPatch =
@@ -55,7 +55,12 @@ rustPlatform.buildRustPackage rec {
       rm -r wezterm-ssh/tests
     '';
 
-  cargoHash = "sha256-WyQYmRNlabJaCTJm7Cn9nkXfOGAcOHwhoD9vmEggrDw=";
+  # dep: syntax causes build failures in rare cases
+  # https://github.com/rust-secure-code/cargo-auditable/issues/124
+  # https://github.com/wezterm/wezterm/blob/main/nix/flake.nix#L134
+  auditable = false;
+
+  cargoHash = "sha256-9pdkXpkIbe5HeVGvgusRaI4A6ZjDGssO5k0ULVnO6k8=";
   useFetchCargoVendor = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wf/wfview/package.nix b/pkgs/by-name/wf/wfview/package.nix
index c9c284c261c5..d5e18535a27a 100644
--- a/pkgs/by-name/wf/wfview/package.nix
+++ b/pkgs/by-name/wf/wfview/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wfview";
-  version = "2.10";
+  version = "2.11";
 
   src = fetchFromGitLab {
     owner = "eliggett";
     repo = "wfview";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bFTblsDtFAakbSJfSfKgvoxd1DTSv++rxU6R3/uWo+4=";
+    hash = "sha256-oPgQnldJA3IEZ0FuigdBpArhVcWE0GR8oa/kyYWDvEo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/wh/whois/package.nix b/pkgs/by-name/wh/whois/package.nix
index 249f3bea1b63..a7e6f03e2106 100644
--- a/pkgs/by-name/wh/whois/package.nix
+++ b/pkgs/by-name/wh/whois/package.nix
@@ -11,14 +11,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.6.0";
+  version = "5.6.1";
   pname = "whois";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    hash = "sha256-NzOJMciqSY8ivvj6fBV1+w009F1zf47U1FQACSfsbUM=";
+    hash = "sha256-2DDZBERslsnkfFDyz7IXEhvUqfKfRvmIelougkTjPYU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/zs/zsh/package.nix b/pkgs/by-name/zs/zsh/package.nix
index e84ddddd9fcf..9b6d6517503a 100644
--- a/pkgs/by-name/zs/zsh/package.nix
+++ b/pkgs/by-name/zs/zsh/package.nix
@@ -10,7 +10,7 @@
   util-linux,
   texinfo,
   ncurses,
-  pcre,
+  pcre2,
   pkg-config,
   buildPackages,
   nixosTests,
@@ -52,6 +52,22 @@ stdenv.mkDerivation {
         hash = "sha256-oA8GC8LmuqNKGuPqGfiQVhL5nWb7ArLWGUI6wjpsIW8=";
         excludes = [ "ChangeLog" ];
       })
+      # PCRE 2.x support
+      (fetchpatch {
+        url = "https://github.com/zsh-users/zsh/commit/1b421e4978440234fb73117c8505dad1ccc68d46.patch";
+        hash = "sha256-jqTXnz56L3X21e3kXtzrT1jKEq+K7ittFjL7GdHVq94=";
+        excludes = [ "ChangeLog" ];
+      })
+      (fetchpatch {
+        url = "https://github.com/zsh-users/zsh/commit/b62e911341c8ec7446378b477c47da4256053dc0.patch";
+        hash = "sha256-MfyiLucaSNNfdCLutgv/kL/oi/EVoxZVUd1KjGzN9XI=";
+        excludes = [ "ChangeLog" ];
+      })
+      (fetchpatch {
+        url = "https://github.com/zsh-users/zsh/commit/10bdbd8b5b0b43445aff23dcd412f25cf6aa328a.patch";
+        hash = "sha256-bl1PG9Zk1wK+2mfbCBhD3OEpP8HQboqEO8sLFqX8DmA=";
+        excludes = [ "ChangeLog" ];
+      })
     ]
     ++ lib.optionals stdenv.cc.isGNU [
       # Fixes compilation with gcc >= 14.
@@ -78,9 +94,11 @@ stdenv.mkDerivation {
 
   buildInputs = [
     ncurses
-    pcre
+    pcre2
   ];
 
+  env.PCRE_CONFIG = lib.getExe' (lib.getDev pcre2) "pcre2-config";
+
   configureFlags =
     [
       "--enable-maildir-support"
@@ -103,16 +121,6 @@ stdenv.mkDerivation {
       "zsh_cv_sys_dynamic_strip_lib=yes"
     ];
 
-  postPatch = ''
-    substituteInPlace Src/Modules/pcre.mdd \
-      --replace 'pcre-config' 'true'
-  '';
-
-  preConfigure = ''
-    # use pkg-config instead of pcre-config
-    configureFlagsArray+=("PCRECONF=''${PKG_CONFIG} libpcre")
-  '';
-
   # the zsh/zpty module is not available on hydra
   # so skip groups Y Z
   checkFlags = map (T: "TESTNUM=${T}") (lib.stringToCharacters "ABCDEVW");
diff --git a/pkgs/development/coq-modules/ElmExtraction/default.nix b/pkgs/development/coq-modules/ElmExtraction/default.nix
index cb4bc717f1d2..3116eb98b251 100644
--- a/pkgs/development/coq-modules/ElmExtraction/default.nix
+++ b/pkgs/development/coq-modules/ElmExtraction/default.nix
@@ -25,15 +25,16 @@ mkCoqDerivation {
       [
         {
           cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
             (range "1.3.1" "1.3.4")
           ];
-          out = "0.1.0";
+          out = "0.1.1";
         }
       ]
       null;
 
   release."0.1.0".sha256 = "EWjubBHsxAl2HuRAfJI3B9qzP2mj89eh0CUc8y7/7Ds=";
+  release."0.1.1".sha256 = "SDSyXqtOQlW9m9yH8OC909fsC/ePhKkSiY+BoQE76vk=";
 
   releaseRev = v: "v${v}";
 
diff --git a/pkgs/development/coq-modules/RustExtraction/default.nix b/pkgs/development/coq-modules/RustExtraction/default.nix
index d9a51b0eefa9..6f2171bf0875 100644
--- a/pkgs/development/coq-modules/RustExtraction/default.nix
+++ b/pkgs/development/coq-modules/RustExtraction/default.nix
@@ -30,10 +30,18 @@ mkCoqDerivation {
           ];
           out = "0.1.0";
         }
+        {
+          cases = [
+            (range "8.20" "9.0")
+            (range "1.3.2" "1.3.4")
+          ];
+          out = "0.1.1";
+        }
       ]
       null;
 
   release."0.1.0".sha256 = "+Of/DP2Vjsa7ASKswjlvqqhcmDhC9WrozridedNZQkY=";
+  release."0.1.1".sha256 = "CPZ5J9knJ1aYoQ7RQN8YFSpxqJXjgQaxIA4F8G6X4tM=";
 
   releaseRev = v: "v${v}";
 
diff --git a/pkgs/development/python-modules/aiohttp-sse-client/default.nix b/pkgs/development/python-modules/aiohttp-sse-client/default.nix
new file mode 100644
index 000000000000..c5812c22c870
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp-sse-client/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  wheel,
+  aiohttp,
+  attrs,
+  multidict,
+  yarl,
+}:
+
+buildPythonPackage rec {
+  pname = "aiohttp-sse-client";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-UATiknFiSvWGFY3HFmywaHp6WZeqtbgI9LU0AOG3Ljs=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "pytest-runner" ""
+  '';
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    aiohttp
+    attrs
+    multidict
+    yarl
+  ];
+
+  pythonImportsCheck = [
+    "aiohttp_sse_client"
+  ];
+
+  meta = {
+    description = "A Server-Sent Event python client base on aiohttp";
+    homepage = "https://pypi.org/project/aiohttp-sse-client/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kranzes ];
+  };
+}
diff --git a/pkgs/development/python-modules/ansible-compat/default.nix b/pkgs/development/python-modules/ansible-compat/default.nix
index 07d529339160..0d74aa9b8fe6 100644
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-compat";
-  version = "25.1.5";
+  version = "25.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "ansible-compat";
     tag = "v${version}";
-    hash = "sha256-fc+PXw9sT+CQFwcajuJC1IcAECbNiklzVTGFsZWUJGY=";
+    hash = "sha256-ael9SByIlq8ss/tujQV4+U3vLo55RSSFc7pVRCnV1go=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-ninja-cursor-pagination/default.nix b/pkgs/development/python-modules/django-ninja-cursor-pagination/default.nix
new file mode 100644
index 000000000000..fe6d7fdcf040
--- /dev/null
+++ b/pkgs/development/python-modules/django-ninja-cursor-pagination/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  django,
+  django-ninja,
+  pytestCheckHook,
+  pytest-django,
+}:
+
+buildPythonPackage {
+  pname = "django-ninja-cursor-pagination";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kitware-resonant";
+    repo = "django-ninja-cursor-pagination";
+    rev = "2cc22187885b9a12956530a00e554c7a6012de63";
+    hash = "sha256-uZ+l/s70A8UG/HlSLIXW4r2WFM0Jj1Ep7fGoNdH9P5M=";
+  };
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    django
+    django-ninja
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  meta = {
+    description = "Django Ninja extension for cursor-based pagination";
+    homepage = "https://github.com/kitware-resonant/django-ninja-cursor-pagination";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-postgres-partition/default.nix b/pkgs/development/python-modules/django-postgres-partition/default.nix
new file mode 100644
index 000000000000..faf3774871e1
--- /dev/null
+++ b/pkgs/development/python-modules/django-postgres-partition/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  django_5_2,
+  psycopg,
+  python-dateutil,
+}:
+
+buildPythonPackage rec {
+  pname = "django-postgres-partition";
+  version = "0.1.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "django_postgres_partition";
+    hash = "sha256-KUrgnfUXWyRerW4dqtVZO9bu5jHYnHcVOIg97w695RU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django_5_2
+    psycopg
+    python-dateutil
+  ];
+
+  doCheck = false; # pypi version doesn't ship with tests
+
+  pythonImportsCheck = [ "psql_partition" ];
+
+  meta = {
+    description = "Partition support for django, based on django-postgres-extra";
+    homepage = "https://gitlab.com/burke-software/django-postgres-partition";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+}
diff --git a/pkgs/development/python-modules/home-connect-async/default.nix b/pkgs/development/python-modules/home-connect-async/default.nix
new file mode 100644
index 000000000000..dec2083d0248
--- /dev/null
+++ b/pkgs/development/python-modules/home-connect-async/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  wheel,
+  aiohttp,
+  aiohttp-sse-client,
+  charset-normalizer,
+  dataclasses-json,
+  oauth2-client,
+}:
+
+buildPythonPackage rec {
+  pname = "home-connect-async";
+  version = "0.8.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "home_connect_async";
+    inherit version;
+    hash = "sha256-npVMEiwclKr9HR2M03GNkyJULeLEE9BAnIw8Zoy98nQ=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    aiohttp
+    aiohttp-sse-client
+    charset-normalizer
+    dataclasses-json
+    oauth2-client
+  ];
+
+  pythonImportsCheck = [
+    "home_connect_async"
+  ];
+
+  meta = {
+    description = "Async SDK for BSH Home Connect API";
+    homepage = "https://pypi.org/project/home-connect-async";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kranzes ];
+  };
+}
diff --git a/pkgs/development/python-modules/ingredient-parser-nlp/default.nix b/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
index ee07bd34acd3..cc871d9e9842 100644
--- a/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
+++ b/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
   pname = "ingredient-parser-nlp";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strangetom";
     repo = "ingredient-parser";
     tag = version;
-    hash = "sha256-VGHN1zgT6gaIrUN6JMgdCSHu652H0D6LCWI6deX12bs=";
+    hash = "sha256-rmCM3KmsCGrKX5AvfIinkL689+miXII9meGAYQxSqEk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index 2b45c4018f92..7a7f95ad5e5a 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-anthropic";
-  version = "0.3.12";
+  version = "0.3.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${version}";
-    hash = "sha256-UpyACv1cVzvK4A1Up3R6PqVQahy9hAu0LoSkaEen6Sw=";
+    hash = "sha256-CloIxDPnBnKDUeS4psRvpz8ifK/xR/U62wG+ORHginM=";
   };
 
   sourceRoot = "${src.name}/libs/partners/anthropic";
diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index 62b7731479cd..a1728f03f5d2 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-sdk";
-  version = "0.1.66";
+  version = "0.1.69";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "sdk==${version}";
-    hash = "sha256-RmyKnCL0hPOEXau+BtcWfOVt7BCtCkWuAEdDOxUV20o=";
+    hash = "sha256-MRs5crbUEak/fr17+lerGFY+xTm7sanUW1lZXbPBAeg=";
   };
 
   sourceRoot = "${src.name}/libs/sdk-py";
diff --git a/pkgs/development/python-modules/meep/default.nix b/pkgs/development/python-modules/meep/default.nix
index 16920fd860be..472e84c2edb2 100644
--- a/pkgs/development/python-modules/meep/default.nix
+++ b/pkgs/development/python-modules/meep/default.nix
@@ -28,6 +28,7 @@
   cython,
   autograd,
   mpi4py,
+  distutils,
 }:
 
 assert !blas.isILP64;
@@ -46,12 +47,6 @@ buildPythonPackage rec {
 
   format = "other";
 
-  # https://github.com/NanoComp/meep/issues/2819
-  postPatch = lib.optionalString (!pythonOlder "3.12") ''
-    substituteInPlace configure.ac doc/docs/setup.py python/visualization.py \
-      --replace-fail "distutils" "setuptools._distutils"
-  '';
-
   # MPI is needed in nativeBuildInputs too, otherwise MPI libs will be missing
   # at runtime
   nativeBuildInputs = [
@@ -76,9 +71,10 @@ buildPythonPackage rec {
     mpb
   ];
 
-  propagatedBuildInputs =
+  propagatedBuildInputs = [ mpi ];
+
+  dependencies =
     [
-      mpi
       numpy
       scipy
       matplotlib
@@ -89,6 +85,7 @@ buildPythonPackage rec {
     ]
     ++ lib.optionals (!pythonOlder "3.12") [
       setuptools # used in python/visualization.py
+      distutils
     ];
 
   propagatedUserEnvPkgs = [ mpi ];
@@ -100,7 +97,7 @@ buildPythonPackage rec {
 
   preConfigure = ''
     export HDF5_MPI=ON
-    export PYTHON=${python}/bin/${python.executable};
+    export PYTHON=${python.interpreter};
   '';
 
   configureFlags = [
diff --git a/pkgs/development/python-modules/oauth2-client/default.nix b/pkgs/development/python-modules/oauth2-client/default.nix
new file mode 100644
index 000000000000..956d8be427fe
--- /dev/null
+++ b/pkgs/development/python-modules/oauth2-client/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  wheel,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "oauth2-client";
+  version = "1.4.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-U4GQBEj/Gudi63xlxQEALqxGu1yi9JR3/f6vnplp8oQ=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "oauth2_client"
+  ];
+
+  meta = {
+    description = "A client library for OAuth2";
+    homepage = "https://pypi.org/project/oauth2-client/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kranzes ];
+  };
+}
diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 74df3646dab8..47a4aac4eb26 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -37,13 +37,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "8.2.0";
+  version = "9.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_utils";
     inherit version;
-    hash = "sha256-3PeNFLlo+3sUJjx3J4srkwp4YdPKqIfTpYsokPZlmDU=";
+    hash = "sha256-1FobkOoUlliVYtOP6EP9p/okf5p+YXhIhZkdIPtmOkM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/phonopy/default.nix b/pkgs/development/python-modules/phonopy/default.nix
index ce91f53e9d72..4a0387c392b1 100644
--- a/pkgs/development/python-modules/phonopy/default.nix
+++ b/pkgs/development/python-modules/phonopy/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "phonopy";
-  version = "2.37.0";
+  version = "2.38.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "phonopy";
     repo = "phonopy";
     tag = "v${version}";
-    hash = "sha256-Asrgf4sTriEOv4Vovejshl5HXAYQEckxbHvZ7GmSQgg=";
+    hash = "sha256-oQcKBwrjQGmjJIHROb9Z/8j7CmfoSxlIzHRABBg+tSs=";
   };
 
   build-system = [
@@ -70,6 +70,9 @@ buildPythonPackage rec {
     homepage = "https://phonopy.github.io/phonopy/";
     changelog = "http://phonopy.github.io/phonopy/changelog.html";
     license = lib.licenses.bsd0;
-    maintainers = with lib.maintainers; [ psyanticy ];
+    maintainers = with lib.maintainers; [
+      psyanticy
+      chn
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/portion/default.nix b/pkgs/development/python-modules/portion/default.nix
index af38121d0119..7cbe2884f387 100644
--- a/pkgs/development/python-modules/portion/default.nix
+++ b/pkgs/development/python-modules/portion/default.nix
@@ -2,24 +2,24 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  hatchling,
   sortedcontainers,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "portion";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AlexandreDecan";
     repo = "portion";
     tag = version;
-    hash = "sha256-TBCnlkGZZ/3tWEojxDGNYcXtYHhrooJkaWBsRkadXEE=";
+    hash = "sha256-K4mZn8Fm96ZBBdLTMfM9f1GKDdIrRwDRzk6ObaXSFG4=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   dependencies = [ sortedcontainers ];
 
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index f6fc84c87a6d..76a60bfcf362 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -33,13 +33,13 @@
 
 buildPythonPackage rec {
   pname = "python-openstackclient";
-  version = "8.0.0";
+  version = "8.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "python_openstackclient";
     inherit version;
-    hash = "sha256-W3peBok/gztdKW0BnFDULHNo43dI7mvo6bFWVbmZQk4=";
+    hash = "sha256-m5xCs/a8S0tICmJU/FYKywGXh4MeCUOW2/msmuVxrks=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-swiftclient/default.nix b/pkgs/development/python-modules/python-swiftclient/default.nix
index eca0e65cb0b5..5cc99ec94d37 100644
--- a/pkgs/development/python-modules/python-swiftclient/default.nix
+++ b/pkgs/development/python-modules/python-swiftclient/default.nix
@@ -13,15 +13,13 @@
 
 buildPythonPackage rec {
   pname = "python-swiftclient";
-  version = "4.7.0";
+  version = "4.8.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
   src = fetchPypi {
     pname = "python_swiftclient";
     inherit version;
-    hash = "sha256-r9dXV1PY5JYXrcsRVQGH/QsSD82Bnx54LAtTjy0JN3M=";
+    hash = "sha256-RBYsq0aTaMr9wl4MjE6VornbGkRFakjOCA/iyppLOGM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/ucsmsdk/default.nix b/pkgs/development/python-modules/ucsmsdk/default.nix
index a55cab3aec9d..ffeb58170e1a 100644
--- a/pkgs/development/python-modules/ucsmsdk/default.nix
+++ b/pkgs/development/python-modules/ucsmsdk/default.nix
@@ -3,22 +3,25 @@
   buildPythonPackage,
   fetchFromGitHub,
   pyparsing,
+  setuptools,
   six,
 }:
 
 buildPythonPackage rec {
   pname = "ucsmsdk";
-  version = "0.9.21";
-  format = "setuptools";
+  version = "0.9.22";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CiscoUcs";
     repo = "ucsmsdk";
     tag = "v${version}";
-    hash = "sha256-iqwU42Im4/YyxefkJZ8Zn5CddjUzuZk/7zjLD/0pHm4=";
+    hash = "sha256-zpb43Id6uHBKpEORDGKNW8lXP10fQJm9lGOztxaTZSI=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     pyparsing
     six
   ];
@@ -31,7 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SDK for Cisco UCS";
     homepage = "https://github.com/CiscoUcs/ucsmsdk";
-    changelog = "https://github.com/CiscoUcs/ucsmsdk/blob/v${version}/HISTORY.rst";
+    changelog = "https://github.com/CiscoUcs/ucsmsdk/blob/${src.tag}/HISTORY.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/kde/plasma/polkit-kde-agent-1/default.nix b/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
index 53f7f2959d60..f87d21cd21b8 100644
--- a/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
+++ b/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
@@ -1,9 +1,13 @@
 {
   mkKdeDerivation,
   qtdeclarative,
+  kirigami,
 }:
 mkKdeDerivation {
   pname = "polkit-kde-agent-1";
 
-  extraBuildInputs = [ qtdeclarative ];
+  extraBuildInputs = [
+    qtdeclarative
+    kirigami
+  ];
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 2856e4df6a2f..d6253cf4726b 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -34,5 +34,9 @@
     "6.14": {
         "version": "6.14.8",
         "hash": "sha256:0199maj3mk577wwaszbi0cl5a0afx1ynad896bmmg8vm636jxcb2"
+    },
+    "6.15": {
+        "version": "6.15",
+        "hash": "sha256:0r4ppfd5kwvj24bjig92hxa18lmjgy9gqvh5qknfffw08wjrd1km"
     }
 }
diff --git a/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix b/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix
new file mode 100644
index 000000000000..6cea05d62fa6
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildHomeAssistantComponent,
+  home-connect-async,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "ekutner";
+  domain = "home_connect_alt";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "ekutner";
+    repo = "home-connect-hass";
+    tag = version;
+    hash = "sha256-v/C4KV/WddaXQIO709nHP4DJM/K3J3WQSrJnVaXQDSY=";
+  };
+
+  dependencies = [ home-connect-async ];
+
+  meta = with lib; {
+    description = "Alternative (and improved) Home Connect integration for Home Assistant";
+    homepage = "https://github.com/ekutner/home-connect-hass";
+    maintainers = with maintainers; [ kranzes ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
new file mode 100644
index 000000000000..d61c13f57f0d
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  shapely,
+  pytestCheckHook,
+  pytest-homeassistant-custom-component,
+  pytest-freezer,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "amitfin";
+  domain = "oref_alert";
+  version = "2.20.1";
+
+  src = fetchFromGitHub {
+    owner = "amitfin";
+    repo = "oref_alert";
+    tag = "v${version}";
+    hash = "sha256-EsDGH7/newjHRYu4Lr5UkJ3qaaNupqlhe5CdffEpIVg=";
+  };
+
+  dependencies = [
+    shapely
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-homeassistant-custom-component
+    pytest-freezer
+  ];
+
+  meta = {
+    changelog = "https://github.com/amitfin/oref_alert/releases/tag/v${version}";
+    description = "Israeli Oref Alerts";
+    homepage = "https://github.com/amitfin/oref_alert";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kranzes ];
+  };
+}
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index f27b0f39349e..37ce2f8464eb 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -35,7 +35,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.03";
+  version = "3.04";
   pname = "asymptote";
 
   outputs = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
-    hash = "sha256-PIpOaYi1M9PVhlCqnL1VZvn3hqmrDl/QoDcPOHUOT70=";
+    hash = "sha256-+T0n2SX9C8Mz0Fb+vkny1x+TWETC+NN67MjfD+6Twys=";
   };
 
   # override with TeX Live containers to avoid building sty, docs from source
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 5fec63e06a4f..62abd723d9eb 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -50,6 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
   inherit pname version src;
 
   patches = [
+    # Making openssh pass the LOCALE_ARCHIVE variable to the forked session processes,
+    # so the session 'bash' will receive the proper locale archive, and thus process
+    # UTF-8 properly.
     ./locale_archive.patch
 
     # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index ab020a2d4b57..1c5b6a6e3893 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -32,7 +32,13 @@ in
       hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
     };
 
-    extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraPatches = [
+      # Use ssh-keysign from PATH
+      # ssh-keysign is used for host-based authentication, and is designed to be used
+      # as SUID-root program. OpenSSH defaults to referencing it from libexec, which
+      # cannot be made SUID in Nix.
+      ./ssh-keysign-8.5.patch
+    ];
     extraMeta = {
       maintainers = [ lib.maintainers.philiptaron ];
       teams = [ lib.teams.helsinki-systems ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a17625927fc2..4a9ae7cc05a4 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1074,6 +1074,7 @@ mapAliases {
   linuxPackages_6_12 = linuxKernel.packages.linux_6_12;
   linuxPackages_6_13 = linuxKernel.packages.linux_6_13;
   linuxPackages_6_14 = linuxKernel.packages.linux_6_14;
+  linuxPackages_6_15 = linuxKernel.packages.linux_6_15;
   linuxPackages_rpi0 = linuxKernel.packages.linux_rpi1;
   linuxPackages_rpi02w = linuxKernel.packages.linux_rpi3;
   linuxPackages_rpi1 = linuxKernel.packages.linux_rpi1;
@@ -1096,6 +1097,7 @@ mapAliases {
   linux_6_12 = linuxKernel.kernels.linux_6_12;
   linux_6_13 = linuxKernel.kernels.linux_6_13;
   linux_6_14 = linuxKernel.kernels.linux_6_14;
+  linux_6_15 = linuxKernel.kernels.linux_6_15;
   linux_rpi0 = linuxKernel.kernels.linux_rpi1;
   linux_rpi02w = linuxKernel.kernels.linux_rpi3;
   linux_rpi1 = linuxKernel.kernels.linux_rpi1;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 73693b082f33..894339ac41d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4084,8 +4084,6 @@ with pkgs;
 
   padthv1 = libsForQt5.callPackage ../applications/audio/padthv1 { };
 
-  pageedit = qt6Packages.callPackage ../applications/office/PageEdit { };
-
   pagefind = libsForQt5.callPackage ../applications/misc/pagefind { };
 
   pakcs = callPackage ../development/compilers/pakcs { };
@@ -16149,8 +16147,6 @@ with pkgs;
 
   ### MISC
 
-  android-file-transfer = libsForQt5.callPackage ../tools/filesystems/android-file-transfer { };
-
   antimicrox = libsForQt5.callPackage ../tools/misc/antimicrox { };
 
   autotiling = python3Packages.callPackage ../misc/autotiling { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index a700297a9c97..be373bc68e26 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -243,6 +243,14 @@ in
           ];
         };
 
+        linux_6_15 = callPackage ../os-specific/linux/kernel/mainline.nix {
+          branch = "6.15";
+          kernelPatches = [
+            kernelPatches.bridge_stp_helper
+            kernelPatches.request_key_helper
+          ];
+        };
+
         linux_testing =
           let
             testing = callPackage ../os-specific/linux/kernel/mainline.nix {
@@ -752,6 +760,7 @@ in
       linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
       linux_6_13 = recurseIntoAttrs (packagesFor kernels.linux_6_13);
       linux_6_14 = recurseIntoAttrs (packagesFor kernels.linux_6_14);
+      linux_6_15 = recurseIntoAttrs (packagesFor kernels.linux_6_15);
     }
     // lib.optionalAttrs config.allowAliases {
       linux_4_19 = throw "linux 4.19 was removed because it will reach its end of life within 24.11"; # Added 2024-09-21
@@ -821,7 +830,7 @@ in
     {
       linux_default = packages.linux_6_12;
       # Update this when adding the newest kernel major version!
-      linux_latest = packages.linux_6_14;
+      linux_latest = packages.linux_6_15;
       linux_rt_default = packages.linux_rt_5_15;
       linux_rt_latest = packages.linux_rt_6_6;
     }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 85a82ae32c57..3bb28911a05e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -317,6 +317,8 @@ self: super: with self; {
 
   aiohttp-sse = callPackage ../development/python-modules/aiohttp-sse { };
 
+  aiohttp-sse-client = callPackage ../development/python-modules/aiohttp-sse-client { };
+
   aiohttp-sse-client2 = callPackage ../development/python-modules/aiohttp-sse-client2 { };
 
   aiohttp-swagger = callPackage ../development/python-modules/aiohttp-swagger { };
@@ -3829,6 +3831,10 @@ self: super: with self; {
 
   django-ninja = callPackage ../development/python-modules/django-ninja { };
 
+  django-ninja-cursor-pagination =
+    callPackage ../development/python-modules/django-ninja-cursor-pagination
+      { };
+
   django-oauth-toolkit = callPackage ../development/python-modules/django-oauth-toolkit { };
 
   django-organizations = callPackage ../development/python-modules/django-organizations { };
@@ -3857,6 +3863,8 @@ self: super: with self; {
 
   django-polymorphic = callPackage ../development/python-modules/django-polymorphic { };
 
+  django-postgres-partition = callPackage ../development/python-modules/django-postgres-partition { };
+
   django-postgresql-netfields =
     callPackage ../development/python-modules/django-postgresql-netfields
       { };
@@ -6412,6 +6420,8 @@ self: super: with self; {
     callPackage ../development/python-modules/home-assistant-chip-wheels { }
   );
 
+  home-connect-async = callPackage ../development/python-modules/home-connect-async { };
+
   homeassistant-stubs = callPackage ../servers/home-assistant/stubs.nix { };
 
   homeconnect = callPackage ../development/python-modules/homeconnect { };
@@ -10203,6 +10213,8 @@ self: super: with self; {
 
   oath = callPackage ../development/python-modules/oath { };
 
+  oauth2-client = callPackage ../development/python-modules/oauth2-client { };
+
   oauth2client = callPackage ../development/python-modules/oauth2client { };
 
   oauthenticator = callPackage ../development/python-modules/oauthenticator { };