diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 56d897e9674e..637d578088b9 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -211,6 +211,8 @@
 
 - [Pareto Security](https://paretosecurity.com/) is an alternative to corporate compliance solutions for companies that care about security but know it doesn't have to be invasive. Available as [services.paretosecurity](#opt-services.paretosecurity.enable)
 
+- [GNU Rush](https://gnu.org/software/rush/) is a Restricted User Shell, designed for systems providing limited remote access to their resources. Available as [programs.rush](#opt-programs.rush.enable).
+
 - [ipfs-cluster](https://ipfscluster.io/), Pinset orchestration for IPFS. Available as [services.ipfs-cluster](#opt-services.ipfs-cluster.enable)
 
 - [bitbox-bridge](https://github.com/BitBoxSwiss/bitbox-bridge), a bridge software that connects BitBox hardware wallets to computers & web wallets like [Rabby](https://rabby.io/). Allows one to interact & transact with smart contracts, Web3 websites & financial services without storing private keys anywhere other than the hardware wallet. Available as [services.bitbox-bridge](#opt-services.bitbox-bridge.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 09f56c25b0fe..f9d300e3da80 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -290,6 +290,7 @@
   ./programs/quark-goldleaf.nix
   ./programs/regreet.nix
   ./programs/rog-control-center.nix
+  ./programs/rush.nix
   ./programs/rust-motd.nix
   ./programs/ryzen-monitor-ng.nix
   ./programs/screen.nix
diff --git a/nixos/modules/programs/rush.nix b/nixos/modules/programs/rush.nix
new file mode 100644
index 000000000000..782e6da2c2a3
--- /dev/null
+++ b/nixos/modules/programs/rush.nix
@@ -0,0 +1,109 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.rush;
+
+  indent =
+    lines:
+    lib.pipe lines [
+      (lib.splitString "\n")
+      (builtins.filter (line: line != ""))
+      (map (line: "  " + line))
+      (builtins.concatStringsSep "\n")
+    ];
+in
+{
+  meta.maintainers = pkgs.rush.meta.maintainers;
+
+  options.programs.rush = with lib.types; {
+    enable = lib.mkEnableOption "Restricted User Shell.";
+
+    package = lib.mkPackageOption pkgs "rush" { } // {
+      type = shellPackage;
+    };
+
+    global = lib.mkOption {
+      type = lines;
+      description = "The `global` statement defines global settings.";
+      default = "";
+    };
+
+    rules = lib.mkOption {
+      type = attrsOf lines;
+      default = { };
+
+      description = ''
+        The rule statement configures a GNU Rush rule. This is a block statement, which means that all
+        statements located between it and the next rule statement (or end of file, whichever occurs first)
+        modify the definition of that rule.
+      '';
+    };
+
+    shell = lib.mkOption {
+      readOnly = true;
+      type = either shellPackage path;
+
+      description = ''
+        The resolved shell path that users can inherit to set `rush` as their login shell.
+        This is a convenience option for use in user definitions. Example:
+          `users.users.alice = { inherit (config.programs.rush) shell; ... };`
+      '';
+    };
+
+    wrap = lib.mkOption {
+      type = bool;
+      default = config.security.enableWrappers;
+      defaultText = lib.literalExpression "config.security.enableWrappers";
+
+      description = ''
+        Whether to wrap the `rush` binary with a SUID-enabled wrapper.
+        This is required if {option}`security.enableWrappers` is enabled in your configuration.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      (lib.mkIf cfg.wrap {
+        security.wrappers.rush = lib.mkDefault {
+          group = "root";
+          owner = "root";
+          permissions = "u+rx,g+x,o+x";
+          setgid = false;
+          setuid = true;
+          source = lib.getExe cfg.package;
+        };
+      })
+
+      {
+        programs.rush.shell = if cfg.wrap then config.security.wrapperDir + "/rush" else cfg.package;
+
+        environment = {
+          shells = [ cfg.shell ];
+          systemPackages = [ cfg.package ];
+
+          etc."rush.rc".text =
+            lib.pipe
+              [
+                "# This file was created by the module `programs.rush`;"
+                "rush 2.0"
+                (lib.optionalString (cfg.global != "") "global\n${indent cfg.global}")
+                (lib.optionals (cfg.rules != { }) (
+                  lib.mapAttrsToList (name: content: "rule ${name}\n${indent content}") cfg.rules
+                ))
+              ]
+              [
+                (lib.flatten)
+                (builtins.filter (line: line != ""))
+                (builtins.concatStringsSep "\n\n")
+                (lib.mkDefault)
+              ];
+        };
+      }
+    ]
+  );
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 2ccd689b16c8..1f866d1f6cb5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -636,7 +636,7 @@ in
   home-assistant = runTest ./home-assistant.nix;
   hostname = handleTest ./hostname.nix { };
   hound = handleTest ./hound.nix { };
-  hub = handleTest ./git/hub.nix { };
+  hub = runTest ./git/hub.nix;
   hydra = runTest ./hydra;
   i3wm = handleTest ./i3wm.nix { };
   icingaweb2 = runTest ./icingaweb2.nix;
@@ -740,7 +740,7 @@ in
   localsend = handleTest ./localsend.nix { };
   locate = handleTest ./locate.nix { };
   login = handleTest ./login.nix { };
-  logrotate = handleTest ./logrotate.nix { };
+  logrotate = runTest ./logrotate.nix;
   loki = handleTest ./loki.nix { };
   luks = handleTest ./luks.nix { };
   lvm2 = handleTest ./lvm2 { };
@@ -770,7 +770,7 @@ in
   mailhog = runTest ./mailhog.nix;
   mailpit = runTest ./mailpit.nix;
   mailman = runTest ./mailman.nix;
-  man = handleTest ./man.nix { };
+  man = runTest ./man.nix;
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix { };
   marytts = handleTest ./marytts.nix { };
   mastodon = pkgs.recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
@@ -1177,6 +1177,7 @@ in
   rsyslogd = handleTest ./rsyslogd.nix { };
   rtkit = runTest ./rtkit.nix;
   rtorrent = handleTest ./rtorrent.nix { };
+  rush = runTest ./rush.nix;
   rustls-libssl = handleTest ./rustls-libssl.nix { };
   rxe = handleTest ./rxe.nix { };
   sabnzbd = handleTest ./sabnzbd.nix { };
diff --git a/nixos/tests/forgejo.nix b/nixos/tests/forgejo.nix
index 38ef6cc57ed4..a35ee87ff68c 100644
--- a/nixos/tests/forgejo.nix
+++ b/nixos/tests/forgejo.nix
@@ -60,7 +60,6 @@ let
               pkgs.gnupg
               pkgs.jq
               pkgs.file
-              pkgs.htmlq
             ];
             services.openssh.enable = true;
 
@@ -253,27 +252,22 @@ let
               client.succeed("git -C /tmp/repo push origin main")
 
               def poll_workflow_action_status(_) -> bool:
-                  output = server.succeed(
-                      "curl --fail http://localhost:3000/test/repo/actions | "
-                      + 'htmlq ".flex-item-leading span" --attribute "data-tooltip-content"'
-                  ).strip()
+                  try:
+                      response = server.succeed("curl --fail http://localhost:3000/api/v1/repos/test/repo/actions/tasks")
+                      status = json.loads(response).get("workflow_runs")[0].get("status")
 
-                  # values taken from https://codeberg.org/forgejo/forgejo/src/commit/af47c583b4fb3190fa4c4c414500f9941cc02389/options/locale/locale_en-US.ini#L3649-L3661
-                  if output in [ "Failure", "Canceled", "Skipped", "Blocked" ]:
-                      raise Exception(f"Workflow status is '{output}', which we consider failed.")
-                      server.log(f"Command returned '{output}', which we consider failed.")
+                  except IndexError:
+                      status = "???"
 
-                  elif output in [ "Unknown", "Waiting", "Running", "" ]:
-                      server.log(f"Workflow status is '{output}'. Waiting some more...")
-                      return False
+                  server.log(f"Workflow status: {status}")
 
-                  elif output in [ "Success" ]:
-                      return True
+                  if status == "failure":
+                      raise Exception("Workflow failed")
 
-                  raise Exception(f"Workflow status is '{output}', which we don't know. Value mappings likely need updating.")
+                  return status == "success"
 
               with server.nested("Waiting for the workflow run to be successful"):
-                  retry(poll_workflow_action_status)
+                  retry(poll_workflow_action_status, 60)
 
           with subtest("Testing backup service"):
               server.succeed("${serverSystem}/specialisation/dump/bin/switch-to-configuration test")
diff --git a/nixos/tests/git/hub.nix b/nixos/tests/git/hub.nix
index 43ae2b7ab30b..622f4b6dac05 100644
--- a/nixos/tests/git/hub.nix
+++ b/nixos/tests/git/hub.nix
@@ -1,20 +1,18 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "hub";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ nequissimus ];
+{ pkgs, ... }:
+{
+  name = "hub";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ nequissimus ];
+  };
+
+  nodes.hub =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.hub ];
     };
 
-    nodes.hub =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.hub ];
-      };
-
-    testScript = ''
-      assert "git version ${pkgs.git.version}\nhub version ${pkgs.hub.version}\n" in hub.succeed("hub version")
-      assert "These GitHub commands are provided by hub" in hub.succeed("hub help")
-    '';
-  }
-)
+  testScript = ''
+    assert "git version ${pkgs.git.version}\nhub version ${pkgs.hub.version}\n" in hub.succeed("hub version")
+    assert "These GitHub commands are provided by hub" in hub.succeed("hub help")
+  '';
+}
diff --git a/nixos/tests/hadoop/hbase.nix b/nixos/tests/hadoop/hbase.nix
index efc85c869bf9..f6eb1f7e759a 100644
--- a/nixos/tests/hadoop/hbase.nix
+++ b/nixos/tests/hadoop/hbase.nix
@@ -116,6 +116,9 @@ import ../make-test-python.nix (
       zookeeper.wait_for_unit("zookeeper")
       zookeeper.wait_for_open_port(2181)
 
+      # wait for HDFS cluster to be RW
+      datanode.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
+
       # wait for HBase to start up
       master.wait_for_unit("hbase-master")
       regionserver.wait_for_unit("hbase-regionserver")
diff --git a/nixos/tests/logrotate.nix b/nixos/tests/logrotate.nix
index 1efbcc4cfed5..603a0f164c46 100644
--- a/nixos/tests/logrotate.nix
+++ b/nixos/tests/logrotate.nix
@@ -10,137 +10,134 @@ let
     };
 
 in
+{ pkgs, ... }:
+{
+  name = "logrotate";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ martinetd ];
+  };
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  rec {
-    name = "logrotate";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ martinetd ];
-    };
-
-    nodes = {
-      defaultMachine =
-        { ... }:
-        {
-          services.logrotate.enable = true;
+  nodes = {
+    defaultMachine =
+      { ... }:
+      {
+        services.logrotate.enable = true;
+      };
+    failingMachine =
+      { ... }:
+      {
+        services.logrotate = {
+          enable = true;
+          configFile = pkgs.writeText "logrotate.conf" ''
+            # self-written config file
+            su notarealuser notagroupeither
+          '';
         };
-      failingMachine =
-        { ... }:
-        {
-          services.logrotate = {
-            enable = true;
-            configFile = pkgs.writeText "logrotate.conf" ''
-              # self-written config file
-              su notarealuser notagroupeither
-            '';
-          };
-        };
-      machine =
-        { config, ... }:
-        {
-          imports = [ importTest ];
+      };
+    machine =
+      { config, ... }:
+      {
+        imports = [ importTest ];
 
-          services.logrotate = {
-            enable = true;
-            settings = {
-              # remove default frequency header and add another
-              header = {
-                frequency = null;
-                delaycompress = true;
-              };
-              # extra global setting... affecting nothing
-              last_line = {
-                global = true;
-                priority = 2000;
-                shred = true;
-              };
-              # using mail somewhere should add --mail to logrotate invocation
-              sendmail = {
-                mail = "user@domain.tld";
-              };
-              # postrotate should be suffixed by 'endscript'
-              postrotate = {
-                postrotate = "touch /dev/null";
-              };
-              # check checkConfig works as expected: there is nothing to check here
-              # except that the file build passes
-              checkConf = {
-                su = "root utmp";
-                createolddir = "0750 root utmp";
-                create = "root utmp";
-                "create " = "0750 root utmp";
-              };
-              # multiple paths should be aggregated
-              multipath = {
-                files = [
-                  "file1"
-                  "file2"
-                ];
-              };
-              # overriding imported path should keep existing attributes
-              # (e.g. olddir is still set)
-              import = {
-                notifempty = true;
-              };
+        services.logrotate = {
+          enable = true;
+          settings = {
+            # remove default frequency header and add another
+            header = {
+              frequency = null;
+              delaycompress = true;
+            };
+            # extra global setting... affecting nothing
+            last_line = {
+              global = true;
+              priority = 2000;
+              shred = true;
+            };
+            # using mail somewhere should add --mail to logrotate invocation
+            sendmail = {
+              mail = "user@domain.tld";
+            };
+            # postrotate should be suffixed by 'endscript'
+            postrotate = {
+              postrotate = "touch /dev/null";
+            };
+            # check checkConfig works as expected: there is nothing to check here
+            # except that the file build passes
+            checkConf = {
+              su = "root utmp";
+              createolddir = "0750 root utmp";
+              create = "root utmp";
+              "create " = "0750 root utmp";
+            };
+            # multiple paths should be aggregated
+            multipath = {
+              files = [
+                "file1"
+                "file2"
+              ];
+            };
+            # overriding imported path should keep existing attributes
+            # (e.g. olddir is still set)
+            import = {
+              notifempty = true;
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      with subtest("whether logrotate works"):
-          # we must rotate once first to create logrotate stamp
-          defaultMachine.succeed("systemctl start logrotate.service")
-          # we need to wait for console text once here to
-          # clear console buffer up to this point for next wait
-          defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
+  testScript = ''
+    with subtest("whether logrotate works"):
+        # we must rotate once first to create logrotate stamp
+        defaultMachine.succeed("systemctl start logrotate.service")
+        # we need to wait for console text once here to
+        # clear console buffer up to this point for next wait
+        defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
 
-          defaultMachine.succeed(
-              # wtmp is present in default config.
-              "rm -f /var/log/wtmp*",
-              # we need to give it at least 1MB
-              "dd if=/dev/zero of=/var/log/wtmp bs=2M count=1",
+        defaultMachine.succeed(
+            # wtmp is present in default config.
+            "rm -f /var/log/wtmp*",
+            # we need to give it at least 1MB
+            "dd if=/dev/zero of=/var/log/wtmp bs=2M count=1",
 
-              # move into the future and check rotation.
-              "date -s 'now + 1 month + 1 day'")
-          defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
-          defaultMachine.succeed(
-              # check rotate worked
-              "[ -e /var/log/wtmp.1 ]",
-          )
-      with subtest("default config does not have mail"):
-          defaultMachine.fail("systemctl cat logrotate.service | grep -- --mail")
-      with subtest("using mails adds mail option"):
-          machine.succeed("systemctl cat logrotate.service | grep -- --mail")
-      with subtest("check generated config matches expectation"):
-          machine.succeed(
-              # copy conf to /tmp/logrotate.conf for easy grep
-              "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
-              "! grep weekly /tmp/logrotate.conf",
-              "grep -E '^delaycompress' /tmp/logrotate.conf",
-              "tail -n 1 /tmp/logrotate.conf | grep shred",
-              "sed -ne '/\"sendmail\" {/,/}/p' /tmp/logrotate.conf | grep 'mail user@domain.tld'",
-              "sed -ne '/\"postrotate\" {/,/}/p' /tmp/logrotate.conf | grep endscript",
-              "grep '\"file1\"\n\"file2\" {' /tmp/logrotate.conf",
-              "sed -ne '/\"import\" {/,/}/p' /tmp/logrotate.conf | grep noolddir",
-          )
-          # also check configFile option
-          failingMachine.succeed(
-              "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
-              "grep 'self-written config' /tmp/logrotate.conf",
-          )
-      with subtest("Check logrotate-checkconf service"):
-          machine.wait_for_unit("logrotate-checkconf.service")
-          # wait_for_unit also asserts for success, so wait for
-          # parent target instead and check manually.
-          failingMachine.wait_for_unit("multi-user.target")
-          info = failingMachine.get_unit_info("logrotate-checkconf.service")
-          if info["ActiveState"] != "failed":
-              raise Exception('logrotate-checkconf.service was not failed')
+            # move into the future and check rotation.
+            "date -s 'now + 1 month + 1 day'")
+        defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
+        defaultMachine.succeed(
+            # check rotate worked
+            "[ -e /var/log/wtmp.1 ]",
+        )
+    with subtest("default config does not have mail"):
+        defaultMachine.fail("systemctl cat logrotate.service | grep -- --mail")
+    with subtest("using mails adds mail option"):
+        machine.succeed("systemctl cat logrotate.service | grep -- --mail")
+    with subtest("check generated config matches expectation"):
+        machine.succeed(
+            # copy conf to /tmp/logrotate.conf for easy grep
+            "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
+            "! grep weekly /tmp/logrotate.conf",
+            "grep -E '^delaycompress' /tmp/logrotate.conf",
+            "tail -n 1 /tmp/logrotate.conf | grep shred",
+            "sed -ne '/\"sendmail\" {/,/}/p' /tmp/logrotate.conf | grep 'mail user@domain.tld'",
+            "sed -ne '/\"postrotate\" {/,/}/p' /tmp/logrotate.conf | grep endscript",
+            "grep '\"file1\"\n\"file2\" {' /tmp/logrotate.conf",
+            "sed -ne '/\"import\" {/,/}/p' /tmp/logrotate.conf | grep noolddir",
+        )
+        # also check configFile option
+        failingMachine.succeed(
+            "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
+            "grep 'self-written config' /tmp/logrotate.conf",
+        )
+    with subtest("Check logrotate-checkconf service"):
+        machine.wait_for_unit("logrotate-checkconf.service")
+        # wait_for_unit also asserts for success, so wait for
+        # parent target instead and check manually.
+        failingMachine.wait_for_unit("multi-user.target")
+        info = failingMachine.get_unit_info("logrotate-checkconf.service")
+        if info["ActiveState"] != "failed":
+            raise Exception('logrotate-checkconf.service was not failed')
 
-      machine.log(machine.execute("systemd-analyze security logrotate.service | grep -v ✓")[1])
+    machine.log(machine.execute("systemd-analyze security logrotate.service | grep -v ✓")[1])
 
-    '';
-  }
-)
+  '';
+}
diff --git a/nixos/tests/man.nix b/nixos/tests/man.nix
index 510a46a46ec9..5155fcbe055a 100644
--- a/nixos/tests/man.nix
+++ b/nixos/tests/man.nix
@@ -1,111 +1,109 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    manImplementations = [
-      "mandoc"
-      "man-db"
+{ pkgs, lib, ... }:
+let
+  manImplementations = [
+    "mandoc"
+    "man-db"
+  ];
+
+  machineNames = builtins.map machineSafe manImplementations;
+
+  makeConfig = useImpl: {
+    # Note: mandoc currently can't index symlinked section directories.
+    # So if a man section comes from one package exclusively (e. g.
+    # 1p from man-pages-posix and 2 from man-pages), it isn't searchable.
+    environment.systemPackages = [
+      pkgs.man-pages
+      pkgs.openssl
+      pkgs.libunwind
     ];
 
-    machineNames = builtins.map machineSafe manImplementations;
-
-    makeConfig = useImpl: {
-      # Note: mandoc currently can't index symlinked section directories.
-      # So if a man section comes from one package exclusively (e. g.
-      # 1p from man-pages-posix and 2 from man-pages), it isn't searchable.
-      environment.systemPackages = [
-        pkgs.man-pages
-        pkgs.openssl
-        pkgs.libunwind
-      ];
-
-      documentation = {
-        enable = true;
-        nixos.enable = lib.mkForce true;
-        dev.enable = true;
-        man =
-          {
-            enable = true;
-            generateCaches = true;
-          }
-          // lib.listToAttrs (
-            builtins.map (impl: {
-              name = impl;
-              value = {
-                enable = useImpl == impl;
-              };
-            }) manImplementations
-          );
-      };
+    documentation = {
+      enable = true;
+      nixos.enable = lib.mkForce true;
+      dev.enable = true;
+      man =
+        {
+          enable = true;
+          generateCaches = true;
+        }
+        // lib.listToAttrs (
+          builtins.map (impl: {
+            name = impl;
+            value = {
+              enable = useImpl == impl;
+            };
+          }) manImplementations
+        );
     };
+  };
 
-    machineSafe = builtins.replaceStrings [ "-" ] [ "_" ];
-  in
-  {
-    name = "man";
-    meta.maintainers = [ lib.maintainers.sternenseemann ];
+  machineSafe = builtins.replaceStrings [ "-" ] [ "_" ];
+in
+{
+  name = "man";
+  meta.maintainers = [ lib.maintainers.sternenseemann ];
 
-    nodes = lib.listToAttrs (
-      builtins.map (i: {
-        name = machineSafe i;
-        value = makeConfig i;
-      }) manImplementations
-    );
+  nodes = lib.listToAttrs (
+    builtins.map (i: {
+      name = machineSafe i;
+      value = makeConfig i;
+    }) manImplementations
+  );
 
-    testScript =
-      ''
-        import re
-        start_all()
+  testScript =
+    ''
+      import re
+      start_all()
 
-        def match_man_k(page, section, haystack):
-          """
-          Check if the man page {page}({section}) occurs in
-          the output of `man -k` given as haystack. Note:
-          This is not super reliable, e. g. it can't deal
-          with man pages that are in multiple sections.
-          """
+      def match_man_k(page, section, haystack):
+        """
+        Check if the man page {page}({section}) occurs in
+        the output of `man -k` given as haystack. Note:
+        This is not super reliable, e. g. it can't deal
+        with man pages that are in multiple sections.
+        """
 
-          for line in haystack.split("\n"):
-            # man -k can look like this:
-            # page(3) - bla
-            # page (3) - bla
-            # pagea, pageb (3, 3P) - foo
-            # pagea, pageb, pagec(3) - bar
-            pages = line.split("(")[0]
-            sections = re.search("\\([a-zA-Z1-9, ]+\\)", line)
-            if sections is None:
-              continue
-            else:
-              sections = sections.group(0)[1:-1]
+        for line in haystack.split("\n"):
+          # man -k can look like this:
+          # page(3) - bla
+          # page (3) - bla
+          # pagea, pageb (3, 3P) - foo
+          # pagea, pageb, pagec(3) - bar
+          pages = line.split("(")[0]
+          sections = re.search("\\([a-zA-Z1-9, ]+\\)", line)
+          if sections is None:
+            continue
+          else:
+            sections = sections.group(0)[1:-1]
 
-            if page in pages and f'{section}' in sections:
-              return True
+          if page in pages and f'{section}' in sections:
+            return True
 
-          return False
+        return False
 
-      ''
-      + lib.concatMapStrings (machine: ''
-        with subtest("Test direct man page lookups in ${machine}"):
-          # man works
-          ${machine}.succeed("man man > /dev/null")
-          # devman works
-          ${machine}.succeed("man 3 libunwind > /dev/null")
-          # NixOS configuration man page is installed
-          ${machine}.succeed("man configuration.nix > /dev/null")
+    ''
+    + lib.concatMapStrings (machine: ''
+      with subtest("Test direct man page lookups in ${machine}"):
+        # man works
+        ${machine}.succeed("man man > /dev/null")
+        # devman works
+        ${machine}.succeed("man 3 libunwind > /dev/null")
+        # NixOS configuration man page is installed
+        ${machine}.succeed("man configuration.nix > /dev/null")
 
-        with subtest("Test generateCaches via man -k in ${machine}"):
-          expected = [
-            ("openssl", "ssl", 3),
-            ("unwind", "libunwind", 3),
-            ("user", "useradd", 8),
-            ("user", "userdel", 8),
-            ("mem", "free", 3),
-            ("mem", "free", 1),
-          ]
+      with subtest("Test generateCaches via man -k in ${machine}"):
+        expected = [
+          ("openssl", "ssl", 3),
+          ("unwind", "libunwind", 3),
+          ("user", "useradd", 8),
+          ("user", "userdel", 8),
+          ("mem", "free", 3),
+          ("mem", "free", 1),
+        ]
 
-          for (keyword, page, section) in expected:
-            matches = ${machine}.succeed(f"man -k {keyword}")
-            if not match_man_k(page, section, matches):
-              raise Exception(f"{page}({section}) missing in matches: {matches}")
-      '') machineNames;
-  }
-)
+        for (keyword, page, section) in expected:
+          matches = ${machine}.succeed(f"man -k {keyword}")
+          if not match_man_k(page, section, matches):
+            raise Exception(f"{page}({section}) missing in matches: {matches}")
+    '') machineNames;
+}
diff --git a/nixos/tests/rush.nix b/nixos/tests/rush.nix
new file mode 100644
index 000000000000..0fcd87d15f58
--- /dev/null
+++ b/nixos/tests/rush.nix
@@ -0,0 +1,88 @@
+{ pkgs, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilEd25519PrivateKey snakeOilEd25519PublicKey;
+  username = "nix-remote-builder";
+in
+{
+  name = "rush";
+  meta = { inherit (pkgs.rush.meta) maintainers platforms; };
+
+  nodes = {
+    client =
+      { ... }:
+      {
+        nix.settings.extra-experimental-features = [ "nix-command" ];
+      };
+
+    server =
+      { config, ... }:
+      {
+        nix.settings.trusted-users = [ "${username}" ];
+
+        programs.rush = {
+          enable = true;
+          global = "debug 1";
+
+          rules = {
+            daemon = ''
+              match $# == 2
+              match $0 == "nix-daemon"
+              match $1 == "--stdio"
+              match $user == "${username}"
+              chdir "${config.nix.package}/bin"
+            '';
+
+            whoami = ''
+              match $# == 1
+              match $0 == "whoami"
+              match $user == "${username}"
+              chdir "${dirOf config.environment.usrbinenv}"
+            '';
+          };
+        };
+
+        services.openssh = {
+          enable = true;
+
+          extraConfig = ''
+            Match User ${username}
+              AllowAgentForwarding no
+              AllowTcpForwarding no
+              PermitTTY no
+              PermitTunnel no
+              X11Forwarding no
+            Match All
+          '';
+        };
+
+        users = {
+          groups."${username}" = { };
+
+          users."${username}" = {
+            inherit (config.programs.rush) shell;
+            group = "${username}";
+            isSystemUser = true;
+            openssh.authorizedKeys.keys = [ snakeOilEd25519PublicKey ];
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    client.succeed("mkdir -m 700 /root/.ssh")
+    client.succeed("cat '${snakeOilEd25519PrivateKey}' | tee /root/.ssh/id_ed25519")
+    client.succeed("chmod 600 /root/.ssh/id_ed25519")
+
+    server.wait_for_unit("sshd")
+
+    client.succeed("ssh-keyscan -H server | tee -a /root/.ssh/known_hosts")
+
+    client.succeed("ssh ${username}@server -- whoami")
+    client.succeed("nix store info --store 'ssh-ng://${username}@server'")
+
+    client.fail("ssh ${username}@server -- date")
+    client.fail("nix store info --store 'ssh://${username}@server'")
+  '';
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix b/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
index fefdefc8eb4f..559d5db86cba 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=./lib"
-    "-DCMAKE_INSTALL_DATADIR=./usr"
+    "-DCMAKE_INSTALL_DATADIR=./share"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ac/actual-server/package.nix b/pkgs/by-name/ac/actual-server/package.nix
index 73a9e3c0a21d..0d1d83b123bc 100644
--- a/pkgs/by-name/ac/actual-server/package.nix
+++ b/pkgs/by-name/ac/actual-server/package.nix
@@ -7,21 +7,49 @@
   cacert,
   gitMinimal,
   nodejs_20,
+  python3,
   yarn,
   nixosTests,
   nix-update-script,
 }:
 let
-  version = "25.3.1";
+  version = "25.4.0";
   src = fetchFromGitHub {
+    name = "actualbudget-actual-source";
     owner = "actualbudget";
     repo = "actual";
     tag = "v${version}";
-    hash = "sha256-UZ2Z1tkMbGJwka//cIC0aG1KCcTSxUPLzctEaOhnKQA=";
+    hash = "sha256-+XYl4Bh0+8bs/FCqlig9egLg3SJCy2SRN2ovxWRE1Ok=";
+  };
+  translations = fetchFromGitHub {
+    name = "actualbudget-translations-source";
+    owner = "actualbudget";
+    repo = "translations";
+    # Note to updaters: this repo is not tagged, so just update this to the Git
+    # tip at the time the update is performed.
+    rev = "312fce7791e6722357e5d2f851407f4b7cf4ecb9";
+    hash = "sha256-kDArpSFiNJJF5ZGCtcn7Ci7wCpI1cTSknDZ4sQgy/Nc=";
   };
 
   yarn_20 = yarn.override { nodejs = nodejs_20; };
 
+  SUPPORTED_ARCHITECTURES = builtins.toJSON {
+    os = [
+      "darwin"
+      "linux"
+    ];
+    cpu = [
+      "arm"
+      "arm64"
+      "ia32"
+      "x64"
+    ];
+    libc = [
+      "glibc"
+      "musl"
+    ];
+  };
+
   # We cannot use fetchYarnDeps because that doesn't support yarn2/berry
   # lockfiles (see https://github.com/NixOS/nixpkgs/issues/254369)
   offlineCache = stdenvNoCC.mkDerivation {
@@ -34,22 +62,7 @@ let
       yarn_20
     ];
 
-    SUPPORTED_ARCHITECTURES = builtins.toJSON {
-      os = [
-        "darwin"
-        "linux"
-      ];
-      cpu = [
-        "arm"
-        "arm64"
-        "ia32"
-        "x64"
-      ];
-      libc = [
-        "glibc"
-        "musl"
-      ];
-    };
+    inherit SUPPORTED_ARCHITECTURES;
 
     buildPhase = ''
       runHook preBuild
@@ -57,9 +70,15 @@ let
       export HOME=$(mktemp -d)
       yarn config set enableTelemetry 0
       yarn config set cacheFolder $out
+      # At this stage we don't need binaries yet, so we can skip preinstall
+      # scripts here.
+      yarn config set enableScripts false
       yarn config set --json supportedArchitectures "$SUPPORTED_ARCHITECTURES"
 
-      yarn workspaces focus @actual-app/sync-server --production
+      # Install dependencies for all workspaces, and include devDependencies,
+      # to build web UI. Dependencies will be re-created in offline mode in the
+      # package's install phase.
+      yarn install --immutable
 
       runHook postBuild
     '';
@@ -76,14 +95,61 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash =
-      {
-        aarch64-darwin = "sha256-IJBfBA71PZeE/Zlu2kzQw8l/D4lVAV5I5loRyRfncKA=";
-        aarch64-linux = "sha256-djE2lt/o/7kd7ci2TW3mhjSptD3etChbvtdbiWqp/wo=";
-        x86_64-darwin = "sha256-AShd87VFwqDbJZoFJPg6HsdhTx7XMVdZ5sRWLXU8ldM=";
-        x86_64-linux = "sha256-me0v+RuoleOKFRyJ7iyLTKRnV2Cz2Q1MLc/SE2sSSH8=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    outputHash = "sha256-Tac2gOkdc2tzNKB3ARMfJad1MkOphudvN74gI8bGMtY=";
+  };
+
+  webUi = stdenvNoCC.mkDerivation {
+    pname = "actual-server-webui";
+    inherit version;
+    srcs = [
+      src
+      translations
+    ];
+    sourceRoot = "${src.name}/";
+
+    nativeBuildInputs = [
+      nodejs_20
+      yarn_20
+    ];
+
+    inherit SUPPORTED_ARCHITECTURES;
+
+    postPatch = ''
+      ln -sv ../../../${translations.name} ./packages/desktop-client/locale
+      cp -r ${offlineCache}/node_modules ./node_modules
+
+      patchShebangs --build ./bin ./packages/*/bin
+
+      # Patch all references to `git` to a no-op `true`. This neuter automatic
+      # translation update.
+      substituteInPlace bin/package-browser \
+        --replace-fail "git" "true"
+
+      # Allow `remove-untranslated-languages` to do its job.
+      chmod -R u+w ./packages/desktop-client/locale
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder ${offlineCache}
+      yarn config set --json supportedArchitectures "$SUPPORTED_ARCHITECTURES"
+
+      yarn build:server
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r packages/desktop-client/build $out
+
+      runHook postInstall
+    '';
+    dontFixup = true;
   };
 in
 stdenv.mkDerivation {
@@ -92,15 +158,35 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     makeWrapper
+    (python3.withPackages (ps: [ ps.setuptools ])) # Used by node-gyp
     yarn_20
   ];
 
+  inherit SUPPORTED_ARCHITECTURES;
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/{bin,lib,lib/actual/packages/sync-server}
-    cp -r ${offlineCache}/node_modules/ $out/lib/actual
+    mkdir -p $out/{bin,lib,lib/actual/packages/sync-server,lib/actual/packages/desktop-client}
     cp -r ./packages/sync-server/{app.js,src,migrations,package.json} $out/lib/actual/packages/sync-server
+    # sync-server uses package.json to determine path to web ui.
+    cp ./packages/desktop-client/package.json $out/lib/actual/packages/desktop-client
+    cp -r ${webUi} $out/lib/actual/packages/desktop-client/build
+
+    # Re-create node_modules/ to contain just production packages required for
+    # sync-server itself, using existing offline cache. This will also now build
+    # binaries.
+    export HOME=$(mktemp -d)
+    yarn config set enableNetwork false
+    yarn config set enableOfflineMode true
+    yarn config set enableTelemetry 0
+    yarn config set cacheFolder ${offlineCache}
+    yarn config set --json supportedArchitectures "$SUPPORTED_ARCHITECTURES"
+
+    export npm_config_nodedir=${nodejs_20}
+
+    yarn workspaces focus @actual-app/sync-server --production
+    cp -r ./node_modules $out/lib/actual/
 
     makeWrapper ${lib.getExe nodejs_20} "$out/bin/actual-server" \
       --add-flags "$out/lib/actual/packages/sync-server/app.js" \
@@ -110,7 +196,7 @@ stdenv.mkDerivation {
   '';
 
   passthru = {
-    inherit offlineCache;
+    inherit offlineCache webUi;
     tests = nixosTests.actual;
     passthru.updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
index 0128d770d227..50a15bc3b2ff 100644
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300054.0";
+  version = "1.300055.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     tag = "v${version}";
-    hash = "sha256-DakLgM3vNHHzOlQTVMGwIioPhB3YryEcm7T0xepAJu4=";
+    hash = "sha256-/L3pq8c3d8AruKI5hvpW22bYqPypYNMO5ehdCgVrfZc=";
   };
 
-  vendorHash = "sha256-rw+doSJGeFl72hHA8FSL3H61KiYwatabQ7jEMOfJZ60=";
+  vendorHash = "sha256-WhmkVN31snLDGvLCg3pukWIDM5yUXeiYh0ywCF83Y8E=";
 
   # See the list in https://github.com/aws/amazon-cloudwatch-agent/blob/v1.300049.1/Makefile#L68-L77.
   subPackages = [
diff --git a/pkgs/by-name/ar/argocd/package.nix b/pkgs/by-name/ar/argocd/package.nix
index 1f03ca226775..93555ff00f00 100644
--- a/pkgs/by-name/ar/argocd/package.nix
+++ b/pkgs/by-name/ar/argocd/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.14.7";
+  version = "2.14.9";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-ilXJWPvu3qwzuUN6AsQNyzrTHdQO51IFZcvZiQ/+/tU=";
+    hash = "sha256-L8ipYgMpL6IhPh/fSanNywzUMDJQfMZc7pyYr2dtbAw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-sfyTXP2vKVJQdUti0TNW/vrKovvN1/PMhEOUI8IiY44=";
+  vendorHash = "sha256-j+uwLG9/r9dlK9JWrQmJdgBOqgZs/aIvkh1Sg81dm1I=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
diff --git a/pkgs/by-name/ba/backlight-auto/package.nix b/pkgs/by-name/ba/backlight-auto/package.nix
index 3d8dc7338a9c..e6f849bf7096 100644
--- a/pkgs/by-name/ba/backlight-auto/package.nix
+++ b/pkgs/by-name/ba/backlight-auto/package.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = with lib; {
+    # Does not support zig 0.12 or newer, hasn't been updated in 2 years.
+    broken = lib.versionAtLeast zig.version "0.12";
     description = "Automatically set screen brightness with a webcam";
     mainProgram = "backlight-auto";
     homepage = "https://len.falken.directory/backlight-auto.html";
diff --git a/pkgs/by-name/bl/blackshades/package.nix b/pkgs/by-name/bl/blackshades/package.nix
index acdc2e385849..ec2bdfe33d4e 100644
--- a/pkgs/by-name/bl/blackshades/package.nix
+++ b/pkgs/by-name/bl/blackshades/package.nix
@@ -7,22 +7,47 @@
   libGLU,
   libsndfile,
   openal,
-  zig_0_11,
+  zig_0_14,
+  runCommand,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blackshades";
-  version = "2.5.1";
+  version = "2.5.2-unstable-2025-03-12";
 
   src = fetchFromSourcehut {
     owner = "~cnx";
     repo = "blackshades";
-    rev = finalAttrs.version;
+    rev = "a2fbe0e08bedbbbb1089dbb8f3e3cb4d76917bd0";
     fetchSubmodules = true;
-    hash = "sha256-qdpXpuXHr9w2XMfgOVveWv3JoqdJHVB8TCqZdyaw/DM=";
+    hash = "sha256-W6ltmWCw7jfiTiNlh60YVF7mz//8s+bgu4F9gy5cDgw=";
   };
 
-  nativeBuildInputs = [ zig_0_11.hook ];
+  postUnpack = ''
+    ln -s ${
+      runCommand "${finalAttrs.finalPackage.name}-zig-deps"
+        {
+          inherit (finalAttrs) src;
+
+          nativeBuildInputs = [ zig_0_14 ];
+
+          outputHashAlgo = null;
+          outputHashMode = "recursive";
+          outputHash = "sha256-wBIfLeaKtTow2Z7gjEgIFmqcTGWgpRWI+k0t294BslM=";
+        }
+        ''
+          export ZIG_GLOBAL_CACHE_DIR=$(mktemp -d)
+
+          runHook unpackPhase
+          cd $sourceRoot
+
+          zig build --fetch
+          mv $ZIG_GLOBAL_CACHE_DIR/p $out
+        ''
+    } $ZIG_GLOBAL_CACHE_DIR/p
+  '';
+
+  nativeBuildInputs = [ zig_0_14.hook ];
 
   buildInputs = [
     glfw
diff --git a/pkgs/by-name/bo/boringtun/package.nix b/pkgs/by-name/bo/boringtun/package.nix
index f5dc75228c26..c8aa82dedf76 100644
--- a/pkgs/by-name/bo/boringtun/package.nix
+++ b/pkgs/by-name/bo/boringtun/package.nix
@@ -6,31 +6,31 @@
   darwin,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "boringtun";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "boringtun";
-    rev = "boringtun-cli-${version}";
-    sha256 = "sha256-PY7yqBNR4CYh8Y/vk4TYxxJnnv0eig8sjXp4dR4CX04=";
+    tag = "boringtun-${finalAttrs.version}";
+    hash = "sha256-QrgKO0SVU4Z9GlNtZZmOV+Xcm1PonzLbUTGAFFOV/BM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9qvX6P/DquQDlt6wOzI5ZQXQzNil1cD7KiuegDXtrQ0=";
+  cargoHash = "sha256-j1I16QC46MMxcK7rbZJgI8KiKJvF29hkuGKiYLc6uW0=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
 
   # Testing this project requires sudo, Docker and network access, etc.
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Userspace WireGuard® implementation in Rust";
     homepage = "https://github.com/cloudflare/boringtun";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ xrelkd ];
-    platforms = platforms.linux ++ platforms.darwin;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ xrelkd ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "boringtun-cli";
   };
-}
+})
diff --git a/pkgs/by-name/cy/cyber/package.nix b/pkgs/by-name/cy/cyber/package.nix
index 651e8aed7d6d..a2e219ef6f2e 100644
--- a/pkgs/by-name/cy/cyber/package.nix
+++ b/pkgs/by-name/cy/cyber/package.nix
@@ -2,22 +2,22 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  zig_0_11,
+  zig_0_12,
 }:
 
 stdenv.mkDerivation rec {
   pname = "cyber";
-  version = "unstable-2023-09-19";
+  version = "0-unstable-2025-12-10";
 
   src = fetchFromGitHub {
     owner = "fubark";
     repo = "cyber";
-    rev = "f95cd189cf090d26542a87b1d2ced461e75fa1a7";
-    hash = "sha256-ctEd8doXMKq3L9/T+jOcWqlBQN0pVhsu9DjBXsg/u/4=";
+    rev = "2a2298d6aa12f9136b18cd85965f4a58e484f506";
+    hash = "sha256-d81z+wUIQ/KUVa+GyXbT+E8dsG8Mdt1hZW1Qe1mmAiw=";
   };
 
   nativeBuildInputs = [
-    zig_0_11.hook
+    zig_0_12.hook
   ];
 
   zigBuildFlags = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/fubark/cyber";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
-    inherit (zig_0_11.meta) platforms;
+    inherit (zig_0_12.meta) platforms;
     broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/di/direnv/package.nix b/pkgs/by-name/di/direnv/package.nix
index 3ad784acfc22..06bcfa467f36 100644
--- a/pkgs/by-name/di/direnv/package.nix
+++ b/pkgs/by-name/di/direnv/package.nix
@@ -6,6 +6,7 @@
   bash,
   fish,
   zsh,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule rec {
@@ -36,11 +37,15 @@ buildGoModule rec {
   nativeCheckInputs = [
     fish
     zsh
+    writableTmpDirAsHomeHook
   ];
 
   checkPhase = ''
-    export HOME=$(mktemp -d)
+    runHook preCheck
+
     make test-go test-bash test-fish test-zsh
+
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/dt/dt/package.nix b/pkgs/by-name/dt/dt/package.nix
index 550d137b206c..aaa9070bf69b 100644
--- a/pkgs/by-name/dt/dt/package.nix
+++ b/pkgs/by-name/dt/dt/package.nix
@@ -3,21 +3,21 @@
   stdenv,
   fetchFromGitHub,
   testers,
-  zig_0_11,
+  zig_0_12,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dt";
-  version = "1.3.1";
+  version = "1.3.1-unstable-2024-07-16";
 
   src = fetchFromGitHub {
     owner = "so-dang-cool";
     repo = "dt";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-qHfvHf4T0wWnzqp5FfLg7n7te24xc2aMEdTK3Iia8Q0=";
+    rev = "0d16ca2867131e99a93a412231465cf68f2e594f";
+    hash = "sha256-pfTlOMJpOPbXZaJJvOKDUyCZxFHNLRRUteJFWT9IKOU=";
   };
 
-  nativeBuildInputs = [ zig_0_11.hook ];
+  nativeBuildInputs = [ zig_0_12.hook ];
 
   passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
 
@@ -37,7 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
       In short, dt is intended to be generally useful, with zero pretense of
       elegance.
     '';
-    changelog = "https://github.com/so-dang-cool/dt/releases/tag/v${finalAttrs.version}";
+    # TODO: uncomment when dt pushes a new release
+    # changelog = "https://github.com/so-dang-cool/dt/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ booniepepper ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/fa/factorio/versions.json b/pkgs/by-name/fa/factorio/versions.json
index 63d9bca496a2..f8f6ea32e40f 100644
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@@ -3,14 +3,14 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.43.tar.xz"
+          "factorio_linux_2.0.45.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.43.tar.xz",
+        "name": "factorio_alpha_x64-2.0.45.tar.xz",
         "needsAuth": true,
-        "sha256": "971c293f46d2e021be762eb23c45c17746aa5b8ec74e30fef5f46fa32bb7e1aa",
+        "sha256": "32b004a648dfc8b8e2bb6b82f648e5be458a13b7fefad79487a1d663c6f3b711",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.43/alpha/linux64",
-        "version": "2.0.43"
+        "url": "https://factorio.com/get-download/2.0.45/alpha/linux64",
+        "version": "2.0.45"
       },
       "stable": {
         "candidateHashFilenames": [
@@ -51,14 +51,14 @@
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.43.tar.xz"
+          "factorio-space-age_linux_2.0.45.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.43.tar.xz",
+        "name": "factorio_expansion_x64-2.0.45.tar.xz",
         "needsAuth": true,
-        "sha256": "43d98f9dfa4edc15a622b9881f71673902710ef8aa12cccc7f6e8ccd7962488e",
+        "sha256": "7a81be62a051b80166c9f6c9e94fca2e19a0ac65f19769f99a624772f87cdab4",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.43/expansion/linux64",
-        "version": "2.0.43"
+        "url": "https://factorio.com/get-download/2.0.45/expansion/linux64",
+        "version": "2.0.45"
       },
       "stable": {
         "candidateHashFilenames": [
@@ -75,15 +75,15 @@
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.43.tar.xz",
-          "factorio_headless_x64_2.0.43.tar.xz"
+          "factorio-headless_linux_2.0.45.tar.xz",
+          "factorio_headless_x64_2.0.45.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.43.tar.xz",
+        "name": "factorio_headless_x64-2.0.45.tar.xz",
         "needsAuth": false,
-        "sha256": "bde6e167330c4439ce7df3ac519ea445120258ef676f1f6ad31d0c2816d3aee3",
+        "sha256": "4fd7e04bb3ea7d12da8e1c3befc6b53b3c0064775c960a5a9db6a943f2259fc2",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.43/headless/linux64",
-        "version": "2.0.43"
+        "url": "https://factorio.com/get-download/2.0.45/headless/linux64",
+        "version": "2.0.45"
       },
       "stable": {
         "candidateHashFilenames": [
diff --git a/pkgs/by-name/fa/factoriolab/package.nix b/pkgs/by-name/fa/factoriolab/package.nix
index da755eac485c..1fe6de31cb6e 100644
--- a/pkgs/by-name/fa/factoriolab/package.nix
+++ b/pkgs/by-name/fa/factoriolab/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage rec {
   pname = "factoriolab";
-  version = "3.13.2";
+  version = "3.13.3";
 
   src = fetchFromGitHub {
     owner = "factoriolab";
     repo = "factoriolab";
     tag = "v${version}";
-    hash = "sha256-jZLrBt73Af1nmRxPcaTTRovQic4EdQryISlGznT7/iE=";
+    hash = "sha256-HYf6G06dK3wvCOLnKx1aDteQ0SxBDE+yulGJa9VZE9Q=";
   };
   buildInputs = [ vips ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/fiddler-everywhere/package.nix b/pkgs/by-name/fi/fiddler-everywhere/package.nix
index cee3021695df..f166197bb6e7 100644
--- a/pkgs/by-name/fi/fiddler-everywhere/package.nix
+++ b/pkgs/by-name/fi/fiddler-everywhere/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "fiddler-everywhere";
-  version = "6.3.0";
+  version = "6.4.0";
 
   src = fetchurl {
     url = "https://downloads.getfiddler.com/linux/fiddler-everywhere-${version}.AppImage";
-    hash = "sha256-AqwIzjnSq579cSgBbslPXINhXAtGvl8Z7nOWdHzCmro=";
+    hash = "sha256-b90O45IOF1F39fKOxyUk8ONTWhH7A367jJpzeKukj04=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/fi/finamp/package.nix b/pkgs/by-name/fi/finamp/package.nix
index 02c93f920022..d083de8340f4 100644
--- a/pkgs/by-name/fi/finamp/package.nix
+++ b/pkgs/by-name/fi/finamp/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
-  flutter327,
+  stdenv,
+  flutter,
   mpv-unwrapped,
   patchelf,
   fetchFromGitHub,
@@ -8,16 +9,16 @@
   makeDesktopItem,
 }:
 let
-  version = "0.9.14-beta";
+  version = "0.9.15-beta";
 in
-flutter327.buildFlutterApplication {
+flutter.buildFlutterApplication {
   inherit version;
   pname = "finamp";
   src = fetchFromGitHub {
     owner = "jmshrv";
     repo = "finamp";
     rev = version;
-    hash = "sha256-SDzKB5KLHkJ3xcJY67TNBXDiDlBOApKrh4x0OZR/K/M=";
+    hash = "sha256-ekCdHU9z8nxcIFz3oN0txlIKWAwhMV8Q5/t5QYvbzCc=";
   };
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -64,6 +65,8 @@ flutter327.buildFlutterApplication {
   ];
 
   meta = {
+    # Finamp depends on `ìsar`, which for Linux is only compiled for x86_64. https://github.com/jmshrv/finamp/issues/766
+    broken = stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isx86_64;
     description = "Open source Jellyfin music player";
     homepage = "https://github.com/jmshrv/finamp";
     license = lib.licenses.mpl20;
diff --git a/pkgs/by-name/fi/finamp/pubspec.lock.json b/pkgs/by-name/fi/finamp/pubspec.lock.json
index 824acc28dd8d..89636bc09f2d 100644
--- a/pkgs/by-name/fi/finamp/pubspec.lock.json
+++ b/pkgs/by-name/fi/finamp/pubspec.lock.json
@@ -17,7 +17,7 @@
       "version": "0.3.3"
     },
     "analyzer": {
-      "dependency": "direct overridden",
+      "dependency": "direct main",
       "description": {
         "name": "analyzer",
         "sha256": "1f14db053a8c23e260789e9b0980fa27f2680dd640932cae5e1137cce0e46e1e",
@@ -27,7 +27,7 @@
       "version": "6.11.0"
     },
     "analyzer_plugin": {
-      "dependency": "transitive",
+      "dependency": "direct overridden",
       "description": {
         "name": "analyzer_plugin",
         "sha256": "9661b30b13a685efaee9f02e5d01ed9f2b423bd889d28a304d02d704aee69161",
@@ -50,31 +50,31 @@
       "dependency": "transitive",
       "description": {
         "name": "archive",
-        "sha256": "6199c74e3db4fbfbd04f66d739e72fe11c8a8957d5f219f1f4482dbde6420b5a",
+        "sha256": "0c64e928dcbefddecd234205422bcfc2b5e6d31be0b86fef0d0dd48d7b4c9742",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.2"
+      "version": "4.0.4"
     },
     "args": {
       "dependency": "transitive",
       "description": {
         "name": "args",
-        "sha256": "bf9f5caeea8d8fe6721a9c358dd8a5c1947b27f1cfaa18b39c301273594919e6",
+        "sha256": "d0481093c50b1da8910eb0bb301626d4d8eb7284aa739614d2b394ee09e3ea04",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.0"
+      "version": "2.7.0"
     },
     "async": {
       "dependency": "transitive",
       "description": {
         "name": "async",
-        "sha256": "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c",
+        "sha256": "d2872f9c19731c2e5f10444b14686eb7cc85c76274bd6c16e1816bff9a3bab63",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.11.0"
+      "version": "2.12.0"
     },
     "audio_service": {
       "dependency": "direct main",
@@ -90,11 +90,11 @@
       "dependency": "direct main",
       "description": {
         "name": "audio_service_mpris",
-        "sha256": "b16db3584a4b2464c0bfd575c1a21765723d257931222f8adfcb0511f940d352",
+        "sha256": "fdab1ae1f659c6db36d5cc396e46e4ee9663caefa6153f8453fcd01d57567c08",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.5"
+      "version": "0.2.0"
     },
     "audio_service_platform_interface": {
       "dependency": "direct main",
@@ -140,11 +140,11 @@
       "dependency": "direct main",
       "description": {
         "name": "background_downloader",
-        "sha256": "ed64a215cd24c83a478f602364a3ca86a6dafd178ad783188cc32c6956d5e529",
+        "sha256": "c3814aa0466368a4c1c32d24bc73ded752edacf06731ead43857a3ac992ed52d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.9.4"
+      "version": "8.9.5"
     },
     "balanced_text": {
       "dependency": "direct main",
@@ -181,14 +181,14 @@
       "dependency": "transitive",
       "description": {
         "name": "boolean_selector",
-        "sha256": "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66",
+        "sha256": "8aab1771e1243a5063b8b0ff68042d67334e3feab9e95b9490f9a6ebf73b42ea",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
     },
     "build": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "build",
         "sha256": "cef23f1eda9b57566c81e2133d196f8e3df48f244b317368d65c5943d91148f0",
@@ -271,21 +271,21 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "28a712df2576b63c6c005c465989a348604960c0958d28be5303ba9baa841ac2",
+        "sha256": "ea90e81dc4a25a043d9bee692d20ed6d1c4a1662a28c03a96417446c093ed6b4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.9.3"
+      "version": "8.9.5"
     },
     "characters": {
       "dependency": "transitive",
       "description": {
         "name": "characters",
-        "sha256": "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605",
+        "sha256": "f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.0"
     },
     "checked_yaml": {
       "dependency": "transitive",
@@ -351,11 +351,11 @@
       "dependency": "transitive",
       "description": {
         "name": "clock",
-        "sha256": "cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf",
+        "sha256": "fddb70d9b5277016c77a80201021d40a2247104d9f4aa7bab7157b7e3f05b84b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.2"
     },
     "code_builder": {
       "dependency": "transitive",
@@ -371,11 +371,11 @@
       "dependency": "direct main",
       "description": {
         "name": "collection",
-        "sha256": "a1ace0a119f20aabc852d165077c036cd864315bd99b7eaa10a60100341941bf",
+        "sha256": "2f5709ae4d3d59dd8f7cd309b4e023046b57d8a6c82130785d2b0e5868084e76",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.19.0"
+      "version": "1.19.1"
     },
     "color": {
       "dependency": "transitive",
@@ -431,31 +431,31 @@
       "dependency": "direct dev",
       "description": {
         "name": "custom_lint",
-        "sha256": "3486c470bb93313a9417f926c7dd694a2e349220992d7b9d14534dc49c15bba9",
+        "sha256": "409c485fd14f544af1da965d5a0d160ee57cd58b63eeaa7280a4f28cf5bda7f1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.0"
+      "version": "0.7.5"
     },
     "custom_lint_builder": {
       "dependency": "transitive",
       "description": {
         "name": "custom_lint_builder",
-        "sha256": "42cdc41994eeeddab0d7a722c7093ec52bd0761921eeb2cbdbf33d192a234759",
+        "sha256": "107e0a43606138015777590ee8ce32f26ba7415c25b722ff0908a6f5d7a4c228",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.0"
+      "version": "0.7.5"
     },
     "custom_lint_core": {
       "dependency": "transitive",
       "description": {
         "name": "custom_lint_core",
-        "sha256": "02450c3e45e2a6e8b26c4d16687596ab3c4644dd5792e3313aa9ceba5a49b7f5",
+        "sha256": "31110af3dde9d29fb10828ca33f1dce24d2798477b167675543ce3d208dee8be",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.0"
+      "version": "0.7.5"
     },
     "custom_lint_visitor": {
       "dependency": "transitive",
@@ -501,11 +501,11 @@
       "dependency": "direct main",
       "description": {
         "name": "device_info_plus",
-        "sha256": "72d146c6d7098689ff5c5f66bcf593ac11efc530095385356e131070333e64da",
+        "sha256": "306b78788d1bb569edb7c55d622953c2414ca12445b41c9117963e03afc5c513",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.3.0"
+      "version": "11.3.3"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
@@ -541,21 +541,21 @@
       "dependency": "transitive",
       "description": {
         "name": "fake_async",
-        "sha256": "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78",
+        "sha256": "6a95e56b2449df2273fd8c45a662d6947ce1ebb7aafe80e550a3f68297f3cacc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.1"
+      "version": "1.3.2"
     },
     "ffi": {
       "dependency": "transitive",
       "description": {
         "name": "ffi",
-        "sha256": "16ed7b077ef01ad6170a3d0c57caa4a112a38d7a2ed5602e0aca9ca6f3d98da6",
+        "sha256": "289279317b4b16eb2bb7e271abccd4bf84ec9bdcbe999e278a94b804f5630418",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.3"
+      "version": "2.1.4"
     },
     "file": {
       "dependency": "transitive",
@@ -571,11 +571,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "3d57312a53746ed4eb8c843dc50372454bbda37dd0c01a4d40fedc83e2ce4921",
+        "sha256": "8d938fd5c11dc81bf1acd4f7f0486c683fe9e79a0b13419e27730f9ce4d8a25b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.3.5"
+      "version": "9.2.1"
     },
     "file_sizes": {
       "dependency": "direct main",
@@ -627,21 +627,21 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_gen_core",
-        "sha256": "53890b653738f34363d9f0d40f82104c261716bd551d3ba65f648770b6764c21",
+        "sha256": "3eaa2d3d8be58267ac4cd5e215ac965dd23cae0410dc073de2e82e227be32bfc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.9.0"
+      "version": "5.10.0"
     },
     "flutter_gen_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "flutter_gen_runner",
-        "sha256": "de70b42eb5329f712c8b041069d081ad5fb5109f32d6d1ea9c1b39596786215d",
+        "sha256": "e74b4ead01df3e8f02e73a26ca856759dbbe8cb3fd60941ba9f4005cd0cd19c9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.9.0"
+      "version": "5.10.0"
     },
     "flutter_launcher_icons": {
       "dependency": "direct dev",
@@ -673,11 +673,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "615a505aef59b151b46bbeef55b36ce2b6ed299d160c51d84281946f0aa0ce0e",
+        "sha256": "5a1e6fb2c0561958d7e4c33574674bda7b77caaca7a33b758876956f2902eea3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.24"
+      "version": "2.0.27"
     },
     "flutter_riverpod": {
       "dependency": "direct main",
@@ -785,11 +785,11 @@
       "dependency": "transitive",
       "description": {
         "name": "freezed_annotation",
-        "sha256": "c2e2d632dd9b8a2b7751117abcfc2b4888ecfe181bd9fca7170d9ef02e595fe2",
+        "sha256": "c87ff004c8aa6af2d531668b46a4ea379f7191dc6dfa066acd53d506da6e044b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.4"
+      "version": "3.0.0"
     },
     "frontend_server_client": {
       "dependency": "transitive",
@@ -841,35 +841,35 @@
       "source": "hosted",
       "version": "2.0.0"
     },
-    "hive": {
+    "hive_ce": {
       "dependency": "direct main",
       "description": {
-        "name": "hive",
-        "sha256": "8dcf6db979d7933da8217edcec84e9df1bdb4e4edc7fc77dbd5aa74356d6d941",
+        "name": "hive_ce",
+        "sha256": "ac66daee46ad46486a1ed12cf91e9d7479c875fb46889be8d2c96b557406647f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.3"
+      "version": "2.10.1"
     },
-    "hive_flutter": {
+    "hive_ce_flutter": {
       "dependency": "direct main",
       "description": {
-        "name": "hive_flutter",
-        "sha256": "dca1da446b1d808a51689fb5d0c6c9510c0a2ba01e22805d492c73b68e33eecc",
+        "name": "hive_ce_flutter",
+        "sha256": "74c1d5f10d803446b4e7913bb272137e2724ba8a56465444f9e7713aeb60a877",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "2.2.0"
     },
-    "hive_generator": {
+    "hive_ce_generator": {
       "dependency": "direct dev",
       "description": {
-        "name": "hive_generator",
-        "sha256": "06cb8f58ace74de61f63500564931f9505368f45f98958bd7a6c35ba24159db4",
+        "name": "hive_ce_generator",
+        "sha256": "0b1c750e2d10c55a14cde16d479ada42704be6cef43c54b728ed0e4e02f7d808",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.1"
+      "version": "1.8.2"
     },
     "hotreloader": {
       "dependency": "transitive",
@@ -915,11 +915,11 @@
       "dependency": "transitive",
       "description": {
         "name": "image",
-        "sha256": "8346ad4b5173924b5ddddab782fc7d8a6300178c8b1dc427775405a01701c4a6",
+        "sha256": "13d3349ace88f12f4a0d175eb5c12dcdd39d35c4c109a8a13dfeb6d0bd9e31c3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.2"
+      "version": "4.5.3"
     },
     "image_size_getter": {
       "dependency": "transitive",
@@ -1015,11 +1015,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "json_serializable",
-        "sha256": "c2fcb3920cf2b6ae6845954186420fca40bc0a8abcc84903b7801f17d7050d7c",
+        "sha256": "81f04dee10969f89f604e1249382d46b97a1ccad53872875369622b5bfc9e58a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.9.0"
+      "version": "6.9.4"
     },
     "just_audio": {
       "dependency": "direct main",
@@ -1065,21 +1065,21 @@
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker",
-        "sha256": "7bb2830ebd849694d1ec25bf1f44582d6ac531a57a365a803a6034ff751d2d06",
+        "sha256": "c35baad643ba394b40aac41080300150a4f08fd0fd6a10378f8f7c6bc161acec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.0.7"
+      "version": "10.0.8"
     },
     "leak_tracker_flutter_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_flutter_testing",
-        "sha256": "9491a714cca3667b60b5c420da8217e6de0d1ba7a5ec322fab01758f6998f379",
+        "sha256": "f8b613e7e6a13ec79cfdc0e97638fddb3ab848452eff057653abd3edba760573",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.8"
+      "version": "3.0.9"
     },
     "leak_tracker_testing": {
       "dependency": "transitive",
@@ -1145,11 +1145,11 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb",
+        "sha256": "dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.16+1"
+      "version": "0.12.17"
     },
     "material_color_utilities": {
       "dependency": "transitive",
@@ -1193,14 +1193,14 @@
       "version": "1.0.9"
     },
     "meta": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "bdb68674043280c3428e9ec998512fb681678676b3c54e773629ffe74419f8c7",
+        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.16.0"
     },
     "mime": {
       "dependency": "transitive",
@@ -1246,31 +1246,31 @@
       "dependency": "transitive",
       "description": {
         "name": "package_config",
-        "sha256": "92d4488434b520a62570293fbd33bb556c7d49230791c1b4bbd973baf6d2dc67",
+        "sha256": "f096c55ebb7deb7e384101542bfba8c52696c1b56fca2eb62827989ef2353bbc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.2.0"
     },
     "package_info_plus": {
       "dependency": "direct main",
       "description": {
         "name": "package_info_plus",
-        "sha256": "67eae327b1b0faf761964a1d2e5d323c797f3799db0e85aa232db8d9e922bc35",
+        "sha256": "7976bfe4c583170d6cdc7077e3237560b364149fcd268b5f53d95a991963b191",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.2.1"
+      "version": "8.3.0"
     },
     "package_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "package_info_plus_platform_interface",
-        "sha256": "205ec83335c2ab9107bbba3f8997f9356d72ca3c715d2f038fc773d0366b4c76",
+        "sha256": "6c935fb612dff8e3cc9632c2b301720c77450a126114126ffaafe28d2e87956c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.2.0"
     },
     "palette_generator": {
       "dependency": "direct main",
@@ -1287,11 +1287,11 @@
       "dependency": "direct main",
       "description": {
         "name": "path",
-        "sha256": "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af",
+        "sha256": "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.0"
+      "version": "1.9.1"
     },
     "path_parsing": {
       "dependency": "transitive",
@@ -1317,11 +1317,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "4adf4fd5423ec60a29506c76581bc05854c55e3a0b72d35bb28d661c9686edf2",
+        "sha256": "0ca7359dad67fd7063cb2892ab0c0737b2daafd807cf1acecd62374c8fae6c12",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.15"
+      "version": "2.2.16"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1367,31 +1367,31 @@
       "dependency": "direct main",
       "description": {
         "name": "permission_handler",
-        "sha256": "18bf33f7fefbd812f37e72091a15575e72d5318854877e0e4035a24ac1113ecb",
+        "sha256": "59adad729136f01ea9e35a48f5d1395e25cba6cea552249ddbe9cf950f5d7849",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.3.1"
+      "version": "11.4.0"
     },
     "permission_handler_android": {
       "dependency": "transitive",
       "description": {
         "name": "permission_handler_android",
-        "sha256": "71bbecfee799e65aff7c744761a57e817e73b738fedf62ab7afd5593da21f9f1",
+        "sha256": "d3971dcdd76182a0c198c096b5db2f0884b0d4196723d21a866fc4cdea057ebc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.0.13"
+      "version": "12.1.0"
     },
     "permission_handler_apple": {
       "dependency": "transitive",
       "description": {
         "name": "permission_handler_apple",
-        "sha256": "e6f6d73b12438ef13e648c4ae56bd106ec60d17e90a59c4545db6781229082a0",
+        "sha256": "f84a188e79a35c687c132a0a0556c254747a08561e99ab933f12f6ca71ef3c98",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.4.5"
+      "version": "9.4.6"
     },
     "permission_handler_html": {
       "dependency": "transitive",
@@ -1407,11 +1407,11 @@
       "dependency": "transitive",
       "description": {
         "name": "permission_handler_platform_interface",
-        "sha256": "e9c8eadee926c4532d0305dff94b85bf961f16759c3af791486613152af4b4f9",
+        "sha256": "eb99b295153abce5d683cac8c02e22faab63e50679b937fa1bf67d58bb282878",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.2.3"
+      "version": "4.3.0"
     },
     "permission_handler_windows": {
       "dependency": "transitive",
@@ -1487,11 +1487,11 @@
       "dependency": "transitive",
       "description": {
         "name": "pub_semver",
-        "sha256": "7b3cfbf654f3edd0c6298ecd5be782ce997ddf0e00531b9464b55245185bbbbd",
+        "sha256": "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.2.0"
     },
     "pubspec_parse": {
       "dependency": "transitive",
@@ -1507,11 +1507,11 @@
       "dependency": "transitive",
       "description": {
         "name": "qs_dart",
-        "sha256": "98a068f7224fe17b68028dbbd43dd48a6049d2de2175f50b2fad2e08f2811f0e",
+        "sha256": "c775dbe663cd59365050220b3499dee259b72ad6b352a3e087a15bd77e161b74",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.2"
+      "version": "1.3.3+1"
     },
     "recursive_regex": {
       "dependency": "transitive",
@@ -1537,11 +1537,11 @@
       "dependency": "transitive",
       "description": {
         "name": "riverpod_analyzer_utils",
-        "sha256": "c6b8222b2b483cb87ae77ad147d6408f400c64f060df7a225b127f4afef4f8c8",
+        "sha256": "03a17170088c63aab6c54c44456f5ab78876a1ddb6032ffde1662ddab4959611",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.5.10"
     },
     "riverpod_annotation": {
       "dependency": "direct main",
@@ -1557,21 +1557,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "riverpod_generator",
-        "sha256": "63546d70952015f0981361636bf8f356d9cfd9d7f6f0815e3c07789a41233188",
+        "sha256": "44a0992d54473eb199ede00e2260bd3c262a86560e3c6f6374503d86d0580e36",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.3"
+      "version": "2.6.5"
     },
     "riverpod_lint": {
       "dependency": "direct dev",
       "description": {
         "name": "riverpod_lint",
-        "sha256": "83e4caa337a9840469b7b9bd8c2351ce85abad80f570d84146911b32086fbd99",
+        "sha256": "89a52b7334210dbff8605c3edf26cfe69b15062beed5cbfeff2c3812c33c9e35",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.3"
+      "version": "2.6.5"
     },
     "rxdart": {
       "dependency": "direct main",
@@ -1730,14 +1730,14 @@
       "version": "1.0.0"
     },
     "source_gen": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "source_gen",
-        "sha256": "14658ba5f669685cd3d63701d01b31ea748310f7ab854e471962670abcf57832",
+        "sha256": "35c8150ece9e8c8d263337a265153c3329667640850b9304861faea59fc98f6b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.0"
+      "version": "2.0.0"
     },
     "source_helper": {
       "dependency": "transitive",
@@ -1753,11 +1753,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_span",
-        "sha256": "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c",
+        "sha256": "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.10.0"
+      "version": "1.10.1"
     },
     "split_view": {
       "dependency": "direct main",
@@ -1834,11 +1834,11 @@
       "dependency": "transitive",
       "description": {
         "name": "stack_trace",
-        "sha256": "9f47fd3630d76be3ab26f0ee06d213679aa425996925ff3feffdec504931c377",
+        "sha256": "8b27215b45d22309b5cddda1aa2b19bdfec9df0e765f2de506401c071d38d1b1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.12.0"
+      "version": "1.12.1"
     },
     "state_notifier": {
       "dependency": "transitive",
@@ -1854,11 +1854,11 @@
       "dependency": "transitive",
       "description": {
         "name": "stream_channel",
-        "sha256": "ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7",
+        "sha256": "969e04c80b8bcdf826f8f16579c7b14d780458bd97f56d107d3950fdbeef059d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.1.4"
     },
     "stream_transform": {
       "dependency": "transitive",
@@ -1874,11 +1874,11 @@
       "dependency": "transitive",
       "description": {
         "name": "string_scanner",
-        "sha256": "688af5ed3402a4bde5b3a6c15fd768dbf2621a614950b17f04626c431ab3c4c3",
+        "sha256": "921cd31725b72fe181906c6a94d987c78e3b98c2e205b397ea399d4054872b43",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.1"
     },
     "synchronized": {
       "dependency": "transitive",
@@ -1894,21 +1894,21 @@
       "dependency": "transitive",
       "description": {
         "name": "term_glyph",
-        "sha256": "a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84",
+        "sha256": "7f554798625ea768a7518313e58f83891c7f5024f88e46e7182a4558850a4b8e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.1"
+      "version": "1.2.2"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "664d3a9a64782fcdeb83ce9c6b39e78fd2971d4e37827b9b06c3aa1edc5e760c",
+        "sha256": "fb31f383e2ee25fbbfe06b40fe21e1e458d14080e3c67e7ba0acfde4df4e0bbd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.3"
+      "version": "0.7.4"
     },
     "time": {
       "dependency": "transitive",
@@ -1994,11 +1994,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "6fc2f56536ee873eeb867ad176ae15f304ccccc357848b351f6f0d8d4a40d193",
+        "sha256": "1d0eae19bd7606ef60fe69ef3b312a437a16549476c42321d5dc1506c9ca3bf4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.14"
+      "version": "6.3.15"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
@@ -2134,11 +2134,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "f6be3ed8bd01289b34d679c2b62226f63c0e69f9fd2e50a6b3c1c729a961041b",
+        "sha256": "0968250880a6c5fe7edc067ed0a13d4bae1577fe2771dcf3010d52c4a9d3ca14",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.3.0"
+      "version": "14.3.1"
     },
     "wakelock_plus": {
       "dependency": "direct main",
@@ -2184,11 +2184,11 @@
       "dependency": "transitive",
       "description": {
         "name": "web",
-        "sha256": "cd3543bd5798f6ad290ea73d210f423502e71900302dde696f8bff84bf89a1cb",
+        "sha256": "868d88a33d8a87b18ffc05f9f030ba328ffefba92d6c127917a2ba740f9cfe4a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.1.1"
     },
     "web_socket": {
       "dependency": "transitive",
@@ -2214,21 +2214,21 @@
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "daf97c9d80197ed7b619040e86c8ab9a9dad285e7671ee7390f9180cc828a51e",
+        "sha256": "dc6ecaa00a7c708e5b4d10ee7bec8c270e9276dfcab1783f57e9962d7884305f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.10.1"
+      "version": "5.12.0"
     },
     "win32_registry": {
       "dependency": "transitive",
       "description": {
         "name": "win32_registry",
-        "sha256": "21ec76dfc731550fd3e2ce7a33a9ea90b828fdf19a5c3bcf556fa992cfa99852",
+        "sha256": "6f1b564492d0147b330dd794fee8f512cec4977957f310f9951b5f9d83618dae",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.5"
+      "version": "2.1.0"
     },
     "window_manager": {
       "dependency": "direct main",
@@ -2279,10 +2279,20 @@
       },
       "source": "hosted",
       "version": "3.1.3"
+    },
+    "yaml_writer": {
+      "dependency": "transitive",
+      "description": {
+        "name": "yaml_writer",
+        "sha256": "69651cd7238411179ac32079937d4aa9a2970150d6b2ae2c6fe6de09402a5dc5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.0"
     }
   },
   "sdks": {
-    "dart": ">=3.6.0 <4.0.0",
+    "dart": ">=3.7.0 <4.0.0",
     "flutter": ">=3.27.0"
   }
 }
diff --git a/pkgs/by-name/fi/findup/package.nix b/pkgs/by-name/fi/findup/package.nix
index baa0248200ed..1be7ec2b1a05 100644
--- a/pkgs/by-name/fi/findup/package.nix
+++ b/pkgs/by-name/fi/findup/package.nix
@@ -3,11 +3,8 @@
   stdenv,
   fetchFromGitHub,
   testers,
-  zig_0_11,
+  zig,
 }:
-let
-  zig = zig_0_11;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "findup";
   version = "1.1.2";
@@ -24,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
 
   meta = {
+    # Doesn't support zig 0.12 or newer, last commit was 2 years ago.
+    broken = lib.versionAtLeast zig.version "0.12";
     homepage = "https://github.com/booniepepper/findup";
     description = "Search parent directories for sentinel files";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/fo/foot/package.nix b/pkgs/by-name/fo/foot/package.nix
index b667d212b46b..34d21354f255 100644
--- a/pkgs/by-name/fo/foot/package.nix
+++ b/pkgs/by-name/fo/foot/package.nix
@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.21.0";
+  version = "1.22.0";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -104,7 +104,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     rev = version;
-    hash = "sha256:19hkw4g2l00wasmk5dn34rf3bhqh6zbwwhvz98bdcv90p761jws4";
+    hash = "sha256-OCDFfOEyE8CrgisswSfPXH1rNoaM1C1ztm9R77P0MOk=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/go/gopeed/package.nix b/pkgs/by-name/go/gopeed/package.nix
index 35feec1bf524..0555e1bbaa2c 100644
--- a/pkgs/by-name/go/gopeed/package.nix
+++ b/pkgs/by-name/go/gopeed/package.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "1.6.11";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "GopeedLab";
     repo = "gopeed";
     tag = "v${version}";
-    hash = "sha256-ayPqLRWYSa0rSHqGFS4xp3wUVAl4tfsSPs/SQcUQD60=";
+    hash = "sha256-9xAArQhf1lAWL6mbx6wuGY3xhKAMigpWFrX8P6/olMY=";
   };
 
   metaCommon = {
diff --git a/pkgs/by-name/go/gose/package.nix b/pkgs/by-name/go/gose/package.nix
index f61f3d1c8c64..bb227d90e677 100644
--- a/pkgs/by-name/go/gose/package.nix
+++ b/pkgs/by-name/go/gose/package.nix
@@ -7,13 +7,13 @@
   lib,
 }:
 let
-  version = "0.10.2";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     repo = "gose";
     owner = "stv0g";
     tag = "v${version}";
-    hash = "sha256-xyAOag2/GaIVttTLnx/6ljkpWbJmsOfyYyWzOAHOQ2I=";
+    hash = "sha256-CYMpibAvuOScKoCP212MSoAt0hhQhEP0uQK7y/YPk9Q=";
   };
 
   frontend = buildNpmPackage {
@@ -37,7 +37,7 @@ buildGoModule {
   inherit version;
   inherit src;
 
-  vendorHash = "sha256-/Drb5Mxz37rNYfHdydl3z+xvFtjGwuzSsG4gkbx/h1o=";
+  vendorHash = "sha256-oz2nmJxnmhj2InN4E7tyz5iWr4geraGszz3QePKuEMM=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/hy/hydrus/package.nix b/pkgs/by-name/hy/hydrus/package.nix
index f539663e8845..2697fbd4f9fc 100644
--- a/pkgs/by-name/hy/hydrus/package.nix
+++ b/pkgs/by-name/hy/hydrus/package.nix
@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hydrus";
-  version = "614";
+  version = "617";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     tag = "v${version}";
-    hash = "sha256-7UYi2dbpoGy373akOKFJjssxMdCKjpv4IgPMqBoe93Q=";
+    hash = "sha256-yvnfG7XxGowa3wRZjNsl/WnptdllWWFT/eIFq0TEey8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/inxi/package.nix b/pkgs/by-name/in/inxi/package.nix
index 72ac2b9aaa72..8010260e3658 100644
--- a/pkgs/by-name/in/inxi/package.nix
+++ b/pkgs/by-name/in/inxi/package.nix
@@ -62,16 +62,16 @@ let
     ++ recommendedSystemPrograms
     ++ recommendedDisplayInformationPrograms;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "inxi";
-  version = "3.3.37-1";
+  version = "3.3.38-1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "smxi";
     repo = "inxi";
-    rev = version;
-    hash = "sha256-LyIKjXdfE2sK81zFpXPneaFyfKqa4tU4GfXtt89TZOg=";
+    tag = finalAttrs.version;
+    hash = "sha256-+2NPQUn2A8Xy5ByKYS3MOcad6xXvkqcusWEMr7mkEwA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     cp inxi.1 $out/share/man/man1/
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Full featured CLI system information tool";
     longDescription = ''
       inxi is a command line system information script built for console and
@@ -97,10 +97,10 @@ stdenv.mkDerivation rec {
       Processes, RAM usage, and a wide variety of other useful information.
     '';
     homepage = "https://smxi.org/docs/inxi.htm";
-    changelog = "https://github.com/smxi/inxi/blob/${version}/inxi.changelog";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
+    changelog = "https://codeberg.org/smxi/inxi/src/tag/${finalAttrs.version}/inxi.changelog";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
     maintainers = [ ];
     mainProgram = "inxi";
   };
-}
+})
diff --git a/pkgs/by-name/jd/jd-diff-patch/package.nix b/pkgs/by-name/jd/jd-diff-patch/package.nix
index 873e8510e699..6468239793fd 100644
--- a/pkgs/by-name/jd/jd-diff-patch/package.nix
+++ b/pkgs/by-name/jd/jd-diff-patch/package.nix
@@ -4,32 +4,35 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "jd-diff-patch";
-  version = "2.1.2";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "josephburnett";
     repo = "jd";
-    rev = "v${version}";
-    sha256 = "sha256-chCxbbRZEE29KVnTQWID889kJ2H4qJGVL+vsxzr6VtA=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-sA3NzCl9dR6cZnZNFa7Sqb1KUPSWA1h8ReZqR+SRjgk";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/v2";
+
   # not including web ui
   excludedPackages = [
     "gae"
     "pack"
   ];
 
-  vendorHash = null;
+  vendorHash = "sha256-Ol+9YwtJ5P6au1aW2ss9mrU9l5G3iBviX5q1qC0K+vc=";
 
-  meta = with lib; {
+  meta = {
     description = "Commandline utility and Go library for diffing and patching JSON values";
     homepage = "https://github.com/josephburnett/jd";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       bryanasdev000
+      juliusfreudenberger
     ];
     mainProgram = "jd";
   };
-}
+})
diff --git a/pkgs/by-name/ju/just-lsp/package.nix b/pkgs/by-name/ju/just-lsp/package.nix
new file mode 100644
index 000000000000..d41b255d3b6a
--- /dev/null
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "just-lsp";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "terror";
+    repo = "just-lsp";
+    tag = finalAttrs.version;
+    hash = "sha256-c/fdj4lEmID4u97fGPXnPLULS7Rxe6P8icmsfjGjT+w=";
+  };
+
+  cargoHash = "sha256-qPMtYaCvSAnLXrLX20QKbgXo9L1HYxJW4uZIzXhpD/A=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Language server for just";
+    homepage = "https://github.com/terror/just-lsp";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "just-lsp";
+  };
+})
diff --git a/pkgs/by-name/ku/kubevpn/package.nix b/pkgs/by-name/ku/kubevpn/package.nix
index 52ae0876068f..2bd3f32dc84b 100644
--- a/pkgs/by-name/ku/kubevpn/package.nix
+++ b/pkgs/by-name/ku/kubevpn/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.6.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     rev = "v${version}";
-    hash = "sha256-P01hjVAA3h/TBPl8q9KuZoE5xWAhmJ5E2nFSuvfWIIg=";
+    hash = "sha256-Og84vFDPGpvQwmS3xL3HBxk/vSnvZbbLvDEyvMbj+GU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/lt/ltris/package.nix b/pkgs/by-name/lt/ltris/package.nix
index 8e0f4ba3cd5f..3c31f4ecc819 100644
--- a/pkgs/by-name/lt/ltris/package.nix
+++ b/pkgs/by-name/lt/ltris/package.nix
@@ -1,24 +1,28 @@
 {
   lib,
-  SDL,
-  SDL_mixer,
+  sdl2-compat,
+  SDL2_mixer,
+  SDL2_image,
+  SDL2_ttf,
   directoryListingUpdater,
   fetchurl,
   stdenv,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "lgames-ltris";
-  version = "1.2.8";
+  pname = "ltris";
+  version = "2.0.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lgames/ltris-${finalAttrs.version}.tar.gz";
-    hash = "sha256-2e5haaU2pqkBk82qiF/3HQgSBVPHP09UwW+TQqpGUqA=";
+    url = "mirror://sourceforge/lgames/ltris2-${finalAttrs.version}.tar.gz";
+    hash = "sha256-+w8WTASYj/AWcBg9W3dmZ0cyCmlZNhDZ0l/WwhRfJRk=";
   };
 
   buildInputs = [
-    SDL
-    SDL_mixer
+    sdl2-compat
+    SDL2_mixer
+    SDL2_image
+    SDL2_ttf
   ];
 
   hardeningDisable = [ "format" ];
@@ -32,10 +36,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://lgames.sourceforge.io/LTris/";
     description = "Tetris clone from the LGames series";
-    license = with lib.licenses; [ gpl2Plus ];
-    mainProgram = "ltris";
-    maintainers = with lib.maintainers; [ ];
-    inherit (SDL.meta) platforms;
+    license = with lib.licenses; [ gpl3Plus ];
+    mainProgram = "ltris2";
+    maintainers = with lib.maintainers; [ marcin-serwin ];
+    platforms = lib.platforms.all;
     broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/ma/maeparser/package.nix b/pkgs/by-name/ma/maeparser/package.nix
index 96d696917834..715baa4b184f 100644
--- a/pkgs/by-name/ma/maeparser/package.nix
+++ b/pkgs/by-name/ma/maeparser/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "maeparser";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "schrodinger";
     repo = "maeparser";
     rev = "v${version}";
-    sha256 = "sha256-+eCTOU0rqFQC87wcxgINGLsULfbIr/wKxQTkRR59JVc=";
+    sha256 = "sha256-LTE1YGw6DiWnpUGB9x3vFVArcYd8zO49b4tqpqK30eA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mp/mpack/package.nix b/pkgs/by-name/mp/mpack/package.nix
index 5fc18538ed0c..567fb303f7ce 100644
--- a/pkgs/by-name/mp/mpack/package.nix
+++ b/pkgs/by-name/mp/mpack/package.nix
@@ -94,7 +94,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Utilities for encoding and decoding binary files in MIME";
     license = licenses.free;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ tomodachi94 ];
   };
 }
diff --git a/pkgs/by-name/op/opendbx/package.nix b/pkgs/by-name/op/opendbx/package.nix
index 0e6db1ef2ec4..4b46e91ae277 100644
--- a/pkgs/by-name/op/opendbx/package.nix
+++ b/pkgs/by-name/op/opendbx/package.nix
@@ -27,6 +27,13 @@ stdenv.mkDerivation rec {
     configureFlagsArray=(--with-backends="mysql pgsql sqlite3")
   '';
 
+  configureFlags = [
+    # detection fails when cross-compiling
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+    "ac_cv_func_strtod=yes"
+  ];
+
   buildInputs = [
     readline
     libmysqlclient
diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index 91efa18e6afb..be49f4acccd1 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron,
+  electron_35,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,16 +15,17 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_22;
+  electron = electron_35;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-33LAhR0L7pAnS27dz5DuqgfUllyAFA9JVZRmrHoajE4=";
+    hash = "sha256-ga37rZ70Xfll3y58uKC4d57NJOxQzQZZps/j/baxkPk=";
   };
 
   makeCacheWritable = true;
@@ -32,7 +33,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-BR51Oi9Ffxy7d0fBkSQ6Iz/PVi+ghIaLqzm3Loq6aDo=";
+  npmDepsHash = "sha256-E8b/L5g+Xt/N3ddOPgm7xkbb5jQtL5ceFtJW6DQN4nA=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/pi/pies/package.nix b/pkgs/by-name/pi/pies/package.nix
index 4d9e858669be..e5499a017637 100644
--- a/pkgs/by-name/pi/pies/package.nix
+++ b/pkgs/by-name/pi/pies/package.nix
@@ -1,30 +1,40 @@
 {
-  fetchurl,
   lib,
   stdenv,
+  fetchurl,
   libxcrypt,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pies";
-  version = "1.3";
+  version = "1.8";
 
   src = fetchurl {
-    url = "mirror://gnu/pies/${pname}-${version}.tar.bz2";
-    sha256 = "12r7rjjyibjdj08dvwbp0iflfpzl4s0zhn6cr6zj3hwf9gbzgl1g";
+    url = "mirror://gnu/pies/pies-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-ZSi00WmC6il4+aSohqFKrKjtp6xFXYE7IIRGVwFmHWw=";
   };
 
   buildInputs = [ libxcrypt ];
 
+  patches = [ ./stdlib.patch ];
+
+  postPatch = ''
+    substituteInPlace configure \
+      --replace-fail "gl_cv_func_memchr_works=\"guessing no\"" "gl_cv_func_memchr_works=yes"
+  '';
+
   configureFlags = [ "--sysconfdir=/etc" ];
 
   hardeningDisable = [ "format" ];
 
   doCheck = true;
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   meta = {
     description = "Program invocation and execution supervisor";
-
     longDescription = ''
       The name Pies (pronounced "p-yes") stands for Program Invocation and
       Execution Supervisor.  This utility starts and controls execution of
@@ -45,12 +55,10 @@ stdenv.mkDerivation rec {
       Jabberd or MeTA1 (and it offers much more control over them than the
       native utilities).  Finally, it can replace the inetd utility!
     '';
-
-    license = lib.licenses.gpl3Plus;
-
     homepage = "https://www.gnu.org/software/pies/";
-
+    license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.gnu ++ lib.platforms.linux;
+    broken = stdenv.hostPlatform.system == "aarch64-linux";
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/pi/pies/stdlib.patch b/pkgs/by-name/pi/pies/stdlib.patch
new file mode 100644
index 000000000000..13af5cdc8522
--- /dev/null
+++ b/pkgs/by-name/pi/pies/stdlib.patch
@@ -0,0 +1,24 @@
+diff --git a/src/pies.c b/src/pies.c
+index 9355d50..9fe6109 100644
+--- a/src/pies.c
++++ b/src/pies.c
+@@ -19,6 +19,7 @@
+ #include <configmake.h>
+ #include "meta1parse.h"
+ #include "grecsasrt.h"
++#include <stdlib.h>
+
+ int preprocess_only;		/* Preprocess config, do nothing more */
+ int lint_mode;			/* Test configuration syntax and exit */
+diff --git a/src/piesctl.c b/src/piesctl.c
+index a0ac967..fd6c3e2 100644
+--- a/src/piesctl.c
++++ b/src/piesctl.c
+@@ -14,6 +14,7 @@
+    You should have received a copy of the GNU General Public License
+    along with GNU Pies.  If not, see <http://www.gnu.org/licenses/>. */
+
++#include <stdlib.h>
+ #include <config.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
diff --git a/pkgs/by-name/pi/pixiecore/package.nix b/pkgs/by-name/pi/pixiecore/package.nix
index f449bdb8d276..80d1a95bc6cd 100644
--- a/pkgs/by-name/pi/pixiecore/package.nix
+++ b/pkgs/by-name/pi/pixiecore/package.nix
@@ -2,31 +2,70 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  xz,
+  ipxe,
+  stdenv,
+  perl,
+  go-bindata,
+  fetchpatch,
 }:
 
+let
+  rebuildIpxe = stdenv.system == "x86_64-linux";
+in
 buildGoModule rec {
   pname = "pixiecore";
-  version = "2020-03-25";
-  rev = "68743c67a60c18c06cd21fd75143e3e069ca3cfc";
+  version = "0-unstable-2024-05-31";
+  rev = "2ed7bd30206a51bae786b02d9a5b8156fdcc8870";
 
   src = fetchFromGitHub {
     owner = "danderson";
     repo = "netboot";
     inherit rev;
-    hash = "sha256-SoD871PaL5/oabKeHFE2TLTTj/CFS4dfggjMN3qlupE=";
+    hash = "sha256-pG4nzzJRWI1rAHS5kBcefNi0ee0/a3jwE+RmR4Dj8jo=";
   };
 
-  vendorHash = "sha256-hytMhf7fz4XiRJH7MnGLmNH+iIzPDz9/rRJBPp2pwyI=";
+  vendorHash = "sha256-3cVGDAZWhmZ1byvjoRodSWMNHCpNujDOAVQKHNntHR8=";
+
+  patches = [
+    # part of https://github.com/danderson/netboot/pull/144
+    # Also backed up in https://github.com/danderson/netboot/compare/main...Mic92:netboot:upgrade-go-mod-117?expand=1
+    (fetchpatch {
+      url = "https://github.com/danderson/netboot/commit/c999a6ca573c973e760c8df531b4c970c21f3d05.patch";
+      sha256 = "sha256-pRWcBz24cqqajLvJffugB/T6lKGVtvOG4ch3vyzDDQQ=";
+    })
+  ];
 
   doCheck = false;
 
+  # De-vendor ipxe, only on x86_64-linux for now.
+  # In future we can do this also for more systems, if we do cross-compilation.
+  buildInputs = lib.optionals rebuildIpxe [ xz ];
+  nativeBuildInputs = lib.optionals rebuildIpxe [
+    perl
+    go-bindata
+  ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error" ];
+  preBuild = lib.optionalString rebuildIpxe ''
+    # don't run in our go-modules phase but only in the normal build phase
+    if echo $NIX_CFLAGS_COMPILE | grep -q xz; then
+      rm -rf ./third_party/ipxe
+      cp -r ${ipxe.src} ./third_party/ipxe
+      chmod -R u+w ./third_party/ipxe
+      make update-ipxe -j$NIX_BUILD_CORES
+    fi
+  '';
+
   subPackages = [ "cmd/pixiecore" ];
 
   meta = {
     description = "Tool to manage network booting of machines";
     homepage = "https://github.com/danderson/netboot/tree/master/pixiecore";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ bbigras ];
+    maintainers = with lib.maintainers; [
+      bbigras
+      mic92
+    ];
     mainProgram = "pixiecore";
   };
 }
diff --git a/pkgs/by-name/po/postgres-lsp/package.nix b/pkgs/by-name/po/postgres-lsp/package.nix
index 538ba40addef..be8814b96a81 100644
--- a/pkgs/by-name/po/postgres-lsp/package.nix
+++ b/pkgs/by-name/po/postgres-lsp/package.nix
@@ -2,39 +2,46 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  protobuf,
 }:
-
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
-  version = "0-unstable-2024-03-24";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
-    owner = "supabase";
-    repo = "postgres_lsp";
-    rev = "43ca9b675cb152ca7f38cfa6aff6dd2131dfa9a2";
-    hash = "sha256-n7Qbt9fGzC0CcleAtTWDInPz4oaPjI+pvIPrR5EYJ9U=";
+    owner = "supabase-community";
+    repo = "postgres-language-server";
+    tag = finalAttrs.version;
+    hash = "sha256-JRCuqJvC+OBdYe2JORwOfghr7smVLsROwrhk5H+SSkc=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9T3bm/TSjnFeF8iE4338I44espnFq6l36yOq8YFPaPQ=";
+  cargoHash = "sha256-lUZpjX3HljOXi0Wt2xZCUru8uinWlngLEs5wlqfFiJA=";
 
   nativeBuildInputs = [
-    protobuf
     rustPlatform.bindgenHook
   ];
 
-  cargoBuildFlags = [ "-p=postgres_lsp" ];
-  cargoTestFlags = cargoBuildFlags;
+  env = {
+    SQLX_OFFLINE = 1;
 
-  RUSTC_BOOTSTRAP = 1; # We need rust unstable features
-
-  meta = with lib; {
-    description = "Language Server for Postgres";
-    homepage = "https://github.com/supabase/postgres_lsp";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
-    mainProgram = "postgres_lsp";
+    # As specified in the upstream: https://github.com/supabase-community/postgres-language-server/blob/main/.github/workflows/release.yml
+    RUSTFLAGS = "-C strip=symbols -C codegen-units=1";
+    PGT_VERSION = finalAttrs.version;
   };
-}
+
+  cargoBuildFlags = [ "-p=pgt_cli" ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+  checkFlags = [
+    # Tries to write to the file system relatively to the current path
+    "--skip=syntax_error"
+  ];
+
+  meta = {
+    description = "Tools and language server for Postgres";
+    homepage = "https://pgtools.dev";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ figsoda ];
+    mainProgram = "postgrestools";
+  };
+})
diff --git a/pkgs/by-name/qi/qidi-slicer-bin/package.nix b/pkgs/by-name/qi/qidi-slicer-bin/package.nix
index 416f4e4b22e5..a27fd1940f90 100644
--- a/pkgs/by-name/qi/qidi-slicer-bin/package.nix
+++ b/pkgs/by-name/qi/qidi-slicer-bin/package.nix
@@ -3,15 +3,16 @@
   fetchurl,
   webkitgtk_4_1,
   libsoup_3,
+  libpng,
   lib,
 }:
 let
   pname = "qidi-slicer";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchurl {
-    url = "https://github.com/QIDITECH/QIDISlicer/releases/download/V${version}/QIDISlicer_${version}_Linux_ubuntu_24.04.AppImage";
-    hash = "sha256-sKdNAhnL2jk4UaSxFwKEFKGiC3kvpkyXRzbMXVAg7Kk=";
+    url = "https://github.com/QIDITECH/QIDISlicer/releases/download/V${version}/QIDISlicer_${version}_Linux_Ubuntu24.AppImage";
+    hash = "sha256-76bdVQu+xCf6uCwkHcpLNNna5MgHm4vbuwMFoQ26N0Y=";
   };
 
   appimageContents = appimageTools.extract {
@@ -23,6 +24,7 @@ appimageTools.wrapType2 {
   extraPkgs = pkgs: [
     webkitgtk_4_1
     libsoup_3
+    libpng
   ];
 
   extraInstallCommands = ''
diff --git a/pkgs/by-name/r2/r2modman/package.nix b/pkgs/by-name/r2/r2modman/package.nix
index ce5073e41d83..8ff252ef6fdf 100644
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "r2modman";
-  version = "3.1.57";
+  version = "3.1.58";
 
   src = fetchFromGitHub {
     owner = "ebkr";
     repo = "r2modmanPlus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1b24tclqXGx85BGFYL9cbthLScVWau2OmRh9YElfCLs=";
+    hash = "sha256-ICLKkhgEi0ThWHLgm9fr0QXXtWMCAOJ6nkD66JR8XMo=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/ru/rush/package.nix b/pkgs/by-name/ru/rush/package.nix
index 3e94ac44c970..cca8e1429a14 100644
--- a/pkgs/by-name/ru/rush/package.nix
+++ b/pkgs/by-name/ru/rush/package.nix
@@ -4,6 +4,7 @@
   stdenv,
   bash,
   perl,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,5 +62,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     shellPath = "/bin/rush";
+    tests = { inherit (nixosTests) rush; };
   };
 }
diff --git a/pkgs/by-name/sc/scite/package.nix b/pkgs/by-name/sc/scite/package.nix
index a587e493e5fd..9a1bd6a3be0d 100644
--- a/pkgs/by-name/sc/scite/package.nix
+++ b/pkgs/by-name/sc/scite/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scite";
-  version = "5.5.5";
+  version = "5.5.6";
 
   src = fetchurl {
     url = "https://www.scintilla.org/scite${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.tgz";
-    hash = "sha256-PkXS0qdYYuU10jGO56RgKk/RrOo2GK+7PR7AfSZszOU=";
+    hash = "sha256-VmNP6NepkF7Ln9eh9pfStmch9nwIKKZTOYxkeduSxrI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sn/snore/package.nix b/pkgs/by-name/sn/snore/package.nix
index 5ad31a29ee35..7311f17fcfbe 100644
--- a/pkgs/by-name/sn/snore/package.nix
+++ b/pkgs/by-name/sn/snore/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "clamiax";
     repo = "snore";
-    rev = version;
+    tag = version;
     hash = "sha256-bKPGSePzp4XEZFY0QQr37fm3R1v3hLD6FeySFd7zNJc=";
   };
 
diff --git a/pkgs/by-name/sp/spider/package.nix b/pkgs/by-name/sp/spider/package.nix
index a9c189133d9b..5e184afd3758 100644
--- a/pkgs/by-name/sp/spider/package.nix
+++ b/pkgs/by-name/sp/spider/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spider";
-  version = "2.36.34";
+  version = "2.36.73";
 
   src = fetchFromGitHub {
     owner = "spider-rs";
     repo = "spider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gdjXTIUeVMjjRq/MfYuvISVt9lFXfIewF6oZ/a46mUE=";
+    hash = "sha256-ad5WihYMCJ1TbZGO4pQwGYTUZ2K993bynT7+KFTLGwY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-gb+WwxiPBoX2QUuRNmOq1J/q0TnmFvmimBAhZ4+It+E=";
+  cargoHash = "sha256-rCmuYRPxz29dKpIoC6fXB5h8+3fERMCcERm+C2juzZA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 99b9858999da..e2842ed056bd 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -1,22 +1,23 @@
 {
   lib,
   fetchzip,
-  buildGo123Module,
+  buildGo124Module,
   nixosTests,
+  nix-update-script,
 }:
 
-buildGo123Module rec {
+buildGo124Module rec {
   pname = "traefik";
-  version = "3.3.4";
+  version = "3.3.6";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-KXFpdk1VMYzGldFp/b5Ss6aJvL9yG4kSbM4LOIBUL5A=";
+    hash = "sha256-HA/JSwcss5ytGPqe2dqsKTZxuhWeC/yi8Mva4YVFeDs=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-wtZFViVNvNuhHvI1YR2ome1rs2DIAd3Iurmpi9Y6F2w=";
+  vendorHash = "sha256-23BkkfJ6XLAygeeKipJk4puV5sGILb8rXEEA4qJWZS4=";
 
   subPackages = [ "cmd/traefik" ];
 
@@ -39,6 +40,8 @@ buildGo123Module rec {
     inherit (nixosTests) traefik;
   };
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "https://traefik.io";
     description = "Modern reverse proxy";
diff --git a/pkgs/by-name/ug/ugm/package.nix b/pkgs/by-name/ug/ugm/package.nix
index db5fe787f319..21a25baca9fa 100644
--- a/pkgs/by-name/ug/ugm/package.nix
+++ b/pkgs/by-name/ug/ugm/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ugm";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
     rev = "v${version}";
-    hash = "sha256-FTgu5bzhX+B71dj4wHcgwbtrde5fzF98zMV1lRO++AE=";
+    hash = "sha256-JgdOoMH8TAUc+23AhU3tZe4SH8GKFeyjSeKm8U7qvpo=";
   };
 
-  vendorHash = "sha256-Nz9Be2Slfan6FmV9/OxVh7GrLgHBhmt5nOOuXNfjy48=";
+  vendorHash = "sha256-Dgnh+4bUNyqD8/bj+iUITPB/SBtQPYrB5XC6/M6Zs6k=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index b6a30d9c97a1..b1383992a192 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-/zFB2lCTajshnIFexDDGrps2bir3Hj2Nq+4RO05HDvc=",
-    "version": "0.2025.04.02.08.11.stable_03"
+    "hash": "sha256-ab4R/1Fe97mXPBBJ4OhgZaIDLBQr1nmA8lZsB2jVlRU=",
+    "version": "0.2025.04.16.08.11.stable_02"
   },
   "linux_x86_64": {
-    "hash": "sha256-wHiiKgTqAC30VMH0VhslmaNZyCwYEs6N915jlkxL8d8=",
-    "version": "0.2025.04.02.08.11.stable_03"
+    "hash": "sha256-+/0PA8Z/IbgHNtk78v4d3cw0G8Kk1MQ+gN16/8nKmGg=",
+    "version": "0.2025.04.16.08.11.stable_02"
   },
   "linux_aarch64": {
-    "hash": "sha256-mjzS33bSHNwnUPPKswkbpbFOnuQu4+SeeCA8IcxE4tk=",
-    "version": "0.2025.04.02.08.11.stable_03"
+    "hash": "sha256-QJsmiKyMhSD/39aBUqCQrQ5ANnFev0x+Pon7dH9XPBQ=",
+    "version": "0.2025.04.16.08.11.stable_02"
   }
 }
diff --git a/pkgs/by-name/wi/windsend-rs/package.nix b/pkgs/by-name/wi/windsend-rs/package.nix
index 3b2f90726473..9d0912a7a987 100644
--- a/pkgs/by-name/wi/windsend-rs/package.nix
+++ b/pkgs/by-name/wi/windsend-rs/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "windsend-rs";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "doraemonkeys";
     repo = "WindSend";
     tag = "v${version}";
-    hash = "sha256-jmFhYCUE37yH+TTHq8Q0bO1Lp/p07PnSJDMAOGbhwOM=";
+    hash = "sha256-mE2pygb4o9gRUdgX/eVsr6WtZxIadxADg+3dpQgP0Ic=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-RmtKspTNTd3ZaucuzJk6yfDFRH7wZsOlEyJd2lNApBU=";
+  cargoHash = "sha256-t9J+Tu/50THWWdNdUzUH6waGUGrDc1E2GxWmb3YOt5g=";
 
   sourceRoot = "${src.name}/windSend-rs";
 
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 9cb0ccdd008e..1fa1ddeca88b 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.6.3",
+    "version": "1.6.5",
     "vscodeVersion": "1.97.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/f8ec5d648c43a2f1e54dccd12e2cf74f5ae6bad9/Windsurf-darwin-arm64-1.6.3.zip",
-    "sha256": "210bb4ea2f7bacc9ffb8ef901a06902f655943e53b695c0c5a3700dc56a1c6e5"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/d87e525d4461b610eeaba26cba66153dd120ef47/Windsurf-darwin-arm64-1.6.5.zip",
+    "sha256": "3043acb2902d0ed9178a34591857ede56472527a5c2091a3500ef1e1537bfde7"
   },
   "x86_64-darwin": {
-    "version": "1.6.3",
+    "version": "1.6.5",
     "vscodeVersion": "1.97.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/f8ec5d648c43a2f1e54dccd12e2cf74f5ae6bad9/Windsurf-darwin-x64-1.6.3.zip",
-    "sha256": "f9c28afd3d9097255d02a79822a62c44fc18bb154727cdf62321a43986f26765"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/d87e525d4461b610eeaba26cba66153dd120ef47/Windsurf-darwin-x64-1.6.5.zip",
+    "sha256": "cdee5037ba3959cec5ab0cd6f18f699cf2724e19e6759e4bd180df728dc0362d"
   },
   "x86_64-linux": {
-    "version": "1.6.3",
+    "version": "1.6.5",
     "vscodeVersion": "1.97.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/f8ec5d648c43a2f1e54dccd12e2cf74f5ae6bad9/Windsurf-linux-x64-1.6.3.tar.gz",
-    "sha256": "ed0853dc833a979fa5ed91caf8db6191b5583e83d79cc6feeb5697cd3ae17440"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/d87e525d4461b610eeaba26cba66153dd120ef47/Windsurf-linux-x64-1.6.5.tar.gz",
+    "sha256": "f95abc06787b8308bcfdca877049b1cd3251e8affac13d96ddbcdd2c4fa25574"
   }
 }
diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index 4f3f71d4d3ea..178aed6fcbea 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -1,5 +1,4 @@
 {
-  # Commented packages are not currently in nixpkgs. They don't appear to cause a problem when not present.
   config,
   lib,
   stdenv,
@@ -8,82 +7,57 @@
   applyPatches,
   autoAddDriverRunpath,
   avahi,
-  bluez,
   boost,
-  cjson,
   cli11,
   cmake,
   cudaPackages ? { },
   cudaSupport ? config.cudaSupport,
-  dbus,
-  # depthai
-  doxygen,
   eigen,
-  elfutils,
   ffmpeg,
   freetype,
   git,
   glib,
   glm,
   glslang,
-  gst_all_1,
   harfbuzz,
-  hidapi,
   kdePackages,
-  # leapsdk
-  # leapv2
-  libGL,
-  libX11,
-  libXrandr,
-  libbsd,
   libdrm,
-  libjpeg,
-  libmd,
+  libGL,
   libnotify,
   libpulseaudio,
-  librealsense,
   librsvg,
-  libsurvive,
-  libunwind,
-  libusb1,
-  libuvc,
   libva,
+  libX11,
+  libXrandr,
   makeDesktopItem,
   nix-update-script,
   nlohmann_json,
   onnxruntime,
   opencomposite,
-  opencv4,
-  openhmd,
-  openvr,
   openxr-loader,
-  orc,
-  # percetto
+  ovrCompatSearchPaths ? "${opencomposite}/lib/opencomposite:${xrizer}/lib/xrizer",
   pipewire,
   pkg-config,
   python3,
   qt6,
-  SDL2,
   shaderc,
   spdlog,
   systemd,
   udev,
   vulkan-headers,
   vulkan-loader,
-  wayland,
-  wayland-protocols,
-  wayland-scanner,
   x264,
+  xrizer,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wivrn";
-  version = "0.24";
+  version = "0.24.1";
 
   src = fetchFromGitHub {
     owner = "wivrn";
     repo = "wivrn";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0F+JHhVT/Axo+ycoh/qCL/jVncD+GrcuvYrxKE+UFGc=";
+    hash = "sha256-aWQcGIrBoDAO7XqWb3dQLBKg5RZYxC7JxwZ+OBSwmEs=";
   };
 
   monado = applyPatches {
@@ -106,8 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  # Let's make sure our monado source revision matches what is used by WiVRn upstream
   postUnpack = ''
-    # Let's make sure our monado source revision matches what is used by WiVRn upstream
     ourMonadoRev="${finalAttrs.monado.src.rev}"
     theirMonadoRev=$(sed -n '/FetchContent_Declare(monado/,/)/p' ${finalAttrs.src.name}/CMakeLists.txt | grep "GIT_TAG" | awk '{print $2}')
     if [ ! "$theirMonadoRev" == "$ourMonadoRev" ]; then
@@ -121,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs =
     [
       cmake
-      doxygen
       git
       glib
       glslang
@@ -138,62 +111,38 @@ stdenv.mkDerivation (finalAttrs: {
     [
       avahi
       boost
-      bluez
-      cjson
       cli11
-      dbus
       eigen
-      elfutils
       ffmpeg
       freetype
-      glib
       glm
-      gst_all_1.gst-plugins-base
-      gst_all_1.gstreamer
       harfbuzz
-      hidapi
       kdePackages.kcoreaddons
       kdePackages.ki18n
       kdePackages.kiconthemes
       kdePackages.kirigami
       kdePackages.qcoro
       kdePackages.qqc2-desktop-style
-      libbsd
       libdrm
       libGL
-      libjpeg
-      libmd
       libnotify
-      librealsense
-      libsurvive
-      libunwind
-      libusb1
-      libuvc
+      libpulseaudio
       libva
       libX11
       libXrandr
-      libpulseaudio
       nlohmann_json
-      opencv4
-      openhmd
-      openvr
       openxr-loader
       onnxruntime
-      orc
       pipewire
       qt6.qtbase
       qt6.qtsvg
       qt6.qttools
-      SDL2
       shaderc
       spdlog
       systemd
       udev
       vulkan-headers
       vulkan-loader
-      wayland
-      wayland-protocols
-      wayland-scanner
       x264
     ]
     ++ lib.optionals cudaSupport [
@@ -214,7 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "WIVRN_CHECK_CAPSYSNICE" false)
       (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
       (lib.cmakeFeature "WIVRN_OPENXR_MANIFEST_TYPE" "absolute")
-      (lib.cmakeFeature "OPENCOMPOSITE_SEARCH_PATH" "${opencomposite}/lib/opencomposite")
+      (lib.cmakeFeature "OVR_COMPAT_SEARCH_PATH" ovrCompatSearchPaths)
       (lib.cmakeFeature "GIT_DESC" "v${finalAttrs.version}")
       (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MONADO" "${finalAttrs.monado}")
     ]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index d467d5cec3b0..bd35f16211cd 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -43,6 +43,7 @@
 
   withGLES ? false,
   buildRemoteServer ? true,
+  zed-editor,
 }:
 
 assert withGLES -> stdenv.hostPlatform.isLinux;
@@ -319,7 +320,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         };
       }
       // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        withGles = finalAttrs.finalPackage.override { withGLES = true; };
+        withGles = zed-editor.override { withGLES = true; };
       };
   };
 
diff --git a/pkgs/by-name/zo/zon2nix/package.nix b/pkgs/by-name/zo/zon2nix/package.nix
index 82135e9ddd2b..380b52d1de21 100644
--- a/pkgs/by-name/zo/zon2nix/package.nix
+++ b/pkgs/by-name/zo/zon2nix/package.nix
@@ -2,23 +2,23 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  zig_0_11,
+  zig_0_14,
   nix,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zon2nix";
-  version = "0.1.2";
+  version = "0.1.3-unstable-2025-03-20";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "zon2nix";
-    rev = "v${version}";
-    hash = "sha256-pS0D+wdebtpNaGpDee9aBwEKTDvNU56VXer9uzULXcM=";
+    rev = "2360e358c2107860dadd340f88b25d260b538188";
+    hash = "sha256-89hYzrzQokQ+HUOd3g4epP9jdajaIoaMG81SrCNCqqU=";
   };
 
   nativeBuildInputs = [
-    zig_0_11.hook
+    zig_0_14.hook
   ];
 
   zigBuildFlags = [
@@ -29,13 +29,16 @@ stdenv.mkDerivation rec {
     "-Dnix=${lib.getExe nix}"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Convert the dependencies in `build.zig.zon` to a Nix expression";
     mainProgram = "zon2nix";
     homepage = "https://github.com/nix-community/zon2nix";
-    changelog = "https://github.com/nix-community/zon2nix/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ figsoda ];
-    inherit (zig_0_11.meta) platforms;
+    changelog = "https://github.com/nix-community/zon2nix/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      figsoda
+      RossComputerGuy
+    ];
+    inherit (zig_0_14.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/zs/zsh-fzf-history-search/package.nix b/pkgs/by-name/zs/zsh-fzf-history-search/package.nix
index c852da674a9b..4d63a7e0427a 100644
--- a/pkgs/by-name/zs/zsh-fzf-history-search/package.nix
+++ b/pkgs/by-name/zs/zsh-fzf-history-search/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "zsh-fzf-history-search";
-  version = "unstable-2023-03-08";
+  version = "unstable-2024-05-15";
 
   src = fetchFromGitHub {
     owner = "joshskidmore";
     repo = "zsh-fzf-history-search";
-    rev = "d1aae98ccd6ce153c97a5401d79fd36418cd2958";
-    hash = "sha256-4Dp2ehZLO83NhdBOKV0BhYFIvieaZPqiZZZtxsXWRaQ=";
+    rev = "d5a9730b5b4cb0b39959f7f1044f9c52743832ba";
+    hash = "sha256-tQqIlkgIWPEdomofPlmWNEz/oNFA1qasILk4R5RWobY=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/default.nix
index ba6db99f5f8b..037e5e2d735a 100644
--- a/pkgs/development/compilers/zig/default.nix
+++ b/pkgs/development/compilers/zig/default.nix
@@ -9,10 +9,6 @@
 }:
 let
   versions = {
-    "0.11.0" = {
-      llvmPackages = llvmPackages_16;
-      hash = "sha256-iuU1fzkbJxI+0N1PiLQM013Pd1bzrgqkbIyTxo5gB2I=";
-    };
     "0.12.1" = {
       llvmPackages = llvmPackages_17;
       hash = "sha256-C56jyVf16Co/XCloMLSRsbG9r/gBc8mzCdeEMHV2T2s=";
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index 0dba4983ea98..aaf9526ba4d1 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -7,6 +7,7 @@
   xcbuild,
   targetPackages,
   libxml2,
+  ninja,
   zlib,
   coreutils,
   callPackage,
@@ -35,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       cmake
       (lib.getDev llvmPackages.llvm.dev)
+      ninja
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # provides xcode-select, which is required for SDK detection
@@ -173,8 +175,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ andrewrk ] ++ lib.teams.zig.members;
     mainProgram = "zig";
-    # docgen fails to build
-    broken = version == "0.11.0";
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 765eadaf82eb..94b9c84fa4bb 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
 
   # build-system
   hatch-nodejs-version,
@@ -18,13 +18,14 @@
 
 buildPythonPackage rec {
   pname = "jupyter-ydoc";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "jupyter_ydoc";
-    inherit version;
-    hash = "sha256-ZvPTepoCqXEbUIpVdLCsSJqkDyFgMK8p/dgshiouteo=";
+  src = fetchFromGitHub {
+    owner = "jupyter-server";
+    repo = "jupyter_ydoc";
+    tag = "v${version}";
+    hash = "sha256-dD4ZLT5yKGdvWnsPd3nAKmi6Ca+MK5f/ufyNfbGMmoM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llm-gemini/default.nix b/pkgs/development/python-modules/llm-gemini/default.nix
index b1e5bdc08c12..5dac4fe11d96 100644
--- a/pkgs/development/python-modules/llm-gemini/default.nix
+++ b/pkgs/development/python-modules/llm-gemini/default.nix
@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
   pname = "llm-gemini";
-  version = "0.17";
+  version = "0.18.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-gemini";
     tag = version;
-    hash = "sha256-CF3kRrW1wV1JZC+spOmb2BFBKjFzvWG+vFIscZuVp2U=";
+    hash = "sha256-kQVqMB8uf8tT4lTbyvX5tByUzD2yO1h7hIDhUTycX2A=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/analysis/hopper/default.nix b/pkgs/development/tools/analysis/hopper/default.nix
index 88554babb9f4..b451763c4aa2 100644
--- a/pkgs/development/tools/analysis/hopper/default.nix
+++ b/pkgs/development/tools/analysis/hopper/default.nix
@@ -1,7 +1,7 @@
 {
+  lib,
   stdenv,
   fetchurl,
-  lib,
   autoPatchelfHook,
   wrapQtAppsHook,
   gnustep-libobjc,
@@ -10,14 +10,20 @@
   ncurses6,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hopper";
-  version = "5.5.3";
+  version = "5.18.0";
   rev = "v4";
 
   src = fetchurl {
-    url = "https://d2ap6ypl1xbe4k.cloudfront.net/Hopper-${rev}-${version}-Linux-demo.pkg.tar.xz";
-    hash = "sha256-xq9ZVg1leHm/tq6LYyQLa8p5dDwBd64Jt92uMoE0z58=";
+    url = "https://www.hopperapp.com/downloader/hopperv4/Hopper-${finalAttrs.rev}-${finalAttrs.version}-Linux-demo.pkg.tar.xz";
+    curlOptsList = [
+      "--user-agent"
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
+      "--referer"
+      "https://www.hopperapp.com"
+    ];
+    hash = "sha256-Z/Y+il5DTdssa2T0RDkDyco098o4JHKeLuwFUpJjgZ0=";
   };
 
   sourceRoot = ".";
@@ -37,39 +43,29 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
-    mkdir -p $out/lib
-    mkdir -p $out/share
-
-    cp $sourceRoot/opt/hopper-${rev}/bin/Hopper $out/bin/hopper
-    cp \
-      --archive \
-      $sourceRoot/opt/hopper-${rev}/lib/libBlocksRuntime.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libdispatch.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libgnustep-base.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libHopperCore.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libkqueue.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libobjcxx.so* \
-      $sourceRoot/opt/hopper-${rev}/lib/libpthread_workqueue.so* \
+    mkdir -p $out/bin $out/lib
+    install -Dm755 opt/hopper-${finalAttrs.rev}/bin/Hopper $out/bin/hopper
+    cp --archive \
+      opt/hopper-${finalAttrs.rev}/lib/libBlocksRuntime.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libdispatch.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libgnustep-base.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libHopperCore.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libkqueue.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libobjcxx.so* \
+      opt/hopper-${finalAttrs.rev}/lib/libpthread_workqueue.so* \
       $out/lib
-
-    cp -r $sourceRoot/usr/share $out
+    cp -r usr/share $out/share
+    substituteInPlace $out/share/applications/hopper-${finalAttrs.rev}.desktop \
+      --replace-fail "Exec=/opt/hopper-${finalAttrs.rev}/bin/Hopper" "Exec=hopper"
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    substituteInPlace "$out/share/applications/hopper-${rev}.desktop" \
-      --replace "Exec=/opt/hopper-${rev}/bin/Hopper" "Exec=$out/bin/hopper"
-  '';
-
-  meta = with lib; {
+  meta = {
     homepage = "https://www.hopperapp.com/index.html";
     description = "MacOS and Linux Disassembler";
-    license = licenses.unfree;
-    maintainers = with maintainers; [
-      Enteee
-    ];
-    platforms = platforms.linux;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ Enteee ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/games/openloco/default.nix b/pkgs/games/openloco/default.nix
index 09febb495f3f..5741e8d2c2aa 100644
--- a/pkgs/games/openloco/default.nix
+++ b/pkgs/games/openloco/default.nix
@@ -11,6 +11,7 @@
   pkg-config,
   yaml-cpp,
   fmt,
+  xorg,
 }:
 let
   sfl-src = fetchFromGitHub {
@@ -68,6 +69,7 @@ stdenv.mkDerivation rec {
     openal
     yaml-cpp
     fmt
+    xorg.libX11
   ];
 
   meta = {
diff --git a/pkgs/servers/hbase/default.nix b/pkgs/servers/hbase/default.nix
index 5d924252d1e9..6e9f3be1d362 100644
--- a/pkgs/servers/hbase/default.nix
+++ b/pkgs/servers/hbase/default.nix
@@ -51,13 +51,13 @@ in
     tests.standalone = nixosTests.hbase_2_4;
   };
   hbase_2_5 = common {
-    version = "2.5.10";
-    hash = "sha256-uYc5IZGQdLOm5gAEyyGtJtcgf+GxADEEuxjixZbG3Qs=";
+    version = "2.5.11";
+    hash = "sha256-W3o8J+aY2bQoiu1Lr1n5EQWDVoS1OwWTNIUAU03a5Es=";
     tests.standalone = nixosTests.hbase_2_5;
   };
   hbase_2_6 = common {
-    version = "2.6.1";
-    hash = "sha256-dubu/4Ilk82NtNEcKt8uLbcH8n81EncxOvkZOwk2kVA=";
+    version = "2.6.2";
+    hash = "sha256-X/mjmTAx9anh2U/Xlfuf+O4AO5BXDkdsY69tPddEpYM=";
     tests.standalone = nixosTests.hbase2;
   };
   hbase_3_0 = common {
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index 09ff1cfdeeea..ffce88990230 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.15.1";
+  version = "2.15.2";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -22,7 +22,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     tag = "v${version}";
-    sha256 = "sha256-c+xGgjmn2HE+sl8Vbw9Neztm8g6s9eF/QOVXRtOZWgI=";
+    sha256 = "sha256-psfwEdYsP6VAzF8rbxZAxLU/uPfG3vB+OaKx2bu8Gwk=";
   };
 
   installPhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 617537eb7ec0..81c622f3933a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1929,6 +1929,7 @@ mapAliases {
   zfs_2_1 = throw "zfs 2.1 has been removed as it is EOL. Please upgrade to a newer version"; # Added 2024-12-25
   zig_0_9 = throw "zig 0.9 has been removed, upgrade to a newer version instead"; # Added 2025-01-24
   zig_0_10 = throw "zig 0.10 has been removed, upgrade to a newer version instead"; # Added 2025-01-24
+  zig_0_11 = throw "zig 0.11 has been removed, upgrade to a newer version instead"; # Added 2025-04-09
   zimlib = throw "'zimlib' has been removed because it was an outdated and unused version of 'libzim'"; # Added 2025-03-07
   zinc = zincsearch; # Added 2023-05-28
   zk-shell = throw "zk-shell has been removed as it was broken and unmaintained"; # Added 2024-08-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bc0e13af2e01..83f48cfe8b1f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7938,9 +7938,9 @@ with pkgs;
       electron-source.electron_35
     else
       electron_35-bin;
-  electron = electron_34;
-  electron-bin = electron_34-bin;
-  electron-chromedriver = electron-chromedriver_34;
+  electron = electron_35;
+  electron-bin = electron_35-bin;
+  electron-chromedriver = electron-chromedriver_35;
 
   autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };
@@ -8981,10 +8981,6 @@ with pkgs;
 
   aws-spend-summary = haskellPackages.aws-spend-summary.bin;
 
-  backlight-auto = callPackage ../by-name/ba/backlight-auto/package.nix {
-    zig = buildPackages.zig_0_11;
-  };
-
   inherit (callPackages ../development/libraries/bashup-events { }) bashup-events32 bashup-events44;
 
   bc-soci = callPackage ../development/libraries/soci/bc-soci.nix { };
@@ -11470,13 +11466,11 @@ with pkgs;
     (rec {
       zigPackages = recurseIntoAttrs (callPackage ../development/compilers/zig { });
 
-      zig_0_11 = zigPackages."0.11";
       zig_0_12 = zigPackages."0.12";
       zig_0_13 = zigPackages."0.13";
       zig_0_14 = zigPackages."0.14";
     })
     zigPackages
-    zig_0_11
     zig_0_12
     zig_0_13
     zig_0_14
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7610a80c8ac2..099b7ebeac83 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12667,16 +12667,23 @@ with self;
       hash = "sha256-u+rO2ZXX2NEM/FGjpaZtpBzrK8BP7cq1DhDmMA6AHG4=";
     };
     nativeBuildInputs = [ buildPackages.pkg-config ];
-    propagatedBuildInputs = [ pkgs.pkg-config ];
+    propagatedNativeBuildInputs = [ pkgs.pkg-config ];
     postPatch = ''
       # no pkg-config binary when cross-compiling so the check fails
       substituteInPlace Makefile.PL \
         --replace "pkg-config" "$PKG_CONFIG"
+      # use correctly prefixed pkg-config binary
+      substituteInPlace lib/ExtUtils/PkgConfig.pm \
+        --replace-fail '`pkg-config' '`${stdenv.cc.targetPrefix}pkg-config' \
+        --replace-fail '"pkg-config' '"${stdenv.cc.targetPrefix}pkg-config' \
+        --replace-fail '/pkg-config' '/${stdenv.cc.targetPrefix}pkg-config'
     '';
     doCheck = false; # expects test_glib-2.0.pc in PKG_CONFIG_PATH
     meta = {
       description = "Simplistic interface to pkg-config";
+      homepage = "https://gitlab.gnome.org/GNOME/perl-extutils-pkgconfig";
       license = with lib.licenses; [ lgpl21Plus ];
+      maintainers = [ lib.maintainers.fliegendewurst ];
     };
   };