diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix
index f6dc40171d1b..ed635a35617b 100644
--- a/nixos/modules/services/backup/zfs-replication.nix
+++ b/nixos/modules/services/backup/zfs-replication.nix
@@ -92,7 +92,7 @@ in
             ++ (lib.optional cfg.followDelete "--follow-delete")
           );
         in
-        "${lib.getExe cfg.package} ${lib.concatStringSep " " args}";
+        "${lib.getExe cfg.package} ${lib.concatStringsSep " " args}";
       wantedBy = [
         "zfs-snapshot-daily.service"
         "zfs-snapshot-frequent.service"
diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix
index 7afdb630b0a7..4a7398721f23 100644
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@@ -184,6 +184,12 @@ in
       environment.etc."sane-config".source = config.hardware.sane.configDir;
       environment.etc."sane-libs".source = "${saneConfig}/lib/sane";
       services.udev.packages = backends;
+      # sane sets up udev rules that tag scanners with `uaccess`. This way, physically logged in users
+      # can access them without belonging to the `scanner` group. However, the `scanner` user used by saned
+      # does not have a real logind seat, so `uaccess` is not enough.
+      services.udev.extraRules = ''
+        ENV{DEVNAME}!="", ENV{libsane_matched}=="yes", RUN+="${pkgs.acl}/bin/setfacl -m g:scanner:rw $env{DEVNAME}"
+      '';
 
       users.groups.scanner.gid = config.ids.gids.scanner;
       networking.firewall.allowedUDPPorts = lib.mkIf config.hardware.sane.openFirewall [ 8612 ];
diff --git a/pkgs/applications/audio/jamesdsp/default.nix b/pkgs/applications/audio/jamesdsp/default.nix
index 6dd5c4bba8ba..823d11b55caa 100644
--- a/pkgs/applications/audio/jamesdsp/default.nix
+++ b/pkgs/applications/audio/jamesdsp/default.nix
@@ -66,6 +66,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   qmakeFlags = lib.optionals usePulseaudio [ "CONFIG+=USE_PULSEAUDIO" ];
 
+  # https://github.com/Audio4Linux/JDSP4Linux/issues/228
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=incompatible-pointer-types"
+    "-Wno-error=implicit-int"
+    "-Wno-error=implicit-function-declaration"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "jamesdsp";
diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index 5bfb8a260b0b..887ded477918 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "beamerpresenter";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "stiglers-eponym";
     repo = "BeamerPresenter";
     rev = "v${version}";
-    hash = "sha256-ofS0KMsn0KG8squIvMPxSCgE/qNK+Kd47psNziLBBoo=";
+    hash = "sha256-sPeWlPkWOPfLAoAC/+T7nyhPqvoaZg6aMOIVLjMqd2k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 6b6d43f5233b..8479675f0be1 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-12-17";
+  version = "0-unstable-2024-12-27";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "c942e9a4a606a27fda4aff5754dd2e397ea5d310";
-    hash = "sha256-4qbvXaGh6zcTwn2dKbVZSfbroBQ9xh02FCq/0t/8sjY=";
+    rev = "8e8452c210f005e409f6b1eddbb2907e8db0a6d3";
+    hash = "sha256-73MltJrKlTvj+ijjhbNQsxGl05KGx+jioSrFGA6IdxE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/br/broot/package.nix b/pkgs/by-name/br/broot/package.nix
index f42b934c6909..df98fa357568 100644
--- a/pkgs/by-name/br/broot/package.nix
+++ b/pkgs/by-name/br/broot/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.44.2";
+  version = "1.44.3";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rMAGnC1CcHYPLh199a+aKgVdm/xheUQIRSvF+HqeZQE=";
+    hash = "sha256-45QNcnx9sEjm02woIpxxLuir4Kep8SPlSZDdiifZNL8=";
   };
 
-  cargoHash = "sha256-DVH7dKJEkyBnjNtLK/xfO+Hlw+rr3wTKqyooj5JM2is=";
+  cargoHash = "sha256-2hqpltfKE8fIFlvXMQfXVT41jPILL/INXQRUHfi1EhY=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/de/dep-tree/package.nix b/pkgs/by-name/de/dep-tree/package.nix
index 5c276b5686ff..57848ec9d392 100644
--- a/pkgs/by-name/de/dep-tree/package.nix
+++ b/pkgs/by-name/de/dep-tree/package.nix
@@ -32,7 +32,7 @@ let
     };
   };
   pname = "dep-tree";
-  version = "0.23.0";
+  version = "0.23.1";
 in
 buildGoModule {
   inherit pname version;
@@ -41,7 +41,7 @@ buildGoModule {
     owner = "gabotechs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Vd6g9UE3XEFGjCK8tFfOphYcNx+zeBS9rBVz0MDLe1I=";
+    hash = "sha256-Y+zNx+p8xmM0L4C5IELtepm7TQDhpxOVzgc1HxdFa0w=";
   };
 
   vendorHash = "sha256-KoVOjZq+RrJ2gzLnANHPPtbEY1ztC0rIXWD9AXAxqMg=";
diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index c21b758b9af9..d852ff4e50c8 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -4,7 +4,7 @@
   fetchYarnDeps,
   fetchFromGitHub,
   fixup-yarn-lock,
-  nodejs,
+  nodejs_20,
   python3,
   makeBinaryWrapper,
   git,
@@ -12,15 +12,19 @@
   yarn,
   docker-compose,
 }:
+
+let
+  nodejs = nodejs_20; # does not build with 22
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "devcontainers";
     repo = "cli";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-plIDK5nOvLKFlRVlPHgpjHPhIh0NAWHmbaKsnYCU/7k=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3rSWD6uxwcMQdHBSmmAQ0aevqevVXINigCj06jjEcRc=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch b/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch
new file mode 100644
index 000000000000..997300c07e3f
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0001-fm-load-all-actions.patch
@@ -0,0 +1,11 @@
+--- a/src/actions/action.c
++++ b/src/actions/action.c
+@@ -2047,7 +2047,7 @@
+ 	gchar* _tmp9_ = NULL;
+ 	_tmp0_ = fm_all_actions;
+ 	g_hash_table_remove_all (_tmp0_);
+-	_tmp2_ = _tmp1_ = g_get_system_data_dirs ();
++	_tmp2_ = _tmp1_ = (gchar **)g_get_system_data_dirs ();
+ 	dirs = _tmp2_;
+ 	dirs_length1 = _vala_array_length (_tmp1_);
+ 	_dirs_size_ = dirs_length1;
diff --git a/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch b/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch
new file mode 100644
index 000000000000..6f0965430112
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0002-exo-icon-view-key-press-event.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/exo/exo-icon-view.c
++++ b/src/gtk/exo/exo-icon-view.c
+@@ -2819,7 +2819,7 @@
+   /* allocate a new event to forward */
+   new_event = gdk_event_copy ((GdkEvent *) event);
+   g_object_unref (G_OBJECT (new_event->key.window));
+-  new_event->key.window = g_object_ref (G_OBJECT (gtk_widget_get_window (icon_view->priv->search_entry)));
++  new_event->key.window = (GdkWindow *)g_object_ref (G_OBJECT (gtk_widget_get_window (icon_view->priv->search_entry)));
+ 
+   /* send the event to the search entry. If the "preedit-changed" signal is
+    * emitted during this event, priv->search_imcontext_changed will be set.
diff --git a/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch b/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch
new file mode 100644
index 000000000000..6106ec9280f5
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0003-ask-action-on-drop.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/fm-dnd-dest.c
++++ b/src/gtk/fm-dnd-dest.c
+@@ -458,7 +458,7 @@
+             gtk_action_set_sensitive(act, FALSE);
+         }
+     }
+-    ri.menu = g_object_ref(gtk_ui_manager_get_widget(ui, "/popup"));
++    ri.menu = (GtkMenu *)g_object_ref(gtk_ui_manager_get_widget(ui, "/popup"));
+     g_signal_connect(ri.menu, "selection-done", G_CALLBACK(gtk_widget_destroy), NULL);
+     unmap_handler = g_signal_connect(ri.menu, "unmap",
+                                      G_CALLBACK(run_unmap_handler), &ri);
diff --git a/pkgs/by-name/li/libfm/0004-create-icon-view.patch b/pkgs/by-name/li/libfm/0004-create-icon-view.patch
new file mode 100644
index 000000000000..6a16b6446c89
--- /dev/null
+++ b/pkgs/by-name/li/libfm/0004-create-icon-view.patch
@@ -0,0 +1,11 @@
+--- a/src/gtk/fm-standard-view.c
++++ b/src/gtk/fm-standard-view.c
+@@ -637,7 +637,7 @@
+                                 "text", FM_FOLDER_MODEL_COL_NAME );
+     if(fv->renderer_text)
+         g_object_unref(fv->renderer_text);
+-    fv->renderer_text = g_object_ref_sink(render);
++    fv->renderer_text = (FmCellRendererText *)g_object_ref_sink(render);
+     exo_icon_view_set_search_column((ExoIconView*)fv->view, FM_FOLDER_MODEL_COL_NAME);
+     g_signal_connect(fv->view, "item-activated", G_CALLBACK(on_icon_view_item_activated), fv);
+     g_signal_connect(fv->view, "selection-changed", G_CALLBACK(on_sel_changed), fv);
diff --git a/pkgs/by-name/li/libfm/package.nix b/pkgs/by-name/li/libfm/package.nix
index 8ce1a0b2ccfe..d762036a22d0 100644
--- a/pkgs/by-name/li/libfm/package.nix
+++ b/pkgs/by-name/li/libfm/package.nix
@@ -27,6 +27,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-pQQmMDBM+OXYz/nVZca9VG8ii0jJYBU+02ajTofK0eU=";
   };
 
+  patches = [
+    ./0001-fm-load-all-actions.patch
+    ./0002-exo-icon-view-key-press-event.patch
+    ./0003-ask-action-on-drop.patch
+    ./0004-create-icon-view.patch
+  ];
+
   nativeBuildInputs = [
     vala
     pkg-config
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index f2adccb9ed9e..73788bb8ccfe 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -43,19 +43,19 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
     common_build_flags.add_argument("--show-trace", action="store_true")
 
-    flake_build_flags = argparse.ArgumentParser(add_help=False)
-    flake_build_flags.add_argument("--accept-flake-config", action="store_true")
-    flake_build_flags.add_argument("--refresh", action="store_true")
-    flake_build_flags.add_argument("--impure", action="store_true")
-    flake_build_flags.add_argument("--offline", action="store_true")
-    flake_build_flags.add_argument("--no-net", action="store_true")
-    flake_build_flags.add_argument("--recreate-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-update-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-write-lock-file", action="store_true")
-    flake_build_flags.add_argument("--no-registries", action="store_true")
-    flake_build_flags.add_argument("--commit-lock-file", action="store_true")
-    flake_build_flags.add_argument("--update-input")
-    flake_build_flags.add_argument("--override-input", nargs=2)
+    flake_common_flags = argparse.ArgumentParser(add_help=False)
+    flake_common_flags.add_argument("--accept-flake-config", action="store_true")
+    flake_common_flags.add_argument("--refresh", action="store_true")
+    flake_common_flags.add_argument("--impure", action="store_true")
+    flake_common_flags.add_argument("--offline", action="store_true")
+    flake_common_flags.add_argument("--no-net", action="store_true")
+    flake_common_flags.add_argument("--recreate-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-update-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-write-lock-file", action="store_true")
+    flake_common_flags.add_argument("--no-registries", action="store_true")
+    flake_common_flags.add_argument("--commit-lock-file", action="store_true")
+    flake_common_flags.add_argument("--update-input")
+    flake_common_flags.add_argument("--override-input", nargs=2)
 
     classic_build_flags = argparse.ArgumentParser(add_help=False)
     classic_build_flags.add_argument("--no-build-output", "-Q", action="store_true")
@@ -74,7 +74,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     sub_parsers = {
         "common_flags": common_flags,
         "common_build_flags": common_build_flags,
-        "flake_build_flags": flake_build_flags,
+        "flake_common_flags": flake_common_flags,
         "classic_build_flags": classic_build_flags,
         "copy_flags": copy_flags,
     }
@@ -262,8 +262,8 @@ def parse_args(
 def reexec(
     argv: list[str],
     args: argparse.Namespace,
-    build_flags: dict[str, Args],
-    flake_build_flags: dict[str, Args],
+    build_flags: Args,
+    flake_build_flags: Args,
 ) -> None:
     drv = None
     attr = "config.system.build.nixos-rebuild"
@@ -271,10 +271,18 @@ def reexec(
         # Parsing the args here but ignore ask_sudo_password since it is not
         # needed and we would end up asking sudo password twice
         if flake := Flake.from_arg(args.flake, Remote.from_arg(args.target_host, None)):
-            drv = nix.build_flake(attr, flake, **flake_build_flags, no_link=True)
+            drv = nix.build_flake(
+                attr,
+                flake,
+                flake_build_flags | {"no_link": True},
+            )
         else:
             build_attr = BuildAttr.from_arg(args.attr, args.file)
-            drv = nix.build(attr, build_attr, **build_flags, no_out_link=True)
+            drv = nix.build(
+                attr,
+                build_attr,
+                build_flags | {"no_out_link": True},
+            )
     except CalledProcessError:
         logger.warning(
             "could not build a newer version of nixos-rebuild, "
@@ -319,7 +327,8 @@ def execute(argv: list[str]) -> None:
     common_flags = vars(args_groups["common_flags"])
     common_build_flags = common_flags | vars(args_groups["common_build_flags"])
     build_flags = common_build_flags | vars(args_groups["classic_build_flags"])
-    flake_build_flags = common_build_flags | vars(args_groups["flake_build_flags"])
+    flake_common_flags = common_flags | vars(args_groups["flake_common_flags"])
+    flake_build_flags = common_build_flags | flake_common_flags
     copy_flags = common_flags | vars(args_groups["copy_flags"])
 
     if args.upgrade or args.upgrade_all:
@@ -350,7 +359,7 @@ def execute(argv: list[str]) -> None:
     flake = Flake.from_arg(args.flake, target_host)
 
     if can_run and not flake:
-        nixpkgs_path = nix.find_file("nixpkgs", **build_flags)
+        nixpkgs_path = nix.find_file("nixpkgs", build_flags)
         rev = nix.get_nixpkgs_rev(nixpkgs_path)
         if nixpkgs_path and rev:
             (nixpkgs_path / ".version-suffix").write_text(rev)
@@ -370,7 +379,10 @@ def execute(argv: list[str]) -> None:
 
             dry_run = action == Action.DRY_BUILD
             no_link = action in (Action.SWITCH, Action.BOOT)
+            build_flags |= {"no_out_link": no_link, "dry_run": dry_run}
+            flake_build_flags |= {"no_link": no_link, "dry_run": dry_run}
             rollback = bool(args.rollback)
+
             match action:
                 case Action.BUILD_VM:
                     attr = "config.system.build.vm"
@@ -395,24 +407,22 @@ def execute(argv: list[str]) -> None:
                 case (_, True, _, _):
                     raise NRError(f"--rollback is incompatible with '{action}'")
                 case (_, False, Remote(_), Flake(_)):
-                    path_to_config = nix.remote_build_flake(
+                    path_to_config = nix.build_remote_flake(
                         attr,
                         flake,
                         build_host,
+                        eval_flags=flake_common_flags,
                         flake_build_flags=flake_build_flags,
                         copy_flags=copy_flags,
-                        build_flags=build_flags,
                     )
                 case (_, False, None, Flake(_)):
                     path_to_config = nix.build_flake(
                         attr,
                         flake,
-                        no_link=no_link,
-                        dry_run=dry_run,
-                        **flake_build_flags,
+                        flake_build_flags=flake_build_flags,
                     )
                 case (_, False, Remote(_), None):
-                    path_to_config = nix.remote_build(
+                    path_to_config = nix.build_remote(
                         attr,
                         build_attr,
                         build_host,
@@ -424,9 +434,7 @@ def execute(argv: list[str]) -> None:
                     path_to_config = nix.build(
                         attr,
                         build_attr,
-                        no_out_link=no_link,
-                        dry_run=dry_run,
-                        **build_flags,
+                        build_flags=build_flags,
                     )
                 case never:
                     # should never happen, but mypy is not smart enough to
@@ -442,7 +450,7 @@ def execute(argv: list[str]) -> None:
                     path_to_config,
                     to_host=target_host,
                     from_host=build_host,
-                    **copy_flags,
+                    copy_flags=copy_flags,
                 )
                 if action in (Action.SWITCH, Action.BOOT):
                     nix.set_profile(
@@ -468,7 +476,7 @@ def execute(argv: list[str]) -> None:
                     f"Done. The virtual machine can be started by running '{vm_path}'"
                 )
         case Action.EDIT:
-            nix.edit(flake, **flake_build_flags)
+            nix.edit(flake, flake_build_flags)
         case Action.DRY_RUN:
             assert False, "DRY_RUN should be a DRY_BUILD alias"
         case Action.LIST_GENERATIONS:
@@ -488,9 +496,9 @@ def execute(argv: list[str]) -> None:
                 print(tabulate(generations, headers=headers))
         case Action.REPL:
             if flake:
-                nix.repl_flake("toplevel", flake, **flake_build_flags)
+                nix.repl_flake("toplevel", flake, flake_build_flags)
             else:
-                nix.repl("system", build_attr, **build_flags)
+                nix.repl("system", build_attr, build_flags)
         case _:
             assert_never(action)
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index c26a771c26f8..876a9a06c9c7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -32,7 +32,7 @@ logger = logging.getLogger(__name__)
 def build(
     attr: str,
     build_attr: BuildAttr,
-    **build_flags: Args,
+    build_flags: Args | None = None,
 ) -> Path:
     """Build NixOS attribute using classic Nix.
 
@@ -52,7 +52,7 @@ def build(
 def build_flake(
     attr: str,
     flake: Flake,
-    **flake_build_flags: Args,
+    flake_build_flags: Args | None = None,
 ) -> Path:
     """Build NixOS attribute using Flakes.
 
@@ -70,13 +70,13 @@ def build_flake(
     return Path(r.stdout.strip())
 
 
-def remote_build(
+def build_remote(
     attr: str,
     build_attr: BuildAttr,
     build_host: Remote | None,
-    build_flags: dict[str, Args] | None = None,
-    instantiate_flags: dict[str, Args] | None = None,
-    copy_flags: dict[str, Args] | None = None,
+    build_flags: Args | None = None,
+    instantiate_flags: Args | None = None,
+    copy_flags: Args | None = None,
 ) -> Path:
     # We need to use `--add-root` otherwise Nix will print this warning:
     # > warning: you did not specify '--add-root'; the result might be removed
@@ -89,12 +89,12 @@ def remote_build(
             build_attr.to_attr(attr),
             "--add-root",
             tmpdir.TMPDIR_PATH / uuid4().hex,
-            *dict_to_flags(instantiate_flags or {}),
+            *dict_to_flags(instantiate_flags),
         ],
         stdout=PIPE,
     )
     drv = Path(r.stdout.strip()).resolve()
-    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    copy_closure(drv, to_host=build_host, from_host=None, copy_flags=copy_flags)
 
     # Need a temporary directory in remote to use in `nix-store --add-root`
     r = run_wrapper(
@@ -109,7 +109,7 @@ def remote_build(
                 drv,
                 "--add-root",
                 remote_tmpdir / uuid4().hex,
-                *dict_to_flags(build_flags or {}),
+                *dict_to_flags(build_flags),
             ],
             remote=build_host,
             stdout=PIPE,
@@ -124,13 +124,13 @@ def remote_build(
         run_wrapper(["rm", "-rf", remote_tmpdir], remote=build_host, check=False)
 
 
-def remote_build_flake(
+def build_remote_flake(
     attr: str,
     flake: Flake,
     build_host: Remote,
-    flake_build_flags: dict[str, Args] | None = None,
-    copy_flags: dict[str, Args] | None = None,
-    build_flags: dict[str, Args] | None = None,
+    eval_flags: Args | None = None,
+    copy_flags: Args | None = None,
+    flake_build_flags: Args | None = None,
 ) -> Path:
     r = run_wrapper(
         [
@@ -139,12 +139,12 @@ def remote_build_flake(
             "eval",
             "--raw",
             flake.to_attr(attr, "drvPath"),
-            *dict_to_flags(flake_build_flags or {}),
+            *dict_to_flags(eval_flags),
         ],
         stdout=PIPE,
     )
     drv = Path(r.stdout.strip())
-    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    copy_closure(drv, to_host=build_host, from_host=None, copy_flags=copy_flags)
     r = run_wrapper(
         [
             "nix",
@@ -152,7 +152,7 @@ def remote_build_flake(
             "build",
             f"{drv}^*",
             "--print-out-paths",
-            *dict_to_flags(build_flags or {}),
+            *dict_to_flags(flake_build_flags),
         ],
         remote=build_host,
         stdout=PIPE,
@@ -164,7 +164,7 @@ def copy_closure(
     closure: Path,
     to_host: Remote | None,
     from_host: Remote | None = None,
-    **copy_flags: Args,
+    copy_flags: Args | None = None,
 ) -> None:
     """Copy a nix closure to or from host to localhost.
 
@@ -192,6 +192,7 @@ def copy_closure(
             [
                 "nix",
                 "copy",
+                *dict_to_flags(copy_flags),
                 "--from",
                 f"ssh://{from_host.host}",
                 "--to",
@@ -221,7 +222,7 @@ def copy_closure(
                 nix_copy_closure(to_host, to=True)
 
 
-def edit(flake: Flake | None, **flake_flags: Args) -> None:
+def edit(flake: Flake | None, flake_flags: Args | None = None) -> None:
     "Try to find and open NixOS configuration file in editor."
     if flake:
         run_wrapper(
@@ -250,7 +251,7 @@ def edit(flake: Flake | None, **flake_flags: Args) -> None:
             raise NRError("cannot find NixOS config file")
 
 
-def find_file(file: str, **nix_flags: Args) -> Path | None:
+def find_file(file: str, nix_flags: Args | None = None) -> Path | None:
     "Find classic Nix file location."
     r = run_wrapper(
         ["nix-instantiate", "--find-file", file, *dict_to_flags(nix_flags)],
@@ -420,14 +421,14 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
         )
 
 
-def repl(attr: str, build_attr: BuildAttr, **nix_flags: Args) -> None:
+def repl(attr: str, build_attr: BuildAttr, nix_flags: Args | None = None) -> None:
     run_args = ["nix", "repl", "--file", build_attr.path]
     if build_attr.attr:
         run_args.append(build_attr.attr)
     run_wrapper([*run_args, *dict_to_flags(nix_flags)])
 
 
-def repl_flake(attr: str, flake: Flake, **flake_flags: Args) -> None:
+def repl_flake(attr: str, flake: Flake, flake_flags: Args | None = None) -> None:
     expr = Template(
         files(__package__).joinpath(FLAKE_REPL_TEMPLATE).read_text()
     ).substitute(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index 11a0d9188294..edf4d8ccdaa3 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -1,8 +1,9 @@
 import logging
 from collections.abc import Mapping, Sequence
-from typing import Any, TypeAlias, assert_never, override
+from typing import Any, assert_never, override
 
-Args: TypeAlias = bool | str | list[str] | int | None
+type Arg = bool | str | list[str] | int | None
+type Args = dict[str, Arg]
 
 
 class LogFormatter(logging.Formatter):
@@ -19,7 +20,10 @@ class LogFormatter(logging.Formatter):
         return formatter.format(record)
 
 
-def dict_to_flags(d: Mapping[str, Args]) -> list[str]:
+def dict_to_flags(d: Args | None) -> list[str]:
+    if not d:
+        return []
+
     flags = []
     for key, value in d.items():
         flag = f"--{'-'.join(key.split('_'))}"
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 23fd55283fce..63ae24147929 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -123,8 +123,8 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
                     "<nixpkgs/nixos>",
                     "--attr",
                     "config.system.build.toplevel",
-                    "--no-out-link",
                     "-vvv",
+                    "--no-out-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -188,8 +188,8 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
                     "build",
                     "--print-out-paths",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel",
-                    "--no-link",
                     "-v",
+                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
@@ -371,6 +371,7 @@ def test_execute_nix_switch_flake_build_host(
                     "build",
                     f"'{config_path}^*'",
                     "--print-out-paths",
+                    "--no-link",
                 ],
                 check=True,
                 stdout=PIPE,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index c2bef1fffe97..a040d60e6368 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -21,7 +21,9 @@ from .helpers import get_qualified_name
 )
 def test_build(mock_run: Any, monkeypatch: Any) -> None:
     assert n.build(
-        "config.system.build.attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag="foo"
+        "config.system.build.attr",
+        m.BuildAttr("<nixpkgs/nixos>", None),
+        {"nix_flag": "foo"},
     ) == Path("/path/to/file")
     mock_run.assert_called_with(
         [
@@ -55,8 +57,7 @@ def test_build_flake(mock_run: Any) -> None:
     assert n.build_flake(
         "config.system.build.toplevel",
         flake,
-        no_link=True,
-        nix_flag="foo",
+        {"no_link": True, "nix_flag": "foo"},
     ) == Path("/path/to/file")
     mock_run.assert_called_with(
         [
@@ -76,7 +77,7 @@ def test_build_flake(mock_run: Any) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 @patch(get_qualified_name(n.uuid4, n), autospec=True)
-def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
+def test_build_remote(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     build_host = m.Remote("user@host", [], None)
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
@@ -97,7 +98,7 @@ def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     mock_run.side_effect = run_wrapper_side_effect
     mock_uuid4.side_effect = [uuid.UUID(int=1), uuid.UUID(int=2)]
 
-    assert n.remote_build(
+    assert n.build_remote(
         "config.system.build.toplevel",
         m.BuildAttr("<nixpkgs/nixos>", "preAttr"),
         build_host,
@@ -164,18 +165,18 @@ def test_remote_build(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
     autospec=True,
     return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
 )
-def test_remote_build_flake(mock_run: Any, monkeypatch: Any) -> None:
+def test_build_remote_flake(mock_run: Any, monkeypatch: Any) -> None:
     flake = m.Flake.parse(".#hostname")
     build_host = m.Remote("user@host", [], None)
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
-    assert n.remote_build_flake(
+    assert n.build_remote_flake(
         "config.system.build.toplevel",
         flake,
         build_host,
-        flake_build_flags={"flake": True},
+        eval_flags={"flake": True},
         copy_flags={"copy": True},
-        build_flags={"build": True},
+        flake_build_flags={"build": True},
     ) == Path("/path/to/file")
     mock_run.assert_has_calls(
         [
@@ -237,9 +238,9 @@ def test_copy_closure(monkeypatch: Any) -> None:
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, None, build_host)
+        n.copy_closure(closure, None, build_host, {"copy_flag": True})
         mock_run.assert_called_with(
-            ["nix-copy-closure", "--from", "user@build.host", closure],
+            ["nix-copy-closure", "--copy-flag", "--from", "user@build.host", closure],
             extra_env={
                 "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-opt"])
             },
@@ -251,11 +252,12 @@ def test_copy_closure(monkeypatch: Any) -> None:
         "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-target-opt"])
     }
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, target_host, build_host)
+        n.copy_closure(closure, target_host, build_host, {"copy_flag": True})
         mock_run.assert_called_with(
             [
                 "nix",
                 "copy",
+                "--copy-flag",
                 "--from",
                 "ssh://user@build.host",
                 "--to",
@@ -286,7 +288,7 @@ def test_copy_closure(monkeypatch: Any) -> None:
 def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
     # Flake
     flake = m.Flake.parse(".#attr")
-    n.edit(flake, commit_lock_file=True)
+    n.edit(flake, {"commit_lock_file": True})
     mock_run.assert_called_with(
         [
             "nix",
@@ -471,7 +473,7 @@ def test_list_generations(mock_get_generations: Any, tmp_path: Path) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl(mock_run: Any) -> None:
-    n.repl("attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag=True)
+    n.repl("attr", m.BuildAttr("<nixpkgs/nixos>", None), {"nix_flag": True})
     mock_run.assert_called_with(
         ["nix", "repl", "--file", "<nixpkgs/nixos>", "--nix-flag"]
     )
@@ -482,7 +484,7 @@ def test_repl(mock_run: Any) -> None:
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl_flake(mock_run: Any) -> None:
-    n.repl_flake("attr", m.Flake(Path("flake.nix"), "myAttr"), nix_flag=True)
+    n.repl_flake("attr", m.Flake(Path("flake.nix"), "myAttr"), {"nix_flag": True})
     # See nixos-rebuild-ng.tests.repl for a better test,
     # this is mostly for sanity check
     assert mock_run.call_count == 1
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
index b1cd52e0b121..de573a2b55a2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
@@ -4,6 +4,7 @@ import nixos_rebuild.utils as u
 
 
 def test_dict_to_flags() -> None:
+    assert u.dict_to_flags(None) == []
     r1 = u.dict_to_flags(
         {
             "test_flag_1": True,
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index f531ea44bd8b..3adf8953bc38 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "opnborg";
-  version = "0.1.49";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     rev = "v${version}";
-    hash = "sha256-q6TwYTVDDNLc9iRFQT9oFtT6SyF1zlJbQ9JH+SRfiSc=";
+    hash = "sha256-HcQl5R+xzk5HUVBUecI7KsrCfz/WK80hZ4oCOSHOGs8=";
   };
 
   vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";
diff --git a/pkgs/by-name/ri/rip2/package.nix b/pkgs/by-name/ri/rip2/package.nix
index c14b829c510b..fcce093a2b23 100644
--- a/pkgs/by-name/ri/rip2/package.nix
+++ b/pkgs/by-name/ri/rip2/package.nix
@@ -5,6 +5,7 @@
   versionCheckHook,
   installShellFiles,
   stdenv,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,6 +37,8 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/rip completions zsh)
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Safe and ergonomic alternative to rm";
     homepage = "https://github.com/MilesCranmer/rip2";
diff --git a/pkgs/by-name/ru/ruff-lsp/package.nix b/pkgs/by-name/ru/ruff-lsp/package.nix
index 97b905e340c3..6214bb2d9332 100644
--- a/pkgs/by-name/ru/ruff-lsp/package.nix
+++ b/pkgs/by-name/ru/ruff-lsp/package.nix
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
     pytest-asyncio
     python-lsp-jsonrpc
-    ruff.bin
+    ruff
     versionCheckHook
   ];
   versionCheckProgramArg = [ "--version" ];
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index c9e2e78427f2..662b7409ec8e 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -1,11 +1,12 @@
 {
   lib,
   stdenv,
-  python3Packages,
-  fetchFromGitHub,
   rustPlatform,
+  fetchFromGitHub,
   installShellFiles,
+
   rust-jemalloc-sys,
+  buildPackages,
   versionCheckHook,
 
   # passthru
@@ -14,15 +15,9 @@
   nix-update-script,
 }:
 
-python3Packages.buildPythonPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "ruff";
   version = "0.8.4";
-  pyproject = true;
-
-  outputs = [
-    "bin"
-    "out"
-  ];
 
   src = fetchFromGitHub {
     owner = "astral-sh";
@@ -31,46 +26,29 @@ python3Packages.buildPythonPackage rec {
     hash = "sha256-c5d2XaoEjCHWMdjTLD6CnwP8rpSXTUrmKSs0QWQ6UG0=";
   };
 
-  # Do not rely on path lookup at runtime to find the ruff binary
-  postPatch = ''
-    substituteInPlace python/ruff/__main__.py \
-      --replace-fail \
-        'ruff_exe = "ruff" + sysconfig.get_config_var("EXE")' \
-        'return "${placeholder "bin"}/bin/ruff"'
-  '';
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-jbUjsIJRpkKYc+qHN8tkcZrcjPTFJfdCsatezzdX4Ss=";
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-jbUjsIJRpkKYc+qHN8tkcZrcjPTFJfdCsatezzdX4Ss=";
-  };
-
-  nativeBuildInputs =
-    [ installShellFiles ]
-    ++ (with rustPlatform; [
-      cargoSetupHook
-      maturinBuildHook
-      cargoCheckHook
-    ]);
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = [
     rust-jemalloc-sys
   ];
 
   postInstall =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
     ''
-      mkdir -p $bin/bin
-      mv $out/bin/ruff $bin/bin/
-      rmdir $out/bin
-    ''
-    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       installShellCompletion --cmd ruff \
-        --bash <($bin/bin/ruff generate-shell-completion bash) \
-        --fish <($bin/bin/ruff generate-shell-completion fish) \
-        --zsh <($bin/bin/ruff generate-shell-completion zsh)
+        --bash <(${emulator} $out/bin/ruff generate-shell-completion bash) \
+        --fish <(${emulator} $out/bin/ruff generate-shell-completion fish) \
+        --zsh <(${emulator} $out/bin/ruff generate-shell-completion zsh)
     '';
 
   # Run cargo tests
-  cargoCheckType = "debug";
+  checkType = "debug";
+
   # tests do not appear to respect linker options on doctests
   # Upstream issue: https://github.com/rust-lang/cargo/issues/14189
   # This causes errors like "error: linker `cc` not found" on static builds
@@ -106,12 +84,11 @@ python3Packages.buildPythonPackage rec {
     "--skip=unix::symlink_inside_workspace"
   ];
 
-  nativeCheckInputs = [
+  nativeInstallCheckInputs = [
     versionCheckHook
   ];
   versionCheckProgramArg = [ "--version" ];
-
-  pythonImportsCheck = [ "ruff" ];
+  doInstallCheck = true;
 
   passthru = {
     tests =
diff --git a/pkgs/by-name/sp/spice-gtk/package.nix b/pkgs/by-name/sp/spice-gtk/package.nix
index 182946d721bf..5dc9fa557a6b 100644
--- a/pkgs/by-name/sp/spice-gtk/package.nix
+++ b/pkgs/by-name/sp/spice-gtk/package.nix
@@ -155,17 +155,24 @@ stdenv.mkDerivation rec {
       "-Dcoroutine=gthread" # Fixes "Function missing:makecontext"
     ];
 
-  postPatch = ''
-    # get rid of absolute path to helper in store so we can use a setuid wrapper
-    substituteInPlace src/usb-acl-helper.c \
-      --replace 'ACL_HELPER_PATH"/' '"'
-    # don't try to setcap/suid in a nix builder
-    substituteInPlace src/meson.build \
-      --replace "meson.add_install_script('../build-aux/setcap-or-suid'," \
-      "# meson.add_install_script('../build-aux/setcap-or-suid',"
+  postPatch =
+    ''
+      # get rid of absolute path to helper in store so we can use a setuid wrapper
+      substituteInPlace src/usb-acl-helper.c \
+        --replace-fail 'ACL_HELPER_PATH"/' '"'
+      # don't try to setcap/suid in a nix builder
+      substituteInPlace src/meson.build \
+        --replace-fail "meson.add_install_script('../build-aux/setcap-or-suid'," \
+        "# meson.add_install_script('../build-aux/setcap-or-suid',"
 
-    patchShebangs subprojects/keycodemapdb/tools/keymap-gen
-  '';
+      patchShebangs subprojects/keycodemapdb/tools/keymap-gen
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # don't use version script and don't export symbols
+      substituteInPlace src/meson.build \
+        --replace-fail "spice_gtk_version_script = [" "# spice_gtk_version_script = [" \
+        --replace-fail ",--version-script=@0@'.format(spice_client_glib_syms_path)" "'"
+    '';
 
   meta = with lib; {
     description = "GTK 3 SPICE widget";
diff --git a/pkgs/by-name/ta/taschenrechner/package.nix b/pkgs/by-name/ta/taschenrechner/package.nix
index fa8d7170dd6f..48e8c181afaf 100644
--- a/pkgs/by-name/ta/taschenrechner/package.nix
+++ b/pkgs/by-name/ta/taschenrechner/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taschenrechner";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.fem-net.de";
     owner = "mabl";
     repo = "taschenrechner";
     rev = version;
-    hash = "sha256-5Vml6UeiWz7fNA+vEQ/Ita2YI8dGgDclqkzQ848AwVk=";
+    hash = "sha256-ZZVghL0R3p5sE8V9Z0MsmTiCacuE2RXohQQEYJYgp/o=";
   };
 
-  cargoHash = "sha256-BZGkdHR66O3GjKl9yM/bKxdGdvWFB/YO2Egg6V/wuB8=";
+  cargoHash = "sha256-xZ3Ki1HLzF7A1+83GQNTBgRjn802Z9ZAKENKB5CykCc=";
 
   meta = with lib; {
     description = "Cli-calculator written in Rust";
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 0b73c101ce79..ad6684023ca2 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.5.12";
+  version = "0.5.13";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = version;
-    hash = "sha256-opTZzNi9cguceD3qdWsIxAYbymu25wFFKOIGhWu958Q=";
+    hash = "sha256-W24bw+fQk7DoHPGFtUiIPybxuCa03o1ngAXqVwU/Z7E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hplzzsbS81GRS8L0Goh7vvzyv6xCAe0CN6KRvJ0GUdc=";
+  cargoHash = "sha256-CN4ZqYeZktcQT0Pro8rfnzri6i0xranmYdroKzwkK6A=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
index 80415ec8640d..97ee4c8ba8f1 100644
--- a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   strictDeps = true;
 
   meta = with lib; {
diff --git a/pkgs/desktops/lxde/core/lxsession/default.nix b/pkgs/desktops/lxde/core/lxsession/default.nix
index 74e49b6bb273..ab6b77429d9a 100644
--- a/pkgs/desktops/lxde/core/lxsession/default.nix
+++ b/pkgs/desktops/lxde/core/lxsession/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   autoconf,
   automake,
@@ -28,7 +29,17 @@ stdenv.mkDerivation rec {
     sha256 = "17sqsx57ymrimm5jfmcyrp7b0nzi41bcvpxsqckmwbhl19g6c17d";
   };
 
-  patches = [ ./xmlcatalog_patch.patch ];
+  patches = [
+    ./xmlcatalog_patch.patch
+
+    # lxsession compilation is broken upstream as of GCC 14
+    # https://sourceforge.net/p/lxde/bugs/973/
+    (fetchpatch {
+      name = "0001-Fix-build-on-GCC-14.patch";
+      url = "https://sourceforge.net/p/lxde/bugs/973/attachment/0001-Fix-build-on-GCC-14.patch";
+      hash = "sha256-lxF3HZy5uLK7Cfu8W1A03syZf7OWXpHiU2Fk+xBl39g=";
+    })
+  ];
 
   nativeBuildInputs = [
     autoconf
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index dc061e0da1ef..b81cbf65263a 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -38,7 +38,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gegl";
-  version = "0.4.50";
+  version = "0.4.52";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YISWmwbuhspxFCEzdz8n4T8C5aaiLCz85FLsqt23kME=";
+    hash = "sha256-yiEqD8PgRIxQWMUcpqDTD9+wKXHyHyiCDaK0kBOWAAo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/httpun-ws/lwt.nix b/pkgs/development/ocaml-modules/httpun-ws/lwt.nix
new file mode 100644
index 000000000000..e1f604d633cd
--- /dev/null
+++ b/pkgs/development/ocaml-modules/httpun-ws/lwt.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  buildDunePackage,
+  lwt,
+  digestif,
+  httpun-ws,
+  gluten-lwt,
+}:
+
+buildDunePackage {
+  pname = "httpun-ws-lwt";
+
+  inherit (httpun-ws) src version;
+
+  propagatedBuildInputs = [
+    httpun-ws
+    lwt
+    digestif
+    gluten-lwt
+  ];
+
+  doCheck = true;
+
+  meta = httpun-ws.meta // {
+    description = "Lwt support for httpun-ws";
+  };
+}
diff --git a/pkgs/development/python-modules/bloodyad/default.nix b/pkgs/development/python-modules/bloodyad/default.nix
index 34a601035813..5a37bd80e879 100644
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bloodyad";
-  version = "2.1.5";
+  version = "2.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "CravateRouge";
     repo = "bloodyAD";
     rev = "refs/tags/v${version}";
-    hash = "sha256-98Fm5c2BWRTuazVMM3v7s2ad5M0nOFQ+H+60whYhnDE=";
+    hash = "sha256-0BzVZ1aIjcq6D95hBjO+ahHaA48bmyaPAYHTAwQHaQg=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index d3d212926c55..e907a0daa7da 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "debugpy";
     tag = "v${version}";
-    hash = "sha256-jq/0Z6Oo/9gjJlziYJIjIC5i9YMayUdPYSGTjnDL8yU=";
+    hash = "sha256-C/cLUMQNmiLn3z93LOg++3WeDUihMR9O3XKouL4uPqw=";
   };
 
   patches =
diff --git a/pkgs/development/python-modules/pynordpool/default.nix b/pkgs/development/python-modules/pynordpool/default.nix
index 3b2f0d6b51a0..38246ac14072 100644
--- a/pkgs/development/python-modules/pynordpool/default.nix
+++ b/pkgs/development/python-modules/pynordpool/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pynordpool";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "gjohansson-ST";
     repo = "pynordpool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QNPq2KKUDgxf2VQ/O+/dywLY6RcHfU2RaC2sohjVmaI=";
+    hash = "sha256-OGCVNVFbJfhjNKKpLRUvZIj7ZIYz/IVlt9xEPJb5W8E=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/ruff/default.nix b/pkgs/development/python-modules/ruff/default.nix
new file mode 100644
index 000000000000..8f5efa9a240b
--- /dev/null
+++ b/pkgs/development/python-modules/ruff/default.nix
@@ -0,0 +1,35 @@
+{
+  buildPythonPackage,
+  pkgs,
+  rustPlatform,
+  installShellFiles,
+}:
+
+buildPythonPackage {
+  inherit (pkgs.ruff)
+    pname
+    version
+    src
+    cargoDeps
+    postInstall
+    meta
+    ;
+
+  # Do not rely on path lookup at runtime to find the ruff binary
+  postPatch = ''
+    substituteInPlace python/ruff/__main__.py \
+      --replace-fail \
+        'ruff_exe = "ruff" + sysconfig.get_config_var("EXE")' \
+        'return "${placeholder "out"}/bin/ruff"'
+  '';
+
+  pyproject = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "ruff" ];
+}
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 30c83cb86004..b3d177f36e9e 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1290";
+  version = "3.0.1291";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-sGIJKU3q+TGDMW6LWtbyiGq1wv1iFRQJ2MBtjK+zqqY=";
+    hash = "sha256-Kc+gnY1swnN2Rle/JHPJlopziYbCIFijRKVZx5Phs8w=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/profiling/heaptrack/default.nix b/pkgs/development/tools/profiling/heaptrack/default.nix
index 88de0065e8ec..43c4a28d9a7b 100644
--- a/pkgs/development/tools/profiling/heaptrack/default.nix
+++ b/pkgs/development/tools/profiling/heaptrack/default.nix
@@ -1,6 +1,6 @@
 {
-  lib, stdenv, mkDerivation, fetchFromGitHub, cmake, extra-cmake-modules, makeBinaryWrapper,
-  zlib, boost179, libunwind, elfutils, sparsehash, zstd,
+  lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch, cmake, extra-cmake-modules, makeBinaryWrapper,
+  zlib, boost, libunwind, elfutils, sparsehash, zstd,
   qtbase, kio, kitemmodels, threadweaver, kconfigwidgets, kcoreaddons, kdiagram
 }:
 
@@ -15,9 +15,17 @@ mkDerivation rec {
     hash = "sha256-pP+s60ERnmOctYTe/vezCg0VYzziApNY0QaF3aTccZU=";
   };
 
+  patches = [
+    # cmake: Fix C compatibility of libunwind probes
+    (fetchpatch {
+      url = "https://invent.kde.org/sdk/heaptrack/-/commit/c6c45f3455a652c38aefa402aece5dafa492e8ab.patch";
+      hash = "sha256-eou53UUQX+S7yrz2RS95GwkAnNIZY/aaze0eAdjnbPU=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules makeBinaryWrapper ];
   buildInputs = [
-    zlib boost179 libunwind sparsehash zstd
+    zlib boost libunwind sparsehash zstd
     qtbase kio kitemmodels threadweaver kconfigwidgets kcoreaddons kdiagram
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     elfutils
diff --git a/pkgs/development/tools/rust/cargo-cache/default.nix b/pkgs/development/tools/rust/cargo-cache/default.nix
index 7b8b60ad4125..2021101430d8 100644
--- a/pkgs/development/tools/rust/cargo-cache/default.nix
+++ b/pkgs/development/tools/rust/cargo-cache/default.nix
@@ -3,8 +3,7 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  libiconv,
-  Security,
+  zlib,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,8 +20,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-275QREIcncgBk4ah/CivSz5N2m6s/XPCfp6JGChpr38=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libiconv
-    Security
+    zlib
   ];
 
   checkFlags = [ "offline_tests" ];
diff --git a/pkgs/os-specific/linux/dmraid/default.nix b/pkgs/os-specific/linux/dmraid/default.nix
index ab366ad88ad5..78ccf00831e4 100644
--- a/pkgs/os-specific/linux/dmraid/default.nix
+++ b/pkgs/os-specific/linux/dmraid/default.nix
@@ -16,7 +16,10 @@ stdenv.mkDerivation rec {
   };
 
   patches =
-    [ ./hardening-format.patch ]
+    [
+      ./hardening-format.patch
+      ./fix-dmevent_tool.patch
+    ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [
       (fetchpatch {
         url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/006-musl-libc.patch";
diff --git a/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch b/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
new file mode 100644
index 000000000000..b7ef83cfa9b3
--- /dev/null
+++ b/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
@@ -0,0 +1,20 @@
+--- a/1.0.0.rc16/tools/dmevent_tool.c.old	2024-12-26 18:39:04.294039876 -0700
++++ a/1.0.0.rc16/tools/dmevent_tool.c	2024-12-26 18:45:59.416784807 -0700
+@@ -123,7 +123,7 @@
+ }
+ 
+ /* Increment option counters. */
+-static _process_opt(int opt, const char *cmd)
++static int _process_opt(int opt, const char *cmd)
+ {
+ 	struct opt_def_struct {
+ 		const char opt;		/* Option character. */
+@@ -148,7 +148,7 @@
+ 
+ 			optc[o->type]++;
+ 			optc[OPT_SUM]++;
+-			return;
++			return 0;
+ 		}
+ 	}
+ 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0137d3ef53e0..f241ea44244d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6807,9 +6807,7 @@ with pkgs;
   cargo-bazel = callPackage ../development/tools/rust/cargo-bazel {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-cache = callPackage ../development/tools/rust/cargo-cache {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-cache = callPackage ../development/tools/rust/cargo-cache { };
   cargo-crev = callPackage ../development/tools/rust/cargo-crev {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
   };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index fc43352ca173..1fbdad438f89 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -705,6 +705,7 @@ let
 
     httpun-ws = callPackage ../development/ocaml-modules/httpun-ws { };
 
+    httpun-ws-lwt = callPackage ../development/ocaml-modules/httpun-ws/lwt.nix { };
     hxd = callPackage ../development/ocaml-modules/hxd { };
 
     ### I ###
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2b6b5b20c50d..490fdd5174d0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14293,9 +14293,7 @@ self: super: with self; {
 
   rubymarshal = callPackage ../development/python-modules/rubymarshal { };
 
-  ruff = toPythonModule (pkgs.ruff.override {
-    python3Packages = self;
-  });
+  ruff = callPackage ../development/python-modules/ruff { };
 
   ruff-api = callPackage ../development/python-modules/ruff-api { };