diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5a4cdf6d0a39..5b5634a67887 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -254,6 +254,14 @@
     githubId = 3417013;
     name = "Eske Nielsen";
   };
+  _4r7if3x = {
+    email = "the.artifex@proton.me";
+    matrix = "@4r7if3x:matrix.org";
+    github = "4r7if3x";
+    githubId = 8606282;
+    name = "4r7if3x";
+    keys = [ { fingerprint = "013C ED4B E769 745A CFC3  0F3C F23C 2613 2266 7A12"; } ];
+  };
   _6543 = {
     email = "6543@obermui.de";
     github = "6543";
@@ -18098,6 +18106,13 @@
     github = "potb";
     githubId = 10779093;
   };
+  pouya = {
+    email = "me@pouyacode.net";
+    github = "pouya-abbassi";
+    githubId = 8519318;
+    name = "Pouya Abbasi";
+    keys = [ { fingerprint = "8CC7 EB15 3563 4205 E9C2  AAD9 AF5A 5A4A D4FD 8797"; } ];
+  };
   poweredbypie = {
     name = "poweredbypie";
     github = "poweredbypie";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 209655cc9925..295d3f100b03 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -87,6 +87,8 @@
 
 ## New Modules {#sec-release-24.11-new-modules}
 
+- [KMonad](https://github.com/kmonad/kmonad), an advanced keyboard remapping utility. Available as [services.kmonad](#opt-services.kmonad.enable).
+
 - [Coral](https://coral.ai/), hardware support for Coral.ai Edge TPU devices. Available as [hardware.coral.usb.enable](#opt-hardware.coral.usb.enable) and [hardware.coral.pcie.enable](#opt-hardware.coral.pcie.enable).
 
 - [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 39e75a30446e..5079ca741469 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -256,6 +256,9 @@
 
 - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is neccessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.
 
+- `siduck76-st` has been renamed to `st-snazzy`, like the project's [flake](https://github.com/siduck/st/blob/main/flake.nix).
+
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-25.05-notable-changes}
diff --git a/nixos/modules/services/networking/wireguard-networkd.nix b/nixos/modules/services/networking/wireguard-networkd.nix
index ad7de97f1e5a..60d86ee43bef 100644
--- a/nixos/modules/services/networking/wireguard-networkd.nix
+++ b/nixos/modules/services/networking/wireguard-networkd.nix
@@ -22,14 +22,16 @@ let
     ;
   inherit (lib.modules) mkIf;
   inherit (lib.options) literalExpression mkOption;
-  inherit (lib.strings) hasInfix;
+  inherit (lib.strings) hasInfix replaceStrings;
   inherit (lib.trivial) flip pipe;
 
   removeNulls = filterAttrs (_: v: v != null);
 
-  privateKeyCredential = interfaceName: "wireguard-${interfaceName}-private-key";
+  escapeCredentialName = input: replaceStrings [ "\\" ] [ "_" ] input;
+
+  privateKeyCredential = interfaceName: escapeCredentialName "wireguard-${interfaceName}-private-key";
   presharedKeyCredential =
-    interfaceName: peer: "wireguard-${interfaceName}-${peer.name}-preshared-key";
+    interfaceName: peer: escapeCredentialName "wireguard-${interfaceName}-${peer.name}-preshared-key";
 
   interfaceCredentials =
     interfaceName: interface:
@@ -61,7 +63,8 @@ let
     interfaceName: peer:
     removeNulls {
       PublicKey = peer.publicKey;
-      PresharedKey = "@${presharedKeyCredential interfaceName peer}";
+      PresharedKey =
+        if peer.presharedKeyFile == null then null else "@${presharedKeyCredential interfaceName peer}";
       AllowedIPs = peer.allowedIPs;
       Endpoint = peer.endpoint;
       PersistentKeepalive = peer.persistentKeepalive;
diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix
index 51c3156fef06..78efbcf7b1b2 100644
--- a/nixos/modules/services/web-apps/movim.nix
+++ b/nixos/modules/services/web-apps/movim.nix
@@ -60,16 +60,16 @@ let
       let
         appDir = "$out/share/php/${finalAttrs.pname}";
 
-        stateDirectories = ''
+        stateDirectories = /* sh */ ''
           # Symlinking in our state directories
-          rm -rf $out/.env $out/cache ${appDir}/public/cache
+          rm -rf $out/{.env,cache} ${appDir}/{log,public/cache}
           ln -s ${cfg.dataDir}/.env ${appDir}/.env
           ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
           ln -s ${cfg.logDir} ${appDir}/log
           ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
         '';
 
-        exposeComposer = ''
+        exposeComposer = /* sh */ ''
           # Expose PHP Composer for scripts
           mkdir -p $out/bin
           echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
@@ -85,10 +85,10 @@ let
                   # Disable all Admin panel options that were set in the
                   # `cfg.podConfig` to prevent confusing situtions where the
                   # values are rewritten on server reboot
-                  ''
-                    substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
-                      --replace-warn 'name="${k}"' 'name="${k}" readonly'
-                  '')
+                  /* sh */ ''
+                  substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
+                    --replace-warn 'name="${k}"' 'name="${k}" readonly'
+                '')
               [ ]
               cfg.podConfig));
 
@@ -101,7 +101,7 @@ let
                 [ "css" "ini" "js" "json" "manifest" "mjs" "svg" "webmanifest" ]);
           in
           lib.concatStringsSep "\n" [
-            (lib.optionalString brotli.enable ''
+            (lib.optionalString brotli.enable /* sh */ ''
               echo -n "Precompressing static files with Brotli …"
               find ${appDir}/public -type f ${findTextFileNames} -print0 \
                 | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
@@ -110,10 +110,10 @@ let
                   ''}
               echo " done."
             '')
-            (lib.optionalString gzip.enable ''
+            (lib.optionalString gzip.enable /* sh */ ''
               echo -n "Precompressing static files with Gzip …"
               find ${appDir}/public -type f ${findTextFileNames} -print0 \
-                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
+                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" ''
                     file="$1"
                     ${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} $file > $file.gz
                   ''}
@@ -440,6 +440,7 @@ in
           isSystemUser = true;
           group = cfg.group;
         };
+      } // lib.optionalAttrs (cfg.nginx != null) {
         "${config.services.nginx.user}".extraGroups = [ cfg.group ];
       };
       groups = {
@@ -483,99 +484,100 @@ in
         };
       };
 
-      nginx = mkIf (cfg.nginx != null) {
-        enable = true;
-        recommendedOptimisation = true;
-        recommendedGzipSettings = true;
-        recommendedBrotliSettings = true;
-        recommendedProxySettings = true;
-        # TODO: recommended cache options already in Nginx⁇
-        appendHttpConfig = /* nginx */ ''
-          fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
-          fastcgi_cache_key "$scheme$request_method$host$request_uri";
-        '';
-        virtualHosts."${cfg.domain}" = mkMerge [
-          cfg.nginx
-          {
-            root = lib.mkForce "${package}/share/php/movim/public";
-            locations = {
-              "/favicon.ico" = {
-                priority = 100;
-                extraConfig = /* nginx */ ''
-                  access_log off;
-                  log_not_found off;
-                '';
+      nginx = mkIf (cfg.nginx != null)
+        {
+          enable = true;
+          recommendedOptimisation = mkDefault true;
+          recommendedProxySettings = true;
+          # TODO: recommended cache options already in Nginx⁇
+          appendHttpConfig = /* nginx */ ''
+            fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
+            fastcgi_cache_key "$scheme$request_method$host$request_uri";
+          '';
+          virtualHosts."${cfg.domain}" = mkMerge [
+            cfg.nginx
+            {
+              root = lib.mkForce "${package}/share/php/movim/public";
+              locations = {
+                "/favicon.ico" = {
+                  priority = 100;
+                  extraConfig = /* nginx */ ''
+                    access_log off;
+                    log_not_found off;
+                  '';
+                };
+                "/robots.txt" = {
+                  priority = 100;
+                  extraConfig = /* nginx */ ''
+                    access_log off;
+                    log_not_found off;
+                  '';
+                };
+                "~ /\\.(?!well-known).*" = {
+                  priority = 210;
+                  extraConfig = /* nginx */ ''
+                    deny all;
+                  '';
+                };
+                # Ask nginx to cache every URL starting with "/picture"
+                "/picture" = {
+                  priority = 400;
+                  tryFiles = "$uri $uri/ /index.php$is_args$args";
+                  extraConfig = /* nginx */ ''
+                    set $no_cache 0; # Enable cache only there
+                  '';
+                };
+                "/" = {
+                  priority = 490;
+                  tryFiles = "$uri $uri/ /index.php$is_args$args";
+                  extraConfig = /* nginx */ ''
+                    # https://github.com/movim/movim/issues/314
+                    add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
+                    set $no_cache 1;
+                  '';
+                };
+                "~ \\.php$" = {
+                  priority = 500;
+                  tryFiles = "$uri =404";
+                  extraConfig = /* nginx */ ''
+                    include ${config.services.nginx.package}/conf/fastcgi.conf;
+                    add_header X-Cache $upstream_cache_status;
+                    fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
+                    fastcgi_cache nginx_cache;
+                    fastcgi_cache_valid any 7d;
+                    fastcgi_cache_bypass $no_cache;
+                    fastcgi_no_cache $no_cache;
+                    fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                    fastcgi_index index.php;
+                    fastcgi_pass unix:${fpm.socket};
+                  '';
+                };
+                "/ws/" = {
+                  priority = 900;
+                  proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/";
+                  proxyWebsockets = true;
+                  recommendedProxySettings = true;
+                  extraConfig = /* nginx */ ''
+                    proxy_set_header X-Forwarded-Proto $scheme;
+                    proxy_redirect off;
+                  '';
+                };
               };
-              "/robots.txt" = {
-                priority = 100;
-                extraConfig = /* nginx */ ''
-                  access_log off;
-                  log_not_found off;
-                '';
-              };
-              "~ /\\.(?!well-known).*" = {
-                priority = 210;
-                extraConfig = /* nginx */ ''
-                  deny all;
-                '';
-              };
-              # Ask nginx to cache every URL starting with "/picture"
-              "/picture" = {
-                priority = 400;
-                tryFiles = "$uri $uri/ /index.php$is_args$args";
-                extraConfig = /* nginx */ ''
-                  set $no_cache 0; # Enable cache only there
-                '';
-              };
-              "/" = {
-                priority = 490;
-                tryFiles = "$uri $uri/ /index.php$is_args$args";
-                extraConfig = /* nginx */ ''
-                  # https://github.com/movim/movim/issues/314
-                  add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
-                  set $no_cache 1;
-                '';
-              };
-              "~ \\.php$" = {
-                priority = 500;
-                tryFiles = "$uri =404";
-                extraConfig = /* nginx */ ''
-                  include ${config.services.nginx.package}/conf/fastcgi.conf;
-                  add_header X-Cache $upstream_cache_status;
-                  fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
-                  fastcgi_cache nginx_cache;
-                  fastcgi_cache_valid any 7d;
-                  fastcgi_cache_bypass $no_cache;
-                  fastcgi_no_cache $no_cache;
-                  fastcgi_split_path_info ^(.+\.php)(/.+)$;
-                  fastcgi_index index.php;
-                  fastcgi_pass unix:${fpm.socket};
-                '';
-              };
-              "/ws/" = {
-                priority = 900;
-                proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/";
-                proxyWebsockets = true;
-                recommendedProxySettings = true;
-                extraConfig = /* nginx */ ''
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_redirect off;
-                '';
-              };
-            };
-            extraConfig = /* ngnix */ ''
-              index index.php;
-            '';
-          }
-        ];
-      };
+              extraConfig = /* ngnix */ ''
+                index index.php;
+              '';
+            }
+          ];
+        }
+      // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) { recommendedGzipSettings = mkDefault true; }
+      // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) { recommendedBrotliSettings = mkDefault true; };
 
       mysql = mkIf (cfg.database.createLocally && cfg.database.type == "mysql") {
         enable = mkDefault true;
         package = mkDefault pkgs.mariadb;
         ensureDatabases = [ cfg.database.name ];
         ensureUsers = [{
-          name = cfg.user;
+          name = cfg.database.user;
           ensureDBOwnership = true;
         }];
       };
@@ -584,7 +586,7 @@ in
         enable = mkDefault true;
         ensureDatabases = [ cfg.database.name ];
         ensureUsers = [{
-          name = cfg.user;
+          name = cfg.database.user;
           ensureDBOwnership = true;
         }];
         authentication = ''
@@ -636,7 +638,7 @@ in
           LoadCredential = "env-secrets:${cfg.secretFile}";
         };
 
-        script = ''
+        script = /* sh */ ''
           # Env vars
           rm -f ${cfg.dataDir}/.env
           cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
diff --git a/nixos/tests/terminal-emulators.nix b/nixos/tests/terminal-emulators.nix
index 1affcbf3c8f7..3fc820d3ac8b 100644
--- a/nixos/tests/terminal-emulators.nix
+++ b/nixos/tests/terminal-emulators.nix
@@ -44,6 +44,8 @@ let
 
     germinal.pkg = p: p.germinal;
 
+    ghostty.pkg = p: p.ghostty;
+
     gnome-terminal.pkg = p: p.gnome-terminal;
 
     guake.pkg = p: p.guake;
diff --git a/nixos/tests/wireguard/dynamic-refresh.nix b/nixos/tests/wireguard/dynamic-refresh.nix
index e0af6bc025aa..2a8fb0598833 100644
--- a/nixos/tests/wireguard/dynamic-refresh.nix
+++ b/nixos/tests/wireguard/dynamic-refresh.nix
@@ -84,7 +84,10 @@ import ../make-test-python.nix (
       ''
         start_all()
 
+        server.systemctl("start network-online.target")
         server.wait_for_unit("network-online.target")
+
+        client.systemctl("start network-online.target")
         client.wait_for_unit("network-online.target")
 
         client.succeed("ping -n -w 1 -c 1 10.23.42.1")
diff --git a/nixos/tests/wireguard/networkd.nix b/nixos/tests/wireguard/networkd.nix
index beaba5a4343a..20305bc2ab12 100644
--- a/nixos/tests/wireguard/networkd.nix
+++ b/nixos/tests/wireguard/networkd.nix
@@ -39,6 +39,9 @@ import ../make-test-python.nix (
                 "fc00::2/128"
               ];
 
+              # !!! Don't do this with real keys. The /nix store is world-readable!
+              presharedKeyFile = toString (pkgs.writeText "presharedKey" wg-snakeoil-keys.presharedKey);
+
               inherit (wg-snakeoil-keys.peer1) publicKey;
             };
           };
@@ -69,6 +72,9 @@ import ../make-test-python.nix (
               endpoint = "192.168.0.1:23542";
               persistentKeepalive = 25;
 
+              # !!! Don't do this with real keys. The /nix store is world-readable!
+              presharedKeyFile = toString (pkgs.writeText "presharedKey" wg-snakeoil-keys.presharedKey);
+
               inherit (wg-snakeoil-keys.peer0) publicKey;
             };
           };
@@ -79,11 +85,18 @@ import ../make-test-python.nix (
     testScript = ''
       start_all()
 
-      peer0.wait_for_unit("systemd-networkd-wait-online.service")
-      peer1.wait_for_unit("systemd-networkd-wait-online.service")
+      peer0.systemctl("start network-online.target")
+      peer0.wait_for_unit("network-online.target")
+
+      peer1.systemctl("start network-online.target")
+      peer1.wait_for_unit("network-online.target")
 
       peer1.succeed("ping -c5 fc00::1")
       peer1.succeed("ping -c5 10.23.42.1")
+
+      with subtest("Has PSK set"):
+        peer0.succeed("wg | grep 'preshared key'")
+        peer1.succeed("wg | grep 'preshared key'")
     '';
   }
 )
diff --git a/nixos/tests/wireguard/snakeoil-keys.nix b/nixos/tests/wireguard/snakeoil-keys.nix
index c979f0e0c8a9..2b51abe53f1e 100644
--- a/nixos/tests/wireguard/snakeoil-keys.nix
+++ b/nixos/tests/wireguard/snakeoil-keys.nix
@@ -1,4 +1,6 @@
 {
+  presharedKey = "7myEJlGAWLTg83y7Py29pp7REQBVmZfI4xcawjcZpjg=";
+
   peer0 = {
     privateKey = "OPuVRS2T0/AtHDp3PXkNuLQYDiqJaBEEnYe42BSnJnQ=";
     publicKey = "IujkG119YPr2cVQzJkSLYCdjpHIDjvr/qH1w1tdKswY=";
diff --git a/pkgs/applications/audio/qpwgraph/default.nix b/pkgs/applications/audio/qpwgraph/default.nix
index 32d254f6d69d..76261c239ba9 100644
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jB2mMLwJ1e/fIsf1R9Wd0stwp/RQH6f9pkF1qQX72Aw=";
+    sha256 = "sha256-yvPV3Npne9oFvA6X49/aMgn7DrN2gCrPha3lJVKwcQ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
index 508d2ce2c5a4..e630b5c674d0 100644
--- a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
@@ -5,7 +5,7 @@
   callPackage,
 }:
 let
-  version = "1.58.0";
+  version = "1.60.0";
   rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
     if stdenv.hostPlatform.isLinux then
@@ -21,7 +21,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     name = "rescript-vscode";
     publisher = "chenglou92";
     inherit version;
-    hash = "sha256-EuEBbtdCaS4l8ykkxyLLMjEnUMs0IsXoc994a8Pw1Ws=";
+    hash = "sha256-1jdjSxho7TRADAxs4ccLw7Ea430f+L5aBlLDlUwvXHk=";
   };
   postPatch = ''
     rm -r ${analysisDir}
diff --git a/pkgs/applications/science/electronics/nanovna-saver/default.nix b/pkgs/applications/science/electronics/nanovna-saver/default.nix
index 03693b69ed4c..171e7ac5103a 100644
--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@@ -7,13 +7,13 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "nanovna-saver";
-  version = "0.6.5";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "NanoVNA-Saver";
     repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-YoIVYK787okl7XHj+nue38RheC4n+tchJLNbld/qdbU=";
+    tag = "v${version}";
+    sha256 = "sha256-XGm3y0C0bFqKbh2ImbYTKOKSYFJ728mE/1N78/WPJqo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/terminal-emulators/st/siduck76-st.nix b/pkgs/applications/terminal-emulators/st/siduck76-st.nix
deleted file mode 100644
index d981ba481e59..000000000000
--- a/pkgs/applications/terminal-emulators/st/siduck76-st.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fontconfig,
-  harfbuzz,
-  libX11,
-  libXext,
-  libXft,
-  ncurses,
-  pkg-config,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "siduck76-st";
-  version = "0.pre+unstable=2021-08-20";
-
-  src = fetchFromGitHub {
-    owner = "siduck76";
-    repo = "st";
-    rev = "c9bda1de1f3f94ba507fa0eacc96d6a4f338637f";
-    hash = "sha256-5n+QkSlVhhku7adtl7TuWhDl3zdwFaXc7Ot1RaIN54A=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-  buildInputs = [
-    fontconfig
-    harfbuzz
-    libX11
-    libXext
-    libXft
-    ncurses
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    TERMINFO=$out/share/terminfo make install PREFIX=$out
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/siduck76/st";
-    description = "Fork of st with many add-ons";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/ai/air/package.nix b/pkgs/by-name/ai/air/package.nix
index e690b06273b8..2a1dba853365 100644
--- a/pkgs/by-name/ai/air/package.nix
+++ b/pkgs/by-name/ai/air/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "air";
-  version = "1.61.4";
+  version = "1.61.5";
 
   src = fetchFromGitHub {
     owner = "air-verse";
     repo = "air";
     rev = "v${version}";
-    hash = "sha256-ML+rdjD20gR8ajyZSs8HEgy1kOFh/MnpnZetQUuZRo0=";
+    hash = "sha256-QKNXEIMsw3MCfPg3Er9r3ncN6dxI2UsD7G/FcBIrP+Y=";
   };
 
   vendorHash = "sha256-tct0bWTvZhHslqPAe8uOwBx4z6gLAq57igcbV1tg9OU=";
diff --git a/pkgs/by-name/ar/arc_unpacker/package.nix b/pkgs/by-name/ar/arc_unpacker/package.nix
index a4ccc53567dc..e11506a976c6 100644
--- a/pkgs/by-name/ar/arc_unpacker/package.nix
+++ b/pkgs/by-name/ar/arc_unpacker/package.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation {
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
     sed '1i#include <limits>' -i src/dec/eagls/pak_archive_decoder.cc # gcc12
+    sed '1i#include <vector>' -i src/flow/cli_facade.h # gcc14
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-semver-checks/package.nix b/pkgs/by-name/ca/cargo-semver-checks/package.nix
index b01afc4e4bd3..f9bf755ec48c 100644
--- a/pkgs/by-name/ca/cargo-semver-checks/package.nix
+++ b/pkgs/by-name/ca/cargo-semver-checks/package.nix
@@ -6,21 +6,23 @@
   zlib,
   stdenv,
   darwin,
-  git,
+  testers,
+  cargo-semver-checks,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.34.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-U7ykTLEuREe2GTVswcAw3R3h4zbkWxuI2dt/2689xSA=";
+    tag = "v${version}";
+    hash = "sha256-IcKjiKFvkFvu8+LFCAmm39AGUaUdK8zhtNzzSb8VPE0=";
   };
 
-  cargoHash = "sha256-NoxYHwY5XpRiqrOjQsaSWQCXFalNAS9SchaKwHbB2uU=";
+  cargoHash = "sha256-QfJ7QnGKmbrGDwYtVyAJNNGoAukD97/tmCwAROvWBIg=";
 
   nativeBuildInputs = [
     cmake
@@ -37,27 +39,37 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # requires internet access
     "--skip=detects_target_dependencies"
+    "--skip=query::tests_lints::feature_missing"
   ];
 
   preCheck = ''
+    # requires internet access
+    rm -r test_crates/feature_missing
+
     patchShebangs scripts/regenerate_test_rustdocs.sh
-    substituteInPlace scripts/regenerate_test_rustdocs.sh \
-      --replace-fail \
-        'TOPLEVEL="$(git rev-parse --show-toplevel)"' \
-        "TOPLEVEL=$PWD"
     scripts/regenerate_test_rustdocs.sh
+
+    substituteInPlace test_outputs/integration_snapshots__bugreport.snap \
+      --replace-fail \
+        'cargo-semver-checks [VERSION] ([HASH])' \
+        'cargo-semver-checks ${version}'
   '';
 
-  meta = with lib; {
+  passthru = {
+    tests.version = testers.testVersion { package = cargo-semver-checks; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Tool to scan your Rust crate for semver violations";
     mainProgram = "cargo-semver-checks";
     homepage = "https://github.com/obi1kenobi/cargo-semver-checks";
     changelog = "https://github.com/obi1kenobi/cargo-semver-checks/releases/tag/v${version}";
-    license = with licenses; [
+    license = with lib.licenses; [
       mit # or
       asl20
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       figsoda
       matthiasbeyer
     ];
diff --git a/pkgs/by-name/ca/catimg/package.nix b/pkgs/by-name/ca/catimg/package.nix
index 8bc3ba1f8750..32d92fa65846 100644
--- a/pkgs/by-name/ca/catimg/package.nix
+++ b/pkgs/by-name/ca/catimg/package.nix
@@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
+  env = lib.optionalAttrs (stdenv.hostPlatform.libc == "glibc") {
+    CFLAGS = "-D_DEFAULT_SOURCE";
+  };
 
   meta = with lib; {
     license = licenses.mit;
diff --git a/pkgs/by-name/ch/changedetection-io/package.nix b/pkgs/by-name/ch/changedetection-io/package.nix
index 797c6096e2d0..390f4079216b 100644
--- a/pkgs/by-name/ch/changedetection-io/package.nix
+++ b/pkgs/by-name/ch/changedetection-io/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.48.01";
+  version = "0.48.05";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
     tag = version;
-    hash = "sha256-iUg6AzI92t8tZGX9LXkU1n8Q94qm/F7xWwsCMkClBnw=";
+    hash = "sha256-oOuHPOvs3qcQcibKyChe2AK1OB3JK/xRKUp1cj5p5PU=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index d73b0b1ad000..984d459ec3f0 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2024-12-16";
+  version = "0.4.0-unstable-2024-12-17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "48c33155d141e0444dd4a73e069422c8a25d51b4";
-    hash = "sha256-6FKzdf4GS0XpA5HUIAqdrBaeslOrNhaZqpHMRIagkpI=";
+    rev = "605037deb68994bbb3114c2a35db7a7a7e4755a6";
+    hash = "sha256-5AwoXX5Qa4ROjt5wSdcElLJ7ZVguKK3urn0ygVDJiGQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cuneiform/gcc14-fix.patch b/pkgs/by-name/cu/cuneiform/gcc14-fix.patch
new file mode 100644
index 000000000000..027d028f36bc
--- /dev/null
+++ b/pkgs/by-name/cu/cuneiform/gcc14-fix.patch
@@ -0,0 +1,170 @@
+diff --git a/cuneiform_src/Kern/ctb/src/ctb_oper.c b/cuneiform_src/Kern/ctb/src/ctb_oper.c
+index 2aedd58..3d7ec65 100644
+--- a/cuneiform_src/Kern/ctb/src/ctb_oper.c
++++ b/cuneiform_src/Kern/ctb/src/ctb_oper.c
+@@ -61,6 +61,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ #define MAXPATH 256
+ #include<string.h>
+ #include<sys/stat.h>
++#include<ctype.h>
+ #include "ctb.h"
+ 
+ /// extern fuxntions and data
+diff --git a/cuneiform_src/Kern/dif/src/diffr.c b/cuneiform_src/Kern/dif/src/diffr.c
+index f0d89db..7d0d898 100644
+--- a/cuneiform_src/Kern/dif/src/diffr.c
++++ b/cuneiform_src/Kern/dif/src/diffr.c
+@@ -105,7 +105,7 @@ extern uchar BUFFER[256];        /* 
+ extern uchar LOCAL[50];          /* ���न����     ���             */
+ extern uchar LOCAL_W[50];        /* �ਭ�         ���             */
+ extern uchar end1,beg2;          /* ����� 1 � ��砫� 2-�� ��� ���  */
+-extern broken_ii;		/* 䫠� ���� �����			*/
++extern uchar broken_ii;		/* 䫠� ���� �����			*/
+ extern int16_t dnri_hook; // bottom right hook in small russian italic II,III
+ extern int16_t uple_hook; // bottom left  hook in small russian italic II,III
+ extern int16_t up_jack  ; // upper jack
+diff --git a/cuneiform_src/Kern/hdebug/__snp.c b/cuneiform_src/Kern/hdebug/__snp.c
+index cbf3353..8682cb1 100644
+--- a/cuneiform_src/Kern/hdebug/__snp.c
++++ b/cuneiform_src/Kern/hdebug/__snp.c
+@@ -986,11 +986,11 @@ extern "C" {
+ 	void SnpDrawLine(Point16* start, Point16* end, int32_t skew,
+ 			uint32_t rgb_color, int16_t pen_width, Handle key )
+ 	{
+-		LDPUMA_DrawLine(NULL,start,end,skew,rgb_color,pen_width,key );
++		LDPUMA_DrawLine(NULL,start,end,skew,rgb_color,pen_width,(long int)key );
+ 	};
+ 	void SnpHideLines(Handle key)
+ 	{
+-		LDPUMA_DeleteLines(NULL,key);
++		LDPUMA_DeleteLines(NULL,(long int)key);
+ 	};
+ 	void SnpUpdateViews(void)
+ 	{
+diff --git a/cuneiform_src/Kern/leo/src/leo_dll.c b/cuneiform_src/Kern/leo/src/leo_dll.c
+index da09092..25bc167 100644
+--- a/cuneiform_src/Kern/leo/src/leo_dll.c
++++ b/cuneiform_src/Kern/leo/src/leo_dll.c
+@@ -60,6 +60,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ #include <ctype.h>
+ /*#include <io.h>*/
+ 
++#include "cfcompat.h"
+ #include "leo_tune.h"
+ #include "cpu.h"
+ #define PC_TYPE 0
+diff --git a/cuneiform_src/Kern/loc/src/loc.c b/cuneiform_src/Kern/loc/src/loc.c
+index e416b33..4b817ad 100644
+--- a/cuneiform_src/Kern/loc/src/loc.c
++++ b/cuneiform_src/Kern/loc/src/loc.c
+@@ -63,6 +63,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ #include <unistd.h>
+ #endif
+ #include "loc.h"
++#include "cfcompat.h"
+ #include "struct.h"
+ #include <sys/stat.h>
+ 
+diff --git a/cuneiform_src/Kern/rbal/src/linbam.c b/cuneiform_src/Kern/rbal/src/linbam.c
+index cd34fab..a0a93d6 100644
+--- a/cuneiform_src/Kern/rbal/src/linbam.c
++++ b/cuneiform_src/Kern/rbal/src/linbam.c
+@@ -65,7 +65,7 @@
+ #include "lang_def.h"	// 08.09.2000 E.P.
+ #include "minmax.h"
+ 
+-extern line_BL;
++extern Bool line_BL;
+ extern CSTR_line lin_str;
+ 
+ static void set_basint(void);
+diff --git a/cuneiform_src/Kern/rblock/sources/c/ltmain.c b/cuneiform_src/Kern/rblock/sources/c/ltmain.c
+index 0653b6b..1c99b28 100644
+--- a/cuneiform_src/Kern/rblock/sources/c/ltmain.c
++++ b/cuneiform_src/Kern/rblock/sources/c/ltmain.c
+@@ -583,7 +583,7 @@ void PageStrings2 (void)
+ 
+ void LayoutPart1 (void)
+ {
+-extern SheetsCorrectRoots();
++// extern SheetsCorrectRoots();
+ # ifdef LT_DEBUG
+     switch (layout)
+     {
+diff --git a/cuneiform_src/Kern/rblock/sources/c/ltroots.c b/cuneiform_src/Kern/rblock/sources/c/ltroots.c
+index e68abd5..7efee82 100644
+--- a/cuneiform_src/Kern/rblock/sources/c/ltroots.c
++++ b/cuneiform_src/Kern/rblock/sources/c/ltroots.c
+@@ -69,6 +69,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ 
+ # include <fcntl.h>
+ # include <stdio.h>
++# include <unistd.h>
+ /*# include <crtdbg.h>*/
+ #include <assert.h>
+ 
+@@ -126,7 +127,7 @@ Bool RootsLoadFile (char * pFilename)
+         return (FALSE);
+     }
+ 
+-    while (read (hFile, &RootRecord, sizeof (ROOT)) == sizeof (ROOT))
++    while (read ((int)hFile, &RootRecord, sizeof (ROOT)) == sizeof (ROOT))
+     {
+         RootRecord.bReached   = FALSE;
+ 
+@@ -143,14 +144,14 @@ Bool RootsLoadFile (char * pFilename)
+         {
+             ErrorNoEnoughMemory ("in LTROOTS.C,RootsLoadFile,part 1");
+             nRoots = 0;
+-            close (hFile);
++            close ((int)hFile);
+             return (FALSE);
+         }
+ 
+         pRoots [nRoots - 1] = RootRecord;
+     }
+ 
+-    close (hFile);
++    close ((int)hFile);
+     return (TRUE);
+ }
+ # endif
+diff --git a/cuneiform_src/Kern/rstr/src/diffr.c b/cuneiform_src/Kern/rstr/src/diffr.c
+index 3427806..c4ad6aa 100644
+--- a/cuneiform_src/Kern/rstr/src/diffr.c
++++ b/cuneiform_src/Kern/rstr/src/diffr.c
+@@ -168,7 +168,7 @@ extern uchar BUFFER[256];        /* 
+ extern uchar LOCAL[50];        	/* ���न����     ���          		*/
+ extern uchar LOCAL_W[50];      	/* �ਭ�         ���          		*/
+ extern uchar end1,beg2;        	/* ����� 1 � ��砫� 2-�� ��� ���	*/
+-extern broken_ii;		/* 䫠� ���� �����			*/
++extern uchar broken_ii;		/* 䫠� ���� �����			*/
+ extern int16_t dnri_hook; // bottom right hook in small russian italic II,III
+ extern int16_t uple_hook; // bottom left  hook in small russian italic II,III
+ extern int16_t up_jack  ; // upper jack
+diff --git a/cuneiform_src/Kern/rstr/src/match_wd.c b/cuneiform_src/Kern/rstr/src/match_wd.c
+index 7a8c7f5..ca5f933 100644
+--- a/cuneiform_src/Kern/rstr/src/match_wd.c
++++ b/cuneiform_src/Kern/rstr/src/match_wd.c
+@@ -341,7 +341,7 @@ param.monitors=*((uint32_t*)points);
+ param.p2_active=1;  //call while p2 pass
+ param.language=3;	// LANG_RUSSIAN
+ 
+-if((rc=setjmp(Control_Point())) != 0)
++if((rc=setjmp(*Control_Point())) != 0)
+   return FALSE;
+ 
+ w=match_string(ln, word, &param);
+diff --git a/cuneiform_src/Kern/rstr/src/rcm.c b/cuneiform_src/Kern/rstr/src/rcm.c
+index 0659b69..45cf362 100644
+--- a/cuneiform_src/Kern/rstr/src/rcm.c
++++ b/cuneiform_src/Kern/rstr/src/rcm.c
+@@ -2648,7 +2648,7 @@ int16_t text_findstat_agressive(char * w) {
+ }
+ 
+ jmp_buf * Control_Point() {
+-	return jumper;
++	return &jumper;
+ }
+ 
+ /////////////
diff --git a/pkgs/by-name/cu/cuneiform/package.nix b/pkgs/by-name/cu/cuneiform/package.nix
index f6d977297f90..2a677a51923b 100644
--- a/pkgs/by-name/cu/cuneiform/package.nix
+++ b/pkgs/by-name/cu/cuneiform/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-text/cuneiform/files/cuneiform-1.1.0-gcc11.patch?id=fd8e596c6a5eab634656e265c3da5241f5ceee8c";
       sha256 = "14bp2f4dvlgxnpdza1rgszhkbxhp6p7lhgnb1s7c1x7vwdrx0ri7";
     })
+    ./gcc14-fix.patch
   ];
 
   # Workaround build failure on -fno-common toolchains like upstream
diff --git a/pkgs/by-name/de/deskflow/package.nix b/pkgs/by-name/de/deskflow/package.nix
index 222396e3240e..116a3fff8845 100644
--- a/pkgs/by-name/de/deskflow/package.nix
+++ b/pkgs/by-name/de/deskflow/package.nix
@@ -32,20 +32,22 @@
 }:
 stdenv.mkDerivation rec {
   pname = "deskflow";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "deskflow";
     repo = "deskflow";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-CHlvL/MC9clFrMxlfIXaCFoTkcLS7QsYK7MXMFW0188=";
+    tag = "v${version}";
+    hash = "sha256-FdpDaJ+pphy2+8prlKst0DjmdbcZOmNp+lKN5xdnvC8=";
   };
 
   postPatch = ''
     substituteInPlace src/lib/deskflow/unix/AppUtilUnix.cpp \
       --replace-fail "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboard_config}/share/X11/xkb/rules/evdev.xml"
     substituteInPlace src/lib/gui/tls/TlsCertificate.cpp \
-      --replace-fail "\"openssl\"" "\"${lib.getBin openssl}/bin/openssl\""
+      --replace-fail '"openssl"' '"${lib.getBin openssl}/bin/openssl"'
+    substituteInPlace deploy/linux/deploy.cmake \
+      --replace-fail 'message(FATAL_ERROR "Unable to read file /etc/os-release")' 'set(RELEASE_FILE_CONTENTS "")'
   '';
 
   nativeBuildInputs = [
@@ -114,5 +116,9 @@ stdenv.mkDerivation rec {
       licenses.openssl
     ];
     platforms = lib.platforms.linux;
+    knownVulnerabilities = [
+      "CVE-2021-42072"
+      "CVE-2021-42073"
+    ];
   };
 }
diff --git a/pkgs/by-name/di/distant/package.nix b/pkgs/by-name/di/distant/package.nix
new file mode 100644
index 000000000000..f9e1f8947b03
--- /dev/null
+++ b/pkgs/by-name/di/distant/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  zlib,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "distant";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "chipsenkbeil";
+    repo = "distant";
+    tag = "v${version}";
+    hash = "sha256-DcnleJUAeYg3GSLZljC3gO9ihiFz04dzT/ddMnypr48=";
+  };
+
+  cargoHash = "sha256-7MNNdm4b9u5YNX04nBtKcrw+phUlpzIXo0tJVfcgb40=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    zlib
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  checkFlags =
+    [
+      # Requires network access:
+      # failed to lookup address information: Temporary failure in name resolution
+      "--skip=options::common::address::tests::resolve_should_properly_resolve_bind_address"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Timeout on darwin
+      # Custom { kind: TimedOut, error: "" }
+      "--skip=cli::api::watch::should_support_json_reporting_changes_using_correct_request_id"
+      "--skip=cli::api::watch::should_support_json_watching_directory_recursively"
+      "--skip=cli::api::watch::should_support_json_watching_single_file"
+      "--skip=cli::client::fs_watch::should_support_watching_a_directory_recursively"
+      "--skip=cli::client::fs_watch::should_support_watching_a_single_file"
+    ];
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Library and tooling that supports remote filesystem and process operations";
+    homepage = "https://github.com/chipsenkbeil/distant";
+    changelog = "https://github.com/chipsenkbeil/distant/blob/${version}/CHANGELOG.md";
+    # From the README:
+    # "This project is licensed under either of Apache License, Version 2.0, MIT license at your option."
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "distant";
+  };
+}
diff --git a/pkgs/by-name/du/duplicati/package.nix b/pkgs/by-name/du/duplicati/package.nix
index 83b32d450dd6..aaef3d602b0d 100644
--- a/pkgs/by-name/du/duplicati/package.nix
+++ b/pkgs/by-name/du/duplicati/package.nix
@@ -7,14 +7,16 @@
   makeWrapper,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "duplicati";
-  version = "2.0.8.1";
+  version = "2.1.0.2";
   channel = "beta";
-  build_date = "2024-05-07";
+  build_date = "2024-11-29";
 
   src = fetchzip {
-    url = "https://github.com/duplicati/duplicati/releases/download/v${version}-${version}_${channel}_${build_date}/duplicati-${version}_${channel}_${build_date}.zip";
+    url =
+      with finalAttrs;
+      "https://github.com/duplicati/duplicati/releases/download/v${version}-${version}_${channel}_${build_date}/duplicati-${version}_${channel}_${build_date}.zip";
     hash = "sha256-LmW6yGutxP33ghFqyOLKrGDNCQdr8DDFn/IHigsLpzA=";
     stripRoot = false;
   };
@@ -22,17 +24,17 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
-    mkdir -p $out/{bin,share/${pname}-${version}}
-    cp -r * $out/share/${pname}-${version}
-    makeWrapper "${mono}/bin/mono" $out/bin/duplicati-cli \
-      --add-flags "$out/share/${pname}-${version}/Duplicati.CommandLine.exe" \
+    mkdir -p $out/{bin,share/duplicati-${finalAttrs.version}}
+    cp -r * $out/share/duplicati-${finalAttrs.version}
+    makeWrapper "${lib.getExe mono}" $out/bin/duplicati-cli \
+      --add-flags "$out/share/duplicati-${finalAttrs.version}/Duplicati.CommandLine.exe" \
       --prefix LD_LIBRARY_PATH : ${
         lib.makeLibraryPath [
           sqlite
         ]
       }
-    makeWrapper "${mono}/bin/mono" $out/bin/duplicati-server \
-      --add-flags "$out/share/${pname}-${version}/Duplicati.Server.exe" \
+    makeWrapper "${lib.getExe mono}" $out/bin/duplicati-server \
+      --add-flags "$out/share/duplicati-${finalAttrs.version}/Duplicati.Server.exe" \
       --prefix LD_LIBRARY_PATH : ${
         lib.makeLibraryPath [
           sqlite
@@ -40,15 +42,15 @@ stdenv.mkDerivation rec {
       }
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Free backup client that securely stores encrypted, incremental, compressed backups on cloud storage services and remote file servers";
     homepage = "https://www.duplicati.com/";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [
+    license = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [
       nyanloutre
       bot-wxt1221
     ];
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    platforms = platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index a6922d67037b..5deaeefbf88a 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.168";
+  version = "0.0.170";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-Pnx+eC2JSs0BSN6cXD44hjY9LM9EmUf7bZNfiJOIRJU=";
+    hash = "sha256-8ljzf/opZnZMOcXi5IBMiS2KYlvIjrtSq/Aee2/IUdU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gh/ghostty/package.nix b/pkgs/by-name/gh/ghostty/package.nix
index cbafd16ba362..dc5e936d2e14 100644
--- a/pkgs/by-name/gh/ghostty/package.nix
+++ b/pkgs/by-name/gh/ghostty/package.nix
@@ -1,44 +1,59 @@
 {
+  lib,
+  stdenv,
   bzip2,
   callPackage,
-  expat,
   fetchFromGitHub,
   fontconfig,
   freetype,
   glib,
   glslang,
   harfbuzz,
-  lib,
-  libadwaita,
   libGL,
-  libpng,
   libX11,
-  libXcursor,
-  libXi,
-  libXrandr,
+  libadwaita,
   ncurses,
   nixosTests,
   oniguruma,
   pandoc,
   pkg-config,
   removeReferencesTo,
-  stdenv,
   versionCheckHook,
   wrapGAppsHook4,
   zig_0_13,
-  zlib,
+  # Usually you would override `zig.hook` with this, but we do that internally
+  # since upstream recommends a non-default level
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/PACKAGING.md#build-options
+  optimizeLevel ? "ReleaseFast",
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/build.zig#L106
+  withAdwaita ? true,
 }:
+
 let
-  # Ghostty needs to be built with --release=fast, --release=debug and
-  # --release=safe enable too many runtime safety checks.
   zig_hook = zig_0_13.hook.overrideAttrs {
-    zig_default_flags = "-Dcpu=baseline -Doptimize=ReleaseFast --color off";
+    zig_default_flags = "-Dcpu=baseline -Doptimize=${optimizeLevel} --color off";
   };
+
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/apprt.zig#L72-L76
+  appRuntime = if stdenv.hostPlatform.isLinux then "gtk" else "none";
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/font/main.zig#L94
+  fontBackend = if stdenv.hostPlatform.isDarwin then "coretext" else "fontconfig_freetype";
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/renderer.zig#L51-L52
+  renderer = if stdenv.hostPlatform.isDarwin then "metal" else "opengl";
 in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostty";
   version = "1.0.0";
 
+  outputs = [
+    "out"
+    "man"
+    "shell_integration"
+    "terminfo"
+    "vim"
+  ];
+
   src = fetchFromGitHub {
     owner = "ghostty-org";
     repo = "ghostty";
@@ -46,50 +61,56 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-AHI1Z4mfgXkNwQA8xYq4tS0/BARbHL7gQUT41vCxQTM=";
   };
 
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    glib # Required for `glib-compile-schemas`
-    ncurses
-    pandoc
-    pkg-config
-    removeReferencesTo
-    wrapGAppsHook4
-    zig_hook
-  ];
-
-  buildInputs = [
-    bzip2
-    expat
-    fontconfig
-    freetype
-    glslang
-    harfbuzz
-    libadwaita
-    libGL
-    libpng
-    libX11
-    libXcursor
-    libXi
-    libXrandr
-    oniguruma
-    zlib
-  ];
-
-  dontConfigure = true;
-  # doCheck is set to false because unit tests currently fail inside the Nix sandbox.
-  doCheck = false;
-  doInstallCheck = true;
+  # Avoid using runtime hacks to help find X11
+  postPatch = lib.optionalString (appRuntime == "gtk") ''
+    substituteInPlace src/apprt/gtk/x11.zig \
+      --replace-warn 'std.DynLib.open("libX11.so");' 'std.DynLib.open("${lib.getLib libX11}/lib/libX11.so");'
+  '';
 
   deps = callPackage ./deps.nix {
     name = "${finalAttrs.pname}-cache-${finalAttrs.version}";
   };
 
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      ncurses
+      pandoc
+      pkg-config
+      removeReferencesTo
+      zig_hook
+    ]
+    ++ lib.optionals (appRuntime == "gtk") [
+      glib # Required for `glib-compile-schemas`
+      wrapGAppsHook4
+    ];
+
+  buildInputs =
+    [
+      glslang
+      oniguruma
+    ]
+    ++ lib.optional (appRuntime == "gtk" && withAdwaita) libadwaita
+    ++ lib.optional (appRuntime == "gtk") libX11
+    ++ lib.optional (renderer == "opengl") libGL
+    ++ lib.optionals (fontBackend == "fontconfig_freetype") [
+      bzip2
+      fontconfig
+      freetype
+      harfbuzz
+    ];
+
   zigBuildFlags =
     [
       "--system"
       "${finalAttrs.deps}"
       "-Dversion-string=${finalAttrs.version}"
+
+      "-Dapp-runtime=${appRuntime}"
+      "-Dfont-backend=${fontBackend}"
+      "-Dgtk-adwaita=${lib.boolToString withAdwaita}"
+      "-Drenderer=${renderer}"
     ]
     ++ lib.mapAttrsToList (name: package: "-fsys=${name} --search-prefix ${lib.getLib package}") {
       inherit glslang;
@@ -97,40 +118,65 @@ stdenv.mkDerivation (finalAttrs: {
 
   zigCheckFlags = finalAttrs.zigBuildFlags;
 
-  outputs = [
-    "out"
-    "terminfo"
-    "shell_integration"
-    "vim"
-  ];
+  # Unit tests currently fail inside the sandbox
+  doCheck = false;
 
-  postInstall = ''
-    mkdir -p "$terminfo/share"
-    mv "$out/share/terminfo" "$terminfo/share/terminfo"
-    ln -sf "$terminfo/share/terminfo" "$out/share/terminfo"
+  /**
+    Ghostty really likes all of it's resources to be in the same directory, so link them back after we split them
 
-    mkdir -p "$shell_integration"
-    mv "$out/share/ghostty/shell-integration" "$shell_integration/shell-integration"
-    ln -sf "$shell_integration/shell-integration" "$out/share/ghostty/shell-integration"
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/os/resourcesdir.zig#L11-L52
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L745-L750
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L818-L834
+
+    terminfo and shell integration should also be installable on remote machines
+
+    ```nix
+    { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.ghostty.terminfo ];
+
+      programs.bash = {
+        interactiveShellInit = ''
+          if [[ "$TERM" == "xterm-ghostty" ]]; then
+            builtin source ${pkgs.ghostty.shell_integration}/bash/ghostty.bash
+          fi
+        '';
+      };
+    }
+    ```
+  */
+  postFixup = ''
+    ln -s $man/share/man $out/share/man
+
+    moveToOutput share/terminfo $terminfo
+    ln -s $terminfo/share/terminfo $out/share/terminfo
+
+    mv $out/share/ghostty/shell-integration $shell_integration
+    ln -s $shell_integration $out/share/ghostty/shell-integration
+
+    mv $out/share/vim/vimfiles $vim
+    rmdir $out/share/vim
+    ln -s $vim $out/share/vim-plugins
 
-    mv "$out/share/vim/vimfiles" "$vim"
-    ln -sf "$vim" "$out/share/vim/vimfiles"
-  '';
 
-  preFixup = ''
     remove-references-to -t ${finalAttrs.deps} $out/bin/ghostty
   '';
 
-  NIX_LDFLAGS = [ "-lX11" ];
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
 
+  doInstallCheck = true;
+
   versionCheckProgramArg = [ "--version" ];
 
+  passthru = {
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) allTerminfo;
+      nixos = nixosTests.terminal-emulators.ghostty;
+    };
+  };
+
   meta = {
-    homepage = "https://ghostty.org/";
     description = "Fast, native, feature-rich terminal emulator pushing modern features";
     longDescription = ''
       Ghostty is a terminal emulator that differentiates itself by being
@@ -138,16 +184,24 @@ stdenv.mkDerivation (finalAttrs: {
       emulators available, they all force you to choose between speed,
       features, or native UIs. Ghostty provides all three.
     '';
+    homepage = "https://ghostty.org/";
     downloadPage = "https://ghostty.org/download";
 
     license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
     mainProgram = "ghostty";
-    outputsToInstall = finalAttrs.outputs;
     maintainers = with lib.maintainers; [
       jcollie
       pluiedev
       getchoo
     ];
+    outputsToInstall = [
+      "out"
+      "man"
+      "shell_integration"
+      "terminfo"
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    # Issues finding the SDK in the sandbox
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/go/godini/package.nix b/pkgs/by-name/go/godini/package.nix
new file mode 100644
index 000000000000..5c09478a26b3
--- /dev/null
+++ b/pkgs/by-name/go/godini/package.nix
@@ -0,0 +1,49 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  godini,
+  lib,
+  nix-update-script,
+  testers,
+}:
+
+buildGoModule rec {
+  pname = "godini";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "bilbilak";
+    repo = "godini";
+    tag = "v${version}";
+    hash = "sha256-83OAddIoJzAUXPZKGnAx8XPKrdSmtc1EIJUDmRHTU/U=";
+  };
+
+  vendorHash = "sha256-hocnLCzWN8srQcO3BMNkd2lt0m54Qe7sqAhUxVZlz1k=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/bilbilak/godini/config.Version=${version}"
+  ];
+
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = godini;
+        command = "godini --version";
+      };
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    changelog = "https://github.com/bilbilak/godini/blob/main/CHANGELOG.md";
+    description = "INI Configuration Management Tool";
+    homepage = "https://github.com/bilbilak/godini";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "godini";
+    maintainers = with lib.maintainers; [ _4r7if3x ];
+    platforms = with lib.platforms; unix ++ windows;
+  };
+}
diff --git a/pkgs/by-name/gp/gpufetch/package.nix b/pkgs/by-name/gp/gpufetch/package.nix
new file mode 100644
index 000000000000..3a40a1df76f7
--- /dev/null
+++ b/pkgs/by-name/gp/gpufetch/package.nix
@@ -0,0 +1,75 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  config,
+  pciutils,
+  cudaSupport ? config.cudaSupport,
+  cudaPackages,
+  installShellFiles,
+  autoAddDriverRunpath,
+  gitUpdater,
+  versionCheckHook,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gpufetch";
+  version = "0.25";
+
+  src = fetchFromGitHub {
+    owner = "Dr-Noob";
+    repo = "gpufetch";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1j23h3TDxa2xu03o37fXfRL3XFYyhMWFGupAlkrYpBY=";
+  };
+
+  nativeBuildInputs =
+    [
+      cmake
+      installShellFiles
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
+      autoAddDriverRunpath
+    ];
+
+  buildInputs =
+    [
+      zlib
+      pciutils
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_cudart
+      cudaPackages.cuda_nvml_dev
+    ];
+
+  installPhase = ''
+    runHook preInstall
+
+    installManPage ${finalAttrs.src}/gpufetch.1
+    install -Dm755 ./gpufetch $out/bin/gpufetch
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
+  meta = {
+    description = "Simple yet fancy GPU architecture fetching tool";
+    homepage = "https://github.com/Dr-Noob/gpufetch";
+    license = lib.licenses.gpl2Only;
+    mainProgram = "gpufetch";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/gz/gzdoom/package.nix b/pkgs/by-name/gz/gzdoom/package.nix
index dee7b1971da1..17051d7692e6 100644
--- a/pkgs/by-name/gz/gzdoom/package.nix
+++ b/pkgs/by-name/gz/gzdoom/package.nix
@@ -28,16 +28,18 @@
 
 stdenv.mkDerivation rec {
   pname = "gzdoom";
-  version = "4.13.2";
+  version = "4.14.0";
 
   src = fetchFromGitHub {
     owner = "ZDoom";
     repo = "gzdoom";
     rev = "g${version}";
     fetchSubmodules = true;
-    hash = "sha256-3nkdpJ3XO58YHtjVTwxdSdCL6CnMcih6mTnI7FXLm34=";
+    hash = "sha256-+gLWt1qBKl8xGK6sALnjqPuXcBexjWKbEkbRMFtLcbE=";
   };
 
+  patches = [ ./string_format.patch ];
+
   outputs = [
     "out"
     "doc"
diff --git a/pkgs/by-name/gz/gzdoom/string_format.patch b/pkgs/by-name/gz/gzdoom/string_format.patch
new file mode 100644
index 000000000000..8aa655c7acaa
--- /dev/null
+++ b/pkgs/by-name/gz/gzdoom/string_format.patch
@@ -0,0 +1,13 @@
+diff --git a/src/common/engine/i_net.cpp b/src/common/engine/i_net.cpp
+index ad106bbc4..0a67062a0 100644
+--- a/src/common/engine/i_net.cpp
++++ b/src/common/engine/i_net.cpp
+@@ -1072,7 +1072,7 @@ void I_NetError(const char* error)
+ {
+ 	doomcom.numnodes = 0;
+ 	StartWindow->NetClose();
+-	I_FatalError(error);
++	I_FatalError("%s", error);
+ }
+ 
+ // todo: later these must be dispatched by the main menu, not the start screen.
diff --git a/pkgs/by-name/ju/jujutsu/package.nix b/pkgs/by-name/ju/jujutsu/package.nix
index 9e51be435988..750ce685575b 100644
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@@ -29,9 +29,9 @@ rustPlatform.buildRustPackage {
   inherit version;
 
   src = fetchFromGitHub {
-    owner = "martinvonz";
+    owner = "jj-vcs";
     repo = "jj";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-XsD4P2UygZFcnlV2o3E/hRRgsGjwKw1r9zniEeAk758";
   };
 
@@ -110,8 +110,8 @@ rustPlatform.buildRustPackage {
 
   meta = {
     description = "Git-compatible DVCS that is both simple and powerful";
-    homepage = "https://github.com/martinvonz/jj";
-    changelog = "https://github.com/martinvonz/jj/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/jj-vcs/jj";
+    changelog = "https://github.com/jj-vcs/jj/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       _0x4A6F
diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 1c5b60219bde..9175c4aadb78 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -8,7 +8,6 @@
   addDriverRunpath,
 
   apple-sdk_12,
-  darwinMinVersionHook,
 
   koboldLiteSupport ? true,
 
@@ -41,13 +40,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.80.1";
+  version = "1.80.3";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-CgJzYF8FnHk0zKdysGJWLnNo/MND24AbQdjRbDtv0II=";
+    hash = "sha256-uxqn4t2dDaVSkVilJOflNbG2Q3fH3Yid8qdEaDGfIcw=";
   };
 
   enableParallelBuilding = true;
@@ -62,10 +61,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ tk ]
     ++ finalAttrs.pythonInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple-sdk_12
-      (darwinMinVersionHook "10.15")
-    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
       cudaPackages.cuda_nvcc
diff --git a/pkgs/by-name/li/libp11/package.nix b/pkgs/by-name/li/libp11/package.nix
index 5bfaffacfb10..4b12b2bda7dc 100644
--- a/pkgs/by-name/li/libp11/package.nix
+++ b/pkgs/by-name/li/libp11/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libp11";
-  version = "0.4.12";
+  version = "0.4.13";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "libp11";
     rev = "${pname}-${version}";
-    sha256 = "sha256-Xqjl12xT30ZXWYzPWNN3jWY9pxojhd7Kq0OC7rABt4M=";
+    sha256 = "sha256-teYXlPtCt6ifQDArbCJWGrYl9pdr6V7HVpU4HXTPIco=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/lu/lucenepp/package.nix b/pkgs/by-name/lu/lucenepp/package.nix
index 59e8a2828c35..5e9688571ce7 100644
--- a/pkgs/by-name/lu/lucenepp/package.nix
+++ b/pkgs/by-name/lu/lucenepp/package.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/bc436842227aea561b68c6ae89fbd1fdefcac7b3.patch";
       sha256 = "sha256-/S7tFZ4ht5p0cv036xF2NKZQwExbPaGINyWZiUg/lS4=";
     })
+    (fetchpatch {
+      name = "fix-build-with-boost-1_85_0.patch";
+      url = "https://github.com/luceneplusplus/LucenePlusPlus/commit/76dc90f2b65d81be018c499714ff11e121ba5585.patch";
+      sha256 = "sha256-SNAngHwy7yxvly8d6u1LcPsM6NYVx3FrFiSHLmkqY6Q=";
+    })
   ];
 
   # Don't use the built in gtest - but the nixpkgs one requires C++14.
diff --git a/pkgs/by-name/ma/mainsail/package.nix b/pkgs/by-name/ma/mainsail/package.nix
index d82882831da8..3f0c7578f18d 100644
--- a/pkgs/by-name/ma/mainsail/package.nix
+++ b/pkgs/by-name/ma/mainsail/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "mainsail";
-  version = "2.13.1";
+  version = "2.13.2";
 
   src = fetchFromGitHub {
     owner = "mainsail-crew";
     repo = "mainsail";
     rev = "v${version}";
-    hash = "sha256-Ugxy6bbLD0XJwKLW3YOM32GWrK9q8JsrcKGipZNZOsE=";
+    hash = "sha256-rXavUkoFRw5fWCisdz/eD+wL1Sc+vExyjskVEIN4QNQ=";
   };
 
-  npmDepsHash = "sha256-mlF8p9s5aGjZz1nfBOOECsW/BhaP2ToQ4f6gUU9sgSI=";
+  npmDepsHash = "sha256-MzPXDy9sX7Y5dUm3qp3OORdEz8QyL5j4M4eXl0gtopo=";
 
   # Prevent Cypress binary download.
   CYPRESS_INSTALL_BINARY = 0;
diff --git a/pkgs/by-name/ma/makejinja/package.nix b/pkgs/by-name/ma/makejinja/package.nix
index e854d85f2e9f..cd46437806c7 100644
--- a/pkgs/by-name/ma/makejinja/package.nix
+++ b/pkgs/by-name/ma/makejinja/package.nix
@@ -6,17 +6,17 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "makejinja";
-  version = "2.6.2";
+  version = "2.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mirkolenz";
     repo = "makejinja";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-xrXyXFmh9df04I/zcSvQXsyUPrAvbOyyrhx8RNS3Ojs=";
+    tag = "v${version}";
+    hash = "sha256-WyTv4eTsEPn3pCCXUB0YUfv9SyR/6Ml4UU4zt1k5z2c=";
   };
 
-  build-system = with python3Packages; [ poetry-core ];
+  build-system = with python3Packages; [ setuptools ];
 
   dependencies =
     with python3Packages;
@@ -46,5 +46,6 @@ python3Packages.buildPythonApplication rec {
       mirkolenz
     ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    changelog = "https://github.com/mirkolenz/makejinja/blob/${src.tag}/CHANGELOG.md";
   };
 }
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index dbfde42f4e02..b3c785eb4575 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -9,12 +9,12 @@
 }:
 
 let
-  version = "2.2.0";
+  version = "2.3.0";
   src = fetchFromGitHub {
     owner = "mealie-recipes";
     repo = "mealie";
     rev = "v${version}";
-    hash = "sha256-t4YYvj8dG8o9PVAlDxdxVBi2omBGQ2h53/IVv089778=";
+    hash = "sha256-GN+uXyZCvDuFmQnXhn0mFans3bvvEw7Uq6V0OeCPEbE=";
   };
 
   frontend = callPackage (import ./mealie-frontend.nix src version) { };
diff --git a/pkgs/by-name/mo/monetdb/package.nix b/pkgs/by-name/mo/monetdb/package.nix
index deb1f13f48c4..7fa26067a80a 100644
--- a/pkgs/by-name/mo/monetdb/package.nix
+++ b/pkgs/by-name/mo/monetdb/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "monetdb";
-  version = "11.51.3";
+  version = "11.51.7";
 
   src = fetchurl {
     url = "https://dev.monetdb.org/downloads/sources/archive/MonetDB-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ql6J4e62sL/g6s6cr2xMoxmlsLyovapaGtpcQIZ9tOU=";
+    hash = "sha256-lWURVG+5NSWBTxXC5slYSedMZC1Z/HGfzZ43tR7z4dE=";
   };
 
   nativeBuildInputs = [ bison cmake python3 ];
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 5aa5f4ed70ff..bc4b138ecc4e 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -155,8 +155,9 @@ php.buildComposerProject (finalAttrs: {
   postInstall = ''
     mkdir -p $out/bin
     echo "#!${lib.getExe dash}" > $out/bin/movim
-    echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/movim
-    chmod +x $out/bin/movim
+    echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/${finalAttrs.meta.mainProgram}
+    chmod +x $out/bin/${finalAttrs.meta.mainProgram}
+
 
     mkdir -p $out/share/{bash-completion/completion,fish/vendor_completions.d,zsh/site-functions}
     $out/bin/movim completion bash | sed "s/daemon.php/movim/g" > $out/share/bash-completion/completion/movim.bash
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index 6de5fae0aec5..fda140295ea5 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "19.0.1";
+  version = "19.0.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-kpNsISDc9L+eeaKCFg3QsZFHIv1+yTIv3svRdGGbNQ0=";
+    sha256 = "sha256-44aorX4i+/kwWMIlM1Z+I81PT+Udjk0llg706eVKONY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/nas/package.nix b/pkgs/by-name/na/nas/package.nix
index 30e359960fae..ff2ce23c8bc0 100644
--- a/pkgs/by-name/na/nas/package.nix
+++ b/pkgs/by-name/na/nas/package.nix
@@ -45,6 +45,12 @@ stdenv.mkDerivation (finalAttrs: {
     "World"
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=implicit-function-declaration"
+    "-Wno-error=implicit-int"
+    "-Wno-error=incompatible-pointer-types"
+  ];
+
   installFlags = [
     "LDLIBS=-lfl"
     "DESTDIR=${placeholder "out"}"
diff --git a/pkgs/by-name/op/openapi-python-client/package.nix b/pkgs/by-name/op/openapi-python-client/package.nix
index 54bdb088ae57..4a7011ab9086 100644
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "openapi-python-client";
-  version = "0.22.0";
+  version = "0.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
     owner = "openapi-generators";
     repo = "openapi-python-client";
     tag = "v${version}";
-    hash = "sha256-Z6gYSonnr2HrWieWFp20U1px8clC1yBCezn/pk428WI=";
+    hash = "sha256-jMRnzrQ5ZySaxrCloE9DLXt2O78d04+XHq4XlFUohjs=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/os/oscavmgr/package.nix b/pkgs/by-name/os/oscavmgr/package.nix
index 21a71ecbb42b..b71bf53b8549 100644
--- a/pkgs/by-name/os/oscavmgr/package.nix
+++ b/pkgs/by-name/os/oscavmgr/package.nix
@@ -7,6 +7,7 @@
   openxr-loader,
   pkg-config,
   rustPlatform,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,6 +33,9 @@ rustPlatform.buildRustPackage rec {
     openxr-loader
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   postPatch = ''
     alvr_session=$(echo $cargoDepsCopy/alvr_session-*/)
     substituteInPlace "$alvr_session/build.rs" \
diff --git a/pkgs/by-name/pa/paper-clip/document-Copy-using-SubprocessLauncher-instead-of-GFile-API.patch b/pkgs/by-name/pa/paper-clip/document-Copy-using-SubprocessLauncher-instead-of-GFile-API.patch
new file mode 100644
index 000000000000..65e99e74ad33
--- /dev/null
+++ b/pkgs/by-name/pa/paper-clip/document-Copy-using-SubprocessLauncher-instead-of-GFile-API.patch
@@ -0,0 +1,66 @@
+From 93e1c00bca9078fa4b21e42a4560011cce768142 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Diego=20Iv=C3=A1n=20M=2EE?= <diegoivan.mae@gmail.com>
+Date: Mon, 12 Aug 2024 09:16:51 -0600
+Subject: [PATCH] document: Copy using SubprocessLauncher instead of GFile API
+
+---
+ io.github.diegoivan.pdf_metadata_editor.json |  7 +++----
+ src/Document.vala                            | 13 +++++++------
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/io.github.diegoivan.pdf_metadata_editor.json b/io.github.diegoivan.pdf_metadata_editor.json
+index ede68d1..3feb79e 100644
+--- a/io.github.diegoivan.pdf_metadata_editor.json
++++ b/io.github.diegoivan.pdf_metadata_editor.json
+@@ -52,10 +52,9 @@
+             ],
+             "sources" : [
+                 {
+-                    "url" : "https://gitlab.freedesktop.org/poppler/poppler.git",
+-                    "type" : "git",
+-                    "tag" : "poppler-23.01.0",
+-                    "commit" : "4259ff0c2067d302f97d87221a442eec8e88d45c"
++                    "url" : "https://poppler.freedesktop.org/poppler-24.08.0.tar.xz",
++                    "type" : "archive",
++                    "sha256" : "97453fbddf0c9a9eafa0ea45ac710d3d49bcf23a62e864585385d3c0b4403174"
+                 }
+             ]
+         },
+diff --git a/src/Document.vala b/src/Document.vala
+index e52e1a7..a59fe03 100644
+--- a/src/Document.vala
++++ b/src/Document.vala
+@@ -445,11 +445,11 @@ public class PaperClip.Document : Object {
+     }
+ 
+     private async File create_copy_from_original () throws Error {
++        var launcher = new SubprocessLauncher (NONE);
+         unowned string tmp_dir = Environment.get_tmp_dir ();
+         string destination_path = Path.build_path (Path.DIR_SEPARATOR_S,
+                                                    tmp_dir,
+                                                    "copies");
+-
+         int res = DirUtils.create_with_parents (destination_path, 0777);
+         if (res < 0) {
+             throw new IOError.FAILED (@"Could not create $destination_path");
+@@ -458,14 +458,15 @@ public class PaperClip.Document : Object {
+         string destination_file = Path.build_filename (destination_path,
+                                                        "%s".printf (original_file.get_basename ()));
+ 
+-        var copy_file = File.new_for_path (destination_file);
+-        FileCopyFlags flags = NOFOLLOW_SYMLINKS | OVERWRITE | ALL_METADATA;
+-
+-        bool success = yield original_file.copy_async (copy_file, flags);
++        Subprocess copy_process = launcher.spawn("cp", original_file.get_path(), destination_path);
++        bool success = yield copy_process.wait_async ();
+         if (!success) {
+-            critical ("Copy Unsuccessful");
++            critical ("Processed failed");
+         }
+ 
++
++        var copy_file = File.new_for_path (destination_file);
++
+         return copy_file;
+     }
+ }
diff --git a/pkgs/by-name/pa/paper-clip/package.nix b/pkgs/by-name/pa/paper-clip/package.nix
index 36be5f4c7bb1..e73043672ab0 100644
--- a/pkgs/by-name/pa/paper-clip/package.nix
+++ b/pkgs/by-name/pa/paper-clip/package.nix
@@ -27,6 +27,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Jdsx5ZhujP0SgEtr4NMbXsTkMYrkQj7Vs+SSYziWpiw=";
   };
 
+  # Remove these patches after the version is bumped past 5.5.1
+  patches = [
+    ./document-Copy-using-SubprocessLauncher-instead-of-GFile-API.patch
+    ./vala-Solve-Vala-errors-at-C-compile-time.patch
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/by-name/pa/paper-clip/vala-Solve-Vala-errors-at-C-compile-time.patch b/pkgs/by-name/pa/paper-clip/vala-Solve-Vala-errors-at-C-compile-time.patch
new file mode 100644
index 000000000000..a41655d6d262
--- /dev/null
+++ b/pkgs/by-name/pa/paper-clip/vala-Solve-Vala-errors-at-C-compile-time.patch
@@ -0,0 +1,24 @@
+From 82193146a80bfe613355706421454f879bdd496f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Diego=20Iv=C3=A1n=20M=2EE?= <diegoivan.mae@gmail.com>
+Date: Mon, 5 Aug 2024 18:08:36 -0600
+Subject: [PATCH] vala: Solve Vala errors at C compile time
+
+---
+ src/Document.vala | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/Document.vala b/src/Document.vala
+index 872309f..e52e1a7 100644
+--- a/src/Document.vala
++++ b/src/Document.vala
+@@ -451,7 +451,9 @@ public class PaperClip.Document : Object {
+                                                    "copies");
+ 
+         int res = DirUtils.create_with_parents (destination_path, 0777);
+-        return_if_fail (res > -1);
++        if (res < 0) {
++            throw new IOError.FAILED (@"Could not create $destination_path");
++        }
+ 
+         string destination_file = Path.build_filename (destination_path,
+                                                        "%s".printf (original_file.get_basename ()));
diff --git a/pkgs/by-name/pe/peakperf/package.nix b/pkgs/by-name/pe/peakperf/package.nix
new file mode 100644
index 000000000000..379963aac156
--- /dev/null
+++ b/pkgs/by-name/pe/peakperf/package.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  config,
+  enableCuda ? config.cudaSupport,
+  cudaPackages,
+  versionCheckHook,
+  installShellFiles,
+  unstableGitUpdater,
+  fetchpatch,
+  autoAddDriverRunpath,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "peakperf";
+  version = "1.17-unstable-2024-10-07";
+
+  src = fetchFromGitHub {
+    owner = "Dr-Noob";
+    repo = "peakperf";
+    rev = "289c8a2f58eb51712d346d5c993b3c1d136bf031";
+    hash = "sha256-CoGWj+zskcv8caFjhy55GKTKqFq2y1/nMjiVc6TzU1c=";
+  };
+
+  nativeBuildInputs =
+    [
+      cmake
+      installShellFiles
+    ]
+    ++ lib.optionals enableCuda [
+      cudaPackages.cuda_nvcc
+      autoAddDriverRunpath
+    ];
+
+  buildInputs = lib.optionals enableCuda [
+    cudaPackages.cuda_cudart
+    cudaPackages.cuda_nvml_dev
+  ];
+
+  postInstall = ''
+    installManPage ${finalAttrs.src}/peakperf.1
+  '';
+
+  passthru = {
+    updateScript = unstableGitUpdater { };
+  };
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = [
+    "-v"
+  ];
+
+  preVersionCheck = ''
+    export version=1.17
+  '';
+
+  doInstallCheck = true;
+
+  versionCheckProgram = "${placeholder "out"}/bin/peakperf";
+
+  meta = {
+    homepage = "https://github.com/Dr-Noob/peakperf";
+    description = "Achieve peak performance on x86 CPUs and NVIDIA GPUs";
+    mainProgram = "peakperf";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.gpl2Only;
+  };
+})
diff --git a/pkgs/by-name/po/portablemc/package.nix b/pkgs/by-name/po/portablemc/package.nix
index 3b3c399d4a9e..f4f3516ae810 100644
--- a/pkgs/by-name/po/portablemc/package.nix
+++ b/pkgs/by-name/po/portablemc/package.nix
@@ -43,7 +43,7 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "portablemc";
-  version = "4.4.0";
+  version = "4.4.1";
   pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.8";
@@ -52,7 +52,7 @@ python3Packages.buildPythonApplication rec {
     owner = "mindstorm38";
     repo = "portablemc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JDosvjbpoDC+xJ15ejcMJd+jA09RLR+whVZblMu+ljk=";
+    hash = "sha256-KE1qf6aIcDjwKzrdKDUmriWfAt+vuriew6ixHKm0xs8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/py/pylyzer/package.nix b/pkgs/by-name/py/pylyzer/package.nix
index 6e7e8c7e761d..474b4438b2bb 100644
--- a/pkgs/by-name/py/pylyzer/package.nix
+++ b/pkgs/by-name/py/pylyzer/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.75";
+  version = "0.0.76";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     tag = "v${version}";
-    hash = "sha256-N0a13nuHL6UuaSTowiEGu0VszW9QTqAmgsUOJXDhj8Q=";
+    hash = "sha256-1WBZ8i/JIIRRH11MNQma/o9VdMvN0eYopXt7Iwj1hZ8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-LJaAcMajDLrpAKmYATN2xWKmoXaZzOyACzVe4vi4+vU=";
+  cargoHash = "sha256-dzp7HeEfM6UP3VgH56CQvnezZjg13YUszA+EsO2N4Os=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/by-name/ra/rain/package.nix b/pkgs/by-name/ra/rain/package.nix
index 5df5e7c559a2..60d4f83ca875 100644
--- a/pkgs/by-name/ra/rain/package.nix
+++ b/pkgs/by-name/ra/rain/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "rain";
-  version = "1.19.0";
+  version = "1.20.2";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-I5h09XbBDrMXQczpNoUENkOp3b4NxBR5Hr58nNVh1JM=";
+    sha256 = "sha256-T/J01oxiCaZ8vBzSvB3j+dacehHCFs5+46MIoc2DKLU=";
   };
 
-  vendorHash = "sha256-6xSWaLnE9pD2d49OVjg2IIbhgdJ5R2I0fuRZ4wFudoI=";
+  vendorHash = "sha256-ML65zg8TVblNcFVmvsiIwxRIfL+jxgUpLx2lVUFHXxI=";
 
   subPackages = [ "cmd/rain" ];
 
diff --git a/pkgs/by-name/ro/roboto/package.nix b/pkgs/by-name/ro/roboto/package.nix
index b22a68fde945..b2b7880f9726 100644
--- a/pkgs/by-name/ro/roboto/package.nix
+++ b/pkgs/by-name/ro/roboto/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  python3Packages,
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -14,9 +15,24 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-ue3PUZinBpcYgSho1Zrw1KHl7gc/GlN1GhWFk6g5QXE=";
   };
 
+  nativeBuildInputs = [
+    python3Packages.fonttools
+  ];
+
   installPhase = ''
     runHook preInstall
 
+    # The RobotoCondensed fonts have a usWidthClass value of 5, which is
+    # incorrect. It should be 3.
+    # See the corresponding issue at https://github.com/googlefonts/roboto-3-classic/issues/130
+    for file in RobotoCondensed*; do
+      fontname=$(echo $file | sed 's/\.ttf//')
+      ttx -v -o $fontname.xml $file
+      substituteInPlace $fontname.xml \
+        --replace-fail "<usWidthClass value=\"5\"/>" "<usWidthClass value=\"3\"/>"
+      ttx $fontname.xml -o $fontname.ttf
+    done
+
     install -Dm644 *.ttf -t $out/share/fonts/truetype
 
     runHook postInstall
diff --git a/pkgs/by-name/ro/rockcraft/package.nix b/pkgs/by-name/ro/rockcraft/package.nix
index 6b1d272edaa2..38bf29563dd2 100644
--- a/pkgs/by-name/ro/rockcraft/package.nix
+++ b/pkgs/by-name/ro/rockcraft/package.nix
@@ -4,6 +4,9 @@
   fetchFromGitHub,
   dpkg,
   nix-update-script,
+  testers,
+  rockcraft,
+  cacert,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -13,18 +16,11 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "rockcraft";
-    rev = "1d87e33cf207b3a2f16eb125743ec11546fa0cb1";
-    hash = "sha256-QnW3BMu4Tuvj8PCt5eYJbNMiojXpyJ1uza6hpMxxSOE=";
+    rev = version;
+    hash = "sha256-2Bo3qtpSSfNvqszlt9cCc9/rurDNDMySAaqLbvRmjjw=";
   };
 
-  postPatch = ''
-    substituteInPlace rockcraft/__init__.py \
-      --replace-fail "dev" "${version}"
-
-    substituteInPlace rockcraft/utils.py \
-      --replace-fail "distutils.util" "setuptools.dist"
-  '';
-
+  pyproject = true;
   build-system = with python3Packages; [ setuptools-scm ];
 
   dependencies = with python3Packages; [
@@ -32,6 +28,7 @@ python3Packages.buildPythonApplication rec {
     craft-archives
     craft-platforms
     spdx-lookup
+    tabulate
   ];
 
   nativeCheckInputs =
@@ -42,7 +39,6 @@ python3Packages.buildPythonApplication rec {
       pytest-mock
       pytest-subprocess
       pytestCheckHook
-      tabulate
     ]
     ++ [ dpkg ];
 
@@ -51,9 +47,19 @@ python3Packages.buildPythonApplication rec {
     export HOME="$(pwd)/check-phase"
   '';
 
-  disabledTests = [ "test_expand_extensions" ];
+  disabledTests = [
+    "test_run_init_flask"
+    "test_run_init_django"
+  ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = rockcraft;
+      command = "env SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt HOME=$(mktemp -d) rockcraft --version";
+      version = "rockcraft ${version}";
+    };
+  };
 
   meta = {
     mainProgram = "rockcraft";
diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix
index 97c32fbe7e3e..3b47b20b8929 100644
--- a/pkgs/by-name/sh/shipwright/package.nix
+++ b/pkgs/by-name/sh/shipwright/package.nix
@@ -6,6 +6,7 @@
   lib,
   fetchFromGitHub,
   fetchurl,
+  fetchpatch,
   copyDesktopItems,
   makeDesktopItem,
   python3,
@@ -43,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./darwin-fixes.patch
+    (fetchpatch {
+      name = "gcc14.patch";
+      url = "https://github.com/HarbourMasters/Shipwright/commit/1bc15d5bf3042d4fd64e1952eb68c47a7d5d8061.patch";
+      hash = "sha256-OpjP+rGqx56DB4W8yzLkxuxSAQa6oXQqtbQ2cNcFjYQ=";
+    })
   ];
 
   # This would get fetched at build time otherwise, see:
diff --git a/pkgs/by-name/si/signal-cli/package.nix b/pkgs/by-name/si/signal-cli/package.nix
index 015e232c16c3..ab4d4da3232d 100644
--- a/pkgs/by-name/si/signal-cli/package.nix
+++ b/pkgs/by-name/si/signal-cli/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.13.10";
+  version = "0.13.11";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    hash = "sha256-libAHGRdOinL48riMwKtacI5YlRw8JGoqOynVUCGyeA=";
+    hash = "sha256-biK03oiGCNXxWQpYVloE2SDLMrOMWIV+1RGqps1kTvk=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/st/st-snazzy/package.nix b/pkgs/by-name/st/st-snazzy/package.nix
new file mode 100644
index 000000000000..2a947e1a81cd
--- /dev/null
+++ b/pkgs/by-name/st/st-snazzy/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fontconfig,
+  harfbuzz,
+  libX11,
+  libXft,
+  ncurses,
+  gd,
+  glib,
+  pkg-config,
+}:
+
+stdenv.mkDerivation {
+  pname = "st-snazzy";
+  version = "0.8.5-unstable-2024-09-06";
+
+  src = fetchFromGitHub {
+    owner = "siduck";
+    repo = "st";
+    rev = "a7582f96afdee6bf0793cd0d8f84b755fd6aabf6";
+    hash = "sha256-wohkmDsm26kqFGQKuY6NuBQsifT7nZNgrLqLFsU+Vog=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    fontconfig
+    harfbuzz
+    libX11
+    libXft
+    ncurses
+    gd
+    glib
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  env.TERMINFO = "${placeholder "out"}/share/terminfo";
+
+  meta = {
+    homepage = "https://github.com/siduck/st";
+    description = "snazzy terminal (suckless + beautiful)";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pouya ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/tr/treegen/package.nix b/pkgs/by-name/tr/treegen/package.nix
new file mode 100644
index 000000000000..040fa27fec16
--- /dev/null
+++ b/pkgs/by-name/tr/treegen/package.nix
@@ -0,0 +1,49 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  testers,
+  treegen,
+}:
+
+buildGoModule rec {
+  pname = "treegen";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "bilbilak";
+    repo = "treegen";
+    tag = "v${version}";
+    hash = "sha256-PPWUEfX7OXKZnghiVXU+eCjveA1VszA3uS8C3uI3pFM=";
+  };
+
+  vendorHash = "sha256-hocnLCzWN8srQcO3BMNkd2lt0m54Qe7sqAhUxVZlz1k=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/bilbilak/treegen/config.Version=${version}"
+  ];
+
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = treegen;
+        command = "treegen --version";
+      };
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    changelog = "https://github.com/bilbilak/treegen/blob/main/CHANGELOG.md";
+    description = "ASCII Tree Directory and File Structure Generator";
+    homepage = "https://github.com/bilbilak/treegen";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "treegen";
+    maintainers = with lib.maintainers; [ _4r7if3x ];
+    platforms = with lib.platforms; unix ++ windows;
+  };
+}
diff --git a/pkgs/by-name/tr/triton-llvm/package.nix b/pkgs/by-name/tr/triton-llvm/package.nix
index 3d0e1661763e..c57a075e432f 100644
--- a/pkgs/by-name/tr/triton-llvm/package.nix
+++ b/pkgs/by-name/tr/triton-llvm/package.nix
@@ -189,20 +189,26 @@ stdenv.mkDerivation (finalAttrs: {
     );
 
   postPatch =
+    # `CMake Error: cannot write to file "/build/source/llvm/build/lib/cmake/mlir/MLIRTargets.cmake": Permission denied`
     ''
-      # `CMake Error: cannot write to file "/build/source/llvm/build/lib/cmake/mlir/MLIRTargets.cmake": Permission denied`
       chmod +w -R ./mlir
       patchShebangs ./mlir/test/mlir-reduce
-
-      # FileSystem permissions tests fail with various special bits
+    ''
+    # FileSystem permissions tests fail with various special bits
+    + ''
       rm llvm/test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
       rm llvm/unittests/Support/Path.cpp
 
       substituteInPlace llvm/unittests/Support/CMakeLists.txt \
-        --replace "Path.cpp" ""
+        --replace-fail "Path.cpp" ""
     ''
+    # Not sure why this fails
+    + ''
+      rm mlir/test/Dialect/SPIRV/IR/availability.mlir
+      rm mlir/test/Dialect/SPIRV/IR/target-env.mlir
+    ''
+    # Not sure why this fails
     + lib.optionalString stdenv.hostPlatform.isAarch64 ''
-      # Not sure why this fails
       rm llvm/test/tools/llvm-exegesis/AArch64/latency-by-opcode-name.s
     '';
 
@@ -221,14 +227,15 @@ stdenv.mkDerivation (finalAttrs: {
   checkTarget = "check-all";
   requiredSystemFeatures = [ "big-parallel" ];
 
-  meta = with lib; {
+  meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage = "https://github.com/llvm/llvm-project";
-    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [
+    changelog = "https://github.com/llvm/llvm-project/releases/tag/llvmorg-${finalAttrs.version}";
+    license = with lib.licenses; [ ncsa ];
+    maintainers = with lib.maintainers; [
       SomeoneSerge
       Madouura
     ];
-    platforms = with platforms; aarch64 ++ x86;
+    platforms = with lib.platforms; aarch64 ++ x86;
   };
 })
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index ecd71df40761..8ecaeba74b66 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "VictoriaMetrics";
-  version = "1.108.0";
+  version = "1.108.1";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     rev = "v${version}";
-    hash = "sha256-c7I+H4KimGDAaDWT1vGyfdjfp/6Ci/kHVQELLsl3Ih4=";
+    hash = "sha256-UaWTBOlMf7SR3tBjeaNnokdSqtRrYm5rPQPi3UGxTvQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xc/xcodegen/0001-spectre-xct-record.patch b/pkgs/by-name/xc/xcodegen/0001-spectre-xct-record.patch
new file mode 100644
index 000000000000..4aef3141061e
--- /dev/null
+++ b/pkgs/by-name/xc/xcodegen/0001-spectre-xct-record.patch
@@ -0,0 +1,34 @@
+diff --git a/Sources/Spectre/XCTest.swift b/Sources/Spectre/XCTest.swift
+index 3704436..e759f14 100644
+--- a/Sources/Spectre/XCTest.swift
++++ b/Sources/Spectre/XCTest.swift
+@@ -31,28 +31,6 @@ class XcodeReporter: ContextReporter {
+   func addDisabled(_ name: String) {}
+ 
+   func addFailure(_ name: String, failure: FailureType) {
+-    // Xcode 12 removed `recordFailure` and replaced with `record(_:)`
+-    #if swift(>=4.2)
+-    // The `compiler` statement was added in swift 4.2, so it needs to be in a separate statement to retain
+-    // compatibility with 4.x.
+-    #if compiler(>=5.3) && os(macOS)
+-    let location = XCTSourceCodeLocation(filePath: failure.file, lineNumber: failure.line)
+-    #if Xcode
+-    // As of Xcode 12.0.1, XCTIssue is unavailable even though it is documented:
+-    //   https://developer.apple.com/documentation/xctest/xctissue
+-    // When building with `swift build`, it is available. Perhaps the xctest overlay behaves differently between the two.
+-    let issue = XCTIssueReference(type: .assertionFailure, compactDescription: "\(name): \(failure.reason)", detailedDescription: nil, sourceCodeContext: .init(location: location), associatedError: nil, attachments: [])
+-    #else
+-    let issue = XCTIssue(type: .assertionFailure, compactDescription: "\(name): \(failure.reason)", detailedDescription: nil, sourceCodeContext: .init(location: location), associatedError: nil, attachments: [])
+-    #endif
+-    #if compiler(>=5.4)
+-    testCase.record(issue as XCTIssue)
+-    #else
+-    testCase.record(issue)
+-    #endif
+-    #else
+     testCase.recordFailure(withDescription: "\(name): \(failure.reason)", inFile: failure.file, atLine: failure.line, expected: false)
+-    #endif
+-    #endif
+   }
+ }
+\ No newline at end of file
diff --git a/pkgs/by-name/xc/xcodegen/nix/default.nix b/pkgs/by-name/xc/xcodegen/nix/default.nix
new file mode 100644
index 000000000000..e9d58741591f
--- /dev/null
+++ b/pkgs/by-name/xc/xcodegen/nix/default.nix
@@ -0,0 +1,16 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "AEXML" = "sha256-bQcXq1aS76sOjW8yYCOlGVZ2tStDvzRQSyj9VrAj6nI=";
+    "ArtifactBundleGen" = "sha256-mSXJiRGFIm2RtzBG8l6s4RJ2BzSbPZKUZIqWM4vDIhc=";
+    "JSONUtilities" = "sha256-jl8XfgoB5IX0qwwDtzcWgK0u3SNG2HfrPoEb2a6/mlA=";
+    "PathKit" = "sha256-ewxTC1kpu6PXhwamCxYfI50ooYO1SIU0+IXH2tc/uv4=";
+    "Rainbow" = "sha256-zmd/wGFX0AYRvwecqQerlxDETMuBqQM+Whuf3JezAGM=";
+    "Spectre" = "sha256-fipGRIgw+jV7Wrxa+xivRk7YMyxDhGFB6SHIHscrmV8=";
+    "SwiftCLI" = "sha256-PmjzLss0D12iy6YKsudFa8i63NQAssyCBqqq8VjRiH4=";
+    "Version" = "sha256-4IwQlexWtIH9M0sSai1a+ITTAKkD2zJtbYoV4Cg+Snw=";
+    "XcodeProj" = "sha256-ycHDzay37YtT/3QqUpG6XPjRh32P5iU/I5GpfjrXs/I=";
+    "Yams" = "sha256-5qxuCkmopm3uFcoYJKQA8ofW98f53H1gZaPiOh2DS4U=";
+  };
+}
diff --git a/pkgs/by-name/xc/xcodegen/nix/workspace-state.json b/pkgs/by-name/xc/xcodegen/nix/workspace-state.json
new file mode 100644
index 000000000000..0f95461da6e0
--- /dev/null
+++ b/pkgs/by-name/xc/xcodegen/nix/workspace-state.json
@@ -0,0 +1,178 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "aexml",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/tadija/AEXML.git",
+          "name": "AEXML"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "38f7d00b23ecd891e1ee656fa6aeebd6ba04ecc3",
+            "version": "4.6.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "AEXML"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "artifactbundlegen",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/freddi-kit/ArtifactBundleGen",
+          "name": "ArtifactBundleGen"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "707e4ccc4b1c7e48e881cd5ea91e493a95df24bf",
+            "version": "0.0.6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "ArtifactBundleGen"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "jsonutilities",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/yonaskolb/JSONUtilities.git",
+          "name": "JSONUtilities"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "128d2ffc22467f69569ef8ff971683e2393191a0",
+            "version": "4.2.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "JSONUtilities"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "pathkit",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/kylef/PathKit.git",
+          "name": "PathKit"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "3bfd2737b700b9a36565a8c94f4ad2b050a5e574",
+            "version": "1.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "PathKit"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "rainbow",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/onevcat/Rainbow.git",
+          "name": "Rainbow"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e0dada9cd44e3fa7ec3b867e49a8ddbf543e3df3",
+            "version": "4.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Rainbow"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "spectre",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/kylef/Spectre.git",
+          "name": "Spectre"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "26cc5e9ae0947092c7139ef7ba612e34646086c7",
+            "version": "0.10.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Spectre"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swiftcli",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jakeheis/SwiftCLI.git",
+          "name": "SwiftCLI"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "2e949055d9797c1a6bddcda0e58dada16cc8e970",
+            "version": "6.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "SwiftCLI"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "version",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/mxcl/Version",
+          "name": "Version"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "a94b48f36763c05629fc102837398505032dead9",
+            "version": "2.0.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Version"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "xcodeproj",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/tuist/XcodeProj.git",
+          "name": "XcodeProj"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "447c159b0c5fb047a024fd8d942d4a76cf47dde0",
+            "version": "8.16.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "XcodeProj"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "01835dc202670b5bb90d07f3eae41867e9ed29f6",
+            "version": "5.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 6
+}
diff --git a/pkgs/by-name/xc/xcodegen/package.nix b/pkgs/by-name/xc/xcodegen/package.nix
new file mode 100644
index 000000000000..d302092be93c
--- /dev/null
+++ b/pkgs/by-name/xc/xcodegen/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  swiftPackages,
+  swift,
+  swiftpm,
+  swiftpm2nix,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  ...
+}:
+
+let
+  # Pass the generated files to the helper.
+  generated = swiftpm2nix.helpers ./nix;
+in
+
+swiftPackages.stdenv.mkDerivation (finalAttrs: {
+  pname = "xcodegen";
+  version = "2.42.0";
+
+  src = fetchFromGitHub {
+    owner = "yonaskolb";
+    repo = "XcodeGen";
+    tag = finalAttrs.version;
+    hash = "sha256-wcjmADG+XnS2kR8BHe6ijApomucS9Tx7ZRjWZmTCUiI=";
+  };
+
+  # Including SwiftPM as a nativeBuildInput provides a buildPhase for you.
+  # This by default performs a release build using SwiftPM, essentially:
+  #   swift build -c release
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+
+  buildInputs = [
+    swiftPackages.XCTest
+  ];
+
+  # The helper provides a configure snippet that will prepare all dependencies
+  # in the correct place, where SwiftPM expects them.
+  configurePhase =
+    generated.configure
+    + ''
+      # Replace the dependency symlink with a writable copy
+      swiftpmMakeMutable Spectre
+      # Now apply a patch
+      patch -p1 -d .build/checkouts/Spectre -i ${./0001-spectre-xct-record.patch}
+    '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp "$(swiftpmBinPath)/${finalAttrs.pname}" $out/bin/
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Swift command line tool for generating your Xcode project";
+    homepage = "https://github.com/yonaskolb/XcodeGen";
+    changelog = "https://github.com/XcodeGen/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
+    maintainers = [ lib.maintainers.samasaur ];
+    mainProgram = "xcodegen";
+  };
+})
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index 3f49ac595fb6..dc58437a49f6 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zizmor";
-  version = "0.9.2";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = "zizmor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bQpjU3ztaO8Fckk51QGOnJFANXceYwiqyopOzMt6UYM=";
+    hash = "sha256-fq+J1+CrxFSbCimM8SIshwQciEjRjPcjAmdVKbVV13s=";
   };
 
-  cargoHash = "sha256-IzTXLwh14v4vjNgl37sFe1hgoA+0Izc9QWelaaArgU4=";
+  cargoHash = "sha256-OUwl9vBB8jMY40SbOc9YK4yyxvgWQTgQRWw2LN07W08=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/development/libraries/drumstick/default.nix b/pkgs/development/libraries/drumstick/default.nix
index 3f2b1ba026ab..bb23d1210404 100644
--- a/pkgs/development/libraries/drumstick/default.nix
+++ b/pkgs/development/libraries/drumstick/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "drumstick";
-  version = "2.9.1";
+  version = "2.10.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumstick/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-U5Cm9pTDxC8NzyQfjaC/eBBDUWELV4jq4ov4QGefM9g=";
+    hash = "sha256-rFoH1daXHiT3LZWQRP+buzMRQSWLJfGMgRtJ9XFy/L0=";
   };
 
   patches = [ ./drumstick-plugins.patch ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 4e15614ea378..08acdfba4eb3 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.15.0";
+  version = "3.16.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-heCebvYP1rrExuD7tAMwSsBsds0cbsPvzHLUtBjNwW0=";
+    tag = "v${version}";
+    hash = "sha256-0kvGEispsDpeTM1NXYb9HylskDONHP48NBn+JyBhSJ4=";
   };
 
   build-system = [ hatchling ];
@@ -91,11 +91,11 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  meta = with lib; {
+  meta = {
     description = "Modern and fully asynchronous framework for Telegram Bot API";
     homepage = "https://github.com/aiogram/aiogram";
-    changelog = "https://github.com/aiogram/aiogram/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
+    changelog = "https://github.com/aiogram/aiogram/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sikmir ];
   };
 }
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index 2d1acee4e2d4..f8ddd7971709 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2024.12.11.19";
+  version = "2024.12.23.19";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-ETEKQ3PC+wKD92QYKqly4EGge9tJgome0N3Vv7qf214=";
+    hash = "sha256-AX+UFQ+Usq9MzbnlZjZQXw9cP6fhO78iFsh0KsbZfw4=";
   };
 
   pythonRelaxDeps = [ "typer" ];
diff --git a/pkgs/development/python-modules/deal/default.nix b/pkgs/development/python-modules/deal/default.nix
index 99c962e5e814..f37377526fdf 100644
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -12,6 +12,7 @@
   pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
+  pythonAtLeast,
   sphinx,
   typeguard,
   urllib3,
@@ -52,26 +53,34 @@ buildPythonPackage rec {
     vaa
   ];
 
-  disabledTests = [
-    # Tests need internet access
-    "test_smoke_has"
-    "test_pure_offline"
-    "test_raises_doesnt_override_another_contract"
-    "test_raises_doesnt_override_another_contract_async"
-    "test_raises_generator"
-    # AttributeError: module 'vaa' has no attribute 'Error'
-    "test_source_vaa_scheme"
-    "test_vaa_scheme_and_custom_exception"
-    "test_scheme_string_validation_args_correct"
-    "test_method_chain_decorator_with_scheme_is_fulfilled"
-    "test_scheme_contract_is_satisfied_when_setting_arg"
-    "test_scheme_contract_is_satisfied_within_chain"
-    "test_scheme_errors_rewrite_message"
-    # assert errors
-    "test_doctest"
-    "test_no_violations"
-    "test_source_get_lambda_multiline_splitted_dec"
-  ];
+  disabledTests =
+    [
+      # Tests need internet access
+      "test_smoke_has"
+      "test_pure_offline"
+      "test_raises_doesnt_override_another_contract"
+      "test_raises_doesnt_override_another_contract_async"
+      "test_raises_generator"
+      # AttributeError: module 'vaa' has no attribute 'Error'
+      "test_source_vaa_scheme"
+      "test_vaa_scheme_and_custom_exception"
+      "test_scheme_string_validation_args_correct"
+      "test_method_chain_decorator_with_scheme_is_fulfilled"
+      "test_scheme_contract_is_satisfied_when_setting_arg"
+      "test_scheme_contract_is_satisfied_within_chain"
+      "test_scheme_errors_rewrite_message"
+      # assert errors
+      "test_doctest"
+      "test_no_violations"
+      "test_source_get_lambda_multiline_splitted_dec"
+      # assert basically correct but fails in string match due to '' removed
+      "test_unknown_command"
+    ]
+    ++ lib.optional (pythonAtLeast "3.13") [
+      # assert basically correct but string match fails in due to
+      # ('pathlib._local', 'Path.write_text') != ('pathlib', 'Path.write_text')
+      "test_infer"
+    ];
 
   disabledTestPaths = [
     # Test needs internet access
diff --git a/pkgs/development/python-modules/glfw/default.nix b/pkgs/development/python-modules/glfw/default.nix
index 56bb2a091748..d021271439d5 100644
--- a/pkgs/development/python-modules/glfw/default.nix
+++ b/pkgs/development/python-modules/glfw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "glfw";
-  version = "2.7.0";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "FlorianRhiem";
     repo = "pyGLFW";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9SNq8jKzgzFzonyMYoyjGbz4NDL83dPKWID9m3HZ7B8=";
+    hash = "sha256-3jcj4YExEtK1ANKDQsq94/NKF6GXXTFTEsXO3Jpf1uQ=";
   };
 
   # Patch path to GLFW shared object
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index f53a08e40555..911a852655ae 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "ha-mqtt-discoverable";
-  version = "0.16.2";
+  version = "0.16.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "unixorn";
     repo = "ha-mqtt-discoverable";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-2Ti03c9eyiBBJy5vTUMQddL2SE3Vyjc7gt/0LkgMkbE=";
+    tag = "v${version}";
+    hash = "sha256-9JRgg2A/tcZyAkuddQ/v3Dhxe60O47Y4VZY3Yb6/49g=";
   };
 
   pythonRelaxDeps = [ "pyaml" ];
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 3f9d0187105d..5bfe04b9e574 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -11,7 +11,6 @@
   stevedore,
   pytestCheckHook,
   setuptools,
-  fetchpatch,
   testtools,
   pytest-mock,
   nixosTests,
@@ -19,22 +18,15 @@
 
 buildPythonPackage rec {
   pname = "jenkins-job-builder";
-  version = "6.4.1";
+  version = "6.4.2";
 
   build-system = [ setuptools ];
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Re7rNAcm0cpSx1tmSzTjfDlW7y236lzFKFjVw0uUTmw=";
+    hash = "sha256-G+DVRd6o3GwTdFNnJkotIidrxexJZSdgCGXTA4KnJJA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://opendev.org/jjb/jenkins-job-builder/commit/7bf0dacd80d6da7b8562db05f9187140e42947c8.patch";
-      hash = "sha256-2z7axGgVV5Z7A11JiQhlrjjXDKYe+X6NrJEuXd986Do=";
-    })
-  ];
-
   postPatch = ''
     export HOME=$(mktemp -d)
   '';
diff --git a/pkgs/development/python-modules/lib4sbom/default.nix b/pkgs/development/python-modules/lib4sbom/default.nix
index e7e581174b61..be76325f2375 100644
--- a/pkgs/development/python-modules/lib4sbom/default.nix
+++ b/pkgs/development/python-modules/lib4sbom/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lib4sbom";
-  version = "0.7.5";
+  version = "0.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "anthonyharrison";
     repo = "lib4sbom";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-NWrHz4G5Ps5GoZUcx0LiSQzbTZlU4eGYgli6znG+NSs=";
+    tag = "v${version}";
+    hash = "sha256-OxYYHiV7TuPiLyd/rdrGfY3agv0vBcATaod37XYb7DY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
index ceaef4f91f14..f427fb1ff56a 100644
--- a/pkgs/development/python-modules/manifestoo-core/default.nix
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "manifestoo-core";
-  version = "1.8.1";
+  version = "1.8.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "manifestoo_core";
-    hash = "sha256-aULT5xxkWEndzEBVcpwvWlIXQYxwfF0VxoI6EHC3JAs=";
+    hash = "sha256-e/kpgGaaQqPI+4WeHXYpVc01t5vexHlmsDuAoGFShEM=";
   };
 
   nativeBuildInputs = [ hatch-vcs ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 992e16985df5..82520dd560de 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -454,12 +454,12 @@ rec {
       "sha256-0Xe77fz+lA+nuUGK+PjU0EgWeQ7AJ9Smsb/4yK1tow0=";
 
   mypy-boto3-ecr =
-    buildMypyBoto3Package "ecr" "1.35.87"
-      "sha256-XK9Q9fz05sI6XqO1BfGaZihfQhHssXgCf0GJONOBym8=";
+    buildMypyBoto3Package "ecr" "1.35.90"
+      "sha256-ocIOtpU5Ae9ggyXOTWY5LnpfGUnDHdG1e1XuO5q833w=";
 
   mypy-boto3-ecr-public =
-    buildMypyBoto3Package "ecr-public" "1.35.87"
-      "sha256-MvEGV9hSLsWPC+FoBH3K2F+DXvoeTSYfwE92QDp7ufU=";
+    buildMypyBoto3Package "ecr-public" "1.35.90"
+      "sha256-K63rvMDWrOWjyizRLwSs5DQn3ysF/VBqK2tVtiINx/0=";
 
   mypy-boto3-ecs =
     buildMypyBoto3Package "ecs" "1.35.83"
@@ -950,8 +950,8 @@ rec {
       "sha256-Epx+p5M+3x0plFaXdc8Rsz+p18ZnxbNlr4IhH5STvZM=";
 
   mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.35.52"
-      "sha256-i4h13QqDO65bSTlxdt5hN6iXag578jc3Mv7bOHBZkpQ=";
+    buildMypyBoto3Package "network-firewall" "1.35.88"
+      "sha256-36FYuBsY8ZQ6o+T7U2zZclhHPvIRbeLby9oSJyshxa4=";
 
   mypy-boto3-networkmanager =
     buildMypyBoto3Package "networkmanager" "1.35.81"
@@ -1086,8 +1086,8 @@ rec {
       "sha256-12AIEWhTwK3YdCUhImozJeO83Ye9G2D1VaKMeqbV/pE=";
 
   mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.35.82"
-      "sha256-P1yEz5IrOIwTjXFH0lD2WetEffFwCDoKfSWU2Qb6/08=";
+    buildMypyBoto3Package "rds" "1.35.89"
+      "sha256-1Xf5cjgBurcHiwvgEQCdv3Ry9sxhGLoE2DIXwcyJCgw=";
 
   mypy-boto3-rds-data =
     buildMypyBoto3Package "rds-data" "1.35.64"
@@ -1222,8 +1222,8 @@ rec {
       "sha256-w30YExW6ENhUaHIwTX8mbnRhQpsI5jUHwjzFCMPvQmQ=";
 
   mypy-boto3-securityhub =
-    buildMypyBoto3Package "securityhub" "1.35.72"
-      "sha256-+AeLQrA2MHQ94z4Rwq5/mhYc1+uJ0qZI1pm1FSnQOqM=";
+    buildMypyBoto3Package "securityhub" "1.35.88"
+      "sha256-s6qkdIPIwD4GUowrwg11EvyQu5rc9TBHXmkzPoxCE9Y=";
 
   mypy-boto3-securitylake =
     buildMypyBoto3Package "securitylake" "1.35.40"
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 578b64208adc..3259bee2721b 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -38,7 +38,7 @@ let
 in
 buildPythonPackage rec {
   pname = "patool";
-  version = "2.4.0";
+  version = "3.1.0";
   format = "setuptools";
 
   #pypi doesn't have test data
@@ -46,9 +46,14 @@ buildPythonPackage rec {
     owner = "wummel";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-dWyC8uTVUb06liNcJaG4oK9wqIDmwAl6i6cg4XRRRdQ=";
+    hash = "sha256-mt/GUIRJHB2/Rritc+uNkolZzguYy2G/NKnSKNxKsLk=";
   };
 
+  patches = [
+    # https://github.com/wummel/patool/pull/173
+    ./fix-rar-detection.patch
+  ];
+
   postPatch = ''
     substituteInPlace patoolib/util.py \
       --replace "path = None" 'path = os.environ["PATH"] + ":${lib.makeBinPath compression-utilities}"'
@@ -61,6 +66,10 @@ buildPythonPackage rec {
     "test_unzip_file"
     "test_zip"
     "test_zip_file"
+    "test_7z"
+    "test_7z_file"
+    "test_7za_file"
+    "test_p7azip"
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "test_ar" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/patool/fix-rar-detection.patch b/pkgs/development/python-modules/patool/fix-rar-detection.patch
new file mode 100644
index 000000000000..fa6d31038da8
--- /dev/null
+++ b/pkgs/development/python-modules/patool/fix-rar-detection.patch
@@ -0,0 +1,318 @@
+From d10324eac4429ff3d7d38ad24a19210699229e07 Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Wed, 11 Dec 2024 06:34:36 +0200
+Subject: [PATCH 1/4] Use application/gzip as the preferred mimetype for gzip
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ patoolib/__init__.py |  1 -
+ patoolib/mime.py     | 16 +++++++++++++---
+ tests/test_mime.py   |  4 ++--
+ 3 files changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/patoolib/__init__.py b/patoolib/__init__.py
+index d665a28a..2247b615 100644
+--- a/patoolib/__init__.py
++++ b/patoolib/__init__.py
+@@ -127,7 +127,6 @@
+     'application/x-cpio': 'cpio',
+     'application/x-debian-package': 'deb',
+     'application/x-dms': 'dms',
+-    'application/x-gzip': 'gzip',
+     'application/x-iso9660-image': 'iso',
+     'application/x-lz4': 'lz4',
+     'application/x-lzop': 'lzop',
+diff --git a/patoolib/mime.py b/patoolib/mime.py
+index 12405ada..c9d8894b 100644
+--- a/patoolib/mime.py
++++ b/patoolib/mime.py
+@@ -135,9 +135,11 @@ def guess_mime(filename: str) -> tuple[str | None, str | None]:
+ Mime2Encoding: dict[str, str] = dict(
+     [(_val, _key) for _key, _val in Encoding2Mime.items()]
+ )
+-# libmagic before version 5.14 identified .gz files as application/x-gzip
+-Mime2Encoding['application/x-gzip'] = 'gzip'
+ 
++LegacyMimeType: dict[str, str] = {
++    # libmagic before version 5.14 identified .gz files as application/x-gzip
++    'application/x-gzip': "application/gzip",
++}
+ 
+ def guess_mime_mimedb(filename: str) -> tuple[str | None, str | None]:
+     """Guess MIME type from given filename.
+@@ -192,6 +194,10 @@ def guess_mime_file(filename: str) -> tuple[str | None, str | None]:
+         except (OSError, subprocess.CalledProcessError) as err:
+             log_warning(f"error executing {cmd}: {err}")
+             mime2 = None
++
++        if mime2 in LegacyMimeType:
++            mime2 = LegacyMimeType[mime2]
++
+         # Some file(1) implementations return an empty or unknown mime type
+         # when the uncompressor program is not installed, other
+         # implementation return the original file type.
+@@ -227,6 +233,10 @@ def guess_mime_file_mime(
+     except OSError as err:
+         # ignore errors, as file(1) is only a fallback
+         log_warning(f"error executing {cmd}: {err}")
++
++    if mime in LegacyMimeType:
++        mime = LegacyMimeType[mime]
++
+     if mime not in ArchiveMimetypes:
+         mime, encoding = None, None
+     return mime, encoding
+@@ -253,7 +263,7 @@ def get_file_mime_encoding(parts: Sequence[str]) -> str | None:
+     "cpio archive": "application/x-cpio",
+     "ASCII cpio archive": "application/x-cpio",
+     "Debian binary package": "application/x-debian-package",
+-    "gzip compressed data": "application/x-gzip",
++    "gzip compressed data": "application/gzip",
+     "LZMA compressed data": "application/x-lzma",
+     "LRZIP compressed data": "application/x-lrzip",
+     "lzop compressed data": "application/x-lzop",
+diff --git a/tests/test_mime.py b/tests/test_mime.py
+index 40e73edf..3f292dfc 100644
+--- a/tests/test_mime.py
++++ b/tests/test_mime.py
+@@ -81,8 +81,8 @@ def test_mime_file(self):
+         self.mime_test_file("t.cpio.foo", "application/x-cpio")
+         self.mime_test_file("t.deb", "application/x-debian-package")
+         self.mime_test_file("t.deb.foo", "application/x-debian-package")
+-        self.mime_test_file("t.txt.gz", ("application/gzip", "application/x-gzip"))
+-        self.mime_test_file("t.txt.gz.foo", ("application/gzip", "application/x-gzip"))
++        self.mime_test_file("t.txt.gz", "application/gzip")
++        self.mime_test_file("t.txt.gz.foo", "application/gzip")
+         self.mime_test_file("t.jar", "application/zip")
+         self.mime_test_file("t.jar.foo", "application/zip")
+         self.mime_test_file("t.txt.lzma", "application/x-lzma")
+
+From e7501d1c7805696ff5b2ecc779f7a56ab2425c3f Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Wed, 11 Dec 2024 06:37:54 +0200
+Subject: [PATCH 2/4] Change rar mime type to application/vnd.rar
+
+https://github.com/file/file/commit/d46a1f3dbbf58eb510c1779b8bdcc59d5ee24ab9
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068700
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ patoolib/__init__.py |  2 +-
+ patoolib/mime.py     |  9 ++++++---
+ tests/test_mime.py   | 16 ++++++++--------
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/patoolib/__init__.py b/patoolib/__init__.py
+index 2247b615..8b13181c 100644
+--- a/patoolib/__init__.py
++++ b/patoolib/__init__.py
+@@ -136,7 +136,6 @@
+     'application/x-lrzip': 'lrzip',
+     'application/x-lzh': 'lzh',
+     'application/x-ms-wim': 'wim',
+-    'application/x-rar': 'rar',
+     'application/x-redhat-package-manager': 'rpm',
+     'application/x-rpm': 'rpm',
+     'application/x-rzip': 'rzip',
+@@ -147,6 +146,7 @@
+     'application/x-xz': 'xz',
+     'application/x-zip-compressed': 'zip',
+     'application/x-zoo': 'zoo',
++    'application/vnd.rar': 'rar',
+     'application/zip': 'zip',
+     'application/zpaq': 'zpaq',
+     "application/zstd": "zstd",
+diff --git a/patoolib/mime.py b/patoolib/mime.py
+index c9d8894b..8de9b180 100644
+--- a/patoolib/mime.py
++++ b/patoolib/mime.py
+@@ -54,8 +54,8 @@ def add_mimedb_data(mimedb: mimetypes.MimeTypes) -> None:
+     add_mimetype(mimedb, 'application/x-lzma', '.lzma')
+     add_mimetype(mimedb, 'application/x-xz', '.xz')
+     add_mimetype(mimedb, 'application/java-archive', '.jar')
+-    add_mimetype(mimedb, 'application/x-rar', '.rar')
+-    add_mimetype(mimedb, 'application/x-rar', '.cbr')
++    add_mimetype(mimedb, 'application/vnd.rar', '.rar')
++    add_mimetype(mimedb, 'application/vnd.rar', '.cbr')
+     add_mimetype(mimedb, 'application/x-7z-compressed', '.7z')
+     add_mimetype(mimedb, 'application/x-7z-compressed', '.cb7')
+     add_mimetype(mimedb, 'application/x-cab', '.cab')
+@@ -139,8 +139,11 @@ def guess_mime(filename: str) -> tuple[str | None, str | None]:
+ LegacyMimeType: dict[str, str] = {
+     # libmagic before version 5.14 identified .gz files as application/x-gzip
+     'application/x-gzip': "application/gzip",
++    # libmagic before version 5.46 identified .rar files as application/x-rar
++    'application/x-rar': "application/vnd.rar",
+ }
+ 
++
+ def guess_mime_mimedb(filename: str) -> tuple[str | None, str | None]:
+     """Guess MIME type from given filename.
+     @return: tuple (mime, encoding)
+@@ -268,7 +271,7 @@ def get_file_mime_encoding(parts: Sequence[str]) -> str | None:
+     "LRZIP compressed data": "application/x-lrzip",
+     "lzop compressed data": "application/x-lzop",
+     "Microsoft Cabinet archive data": "application/vnd.ms-cab-compressed",
+-    "RAR archive data": "application/x-rar",
++    "RAR archive data": "application/vnd.rar",
+     "RPM ": "application/x-redhat-package-manager",
+     "POSIX tar archive": "application/x-tar",
+     "xz compressed data": "application/x-xz",
+diff --git a/tests/test_mime.py b/tests/test_mime.py
+index 3f292dfc..8f3ecb8c 100644
+--- a/tests/test_mime.py
++++ b/tests/test_mime.py
+@@ -91,10 +91,10 @@ def test_mime_file(self):
+         self.mime_test_file("t.txt.lz.foo", "application/x-lzip")
+         self.mime_test_file("t.txt.lzo", "application/x-lzop")
+         self.mime_test_file("t.txt.lzo.foo", "application/x-lzop")
+-        self.mime_test_file("t.rar", "application/x-rar")
+-        self.mime_test_file("t.rar.foo", "application/x-rar")
+-        self.mime_test_file("t.cbr", "application/x-rar")
+-        self.mime_test_file("t.cbr.foo", "application/x-rar")
++        self.mime_test_file("t.rar", "application/vnd.rar")
++        self.mime_test_file("t.rar.foo", "application/vnd.rar")
++        self.mime_test_file("t.cbr", "application/vnd.rar")
++        self.mime_test_file("t.cbr.foo", "application/vnd.rar")
+         self.mime_test_file("t.rpm", "application/x-rpm")
+         self.mime_test_file("t.rpm.foo", "application/x-rpm")
+         self.mime_test_file("t.tar", "application/x-tar")
+@@ -197,8 +197,8 @@ def test_nested_gzip(self):
+         """Test mime detection of archives with double compression"""
+         # We won't extract this with rar, as it doesn't support archives wrapped in gzip
+         # compression, but we will recognize the archive as a gzip-wrapped rar-file
+-        self.mime_test_file("t.rar.gz", "application/x-rar", "gzip")
+-        self.mime_test_file("t.rar.gz.foo", "application/x-rar", "gzip")
++        self.mime_test_file("t.rar.gz", "application/vnd.rar", "gzip")
++        self.mime_test_file("t.rar.gz.foo", "application/vnd.rar", "gzip")
+ 
+     @needs_program('file')
+     @needs_program('gzip')
+@@ -237,7 +237,7 @@ def test_mime_mimedb(self):
+         self.mime_test_mimedb("t .bz2", "application/x-bzip2")
+         self.mime_test_mimedb("t .bz3", "application/x-bzip3")
+         self.mime_test_mimedb("t.cab", "application/x-cab")
+-        self.mime_test_mimedb("t.cbr", ("application/rar", "application/x-rar"))
++        self.mime_test_mimedb("t.cbr", ("application/rar", "application/vnd.rar"))
+         self.mime_test_mimedb("t.cpio", "application/x-cpio")
+         self.mime_test_mimedb("t.deb", "application/x-debian-package")
+         self.mime_test_mimedb("t.gz", "application/gzip")
+@@ -247,7 +247,7 @@ def test_mime_mimedb(self):
+         self.mime_test_mimedb("t.txt.lz", "application/x-lzip")
+         self.mime_test_mimedb("t.txt.lz4", "application/x-lz4")
+         self.mime_test_mimedb("t.lzo", "application/x-lzop")
+-        self.mime_test_mimedb("t.rar", ("application/rar", "application/x-rar"))
++        self.mime_test_mimedb("t.rar", ("application/rar", "application/vnd.rar"))
+         self.mime_test_mimedb(
+             "t.rpm", ("application/x-redhat-package-manager", "application/x-rpm")
+         )
+
+From 85fafd16ec01a7eb793e04011617bb47211d446a Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Wed, 11 Dec 2024 06:40:41 +0200
+Subject: [PATCH 3/4] Remove references to application/rar
+
+application/vnd.rar is the IANA assigned mime type for rar. libmagic has
+never refered to application/rar either, so there is no use for backwards
+compatibility.
+
+https://www.iana.org/assignments/media-types/application/vnd.rar
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ patoolib/__init__.py | 1 -
+ tests/test_mime.py   | 4 ++--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/patoolib/__init__.py b/patoolib/__init__.py
+index 8b13181c..51f8b4eb 100644
+--- a/patoolib/__init__.py
++++ b/patoolib/__init__.py
+@@ -110,7 +110,6 @@
+     'application/jar': 'zip',  # reported on older systems such as ubuntu 14.04
+     'application/java-archive': 'zip',
+     'application/vnd.android.package-archive': 'zip',
+-    'application/rar': 'rar',
+     'application/vnd.ms-cab-compressed': 'cab',
+     'application/x-7z-compressed': '7z',
+     'application/x-ace': 'ace',
+diff --git a/tests/test_mime.py b/tests/test_mime.py
+index 8f3ecb8c..287d8208 100644
+--- a/tests/test_mime.py
++++ b/tests/test_mime.py
+@@ -237,7 +237,7 @@ def test_mime_mimedb(self):
+         self.mime_test_mimedb("t .bz2", "application/x-bzip2")
+         self.mime_test_mimedb("t .bz3", "application/x-bzip3")
+         self.mime_test_mimedb("t.cab", "application/x-cab")
+-        self.mime_test_mimedb("t.cbr", ("application/rar", "application/vnd.rar"))
++        self.mime_test_mimedb("t.cbr", "application/vnd.rar")
+         self.mime_test_mimedb("t.cpio", "application/x-cpio")
+         self.mime_test_mimedb("t.deb", "application/x-debian-package")
+         self.mime_test_mimedb("t.gz", "application/gzip")
+@@ -247,7 +247,7 @@ def test_mime_mimedb(self):
+         self.mime_test_mimedb("t.txt.lz", "application/x-lzip")
+         self.mime_test_mimedb("t.txt.lz4", "application/x-lz4")
+         self.mime_test_mimedb("t.lzo", "application/x-lzop")
+-        self.mime_test_mimedb("t.rar", ("application/rar", "application/vnd.rar"))
++        self.mime_test_mimedb("t.rar", "application/vnd.rar")
+         self.mime_test_mimedb(
+             "t.rpm", ("application/x-redhat-package-manager", "application/x-rpm")
+         )
+
+From bab80a04a72941b3c53e5fce1f96f5a2fc531280 Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Wed, 11 Dec 2024 07:04:19 +0200
+Subject: [PATCH 4/4] Remove references to application/x-redhat-package-manager
+
+libmagic has never referred to x-redhat-package-manager and has had
+x-rpm since 3.30. Red Hat themselves use x-rpm in their mailcap.
+
+https://pagure.io/mailcap/blob/master/f/mime.types
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ patoolib/__init__.py | 1 -
+ patoolib/mime.py     | 2 +-
+ tests/test_mime.py   | 4 +---
+ 3 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/patoolib/__init__.py b/patoolib/__init__.py
+index 51f8b4eb..9d8bc849 100644
+--- a/patoolib/__init__.py
++++ b/patoolib/__init__.py
+@@ -135,7 +135,6 @@
+     'application/x-lrzip': 'lrzip',
+     'application/x-lzh': 'lzh',
+     'application/x-ms-wim': 'wim',
+-    'application/x-redhat-package-manager': 'rpm',
+     'application/x-rpm': 'rpm',
+     'application/x-rzip': 'rzip',
+     'application/x-shar': 'shar',
+diff --git a/patoolib/mime.py b/patoolib/mime.py
+index 8de9b180..ffad9cd0 100644
+--- a/patoolib/mime.py
++++ b/patoolib/mime.py
+@@ -272,7 +272,7 @@ def get_file_mime_encoding(parts: Sequence[str]) -> str | None:
+     "lzop compressed data": "application/x-lzop",
+     "Microsoft Cabinet archive data": "application/vnd.ms-cab-compressed",
+     "RAR archive data": "application/vnd.rar",
+-    "RPM ": "application/x-redhat-package-manager",
++    "RPM ": "application/x-rpm",
+     "POSIX tar archive": "application/x-tar",
+     "xz compressed data": "application/x-xz",
+     "Zip archive data": "application/zip",
+diff --git a/tests/test_mime.py b/tests/test_mime.py
+index 287d8208..a337f87a 100644
+--- a/tests/test_mime.py
++++ b/tests/test_mime.py
+@@ -248,9 +248,7 @@ def test_mime_mimedb(self):
+         self.mime_test_mimedb("t.txt.lz4", "application/x-lz4")
+         self.mime_test_mimedb("t.lzo", "application/x-lzop")
+         self.mime_test_mimedb("t.rar", "application/vnd.rar")
+-        self.mime_test_mimedb(
+-            "t.rpm", ("application/x-redhat-package-manager", "application/x-rpm")
+-        )
++        self.mime_test_mimedb("t.rpm", "application/x-rpm")
+         self.mime_test_mimedb("t.tar", "application/x-tar")
+         self.mime_test_mimedb("t.cbt", "application/x-tar")
+         self.mime_test_mimedb("t.tar.bz2", "application/x-tar", "bzip2")
diff --git a/pkgs/development/python-modules/picos/default.nix b/pkgs/development/python-modules/picos/default.nix
index 5d5e715ec648..0dbc12aa42a4 100644
--- a/pkgs/development/python-modules/picos/default.nix
+++ b/pkgs/development/python-modules/picos/default.nix
@@ -1,41 +1,57 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitLab,
+  fetchPypi,
   numpy,
   cvxopt,
   python,
   networkx,
+  scipy,
+  pythonOlder,
+  stdenv,
 }:
 
 buildPythonPackage rec {
   pname = "picos";
-  version = "2.0";
+  version = "2.5.1";
   format = "setuptools";
 
-  src = fetchFromGitLab {
-    owner = "picos-api";
-    repo = "picos";
-    rev = "v${version}";
-    sha256 = "1k65iq791k5r08gh2kc6iz0xw1wyzqik19j6iam8ip732r7jm607";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Zmtzhfeu0FURK7pCDJ7AsZc6ElZfrt73rVH3g8OkkCs=";
   };
 
   # Needed only for the tests
   nativeCheckInputs = [ networkx ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     cvxopt
+    scipy
   ];
 
+  postPatch =
+    lib.optionalString (pythonOlder "3.12") ''
+      substituteInPlace picos/modeling/problem.py \
+        --replace-fail "mappingproxy(OrderedDict({'x': <3×1 Real Variable: x>}))" "mappingproxy(OrderedDict([('x', <3×1 Real Variable: x>)]))"
+    ''
+    # TypeError: '<=' not supported between instances of 'ComplexAffineExpression' and 'float'
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+      rm tests/ptest_quantentr.py
+    '';
+
   checkPhase = ''
+    runHook preCheck
+
     ${python.interpreter} test.py
+
+    runHook postCheck
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Python interface to conic optimization solvers";
     homepage = "https://gitlab.com/picos-api/picos";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ tobiasBora ];
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ tobiasBora ];
   };
 }
diff --git a/pkgs/development/python-modules/pmdarima/default.nix b/pkgs/development/python-modules/pmdarima/default.nix
index 0b03e9bcf6bb..5a98e4569a32 100644
--- a/pkgs/development/python-modules/pmdarima/default.nix
+++ b/pkgs/development/python-modules/pmdarima/default.nix
@@ -14,25 +14,45 @@
   pythonOlder,
   python,
   pytest7CheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pmdarima";
   version = "2.0.4";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "alkaline-ml";
     repo = "pmdarima";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-LHwPgQRB/vP3hBM8nqafoCrN3ZSRIMWLzqTqDOETOEc=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy==" "numpy>=" \
+      --replace-fail "scipy==" "scipy>=" \
+      --replace-fail "statsmodels==" "statsmodels>="
+  '';
+
+  env = {
+    GITHUB_REF = "refs/tags/v${version}";
+  };
+
+  preBuild = ''
+    python build_tools/get_tag.py
+  '';
+
   nativeBuildInputs = [ cython ];
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     joblib
     numpy
     pandas
@@ -60,11 +80,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pmdarima" ];
 
-  meta = with lib; {
+  meta = {
     description = "Statistical library designed to fill the void in Python's time series analysis capabilities, including the equivalent of R's auto.arima function";
     homepage = "https://github.com/alkaline-ml/pmdarima";
     changelog = "https://github.com/alkaline-ml/pmdarima/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mbalatsko ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mbalatsko ];
   };
 }
diff --git a/pkgs/development/python-modules/pydata-google-auth/default.nix b/pkgs/development/python-modules/pydata-google-auth/default.nix
index 727ac93f47b6..37a1fdae1ee0 100644
--- a/pkgs/development/python-modules/pydata-google-auth/default.nix
+++ b/pkgs/development/python-modules/pydata-google-auth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pydata-google-auth";
-  version = "1.8.2";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     repo = "pydata-google-auth";
     owner = "pydata";
     rev = "refs/tags/${version}";
-    hash = "sha256-Wo+tXbzOuz/cW8GuWoSxLA/Lr2S9NMdePa8tIV39mbY=";
+    hash = "sha256-Vel8xSDX0djNwlICXE/ON3G4m0dWmynl8fHfDhaZhbI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index e59c4d98c69d..ae019e8dbe2b 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "2.8.3";
+  version = "2.8.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "humbertogontijo";
     repo = "python-roborock";
     tag = "v${version}";
-    hash = "sha256-auKqv9fD8ensL3k5RbaCNzwrCO7Sd210CFUJROSdEjc=";
+    hash = "sha256-/VDDonWJ/BdWjOzIFSddh9dZEZxIP2XwODsOpnPKbHs=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/corefreq/default.nix b/pkgs/os-specific/linux/corefreq/default.nix
index 0f716e145630..406da48fc806 100644
--- a/pkgs/os-specific/linux/corefreq/default.nix
+++ b/pkgs/os-specific/linux/corefreq/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corefreq";
-  version = "1.98.7";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "cyring";
     repo = "CoreFreq";
     rev = version;
-    hash = "sha256-/kvDwIEUbcO80keG3w3x3IfLaXbrbaptUAJxvDh5rlY=";
+    hash = "sha256-onpr9SsoYifomdSijZ2M5cSShfs8s2q9cbVYN4g3bBo=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index b2bb6c396000..f414b1a3f8d9 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.34.1";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     rev = "v${version}";
-    hash = "sha256-UQ91Xjw7RTtTMCrCKyv8tk08hhgyXbjG+QKuVjNk4kM=";
+    hash = "sha256-PgJm0+HqJMdDjbX+9a86BmicArJCiegf4n7A1sHNQ0Y=";
   };
 
-  vendorHash = "sha256-8ML6s+XPhciYHhWfUOQqgN2XSSqgZ9ULZ6+arWgQjMY=";
+  vendorHash = "sha256-CgfZZOiFDLf6vCbzovpwzt7FlO9BnzNSdR8e5U+xCDQ=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 9f92da1b2755..0a9f52ae6ef2 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.87.0";
+  version = "3.88.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xdRd2k8yZUVnAoQ2MjrbeP5RqLIu27+A0bXOIR6zZtQ=";
+    hash = "sha256-IAvVdq59epg/zQ8lLHlewIDBxZD5FmAYCt1xrJlghzM=";
   };
 
-  vendorHash = "sha256-M8qasSqn0NdQOk7/Sq0NhK/YFMjJSrPRF61h5k3MPB0=";
+  vendorHash = "sha256-/wuv72PZGdEiTFuurBQJ+K4lunnkR51CrkyHaVb+/kY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d4c3970a940b..a368b2933e36 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1199,6 +1199,7 @@ mapAliases {
   sexp = sexpp; # Added 2023-07-03
   inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
   shipyard = jumppad; # Added 2023-06-06
+  siduck76-st = st-snazzy; # Added 2024-12-24
   signal-desktop-beta = throw "signal-desktop-beta has been removed to make the signal-desktop package easier to maintain";
   shout = nodePackages.shout; # Added unknown; moved 2024-10-19
   sky = throw "'sky' has been removed because its upstream website disappeared"; # Added 2024-07-21
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 164f64ad2733..2d7ebfe2dd2c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1570,7 +1570,6 @@ with pkgs;
   };
   xst = callPackage ../applications/terminal-emulators/st/xst.nix { };
   mcaimi-st = callPackage ../applications/terminal-emulators/st/mcaimi-st.nix { };
-  siduck76-st = callPackage ../applications/terminal-emulators/st/siduck76-st.nix { };
 
   stupidterm = callPackage ../applications/terminal-emulators/stupidterm {
     gtk = gtk3;
@@ -8348,7 +8347,8 @@ with pkgs;
 
   qtcreator = qt6Packages.callPackage ../development/tools/qtcreator {
     inherit (linuxPackages) perf;
-    stdenv = llvmPackages.stdenv;
+    llvmPackages = llvmPackages_18;
+    stdenv = llvmPackages_18.stdenv;
   };
 
   qxmledit = libsForQt5.callPackage ../applications/editors/qxmledit {} ;