diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e7464e9e5a75..945e407cb9e4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13573,7 +13573,7 @@
   };
   lgcl = {
     email = "dev@lgcl.de";
-    name = "Leon Vack";
+    name = "Leonie Marcy Vack";
     github = "LogicalOverflow";
     githubId = 5919957;
   };
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index a49ff9fa5d66..4deb34e50ec5 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -474,7 +474,7 @@ in
         after = [ "zfs.target" ];
 
         path = with pkgs; [
-          zfs
+          config.boot.zfs.package
           mbuffer
           openssh
         ];
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index b86b8e63f409..4911d7871412 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -458,7 +458,7 @@ in
       type = with lib.types; either str (listOf str);
       default = [ ];
       example = [
-        "--no-deploy traefik"
+        "--disable traefik"
         "--cluster-cidr 10.24.0.0/16"
       ];
     };
diff --git a/nixos/modules/services/misc/bees.nix b/nixos/modules/services/misc/bees.nix
index b16552a8eecd..2815bb035cb7 100644
--- a/nixos/modules/services/misc/bees.nix
+++ b/nixos/modules/services/misc/bees.nix
@@ -97,42 +97,29 @@ in
       '';
     };
   };
-  config = {
+  config = lib.mkIf (cfg.filesystems != { }) {
+    systemd.packages = [ pkgs.bees ];
     systemd.services = lib.mapAttrs' (
       name: fs:
       lib.nameValuePair "beesd@${name}" {
-        description = "Block-level BTRFS deduplication for %i";
-        after = [ "sysinit.target" ];
-
-        serviceConfig =
-          let
-            configOpts = [
-              fs.spec
-              "verbosity=${toString fs.verbosity}"
-              "idxSizeMB=${toString fs.hashTableSizeMB}"
-              "workDir=${fs.workDir}"
+        overrideStrategy = "asDropin";
+        serviceConfig = {
+          ExecStart =
+            let
+              configOpts = [
+                fs.spec
+                "verbosity=${toString fs.verbosity}"
+                "idxSizeMB=${toString fs.hashTableSizeMB}"
+                "workDir=${fs.workDir}"
+              ];
+              configOptsStr = lib.escapeShellArgs configOpts;
+            in
+            [
+              ""
+              "${pkgs.bees}/bin/bees-service-wrapper run ${configOptsStr} -- --no-timestamps ${lib.escapeShellArgs fs.extraOptions}"
             ];
-            configOptsStr = lib.escapeShellArgs configOpts;
-          in
-          {
-            # Values from https://github.com/Zygo/bees/blob/v0.6.5/scripts/beesd@.service.in
-            ExecStart = "${pkgs.bees}/bin/bees-service-wrapper run ${configOptsStr} -- --no-timestamps ${lib.escapeShellArgs fs.extraOptions}";
-            ExecStopPost = "${pkgs.bees}/bin/bees-service-wrapper cleanup ${configOptsStr}";
-            CPUAccounting = true;
-            CPUSchedulingPolicy = "batch";
-            CPUWeight = 12;
-            IOSchedulingClass = "idle";
-            IOSchedulingPriority = 7;
-            IOWeight = 10;
-            KillMode = "control-group";
-            KillSignal = "SIGTERM";
-            MemoryAccounting = true;
-            Nice = 19;
-            Restart = "on-abnormal";
-            StartupCPUWeight = 25;
-            StartupIOWeight = 25;
-            SyslogIdentifier = "beesd"; # would otherwise be "bees-service-wrapper"
-          };
+          SyslogIdentifier = "beesd"; # would otherwise be "bees-service-wrapper"
+        };
         unitConfig.RequiresMountsFor = lib.mkIf (lib.hasPrefix "/" fs.spec) fs.spec;
         wantedBy = [ "multi-user.target" ];
       }
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index ab425e74eaf6..308ae1278a1b 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -226,7 +226,7 @@ in
         (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for
         both an IPv4 and an IPv6 address before forking.
         The option "if-carrier-up" is equivalent to "any" if either ethernet
-        is plugged nor WiFi is powered, and to "background" otherwise.
+        is plugged or WiFi is powered, and to "background" otherwise.
       '';
     };
 
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 3adc7f0bb0be..b2dc4a57fa44 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -908,7 +908,6 @@ in
           TemporaryFileSystem = "/:ro";
         }
       ];
-      environment.RUST_LOG = "info";
     };
 
     systemd.services.kanidm-unixd = mkIf cfg.enablePam {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fbe35b84859a..62f52b0e4056 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -800,11 +800,11 @@ in
   mopidy = handleTest ./mopidy.nix { };
   morph-browser = runTest ./morph-browser.nix;
   morty = handleTest ./morty.nix { };
-  mosquitto = handleTest ./mosquitto.nix { };
+  mosquitto = runTest ./mosquitto.nix;
   moosefs = handleTest ./moosefs.nix { };
   movim = discoverTests (import ./web-apps/movim { inherit handleTestOn; });
   mpd = handleTest ./mpd.nix { };
-  mpv = handleTest ./mpv.nix { };
+  mpv = runTest ./mpv.nix;
   mtp = handleTest ./mtp.nix { };
   multipass = handleTest ./multipass.nix { };
   mumble = handleTest ./mumble.nix { };
diff --git a/nixos/tests/mosquitto.nix b/nixos/tests/mosquitto.nix
index 30c7e3bcd32c..e4bdb106b8e0 100644
--- a/nixos/tests/mosquitto.nix
+++ b/nixos/tests/mosquitto.nix
@@ -1,229 +1,227 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, ... }:
 
-  let
-    port = 1888;
-    tlsPort = 1889;
-    anonPort = 1890;
-    password = "VERY_secret";
-    hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
-    topic = "test/foo";
+let
+  port = 1888;
+  tlsPort = 1889;
+  anonPort = 1890;
+  password = "VERY_secret";
+  hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
+  topic = "test/foo";
 
-    snakeOil =
-      pkgs.runCommand "snakeoil-certs"
-        {
-          buildInputs = [ pkgs.gnutls.bin ];
-          caTemplate = pkgs.writeText "snakeoil-ca.template" ''
-            cn = server
-            expiration_days = -1
-            cert_signing_key
-            ca
-          '';
-          certTemplate = pkgs.writeText "snakeoil-cert.template" ''
-            cn = server
-            expiration_days = -1
-            tls_www_server
-            encryption_key
-            signing_key
-          '';
-          userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
-            organization = snakeoil
-            cn = client1
-            expiration_days = -1
-            tls_www_client
-            encryption_key
-            signing_key
-          '';
-        }
-        ''
-          mkdir "$out"
-
-          certtool -p --bits 2048 --outfile "$out/ca.key"
-          certtool -s --template "$caTemplate" --load-privkey "$out/ca.key" \
-                      --outfile "$out/ca.crt"
-          certtool -p --bits 2048 --outfile "$out/server.key"
-          certtool -c --template "$certTemplate" \
-                      --load-ca-privkey "$out/ca.key" \
-                      --load-ca-certificate "$out/ca.crt" \
-                      --load-privkey "$out/server.key" \
-                      --outfile "$out/server.crt"
-
-          certtool -p --bits 2048 --outfile "$out/client1.key"
-          certtool -c --template "$userCertTemplate" \
-                      --load-privkey "$out/client1.key" \
-                      --load-ca-privkey "$out/ca.key" \
-                      --load-ca-certificate "$out/ca.crt" \
-                      --outfile "$out/client1.crt"
+  snakeOil =
+    pkgs.runCommand "snakeoil-certs"
+      {
+        buildInputs = [ pkgs.gnutls.bin ];
+        caTemplate = pkgs.writeText "snakeoil-ca.template" ''
+          cn = server
+          expiration_days = -1
+          cert_signing_key
+          ca
         '';
+        certTemplate = pkgs.writeText "snakeoil-cert.template" ''
+          cn = server
+          expiration_days = -1
+          tls_www_server
+          encryption_key
+          signing_key
+        '';
+        userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
+          organization = snakeoil
+          cn = client1
+          expiration_days = -1
+          tls_www_client
+          encryption_key
+          signing_key
+        '';
+      }
+      ''
+        mkdir "$out"
 
-  in
-  {
-    name = "mosquitto";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ peterhoeg ];
+        certtool -p --bits 2048 --outfile "$out/ca.key"
+        certtool -s --template "$caTemplate" --load-privkey "$out/ca.key" \
+                    --outfile "$out/ca.crt"
+        certtool -p --bits 2048 --outfile "$out/server.key"
+        certtool -c --template "$certTemplate" \
+                    --load-ca-privkey "$out/ca.key" \
+                    --load-ca-certificate "$out/ca.crt" \
+                    --load-privkey "$out/server.key" \
+                    --outfile "$out/server.crt"
+
+        certtool -p --bits 2048 --outfile "$out/client1.key"
+        certtool -c --template "$userCertTemplate" \
+                    --load-privkey "$out/client1.key" \
+                    --load-ca-privkey "$out/ca.key" \
+                    --load-ca-certificate "$out/ca.crt" \
+                    --outfile "$out/client1.crt"
+      '';
+
+in
+{
+  name = "mosquitto";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+
+  nodes =
+    let
+      client =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = with pkgs; [ mosquitto ];
+        };
+    in
+    {
+      server =
+        { pkgs, ... }:
+        {
+          networking.firewall.allowedTCPPorts = [
+            port
+            tlsPort
+            anonPort
+          ];
+          networking.useNetworkd = true;
+          services.mosquitto = {
+            enable = true;
+            settings = {
+              sys_interval = 1;
+            };
+            listeners = [
+              {
+                inherit port;
+                users = {
+                  password_store = {
+                    inherit password;
+                  };
+                  password_file = {
+                    passwordFile = pkgs.writeText "mqtt-password" password;
+                  };
+                  hashed_store = {
+                    inherit hashedPassword;
+                  };
+                  hashed_file = {
+                    hashedPasswordFile = pkgs.writeText "mqtt-hashed-password" hashedPassword;
+                  };
+
+                  reader = {
+                    inherit password;
+                    acl = [
+                      "read ${topic}"
+                      "read $SYS/#" # so we always have something to read
+                    ];
+                  };
+                  writer = {
+                    inherit password;
+                    acl = [ "write ${topic}" ];
+                  };
+                };
+              }
+              {
+                port = tlsPort;
+                users.client1 = {
+                  acl = [ "read $SYS/#" ];
+                };
+                settings = {
+                  cafile = "${snakeOil}/ca.crt";
+                  certfile = "${snakeOil}/server.crt";
+                  keyfile = "${snakeOil}/server.key";
+                  require_certificate = true;
+                  use_identity_as_username = true;
+                };
+              }
+              {
+                port = anonPort;
+                omitPasswordAuth = true;
+                settings.allow_anonymous = true;
+                acl = [ "pattern read #" ];
+                users = {
+                  anonWriter = {
+                    password = "<ignored>" + password;
+                    acl = [ "write ${topic}" ];
+                  };
+                };
+              }
+            ];
+          };
+        };
+
+      client1 = client;
+      client2 = client;
     };
 
-    nodes =
-      let
-        client =
-          { pkgs, ... }:
-          {
-            environment.systemPackages = with pkgs; [ mosquitto ];
-          };
-      in
-      {
-        server =
-          { pkgs, ... }:
-          {
-            networking.firewall.allowedTCPPorts = [
-              port
-              tlsPort
-              anonPort
-            ];
-            networking.useNetworkd = true;
-            services.mosquitto = {
-              enable = true;
-              settings = {
-                sys_interval = 1;
-              };
-              listeners = [
-                {
-                  inherit port;
-                  users = {
-                    password_store = {
-                      inherit password;
-                    };
-                    password_file = {
-                      passwordFile = pkgs.writeText "mqtt-password" password;
-                    };
-                    hashed_store = {
-                      inherit hashedPassword;
-                    };
-                    hashed_file = {
-                      hashedPasswordFile = pkgs.writeText "mqtt-hashed-password" hashedPassword;
-                    };
-
-                    reader = {
-                      inherit password;
-                      acl = [
-                        "read ${topic}"
-                        "read $SYS/#" # so we always have something to read
-                      ];
-                    };
-                    writer = {
-                      inherit password;
-                      acl = [ "write ${topic}" ];
-                    };
-                  };
-                }
-                {
-                  port = tlsPort;
-                  users.client1 = {
-                    acl = [ "read $SYS/#" ];
-                  };
-                  settings = {
-                    cafile = "${snakeOil}/ca.crt";
-                    certfile = "${snakeOil}/server.crt";
-                    keyfile = "${snakeOil}/server.key";
-                    require_certificate = true;
-                    use_identity_as_username = true;
-                  };
-                }
-                {
-                  port = anonPort;
-                  omitPasswordAuth = true;
-                  settings.allow_anonymous = true;
-                  acl = [ "pattern read #" ];
-                  users = {
-                    anonWriter = {
-                      password = "<ignored>" + password;
-                      acl = [ "write ${topic}" ];
-                    };
-                  };
-                }
-              ];
-            };
-          };
-
-        client1 = client;
-        client2 = client;
-      };
-
-    testScript = ''
-      def mosquitto_cmd(binary, user, topic, port):
-          return (
-              "mosquitto_{} "
-              "-V mqttv311 "
-              "-h server "
-              "-p {} "
-              "-u {} "
-              "-P '${password}' "
-              "-t '{}'"
-          ).format(binary, port, user, topic)
+  testScript = ''
+    def mosquitto_cmd(binary, user, topic, port):
+        return (
+            "mosquitto_{} "
+            "-V mqttv311 "
+            "-h server "
+            "-p {} "
+            "-u {} "
+            "-P '${password}' "
+            "-t '{}'"
+        ).format(binary, port, user, topic)
 
 
-      def publish(args, user, topic="${topic}", port=${toString port}):
-          return "{} {}".format(mosquitto_cmd("pub", user, topic, port), args)
+    def publish(args, user, topic="${topic}", port=${toString port}):
+        return "{} {}".format(mosquitto_cmd("pub", user, topic, port), args)
 
-      def subscribe(args, user, topic="${topic}", port=${toString port}):
-          return "{} -W 5 -C 1 {}".format(mosquitto_cmd("sub", user, topic, port), args)
+    def subscribe(args, user, topic="${topic}", port=${toString port}):
+        return "{} -W 5 -C 1 {}".format(mosquitto_cmd("sub", user, topic, port), args)
 
-      def parallel(*fns):
-          from threading import Thread
-          threads = [ Thread(target=fn) for fn in fns ]
-          for t in threads: t.start()
-          for t in threads: t.join()
+    def parallel(*fns):
+        from threading import Thread
+        threads = [ Thread(target=fn) for fn in fns ]
+        for t in threads: t.start()
+        for t in threads: t.join()
 
-      def wait_uuid(uuid):
-          server.wait_for_console_text(uuid)
-          return None
+    def wait_uuid(uuid):
+        server.wait_for_console_text(uuid)
+        return None
 
 
-      start_all()
-      server.wait_for_unit("mosquitto.service")
+    start_all()
+    server.wait_for_unit("mosquitto.service")
 
-      with subtest("check passwords"):
-          client1.succeed(publish("-m test", "password_store"))
-          client1.succeed(publish("-m test", "password_file"))
-          client1.succeed(publish("-m test", "hashed_store"))
-          client1.succeed(publish("-m test", "hashed_file"))
+    with subtest("check passwords"):
+        client1.succeed(publish("-m test", "password_store"))
+        client1.succeed(publish("-m test", "password_file"))
+        client1.succeed(publish("-m test", "hashed_store"))
+        client1.succeed(publish("-m test", "hashed_file"))
 
-      with subtest("check acl"):
-          client1.succeed(subscribe("", "reader", topic="$SYS/#"))
-          client1.fail(subscribe("", "writer", topic="$SYS/#"))
+    with subtest("check acl"):
+        client1.succeed(subscribe("", "reader", topic="$SYS/#"))
+        client1.fail(subscribe("", "writer", topic="$SYS/#"))
 
-          parallel(
-              lambda: client1.succeed(subscribe("-i 3688cdd7-aa07-42a4-be22-cb9352917e40", "reader")),
-              lambda: [
-                  wait_uuid("3688cdd7-aa07-42a4-be22-cb9352917e40"),
-                  client2.succeed(publish("-m test", "writer"))
-              ])
+        parallel(
+            lambda: client1.succeed(subscribe("-i 3688cdd7-aa07-42a4-be22-cb9352917e40", "reader")),
+            lambda: [
+                wait_uuid("3688cdd7-aa07-42a4-be22-cb9352917e40"),
+                client2.succeed(publish("-m test", "writer"))
+            ])
 
-          parallel(
-              lambda: client1.fail(subscribe("-i 24ff16a2-ae33-4a51-9098-1b417153c712", "reader")),
-              lambda: [
-                  wait_uuid("24ff16a2-ae33-4a51-9098-1b417153c712"),
-                  client2.succeed(publish("-m test", "reader"))
-              ])
+        parallel(
+            lambda: client1.fail(subscribe("-i 24ff16a2-ae33-4a51-9098-1b417153c712", "reader")),
+            lambda: [
+                wait_uuid("24ff16a2-ae33-4a51-9098-1b417153c712"),
+                client2.succeed(publish("-m test", "reader"))
+            ])
 
-      with subtest("check tls"):
-          client1.succeed(
-              subscribe(
-                  "--cafile ${snakeOil}/ca.crt "
-                  "--cert ${snakeOil}/client1.crt "
-                  "--key ${snakeOil}/client1.key",
-                  topic="$SYS/#",
-                  port=${toString tlsPort},
-                  user="no_such_user"))
+    with subtest("check tls"):
+        client1.succeed(
+            subscribe(
+                "--cafile ${snakeOil}/ca.crt "
+                "--cert ${snakeOil}/client1.crt "
+                "--key ${snakeOil}/client1.key",
+                topic="$SYS/#",
+                port=${toString tlsPort},
+                user="no_such_user"))
 
-      with subtest("check omitPasswordAuth"):
-          parallel(
-              lambda: client1.succeed(subscribe("-i fd56032c-d9cb-4813-a3b4-6be0e04c8fc3",
-                  "anonReader", port=${toString anonPort})),
-              lambda: [
-                  wait_uuid("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"),
-                  client2.succeed(publish("-m test", "anonWriter", port=${toString anonPort}))
-              ])
-    '';
-  }
-)
+    with subtest("check omitPasswordAuth"):
+        parallel(
+            lambda: client1.succeed(subscribe("-i fd56032c-d9cb-4813-a3b4-6be0e04c8fc3",
+                "anonReader", port=${toString anonPort})),
+            lambda: [
+                wait_uuid("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"),
+                client2.succeed(publish("-m test", "anonWriter", port=${toString anonPort}))
+            ])
+  '';
+}
diff --git a/nixos/tests/mpv.nix b/nixos/tests/mpv.nix
index 6ec24ae78cd4..07d8b9fb3b96 100644
--- a/nixos/tests/mpv.nix
+++ b/nixos/tests/mpv.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  let
-    port = toString 4321;
-  in
-  {
-    name = "mpv";
-    meta.maintainers = with lib.maintainers; [ zopieux ];
+let
+  port = toString 4321;
+in
+{
+  name = "mpv";
+  meta.maintainers = with lib.maintainers; [ zopieux ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          pkgs.curl
-          (pkgs.mpv.override {
-            scripts = [ pkgs.mpvScripts.simple-mpv-webui ];
-          })
-        ];
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.curl
+        (pkgs.mpv.override {
+          scripts = [ pkgs.mpvScripts.simple-mpv-webui ];
+        })
+      ];
+    };
 
-    testScript = ''
-      machine.execute("set -m; mpv --script-opts=webui-port=${port} --idle=yes >&2 &")
-      machine.wait_for_open_port(${port})
-      assert "<title>simple-mpv-webui" in machine.succeed("curl -s localhost:${port}")
-    '';
-  }
-)
+  testScript = ''
+    machine.execute("set -m; mpv --script-opts=webui-port=${port} --idle=yes >&2 &")
+    machine.wait_for_open_port(${port})
+    assert "<title>simple-mpv-webui" in machine.succeed("curl -s localhost:${port}")
+  '';
+}
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index b51b0a9e9d4c..356127483fe8 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -12,13 +12,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "6.1.3.3";
+  version = "6.1.4.3";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-kwCmOPgO1YR2VgAwvu/c9iTWHWFZGsZCkbAsWoeLTV0=";
+    hash = "sha256-PTO4x5YKqs4wWonW3N/sMAVlbWJp+eVjLL98G9bNZ4c=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.json b/pkgs/applications/misc/ArchiSteamFarm/deps.json
index fce7dfa79f84..ccec2735b33e 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.json
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.json
@@ -4,11 +4,6 @@
     "version": "1.2.0",
     "hash": "sha256-l8+Var9o773VL6Ybih3boaFf9sYjS7eqtLGd8DCIPsk="
   },
-  {
-    "pname": "AngleSharp.XPath",
-    "version": "2.0.5",
-    "hash": "sha256-V2ehfOdVI16QdsQ+FrxZZGnUvbEbt3Ldr9LPF/dF69A="
-  },
   {
     "pname": "CryptSharpStandard",
     "version": "1.0.0",
@@ -291,8 +286,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "9.0.2",
-    "hash": "sha256-zqsI0lEDrP8l2QaDxRxb4SC4mwxVfYGFYp/wURXRzKs="
+    "version": "9.0.3",
+    "hash": "sha256-URV7tlaHv1JPpqeJXQMYRoIZYU7lFGJPyTKbl2p3gqI="
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
@@ -301,8 +296,8 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
-    "version": "3.11.0-beta1.24629.2",
-    "hash": "sha256-f4UuX2syNwccB3TbN73jw4JBXxgiyeE6PzLylcdyeWg="
+    "version": "3.11.0-beta1.25076.3",
+    "hash": "sha256-JCyHBJ7BhQFem8vp96ewwFvWaZccOBg1viAHxZwzORg="
   },
   {
     "pname": "Microsoft.CodeCoverage",
@@ -446,23 +441,23 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.6.0",
-    "hash": "sha256-0mXOkDKvUikcyCMUcmA7PWl4RlAwwUciKSqTTgLDa3o="
+    "version": "8.7.0",
+    "hash": "sha256-LqEtksyd06m12yasVQK/9j6Y/giTDqfMJrdUUDxW0WY="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.6.0",
-    "hash": "sha256-Wey0xjL0n6NCi4HiVFGcDS6+ONPp+ogzb5ZTF7sFt3k="
+    "version": "8.7.0",
+    "hash": "sha256-P9oPGIyaZrRd1EqhgvuSF5Bt/7fm/dS3nC3HXo4C720="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.6.0",
-    "hash": "sha256-4M4EUJDMDgmqdBxlbptnrLNWOLbmzatypDpl30CBUlk="
+    "version": "8.7.0",
+    "hash": "sha256-yXyiQR87kb630Qwu+D0GifWxPj74VN7wtzOincrSdIg="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.6.0",
-    "hash": "sha256-gyZpy8h9I09fr7icHaIXaxRTzhstHrrrq2wkd/5vz78="
+    "version": "8.7.0",
+    "hash": "sha256-l4jl4mU3bG433xSKDdCAkEqD0uUGKTOmbthhYAogcRI="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -486,23 +481,23 @@
   },
   {
     "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.6.2",
-    "hash": "sha256-GZYUH+0vWAif5p4S81Oo9Tsez68ylsLjEQWhI2rgcik="
+    "version": "1.6.3",
+    "hash": "sha256-DVwTXRoWHt8Ybfz1gv/TzmX6VfxaUp9lGghDEoby0dg="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "1.6.2",
-    "hash": "sha256-21x7FSFGVGXS8fkOQyr3jxsemxU8+7ugkVzo+mOP0Ic="
+    "version": "1.6.3",
+    "hash": "sha256-RX5m9VaXaAnmxQces8Knru7r4iHEC+EZMB0KYeXCcrc="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.6.2",
-    "hash": "sha256-UOpDBbW3xgahofRjqdw3wUj63zXVdkIAfUE7dA4uI4Y="
+    "version": "1.6.3",
+    "hash": "sha256-gv7aCP029oku6xwYKclY5hI+ewShrk4tVFbDEND4FJI="
   },
   {
     "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.6.2",
-    "hash": "sha256-SWaSPgc2PQNqsz7ea/SQsmqOX6le6dmrDbwCHfbppZo="
+    "version": "1.6.3",
+    "hash": "sha256-4FTZCHdI9WZwd3ejeFCVbx5O0UWLJwKJc6NduUQu0XE="
   },
   {
     "pname": "Microsoft.Testing.Platform",
@@ -511,13 +506,13 @@
   },
   {
     "pname": "Microsoft.Testing.Platform",
-    "version": "1.6.2",
-    "hash": "sha256-RfdgATa3aTYLpGfv8ORI5uEP8dH87L5/gBDkxAG6ho4="
+    "version": "1.6.3",
+    "hash": "sha256-WJD2zC0b1jU5DRAFG3XmHiQJKdKnjDQB3xbdRmv8V9Q="
   },
   {
     "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.6.2",
-    "hash": "sha256-bzlz10QeFrCAR+1og0gXbxSbpO64wCFrwAhBUwAp0nI="
+    "version": "1.6.3",
+    "hash": "sha256-JK8l4K4uSO6mgsZ6Lo/Sv4VjaLGZjD5g/oZYy0iAYDs="
   },
   {
     "pname": "Microsoft.TestPlatform.ObjectModel",
@@ -536,23 +531,23 @@
   },
   {
     "pname": "MSTest",
-    "version": "3.8.2",
-    "hash": "sha256-k6M9buNaP/y+e4/4dsSWxsFWMmocWocDh3LW1jL97/A="
+    "version": "3.8.3",
+    "hash": "sha256-Y9cVTLCQjO6j/P7Dq4/zWrF7EsVgQVnDTs5otXHzGkM="
   },
   {
     "pname": "MSTest.Analyzers",
-    "version": "3.8.2",
-    "hash": "sha256-r+JAxw77n/PQpQviXn8j1M+ccb9GVHTNuPWwffacVkg="
+    "version": "3.8.3",
+    "hash": "sha256-/Nf6E5zQib741BKu4IwRBz36lW9+krWLy2904MT3O1M="
   },
   {
     "pname": "MSTest.TestAdapter",
-    "version": "3.8.2",
-    "hash": "sha256-z5fZWSvyxvohB8Vl6gtb8nsAGt/9saXLZRckuzfVg/Y="
+    "version": "3.8.3",
+    "hash": "sha256-pBfg41vnc9z1W2uMuXRUnulGycyXJpBATsBHEiOi9mg="
   },
   {
     "pname": "MSTest.TestFramework",
-    "version": "3.8.2",
-    "hash": "sha256-NjQ1XU3vMRdFZSE6Ju2ASopCPZFpFZaPAQdRudqAf5c="
+    "version": "3.8.3",
+    "hash": "sha256-3dhd6vk2KdMwe+JNSoUZZ4+P04jPKBl3HTuc9ZXBTlw="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -601,8 +596,8 @@
   },
   {
     "pname": "OpenTelemetry",
-    "version": "1.11.1",
-    "hash": "sha256-Z4U/FCSlY+qdQRS2haJDSYyxI624mDCwHZhf5At2Atk="
+    "version": "1.11.2",
+    "hash": "sha256-sQAmDGH6rQSYWNCaqgyP7qWdDciAh+IKHf4IXFwuMq4="
   },
   {
     "pname": "OpenTelemetry",
@@ -611,13 +606,13 @@
   },
   {
     "pname": "OpenTelemetry.Api",
-    "version": "1.11.1",
-    "hash": "sha256-1qDEHEvelvySuCPcevWgO7N9ZEmPXwnFog+tiWXr2qU="
+    "version": "1.11.2",
+    "hash": "sha256-LfsXbTxVR8f524bvIsIbLtQYxOtun4Bm3Me6IpxbvOw="
   },
   {
     "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
-    "version": "1.11.1",
-    "hash": "sha256-rioqazZAS6aZ7W8jJ4owu58rcnRbQyPrWVTBoqu1zPc="
+    "version": "1.11.2",
+    "hash": "sha256-p6moAb53XhkKlZ5LAy3RXPFtYFUqtOidyKJg6xzagRY="
   },
   {
     "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
@@ -631,23 +626,23 @@
   },
   {
     "pname": "OpenTelemetry.Extensions.Hosting",
-    "version": "1.11.1",
-    "hash": "sha256-eHQaUToWOpmJgD5XCHDCWsUcChKH3roaO8ZTAIulJVk="
+    "version": "1.11.2",
+    "hash": "sha256-z2o0gfQSZKrRDJfKrs70jmJaK3/oTqW+LSD/b+alF78="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.AspNetCore",
-    "version": "1.11.0",
-    "hash": "sha256-F3WTwCPVUe+VppF1ZOAdBKaSseKmFZEU7D81uegqpGo="
+    "version": "1.11.1",
+    "hash": "sha256-aTXVd+zdEMJFNdRDGg01PyP4vhpDl9tpTm5GlQ2oTxU="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.Http",
-    "version": "1.11.0",
-    "hash": "sha256-4J7ZvginaiISaLB4M9tTK2o6avBz2dSI+fAhyfraBQ4="
+    "version": "1.11.1",
+    "hash": "sha256-9bqehwixulMrjXt/ZFEosHLt6CIikLzzrdHFP5gNbzo="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.Runtime",
-    "version": "1.11.0",
-    "hash": "sha256-VBSSJ3eORWUlVH12xzubtMtrDACAsyd1nSfgUt5ltCg="
+    "version": "1.11.1",
+    "hash": "sha256-ssHSQx/O590o/25vy+BB4KH1ChIVzQjDnwW2LnGlkm0="
   },
   {
     "pname": "protobuf-net",
@@ -659,16 +654,16 @@
     "version": "3.2.46",
     "hash": "sha256-Srg7pP7rleL462idLPFUxgXBLrywWeHFyEvSV+keA4E="
   },
+  {
+    "pname": "Scalar.AspNetCore",
+    "version": "2.1.3",
+    "hash": "sha256-o0rPXtulpU7y0gfQkUq9MQzud2X6A8DAJ38NPGeP5zs="
+  },
   {
     "pname": "SteamKit2",
     "version": "3.0.2",
     "hash": "sha256-bRiLFaq/hsr+7BKtSKoD2+pf0VCGhBYe/rO3DgqMZpo="
   },
-  {
-    "pname": "Swashbuckle.AspNetCore.SwaggerUI",
-    "version": "7.2.0",
-    "hash": "sha256-EwJsqa4JBJhMzq+zgND3STyoZi1+6GaVQqXz3ZVP7p8="
-  },
   {
     "pname": "System.Buffers",
     "version": "4.5.1",
@@ -691,33 +686,33 @@
   },
   {
     "pname": "System.Composition",
-    "version": "9.0.2",
-    "hash": "sha256-xOstum9Tv0qppXg3lq7ztv8gsSl7vvM5vp/UkrWX2Yo="
+    "version": "9.0.3",
+    "hash": "sha256-WnAxY6yJygMiHhht3/Cu2q6usvbqjy10+dnQhVAOBoc="
   },
   {
     "pname": "System.Composition.AttributedModel",
-    "version": "9.0.2",
-    "hash": "sha256-9y+qPVXzg8eOYaN7hp4/qtZ5WzT6NcUkO/qwenZ1wW0="
+    "version": "9.0.3",
+    "hash": "sha256-wNsQq1oshdAXZYlE3a0V+qdaSY7UAJa6XyjVEKtCzdM="
   },
   {
     "pname": "System.Composition.Convention",
-    "version": "9.0.2",
-    "hash": "sha256-pob6h82/AbgcNc/qYG0Yx6RNI8UtlDRX8idjZKLM6HQ="
+    "version": "9.0.3",
+    "hash": "sha256-FxDt7YeQ/n3RJbfgqhKnWxZGvAisArsWS6Nl5XN8Cm0="
   },
   {
     "pname": "System.Composition.Hosting",
-    "version": "9.0.2",
-    "hash": "sha256-MlTsCtJ8j+NWkGdsyw6v72AyC0BacCbB4XBeWCgfRnM="
+    "version": "9.0.3",
+    "hash": "sha256-Lshms36a63CFbBKA34tXJON2/fFy6UeAK2EcKFgGHas="
   },
   {
     "pname": "System.Composition.Runtime",
-    "version": "9.0.2",
-    "hash": "sha256-UZN46BXCtZWzG9HNbEQVwEmqjRfVtDpr3C+0VprKCPE="
+    "version": "9.0.3",
+    "hash": "sha256-YjWG/ugx/aEDND496fYbRVD7+lpOU7cNZFPICkHc4S0="
   },
   {
     "pname": "System.Composition.TypedParts",
-    "version": "9.0.2",
-    "hash": "sha256-bivrgDR31TbgugEJs79rsqmGju74NK6t6BrVDcs31es="
+    "version": "9.0.3",
+    "hash": "sha256-gMkfMOSVX0YLAtBamdHacmSBTDE+XHR2ocp5/Bwrj0U="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -771,8 +766,8 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.2",
-    "hash": "sha256-feZYAyRd1O1ViWDkBvkgVzCgIuPeyXgRsI+nrUqZAFc="
+    "version": "9.0.3",
+    "hash": "sha256-27A1V1ANw23BZPxSMJQsrrwQ1hruFj48DtWuyavViT4="
   },
   {
     "pname": "System.Security.Principal.Windows",
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index 84d7a56dc175..9a185ff1f9f6 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage rec {
   pname = "asf-ui";
-  version = "687959ad867995061641a870fb7392088929acdb";
+  version = "c3113782bc4895099b1a07a0e811d1e5af871ddc";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
     rev = version;
-    hash = "sha256-N2UgyVzHyombfPg+nI0O/uTAlD6Mq/pIRxdvM5bTHDE=";
+    hash = "sha256-B2gn40LWVm75pwV5sQpv1gRsNof9tQUDClu7oLSz/VM=";
   };
 
-  npmDepsHash = "sha256-TV2+84bcNIiFHxsoDfsUNzEYGLhtXZoYSWvb898X9fU=";
+  npmDepsHash = "sha256-Btf/S3ia8Uo/ChrKoYKRk9sKS+ZuQGtaAnaQeGDTIYI=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
index 55d55fdf59f8..f36bce3cb200 100644
--- a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
+++ b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
@@ -20,6 +20,10 @@ buildLua rec {
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
+  postInstall = ''
+    rm -f $out/share/mpv/scripts/webui/setup.cfg
+  '';
+
   scriptPath = ".";
   passthru.scriptName = "webui";
 
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index bce4207508d2..86c096f829ed 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "2025.2.1";
+  version = "2025.2.3";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     rev = "version/${version}";
-    hash = "sha256-KZalpsM9rvki9GD+urf8idHOEnvBJtkSvE1b2b4KL/4=";
+    hash = "sha256-aaSAlFIc5Gn5PJPVuObi24Y86/3N3yFJVQTx1tV2i2A=";
   };
 
   meta = with lib; {
@@ -30,6 +30,7 @@ let
     homepage = "https://goauthentik.io/";
     license = licenses.mit;
     platforms = platforms.linux;
+    broken = stdenvNoCC.hostPlatform.isAarch64;
     maintainers = with maintainers; [
       jvanbruegge
       risson
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index 31590ec1ee90..29c07029fcac 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -23,10 +23,10 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-xczcogpRXdFX34uAjbERWf9lj3uxLKpPlceyZ7KgTz0=";
-      aarch64-linux = "sha256-8Ju1qUGc68xxj7ikoAQzic5tdnnemhIo/UU2G55npeE=";
-      x86_64-darwin = "sha256-pJZxykfeQaaNFrP3x1Hj2huWngOQc3F4KjtGV8Rae8s=";
-      aarch64-darwin = "sha256-jEMgFbOy65wCLxcA961u3jFwav+KVSrpDYcvt/4Ea8A=";
+      x86_64-linux = "sha256-iFJRdECSmFZt63yVkozaZeIT0MP8vfW3G5SvuE8/wZw=";
+      aarch64-linux = "sha256-JJxjYFgaj2f6RQRszWfxG26SjTokhoGDZjqbg7HGoV0=";
+      x86_64-darwin = "sha256-27bhqNIw3Aceq8u0UthR5Ju20SQiGVMCfUZiHbzC6wk=";
+      aarch64-darwin = "sha256-wajMCeRaOzXSJgb5z8i+ed+2w0xWTm0I2Wb3hTq1LqY=";
     }
     .${system} or throwSystem;
 
@@ -35,7 +35,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.42.3";
+  version = "1.42.4";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index f769b0a9966f..675296ca94c4 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.39.1";
+  version = "2.40.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-7ukbYmfhfdjzooHA9J/AixfkZrzJZvnoHGg4z2jCZPI=";
+    hash = "sha256-+eCoxWzTUPLYkz05XwJW1i8v5tyO3VRlm/ZKSlP3cts=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ga/gappa/package.nix b/pkgs/by-name/ga/gappa/package.nix
index b13011605e50..0d853df0ca2c 100644
--- a/pkgs/by-name/ga/gappa/package.nix
+++ b/pkgs/by-name/ga/gappa/package.nix
@@ -5,15 +5,16 @@
   gmp,
   mpfr,
   boost,
+  version ? "1.6.0",
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "gappa";
-  version = "1.4.0";
+  inherit version;
 
   src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/file/38436/gappa-${version}.tar.gz";
-    sha256 = "12x42z901pr05ldmparqdi8sq9s7fxbavhzk2dbq3l6hy247dwbb";
+    url = "https://gappa.gitlabpages.inria.fr/releases/gappa-${version}.tar.gz";
+    hash = "sha256-aNht0Ttv+gzS9eLzu4PQitRK/zQN9QQ4YOEjQ2d9xIM=";
   };
 
   buildInputs = [
@@ -26,12 +27,12 @@ stdenv.mkDerivation rec {
   installPhase = "./remake install";
 
   meta = {
-    homepage = "http://gappa.gforge.inria.fr/";
+    homepage = "https://gappa.gitlabpages.inria.fr/";
     description = "Verifying and formally proving properties on numerical programs dealing with floating-point or fixed-point arithmetic";
     mainProgram = "gappa";
     license = with lib.licenses; [
-      cecill20
-      gpl2
+      cecill21
+      gpl3
     ];
     maintainers = with lib.maintainers; [ vbgl ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/he/hexxy/package.nix b/pkgs/by-name/he/hexxy/package.nix
index d33ebbc6d762..fadbfc446831 100644
--- a/pkgs/by-name/he/hexxy/package.nix
+++ b/pkgs/by-name/he/hexxy/package.nix
@@ -4,15 +4,15 @@
   fetchFromGitHub,
   nix-update-script,
 }:
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "hexxy";
-  version = "0-unstable-2025-03-16";
+  version = "0.1.1";
   src = fetchFromGitHub {
     owner = "sweetbbak";
     repo = "hexxy";
-    # upstream does not publish releases, i.e., there are no tags
-    rev = "d90f345ba80078b18baf006b3a5aec92d2c330e1";
-    hash = "sha256-htTGdcJ3oMgfsJ3FH1aRnI2vxMNpBcLksABA75EQUFo=";
+
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pboOpPGqlSWSiP6yWONxC3wbrGc8FN0++5vHd4ERbkA=";
   };
 
   vendorHash = "sha256-qkBpSVLWZPRgS9bqOVUWHpyj8z/nheQJON3vJOwPUj4=";
@@ -21,12 +21,7 @@ buildGoModule {
     "-w"
   ];
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version"
-      "branch"
-    ];
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "A modern and beautiful alternative to xxd and hexdump";
@@ -35,4 +30,4 @@ buildGoModule {
     maintainers = [ lib.maintainers.NotAShelf ];
     mainProgram = "hexxy";
   };
-}
+})
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index fd8674f00f4c..e650ee77190f 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -44,8 +44,8 @@
   zsh,
   fish,
   nixosTests,
-  go_1_23,
-  buildGo123Module,
+  go_1_24,
+  buildGo124Module,
   nix-update-script,
   makeBinaryWrapper,
   autoSignDarwinBinariesHook,
@@ -56,21 +56,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.40.1";
+  version = "0.41.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-ta9MTbSkIkowkd5zBUbtauFNGVRDgxof1SSQXuEgFTQ=";
+    hash = "sha256-oTkzFEPgbFa2wPBJxh/9ZbK8liM9isWGEwExJq5/h2o=";
   };
 
   goModules =
-    (buildGo123Module {
+    (buildGo124Module {
       pname = "kitty-go-modules";
       inherit src version;
-      vendorHash = "sha256-wr5R2X+lV8vVVWsDYLLSaz7HRNOB7Zzk/a7knsdDlXs=";
+      vendorHash = "sha256-ld3cGJUjoi3od6gINyGE7fQodl9CSKmakJ1CPLMX+Ss=";
     }).goModules;
 
   buildInputs =
@@ -124,7 +124,7 @@ buildPythonApplication rec {
       sphinx-copybutton
       sphinxext-opengraph
       sphinx-inline-tabs
-      go_1_23
+      go_1_24
       fontconfig
       makeBinaryWrapper
     ]
@@ -231,9 +231,19 @@ buildPythonApplication rec {
 
   # skip failing tests due to darwin sandbox
   preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # can be re-enabled with the next kitty release, see https://github.com/kovidgoyal/kitty/pull/7939
+
     substituteInPlace kitty_tests/file_transmission.py \
       --replace test_transfer_send dont_test_transfer_send
+
+    substituteInPlace kitty_tests/ssh.py \
+      --replace test_ssh_connection_data no_test_ssh_connection_data \
+
+    substituteInPlace kitty_tests/shell_integration.py \
+      --replace test_fish_integration no_test_fish_integration
+
+    substituteInPlace kitty_tests/fonts.py \
+      --replace test_fallback_font_not_last_resort no_test_fallback_font_not_last_resort
+
     # theme collection test starts an http server
     rm tools/themes/collection_test.go
     # passwd_test tries to exec /usr/bin/dscl
diff --git a/pkgs/by-name/li/libbytesize/package.nix b/pkgs/by-name/li/libbytesize/package.nix
index ae268b88b83c..48619381acda 100644
--- a/pkgs/by-name/li/libbytesize/package.nix
+++ b/pkgs/by-name/li/libbytesize/package.nix
@@ -60,6 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     substituteInPlace $out/${python3Packages.python.sitePackages}/bytesize/bytesize.py \
       --replace-fail 'CDLL("libbytesize.so.1")' "CDLL('$out/lib/libbytesize.so.1')"
+
+    # Force compilation of .pyc files to make them deterministic
+    ${python3Packages.python.interpreter} -m compileall $out/${python3Packages.python.sitePackages}/bytesize
   '';
 
   pythonImportsCheck = [ "bytesize" ];
diff --git a/pkgs/by-name/lo/lowfi/package.nix b/pkgs/by-name/lo/lowfi/package.nix
index 6ca7e2c2465b..8ff50bc7d6b3 100644
--- a/pkgs/by-name/lo/lowfi/package.nix
+++ b/pkgs/by-name/lo/lowfi/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lowfi";
-  version = "1.5.6";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "talwat";
     repo = "lowfi";
     tag = version;
-    hash = "sha256-lR22UN9LiuJknq2KTNOXcybXwi2KvLRe0KHocFWL0GM=";
+    hash = "sha256-t3Lbqrcmh0XSOO+hc4UsWhKi4zToORFQo0A4G32aeOw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xMksujaZgOPJsBiv6//4zeiUcWEV2Pc7daBaPUh3cYc=";
+  cargoHash = "sha256-waQcxdVXZZ09wuLWUNL4nRUHF1rIDI8lAfYc/1bxMl0=";
 
   buildFeatures = [ "mpris" ];
 
diff --git a/pkgs/by-name/mj/mjmap/package.nix b/pkgs/by-name/mj/mjmap/package.nix
index b8925073aad2..8bd3d74f477e 100644
--- a/pkgs/by-name/mj/mjmap/package.nix
+++ b/pkgs/by-name/mj/mjmap/package.nix
@@ -2,33 +2,47 @@
   lib,
   buildGoModule,
   fetchFromSourcehut,
-  unstableGitUpdater,
+  scdoc,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
+let
+  version = "1.0.1";
+in
+
 buildGoModule {
   pname = "mjmap";
-  version = "0.1.0-unstable-2025-03-06";
+  inherit version;
 
   src = fetchFromSourcehut {
     owner = "~rockorager";
     repo = "mjmap";
-    rev = "fdc1658f1a3d57594479535692ed06c6e19cc859";
-    hash = "sha256-178S4Y4h31z0OCedS44udxyv8TfgZoDykApg3pX15oQ=";
+    rev = "v${version}";
+    hash = "sha256-VV+bZ01l+uEe3wqdYyVwpzsZJNzoTCD38F6a58dozbg=";
   };
 
-  vendorHash = "sha256-fJuPrzjRH0FpYj2D9CsFdsdzYT0C3/D2PhmJIZTsgfQ=";
+  vendorHash = "sha256-sZsS8q/hkA2T/8QmtKzNof0mzCuWYin227+/7k3XTM0=";
 
-  installCheckPhase = ''
-    runHook preInstallCheck
+  nativeBuildInputs = [
+    scdoc
+    installShellFiles
+  ];
 
-    $out/bin/mjmap --version >/dev/null
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
-    runHook postInstallCheck
+  versionCheckProgram = "mjmap";
+
+  postBuild = ''
+    make mjmap.1
   '';
 
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v.";
-  };
+  postInstall = ''
+    installManPage mjmap.1
+  '';
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Sendmail‐compatible JMAP client";
diff --git a/pkgs/by-name/nr/nrr/package.nix b/pkgs/by-name/nr/nrr/package.nix
index 470c13820a7b..5ee3a195490d 100644
--- a/pkgs/by-name/nr/nrr/package.nix
+++ b/pkgs/by-name/nr/nrr/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-9QoYkYuN9kbcjgjn+7CuqKOKrVaPu8U2W/4KB+M04hg=";
+    hash = "sha256-qh4YEfdfO6WofdrFHVDvkNocloK2LuWelfZPilxiKPk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZAGR7Slpt3uUWO7g4GFr7tn8/fYeAxPYZivKAhLkar4=";
+  cargoHash = "sha256-f8ugfkTtS23TLh0Ss4SpxGy1Y9AeqinE+psDmHVHibg=";
 
   env = lib.optionalAttrs enableLTO {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index 85d9952b8c52..e73a6e6b27f0 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -108,28 +108,7 @@ let
   withPlugins =
     plugins:
     let
-      actualPlugins = lib.lists.map (
-        provider:
-        if provider ? override then
-          # use opentofu plugin registry over terraform's
-          provider.override (
-            oldArgs:
-            if (builtins.hasAttr "homepage" oldArgs) then
-              {
-                provider-source-address =
-                  lib.replaceStrings
-                    [ "https://registry.terraform.io/providers" ]
-                    [
-                      "registry.opentofu.org"
-                    ]
-                    oldArgs.homepage;
-              }
-            else
-              { }
-          )
-        else
-          provider
-      ) (plugins package.plugins);
+      actualPlugins = plugins package.plugins;
 
       # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
       wrapperInputs = lib.unique (
@@ -183,13 +162,16 @@ let
           passthru = package.passthru // passthru;
 
           buildCommand = ''
-            # Create wrappers for terraform plugins because Terraform only
+            # Create wrappers for terraform plugins because OpenTofu only
             # walks inside of a tree of files.
+            # Also replace registry.terraform.io dir with registry.opentofu.org,
+            # so OpenTofu can find the plugins.
             for providerDir in ${toString actualPlugins}
             do
               for file in $(find $providerDir/libexec/terraform-providers -type f)
               do
                 relFile=''${file#$providerDir/}
+                relFile=''${relFile/registry.terraform.io/registry.opentofu.org}
                 mkdir -p $out/$(dirname $relFile)
                 cat <<WRAPPER > $out/$relFile
             #!${runtimeShell}
diff --git a/pkgs/by-name/qu/quill-log/package.nix b/pkgs/by-name/qu/quill-log/package.nix
index d29a4ef21c7d..1b7d1aeb4f52 100644
--- a/pkgs/by-name/qu/quill-log/package.nix
+++ b/pkgs/by-name/qu/quill-log/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quill-log";
-  version = "8.2.0";
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "odygrd";
     repo = "quill";
     rev = "v${version}";
-    hash = "sha256-q61TdttCVZG5MZVhokugMGhB4ZJOhK4iFgirUonocJg=";
+    hash = "sha256-WkJOB06yH3B3L2aqglh1jc38e1fDbxaqFEEh1AvBUcw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index 51edf668b343..c5b323466b81 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "05.03.04";
+  version = "05.03.05";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-6pUQONmafwfUZ3DAsYS6dju8mLE9piu7btPmP6QX4pM=";
+    hash = "sha256-dMnsMV4DRxXWgev9LCb4wwdnx7A++giCsW7c2cMde9Q=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 43309734f1ac..99b9858999da 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -7,16 +7,16 @@
 
 buildGo123Module rec {
   pname = "traefik";
-  version = "3.3.3";
+  version = "3.3.4";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-R9fiCLqzrd9SS6LoQt3jOoEchRnPuhmJqIob8JhzqEU=";
+    hash = "sha256-KXFpdk1VMYzGldFp/b5Ss6aJvL9yG4kSbM4LOIBUL5A=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-9WuhQjl+lWRZBvEP8qjBQUbEQC1SG9J+3xNpmIieOo8=";
+  vendorHash = "sha256-wtZFViVNvNuhHvI1YR2ome1rs2DIAd3Iurmpi9Y6F2w=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/by-name/va/vale/package.nix b/pkgs/by-name/va/vale/package.nix
index a3dd78ea4c21..b75fe852fb43 100644
--- a/pkgs/by-name/va/vale/package.nix
+++ b/pkgs/by-name/va/vale/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.10.0";
+  version = "3.11.0";
 
   subPackages = [ "cmd/vale" ];
 
@@ -19,7 +19,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-aZ+ihq4ft6HpKBZu7idq0m298WSxBubuEsIPNLvu1RU=";
+    hash = "sha256-NJ8QmF2ZGlbkHhc0OQSVl11pQDHO88KL/MLr+8ABLYs=";
   };
 
   vendorHash = "sha256-Zhhp/qbwGTQEZ28S+p7GJodwQcnkFNqNU7WCZKdeoz0=";
diff --git a/pkgs/by-name/xe/xee/package.nix b/pkgs/by-name/xe/xee/package.nix
new file mode 100644
index 000000000000..0985ada161e7
--- /dev/null
+++ b/pkgs/by-name/xe/xee/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  writers,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "xee";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Paligo";
+    repo = "xee";
+    tag = "xee-v${finalAttrs.version}";
+    hash = "sha256-l5g2YZ4lNu+CLyya0FavDEqbJayaTXGrB8fYCr3fj0s=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-Ora6VwYLDyFI4iA4FkygGsup8I4OvK0kkLvHs4F/YhY=";
+
+  cargoBuildFlags = [
+    "--package"
+    "xee"
+  ];
+
+  nativeBuildInputs = [
+    # "${cargoDeps}/build-data-0.2.1/src/lib.rs" is pretty terrible
+    (writers.writePython3Bin "git" { } ''
+      import sys
+      import os
+      sys.argv[0] = os.path.basename(sys.argv[0])
+      if sys.argv == ["git", "rev-parse", "HEAD"]:
+          print("${finalAttrs.src.rev}")
+      elif sys.argv == ["git", "rev-parse", "--abbrev-ref=loose", "HEAD"]:
+          print("${finalAttrs.src.rev}")
+      elif sys.argv == ["git", "status", "-s"]:
+          pass
+      elif sys.argv == ["git", "log", "-1", "--pretty=%ct"]:
+          print(os.environ.get("SOURCE_DATE_EPOCH", "0"))
+      else:
+          raise RuntimeError(sys.argv[1:])
+    '')
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    description = "XML Execution Engine written in Rust.";
+    longDescription = ''
+      Load XML documents, issue XPath expressions against them, including in
+      a REPL, and pretty-print XML documents. A Swiss Army knife CLI for XML.
+    '';
+    homepage = "https://github.com/Paligo/xee";
+    changelog = "https://github.com/Paligo/xee/releases/tag/xee-v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pbsds ];
+    mainProgram = "xee";
+  };
+})
diff --git a/pkgs/data/fonts/font-awesome/default.nix b/pkgs/data/fonts/font-awesome/default.nix
index fe48972b0573..c12fe54b4412 100644
--- a/pkgs/data/fonts/font-awesome/default.nix
+++ b/pkgs/data/fonts/font-awesome/default.nix
@@ -61,7 +61,7 @@ in
     hash = "sha256-gd23ZplNY56sm1lfkU3kPXUOmNmY5SRnT0qlQZRNuBo=";
   };
   v6 = font-awesome {
-    version = "6.7.1";
-    hash = "sha256-Lzy12F0qEGzvdyN9SC3nyh2eTc80HM4qR5U6h0G15bo=";
+    version = "6.7.2";
+    hash = "sha256-MaJG96kYj8ukJVyqOTDpkHH/eWr/ZlbVKk9AvJM7ub4=";
   };
 }
diff --git a/pkgs/development/embedded/platformio/default.nix b/pkgs/development/embedded/platformio/default.nix
index 8843c36a9f6a..53eb74caaf79 100644
--- a/pkgs/development/embedded/platformio/default.nix
+++ b/pkgs/development/embedded/platformio/default.nix
@@ -1,10 +1,10 @@
-{ newScope, python3Packages }:
+{ newScope }:
 
 let
   callPackage = newScope self;
 
   self = {
-    platformio-core = python3Packages.callPackage ./core.nix { };
+    platformio-core = callPackage ./core.nix { };
 
     platformio-chrootenv = callPackage ./chrootenv.nix { };
   };
diff --git a/pkgs/development/libraries/cxxtest/default.nix b/pkgs/development/libraries/cxxtest/default.nix
index b15d9dbe96a2..187a9c8470ab 100644
--- a/pkgs/development/libraries/cxxtest/default.nix
+++ b/pkgs/development/libraries/cxxtest/default.nix
@@ -1,10 +1,11 @@
 {
   lib,
-  python3Packages,
+  buildPythonApplication,
   fetchFromGitHub,
+  ply,
 }:
 
-python3Packages.buildPythonApplication rec {
+buildPythonApplication rec {
   pname = "cxxtest";
   version = "4.4";
 
@@ -17,7 +18,7 @@ python3Packages.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/python";
 
-  nativeCheckInputs = [ python3Packages.ply ];
+  nativeCheckInputs = [ ply ];
 
   preCheck = ''
     cd ../
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index 63de75a4ab1c..a420212baea0 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.21.1";
+  version = "5.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
     tag = "v${version}";
-    hash = "sha256-XwStIPjhCw3Vf8jAMG7x8uc/t4h1JYTDz4Lobv/nS1g=";
+    hash = "sha256-NQYvtt/cjssJ7Lv3RyDeBMQByKMmt1p0X9F+LqhtTV4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyporscheconnectapi/default.nix b/pkgs/development/python-modules/pyporscheconnectapi/default.nix
new file mode 100644
index 000000000000..13ee074de752
--- /dev/null
+++ b/pkgs/development/python-modules/pyporscheconnectapi/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  beautifulsoup4,
+  buildPythonPackage,
+  fetchFromGitHub,
+  httpx,
+  rich,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pyporscheconnectapi";
+  version = "0.2.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "CJNE";
+    repo = "pyporscheconnectapi";
+    tag = version;
+    hash = "sha256-MQYhIp+DUYcRKAEwcT8qzrFY043b33BHR8jma3jR0lE=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"pytest-runner"' ""
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    beautifulsoup4
+    httpx
+    rich
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyporscheconnectapi" ];
+
+  meta = {
+    description = "Python client library for Porsche Connect API";
+    homepage = "https://github.com/CJNE/pyporscheconnectapi";
+    changelog = "https://github.com/CJNE/pyporscheconnectapi/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyssim/default.nix b/pkgs/development/python-modules/pyssim/default.nix
index 6b910b1d7207..a0145c30c553 100644
--- a/pkgs/development/python-modules/pyssim/default.nix
+++ b/pkgs/development/python-modules/pyssim/default.nix
@@ -5,18 +5,20 @@
   numpy,
   scipy,
   pillow,
+  pywavelets,
   fetchpatch,
 }:
 
 buildPythonPackage rec {
   pname = "pyssim";
-  version = "0.6";
+  version = "0.7";
   format = "setuptools";
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     scipy
     pillow
+    pywavelets
   ];
 
   # PyPI tarball doesn't contain test images so let's use GitHub
@@ -24,22 +26,18 @@ buildPythonPackage rec {
     owner = "jterrace";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VvxQTvDTDms6Ccyclbf9P0HEQksl5atPPzHuH8yXTmc=";
+    sha256 = "sha256-LDNIugQeRqNsAZ5ZxS/NxHokEAwefpfRutTRpR0IcXk=";
   };
 
   patches = [
-    # "Replace Image.ANTIALIAS with Image.LANCZOS"
-    # Image.ANTIALIAS has been removed in Pillow 10.0.0,
-    # the version currently in nixpkgs,
-    # and Image.LANCZOS is a drop-in since Pillow 2.7.0.
-    # https://github.com/jterrace/pyssim/pull/45
+    # "Use PyWavelets for continuous wavelet transform"; signal.cwt was removed and broke the build
     (fetchpatch {
-      url = "https://github.com/jterrace/pyssim/commit/db4296c12ca9c027eb9cd61b52195a78dfcc6711.patch";
-      hash = "sha256-wNp47EFtjXv6jIFX25IErXg83ksmGRNFKNeMFS+tP6s=";
+      url = "https://github.com/jterrace/pyssim/commit/64a58687f261eb397e9c22609b5d48497ef02762.patch?full_index=1";
+      hash = "sha256-u6okuWZgGcYlf/SW0QLrAv0IYuJi7D8RHHEr8DeXKcw=";
     })
   ];
 
-  # Tests are copied from .travis.yml
+  # Tests are copied from .github/workflows/python-package.yml
   checkPhase = ''
     $out/bin/pyssim test-images/test1-1.png test-images/test1-1.png | grep 1
     $out/bin/pyssim test-images/test1-1.png test-images/test1-2.png | grep 0.998
@@ -48,11 +46,11 @@ buildPythonPackage rec {
     $out/bin/pyssim --cw --width 128 --height 128 test-images/test3-orig.jpg test-images/test3-rot.jpg | grep 0.938
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Module for computing Structured Similarity Image Metric (SSIM) in Python";
     mainProgram = "pyssim";
     homepage = "https://github.com/jterrace/pyssim";
-    license = licenses.mit;
-    maintainers = with maintainers; [ jluttine ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jluttine ];
   };
 }
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index d359937f282b..c03ba6542265 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -32,20 +32,16 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.28.3";
+  version = "2.30.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pytensor";
     tag = "rel-${version}";
-    hash = "sha256-MtY0JbziboJNHKe8wXaPtOWgFnpv8yQZeg6hNirnSEI=";
+    hash = "sha256-l9/N6DFR8qTF4BiH+g6H32r0FkpL9Pjtn/xkiFYYJhU=";
   };
 
-  pythonRelaxDeps = [
-    "scipy"
-  ];
-
   build-system = [
     cython
     versioneer
@@ -163,7 +159,7 @@ buildPythonPackage rec {
     description = "Python library to define, optimize, and efficiently evaluate mathematical expressions involving multi-dimensional arrays";
     mainProgram = "pytensor-cache";
     homepage = "https://github.com/pymc-devs/pytensor";
-    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/red-${version}";
+    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/rel-${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       bcdarwin
diff --git a/pkgs/development/python-modules/resend/default.nix b/pkgs/development/python-modules/resend/default.nix
index bd49a7a1ded7..bb7cafc77fbd 100644
--- a/pkgs/development/python-modules/resend/default.nix
+++ b/pkgs/development/python-modules/resend/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "resend";
-  version = "2.6.0";
+  version = "2.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "resend";
     repo = "resend-python";
     tag = "v${version}";
-    hash = "sha256-Sxe1TS/MahzKObPpo4+Iq+jbIuw4H1NJ3oU74MXZByQ=";
+    hash = "sha256-Uo8Shryw365l1970R0VpvGPAJOTxuJy6ZjIE2pcZkGs=";
   };
 
   build-system = [ setuptools ];
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "SDK for Resend";
     homepage = "https://github.com/resend/resend-python";
-    changelog = "https://github.com/resend/resend-python/releases/tag/v${version}";
+    changelog = "https://github.com/resend/resend-python/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/wgpu-py/default.nix b/pkgs/development/python-modules/wgpu-py/default.nix
index 6b8bf860b102..eab8ceb8a1dc 100644
--- a/pkgs/development/python-modules/wgpu-py/default.nix
+++ b/pkgs/development/python-modules/wgpu-py/default.nix
@@ -34,7 +34,6 @@
   # passthru
   wgpu-py,
   testers,
-  nix-update-script,
 }:
 buildPythonPackage rec {
   pname = "wgpu-py";
@@ -107,7 +106,6 @@ buildPythonPackage rec {
   doCheck = false;
 
   passthru = {
-    updateScript = nix-update-script { rev-prefix = "v"; };
     tests =
       {
         version = testers.testVersion {
diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index b5a8b5d3657f..e9e9bbe1b41b 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -17,6 +17,7 @@
   qttools,
   qqc2-breeze-style,
   gpsd,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "plasma-workspace";
@@ -32,6 +33,13 @@ mkKdeDerivation {
       # @QtBinariesDir@ only appears in the *removed* lines of the diff
       QtBinariesDir = null;
     })
+
+    # Backport patch recommended by upstream
+    # FIXME: remove in 6.3.5
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/plasma-workspace/-/commit/47d502353720004fa2d0e7b0065994b75b3e0ded.patch";
+      hash = "sha256-wt0ZIF4zcEOmP0o4ZcjBYxVjr2hVUlOKVJ8SMNSYt68=";
+    })
   ];
 
   postInstall = ''
diff --git a/pkgs/os-specific/linux/scx/default.nix b/pkgs/os-specific/linux/scx/default.nix
index 112c6a9edc89..ae7434370d83 100644
--- a/pkgs/os-specific/linux/scx/default.nix
+++ b/pkgs/os-specific/linux/scx/default.nix
@@ -17,15 +17,6 @@ let
       inherit (versionInfo.scx) hash;
     };
 
-    patches = [
-      # Remove after new release
-      (fetchpatch2 {
-        name = "fix-builds-on-debug-fs-kernels";
-        url = "https://github.com/sched-ext/scx/commit/3c09e8c8c62efd701107f4c2071211db02341d62.patch?full_index=1";
-        hash = "sha256-jLMlCKBYQKS6sf5pZy5z19iSmX9bu9rlXHmGVaxTOho=";
-      })
-    ];
-
     meta = {
       homepage = "https://github.com/sched-ext/scx";
       changelog = "https://github.com/sched-ext/scx/releases/tag/v${versionInfo.scx.version}";
diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index 78861dfd5024..84b07682015d 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -26,7 +26,7 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "scx_cscheds";
-  inherit (scx-common) version src patches;
+  inherit (scx-common) version src;
 
   # scx needs specific commits of bpftool and libbpf
   # can be found in meson.build of scx src
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index fa002ea5811b..2e4cabfb95ea 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -11,7 +11,7 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "scx_rustscheds";
-  inherit (scx-common) version src patches;
+  inherit (scx-common) version src;
 
   useFetchCargoVendor = true;
   inherit (scx-common.versionInfo.scx) cargoHash;
diff --git a/pkgs/os-specific/linux/scx/version.json b/pkgs/os-specific/linux/scx/version.json
index 3b98f94a3f40..c23828ced321 100644
--- a/pkgs/os-specific/linux/scx/version.json
+++ b/pkgs/os-specific/linux/scx/version.json
@@ -1,8 +1,8 @@
 {
   "scx": {
-    "version": "1.0.10",
-    "hash": "sha256-IJn3MAPEwxImHUfHV7zPNlAlHXvzOkH0S7eJDNnupf0=",
-    "cargoHash": "sha256-d0TvLhBaDgqi4/dtVgL+UOn78uaqSpdFxm4kBdVyCR4="
+    "version": "1.0.11",
+    "hash": "sha256-Lj+YH+pWcdbGvpk6PAgat279cXOGkm0SZ5+wdK+2u9Q=",
+    "cargoHash": "sha256-sDrkUiZpX04A6a4ltFFZo6qtUgUgZ0ydml4mfKYYu3g="
   },
   "bpftool": {
     "rev": "183e7010387d1fc9f08051426e9a9fbd5f8d409e",
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
index 2d0c25c578fc..884667c39172 100644
--- a/pkgs/tools/networking/vpn-slice/default.nix
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -3,10 +3,12 @@
   stdenv,
   buildPythonApplication,
   nix-update-script,
-  python3Packages,
   fetchFromGitHub,
+  dnspython,
   iproute2,
   iptables,
+  setproctitle,
+  setuptools,
   unixtools,
 }:
 
@@ -33,11 +35,11 @@ buildPythonApplication rec {
         --replace-fail "'/sbin/iptables'" "'${iptables}/bin/iptables'"
     '';
 
-  build-system = with python3Packages; [
+  build-system = [
     setuptools
   ];
 
-  dependencies = with python3Packages; [
+  dependencies = [
     setuptools # can be removed with next package update, upstream no longer has a dependency on distutils
     setproctitle
     dnspython
diff --git a/pkgs/tools/security/bitwarden-directory-connector/default.nix b/pkgs/tools/security/bitwarden-directory-connector/default.nix
index 1fc1579f3327..ab25caee50ac 100644
--- a/pkgs/tools/security/bitwarden-directory-connector/default.nix
+++ b/pkgs/tools/security/bitwarden-directory-connector/default.nix
@@ -7,7 +7,7 @@
   python3,
   pkg-config,
   libsecret,
-  nodejs_18,
+  nodejs_22,
 }:
 
 let
@@ -19,14 +19,14 @@ let
     }:
     buildNpmPackage rec {
       pname = name;
-      version = "2025.1.0";
-      nodejs = nodejs_18;
+      version = "2025.3.0";
+      nodejs = nodejs_22;
 
       src = fetchFromGitHub {
         owner = "bitwarden";
         repo = "directory-connector";
         rev = "v${version}";
-        hash = "sha256-4Bt+E0lkmRXY4yIq6DwCyggcu7/8QtaYE9QHNTUhM+8=";
+        hash = "sha256-8EY+bU7i3fdUBQYsykUzgOIWS5VAJlmRYW8fsp0xfnY=";
       };
 
       postPatch = ''
@@ -38,7 +38,7 @@ let
           --replace-fail "AppImage" "dir"
       '';
 
-      npmDepsHash = "sha256-vvVZIfRZw5C4pLUkNHS+kgD7MzoImvsf8CGxdH2xXOs=";
+      npmDepsHash = "sha256-2McM5o6CxEu8YcFl4ey9cirfJYYIY3kLkuyLL020E+A=";
 
       env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3ed7a2e8b6d5..0f19e013627a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4496,6 +4496,7 @@ with pkgs;
 
   netcat = libressl.nc.overrideAttrs (old: {
     meta = old.meta // {
+      description = "Utility which reads and writes data across network connections — LibreSSL implementation";
       mainProgram = "nc";
     };
   });
@@ -15720,7 +15721,7 @@ with pkgs;
 
   openscad = libsForQt5.callPackage ../applications/graphics/openscad { };
 
-  opentimestamps-client = python3Packages.callPackage ../tools/misc/opentimestamps-client { };
+  opentimestamps-client = callPackage ../tools/misc/opentimestamps-client { };
 
   opentoonz = libsForQt5.callPackage ../applications/graphics/opentoonz { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d8fdc3348ff7..22d0ad6189e4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12877,6 +12877,8 @@ self: super: with self; {
 
   pypoolstation = callPackage ../development/python-modules/pypoolstation { };
 
+  pyporscheconnectapi = callPackage ../development/python-modules/pyporscheconnectapi { };
+
   pyppeteer = callPackage ../development/python-modules/pyppeteer { };
 
   pyppmd = callPackage ../development/python-modules/pyppmd { };