diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 437e4187fc3f..9c3a264db53e 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -8,6 +8,10 @@
 
 - `services.rippleDataApi` has been removed, as `ripple-data-api` was broken and had not been updated since 2022.
 
+- The `rustPlatform.fetchCargoTarball` function is deprecated, because it relied on `cargo vendor` not changing its output format to keep fixed-output derivation hashes the same, which is a Nix invariant, and Cargo 1.84.0 changed `cargo vendor`'s output format.
+  It should generally be replaced with `rustPlatform.fetchCargoVendor`, but `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
+  `rustPlatform.buildRustPackage` users must set `useFetchCargoVendor` to `true` and regenerate the `cargoHash`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ### Titanium removed {#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ffd58bb2e749..d39da6d4a57a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22845,6 +22845,13 @@
     githubId = 159372832;
     keys = [ { fingerprint = "6F54 C08C 37C8 EC78 15FA  0D01 A721 8CBA 2D80 15C3"; } ];
   };
+  Tert0 = {
+    name = "Tert0";
+    github = "Tert0";
+    githubId = 62036464;
+    email = "tert0byte@gmail.com";
+    keys = [ { fingerprint = "F899 D3B5 00BF 98AE 9097  F616 7069 D89F 9E5C 97ED"; } ];
+  };
   tesq0 = {
     email = "mikolaj.galkowski@gmail.com";
     github = "tesq0";
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index 604f399e0088..cde2107eb3f4 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -1,4 +1,10 @@
-{ config, lib, pkgs, utils, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
 let
   # Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
   inherit (utils.systemdUtils.unitOptions) unitOption;
@@ -8,269 +14,297 @@ in
     description = ''
       Periodic backups to create with Restic.
     '';
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        passwordFile = lib.mkOption {
-          type = lib.types.str;
-          description = ''
-            Read the repository password from a file.
-          '';
-          example = "/etc/nixos/restic-password";
-        };
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            passwordFile = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                Read the repository password from a file.
+              '';
+              example = "/etc/nixos/restic-password";
+            };
 
-        environmentFile = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            file containing the credentials to access the repository, in the
-            format of an EnvironmentFile as described by {manpage}`systemd.exec(5)`
-          '';
-        };
+            environmentFile = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                file containing the credentials to access the repository, in the
+                format of an EnvironmentFile as described by {manpage}`systemd.exec(5)`
+              '';
+            };
 
-        rcloneOptions = lib.mkOption {
-          type = with lib.types; nullOr (attrsOf (oneOf [ str bool ]));
-          default = null;
-          description = ''
-            Options to pass to rclone to control its behavior.
-            See <https://rclone.org/docs/#options> for
-            available options. When specifying option names, strip the
-            leading `--`. To set a flag such as
-            `--drive-use-trash`, which does not take a value,
-            set the value to the Boolean `true`.
-          '';
-          example = {
-            bwlimit = "10M";
-            drive-use-trash = "true";
+            rcloneOptions = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  attrsOf (oneOf [
+                    str
+                    bool
+                  ])
+                );
+              default = null;
+              description = ''
+                Options to pass to rclone to control its behavior.
+                See <https://rclone.org/docs/#options> for
+                available options. When specifying option names, strip the
+                leading `--`. To set a flag such as
+                `--drive-use-trash`, which does not take a value,
+                set the value to the Boolean `true`.
+              '';
+              example = {
+                bwlimit = "10M";
+                drive-use-trash = "true";
+              };
+            };
+
+            rcloneConfig = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  attrsOf (oneOf [
+                    str
+                    bool
+                  ])
+                );
+              default = null;
+              description = ''
+                Configuration for the rclone remote being used for backup.
+                See the remote's specific options under rclone's docs at
+                <https://rclone.org/docs/>. When specifying
+                option names, use the "config" name specified in the docs.
+                For example, to set `--b2-hard-delete` for a B2
+                remote, use `hard_delete = true` in the
+                attribute set.
+                Warning: Secrets set in here will be world-readable in the Nix
+                store! Consider using the `rcloneConfigFile`
+                option instead to specify secret values separately. Note that
+                options set here will override those set in the config file.
+              '';
+              example = {
+                type = "b2";
+                account = "xxx";
+                key = "xxx";
+                hard_delete = true;
+              };
+            };
+
+            rcloneConfigFile = lib.mkOption {
+              type = with lib.types; nullOr path;
+              default = null;
+              description = ''
+                Path to the file containing rclone configuration. This file
+                must contain configuration for the remote specified in this backup
+                set and also must be readable by root. Options set in
+                `rcloneConfig` will override those set in this
+                file.
+              '';
+            };
+
+            inhibitsSleep = lib.mkOption {
+              default = false;
+              type = lib.types.bool;
+              example = true;
+              description = ''
+                Prevents the system from sleeping while backing up.
+              '';
+            };
+
+            repository = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                repository to backup to.
+              '';
+              example = "sftp:backup@192.168.1.100:/backups/${name}";
+            };
+
+            repositoryFile = lib.mkOption {
+              type = with lib.types; nullOr path;
+              default = null;
+              description = ''
+                Path to the file containing the repository location to backup to.
+              '';
+            };
+
+            paths = lib.mkOption {
+              # This is nullable for legacy reasons only. We should consider making it a pure listOf
+              # after some time has passed since this comment was added.
+              type = lib.types.nullOr (lib.types.listOf lib.types.str);
+              default = [ ];
+              description = ''
+                Which paths to backup, in addition to ones specified via
+                `dynamicFilesFrom`.  If null or an empty array and
+                `dynamicFilesFrom` is also null, no backup command will be run.
+                 This can be used to create a prune-only job.
+              '';
+              example = [
+                "/var/lib/postgresql"
+                "/home/user/backup"
+              ];
+            };
+
+            exclude = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Patterns to exclude when backing up. See
+                https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
+                details on syntax.
+              '';
+              example = [
+                "/var/cache"
+                "/home/*/.cache"
+                ".git"
+              ];
+            };
+
+            timerConfig = lib.mkOption {
+              type = lib.types.nullOr (lib.types.attrsOf unitOption);
+              default = {
+                OnCalendar = "daily";
+                Persistent = true;
+              };
+              description = ''
+                When to run the backup. See {manpage}`systemd.timer(5)` for
+                details. If null no timer is created and the backup will only
+                run when explicitly started.
+              '';
+              example = {
+                OnCalendar = "00:05";
+                RandomizedDelaySec = "5h";
+                Persistent = true;
+              };
+            };
+
+            user = lib.mkOption {
+              type = lib.types.str;
+              default = "root";
+              description = ''
+                As which user the backup should run.
+              '';
+              example = "postgresql";
+            };
+
+            extraBackupArgs = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Extra arguments passed to restic backup.
+              '';
+              example = [
+                "--exclude-file=/etc/nixos/restic-ignore"
+              ];
+            };
+
+            extraOptions = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Extra extended options to be passed to the restic --option flag.
+              '';
+              example = [
+                "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
+              ];
+            };
+
+            initialize = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Create the repository if it doesn't exist.
+              '';
+            };
+
+            pruneOpts = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                A list of options (--keep-\* et al.) for 'restic forget
+                --prune', to automatically prune old snapshots.  The
+                'forget' command is run *after* the 'backup' command, so
+                keep that in mind when constructing the --keep-\* options.
+              '';
+              example = [
+                "--keep-daily 7"
+                "--keep-weekly 5"
+                "--keep-monthly 12"
+                "--keep-yearly 75"
+              ];
+            };
+
+            runCheck = lib.mkOption {
+              type = lib.types.bool;
+              default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
+              defaultText = lib.literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
+              description = "Whether to run the `check` command with the provided `checkOpts` options.";
+              example = true;
+            };
+
+            checkOpts = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                A list of options for 'restic check'.
+              '';
+              example = [
+                "--with-cache"
+              ];
+            };
+
+            dynamicFilesFrom = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that produces a list of files to back up.  The
+                results of this command are given to the '--files-from'
+                option. The result is merged with paths specified via `paths`.
+              '';
+              example = "find /home/matt/git -type d -name .git";
+            };
+
+            backupPrepareCommand = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that must run before starting the backup process.
+              '';
+            };
+
+            backupCleanupCommand = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that must run after finishing the backup process.
+              '';
+            };
+
+            package = lib.mkPackageOption pkgs "restic" { };
+
+            createWrapper = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to generate and add a script to the system path, that has the same environment variables set
+                as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
+                having to manually specify most options.
+              '';
+            };
+
+            progressFps = lib.mkOption {
+              type = with lib.types; nullOr numbers.nonnegative;
+              default = null;
+              description = ''
+                Controls the frequency of progress reporting.
+              '';
+              example = 0.1;
+            };
           };
-        };
-
-        rcloneConfig = lib.mkOption {
-          type = with lib.types; nullOr (attrsOf (oneOf [ str bool ]));
-          default = null;
-          description = ''
-            Configuration for the rclone remote being used for backup.
-            See the remote's specific options under rclone's docs at
-            <https://rclone.org/docs/>. When specifying
-            option names, use the "config" name specified in the docs.
-            For example, to set `--b2-hard-delete` for a B2
-            remote, use `hard_delete = true` in the
-            attribute set.
-            Warning: Secrets set in here will be world-readable in the Nix
-            store! Consider using the `rcloneConfigFile`
-            option instead to specify secret values separately. Note that
-            options set here will override those set in the config file.
-          '';
-          example = {
-            type = "b2";
-            account = "xxx";
-            key = "xxx";
-            hard_delete = true;
-          };
-        };
-
-        rcloneConfigFile = lib.mkOption {
-          type = with lib.types; nullOr path;
-          default = null;
-          description = ''
-            Path to the file containing rclone configuration. This file
-            must contain configuration for the remote specified in this backup
-            set and also must be readable by root. Options set in
-            `rcloneConfig` will override those set in this
-            file.
-          '';
-        };
-
-        inhibitsSleep = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
-          example = true;
-          description = ''
-            Prevents the system from sleeping while backing up.
-          '';
-        };
-
-        repository = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            repository to backup to.
-          '';
-          example = "sftp:backup@192.168.1.100:/backups/${name}";
-        };
-
-        repositoryFile = lib.mkOption {
-          type = with lib.types; nullOr path;
-          default = null;
-          description = ''
-            Path to the file containing the repository location to backup to.
-          '';
-        };
-
-        paths = lib.mkOption {
-          # This is nullable for legacy reasons only. We should consider making it a pure listOf
-          # after some time has passed since this comment was added.
-          type = lib.types.nullOr (lib.types.listOf lib.types.str);
-          default = [ ];
-          description = ''
-            Which paths to backup, in addition to ones specified via
-            `dynamicFilesFrom`.  If null or an empty array and
-            `dynamicFilesFrom` is also null, no backup command will be run.
-             This can be used to create a prune-only job.
-          '';
-          example = [
-            "/var/lib/postgresql"
-            "/home/user/backup"
-          ];
-        };
-
-        exclude = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Patterns to exclude when backing up. See
-            https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
-            details on syntax.
-          '';
-          example = [
-            "/var/cache"
-            "/home/*/.cache"
-            ".git"
-          ];
-        };
-
-        timerConfig = lib.mkOption {
-          type = lib.types.nullOr (lib.types.attrsOf unitOption);
-          default = {
-            OnCalendar = "daily";
-            Persistent = true;
-          };
-          description = ''
-            When to run the backup. See {manpage}`systemd.timer(5)` for
-            details. If null no timer is created and the backup will only
-            run when explicitly started.
-          '';
-          example = {
-            OnCalendar = "00:05";
-            RandomizedDelaySec = "5h";
-            Persistent = true;
-          };
-        };
-
-        user = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-          description = ''
-            As which user the backup should run.
-          '';
-          example = "postgresql";
-        };
-
-        extraBackupArgs = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Extra arguments passed to restic backup.
-          '';
-          example = [
-            "--exclude-file=/etc/nixos/restic-ignore"
-          ];
-        };
-
-        extraOptions = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Extra extended options to be passed to the restic --option flag.
-          '';
-          example = [
-            "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
-          ];
-        };
-
-        initialize = lib.mkOption {
-          type = lib.types.bool;
-          default = false;
-          description = ''
-            Create the repository if it doesn't exist.
-          '';
-        };
-
-        pruneOpts = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            A list of options (--keep-\* et al.) for 'restic forget
-            --prune', to automatically prune old snapshots.  The
-            'forget' command is run *after* the 'backup' command, so
-            keep that in mind when constructing the --keep-\* options.
-          '';
-          example = [
-            "--keep-daily 7"
-            "--keep-weekly 5"
-            "--keep-monthly 12"
-            "--keep-yearly 75"
-          ];
-        };
-
-        runCheck = lib.mkOption {
-          type = lib.types.bool;
-          default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
-          defaultText = lib.literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
-          description = "Whether to run the `check` command with the provided `checkOpts` options.";
-          example = true;
-        };
-
-        checkOpts = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            A list of options for 'restic check'.
-          '';
-          example = [
-            "--with-cache"
-          ];
-        };
-
-        dynamicFilesFrom = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that produces a list of files to back up.  The
-            results of this command are given to the '--files-from'
-            option. The result is merged with paths specified via `paths`.
-          '';
-          example = "find /home/matt/git -type d -name .git";
-        };
-
-        backupPrepareCommand = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that must run before starting the backup process.
-          '';
-        };
-
-        backupCleanupCommand = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that must run after finishing the backup process.
-          '';
-        };
-
-        package = lib.mkPackageOption pkgs "restic" { };
-
-        createWrapper = lib.mkOption {
-          type = lib.types.bool;
-          default = true;
-          description = ''
-            Whether to generate and add a script to the system path, that has the same environment variables set
-            as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
-            having to manually specify most options.
-          '';
-        };
-      };
-    }));
+        }
+      )
+    );
     default = { };
     example = {
       localbackup = {
@@ -300,119 +334,142 @@ in
       assertion = (v.repository == null) != (v.repositoryFile == null);
       message = "services.restic.backups.${n}: exactly one of repository or repositoryFile should be set";
     }) config.services.restic.backups;
-    systemd.services =
-      lib.mapAttrs'
-        (name: backup:
-          let
-            extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
-            inhibitCmd = lib.concatStringsSep " " [
-              "${pkgs.systemd}/bin/systemd-inhibit"
-              "--mode='block'"
-              "--who='restic'"
-              "--what='sleep'"
-              "--why=${lib.escapeShellArg "Scheduled backup ${name}"} "
-            ];
-            resticCmd = "${lib.optionalString backup.inhibitsSleep inhibitCmd}${backup.package}/bin/restic${extraOptions}";
-            excludeFlags = lib.optional (backup.exclude != []) "--exclude-file=${pkgs.writeText "exclude-patterns" (lib.concatStringsSep "\n" backup.exclude)}";
-            filesFromTmpFile = "/run/restic-backups-${name}/includes";
-            doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != []);
-            pruneCmd = lib.optionals (builtins.length backup.pruneOpts > 0) [
-              (resticCmd + " forget --prune " + (lib.concatStringsSep " " backup.pruneOpts))
-            ];
-            checkCmd = lib.optionals backup.runCheck [
-                (resticCmd + " check " + (lib.concatStringsSep " " backup.checkOpts))
-            ];
-            # Helper functions for rclone remotes
-            rcloneRemoteName = builtins.elemAt (lib.splitString ":" backup.repository) 1;
-            rcloneAttrToOpt = v: "RCLONE_" + lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
-            rcloneAttrToConf = v: "RCLONE_CONFIG_" + lib.toUpper (rcloneRemoteName + "_" + v);
-            toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
-          in
-          lib.nameValuePair "restic-backups-${name}" ({
-            environment = {
+    systemd.services = lib.mapAttrs' (
+      name: backup:
+      let
+        extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
+        inhibitCmd = lib.concatStringsSep " " [
+          "${pkgs.systemd}/bin/systemd-inhibit"
+          "--mode='block'"
+          "--who='restic'"
+          "--what='sleep'"
+          "--why=${lib.escapeShellArg "Scheduled backup ${name}"} "
+        ];
+        resticCmd = "${lib.optionalString backup.inhibitsSleep inhibitCmd}${backup.package}/bin/restic${extraOptions}";
+        excludeFlags = lib.optional (
+          backup.exclude != [ ]
+        ) "--exclude-file=${pkgs.writeText "exclude-patterns" (lib.concatStringsSep "\n" backup.exclude)}";
+        filesFromTmpFile = "/run/restic-backups-${name}/includes";
+        doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != [ ]);
+        pruneCmd = lib.optionals (builtins.length backup.pruneOpts > 0) [
+          (resticCmd + " forget --prune " + (lib.concatStringsSep " " backup.pruneOpts))
+        ];
+        checkCmd = lib.optionals backup.runCheck [
+          (resticCmd + " check " + (lib.concatStringsSep " " backup.checkOpts))
+        ];
+        # Helper functions for rclone remotes
+        rcloneRemoteName = builtins.elemAt (lib.splitString ":" backup.repository) 1;
+        rcloneAttrToOpt = v: "RCLONE_" + lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
+        rcloneAttrToConf = v: "RCLONE_CONFIG_" + lib.toUpper (rcloneRemoteName + "_" + v);
+        toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
+      in
+      lib.nameValuePair "restic-backups-${name}" (
+        {
+          environment =
+            {
               # not %C, because that wouldn't work in the wrapper script
               RESTIC_CACHE_DIR = "/var/cache/restic-backups-${name}";
               RESTIC_PASSWORD_FILE = backup.passwordFile;
               RESTIC_REPOSITORY = backup.repository;
               RESTIC_REPOSITORY_FILE = backup.repositoryFile;
-            } // lib.optionalAttrs (backup.rcloneOptions != null) (lib.mapAttrs'
-              (name: value:
-                lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
-              )
-              backup.rcloneOptions) // lib.optionalAttrs (backup.rcloneConfigFile != null) {
+            }
+            // lib.optionalAttrs (backup.rcloneOptions != null) (
+              lib.mapAttrs' (
+                name: value: lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
+              ) backup.rcloneOptions
+            )
+            // lib.optionalAttrs (backup.rcloneConfigFile != null) {
               RCLONE_CONFIG = backup.rcloneConfigFile;
-            } // lib.optionalAttrs (backup.rcloneConfig != null) (lib.mapAttrs'
-              (name: value:
-                lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
-              )
-              backup.rcloneConfig);
-            path = [ config.programs.ssh.package ];
-            restartIfChanged = false;
-            wants = [ "network-online.target" ];
-            after = [ "network-online.target" ];
-            serviceConfig = {
+            }
+            // lib.optionalAttrs (backup.rcloneConfig != null) (
+              lib.mapAttrs' (
+                name: value: lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
+              ) backup.rcloneConfig
+            )
+            // lib.optionalAttrs (backup.progressFps != null) {
+              RESTIC_PROGRESS_FPS = toString backup.progressFps;
+            };
+          path = [ config.programs.ssh.package ];
+          restartIfChanged = false;
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+          serviceConfig =
+            {
               Type = "oneshot";
-              ExecStart = (lib.optionals doBackup [ "${resticCmd} backup ${lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} --files-from=${filesFromTmpFile}" ])
-                ++ pruneCmd ++ checkCmd;
+              ExecStart =
+                (lib.optionals doBackup [
+                  "${resticCmd} backup ${
+                    lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)
+                  } --files-from=${filesFromTmpFile}"
+                ])
+                ++ pruneCmd
+                ++ checkCmd;
               User = backup.user;
               RuntimeDirectory = "restic-backups-${name}";
               CacheDirectory = "restic-backups-${name}";
               CacheDirectoryMode = "0700";
               PrivateTmp = true;
-            } // lib.optionalAttrs (backup.environmentFile != null) {
+            }
+            // lib.optionalAttrs (backup.environmentFile != null) {
               EnvironmentFile = backup.environmentFile;
             };
-          } // lib.optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
-            preStart = ''
-              ${lib.optionalString (backup.backupPrepareCommand != null) ''
-                ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
-              ''}
-              ${lib.optionalString (backup.initialize) ''
-                ${resticCmd} cat config > /dev/null || ${resticCmd} init
-              ''}
-              ${lib.optionalString (backup.paths != null && backup.paths != []) ''
-                cat ${pkgs.writeText "staticPaths" (lib.concatLines backup.paths)} >> ${filesFromTmpFile}
-              ''}
-              ${lib.optionalString (backup.dynamicFilesFrom != null) ''
-                ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
-              ''}
-            '';
-          } // lib.optionalAttrs (doBackup || backup.backupCleanupCommand != null) {
-            postStop = ''
-              ${lib.optionalString (backup.backupCleanupCommand != null) ''
-                ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
-              ''}
-              ${lib.optionalString doBackup ''
-                rm ${filesFromTmpFile}
-              ''}
-            '';
-          })
-        )
-        config.services.restic.backups;
-    systemd.timers =
-      lib.mapAttrs'
-        (name: backup: lib.nameValuePair "restic-backups-${name}" {
-          wantedBy = [ "timers.target" ];
-          timerConfig = backup.timerConfig;
-        })
-        (lib.filterAttrs (_: backup: backup.timerConfig != null) config.services.restic.backups);
+        }
+        // lib.optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
+          preStart = ''
+            ${lib.optionalString (backup.backupPrepareCommand != null) ''
+              ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
+            ''}
+            ${lib.optionalString (backup.initialize) ''
+              ${resticCmd} cat config > /dev/null || ${resticCmd} init
+            ''}
+            ${lib.optionalString (backup.paths != null && backup.paths != [ ]) ''
+              cat ${pkgs.writeText "staticPaths" (lib.concatLines backup.paths)} >> ${filesFromTmpFile}
+            ''}
+            ${lib.optionalString (backup.dynamicFilesFrom != null) ''
+              ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
+            ''}
+          '';
+        }
+        // lib.optionalAttrs (doBackup || backup.backupCleanupCommand != null) {
+          postStop = ''
+            ${lib.optionalString (backup.backupCleanupCommand != null) ''
+              ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
+            ''}
+            ${lib.optionalString doBackup ''
+              rm ${filesFromTmpFile}
+            ''}
+          '';
+        }
+      )
+    ) config.services.restic.backups;
+    systemd.timers = lib.mapAttrs' (
+      name: backup:
+      lib.nameValuePair "restic-backups-${name}" {
+        wantedBy = [ "timers.target" ];
+        timerConfig = backup.timerConfig;
+      }
+    ) (lib.filterAttrs (_: backup: backup.timerConfig != null) config.services.restic.backups);
 
     # generate wrapper scripts, as described in the createWrapper option
-    environment.systemPackages = lib.mapAttrsToList (name: backup: let
-      extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
-      resticCmd = "${backup.package}/bin/restic${extraOptions}";
-    in pkgs.writeShellScriptBin "restic-${name}" ''
-      set -a  # automatically export variables
-      ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
-      # set same environment variables as the systemd service
-      ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
-        (lib.filterAttrs (n: v: v != null && n != "PATH"))
-        (lib.mapAttrsToList (n: v: "${n}=${v}"))
-        (lib.concatStringsSep "\n")
-      ]}
-      PATH=${config.systemd.services."restic-backups-${name}".environment.PATH}:$PATH
+    environment.systemPackages = lib.mapAttrsToList (
+      name: backup:
+      let
+        extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
+        resticCmd = "${backup.package}/bin/restic${extraOptions}";
+      in
+      pkgs.writeShellScriptBin "restic-${name}" ''
+        set -a  # automatically export variables
+        ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
+        # set same environment variables as the systemd service
+        ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
+          (lib.filterAttrs (n: v: v != null && n != "PATH"))
+          (lib.mapAttrsToList (n: v: "${n}=${v}"))
+          (lib.concatStringsSep "\n")
+        ]}
+        PATH=${config.systemd.services."restic-backups-${name}".environment.PATH}:$PATH
 
-      exec ${resticCmd} "$@"
-    '') (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);
+        exec ${resticCmd} "$@"
+      ''
+    ) (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);
   };
 }
diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index fa80c47305ba..cc7d5ff6f39e 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -20,7 +20,8 @@ let
     NoNewPrivileges = true;
     PrivateUsers = true;
     PrivateTmp = true;
-    PrivateDevices = true;
+    PrivateDevices = cfg.accelerationDevices == [ ];
+    DeviceAllow = mkIf (cfg.accelerationDevices != null) cfg.accelerationDevices;
     PrivateMounts = true;
     ProtectClock = true;
     ProtectControlGroups = true;
@@ -161,6 +162,17 @@ in
       };
     };
 
+    accelerationDevices = mkOption {
+      type = types.nullOr (types.listOf types.str);
+      default = [ ];
+      example = [ "/dev/dri/renderD128" ];
+      description = ''
+        A list of device paths to hardware acceleration devices that immich should
+        have access to. This is useful when transcoding media files.
+        The special value `[ ]` will disallow all devices using `PrivateDevices`. `null` will give access to all devices.
+      '';
+    };
+
     database = {
       enable =
         mkEnableOption "the postgresql database for use with immich. See {option}`services.postgresql`"
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 9a10067fe1e7..98eaa59575bb 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -17,8 +17,8 @@ let
     sha256Hash = "sha256-UxxofUCJGhQTLMwHGaSdNDqWnjkpRVwm2oqLLp3jR8E=";
   };
   latestVersion = {
-    version = "2024.3.2.1"; # "Android Studio Meerkat Feature Drop | 2024.3.2 Canary 1"
-    sha256Hash = "sha256-qJKkuB8v4wOqEQwnDyMegLbRLzxVwCq/hS1TQ3lhBKk=";
+    version = "2024.3.2.2"; # "Android Studio Meerkat Feature Drop | 2024.3.2 Canary 2"
+    sha256Hash = "sha256-P0yBlqcuTSmJ4gmSvSCW31ARqDBC3NC8PozQHIXPS8Y=";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 2f724348c701..76b98bf18af6 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -1302,6 +1302,30 @@ final: prev:
     meta.homepage = "https://github.com/giuxtaposition/blink-cmp-copilot/";
   };
 
+  blink-cmp-spell = buildVimPlugin {
+    pname = "blink-cmp-spell";
+    version = "2025-02-01";
+    src = fetchFromGitHub {
+      owner = "ribru17";
+      repo = "blink-cmp-spell";
+      rev = "38d6797dea6f72baa6e8b3bfca6da96d8fcac64d";
+      sha256 = "19pnasa446iiapgsr3z2fpk0nnrzh8g5wrzrq8n0y4q0z6spc9f6";
+    };
+    meta.homepage = "https://github.com/ribru17/blink-cmp-spell/";
+  };
+
+  blink-cmp-git = buildVimPlugin {
+    pname = "blink-cmp-git";
+    version = "2025-01-27";
+    src = fetchFromGitHub {
+      owner = "Kaiser-Yang";
+      repo = "blink-cmp-git";
+      rev = "7c6cfa3d427f50a6eae5c38628b31b8675bab05d";
+      sha256 = "08hfwnjgsl88bkphpdxkdswdnc10mlxpsrk084kgzk4j19w55gyq";
+    };
+    meta.homepage = "https://github.com/Kaiser-Yang/blink-cmp-git/";
+  };
+
   blink-compat = buildVimPlugin {
     pname = "blink.compat";
     version = "2025-01-20";
@@ -3007,6 +3031,18 @@ final: prev:
     meta.homepage = "https://github.com/hat0uma/csvview.nvim/";
   };
 
+  ctags-lsp-nvim = buildVimPlugin {
+    pname = "ctags-lsp.nvim";
+    version = "2024-12-08";
+    src = fetchFromGitHub {
+      owner = "netmute";
+      repo = "ctags-lsp.nvim";
+      rev = "aaae7b5d8dc7aeb836c63301b8eb7311af49bb2a";
+      sha256 = "06h388vkp8nv15wbh96pza85994xf979s7kjqrli4s6y5ygw6m02";
+    };
+    meta.homepage = "https://github.com/netmute/ctags-lsp.nvim/";
+  };
+
   ctrlp-cmatcher = buildVimPlugin {
     pname = "ctrlp-cmatcher";
     version = "2015-10-15";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index bd9f3940bf2a..953d95428e5d 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -296,6 +296,10 @@ in
     dependencies = [ self.blink-cmp ];
   };
 
+  blink-cmp-git = super.blink-cmp-git.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+  };
+
   bluloco-nvim = super.bluloco-nvim.overrideAttrs {
     dependencies = [ self.lush-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 812b04c932fb..c702f9edc674 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -106,6 +106,8 @@ https://github.com/max397574/better-escape.nvim/,,
 https://github.com/LunarVim/bigfile.nvim/,,
 https://github.com/APZelos/blamer.nvim/,HEAD,
 https://github.com/giuxtaposition/blink-cmp-copilot/,HEAD,
+https://github.com/Kaiser-Yang/blink-cmp-git/,HEAD,
+https://github.com/ribru17/blink-cmp-spell/,HEAD,
 https://github.com/fang2hou/blink-copilot/,HEAD,
 https://github.com/moyiz/blink-emoji.nvim/,HEAD,
 https://github.com/mikavilpas/blink-ripgrep.nvim/,HEAD,
@@ -248,6 +250,7 @@ https://github.com/Decodetalkers/csharpls-extended-lsp.nvim/,HEAD,
 https://github.com/davidmh/cspell.nvim/,HEAD,
 https://github.com/chrisbra/csv.vim/,,
 https://github.com/hat0uma/csvview.nvim/,HEAD,
+https://github.com/netmute/ctags-lsp.nvim/,HEAD,
 https://github.com/JazzCore/ctrlp-cmatcher/,,
 https://github.com/FelikZ/ctrlp-py-matcher/,,
 https://github.com/amiorin/ctrlp-z/,,
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index e7a6aa4950ad..cd79731e1bbb 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "0dz8zpb1la98y63x7qs00s28bzn10ycipwsf6a5lvyhzzgpl253a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0sn4m1djj8npdx90mny7cwc843ri9q4s0w906rgabjw2v1h56qz0"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "04qsn75xzfl29fksnb0rzcj7cfdi84smmhn9v47l423zbgr30pfv"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1mk8xjc4zj3a6jm53drwicqsipy58faxmq990s14lqvrhh3qjnh4"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "1bk8skws87561n06mkwh92c93v5rinf8nmwydn06p8crz9ggp5q6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "0s1h6lksn83r71ia61h9cjwiqigz9nw9n9jm92749782c8zi918x"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.0%2Bk3s1/k3s-images.txt",
-    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-images.txt",
+    "sha256": "08qxykq9aylfgm24g8ybki62r2sdzvnmv72pan4i2nn0js93nnk9"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index 1e2c9a4fac75..6a966b4f0ba8 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.32.0+k3s1";
-  k3sCommit = "cca8facaa33a3ec7897349a8740fd96029590c31";
-  k3sRepoSha256 = "0l8mciwv2wr266zxv9zc5wpgf92gqvzg4d08z4g63wbvsi7zflzh";
-  k3sVendorHash = "sha256-3hY67A6GbzB2ki5GB7GmmmGG5A4cup17zhkUNiN1chk=";
+  k3sVersion = "1.32.1+k3s1";
+  k3sCommit = "6a322f122729e0e668ca67fd9f0e993541bdce49";
+  k3sRepoSha256 = "00ljl6mzbyvyy25cz0k511wmm1zhllvz0l2ns72ic4xjg9sxq6zi";
+  k3sVendorHash = "sha256-/VQslKifAKFo57Zut9F8jWWNuMRFlMgpGo/FoqutT7Q=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 0821592e1fe1..c477262968af 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -69,94 +69,102 @@ let
     else
       throw "fetchCargoTarball requires a hash for ${name}";
 in
-stdenv.mkDerivation (
-  {
-    name = "${name}-vendor.tar.gz";
-    nativeBuildInputs = [
-      cacert
-      git
-      cargo-vendor-normalise
-      cargo
-    ] ++ nativeBuildInputs;
+lib.warn
+  ''
+    rustPlatform.fetchCargoTarball is deprecated in favor of rustPlatform.fetchCargoVendor.
+    If you are using buildRustPackage, try setting useFetchCargoVendor = true and regenerating cargoHash.
+    See the 25.05 release notes for more information.
+  ''
+  (
+    stdenv.mkDerivation (
+      {
+        name = "${name}-vendor.tar.gz";
+        nativeBuildInputs = [
+          cacert
+          git
+          cargo-vendor-normalise
+          cargo
+        ] ++ nativeBuildInputs;
 
-    dontConfigure = true;
-    buildPhase = ''
-      runHook preBuild
+        dontConfigure = true;
+        buildPhase = ''
+          runHook preBuild
 
-      # Ensure deterministic Cargo vendor builds
-      export SOURCE_DATE_EPOCH=1
+          # Ensure deterministic Cargo vendor builds
+          export SOURCE_DATE_EPOCH=1
 
-      if [ -n "''${cargoRoot-}" ]; then
-        cd "$cargoRoot"
-      fi
+          if [ -n "''${cargoRoot-}" ]; then
+            cd "$cargoRoot"
+          fi
 
-      if [[ ! -f Cargo.lock ]]; then
-          echo
-          echo "ERROR: The Cargo.lock file doesn't exist"
-          echo
-          echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
-          echo "when the registry is updated."
-          echo
+          if [[ ! -f Cargo.lock ]]; then
+              echo
+              echo "ERROR: The Cargo.lock file doesn't exist"
+              echo
+              echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
+              echo "when the registry is updated."
+              echo
 
-          exit 1
-      fi
+              exit 1
+          fi
 
-      # Keep the original around for copyLockfile
-      cp Cargo.lock Cargo.lock.orig
+          # Keep the original around for copyLockfile
+          cp Cargo.lock Cargo.lock.orig
 
-      export CARGO_HOME=$(mktemp -d cargo-home.XXX)
-      CARGO_CONFIG=$(mktemp cargo-config.XXXX)
+          export CARGO_HOME=$(mktemp -d cargo-home.XXX)
+          CARGO_CONFIG=$(mktemp cargo-config.XXXX)
 
-      if [[ -n "$NIX_CRATES_INDEX" ]]; then
-      cat >$CARGO_HOME/config.toml <<EOF
-      [source.crates-io]
-      replace-with = 'mirror'
-      [source.mirror]
-      registry = "$NIX_CRATES_INDEX"
-      EOF
-      fi
+          if [[ -n "$NIX_CRATES_INDEX" ]]; then
+          cat >$CARGO_HOME/config.toml <<EOF
+          [source.crates-io]
+          replace-with = 'mirror'
+          [source.mirror]
+          registry = "$NIX_CRATES_INDEX"
+          EOF
+          fi
 
-      ${cargoUpdateHook}
+          ${cargoUpdateHook}
 
-      # Override the `http.cainfo` option usually specified in `.cargo/config`.
-      export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+          # Override the `http.cainfo` option usually specified in `.cargo/config`.
+          export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
 
-      if grep '^source = "git' Cargo.lock; then
-          echo
-          echo "ERROR: The Cargo.lock contains git dependencies"
-          echo
-          echo "This is not supported in the default fixed-output derivation fetcher."
-          echo "Set \`useFetchCargoVendor = true\` / use fetchCargoVendor"
-          echo "or use cargoLock.lockFile / importCargoLock instead."
-          echo
+          if grep '^source = "git' Cargo.lock; then
+              echo
+              echo "ERROR: The Cargo.lock contains git dependencies"
+              echo
+              echo "This is not supported in the default fixed-output derivation fetcher."
+              echo "Set \`useFetchCargoVendor = true\` / use fetchCargoVendor"
+              echo "or use cargoLock.lockFile / importCargoLock instead."
+              echo
 
-          exit 1
-      fi
+              exit 1
+          fi
 
-      cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
+          cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
 
-      # Create an empty vendor directory when there is no dependency to vendor
-      mkdir -p $name
-      # Add the Cargo.lock to allow hash invalidation
-      cp Cargo.lock.orig $name/Cargo.lock
+          # Create an empty vendor directory when there is no dependency to vendor
+          mkdir -p $name
+          # Add the Cargo.lock to allow hash invalidation
+          cp Cargo.lock.orig $name/Cargo.lock
 
-      # Packages with git dependencies generate non-default cargo configs, so
-      # always install it rather than trying to write a standard default template.
-      install -D $CARGO_CONFIG $name/.cargo/config
+          # Packages with git dependencies generate non-default cargo configs, so
+          # always install it rather than trying to write a standard default template.
+          install -D $CARGO_CONFIG $name/.cargo/config
 
-      runHook postBuild
-    '';
+          runHook postBuild
+        '';
 
-    # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
-    installPhase = ''
-      tar --owner=0 --group=0 --numeric-owner --format=gnu \
-          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
-          -czf $out $name
-    '';
+        # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+        installPhase = ''
+          tar --owner=0 --group=0 --numeric-owner --format=gnu \
+              --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+              -czf $out $name
+        '';
 
-    inherit (hash_) outputHashAlgo outputHash;
+        inherit (hash_) outputHashAlgo outputHash;
 
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
-  }
-  // (removeAttrs args removedArgs)
-)
+        impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
+      }
+      // (removeAttrs args removedArgs)
+    )
+  )
diff --git a/pkgs/by-name/ca/cargo-show-asm/package.nix b/pkgs/by-name/ca/cargo-show-asm/package.nix
index c29b00755de2..ecddcce4cb93 100644
--- a/pkgs/by-name/ca/cargo-show-asm/package.nix
+++ b/pkgs/by-name/ca/cargo-show-asm/package.nix
@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.46";
+  version = "0.2.47";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-MiODtrEE/arK5SiSs/YuFWBkSQkSUrPqUZcjFd+HNbg=";
+    hash = "sha256-ZXqcBAB6gxtukQ51JPVl7qUM7eAhiBgmeZZD2pF5q2g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-8PxjPjb/ewLIK/bS6IYy/NBJQZirXWKSiz2c/lzg8zU=";
+  cargoHash = "sha256-Luts8Pe1ZltA84GQJONsDSdeOSm0F+oJ5gNJDGYBPaQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix b/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix
new file mode 100644
index 000000000000..b1ff4e01d229
--- /dev/null
+++ b/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix
@@ -0,0 +1,109 @@
+{
+  pkgsi686Linux,
+  lib,
+  stdenv,
+  fetchurl,
+  dpkg,
+  makeWrapper,
+  ghostscript,
+  file,
+  gnused,
+  gnugrep,
+  coreutils,
+  which,
+  perl,
+}:
+let
+  version = "1.0.2-0";
+  model = "dcpl3550cdw";
+  interpreter = "${pkgsi686Linux.stdenv.cc.libc}/lib/ld-linux.so.2";
+in
+stdenv.mkDerivation {
+  pname = "cups-brother-${model}";
+  inherit version;
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf103919/dcpl3550cdwpdrv-${version}.i386.deb";
+    hash = "sha256-FbtqISK3f1q1+JXJ+RP5O/8G0ZW9gcCS7OI0YRljwyY=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    dpkg-deb -x $src $out
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    substituteInPlace $out/opt/brother/Printers/${model}/lpd/filter_${model} \
+      --replace-fail /usr/bin/perl ${lib.getExe perl} \
+      --replace-fail "PRINTER =~" "PRINTER = \"${model}\"; #" \
+      --replace-fail "BR_PRT_PATH =~" "BR_PRT_PATH = \"$out/opt/brother/Printers/${model}/\"; #"
+
+    substituteInPlace $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} \
+      --replace-fail /usr/bin/perl ${lib.getExe perl} \
+      --replace-fail "basedir =~ " "basedir = \"$out/opt/brother/Printers/${model}/\"; #" \
+      --replace-fail "PRINTER =~ " "PRINTER = \"${model}\"; #" \
+      --replace-fail "LPDCONFIGEXE=" "LPDCONFIGEXE=\"$out/usr/bin/brprintconf_\"; #"
+
+    patchelf --set-interpreter ${interpreter} $out/opt/brother/Printers/${model}/lpd/br${model}filter
+    patchelf --set-interpreter ${interpreter} $out/usr/bin/brprintconf_${model}
+
+    mkdir -p $out/lib/cups/filter $out/share/cups/model
+    ln -s $out/opt/brother/Printers/${model}/lpd/filter_${model} $out/lib/cups/filter/brlpdwrapper${model}
+    ln -s $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} $out/lib/cups/filter/brother_lpdwrapper_${model}
+    ln -s $out/opt/brother/Printers/${model}/cupswrapper/brother_${model}_printer_en.ppd $out/share/cups/model/brother_${model}_printer_en.ppd
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/opt/brother/Printers/${model}/lpd/filter_${model} \
+        --prefix PATH ":" ${
+          lib.makeBinPath [
+            ghostscript
+            file
+            gnused
+            gnugrep
+            coreutils
+            which
+          ]
+        }
+    wrapProgram $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} \
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          gnugrep
+          coreutils
+        ]
+      }
+    wrapProgram $out/usr/bin/brprintconf_${model} \
+      --set LD_PRELOAD "${pkgsi686Linux.libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+    wrapProgram $out/opt/brother/Printers/${model}/lpd/br${model}filter \
+      --set LD_PRELOAD "${pkgsi686Linux.libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+  '';
+
+  meta = {
+    homepage = "https://www.brother.com/";
+    downloadPage = "https://support.brother.com/g/b/downloadlist.aspx?c=eu_ot&lang=en&prod=${model}_eu&os=128";
+    description = "Brother DCP-L3550CDW printer driver";
+    license = with lib.licenses; [
+      unfreeRedistributable
+      gpl2Only
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+    maintainers = with lib.maintainers; [ Tert0 ];
+  };
+}
diff --git a/pkgs/by-name/cy/cyberduck/package.nix b/pkgs/by-name/cy/cyberduck/package.nix
index cec9f93214df..57f71caddbbb 100644
--- a/pkgs/by-name/cy/cyberduck/package.nix
+++ b/pkgs/by-name/cy/cyberduck/package.nix
@@ -3,34 +3,58 @@
   stdenvNoCC,
   fetchurl,
   unzip,
+  makeBinaryWrapper,
+  versionCheckHook,
+  writeShellScript,
+  coreutils,
+  xcbuild,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cyberduck";
-  version = "9.0.0.41777";
+  version = "9.1.2.42722";
 
   src = fetchurl {
     url = "https://update.cyberduck.io/Cyberduck-${finalAttrs.version}.zip";
-    hash = "sha256-oDTFkoX4uu+X5vLDHn+tGoNB/Pd9ncdFE8dGS6PT5wg=";
+    hash = "sha256-oGerVv6CteMl+MJ9AfGYmo6Iv6i7BFUCF+E3My6UH6I=";
   };
   sourceRoot = ".";
 
-  nativeBuildInputs = [ unzip ];
+  nativeBuildInputs = [
+    unzip
+    makeBinaryWrapper
+  ];
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/Applications
     cp -r Cyberduck.app $out/Applications
+    makeWrapper $out/Applications/Cyberduck.app/Contents/MacOS/Cyberduck $out/bin/cyberduck
 
     runHook postInstall
   '';
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = writeShellScript "version-check" ''
+    marketing_version=$(${xcbuild}/bin/PlistBuddy -c "Print :CFBundleShortVersionString" "$1" | ${coreutils}/bin/tr -d '"')
+    build_version=$(${xcbuild}/bin/PlistBuddy -c "Print :CFBundleVersion" "$1")
+
+    echo $marketing_version.$build_version
+  '';
+  versionCheckProgramArg = [ "${placeholder "out"}/Applications/Cyberduck.app/Contents/Info.plist" ];
+  doInstallCheck = true;
+
+  meta = {
     description = "Libre file transfer client for Mac and Windows";
     homepage = "https://cyberduck.io";
-    license = licenses.gpl3Plus;
+    changelog = "https://cyberduck.io/changelog/";
+    license = lib.licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau ];
-    platforms = platforms.darwin;
+    maintainers = with lib.maintainers; [
+      emilytrau
+      DimitarNestorov
+    ];
+    platforms = lib.platforms.darwin;
+    mainProgram = "cyberduck";
   };
 })
diff --git a/pkgs/by-name/da/dave/package.nix b/pkgs/by-name/da/dave/package.nix
deleted file mode 100644
index 638a790dc504..000000000000
--- a/pkgs/by-name/da/dave/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule rec {
-  pname = "dave";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "micromata";
-    repo = "dave";
-    rev = "v${version}";
-    hash = "sha256-JgRclcSrdgTXBuU8attSbDhRj4WUGXSpKTrUZ8mP5ns=";
-  };
-
-  vendorHash = "sha256-yo6DEvKnCQak+MrpIIDU4DkRhRP+HeJXLV87NRf6g/c=";
-
-  subPackages = [
-    "cmd/dave"
-    "cmd/davecli"
-  ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.version=${version}"
-    "-X main.builtBy=nixpkgs"
-  ];
-
-  meta = {
-    homepage = "https://github.com/micromata/dave";
-    description = "Totally simple and very easy to configure stand alone webdav server";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ lunik1 ];
-    mainProgram = "dave";
-  };
-}
diff --git a/pkgs/by-name/db/dbip-asn-lite/package.nix b/pkgs/by-name/db/dbip-asn-lite/package.nix
index b5ca33f49906..65ab3c92477f 100644
--- a/pkgs/by-name/db/dbip-asn-lite/package.nix
+++ b/pkgs/by-name/db/dbip-asn-lite/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-asn-lite";
-  version = "2025-01";
+  version = "2025-02";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-asn-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-cRlhlP5ml+swBZGiLpVH5s7nvPiHUi7qxM2GajoeK+Y=";
+    hash = "sha256-lQmBPlaUib2NDLNmrB7x2HiSRXcIi3uC8wxEEBtbecI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/db/dbip-city-lite/package.nix b/pkgs/by-name/db/dbip-city-lite/package.nix
index 521d3cebf20e..444be2d9244d 100644
--- a/pkgs/by-name/db/dbip-city-lite/package.nix
+++ b/pkgs/by-name/db/dbip-city-lite/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-city-lite";
-  version = "2025-01";
+  version = "2025-02";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-city-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-fBS2JASkZaLNCjNAadNkrctixTkDvpkTUYP0yUHBXnw=";
+    hash = "sha256-p0cLbcLeoqemY4zhK7tNP//9H27BV6YOLBTgDqdcI7Q=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/db/dbip-country-lite/package.nix b/pkgs/by-name/db/dbip-country-lite/package.nix
index 00f29f3674d7..17e7bf41777f 100644
--- a/pkgs/by-name/db/dbip-country-lite/package.nix
+++ b/pkgs/by-name/db/dbip-country-lite/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-country-lite";
-  version = "2025-01";
+  version = "2025-02";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-PVpqo1t6V0kdVqA1aEgU0UqwhzmLLMHYB6gyoMusVv8=";
+    hash = "sha256-/VsGdiiDkY13fyfLoa3N1nVJEVUrqRPNFg3Bs6MVkLY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/hi/himalaya/package.nix b/pkgs/by-name/hi/himalaya/package.nix
index 1368b9da32d6..6badfc8ccfb4 100644
--- a/pkgs/by-name/hi/himalaya/package.nix
+++ b/pkgs/by-name/hi/himalaya/package.nix
@@ -19,8 +19,7 @@
 let
   version = "1.1.0";
   hash = "sha256-gdrhzyhxRHZkALB3SG/aWOdA5iMYkel3Cjk5VBy3E4M=";
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-1KtS/lzVUEDiDCo3b8RFDYeTMsbHk2tIdniFZfoTxYk=";
+  cargoHash = "sha256-ulqMjpW3UI509vs3jVHXAEQUhxU/f/hN8XiIo8UBRq8=";
 
   noDefaultFeatures = lib.warnIf
     (args ? buildNoDefaultFeatures)
@@ -45,6 +44,8 @@ rustPlatform.buildRustPackage {
     rev = "v${version}";
   };
 
+  useFetchCargoVendor = true;
+
   buildNoDefaultFeatures = noDefaultFeatures;
   buildFeatures = features;
 
diff --git a/pkgs/by-name/hy/hydra-check/package.nix b/pkgs/by-name/hy/hydra-check/package.nix
index 5117884adce1..6ea49fc8983f 100644
--- a/pkgs/by-name/hy/hydra-check/package.nix
+++ b/pkgs/by-name/hy/hydra-check/package.nix
@@ -6,21 +6,22 @@
   openssl,
   stdenv,
   installShellFiles,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hydra-check";
-  version = "2.0.1";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "hydra-check";
-    rev = "v${version}";
-    hash = "sha256-QdCXToHNymOdlTyQjk9eo7LTznGKB+3pIOgjjaGoTXg=";
+    tag = "v${version}";
+    hash = "sha256-h8bs6oe8zkzEDCoC9F6IzTaTkNf4eAAjt663V0qn73I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zjpsMuwOdDm4St8M0h4yoJhTirgANJ6s5hfbayyq/uE=";
+  cargoHash = "sha256-aV4URx9bGAOLWRh/kFDU67GiXk7RdCqfahG+fZPfdUo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -38,6 +39,12 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/hydra-check --shell-completion zsh)
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
   meta = {
     description = "Check hydra for the build status of a package";
     homepage = "https://github.com/nix-community/hydra-check";
diff --git a/pkgs/by-name/io/iosevka/package.nix b/pkgs/by-name/io/iosevka/package.nix
index 7d9cbd545089..a64819d94a95 100644
--- a/pkgs/by-name/io/iosevka/package.nix
+++ b/pkgs/by-name/io/iosevka/package.nix
@@ -56,16 +56,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "32.4.0";
+  version = "32.5.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-kB4CsC/hHstajLcVYBxO7RD0lsZymrxlUha4cRtQ7Ak=";
+    hash = "sha256-MzsAkq5l4TP19UJNPW/8hvIqsJd94pADrrv8wLG6NMQ=";
   };
 
-  npmDepsHash = "sha256-Qr7fN49qyaqaSutrdT7HjWis7jjwYR/S2kxkHs7EhXY=";
+  npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/ja/jay/package.nix b/pkgs/by-name/ja/jay/package.nix
index a33f6d89b58c..c787cb9aa8fa 100644
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jay";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "mahkoh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VAg59hmI38hJzkh/Vtv6LjrqQFLaq7rIGtk9sfQe1TA=";
+    sha256 = "sha256-RGBFIYVeunMhZbpRExKYh7VlhodOsCN7WzN/7UPEJdc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1Jf0uZYxk7I6dn+eFtohBoZtOJatvFEYom4A0dZbKYQ=";
+  cargoHash = "sha256-vW+87tqc9bJ/xDOqcgz3PrqEkf7daZp3nb0hwXDxULI=";
 
   SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
 
diff --git a/pkgs/by-name/ku/kubefirst/package.nix b/pkgs/by-name/ku/kubefirst/package.nix
index b72db614dfa8..931a8037e435 100644
--- a/pkgs/by-name/ku/kubefirst/package.nix
+++ b/pkgs/by-name/ku/kubefirst/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.7.9";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "konstructio";
     repo = "kubefirst";
     tag = "v${version}";
-    hash = "sha256-nBYwvOgkkx3NXELK+h9SpapoMjAVauI9leCPhKNZfh0=";
+    hash = "sha256-WggQdhMFbUbJ2bAj2oSveIHMg1HWPj0I14qiE3PTGqE=";
   };
 
-  vendorHash = "sha256-DYEEkduud1sXVao7xbJoyvmMhfMJUPswIs3v20tncwo=";
+  vendorHash = "sha256-WjucnfiMxthygFaxseggMmlkF/Oih310O56Y7lW+11E=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/li/libmaddy-markdown/package.nix b/pkgs/by-name/li/libmaddy-markdown/package.nix
new file mode 100644
index 000000000000..98a9ee3cff59
--- /dev/null
+++ b/pkgs/by-name/li/libmaddy-markdown/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "libmaddy-markdown";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "progsource";
+    repo = "maddy";
+    tag = finalAttrs.version;
+    hash = "sha256-sVUXACT94PSPcohnOyIp7KK8baCBuf6ZNMIyk6Cfdjg=";
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/include/maddy
+    install -Dm444 include/maddy/* -t $out/include/maddy
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "C++ Markdown to HTML header-only parser library";
+    homepage = "https://github.com/progsource/maddy";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.normalcea ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libnick/package.nix b/pkgs/by-name/li/libnick/package.nix
new file mode 100644
index 000000000000..b33595964c9e
--- /dev/null
+++ b/pkgs/by-name/li/libnick/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  validatePkgConfig,
+  openssl,
+  sqlcipher,
+  boost,
+  curl,
+  glib,
+  libsecret,
+  libmaddy-markdown,
+  testers,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnick";
+  version = "2025.1.0";
+
+  src = fetchFromGitHub {
+    owner = "NickvisionApps";
+    repo = "libnick";
+    tag = finalAttrs.version;
+    hash = "sha256-Y7Vn9KaZjEJ29o2GouNl5B/svAtJ24El9WYgXHhnxho=";
+  };
+
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isUnix [
+      pkg-config
+      validatePkgConfig
+    ];
+
+  buildInputs =
+    [
+      boost
+      libmaddy-markdown
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isUnix [
+      glib
+      openssl
+    ]
+    ++ lib.optional stdenv.hostPlatform.isWindows sqlcipher;
+
+  propagatedBuildInputs = [
+    curl
+    libsecret
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "USE_LIBSECRET" "true")
+  ];
+
+  postPatch = ''
+    substituteInPlace cmake/libnick.pc.in \
+    --replace-fail 'libdir=''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@' \
+                   'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+    --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+                   'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+  '';
+
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Cross-platform development base for native Nickvision applications";
+    homepage = "https://github.com/NickvisionApps/libnick";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.normalcea ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    pkgConfigModules = [ "libnick" ];
+  };
+})
diff --git a/pkgs/by-name/li/libxisf/package.nix b/pkgs/by-name/li/libxisf/package.nix
index 5087b9529840..60cea171bfde 100644
--- a/pkgs/by-name/li/libxisf/package.nix
+++ b/pkgs/by-name/li/libxisf/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxisf";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitea {
     domain = "gitea.nouspiro.space";
     owner = "nou";
     repo = "libXISF";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QhshgKyf9s5U5JMa5TZelIo1tpJGlsOQePPG1kEfbq8=";
+    hash = "sha256-vc42Jw7kBbQYu+/6jakxFnSuVkS8t6ZyYuSMLGMnEn4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/libxmlxx5/package.nix b/pkgs/by-name/li/libxmlxx5/package.nix
new file mode 100644
index 000000000000..52704f127edb
--- /dev/null
+++ b/pkgs/by-name/li/libxmlxx5/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libxml2,
+  glibmm,
+  meson,
+  ninja,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libxmlxx5";
+  version = "5.4";
+
+  src = fetchurl {
+    url = "https://download.gnome.org/sources/libxml++/${version}/libxml++-${lib.versions.pad 3 version}.tar.xz";
+    hash = "sha256-6aI8Q2aGqUaY0hOOa8uvhJEh1jv6D1DcNP77/XlWaEg=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [ glibmm ];
+
+  propagatedBuildInputs = [ libxml2 ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  meta = {
+    description = "C++ wrapper for the libxml2 XML parser library";
+    homepage = "https://libxmlplusplus.sourceforge.net/";
+    license = lib.licenses.lgpl2Plus;
+    maintainers = [ lib.maintainers.normalcea ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/na/natural-docs/package.nix b/pkgs/by-name/na/natural-docs/package.nix
index fcffb10de7df..51fcd609549f 100644
--- a/pkgs/by-name/na/natural-docs/package.nix
+++ b/pkgs/by-name/na/natural-docs/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "natural-docs";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchzip {
     url = "https://naturaldocs.org/download/natural_docs/${version}/Natural_Docs_${version}.zip";
-    sha256 = "sha256-yk9PxrZ6+ocqGLB+xCBGiQKnHLMdp2r+NuoMhWsr0GM=";
+    sha256 = "sha256-gjAhS2hdFA8G+E5bJD18BQdb7PrBeRnpBBSlnVJ5hgY=";
   };
 
   dontPatch = true;
diff --git a/pkgs/by-name/ng/ngrok/versions.json b/pkgs/by-name/ng/ngrok/versions.json
index 453116873bed..534f529f3337 100644
--- a/pkgs/by-name/ng/ngrok/versions.json
+++ b/pkgs/by-name/ng/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/cPMgrL2ncCb/ngrok-v3-3.18.1-linux-386",
-    "sha256": "f0b85d6a2f7ab3bd48186100e0f619acd18d4bdf56df2cd7044e6b35745c17a4",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/7rWAoLaoN6E/ngrok-v3-3.19.1-linux-386",
+    "sha256": "ade3cb371e0420b4d314051f702029661ec051158892ae8de87b0dd3fb8c9ae2",
+    "version": "3.19.1"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/gnpHP5YLEsK/ngrok-v3-3.18.1-linux-amd64",
-    "sha256": "7d0a1f40bfb10fd7304081dcc27d7b8d2bed86f39cd46825c07679d8c888975f",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/aNKWdiDQehF/ngrok-v3-3.19.1-linux-amd64",
+    "sha256": "eea9510a71beab13f50024c23938d00ba9cfe4a8b4840030b8432c8637b4427a",
+    "version": "3.19.1"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/mke1muTU2zp/ngrok-v3-3.18.1-linux-arm",
-    "sha256": "6e7b4723a3a2c936157e4ec7be0bcbf95b49c672223ba0621d54165e8009fd78",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/fHwvcnrN4W1/ngrok-v3-3.19.1-linux-arm",
+    "sha256": "ff1260e987641b0b280e5da3004d020093745a7586ecca65e1025bc3738d55d9",
+    "version": "3.19.1"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/jYPr353ESuj/ngrok-v3-3.18.1-linux-arm64",
-    "sha256": "0dbdfdf94b3acb777741e9eeeb27a256cb1975b7d366d1ba404804b863b8fcbb",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/ckBcN6JRV3s/ngrok-v3-3.19.1-linux-arm64",
+    "sha256": "1f8eec521c00eece4a4a15750927dc492f1243e34598868b15996940ab2bed5b",
+    "version": "3.19.1"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/iTdNrZisjJj/ngrok-v3-3.18.1-darwin-amd64",
-    "sha256": "9a1319caf566ee7f85c1a9b2982ee95c08bd549e90d56ac99ef863d5da92b4a4",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/yubNbWvsvB/ngrok-v3-3.19.1-darwin-amd64",
+    "sha256": "4e19fee94598a74164516a8b439742bd8bee8844bfea4e3f41ba33b761323583",
+    "version": "3.19.1"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/6wGwyzYTbRX/ngrok-v3-3.18.1-darwin-arm64",
-    "sha256": "9cc3fee7d81157e6bc645f160f6aa5562577c4b9f72db8675143e16d07703816",
-    "version": "3.18.1"
+    "url": "https://bin.equinox.io/a/iv6WKkDK2i5/ngrok-v3-3.19.1-darwin-arm64",
+    "sha256": "1da4acdf28b7c64ded056d29a2f3bb452481b4112a04f520f33fcead8794e2a1",
+    "version": "3.19.1"
   }
 }
diff --git a/pkgs/by-name/pa/parabolic/deps.json b/pkgs/by-name/pa/parabolic/deps.json
deleted file mode 100644
index 3bdb9a2e2489..000000000000
--- a/pkgs/by-name/pa/parabolic/deps.json
+++ /dev/null
@@ -1,237 +0,0 @@
-[
-  {
-    "pname": "Ace4896.DBus.Services.Secrets",
-    "version": "1.2.0",
-    "sha256": "1i1rwv8z2dx0mjib7vair2w7ylngmrcpbd012sdlpvdjpx0af0bn"
-  },
-  {
-    "pname": "Cake.Tool",
-    "version": "4.0.0",
-    "sha256": "11vc5fimi6w465081sqxs4zhw7grr6v8ga7nl1mscdl43wv33ql2"
-  },
-  {
-    "pname": "GetText.NET",
-    "version": "1.9.14",
-    "sha256": "18z4cf0dldcf41z8xgj3gdlvj9w5a9ikgj72623r0i740ndnl094"
-  },
-  {
-    "pname": "GirCore.Adw-1",
-    "version": "0.5.0",
-    "sha256": "130jwgkkphyhsk0c14kqmznx9ywfhiwa37lzjn2qgr68akgd3xd9"
-  },
-  {
-    "pname": "GirCore.Cairo-1.0",
-    "version": "0.5.0",
-    "sha256": "1x9d3jzzpf72gzxq6qf02ih2x79y9m5zqc874drl5wc8p1qbryzn"
-  },
-  {
-    "pname": "GirCore.FreeType2-2.0",
-    "version": "0.5.0",
-    "sha256": "1688rn8dycqcslfk850w8w2pbs4b93nmj1xa6g4n6ncy799780cy"
-  },
-  {
-    "pname": "GirCore.Gdk-4.0",
-    "version": "0.5.0",
-    "sha256": "1v2nl9gh941lqzfvryslhgsx9nwaf91q131xrpilrmk18xn3hpd6"
-  },
-  {
-    "pname": "GirCore.GdkPixbuf-2.0",
-    "version": "0.5.0",
-    "sha256": "0gbmckch435s2fxpxzqjwckfsxqsidv1nz3wil3v1a2iqvk3imnr"
-  },
-  {
-    "pname": "GirCore.Gio-2.0",
-    "version": "0.5.0",
-    "sha256": "1yx23jcyy7pzjkbcf0v0s4nw1n51rcaxf8dg7zqfzhvg9f0k2iwl"
-  },
-  {
-    "pname": "GirCore.GLib-2.0",
-    "version": "0.5.0",
-    "sha256": "169y390cgda0ps60g2j6vf5bkr6bfmxvgzga8k697bsl3dfzkkvv"
-  },
-  {
-    "pname": "GirCore.GObject-2.0",
-    "version": "0.5.0",
-    "sha256": "1w35a1kmn0ggnlwcsib9m4427299f9ylm7xkm69yzswdwzrfv1kj"
-  },
-  {
-    "pname": "GirCore.Graphene-1.0",
-    "version": "0.5.0",
-    "sha256": "16y836gzn9ah963lhg533hik8wh984j33gc60kzn8nziwxl6jplq"
-  },
-  {
-    "pname": "GirCore.Gsk-4.0",
-    "version": "0.5.0",
-    "sha256": "152c839l1lv6qc8pccmkzm72sfh45n9qpyyarxvllnn0lzhd50lf"
-  },
-  {
-    "pname": "GirCore.Gtk-4.0",
-    "version": "0.5.0",
-    "sha256": "0lj69qx9ksz9w94j4ryy8hr0ja60ijvx8wpr4l1i7ic01gsyxprc"
-  },
-  {
-    "pname": "GirCore.HarfBuzz-0.0",
-    "version": "0.5.0",
-    "sha256": "0cnic254jwkndcdg51wvi1vvh4f947ylwg63ag428gfbmx0684c4"
-  },
-  {
-    "pname": "GirCore.Pango-1.0",
-    "version": "0.5.0",
-    "sha256": "0p4ks9yk3d8pl9c58zc1ncdzw45fkkmgpwn29vj1wax73iml1k79"
-  },
-  {
-    "pname": "GirCore.PangoCairo-1.0",
-    "version": "0.5.0",
-    "sha256": "0j532ixh9adk2gwg55w81m5hwy0c6a3307jr4157pbjg2qm1x4mn"
-  },
-  {
-    "pname": "Markdig",
-    "version": "0.33.0",
-    "sha256": "1dj06wgdqmjji4nfr1dysz7hwp5bjgsrk9qjkdq82d7gk6nmhs9r"
-  },
-  {
-    "pname": "Meziantou.Framework.Win32.CredentialManager",
-    "version": "1.4.5",
-    "sha256": "1ikjxj6wir2jcjwlmd4q7zz0b4g40808gx59alvad31sb2aqp738"
-  },
-  {
-    "pname": "Microsoft.CSharp",
-    "version": "4.7.0",
-    "sha256": "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"
-  },
-  {
-    "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "8.0.0",
-    "sha256": "05qjnzk1fxybks92y93487l3mj5nghjcwiy360xjgk3jykz3rv39"
-  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "1.1.0",
-    "sha256": "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "5.0.0",
-    "sha256": "0z3qyv7qal5irvabc8lmkh58zsl42mrzd1i0sssvzhv4q4kl3cg6"
-  },
-  {
-    "pname": "Microsoft.Win32.SystemEvents",
-    "version": "8.0.0",
-    "sha256": "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"
-  },
-  {
-    "pname": "Nickvision.Aura",
-    "version": "2023.11.4",
-    "sha256": "0gasyglp1pgi0s6zqzmbm603j3j36vvr68grv6g93fdj2vjlmkxs"
-  },
-  {
-    "pname": "Octokit",
-    "version": "9.0.0",
-    "sha256": "0kw49w1hxk4d2x9598012z9q1yr3ml5rm06fy1jnmhy44s3d3jp5"
-  },
-  {
-    "pname": "pythonnet",
-    "version": "3.0.3",
-    "sha256": "0qnivddg13vi1fb22z3krsj1gczyyfd56nmk6gas6qrwlxdzhriv"
-  },
-  {
-    "pname": "SQLitePCLRaw.bundle_e_sqlcipher",
-    "version": "2.1.6",
-    "sha256": "15v2x7y4k7cl47a9jccbvgbwngwi5dz6qhv0cxpcasx4v5i9aila"
-  },
-  {
-    "pname": "SQLitePCLRaw.core",
-    "version": "2.1.6",
-    "sha256": "1w8zsgz2w2q0a9cw9cl1rzrpv48a04nhyq67ywan6xlgknds65a7"
-  },
-  {
-    "pname": "SQLitePCLRaw.lib.e_sqlcipher",
-    "version": "2.1.6",
-    "sha256": "0dl5an15whs4yl5hm2wibzbfigzck0flah8a07k99y1bhbmv080z"
-  },
-  {
-    "pname": "SQLitePCLRaw.provider.e_sqlcipher",
-    "version": "2.1.6",
-    "sha256": "1jx8d4dq5w2951b7w722gnxbfgdklwazc48kcbdzylkglwkrqgrq"
-  },
-  {
-    "pname": "System.CodeDom",
-    "version": "8.0.0",
-    "sha256": "0zyzd15v0nf8gla7nz243m1kff8ia6vqp471i3g7xgawgj5n21dv"
-  },
-  {
-    "pname": "System.Drawing.Common",
-    "version": "8.0.0",
-    "sha256": "1j4rsm36bnwqmh5br9mzmj0ikjnc39k26q6l9skjlrnw8hlngwy4"
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.3.0",
-    "sha256": "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"
-  },
-  {
-    "pname": "System.IO.Pipelines",
-    "version": "6.0.0",
-    "sha256": "08211lvckdsdbd67xz4f6cyk76cli565j0dby1grlc4k9bhwby65"
-  },
-  {
-    "pname": "System.Management",
-    "version": "8.0.0",
-    "sha256": "1zbwj6ii8axa4w8ymjzi9d9pj28nhswygahyqppvzaxypw6my2hz"
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.3",
-    "sha256": "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.5",
-    "sha256": "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.3.0",
-    "sha256": "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"
-  },
-  {
-    "pname": "System.Reflection.Emit",
-    "version": "4.3.0",
-    "sha256": "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"
-  },
-  {
-    "pname": "System.Reflection.Emit.ILGeneration",
-    "version": "4.3.0",
-    "sha256": "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.3.0",
-    "sha256": "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.3.0",
-    "sha256": "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.3.0",
-    "sha256": "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.3.0",
-    "sha256": "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"
-  },
-  {
-    "pname": "Tmds.DBus",
-    "version": "0.15.0",
-    "sha256": "1bz5j6wfp9hn4fg5vjxl6mr9lva4gx6zqncqyqxrcb8lw7hvhwc6"
-  },
-  {
-    "pname": "Tmds.DBus.Protocol",
-    "version": "0.15.0",
-    "sha256": "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"
-  }
-]
diff --git a/pkgs/by-name/pa/parabolic/package.nix b/pkgs/by-name/pa/parabolic/package.nix
index 21f6dbe6d38b..093e8f024ba2 100644
--- a/pkgs/by-name/pa/parabolic/package.nix
+++ b/pkgs/by-name/pa/parabolic/package.nix
@@ -1,77 +1,120 @@
-{ lib
-, buildDotnetModule
-, fetchFromGitHub
-, dotnetCorePackages
-, gtk4
-, libadwaita
-, pkg-config
-, wrapGAppsHook4
-, glib
-, shared-mime-info
-, gdk-pixbuf
-, blueprint-compiler
-, python3
-, ffmpeg
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gettext,
+  itstool,
+  ninja,
+  yelp-tools,
+  pkg-config,
+  libnick,
+  boost,
+  glib,
+  shared-mime-info,
+  gtk4,
+  libadwaita,
+  wrapGAppsHook4,
+  libxmlxx5,
+  blueprint-compiler,
+  qt6,
+  yt-dlp,
+  ffmpeg,
+  aria2,
+  nix-update-script,
+  uiPlatform ? "gnome",
 }:
+assert lib.assertOneOf "uiPlatform" uiPlatform [
+  "gnome"
+  "qt"
+];
 
-buildDotnetModule rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "parabolic";
-  version = "2024.5.0";
+  version = "2025.1.4";
 
   src = fetchFromGitHub {
     owner = "NickvisionApps";
     repo = "Parabolic";
-    rev = version;
-    hash = "sha256-awbCn7W7RUSuEByXxLGrsmYjmxCrwywhhrMJq/iM1Uc=";
-    fetchSubmodules = true;
+    tag = finalAttrs.version;
+    hash = "sha256-B8/e5urhy5tAgHNd/PR3HlNQd0M0CxgC56nArFGlQ9c=";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
-  pythonEnv = python3.withPackages(ps: with ps; [ yt-dlp ]);
+  nativeBuildInputs =
+    [
+      cmake
+      gettext
+      ninja
+      pkg-config
+      itstool
+      yelp-tools
+    ]
+    ++ lib.optionals (uiPlatform == "gnome") [
+      wrapGAppsHook4
+      blueprint-compiler
+      glib
+      shared-mime-info
+    ]
+    ++ lib.optional (uiPlatform == "qt") qt6.wrapQtAppsHook;
 
-  projectFile = "NickvisionTubeConverter.GNOME/NickvisionTubeConverter.GNOME.csproj";
-  nugetDeps = ./deps.json;
-  executables = "NickvisionTubeConverter.GNOME";
+  buildInputs =
+    [
+      libnick
+      boost
+    ]
+    ++ lib.optionals (uiPlatform == "qt") [
+      qt6.qtbase
+      qt6.qtsvg
+    ]
+    ++ lib.optionals (uiPlatform == "gnome") [
+      glib
+      gtk4
+      libadwaita
+      libxmlxx5
+    ];
 
-   nativeBuildInputs = [
-    pkg-config
-    wrapGAppsHook4
-    glib
-    shared-mime-info
-    gdk-pixbuf
-    blueprint-compiler
+  cmakeFlags = [
+    (lib.cmakeFeature "UI_PLATFORM" uiPlatform)
   ];
 
-  buildInputs = [ gtk4 libadwaita ];
+  preFixup =
+    lib.optionalString (uiPlatform == "gnome") "gappsWrapperArgs"
+    + lib.optionalString (uiPlatform == "qt") "qtWrapperArgs"
+    + "+=(--prefix PATH : ${
+      lib.makeBinPath [
+        aria2
+        ffmpeg
+        yt-dlp
+      ]
+    })";
 
-  runtimeDeps = [
-    gtk4
-    libadwaita
-    glib
-    gdk-pixbuf
-  ];
+  passthru.updateScript = nix-update-script { };
 
-  postPatch = ''
-    substituteInPlace NickvisionTubeConverter.Shared/Linux/org.nickvision.tubeconverter.desktop.in --replace '@EXEC@' "NickvisionTubeConverter.GNOME"
-  '';
+  meta = {
+    description = "Graphical frontend for yt-dlp to download video and audio";
+    longDescription = ''
+      Parabolic is a user-friendly frontend for `yt-dlp` that supports
+      many features including but limited to:
+      - Downloading and converting videos and audio using ffmpeg.
+      - Supporting multiple codecs.
+      - Offering YouTube sponsorblock support.
+      - Running multiple downloads at a time.
+      - Downloading metadata and video subtitles.
+      - Allowing the use of `aria2` for parallel downloads.
+      - Offering a graphical keyring to manage account credentials.
+      - Being available as both a Qt and GNOME application.
 
-  postInstall = ''
-    install -Dm444 NickvisionTubeConverter.Shared/Resources/org.nickvision.tubeconverter.svg -t $out/share/icons/hicolor/scalable/apps/
-    install -Dm444 NickvisionTubeConverter.Shared/Resources/org.nickvision.tubeconverter-symbolic.svg -t $out/share/icons/hicolor/symbolic/apps/
-    install -Dm444 NickvisionTubeConverter.Shared/Linux/org.nickvision.tubeconverter.desktop.in -T $out/share/applications/org.nickvision.tubeconverter.desktop
-  '';
-
-  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ pythonEnv ffmpeg ]}" ];
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Download web video and audio";
+      By default, the GNOME interface is used, but the Qt interface
+      can be built by overriding the `uiPlatform` argument to `"qt"`
+      over the default value `"gnome"`.
+    '';
     homepage = "https://github.com/NickvisionApps/Parabolic";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ewuuwe ];
-    mainProgram = "NickvisionTubeConverter.GNOME";
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      normalcea
+      getchoo
+    ];
+    mainProgram = "org.nickvision.tubeconverter";
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/pa/parabolic/update.sh b/pkgs/by-name/pa/parabolic/update.sh
deleted file mode 100755
index 798dba869403..000000000000
--- a/pkgs/by-name/pa/parabolic/update.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts
-#shellcheck shell=bash
-
-set -eu -o pipefail
-
-version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-    https://api.github.com/repos/NickvisionApps/Parabolic/releases/latest | jq -e -r .tag_name)
-old_version=$(nix-instantiate --eval -A parabolic.version | jq -e -r)
-
-if [[ $version == "$old_version" ]]; then
-    echo "New version same as old version, nothing to do." >&2
-    exit 0
-fi
-
-update-source-version parabolic "$version"
-
-$(nix-build -A parabolic.fetch-deps --no-out-link) "$(dirname -- "${BASH_SOURCE[0]}")/deps.nix"
diff --git a/pkgs/by-name/re/redocly/package.nix b/pkgs/by-name/re/redocly/package.nix
index 1e4f43b3b4d8..ef65d3661471 100644
--- a/pkgs/by-name/re/redocly/package.nix
+++ b/pkgs/by-name/re/redocly/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "redocly";
-  version = "1.26.0";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "Redocly";
     repo = "redocly-cli";
     rev = "@redocly/cli@${version}";
-    hash = "sha256-jBfAMrmJ9+k1Fx2gZoQ8UiTT13tSvxXUKXNCW3vmuUY=";
+    hash = "sha256-79zB7ydbgS+9us+saFiYBPHILoATP00x+Y1hAgPsPk4=";
   };
 
-  npmDepsHash = "sha256-IcyX+LmMduE8CY6wNSTv0D4c3vCZu48EXsUSsqfOqFQ=";
+  npmDepsHash = "sha256-EYhX1zAio+f1PGfQUQIFkc9Ve9jLIG7/1xgOI0JAZ5s=";
 
   npmBuildScript = "prepare";
 
diff --git a/pkgs/by-name/sa/saucectl/package.nix b/pkgs/by-name/sa/saucectl/package.nix
index 27551c557dff..237935072cfd 100644
--- a/pkgs/by-name/sa/saucectl/package.nix
+++ b/pkgs/by-name/sa/saucectl/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "saucectl";
-  version = "0.191.0";
+  version = "0.192.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "saucelabs";
     repo = "saucectl";
     tag = "v${version}";
-    hash = "sha256-cOgjNoJwcNu04YNqjeVaGIVauApYhFjLTa34HXV78sg=";
+    hash = "sha256-p7NWIjiaXM96PfmBohkfc1PQ6ZtE0pEeBVLemJiowXg=";
   };
 
   ldflags = [
@@ -22,7 +22,7 @@ buildGoModule {
     "-X github.com/saucelabs/saucectl/internal/version.GitCommit=${version}"
   ];
 
-  vendorHash = "sha256-NJBEIUeTasoIAeaGm+RdmfeELodXcnpxcxxQFaUJf4o=";
+  vendorHash = "sha256-N8e8k8vAyVY57iqHU6P88hn9NS3Mdfbgx5P8/wDcmMY=";
 
   checkFlags = [ "-skip=^TestNewRequestWithContext$" ];
 
diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index e292b1ea1080..f815d91a4ab4 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -22,11 +22,11 @@ rustPlatform.buildRustPackage {
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-CinJEzH4GsCAzU8FiInulPHLm73KI4nLlAcskkjgeJM=";
+    hash = "sha256-T6bJOXSXFWZYAxZ+nTDu+H8Wi75QRKddXkXdSOPwHbI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-inesrYFVIRIcckYWjFCG1dYyhLBInC8ODFEXwXgMjb4=";
+  cargoHash = "sha256-5f915lrymOwg5bPsTp6sxKikCcTpbeia1fQzKnLYGOs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index 196b04983ca2..7ffb6e724e84 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.21.1";
+  version = "2.21.2";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-YXGhgxpNVk1u8pFJmN194OP8wFVaMfFRiK0yitxFBPo=";
+    hash = "sha256-Tblba2vSZvnKCKvkp+QczyhiqNBx4Qpj7BfqYkdMd18=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-7ZMFKApMjxDBGuk5q+Px7ovIPO8SteNuZ1d1IdPtme0=";
+  vendorHash = "sha256-Halc2oPLYagmI7+vF8LMqBLVEcdjkHdpWYV558jLJjo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tg/tgpt/package.nix b/pkgs/by-name/tg/tgpt/package.nix
index 6abb1dd1401d..c0f0a1d3104d 100644
--- a/pkgs/by-name/tg/tgpt/package.nix
+++ b/pkgs/by-name/tg/tgpt/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "2.7.4";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     tag = "v${version}";
-    hash = "sha256-Nk+iLsTXnw6RAc1VztW8ZqeUVsywFjMCOBY2yuWbUXQ=";
+    hash = "sha256-8R6rb4GvSf4nw78Yxcuh9Vct/qUTkQNatRolT1m7JR4=";
   };
 
-  vendorHash = "sha256-docq/r6yyMPsuUyFbtCMaYfEVL0gLmyTy4PbrAemR00=";
+  vendorHash = "sha256-HObEC0SqSHJOgiJxlniN4yJ3U8ksv1HeiMhtOiZRq50=";
 
   ldflags = [
     "-s"
@@ -25,14 +25,15 @@ buildGoModule rec {
   preCheck = ''
     # Remove test which need network access
     rm providers/koboldai/koboldai_test.go
+    rm providers/phind/phind_test.go
   '';
 
-  meta = with lib; {
+  meta = {
     description = "ChatGPT in terminal without needing API keys";
     homepage = "https://github.com/aandrew-me/tgpt";
     changelog = "https://github.com/aandrew-me/tgpt/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "tgpt";
   };
 }
diff --git a/pkgs/by-name/tw/twitch-hls-client/package.nix b/pkgs/by-name/tw/twitch-hls-client/package.nix
index 0bdc151acd48..d1ba72addbcc 100644
--- a/pkgs/by-name/tw/twitch-hls-client/package.nix
+++ b/pkgs/by-name/tw/twitch-hls-client/package.nix
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-H446qXFwRGippLMZemkW8sVhTV3YGpKmAvD8QBamAlo=";
   };
 
-  cargoHash = "sha256-PK6x7xRUSbOFEAhw22T/zbMlqcS5ZQd2bpMp9OFIiUc=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-sqhB2Lj3RK1OyXy87Be9aOkfcksqz+5VfRTlKuswerU=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/vo/volatility3/package.nix b/pkgs/by-name/vo/volatility3/package.nix
index 286c54fae023..db747b0fc29f 100644
--- a/pkgs/by-name/vo/volatility3/package.nix
+++ b/pkgs/by-name/vo/volatility3/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "volatility3";
-  version = "2.8.0";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "volatilityfoundation";
     repo = "volatility3";
     tag = "v${version}";
-    hash = "sha256-XMoVfT1Wd8r684y4crTOjW9GklSTkivOGv1Ii10KzII=";
+    hash = "sha256-X2cTZaEUQm7bE0k2ve4vKj0k1N6zeLXfDzhWm32diVY=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 009978e53960..21a7691b670a 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  cmake,
   installShellFiles,
   testers,
   yara-x,
@@ -11,20 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yara-x";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-gIYqWRJI/IZwEyc1Fke/CD8PPoSZvwtvOT0rnK+LFIo=";
+    hash = "sha256-ZSJHvpRZO6Tbw7Ct4oD6QmuV4mJ4RGW5gnT6PTX+nC8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-w/jMrWu/JKhrlI5Ux+6UNkIgnVpxJtTX2LU+wP+kYFY=";
+  cargoHash = "sha256-pD4qyw+TTpmcoX1N3C65VelYszYifm9sFOsEkXEysvo=";
 
   nativeBuildInputs = [
-    cmake
     installShellFiles
   ];
 
diff --git a/pkgs/by-name/ye/yek/package.nix b/pkgs/by-name/ye/yek/package.nix
index 9c0f2b58df2c..6c23ee43b4f7 100644
--- a/pkgs/by-name/ye/yek/package.nix
+++ b/pkgs/by-name/ye/yek/package.nix
@@ -20,7 +20,8 @@ rustPlatform.buildRustPackage {
     tag = "v${version}";
     hash = "sha256-dboKZuY6mlFZu/xCoLXFJ4ARXyYs5/yOYeGkAnUKRX4=";
   };
-  cargoHash = "sha256-3+jTzYwu9eHji8o4abLiiJGXtZYPfXtXeiZEZajxrVo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-/J+11PRCWn0rzq3nILJYd3V8cxmwDegArUDp8i5rsTY=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/development/compilers/ponyc/pony-corral.nix b/pkgs/development/compilers/ponyc/pony-corral.nix
index 980b8e69d666..f56b4d0f5b19 100644
--- a/pkgs/development/compilers/ponyc/pony-corral.nix
+++ b/pkgs/development/compilers/ponyc/pony-corral.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corral";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "corral";
     rev = finalAttrs.version;
-    hash = "sha256-cbiw7OaU6HyAp/dHV5FVI7B7mam0GUb95EkR/Grwu0k=";
+    hash = "sha256-arcMtCSbXFLBT2ygdj44UKMdGStlgHyiBgt5xZpPRhs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/octave-modules/instrument-control/default.nix b/pkgs/development/octave-modules/instrument-control/default.nix
index 433bfcf24f6b..34a9644cb1a1 100644
--- a/pkgs/development/octave-modules/instrument-control/default.nix
+++ b/pkgs/development/octave-modules/instrument-control/default.nix
@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "instrument-control";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5ZufEs761qz0nKt0YYikJccqEtK+Qs9UcnJlRsW8VCM=";
+    sha256 = "sha256-AfrQQy1EuMpO6qGYz+sh4EW5eYi6fE6KaRxro0psSN8=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/aiosmtplib/default.nix b/pkgs/development/python-modules/aiosmtplib/default.nix
index 12c49c681005..bf3346f83183 100644
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "aiosmtplib";
-  version = "3.0.2";
+  version = "4.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "cole";
     repo = "aiosmtplib";
     tag = "v${version}";
-    hash = "sha256-1GuxlgNvzVv6hEQY1Mkv7NxAoOik9gpIS90a6flfC+k=";
+    hash = "sha256-Bj5wkNaNm9ojjffsS4nNKUucwbitvApIK1Ux88MSOoE=";
   };
 
   build-system = [ hatchling ];
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     description = "Module which provides a SMTP client";
     homepage = "https://github.com/cole/aiosmtplib";
     changelog = "https://github.com/cole/aiosmtplib/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/babelfont/default.nix b/pkgs/development/python-modules/babelfont/default.nix
index 4cdc2ed2e9d8..48c5211dcdd0 100644
--- a/pkgs/development/python-modules/babelfont/default.nix
+++ b/pkgs/development/python-modules/babelfont/default.nix
@@ -13,6 +13,7 @@
   setuptools,
   setuptools-scm,
   ufolib2,
+  ufomerge,
   vfblib,
 }:
 
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     openstep-plist
     orjson
     ufolib2
+    ufomerge
     vfblib
   ];
 
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index c9b34c0c920b..6663feddc114 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.36.10";
+  version = "1.36.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-/fgvvifEuQnfEwgJIv4nsuVlv1tUa/7JgF5m6YPBtdk=";
+    hash = "sha256-tBzTzvXEQvL3fRCkYJ//qowiMjKzYRVK9nT1WWUfcIk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index f2893710fa47..6c37fbbf0b33 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.36.10";
+  version = "1.36.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Jubwgr4mJigOgCEAK1u1j4DffOmtXgF5AaAxv0FBe4c=";
+    hash = "sha256-TBjwmUJURW+DTQEp7R9JQhyM2ABHxOXbkAcPafDm89I=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/dlib/default.nix b/pkgs/development/python-modules/dlib/default.nix
index 5faf143daab5..d8b863ade3f8 100644
--- a/pkgs/development/python-modules/dlib/default.nix
+++ b/pkgs/development/python-modules/dlib/default.nix
@@ -1,21 +1,20 @@
 {
-  stdenv,
   buildPythonPackage,
   dlib,
-  python,
   pytestCheckHook,
   more-itertools,
-  sse4Support ? stdenv.hostPlatform.sse4_1Support,
-  avxSupport ? stdenv.hostPlatform.avxSupport,
 }:
 
 buildPythonPackage {
   inherit (dlib)
+    stdenv
     pname
     version
     src
     nativeBuildInputs
     buildInputs
+    cmakeFlags
+    passthru
     meta
     ;
 
@@ -34,10 +33,26 @@ buildPythonPackage {
       --replace "pytest==3.8" "pytest"
   '';
 
-  setupPyBuildFlags = [
-    "--set USE_SSE4_INSTRUCTIONS=${if sse4Support then "yes" else "no"}"
-    "--set USE_AVX_INSTRUCTIONS=${if avxSupport then "yes" else "no"}"
-  ];
+  # Pass CMake flags through to the build script
+  preConfigure = ''
+    for flag in $cmakeFlags; do
+      if [[ "$flag" == -D* ]]; then
+        setupPyBuildFlags+=" --set ''${flag#-D}"
+      fi
+    done
+  '';
 
   dontUseCmakeConfigure = true;
+
+  doCheck =
+    !(
+      # The tests attempt to use CUDA on the build platform.
+      # https://github.com/NixOS/nixpkgs/issues/225912
+      dlib.cudaSupport
+
+      # although AVX can be enabled, we never test with it. Some Hydra machines
+      # fail because of this, however their build results are probably used on hardware
+      # with AVX support.
+      || dlib.avxSupport
+    );
 }
diff --git a/pkgs/development/python-modules/dsmr-parser/default.nix b/pkgs/development/python-modules/dsmr-parser/default.nix
index 44199f7c56dc..f69ea095a286 100644
--- a/pkgs/development/python-modules/dsmr-parser/default.nix
+++ b/pkgs/development/python-modules/dsmr-parser/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     hash = "sha256-NfleByW9MF7FS4n/cMv297382LucP6Z629CuA6chm20=";
   };
 
-  pythonRelaxDeps = [ "dlms-cosem" ];
+  pythonRelaxDeps = [ "dlms_cosem" ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/enturclient/default.nix b/pkgs/development/python-modules/enturclient/default.nix
index 1b62fc88ef50..372bdf17e075 100644
--- a/pkgs/development/python-modules/enturclient/default.nix
+++ b/pkgs/development/python-modules/enturclient/default.nix
@@ -6,14 +6,15 @@
   fetchFromGitHub,
   poetry-core,
   pythonOlder,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "enturclient";
   version = "0.2.4";
-  disabled = pythonOlder "3.8";
+  pyproject = true;
 
-  format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "hfurubotten";
@@ -22,23 +23,27 @@ buildPythonPackage rec {
     hash = "sha256-Y2sBPikCAxumylP1LUy8XgjBRCWaNryn5XHSrRjJIIo=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'async_timeout = "^3.0.1"' 'async_timeout = ">=3.0.1"'
-  '';
-
-  # Project has no tests
-  doCheck = false;
+  pythonRelaxDeps = [
+    "async_timeout"
+  ];
 
   pythonImportsCheck = [ "enturclient" ];
 
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [
+    "tests/dto/"
+  ];
+
   meta = with lib; {
     description = "Python library for interacting with the Entur.org API";
     homepage = "https://github.com/hfurubotten/enturclient";
diff --git a/pkgs/development/python-modules/igloohome-api/default.nix b/pkgs/development/python-modules/igloohome-api/default.nix
new file mode 100644
index 000000000000..e119d7d8b0f2
--- /dev/null
+++ b/pkgs/development/python-modules/igloohome-api/default.nix
@@ -0,0 +1,43 @@
+{
+  aiohttp,
+  buildPythonPackage,
+  dacite,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pyjwt,
+}:
+
+buildPythonPackage rec {
+  pname = "igloohome-api";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "keithle888";
+    repo = "igloohome-api";
+    tag = "v${version}";
+    hash = "sha256-CFxVZiga6008oNbacK12t7U8mOvL8YgEgQ82MsvZ46w=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    aiohttp
+    dacite
+    pyjwt
+  ];
+
+  pythonImportsCheck = [ "igloohome_api" ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/keithle888/igloohome-api/releases/tag/${src.tag}";
+    description = "Python package for using igloohome's API";
+    homepage = "https://github.com/keithle888/igloohome-api";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/nvidia-ml-py/default.nix b/pkgs/development/python-modules/nvidia-ml-py/default.nix
index 08beac0daf50..f5b4ea48a75d 100644
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "nvidia-ml-py";
-  version = "12.560.30";
+  version = "12.570.86";
 
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    extension = "tar.gz";
-    hash = "sha256-8CVNx0AGR2gKBy7gJQm/1GECtgvf7KMhV21NSBfn/pc=";
+    pname = "nvidia_ml_py";
+    inherit version;
+    hash = "sha256-BQjUoMe20BXPV0UwuVpi7U/InaO4tH4a7+Z3fbFw7Is=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
new file mode 100644
index 000000000000..11b0d47f2939
--- /dev/null
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonAtLeast,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pynfsclient";
+  version = "0.1.5";
+  pyproject = true;
+
+  disabled = pythonAtLeast "3.13";
+
+  src = fetchPypi {
+    pname = "pyNfsClient";
+    inherit version;
+    hash = "sha256-xgZL08NlMCpSkALQwklh7Xq16bK2Sm2hAynbrIWsgaU=";
+  };
+
+  postPatch = ''
+    # HISTORY.md is missing
+    substituteInPlace setup.py \
+      --replace-fail "HISTORY.md" "README.rst"
+  '';
+
+  build-system = [ setuptools ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyNfsClient" ];
+
+  meta = {
+    description = "Pure python NFS client";
+    homepage = "https://pypi.org/project/pyNfsClient/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-google-drive-api/default.nix b/pkgs/development/python-modules/python-google-drive-api/default.nix
new file mode 100644
index 000000000000..1cb239fb79ba
--- /dev/null
+++ b/pkgs/development/python-modules/python-google-drive-api/default.nix
@@ -0,0 +1,42 @@
+{
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  mashumaro,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "python-google-drive-api";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tronikos";
+    repo = "python-google-drive-api";
+    tag = "v${version}";
+    hash = "sha256-JvPaMD7UHDqCQCoh1Q8jNFw4R7Jbp2YQDBI3xVp1L1g=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    mashumaro
+  ];
+
+  pythonImportsCheck = [ "google_drive_api" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python client library for Google Drive API";
+    homepage = "https://github.com/tronikos/python-google-drive-api";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/qbusmqttapi/default.nix b/pkgs/development/python-modules/qbusmqttapi/default.nix
new file mode 100644
index 000000000000..0aaa681a024d
--- /dev/null
+++ b/pkgs/development/python-modules/qbusmqttapi/default.nix
@@ -0,0 +1,33 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "qbusmqttapi";
+  version = "1.2.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Qbus-iot";
+    repo = "qbusmqttapi";
+    tag = "v${version}";
+    hash = "sha256-daa+AwoOLJRaMzaUCai6pbYd8ux9v8NTR/mnsss/r4c=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "qbusmqttapi" ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = {
+    description = "MQTT API for Qbus Home Automation";
+    homepage = "https://github.com/Qbus-iot/qbusmqttapi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/simsimd/default.nix b/pkgs/development/python-modules/simsimd/default.nix
index 9c03f1bb904b..2dbd8773d86d 100644
--- a/pkgs/development/python-modules/simsimd/default.nix
+++ b/pkgs/development/python-modules/simsimd/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "simsimd";
-  version = "6.2.3";
+  version = "6.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "simsimd";
     tag = "v${version}";
-    hash = "sha256-9+m1NkXwlHtqeXvsyYhhT+7KNZ1aFUxxA/+i3GbQvgs=";
+    hash = "sha256-RQgPjU2uOxOnDacIARMAkKvnUIHLzRsaxLERmTrLj1Q=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index f7c8af22db8e..5a48bb73d802 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.360";
+  version = "3.2.361";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-kFLtEVbj0XTa19MOS0di6bHBMHeHH4b9+H/iHqV39kU=";
+    hash = "sha256-7w8oAIBAgYH/TXNnAVKC6E3AT37WJDSSgnpAeRfY4vA=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 4c9e256a8dcb..0f7606c79b53 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1342,7 +1342,8 @@ let
             ACPI_HOTPLUG_CPU = yes;
             ACPI_HOTPLUG_MEMORY = yes;
             MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
             MEMORY_HOTREMOVE = yes;
             HOTPLUG_CPU = yes;
             MIGRATION = yes;
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 5ab026e291b8..5488bb52e1d7 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.13-rc7",
-        "hash": "sha256:12c9bd0ikppkdpqmvg7g2062s60ks9p0qxx1jis29wl9swr74120"
+        "version": "6.14-rc1",
+        "hash": "sha256:0schcgij7kdzj0zb6g3sjf32mq7s388hysrfzjzi5g1y3py21igk"
     },
     "6.1": {
         "version": "6.1.128",
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 0e541e127cae..6dcf421c690f 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -5,8 +5,8 @@
   linux,
   scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19683";
-    sha256 = "1xp4vslbvvwys2pmms3y9phxwc7gnar3zvbwbgbp9vgjq0bsadjw";
+    rev = "19707";
+    sha256 = "1ixvavd9rhhwfnyvkdnyyjwckdijh02xppl0sjv1vw9i0jn1s1l2";
   },
   ...
 }@args:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index a56dcefd49a9..db1cef1ae7c7 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.10.231-rt123"; # updated by ./update-rt.sh
+  version = "5.10.233-rt125"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -25,7 +25,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "0xcnlz5ib4b368z5cyp4qwys3jsbm18wlvwn73rzj2j6rj1lhnjn";
+      sha256 = "0lkz2g8r032f027j3gih3f7crx991mrpng9qgqc5k4cc1wl5g7i3";
     };
 
     kernelPatches =
@@ -34,7 +34,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "01ibh8krzmwdh7229fc3ajbg1mlmd4sv969px6nh7z8fvpb60lfn";
+            sha256 = "1cx91p88h169v69lxz7vbjjnxdzdz9v28liypz099xghibwhcwfh";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 648938217933..ec8816894f78 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.15.173-rt82"; # updated by ./update-rt.sh
+  version = "5.15.177-rt83"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "1a3x3ld6g7ny0hdfqfvj5j2i5sx5l5p236pdnsr0icn9ri3jljwa";
+      sha256 = "1q56w3lqwi3ynny6z7siqzv3h8nryksyw70r3fhghca2il4bi7pa";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1xykbqkj4pqd7rdqnjk91mbdia3lxlng3c2nz7lnhhjnbva6b3vw";
+            sha256 = "1rc0cbc5jkgr3q3q2syqidak744lxcq3f5zdq6si2rsfxjz45www";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 78f1c77db53c..088c7ef0fe50 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.1.120-rt47"; # updated by ./update-rt.sh
+  version = "6.1.127-rt48"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "06gp5fdq0bc39hd8mf9mrdrygdybdr3nzsb58lcapf5vmjw9gjb1";
+      sha256 = "0xkqpwhvz6qhaxzg1j993lv1iyvb2zydgq6d8mhdbfkz38fx9c0q";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "0nq8diqbanlkglb0liva3s43wx8g6pr9znvl9cq6df093by4gcya";
+            sha256 = "1sq79iibjsph3jmmihabamzmm4sr68sw87jqqa3khzq7f2s6cwmg";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 15f738348095..3210da6a022b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.6.65-rt47"; # updated by ./update-rt.sh
+  version = "6.6.74-rt48"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "1q53xiwnszchl9c4g4yfxyzk4nffzgb4a7aq9rsyg1jcidp4gqbs";
+      sha256 = "0ka9snxl0y57fajy8vszwa4ggn48pid8m1879d4vl3mbicd2nppi";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1sb6mmbiwh7kijb2bxhlz09dgvd2hpxh6rxghwi1d4cg2151jsr5";
+            sha256 = "1rpbbm9fln2v6xigxrsajivr4zmh0nika3nmm1y7ws31njkg57gq";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index de14f7f5d31f..b3c123022de9 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,9 +12,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.12.10"; # zen
+      version = "6.13.1"; # zen
       suffix = "zen1"; # zen
-      sha256 = "1kd3bcnhlarnrpl87mrdb5r9k2jdq7m8607ai847dkmncw7q2d1q"; # zen
+      sha256 = "1n22hsjl77qby2s4wf9y6z3kbcw7yziiniv2x43xixgkl12ajvk5"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 59ecbb865ef9..11492bd163e3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -17,6 +17,7 @@
   getent,
   glibcLocales,
   autoPatchelfHook,
+  fetchpatch,
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
   glib,
@@ -281,6 +282,14 @@ stdenv.mkDerivation (finalAttrs: {
         "0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch"
         "0026-build-path.c-avoid-boot-time-segfault-for-musl.patch"
       ]
+      ++ [
+        # add a missing include
+        (fetchpatch {
+          url = "https://github.com/systemd/systemd/commit/34fcd3638817060c79e1186b370e46d9b3a7409f.patch";
+          hash = "sha256-Uaewo3jPrZGJttlLcqO6cCj1w3IGZmvbur4+TBdIPxc=";
+          excludes = [ "src/udev/udevd.c" ];
+        })
+      ]
     );
 
   postPatch =
diff --git a/pkgs/servers/osrm-backend/boost187-compat.patch b/pkgs/servers/osrm-backend/boost187-compat.patch
new file mode 100644
index 000000000000..4c5aa5eb05a8
--- /dev/null
+++ b/pkgs/servers/osrm-backend/boost187-compat.patch
@@ -0,0 +1,14 @@
+diff --git a/include/server/server.hpp b/include/server/server.hpp
+index 34b8982e67a..02b0dda050d 100644
+--- a/include/server/server.hpp
++++ b/include/server/server.hpp
+@@ -53,8 +53,7 @@ class Server
+         const auto port_string = std::to_string(port);
+ 
+         boost::asio::ip::tcp::resolver resolver(io_context);
+-        boost::asio::ip::tcp::resolver::query query(address, port_string);
+-        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(query);
++        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(address, port_string).begin();
+ 
+         acceptor.open(endpoint.protocol());
+ #ifdef SO_REUSEPORT
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index 96f7141f953b..ed811594bfc2 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
   bzip2,
@@ -16,7 +15,7 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "osrm-backend";
   version = "5.27.1-unstable-2024-11-03";
 
@@ -27,6 +26,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-iix++G49cC13wZGZIpXu1SWGtVAcqpuX3GhsIaETzUU=";
   };
 
+  patches = [
+    # Taken from https://github.com/Project-OSRM/osrm-backend/pull/7073.
+    ./boost187-compat.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 156a927527bf..bd43082ba12b 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -82,7 +82,7 @@ let
 in
 buildPythonApplication rec {
   pname = "xpra";
-  version = "6.2.2";
+  version = "6.2.3";
 
   stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
 
@@ -90,7 +90,7 @@ buildPythonApplication rec {
     owner = "Xpra-org";
     repo = "xpra";
     rev = "v${version}";
-    hash = "sha256-YLz2Ex3gHabicPbGj5BFP1pwU/8K/bu4R7cWi1Fu2oM=";
+    hash = "sha256-5f6yHz3uc5qsU1F6D8r0KPo8tbrFP4pfxXTvIJYqKuI=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index f2846c846abf..6f0efb5fc4ee 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "285";
+  version = "287";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-OTS4Lr2OF1mdIAiPGK31Ptc/gr3D216Z1kvKOMNeaJI=";
+    hash = "sha256-0s7pT8pAMCE+csd9/+Dv4AbCK0qxDacQ9fNcMYCNDbw=";
   };
 
   outputs = [
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index 715eea7768d7..a0febe773a63 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -17,8 +17,7 @@ let
   # Also don’t forget to run `nix-build -A lorri.tests`
   version = "1.7.1";
   sha256 = "sha256-dEdKMgE4Jd8CCvtGQDZNDCYOomZAV8aR7Cmtyn8RfTo=";
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-d1kXwb2WsF3J5AyD8wrrnGtCMYQ4P2mtiuJLMyCDPdM=";
+  cargoHash = "sha256-pRtc0cDVIBqbCbC1weFOhZP29rKAE1XdmM6HE5nJKRU=";
 
 in
 (rustPlatform.buildRustPackage rec {
@@ -38,6 +37,7 @@ in
     "doc"
   ];
 
+  useFetchCargoVendor = true;
   inherit cargoHash;
   doCheck = false;
 
diff --git a/pkgs/tools/security/netexec/default.nix b/pkgs/tools/security/netexec/default.nix
index 81659210895c..f3145427148f 100644
--- a/pkgs/tools/security/netexec/default.nix
+++ b/pkgs/tools/security/netexec/default.nix
@@ -27,32 +27,35 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "netexec";
-  version = "1.1.0-unstable-2024-01-15";
+  version = "1.3.0";
   pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Pennyw0rth";
+    repo = "NetExec";
+    tag = "v${version}";
+    hash = "sha256-Pub7PAw6CTN4c/PHTPE9KcnDR2a6hSza1ODp3EWMOH0=";
+  };
+
   pythonRelaxDeps = true;
+
   pythonRemoveDeps = [
     # Fail to detect dev version requirement
     "neo4j"
   ];
 
-  src = fetchFromGitHub {
-    owner = "Pennyw0rth";
-    repo = "NetExec";
-    rev = "9df72e2f68b914dfdbd75b095dd8f577e992615f";
-    hash = "sha256-oQHtTE5hdlxHX4uc412VfNUrN0UHVbwI0Mm9kmJpNW4=";
-  };
-
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace '{ git = "https://github.com/Pennyw0rth/impacket.git", branch = "gkdi" }' '"*"' \
-      --replace '{ git = "https://github.com/Pennyw0rth/oscrypto" }' '"*"'
+      --replace-fail '{ git = "https://github.com/fortra/impacket.git" }' '"*"' \
+      --replace-fail '{ git = "https://github.com/Pennyw0rth/NfsClient" }' '"*"'
   '';
 
-  nativeBuildInputs = with python.pkgs; [
+  build-system = with python.pkgs; [
     poetry-core
+    poetry-dynamic-versioning
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
     aardwolf
     aioconsole
     aiosqlite
@@ -67,13 +70,15 @@ python.pkgs.buildPythonApplication rec {
     masky
     minikerberos
     msgpack
+    msldap
     neo4j
-    oscrypto
     paramiko
     pyasn1-modules
     pylnk3
+    pynfsclient
     pypsrp
     pypykatz
+    python-dateutil
     python-libnmap
     pywerview
     requests
@@ -84,9 +89,10 @@ python.pkgs.buildPythonApplication rec {
     xmltodict
   ];
 
-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python.pkgs; [ pytestCheckHook ];
+
+  # Tests no longer works out-of-box with 1.3.0
+  doCheck = false;
 
   preCheck = ''
     export HOME=$(mktemp -d)
@@ -96,9 +102,9 @@ python.pkgs.buildPythonApplication rec {
     description = "Network service exploitation tool (maintained fork of CrackMapExec)";
     homepage = "https://github.com/Pennyw0rth/NetExec";
     changelog = "https://github.com/Pennyw0rth/NetExec/releases/tag/v${version}";
-    license = with licenses; [ bsd2 ];
-    mainProgram = "nxc";
+    license = licenses.bsd2;
     maintainers = with maintainers; [ vncsb ];
+    mainProgram = "nxc";
     # FIXME: failing fixupPhase:
     # $ Rewriting #!/nix/store/<hash>-python3-3.11.7/bin/python3.11 to #!/nix/store/<hash>-python3-3.11.7
     # $ /nix/store/<hash>-wrap-python-hook/nix-support/setup-hook: line 65: 47758 Killed: 9               sed -i "$f" -e "1 s^#!/nix/store/<hash>-python3-3.11.7^#!/nix/store/<hash>-python3-3.11.7^"
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index 00d1283c4c8e..65604d531349 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -22,17 +22,17 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.33.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     rev = version;
-    hash = "sha256-2lZfPPHHAoY12cXpkeJnvMab+C3T5O7KdmVpKqRQkgQ=";
+    hash = "sha256-p5SgXqeafEqPQmSKEtcPCHvxODxrEX4gNmpb2ybmpO4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-f+884HV9oopvr/2UfWk0sw2DW2cU3c16F+5vGc6+IL0=";
+  cargoHash = "sha256-B9RztnkIbYVWdx85p1WEskwTdFrUruD0UJ7qFIg8vy8=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = version;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 403a59eaad18..a7f851f9aa2d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -298,6 +298,7 @@ mapAliases {
   dart_stable = throw "'dart_stable' has been renamed to/replaced by 'dart'"; # Converted to throw 2024-10-17
   dart-sass-embedded = throw "dart-sass-embedded has been removed from nixpkgs, as is now included in Dart Sass itself.";
   dat = nodePackages.dat;
+  dave = throw "'dave' has been removed as it has been archived upstream. Consider using 'webdav' instead"; # Added 2025-02-03
   dbeaver = throw "'dbeaver' has been renamed to/replaced by 'dbeaver-bin'"; # Added 2024-05-16
   dbus-map = throw "'dbus-map' has been dropped as it is unmaintained"; # Added 2024-11-01
   deadpixi-sam = deadpixi-sam-unstable;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f8bb3886d5cb..25a563e2061e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6252,6 +6252,8 @@ self: super: with self; {
     inherit (pkgs) cgal libxml2;
   };
 
+  igloohome-api = callPackage ../development/python-modules/igloohome-api { };
+
   ignite = callPackage ../development/python-modules/ignite { };
 
   igraph = callPackage ../development/python-modules/igraph {
@@ -9521,6 +9523,8 @@ self: super: with self; {
 
   python-debian = callPackage ../development/python-modules/python-debian { };
 
+  python-google-drive-api = callPackage ../development/python-modules/python-google-drive-api { };
+
   python-hcl2 = callPackage ../development/python-modules/python-hcl2 { };
 
   python-lorem = callPackage ../development/python-modules/python-lorem { };
@@ -10713,6 +10717,8 @@ self: super: with self; {
 
   pylsl = callPackage ../development/python-modules/pylsl { };
 
+  pynfsclient = callPackage ../development/python-modules/pynfsclient { };
+
   pyngo = callPackage ../development/python-modules/pyngo { };
 
   pyngrok = callPackage ../development/python-modules/pyngrok { };
@@ -13755,6 +13761,8 @@ self: super: with self; {
 
   qasync = callPackage ../development/python-modules/qasync { };
 
+  qbusmqttapi = callPackage ../development/python-modules/qbusmqttapi { };
+
   qcelemental = callPackage ../development/python-modules/qcelemental { };
 
   qcengine = callPackage ../development/python-modules/qcengine { };