diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2a910ee13dd9..4ab71bbb8762 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19682,6 +19682,13 @@
     githubId = 83010835;
     keys = [ { fingerprint = "0181 FF89 4F34 7FCC EB06  5710 4C88 A185 FB89 301E"; } ];
   };
+  overloader = {
+    name = "Overloader";
+    github = "Overloader6";
+    githubId = 22007229;
+    email = "overloader@tutanota.com";
+    keys = [ { fingerprint = "B96E 6D41 E47B 042C 64A2  1D9A 8B17 537A AF09 AF18"; } ];
+  };
   ovlach = {
     email = "ondrej@vlach.xyz";
     name = "Ondrej Vlach";
diff --git a/nixos/modules/services/development/zammad.nix b/nixos/modules/services/development/zammad.nix
index b0917b6b8893..6b91626c07da 100644
--- a/nixos/modules/services/development/zammad.nix
+++ b/nixos/modules/services/development/zammad.nix
@@ -32,7 +32,6 @@ let
   };
 in
 {
-
   options = {
     services.zammad = {
       enable = lib.mkEnableOption "Zammad, a web-based, open source user support/ticketing solution";
@@ -70,12 +69,6 @@ in
         description = "Host address.";
       };
 
-      openPorts = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to open firewall ports for Zammad";
-      };
-
       port = lib.mkOption {
         type = lib.types.port;
         default = 3000;
@@ -177,6 +170,19 @@ in
         };
       };
 
+      nginx = {
+        configure = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = "Whether to configure a local nginx for Zammad.";
+        };
+
+        domain = lib.mkOption {
+          type = lib.types.str;
+          description = "The domain under which zammad will be reachable.";
+        };
+      };
+
       secretKeyBaseFile = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
@@ -203,7 +209,32 @@ in
     };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "zammad"
+      "openPorts"
+    ] "The openPorts option was removed in favor of the nginx.configure option.")
+  ];
+
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      # we try to eumulate parts of the pkgr script that are relevant to NixOS
+      (pkgs.writeShellScriptBin "zammad" ''
+        if [[ ''${1:-} != run ]]; then
+          echo "This script only supports the run subcommand".
+          exit 1
+        fi
+        shift
+
+        prog="$1"
+        shift
+        sudo -u ${cfg.user} -- env ${
+          lib.concatMapAttrsStringSep " " (n: v: "${n}=${v}") environment
+        } bash -c "cd ${cfg.package}; ${cfg.package}/bin/$prog $(printf " %q" "$@")"
+      '')
+    ];
+
     services.zammad.database.settings = {
       production = lib.mapAttrs (_: v: lib.mkDefault v) (filterNull {
         adapter = "postgresql";
@@ -217,11 +248,6 @@ in
       });
     };
 
-    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openPorts [
-      config.services.zammad.port
-      config.services.zammad.websocketPort
-    ];
-
     users.users.${cfg.user} = {
       group = "${cfg.group}";
       isSystemUser = true;
@@ -245,21 +271,56 @@ in
       }
     ];
 
-    services.postgresql = lib.optionalAttrs (cfg.database.createLocally) {
-      enable = true;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
-        {
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    services.redis = lib.optionalAttrs cfg.redis.createLocally {
-      servers."${cfg.redis.name}" = {
+    services = {
+      nginx = lib.mkIf cfg.nginx.configure {
         enable = true;
-        port = cfg.redis.port;
+        virtualHosts."${cfg.nginx.domain}" = {
+          forceSSL = true;
+          locations = {
+            "/" = {
+              proxyPass = "http://127.0.0.1:${toString config.services.zammad.port}";
+              root = "${config.services.zammad.package}/public/";
+              extraConfig = # nginx
+                ''
+                  proxy_set_header CLIENT_IP $remote_addr;
+                '';
+            };
+            "/cable" = {
+              proxyPass = "http://127.0.0.1:${toString config.services.zammad.port}";
+              proxyWebsockets = true;
+              extraConfig = # nginx
+                ''
+                  proxy_set_header CLIENT_IP $remote_addr;
+                '';
+            };
+            "/ws" = {
+              proxyPass = "http://127.0.0.1:${toString config.services.zammad.websocketPort}";
+              proxyWebsockets = true;
+              extraConfig = # nginx
+                ''
+                  proxy_set_header CLIENT_IP $remote_addr;
+                '';
+            };
+          };
+        };
+      };
+
+      postgresql = lib.optionalAttrs cfg.database.createLocally {
+        enable = true;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      redis = lib.optionalAttrs cfg.redis.createLocally {
+        servers."${cfg.redis.name}" = {
+          enable = true;
+          port = cfg.redis.port;
+        };
       };
     };
 
@@ -273,13 +334,13 @@ in
         "network.target"
         "systemd-tmpfiles-setup.service"
       ]
-      ++ lib.optionals (cfg.database.createLocally) [
+      ++ lib.optionals cfg.database.createLocally [
         "postgresql.target"
       ]
       ++ lib.optionals cfg.redis.createLocally [
         "redis-${cfg.redis.name}.service"
       ];
-      requires = lib.optionals (cfg.database.createLocally) [
+      requires = lib.optionals cfg.database.createLocally [
         "postgresql.target"
       ];
       description = "Zammad web";
@@ -307,7 +368,7 @@ in
         # cleanup state directory from module before refactoring in
         # https://github.com/NixOS/nixpkgs/pull/277456
         if [[ -e ${cfg.dataDir}/node_modules ]]; then
-          rm -rf ${cfg.dataDir}/!("tmp"|"config"|"log"|"state_dir_migrated"|"db_seeded")
+          rm -rf ${cfg.dataDir}/!("tmp"|"config"|"log"|"state_dir_migrated"|"db_seeded"|"storage")
           rm -rf ${cfg.dataDir}/config/!("database.yml"|"secrets.yml")
           # state directory cleanup required --> zammad was already installed --> do not seed db
           echo true > ${cfg.dataDir}/db_seeded
@@ -331,8 +392,9 @@ in
     systemd.tmpfiles.rules = [
       "d ${cfg.dataDir}                               0750 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/config                        0750 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/tmp                           0750 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/log                           0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                       0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/tmp                           0750 ${cfg.user} ${cfg.group} - -"
       "f ${cfg.dataDir}/config/secrets.yml            0640 ${cfg.user} ${cfg.group} - -"
       "f ${cfg.dataDir}/config/database.yml           0640 ${cfg.user} ${cfg.group} - -"
       "f ${cfg.dataDir}/db_seeded                     0640 ${cfg.user} ${cfg.group} - -"
diff --git a/nixos/modules/services/mail/stalwart-mail.nix b/nixos/modules/services/mail/stalwart-mail.nix
index 34004da62ef7..059addd617ba 100644
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -154,8 +154,8 @@ in
     ];
 
     systemd = {
-      packages = [ cfg.package ];
       services.stalwart-mail = {
+        description = "Stalwart Mail Server";
         wantedBy = [ "multi-user.target" ];
         after = [
           "local-fs.target"
@@ -173,15 +173,21 @@ in
             '';
 
         serviceConfig = {
+          # Upstream service config
+          Type = "simple";
+          LimitNOFILE = 65536;
+          KillMode = "process";
+          KillSignal = "SIGINT";
+          Restart = "on-failure";
+          RestartSec = 5;
+          SyslogIdentifier = "stalwart-mail";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} --config=${configFile}"
           ];
           LoadCredential = lib.mapAttrsToList (key: value: "${key}:${value}") cfg.credentials;
 
-          StandardOutput = "journal";
-          StandardError = "journal";
-
           ReadWritePaths = [
             cfg.dataDir
           ];
@@ -228,7 +234,6 @@ in
           UMask = "0077";
         };
         unitConfig.ConditionPathExists = [
-          ""
           "${configFile}"
         ];
       };
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 2002f2eca8c6..f852d7a8210a 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.chrony;
   chronyPkg = cfg.package;
@@ -17,21 +15,21 @@ let
   rtcFile = "${stateDir}/chrony.rtc";
 
   configFile = pkgs.writeText "chrony.conf" ''
-    ${concatMapStringsSep "\n" (
-      server: "server " + server + " " + cfg.serverOption + optionalString (cfg.enableNTS) " nts"
+    ${lib.concatMapStringsSep "\n" (
+      server: "server " + server + " " + cfg.serverOption + lib.optionalString (cfg.enableNTS) " nts"
     ) cfg.servers}
 
-    ${optionalString (
+    ${lib.optionalString (
       cfg.initstepslew.enabled && (cfg.servers != [ ])
-    ) "initstepslew ${toString cfg.initstepslew.threshold} ${concatStringsSep " " cfg.servers}"}
+    ) "initstepslew ${toString cfg.initstepslew.threshold} ${lib.concatStringsSep " " cfg.servers}"}
 
     driftfile ${driftFile}
     keyfile ${keyFile}
-    ${optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
-    ${optionalString (cfg.enableNTS) "ntsdumpdir ${stateDir}"}
+    ${lib.optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
+    ${lib.optionalString (cfg.enableNTS) "ntsdumpdir ${stateDir}"}
 
-    ${optionalString (cfg.enableRTCTrimming) "rtcautotrim ${builtins.toString cfg.autotrimThreshold}"}
-    ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
+    ${lib.optionalString (cfg.enableRTCTrimming) "rtcautotrim ${builtins.toString cfg.autotrimThreshold}"}
+    ${lib.optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
 
     ${cfg.extraConfig}
   '';
@@ -43,14 +41,14 @@ let
     "-f"
     "${configFile}"
   ]
-  ++ optional cfg.enableMemoryLocking "-m"
+  ++ lib.optional cfg.enableMemoryLocking "-m"
   ++ cfg.extraFlags;
 in
 {
   options = {
     services.chrony = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to synchronise your machine's time using chrony.
@@ -58,20 +56,20 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "chrony" { };
+      package = lib.mkPackageOption pkgs "chrony" { };
 
-      servers = mkOption {
+      servers = lib.mkOption {
         default = config.networking.timeServers;
-        defaultText = literalExpression "config.networking.timeServers";
-        type = types.listOf types.str;
+        defaultText = lib.literalExpression "config.networking.timeServers";
+        type = lib.types.listOf lib.types.str;
         description = ''
           The set of NTP servers from which to synchronise.
         '';
       };
 
-      serverOption = mkOption {
+      serverOption = lib.mkOption {
         default = "iburst";
-        type = types.enum [
+        type = lib.types.enum [
           "iburst"
           "offline"
         ];
@@ -86,8 +84,8 @@ in
         '';
       };
 
-      enableMemoryLocking = mkOption {
-        type = types.bool;
+      enableMemoryLocking = lib.mkOption {
+        type = lib.types.bool;
         default =
           config.environment.memoryAllocator.provider != "graphene-hardened"
           && config.environment.memoryAllocator.provider != "graphene-hardened-light";
@@ -97,8 +95,8 @@ in
         '';
       };
 
-      enableRTCTrimming = mkOption {
-        type = types.bool;
+      enableRTCTrimming = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Enable tracking of the RTC offset to the system clock and automatic trimming.
@@ -113,8 +111,8 @@ in
         '';
       };
 
-      autotrimThreshold = mkOption {
-        type = types.ints.positive;
+      autotrimThreshold = lib.mkOption {
+        type = lib.types.ints.positive;
         default = 30;
         example = 10;
         description = ''
@@ -124,8 +122,8 @@ in
         '';
       };
 
-      enableNTS = mkOption {
-        type = types.bool;
+      enableNTS = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable Network Time Security authentication.
@@ -134,8 +132,8 @@ in
       };
 
       initstepslew = {
-        enabled = mkOption {
-          type = types.bool;
+        enabled = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Allow chronyd to make a rapid measurement of the system clock error
@@ -144,8 +142,8 @@ in
           '';
         };
 
-        threshold = mkOption {
-          type = types.either types.float types.int;
+        threshold = lib.mkOption {
+          type = lib.types.either lib.types.float lib.types.int;
           default = 1000; # by default, same threshold as 'ntpd -g' (1000s)
           description = ''
             The threshold of system clock error (in seconds) above which the
@@ -155,14 +153,14 @@ in
         };
       };
 
-      directory = mkOption {
-        type = types.str;
+      directory = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/chrony";
         description = "Directory where chrony state is stored.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration directives that should be added to
@@ -170,10 +168,10 @@ in
         '';
       };
 
-      extraFlags = mkOption {
+      extraFlags = lib.mkOption {
         default = [ ];
         example = [ "-s" ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = "Extra flags passed to the chronyd command.";
       };
     };
@@ -184,7 +182,7 @@ in
     vifino
   ];
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ chronyPkg ];
 
     users.groups.chrony.gid = config.ids.gids.chrony;
@@ -196,7 +194,7 @@ in
       home = stateDir;
     };
 
-    services.timesyncd.enable = mkForce false;
+    services.timesyncd.enable = lib.mkForce false;
 
     # If chrony controls and tracks the RTC, writing it externally causes clock error.
     systemd.services.save-hwclock = lib.mkIf cfg.enableRTCTrimming {
@@ -233,7 +231,9 @@ in
 
       path = [ chronyPkg ];
 
-      unitConfig.ConditionCapability = "CAP_SYS_TIME";
+      unitConfig = lib.mkIf (!lib.elem "-x" cfg.extraFlags && !cfg.enableRTCTrimming) {
+        ConditionCapability = "CAP_SYS_TIME";
+      };
       serviceConfig = {
         Type = "notify";
         ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index dc2464c065e4..5fd4a5d059a6 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -40,8 +40,10 @@ let
   cacheDir = "/var/cache/mediawiki";
   stateDir = "/var/lib/mediawiki";
 
-  # https://www.mediawiki.org/wiki/Compatibility
-  php = pkgs.php82;
+  toolsPath = pkgs.symlinkJoin {
+    name = "mediawiki-path";
+    paths = cfg.path;
+  };
 
   pkg = pkgs.stdenv.mkDerivation rec {
     pname = "mediawiki-full";
@@ -52,6 +54,10 @@ let
       mkdir -p $out
       cp -r * $out/
 
+      substituteInPlace $out/share/mediawiki/includes/config-schema.php \
+        --replace-fail "/usr/bin/" "${toolsPath}/bin/" \
+        --replace-fail "\$path/" "${toolsPath}/bin/"
+
       # try removing directories before symlinking to allow overwriting any builtin extension or skin
       ${concatStringsSep "\n" (
         mapAttrsToList (k: v: ''
@@ -79,11 +85,11 @@ let
       }
       ''
         mkdir -p $out/bin
-        makeWrapper ${php}/bin/php $out/bin/mediawiki-maintenance \
+        makeWrapper ${cfg.phpPackage}/bin/php $out/bin/mediawiki-maintenance \
           --set MEDIAWIKI_CONFIG ${mediawikiConfig} \
           --add-flags ${pkg}/share/mediawiki/maintenance/run.php
 
-        for i in changePassword createAndPromote deleteUserEmail resetUserEmail userOptions edit nukePage update importDump run; do
+        for i in changePassword createAndPromote deleteUserEmail renameUser resetUserEmail userOptions edit nukePage update importDump run; do
           script="$out/bin/mediawiki-$i"
         cat <<'EOF' >"$script"
         #!${pkgs.runtimeShell}
@@ -115,7 +121,7 @@ let
   mediawikiConfig = pkgs.writeTextFile {
     name = "LocalSettings.php";
     checkPhase = ''
-      ${php}/bin/php --syntax-check "$target"
+      ${cfg.phpPackage}/bin/php --syntax-check "$target"
     '';
     text = ''
       <?php
@@ -190,7 +196,6 @@ let
         ''}
 
         $wgUseImageMagick = true;
-        $wgImageMagickConvertCommand = "${pkgs.imagemagick}/bin/convert";
 
         # InstantCommons allows wiki to use images from https://commons.wikimedia.org
         $wgUseInstantCommons = false;
@@ -226,10 +231,6 @@ let
         $wgRightsText = "";
         $wgRightsIcon = "";
 
-        # Path to the GNU diff3 utility. Used for conflict resolution.
-        $wgDiff = "${pkgs.diffutils}/bin/diff";
-        $wgDiff3 = "${pkgs.diffutils}/bin/diff3";
-
         # Enabled skins.
         ${concatStringsSep "\n" (mapAttrsToList (k: v: "wfLoadSkin('${k}');") cfg.skins)}
 
@@ -247,7 +248,6 @@ let
   withTrailingSlash = str: if lib.hasSuffix "/" str then str else "${str}/";
 in
 {
-  # interface
   options = {
     services.mediawiki = {
 
@@ -255,6 +255,11 @@ in
 
       package = mkPackageOption pkgs "mediawiki" { };
 
+      # https://www.mediawiki.org/wiki/Compatibility
+      phpPackage = mkPackageOption pkgs "php" {
+        default = "php82";
+      };
+
       finalPackage = mkOption {
         type = types.package;
         readOnly = true;
@@ -337,6 +342,13 @@ in
         description = "Contact address for password reset.";
       };
 
+      path = mkOption {
+        type = types.listOf types.package;
+        defaultText = lib.literalExpression "with pkgs; [ diffutils imagemagick ]";
+        example = lib.literalExpression "with pkgs; [ librsvg ]";
+        description = "Extra packages to add to the PATH of phpfpm-pool.";
+      };
+
       skins = mkOption {
         default = { };
         type = types.attrsOf types.path;
@@ -530,7 +542,6 @@ in
     )
   ];
 
-  # implementation
   config = mkIf cfg.enable {
 
     assertions = [
@@ -554,10 +565,16 @@ in
       }
     ];
 
-    services.mediawiki.skins = {
-      MonoBook = "${cfg.package}/share/mediawiki/skins/MonoBook";
-      Timeless = "${cfg.package}/share/mediawiki/skins/Timeless";
-      Vector = "${cfg.package}/share/mediawiki/skins/Vector";
+    services.mediawiki = {
+      path = with pkgs; [
+        diffutils
+        imagemagick
+      ];
+      skins = {
+        MonoBook = "${cfg.package}/share/mediawiki/skins/MonoBook";
+        Timeless = "${cfg.package}/share/mediawiki/skins/Timeless";
+        Vector = "${cfg.package}/share/mediawiki/skins/Vector";
+      };
     };
 
     services.mysql = mkIf (cfg.database.type == "mysql" && cfg.database.createLocally) {
@@ -588,7 +605,7 @@ in
     services.phpfpm.pools.mediawiki = {
       inherit user group;
       phpEnv.MEDIAWIKI_CONFIG = "${mediawikiConfig}";
-      phpPackage = php;
+      phpPackage = cfg.phpPackage;
       settings =
         (
           if (cfg.webserver == "apache") then
@@ -712,8 +729,8 @@ in
         fi
 
         echo "exit( \$this->getPrimaryDB()->tableExists( 'user' ) ? 1 : 0 );" | \
-        ${php}/bin/php ${pkg}/share/mediawiki/maintenance/run.php eval --conf ${mediawikiConfig} && \
-        ${php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/run.php eval --conf ${mediawikiConfig} && \
+        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
           --confpath /tmp \
           --scriptpath / \
           --dbserver ${lib.escapeShellArg dbAddr} \
@@ -735,7 +752,7 @@ in
           ${lib.escapeShellArg cfg.name} \
           admin
 
-        ${php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick --skip-external-dependencies
+        ${cfg.phpPackage}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick --skip-external-dependencies
       '';
 
       serviceConfig = {
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index f46042addf88..c3e7383964fd 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -9,19 +9,19 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.4.4";
+        version = "1.4.5";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           tag = "v${version}";
-          hash = "sha256-d3XcN+Jc9KHzVCHOatgpId/DeY/HhVkI9eF+48rzxO4=";
+          hash = "sha256-J8q/dUW5OPbMXpeZfRP3C2nseimH+HBhkSLoIAE6NlI=";
         };
 
         # Override vendorHash with overrideAttrs.
         # See https://nixos.org/manual/nixpkgs/unstable/#buildGoModule-vendorHash
-        vendorHash = "sha256-l8c85M9IdLNhZ40FkC+zH+0wHKcYHcXFbhMklCLULzs=";
+        vendorHash = "sha256-47Ri7Jdy31rIp+lon6kkpa5e7pgPevU8ajsIa/RVScY=";
 
         extraDescription = " (previously known as Singularity)";
         extraMeta.homepage = "https://apptainer.org";
@@ -46,19 +46,19 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "singularity-ce";
-        version = "4.3.4";
+        version = "4.3.5";
         projectName = "singularity";
 
         src = fetchFromGitHub {
           owner = "sylabs";
           repo = "singularity";
           tag = "v${version}";
-          hash = "sha256-+KW9XaYXNzOpUier8FJ4lbKx7uJ8jNKHkt2QX2Kiehs=";
+          hash = "sha256-CEOVtlfDyOPCg9CtShiQm+RFJUULosKtPkrOfd1vBuQ=";
         };
 
         # Override vendorHash with overrideAttrs.
         # See https://nixos.org/manual/nixpkgs/unstable/#buildGoModule-vendorHash
-        vendorHash = "sha256-JCRUhY00Zj6rlmyDW+RKoGNKhmxesgHn9XdO8h2DAj4=";
+        vendorHash = "sha256-/4jU2Za/1nNTXLy7+2NpGlr/fOJ4kMii0zxPJhytYpI=";
 
         extraConfigureFlags = [
           # Do not build squashfuse from the Git submodule sources, use Nixpkgs provided version
diff --git a/pkgs/by-name/al/alterware-launcher/package.nix b/pkgs/by-name/al/alterware-launcher/package.nix
index 53641181585b..ddb6e61a1664 100644
--- a/pkgs/by-name/al/alterware-launcher/package.nix
+++ b/pkgs/by-name/al/alterware-launcher/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alterware-launcher";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "alterware";
     repo = "alterware-launcher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TDdhPROyDUvTy7+h+P63xQ675SNhGBTU1mJTlNZyM5U=";
+    hash = "sha256-I2HlLi8f0+p1Gk7QzwNxOAOix0dxGKMmNkcXilQANzo=";
   };
 
-  cargoHash = "sha256-R5DmSMiwR/b33iyhVa7zY4GiOzTKzKTyeAvsmIEcUqk=";
+  cargoHash = "sha256-M0Y59+p0SiDiE0MM165l/5HAYc2A00S9TDcYfzdAuAw=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/au/automatic-timezoned/package.nix b/pkgs/by-name/au/automatic-timezoned/package.nix
index 3f22e60c54d4..4dc16120ff95 100644
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "automatic-timezoned";
-  version = "2.0.103";
+  version = "2.0.104";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VxD+aXGbJTdNAI9V3meQjF4CfhPr7lChhVAN4WnH6ac=";
+    sha256 = "sha256-W4iGBbWLG7HATXGv1xsapGlQ0i+RiPsIZwXET5qaPGE=";
   };
 
-  cargoHash = "sha256-0AZNViP2jE6/FZdo0LaLjxBPkPqnd2kvZmVtbi5W5RI=";
+  cargoHash = "sha256-YNBuiTUbGlUea81j+5u3qZj/xaciZ5D9QcWfe4nEG7c=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/bi/binsider/package.nix b/pkgs/by-name/bi/binsider/package.nix
index f66bc4293d36..78295d09b77a 100644
--- a/pkgs/by-name/bi/binsider/package.nix
+++ b/pkgs/by-name/bi/binsider/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "binsider";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "binsider";
     rev = "v${version}";
-    hash = "sha256-FNaYMp+vrFIziBzZ8//+ppq7kwRjBJypqsxg42XwdEs=";
+    hash = "sha256-k40mnDRbvwWJmcT02aVWdwwEiDCuL4hQnvnPitrW8qA=";
   };
 
-  cargoHash = "sha256-ZoZbhmUeC63IZ5kNuACfRaCsOicZNUAGYABSpCkUCXA=";
+  cargoHash = "sha256-hysp7AeYJ153AC0ERcrRzf4ujmM+V9pgAxOvOlG/2aE=";
 
   buildNoDefaultFeatures = !stdenv.hostPlatform.isLinux;
 
diff --git a/pkgs/by-name/cl/cldr-annotations/package.nix b/pkgs/by-name/cl/cldr-annotations/package.nix
index 0404b11c16c0..60c125758561 100644
--- a/pkgs/by-name/cl/cldr-annotations/package.nix
+++ b/pkgs/by-name/cl/cldr-annotations/package.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cldr-annotations";
-  version = "46.1";
+  version = "48";
 
   src = fetchzip {
     url = "https://unicode.org/Public/cldr/${version}/cldr-common-${version}.zip";
     stripRoot = false;
-    hash = "sha256-HNQVVbUIjsGOnkzUlH2m8I0IDgEfy2omCTekZlSyXQI=";
+    hash = "sha256-Q+dA8Y4VfO8abyHRVgoRQMfY5NG6vZn/ZorxF/SEOmo=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/de/deltatouch/package.nix b/pkgs/by-name/de/deltatouch/package.nix
index 273011a02a71..5ba82a4515ad 100644
--- a/pkgs/by-name/de/deltatouch/package.nix
+++ b/pkgs/by-name/de/deltatouch/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitea,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   intltool,
   libdeltachat,
@@ -15,43 +14,32 @@
 
 let
   libdeltachat' = libdeltachat.overrideAttrs rec {
-    version = "2.22.0";
+    version = "2.25.0";
     src = fetchFromGitHub {
       owner = "chatmail";
       repo = "core";
       tag = "v${version}";
-      hash = "sha256-DKqqdcG3C7/RF/wz2SqaiPUjZ/7vMFJTR5DIGTXjoTY=";
+      hash = "sha256-pW1+9aljtnYJmlJOj+m0aQekYO5IsL0fduR7kIAPdN8=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "chatmail-core";
       inherit version src;
-      hash = "sha256-x71vytk9ytIhHlRR0lDhDcIaDNJGDdPwb6fkB1SI+NQ=";
+      hash = "sha256-iIC9wE7P2SKeCMtc/hFTRaOGXD2F7kh1TptOoes/Qi0=";
     };
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltatouch";
-  version = "2.22.0";
+  version = "2.25.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "lk108";
     repo = "deltatouch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8kS6kAjOZ2V33XJuJbvDZ9mfRknDh9un0dn5HtD3UY=";
+    hash = "sha256-0+5wZCadYHmZjp/Za0LmK7FWq9nfyhXZFAx0lGqfRK0=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://codeberg.org/lk108/deltatouch/commit/b19c088ce95e8ca6ff1102c36d91b1db937e3a3a.patch";
-      hash = "sha256-58WPUSFaAUqVVU3iq05tae5Gvvr405zDA145V9DbJ54=";
-    })
-    (fetchpatch {
-      url = "https://codeberg.org/lk108/deltatouch/commit/139f3a4abd772b17142a7f61ef9b442200728f4a.patch";
-      hash = "sha256-bEX4g88CCt7AFok8kTeItzCripXFoG2ED7R9lGYoCAw=";
-    })
-  ];
-
   nativeBuildInputs = [
     qt5.wrapQtAppsHook
     intltool
diff --git a/pkgs/by-name/di/diesel-cli/package.nix b/pkgs/by-name/di/diesel-cli/package.nix
index 909dd6d31e9c..4b3b93417e24 100644
--- a/pkgs/by-name/di/diesel-cli/package.nix
+++ b/pkgs/by-name/di/diesel-cli/package.nix
@@ -27,15 +27,15 @@ assert lib.assertMsg (lib.elem true [
 
 rustPlatform.buildRustPackage rec {
   pname = "diesel-cli";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchCrate {
     inherit version;
     crateName = "diesel_cli";
-    hash = "sha256-AgPESgFLnL3jiYBP8DiWb0hLzsx5tJA+gcO/fdV5Cvo=";
+    hash = "sha256-92mXE+FHggig2TrY+Mf31MEtfxP3vf2J/mUZmW/bkCI=";
   };
 
-  cargoHash = "sha256-yco4l/4UiYnqnZZLYm3EkHmYiQJhMC2xloFg0brDfsg=";
+  cargoHash = "sha256-/5Bxn0gZfHCz5GVupmkmN1QKkef4q266e+FUbIN1x9E=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/dt/dtrx/package.nix b/pkgs/by-name/dt/dtrx/package.nix
index 0ba6669a723a..6a9495009fe8 100644
--- a/pkgs/by-name/dt/dtrx/package.nix
+++ b/pkgs/by-name/dt/dtrx/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dtrx";
-  version = "8.5.3";
+  version = "8.7.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "dtrx-py";
     repo = "dtrx";
     rev = version;
-    sha256 = "sha256-LB3F6jcqQPRsjFO4L2fPAPnacDAdtcaadgGbwXA9LAw=";
+    sha256 = "sha256-wk+TPUXFLKqfUbjV/ALCTLXUacpLa8WhqR7VawaPWQM=";
   };
 
   makeWrapperArgs =
@@ -64,11 +64,11 @@ python3Packages.buildPythonApplication rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Do The Right Extraction: A tool for taking the hassle out of extracting archives";
     homepage = "https://github.com/dtrx-py/dtrx";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ colinsane ];
     mainProgram = "dtrx";
   };
 }
diff --git a/pkgs/by-name/fl/flow-state/package.nix b/pkgs/by-name/fl/flow-state/package.nix
new file mode 100644
index 000000000000..25e5d59ed8db
--- /dev/null
+++ b/pkgs/by-name/fl/flow-state/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "flow_state";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "Stan-breaks";
+    repo = "flow_state";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7j8W370lr/QaLL+T7N/2SlcrPe+dTW5zlNPL7+U/Vog=";
+  };
+
+  cargoHash = "sha256-IY4Kd43zLIGRjQbkeZddl6ayRv997HuSKV1DKI8Z6BY=";
+
+  meta = {
+    description = "Terminal-based habit tracker designed for neurodivergent users";
+    mainProgram = "flow_state";
+    homepage = "https://github.com/Stan-breaks/flow_state";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      overloader
+    ];
+  };
+})
diff --git a/pkgs/by-name/gc/gcsfuse/package.nix b/pkgs/by-name/gc/gcsfuse/package.nix
index 7a226535fd0c..74bd63f082a1 100644
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-hC8/vgngJ4lLF02uV1MurZyRG7dpcEg9gcZr+HWzaNE=";
+    hash = "sha256-48m4/k9BLwFrNIXcRY25jvNd3E/9zwEsuf2ZVG00svM=";
   };
 
-  vendorHash = "sha256-BirzhmYwFSs2poA5tNOlK2bDO71mCkgSck7fE9la2wA=";
+  vendorHash = "sha256-gC7ngmy4xIkEp2lHOfGyDaZNqy/J4Uy8ox8F2uP7P/0=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/gh/gh-gei/package.nix b/pkgs/by-name/gh/gh-gei/package.nix
index 738446828cc8..ae0b0ddf10cc 100644
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-hlhryJno8XpSITBv1ShhqP7jPoRtoscD/YGXIU6ubt0=";
+    hash = "sha256-5BGYNhrHtRHtjfdjSodlhc0Yu/GcYXjvdzGBg2AWVzc=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;
diff --git a/pkgs/by-name/gr/grafana-image-renderer/package.nix b/pkgs/by-name/gr/grafana-image-renderer/package.nix
index e7ca2beb0840..b58622c7adc6 100644
--- a/pkgs/by-name/gr/grafana-image-renderer/package.nix
+++ b/pkgs/by-name/gr/grafana-image-renderer/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana-image-renderer";
-  version = "5.0.10";
+  version = "5.0.11";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oWJlb1mV1sNgN7EQ8L4msfnKps5oV60JgwZYpAJQaq4=";
+    hash = "sha256-fHIxtIRCxxJVHUA3r1ddCpOAsJ8QCJoCbUWagFcj4+I=";
   };
 
   vendorHash = "sha256-wA1XeLO2bYwq7HZOQ5UNcdqqJdEWRUxFoAQucXAj48k=";
diff --git a/pkgs/by-name/hy/hypre/package.nix b/pkgs/by-name/hy/hypre/package.nix
index 403c23eda7bd..34cc564db103 100644
--- a/pkgs/by-name/hy/hypre/package.nix
+++ b/pkgs/by-name/hy/hypre/package.nix
@@ -2,46 +2,119 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
+  cmake,
+  pkg-config,
+  gfortran,
+  blas,
+  lapack,
   mpi,
+  llvmPackages,
+  mpiCheckPhaseHook,
+  isILP64 ? false,
+  mpiSupport ? true,
+  precision ? "double",
+  testers,
+  hypre,
 }:
 
+assert lib.elem precision [
+  "single"
+  "double"
+  "long-double"
+];
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "hypre";
-  version = "2.33.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "hypre-space";
     repo = "hypre";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OrpClN9xd+8DdELVnI4xBg3Ih/BaoBiO0w/QrFjUclw=";
+    hash = "sha256-zu9YWfBT2WJxPg6JHrXjZWRM9Ai1p28EpvAx6xfdPsY=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/src";
-
-  buildInputs = [ mpi ];
-
-  configureFlags = [
-    "--enable-mpi"
-    "--enable-shared"
+  outputs = [
+    "out"
+    "dev"
   ];
 
-  preBuild = ''
-    makeFlagsArray+=(AR="ar -rcu")
+  patches = [
+    (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/spack/spack-packages/eb4b23847f0079d0c9c8de99aaa32557ad4c9194/repos/builtin/packages/hypre/hypre-precision-fix.patch?full_index=1";
+      hash = "sha256-Ni5xlfFmok884x5Hctf9VOsAgZp8ICG7QNVGTdVKPzE=";
+    })
+  ];
+
+  # fix sequence check
+  postPatch = lib.optionalString (!mpiSupport) ''
+    substituteInPlace src/test/CMakeLists.txt \
+      --replace-fail ''\'''${MPIEXEC_EXECUTABLE} ''${MPIEXEC_NUMPROC_FLAG} 1' ""
   '';
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/{include,lib}
-    cp -r hypre/include/* $out/include
-    cp -r hypre/lib/* $out/lib
-    runHook postInstall
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    gfortran
+  ];
+
+  propagatedBuildInputs = [
+    (blas.override { inherit isILP64; })
+    (lapack.override { inherit isILP64; })
+  ]
+  ++ lib.optional mpiSupport mpi
+  ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  cmakeDir = "../src";
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BLA_PREFER_PKGCONFIG" true)
+    (lib.cmakeBool "HYPRE_ENABLE_HYPRE_BLAS" false)
+    (lib.cmakeBool "HYPRE_ENABLE_HYPRE_LAPACK" false)
+    (lib.cmakeBool "HYPRE_ENABLE_FORTRAN" true)
+    (lib.cmakeBool "HYPRE_ENABLE_BIGINT" isILP64)
+    (lib.cmakeBool "HYPRE_ENABLE_SINGLE" (precision == "single"))
+    (lib.cmakeBool "HYPRE_ENABLE_LONG_DOUBLE" (precision == "long-double"))
+    (lib.cmakeBool "HYPRE_ENABLE_OPENMP" true)
+    (lib.cmakeBool "HYPRE_ENABLE_MPI" mpiSupport)
+    (lib.cmakeBool "HYPRE_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
+
+  __darwinAllowLocalNetworking = mpiSupport;
+
+  nativeCheckInputs = lib.optional mpiSupport mpiCheckPhaseHook;
+
+  doCheck = true;
+
+  postInstall = lib.optionalString finalAttrs.finalPackage.doCheck ''
+    rm -rf $out/bin
   '';
 
-  meta = with lib; {
+  passthru = {
+    tests = {
+      cmake-config = testers.hasCmakeConfigModules {
+        moduleNames = [ "HYPRE" ];
+        package = finalAttrs.finalPackage;
+      };
+      ilp64 = hypre.override { isILP64 = true; };
+      single = hypre.override { precision = "single"; };
+      serial = hypre.override { mpiSupport = false; };
+    };
+  };
+
+  meta = {
     description = "Parallel solvers for sparse linear systems featuring multigrid methods";
     homepage = "https://computing.llnl.gov/projects/hypre-scalable-linear-solvers-multigrid-methods";
-    platforms = platforms.unix;
-    license = licenses.mit;
-    maintainers = with maintainers; [ mkez ];
+    platforms = lib.platforms.unix;
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      mkez
+      qbisi
+    ];
   };
 })
diff --git a/pkgs/by-name/hy/hyprlang/package.nix b/pkgs/by-name/hy/hyprlang/package.nix
index 5da9c6ead388..ea19642e584e 100644
--- a/pkgs/by-name/hy/hyprlang/package.nix
+++ b/pkgs/by-name/hy/hyprlang/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlang";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlang";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-APyQ4L05EHRbQFS1t7nXex4u+g9Sh8J70W80djOnmI4=";
+    hash = "sha256-54ltTSbI6W+qYGMchAgCR6QnC1kOdKXN6X6pJhOWxFg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/jj/jj-fzf/nix-preflight.patch b/pkgs/by-name/jj/jj-fzf/nix-preflight.patch
new file mode 100644
index 000000000000..417bb348a6c5
--- /dev/null
+++ b/pkgs/by-name/jj/jj-fzf/nix-preflight.patch
@@ -0,0 +1,24 @@
+diff --git a/preflight.sh b/preflight.sh
+index f1ed02fe60..43b9c365c5 100755
+--- a/preflight.sh
++++ b/preflight.sh
+@@ -78,19 +78,6 @@
+   test $(awk 'BEGIN{print(123)}') == 123 ||
+     __preflightish_die "Failed to find usable 'awk' executable in \$PATH"
+
+-# == Jujutsu ==
+-__preflightish_require "0.34" jj --version --ignore-working-copy
+-
+-# == fzf ==
+-__preflightish_require "0.65.2" fzf --version
+-
+-# == python3 ==
+-__preflightish_require "3.9" python3 --version
+-
+-# == column ==
+-command -v "column" > /dev/null 2>&1 ||
+-  __preflightish_die "Failed to find the 'column' executable in \$PATH"
+-
+ # == Success ==
+ [[ "${BASH_SOURCE[0]}" == "$0" ]] &&
+   echo "  OK         All preflight.sh checks passed"
diff --git a/pkgs/by-name/jj/jj-fzf/package.nix b/pkgs/by-name/jj/jj-fzf/package.nix
index a29b23d63d93..e109571e1f28 100644
--- a/pkgs/by-name/jj/jj-fzf/package.nix
+++ b/pkgs/by-name/jj/jj-fzf/package.nix
@@ -8,42 +8,55 @@
   gnused,
   jujutsu,
   makeWrapper,
+  pandoc,
+  python3,
+  unixtools,
   stdenv,
 }:
 
 stdenv.mkDerivation rec {
   pname = "jj-fzf";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "tim-janik";
     repo = "jj-fzf";
     tag = "v${version}";
-    hash = "sha256-iVgX2Lu06t1pCQl5ZGgl3+lTv4HAPKbD/83STDtYhdU=";
+    hash = "sha256-aJyKVMg/yI2CmAx5TxN0w670Rq26ESdLzESgh8Jr4nE=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  strictDeps = true;
+  buildInputs = [ bashInteractive ];
+  nativeBuildInputs = [
+    bashInteractive
+    makeWrapper
+    pandoc
+    jujutsu
+  ];
 
   dontConfigure = true;
   dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    install -D jj-fzf $out/bin/jj-fzf
-    substituteInPlace $out/bin/jj-fzf \
-      --replace-fail "/usr/bin/env bash" "${lib.getExe bashInteractive}"
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  patches = [ ./nix-preflight.patch ];
+  postPatch = ''
+    substituteInPlace lib/gen-message.py \
+      --replace-fail '/usr/bin/env -S python3 -B' '${python3}/bin/python -B'
+    patchShebangs --build lib/*.sh
+    patchShebangs --host jj-fzf *.sh contrib/*.sh
+  '';
+  postInstall = ''
     wrapProgram $out/bin/jj-fzf \
       --prefix PATH : ${
         lib.makeBinPath [
-          bashInteractive
           coreutils
           fzf
           gawk
           gnused
           jujutsu
+          python3
+          unixtools.column
         ]
       }
-    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ks/ksmbd-tools/package.nix b/pkgs/by-name/ks/ksmbd-tools/package.nix
index 27c1bcf09cf0..a48ff86c211b 100644
--- a/pkgs/by-name/ks/ksmbd-tools/package.nix
+++ b/pkgs/by-name/ks/ksmbd-tools/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ksmbd-tools";
-  version = "3.5.5";
+  version = "3.5.6";
 
   src = fetchFromGitHub {
     owner = "cifsd-team";
     repo = "ksmbd-tools";
     rev = version;
-    sha256 = "sha256-ZA2HE/IhdF0UqVv92h1iEc9vPbycA/7Qxka1fXJ4AhE=";
+    sha256 = "sha256-JwfxYFBwrMtP2D7GcDpW44WYbLJyxZy3Jhgi+7HsIng=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
index 4aec5a19498f..9cfd59498482 100644
--- a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-collaboration-server";
-  version = "3.6.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-8bD+rBEN0GEQz3tiPEQYmf/mpijPefFmQchGhYkVBVY=";
+    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-b4JBjJUB1i9jYSy+RFkXKmq6rzp28xHLdPNSH0QO1Ek=";
+    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs-frontend/package.nix b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
index 3862e34dac5f..8f3542f7d722 100644
--- a/pkgs/by-name/la/lasuite-docs-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-frontend";
-  version = "3.6.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-8bD+rBEN0GEQz3tiPEQYmf/mpijPefFmQchGhYkVBVY=";
+    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-b4JBjJUB1i9jYSy+RFkXKmq6rzp28xHLdPNSH0QO1Ek=";
+    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
index 5a4d3c3cc4c3..865fb2419bb5 100644
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -26,12 +26,12 @@ let
     };
   };
 
-  version = "3.9.0";
+  version = "4.0.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-qlnDv2NYs6XCZDos/8CflyO/0GmYKd45/efDDNGGsic=";
+    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -44,7 +44,7 @@ let
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/src/mail/yarn.lock";
-      hash = "sha256-+kjU8eGk5CFh6/Z4G5G4XiaZ5OOBO5WB4d7lU7evXs0=";
+      hash = "sha256-kwt4vSIiC8NNaKmygl2moV8ft02eB4ylPND4oe9tBUA=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/lf/lf/package.nix b/pkgs/by-name/lf/lf/package.nix
index 85069d75e727..d40c604a6f13 100644
--- a/pkgs/by-name/lf/lf/package.nix
+++ b/pkgs/by-name/lf/lf/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "lf";
-  version = "38";
+  version = "39";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
     tag = "r${version}";
-    hash = "sha256-a3Ql0E3ZVbveGXGO+n2G2WBVjBk5HuJx9NiaZ7ZAVMc=";
+    hash = "sha256-6M6xMVWHTLPlnG5i6/dC3KEV6RXezz8KK0V81P8RcE0=";
   };
 
-  vendorHash = "sha256-kZFmCkYd6ijJC/vedUoWZW1TUW1oGD9qA0GCQzfiTUE=";
+  vendorHash = "sha256-93VPbrNPRW6NyKHJBvmAadbJ+DLsH2jTAXjTKkPdYBA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index a1a3ff89592e..0d4ef3b07c4c 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.9.4";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-9di+WCu19cjJXBjtQN29JpGUEFygcIYTJXrdRwSg+TE=";
+    hash = "sha256-hDBdxuAWFJr5iAFOjGdUwO7zNgsVmFXIRaII1T5m20Y=";
   };
 
-  vendorHash = "sha256-FM7ORm4loMi06T5eAs8KiKFErcXk4XV8yLQYFy3uBRM=";
+  vendorHash = "sha256-hgziX88Ty3HYQKgpgu/LqdtzqcfjZktZstsve6jVKk4=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/by-name/me/mediawiki/package.nix b/pkgs/by-name/me/mediawiki/package.nix
index 199ffa40cc4c..745177a1492f 100644
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenvNoCC,
   fetchurl,
-  imagemagick,
   nixosTests,
 }:
 
@@ -16,11 +15,8 @@ stdenvNoCC.mkDerivation rec {
   };
 
   postPatch = ''
-    sed -i 's|$vars = Installer::getExistingLocalSettings();|$vars = null;|' includes/installer/CliInstaller.php
-
-    # fix generating previews for SVGs
-    substituteInPlace includes/config-schema.php \
-      --replace-fail "\$path/convert" "${imagemagick}/bin/convert"
+    substituteInPlace includes/installer/CliInstaller.php \
+      --replace-fail '$vars = Installer::getExistingLocalSettings();' '$vars = null;'
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/mu/mupdf/package.nix b/pkgs/by-name/mu/mupdf/package.nix
index cd1bea612afa..492322fd7f9b 100644
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@@ -55,7 +55,15 @@ let
       hash = "sha256-0fuE0lm9rlAaok2Qe0V1uUrgP4AjMWgp3eTbw8G6PMM=";
     };
 
-    patches = [ ];
+    patches = [
+      # Fix build with gcc15
+      # https://github.com/freeglut/freeglut/pull/187
+      (fetchpatch {
+        name = "freeglut-fix-fgPlatformDestroyContext-prototype-for-C23.patch";
+        url = "https://github.com/freeglut/freeglut/commit/800772e993a3ceffa01ccf3fca449d3279cde338.patch";
+        hash = "sha256-agXw3JHq81tx5514kkorvuU5mX4E3AV930hy1OJl4L0=";
+      })
+    ];
 
     # cmake 4 compatibility, upstream is dead
     postPatch = ''
diff --git a/pkgs/by-name/oh/oha/package.nix b/pkgs/by-name/oh/oha/package.nix
index 6cbd718eb848..7a4519e8dbf4 100644
--- a/pkgs/by-name/oh/oha/package.nix
+++ b/pkgs/by-name/oh/oha/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oha";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = "oha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N52j8WYEVlmHQdr0HZJZZo92OhIz4V0R1SdaWlOD684=";
+    hash = "sha256-GDFS/f9fombAEXEf0f/issQFrFviU1nsLOIQ5nthPHk=";
   };
 
-  cargoHash = "sha256-M6wJy5X9JRM9tOOGT8b6YIUT0OakXQxjw17iuqaRT5s=";
+  cargoHash = "sha256-pZnHE89kwuByMtm5m9QLSuhJ6wxFrbVOShF7T6c2494=";
 
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 86c94740d7e0..06bc4ec34f7b 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -187,6 +187,12 @@ goBuild (finalAttrs: {
   postPatch = ''
     substituteInPlace version/version.go \
       --replace-fail 0.0.0 '${finalAttrs.version}'
+    rm -r app
+  ''
+  # disable tests that fail in sandbox due to Metal init failure
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    rm ml/backend/ggml/ggml_test.go
+    rm ml/nn/pooling/pooling_test.go
   '';
 
   overrideModAttrs = (
diff --git a/pkgs/by-name/pa/paraview/package.nix b/pkgs/by-name/pa/paraview/package.nix
index d63ab290d7b5..d777225a7143 100644
--- a/pkgs/by-name/pa/paraview/package.nix
+++ b/pkgs/by-name/pa/paraview/package.nix
@@ -31,12 +31,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-XlasevXpJbPP0/q4JHCTPLq8fo/ah+FK9k+ZXWBk6wY=";
   };
 
-  # When building paraview with external vtk, we can not infer resource_dir
-  # from the path of vtk's libraries. Thus hardcoding the resource_dir.
-  # See https://gitlab.kitware.com/paraview/paraview/-/issues/23043.
   postPatch = ''
+    # When building paraview with external vtk, we can not infer resource_dir
+    # from the path of vtk's libraries. Thus hardcoding the resource_dir.
+    # See https://gitlab.kitware.com/paraview/paraview/-/issues/23043.
     substituteInPlace Remoting/Core/vtkPVFileInformation.cxx \
       --replace-fail "return resource_dir;" "return \"$out/share/paraview\";"
+
+    # fix build against qt-6.10.1
+    substituteInPlace Qt/Core/{pqFlatTreeViewEventTranslator,pqQVTKWidgetEventTranslator}.cxx \
+      ThirdParty/QtTesting/vtkqttesting/{pqAbstractItemViewEventTranslator,pqBasicWidgetEventTranslator}.cxx \
+      --replace-fail "mouseEvent->buttons()" "static_cast<int>(mouseEvent->buttons())" \
+      --replace-fail "mouseEvent->modifiers()" "static_cast<int>(mouseEvent->modifiers())"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rc/rclone-ui/package.nix b/pkgs/by-name/rc/rclone-ui/package.nix
index 71a17ea300be..561aca1c6efb 100644
--- a/pkgs/by-name/rc/rclone-ui/package.nix
+++ b/pkgs/by-name/rc/rclone-ui/package.nix
@@ -20,26 +20,26 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rclone-ui";
-  version = "2.2.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "rclone-ui";
     repo = "rclone-ui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gwZXI501lE3Tm9M8k6a2NJCsvbiPB3Y4yhhr4gkpkY4=";
+    hash = "sha256-z8SAXYK3HgtJSiFTJopo+zVZw2kd8ByUXufyauoUNFM=";
   };
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     forceGitDeps = true;
-    hash = "sha256-OkPVPT4JBbkVcfGtSs6oi+VFA3sxp1b6fVr68ILtnPU=";
+    hash = "sha256-8Os5mFILRpe8tROQdDAW6y/RTp/X0X/5z+Psf/lQpi4=";
   };
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-8RK1rrGyxRNCTARlYUJNXWaH9F/3hV31uyNXjvWJaFU=";
+  cargoHash = "sha256-c/BHtHWj8F6mCmIpxDPIVy/5bRBCUFACWZEpsDO6CTU=";
 
   # Disable tauri bundle updater, can be removed when #389107 is merged
   patches = [ ./remove_updater.patch ];
diff --git a/pkgs/by-name/rc/rclone-ui/remove_updater.patch b/pkgs/by-name/rc/rclone-ui/remove_updater.patch
index 4dd542283795..c48678d1d87f 100644
--- a/pkgs/by-name/rc/rclone-ui/remove_updater.patch
+++ b/pkgs/by-name/rc/rclone-ui/remove_updater.patch
@@ -1,23 +1,37 @@
 diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
-index 04ea191..72d178d 100644
+index 5200821..8994d35 100644
 --- a/src-tauri/src/lib.rs
 +++ b/src-tauri/src/lib.rs
-@@ -83,7 +83,6 @@ pub fn run() {
- 	
+@@ -673,7 +673,7 @@ async fn update_system_rclone() -> Result<i32, String> {
+                 // Fallback to sudo with custom prompt (works if the user has NOPASSWD or cached credentials)
+                 let mut sudo_env = std::collections::HashMap::new();
+                 sudo_env.insert("SUDO_PROMPT", "Rclone UI needs permission to run rclone selfupdate. Please enter your password: ");
+-                
++
+                 let mut sudo_args: Vec<String> = Vec::new();
+                 sudo_args.push("-n".to_string());
+                 sudo_args.push("env".to_string());
+@@ -735,11 +735,10 @@ pub fn run() {
+     ));
+ 
+     let _guard = tauri_plugin_sentry::minidump::init(&client);
+-	
++
      let mut app = tauri::Builder::default()
+ 		.plugin(tauri_plugin_sentry::init_with_no_injection(&client))
          .plugin(tauri_plugin_clipboard_manager::init())
 -        .plugin(tauri_plugin_updater::Builder::new().build())
          .plugin(tauri_plugin_os::init())
          .plugin(tauri_plugin_notification::init())
          .plugin(tauri_plugin_process::init())
 diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
-index 8b1c89f..1705861 100644
+index 933f067..bbb69fc 100644
 --- a/src-tauri/tauri.conf.json
 +++ b/src-tauri/tauri.conf.json
-@@ -86,16 +86,9 @@
-                 "installMode": "both"
-             },
-             "signCommand": "trusted-signing-cli -e https://eus.codesigning.azure.net -a sign-1 -c Sign1 -d Rclone %1"
+@@ -87,16 +87,9 @@
+             "rpm": {
+                 "depends": ["(libappindicator-gtk3 or libayatana-appindicator-gtk3)"]
+             }
 -        },
 -        "createUpdaterArtifacts": true
 +        }
diff --git a/pkgs/by-name/sc/scriv/package.nix b/pkgs/by-name/sc/scriv/package.nix
index c6d475c2a4a0..0a2e3177283f 100644
--- a/pkgs/by-name/sc/scriv/package.nix
+++ b/pkgs/by-name/sc/scriv/package.nix
@@ -6,6 +6,7 @@
   git,
   scriv,
   testers,
+  fetchpatch,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -18,6 +19,14 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-fBqL5jUdA2kuXnV4Te6g2PEbLJD5G+GLD7OjdVVbUl4=";
   };
 
+  patches = [
+    # fix tests by removing deprecated Click parameter from fixture
+    (fetchpatch {
+      url = "https://github.com/nedbat/scriv/commit/04ac45da9e1adb24a95ad9643099fe537b3790fd.diff";
+      hash = "sha256-Gle3zWC/WypGHsKmVlqedRAZVWsBjGpzMq3uKuG9+SY=";
+    })
+  ];
+
   build-system = with python3.pkgs; [ setuptools ];
 
   dependencies =
diff --git a/pkgs/by-name/su/superlu_dist/package.nix b/pkgs/by-name/su/superlu_dist/package.nix
index 2cb3af3d2532..c300133a5157 100644
--- a/pkgs/by-name/su/superlu_dist/package.nix
+++ b/pkgs/by-name/su/superlu_dist/package.nix
@@ -18,6 +18,7 @@
   isILP64 ? false,
 
   # passthru.tests
+  mpich,
   superlu_dist,
 }:
 
@@ -36,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-i/Gg+9oMNNRlviwXUSRkWNaLRZLPWZRtA1fGYqh2X0k=";
   };
 
+  # --oversubscribe unrecognized by mpich
+  # see https://github.com/xiaoyeli/superlu_dist/issues/208
+  postPatch = ''
+    substituteInPlace TEST/CMakeLists.txt \
+      --replace-fail "-oversubscribe" ""
+  '';
+
   patches = [
     ./mc64ad_dist-stub.patch
   ];
@@ -89,6 +97,11 @@ stdenv.mkDerivation (finalAttrs: {
     inherit isILP64;
     tests = {
       ilp64 = superlu_dist.override { isILP64 = true; };
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      mpich = superlu_dist.override {
+        mpi = mpich;
+      };
     };
   };
 
diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 919553005fd7..f42c2269dc2f 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "16.5.0";
+  version = "16.6.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${version}";
-    hash = "sha256-2Cj3o2ybNA7ss3fyPaDXtQxIl2fXuxfY7SZI5K/Q2tc=";
+    hash = "sha256-hZD7I31kmX+wvurDa+7NHitzJEdN5Yudr1y6djGeh04=";
   };
 
-  cargoHash = "sha256-eXRWR5EvjqYQSY9hzb31iladS699Oy+n/dojid9BBFU=";
+  cargoHash = "sha256-gYuKMpBy/muH0ZjYrIy6v8xqOVP1Ph/hx8VKfOPKJJc=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/uw/uwhoisd/package.nix b/pkgs/by-name/uw/uwhoisd/package.nix
index 4beabbf1eeeb..1ecee5d54a3c 100644
--- a/pkgs/by-name/uw/uwhoisd/package.nix
+++ b/pkgs/by-name/uw/uwhoisd/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "uwhoisd";
-  version = "0.1.1";
+  version = "0.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kgaughan";
     repo = "uwhoisd";
     tag = "v${version}";
-    hash = "sha256-ncllROnKFwsSalbkQIOt/sQO0qxybAgxrVnYOC+9InY=";
+    hash = "sha256-Em+SkQ/olmKGntwOG+CUe3x1ZIIH8grOBVxY/a3eVGI=";
   };
 
   build-system = with python3.pkgs; [
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Universal WHOIS proxy server";
     homepage = "https://github.com/kgaughan/uwhoisd";
-    changelog = "https://github.com/kgaughan/uwhoisd/blob/${src.tag}/ChangeLog";
+    changelog = "https://github.com/kgaughan/uwhoisd/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 750b99136e61..d95ae06be8f2 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -1,24 +1,23 @@
 {
   lib,
-  a52dec,
   alsa-lib,
   autoreconfHook,
   avahi,
+  bison,
   cairo,
   curl,
   dbus,
   faad2,
+  fetchFromGitLab,
   fetchpatch,
-  fetchurl,
-  # Please unpin FFmpeg on the next upstream release.
-  ffmpeg_6,
+  ffmpeg_7,
   flac,
+  flex,
   fluidsynth,
   fontconfig,
   freefont_ttf,
   freetype,
   fribidi,
-  genericUpdater,
   gnutls,
   harfbuzz,
   libGL,
@@ -44,7 +43,6 @@
   libmatroska,
   libmicrodns,
   libmodplug,
-  libmpeg2,
   libmtp,
   libogg,
   libopus,
@@ -66,6 +64,7 @@
   live555,
   lua5,
   ncurses,
+  nix-update-script,
   perl,
   pkg-config,
   pkgsBuildBuild,
@@ -104,17 +103,22 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.21";
+  version = "3.0.22";
 
-  src = fetchurl {
-    url = "https://get.videolan.org/vlc/${finalAttrs.version}/vlc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JNu+HX367qCZTV3vC73iABdzRxNtv+Vz9bakzuJa+7A=";
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = "vlc";
+    rev = finalAttrs.version;
+    hash = "sha256-EI8w8Nep8Vhgp+5wKOdtbFHiSkURnGqb/AjTfELTq1w=";
   };
 
   depsBuildBuild = optionals waylandSupport [ pkg-config ];
 
   nativeBuildInputs = [
     autoreconfHook
+    bison
+    flex
     lua5
     perl
     pkg-config
@@ -132,13 +136,12 @@ stdenv.mkDerivation (finalAttrs: {
   # which are not included here for no other reason that nobody has mentioned
   # needing them
   buildInputs = [
-    a52dec
     alsa-lib
     avahi
     cairo
     dbus
     faad2
-    ffmpeg_6
+    ffmpeg_7
     flac
     fluidsynth
     fontconfig
@@ -165,7 +168,6 @@ stdenv.mkDerivation (finalAttrs: {
     libmad
     libmatroska
     libmodplug
-    libmpeg2
     libmtp
     libogg
     libopus
@@ -236,18 +238,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://code.videolan.org/videolan/vlc/uploads/eb1c313d2d499b8a777314f789794f9d/0001-Add-lssl-and-lcrypto-to-liblive555_plugin_la_LIBADD.patch";
       hash = "sha256-qs3gY1ksCZlf931TSZyMuT2JD0sqrmcRCZwL+wVG0U8=";
     })
-    # support VAAPI hardware video decoding with newer ffmpeg
-    # upstream merge request: https://code.videolan.org/videolan/vlc/-/merge_requests/6606 (will be included in the next release)
-    (fetchpatch {
-      url = "https://code.videolan.org/videolan/vlc/-/commit/ba5dc03aecc1d96f81b76838f845ebde7348cf62.diff";
-      hash = "sha256-s6AI9O0V3AKOyw9LbQ9CgjaCi5m5+nLacKNLl5ZLC6Q=";
-    })
     # make the plugins.dat file generation reproducible
     # upstream merge request: https://code.videolan.org/videolan/vlc/-/merge_requests/7149
     ./deterministic-plugin-cache.diff
   ];
 
   postPatch = ''
+    echo "$version" > src/revision.txt
     substituteInPlace modules/text_renderer/freetype/platform_fonts.h \
       --replace \
         /usr/share/fonts/truetype/freefont \
@@ -312,11 +309,7 @@ stdenv.mkDerivation (finalAttrs: {
     remove-references-to -t "${libsForQt5.qtbase.dev}" $out/lib/vlc/plugins/gui/libqt_plugin.so
   '';
 
-  passthru.updateScript = genericUpdater {
-    versionLister = writeShellScript "vlc-versionLister" ''
-      ${curl}/bin/curl -s https://get.videolan.org/vlc/ | sed -En 's/^.*href="([0-9]+(\.[0-9]+)+)\/".*$/\1/p'
-    '';
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Cross-platform media player and streaming server";
diff --git a/pkgs/by-name/wa/wayscriber/package.nix b/pkgs/by-name/wa/wayscriber/package.nix
index 0277f9089b20..f3a67ca48670 100644
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@@ -9,21 +9,21 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  name = "wayscriber";
-  version = "0.7.2";
+  pname = "wayscriber";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "devmobasa";
     repo = "wayscriber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2CBSonwYa0lxhDYp1To08VicoNrAQkKwhJxZd0Iu+P0=";
+    hash = "sha256-CJ3UleMFk033zuz507KIhHkVRRayh6Z+OdaREhFs0GM=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pango
     libxkbcommon
   ];
-  cargoHash = "sha256-DjC8UOGSMqinr5p+Jzot7sRV1AP9xn4AwWXKRDZLdU4=";
+  cargoHash = "sha256-cLV7NRQGK2jjCBOeTNe86ESV4TG0vTYJu3K5aQHQrXo=";
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/wx/wxsqlite3/package.nix b/pkgs/by-name/wx/wxsqlite3/package.nix
index eb68e3fadbbd..f61948d8291a 100644
--- a/pkgs/by-name/wx/wxsqlite3/package.nix
+++ b/pkgs/by-name/wx/wxsqlite3/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.11.0";
+  version = "4.11.1";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    hash = "sha256-cTErixQhAruU/mpxnG4Nio4PPtxSeGeNZNHTjZlyn+M=";
+    hash = "sha256-fhhE7nPYNnqvtSCL0Z8v8mcF4gxrmE3lpCd9ji01PQ4=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/xl/xlights/package.nix b/pkgs/by-name/xl/xlights/package.nix
index 7148d30d8373..1d6aab973686 100644
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "xlights";
-  version = "2025.12";
+  version = "2025.13";
 
   src = fetchurl {
     url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-INB4x2iCzjpURL7VhugCcYo+X6p6aKIY5Dx5dy1ZjJ8=";
+    hash = "sha256-HYOfcANhOmngNxtMYT53N2aoAI/0n/n+WMyQfjkuqXg=";
   };
 
   meta = {
diff --git a/pkgs/by-name/za/zammad/package.nix b/pkgs/by-name/za/zammad/package.nix
index 5ccf3bff026d..c38c37a4f85b 100644
--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@@ -108,11 +108,12 @@ stdenvNoCC.mkDerivation {
   installPhase = ''
     cp -R . $out
     rm -rf $out/config/database.yml $out/config/secrets.yml $out/tmp $out/log
-    # dataDir will be set in the module, and the package gets overriden there
+    # dataDir will be set in the module, and the package gets overridden there
     ln -s ${dataDir}/config/database.yml $out/config/database.yml
     ln -s ${dataDir}/config/secrets.yml $out/config/secrets.yml
-    ln -s ${dataDir}/tmp $out/tmp
     ln -s ${dataDir}/log $out/log
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/tmp $out/tmp
   '';
 
   passthru = {
diff --git a/pkgs/by-name/za/zapret/package.nix b/pkgs/by-name/za/zapret/package.nix
index f554c4f56b7b..9909e2d51f53 100644
--- a/pkgs/by-name/za/zapret/package.nix
+++ b/pkgs/by-name/za/zapret/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret";
-  version = "72.2";
+  version = "72.3";
 
   src = fetchFromGitHub {
     owner = "bol-van";
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tDoo4PxfK/JB4Q10QQECYKf34nL2YkoHcUhp3aKbtYI=";
+    hash = "sha256-JTjw6yfM5DAFL9H+EvXXmUzkK0YTZ6Jx8qwOOvja5q4=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/langchain-huggingface/default.nix b/pkgs/development/python-modules/langchain-huggingface/default.nix
index d66b83373d26..94fcff8723c8 100644
--- a/pkgs/development/python-modules/langchain-huggingface/default.nix
+++ b/pkgs/development/python-modules/langchain-huggingface/default.nix
@@ -33,14 +33,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-huggingface";
-  version = "1.0.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-huggingface==${version}";
-    hash = "sha256-SPWGPwOphT0ewgLYIhFdbNtzCI2wFhmsBlxYxNjswOY=";
+    hash = "sha256-dmuDgKQW1yAz/8tjQx7LaUiuz5Sh4cAyd9nt33mCPbI=";
   };
 
   sourceRoot = "${src.name}/libs/partners/huggingface";
diff --git a/pkgs/development/python-modules/letpot/default.nix b/pkgs/development/python-modules/letpot/default.nix
index ccb4949b75d4..c6264c7e047a 100644
--- a/pkgs/development/python-modules/letpot/default.nix
+++ b/pkgs/development/python-modules/letpot/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "letpot";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpelgrom";
     repo = "python-letpot";
     tag = "v${version}";
-    hash = "sha256-ULU+KBeE7T7qFQvw4KXz3/o2ZkZZa/C1QGqTPwlK7+c=";
+    hash = "sha256-ayNgRJb+/hfxxfLQv+RyKiOaYHK50ZrROeeDAsAGCVE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/py-dactyl/default.nix b/pkgs/development/python-modules/py-dactyl/default.nix
index 7906828e1ba0..c5b669024b07 100644
--- a/pkgs/development/python-modules/py-dactyl/default.nix
+++ b/pkgs/development/python-modules/py-dactyl/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "py-dactyl";
-  version = "2.0.5";
+  version = "2.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iamkubi";
     repo = "pydactyl";
     tag = "v${version}";
-    hash = "sha256-yw5S4I4mtb9URnZ1So1nlZi4v7y0Nz4msx+8SwSi8N4=";
+    hash = "sha256-4WzQQs4WP5AwO8idZsP6J71CwnoD1ilC5Tpcepnf26c=";
   };
 
   build-system = [ setuptools ];
@@ -33,9 +33,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     # upstream's tests are not fully maintained
-    "test_get_file_contents"
     "test_paginated_response_multipage_iterator"
-    "test_pterodactyl_client_debug_param"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pycync/default.nix b/pkgs/development/python-modules/pycync/default.nix
index 199e7ae69e44..5c8b0216bd5f 100644
--- a/pkgs/development/python-modules/pycync/default.nix
+++ b/pkgs/development/python-modules/pycync/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pycync";
-  version = "0.4.3";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Kinachi249";
     repo = "pycync";
     tag = "v${version}";
-    hash = "sha256-UjodZbgicTiJV4T5yqWy5J4oAeZGbggVfaPMoDmL74M=";
+    hash = "sha256-mYHUkenP0FMnwKOdZe4XjC/VnP3JJGPtuVdYR9UcouM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyjwkest/default.nix b/pkgs/development/python-modules/pyjwkest/default.nix
index 4663752311d1..2d5e97887688 100644
--- a/pkgs/development/python-modules/pyjwkest/default.nix
+++ b/pkgs/development/python-modules/pyjwkest/default.nix
@@ -1,35 +1,48 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  future,
+  fetchFromGitHub,
   pycryptodomex,
-  pytest,
+  pytestCheckHook,
   requests,
+  setuptools,
   six,
 }:
 
 buildPythonPackage rec {
   pname = "pyjwkest";
-  version = "1.4.2";
-  format = "setuptools";
+  version = "1.4.4";
+  pyproject = true;
 
-  meta = {
-    description = "Implementation of JWT, JWS, JWE and JWK";
-    homepage = "https://github.com/rohe/pyjwkest";
-    license = lib.licenses.asl20;
+  src = fetchFromGitHub {
+    owner = "IdentityPython";
+    repo = "pyjwkest";
+    tag = "v${version}";
+    hash = "sha256-G4/qLOOQHsNSMVndUdYBhrrk8uEufbI8Od3ziQiY0XI=";
   };
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5560fd5ba08655f29ff6ad1df1e15dc05abc9d976fcbcec8d2b5167f49b70222";
-  };
+  build-system = [ setuptools ];
 
-  buildInputs = [ pytest ];
-  propagatedBuildInputs = [
-    future
+  # Remove unused future import, see pending PR:
+  # https://github.com/IdentityPython/pyjwkest/pull/107
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"future"' ""
+  '';
+
+  dependencies = [
     pycryptodomex
     requests
     six
   ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "jwkest" ];
+
+  meta = {
+    description = "Implementation of JWT, JWS, JWE and JWK";
+    homepage = "https://github.com/IdentityPython/pyjwkest";
+    license = lib.licenses.asl20;
+  };
 }
diff --git a/pkgs/development/python-modules/wavinsentio/default.nix b/pkgs/development/python-modules/wavinsentio/default.nix
index 8532e94d4742..7efdd81b9247 100644
--- a/pkgs/development/python-modules/wavinsentio/default.nix
+++ b/pkgs/development/python-modules/wavinsentio/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "wavinsentio";
-  version = "0.5.4";
+  version = "0.5.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FlxeOaqQkJBWQtEUudbwlCzkK6HWmWTIxjgaI80BlxQ=";
+    hash = "sha256-Xw21JeQA0OMtyATey+LYmf3tRDcSME1bkQeAK0wFhHU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/linux/tuxedo-drivers/default.nix b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
index e8ce6ff5198e..05f4338323e4 100644
--- a/pkgs/os-specific/linux/tuxedo-drivers/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tuxedo-drivers-${kernel.version}";
-  version = "4.18.0";
+  version = "4.18.1";
 
   src = fetchFromGitLab {
     group = "tuxedocomputers";
     owner = "development/packages";
     repo = "tuxedo-drivers";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9XtogovzAWaMkJI5CxszY5qO3q6NOACZ7pnejyobJlY=";
+    hash = "sha256-TkzdFVffYpVYEKImhRj6nqeVTr4yvzh//wSSRqIrPyA=";
   };
 
   patches = [ ./no-cp-usr.patch ];
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
index 509e56c50654..b8901d433da5 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslscan";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "rbsec";
     repo = "sslscan";
     tag = version;
-    hash = "sha256-i8nrGni7mClJQIlkDt20JXyhlJALKCR0MZk51ACtev0=";
+    hash = "sha256-HE0Jc0FSH/hK7wDhEOFR6nJJzyVAVlNhrCVlY0AlNU4=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index f0ed6b55dd36..4aea1b23e347 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -71,10 +71,17 @@ let
 
   # more is unavailable in darwin
   # so we just use less
-  more_compat = runCommand "more-${pkgs.less.name}" { } ''
-    mkdir -p $out/bin
-    ln -s ${pkgs.less}/bin/less $out/bin/more
-  '';
+  more_compat =
+    runCommand pkgs.less.name
+      {
+        passthru = {
+          inherit (pkgs.less) version;
+        };
+      }
+      ''
+        mkdir -p $out/bin
+        ln -s ${pkgs.less}/bin/less $out/bin/more
+      '';
 
   bins = mapAttrs singleBinary {
     # singular binaries