diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
index 3f7296d32653..c7b0b664940e 100644
--- a/doc/stdenv/platform-notes.chapter.md
+++ b/doc/stdenv/platform-notes.chapter.md
@@ -158,7 +158,7 @@ These paths will need to be replaced with relative paths and the xcbuild package
 stdenv.mkDerivation {
   name = "libfoo-1.2.3";
   postPatch = ''
-    subsituteInPlace Makefile \
+    substituteInPlace Makefile \
       --replace-fail '/usr/bin/xcodebuild' 'xcodebuild' \
       --replace-fail '/usr/bin/xcrun' 'xcrun' \
       --replace-fail '/usr/bin/PListBuddy' 'PListBuddy'
diff --git a/doc/using/configuration.chapter.md b/doc/using/configuration.chapter.md
index 05a8fa5517cc..d443cf1b8e54 100644
--- a/doc/using/configuration.chapter.md
+++ b/doc/using/configuration.chapter.md
@@ -154,11 +154,13 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     The `allowInsecurePredicate` option is a function which accepts a package and returns a boolean, much like `allowUnfreePredicate`.
 
-    The following configuration example only allows insecure packages with very short names:
+    The following configuration example allows any version of the `ovftool` package:
 
     ```nix
     {
-      allowInsecurePredicate = pkg: builtins.stringLength (lib.getName pkg) <= 5;
+      allowInsecurePredicate = pkg: builtins.elem (lib.getName pkg) [
+        "ovftool"
+      ];
     }
     ```
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 57db6335c01f..055857336729 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12746,6 +12746,14 @@
     githubId = 5624721;
     name = "Ben Wolsieffer";
   };
+  lordmzte = {
+    name = "Moritz Thomae";
+    email = "lord@mzte.de";
+    matrix = "@lordmzte:mzte.de";
+    github = "LordMZTE";
+    githubId = 28735087;
+    keys = [ { fingerprint = "AB47 3D70 53D2 74CA DC2C  230C B648 02DC 33A6 4FF6"; } ];
+  };
   lord-valen = {
     name = "Lord Valen";
     matrix = "@lord-valen:matrix.org";
@@ -15586,6 +15594,13 @@
     githubId = 399535;
     name = "Niklas Hambüchen";
   };
+  n-hass = {
+    email = "nick@hassan.host";
+    github = "n-hass";
+    githubId = 72363381;
+    name = "n-hass";
+    keys = [ { fingerprint = "FDEE 6116 DBA7 8840 7323  4466 A371 5973 2728 A6A6"; } ];
+  };
   nhnn = {
     matrix = "@nhnn:nhnn.dev";
     github = "thenhnn";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 362e4db45e23..88a6c24ce293 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1494,6 +1494,7 @@
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/openvscode-server.nix
   ./services/web-apps/mediagoblin.nix
+  ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/mobilizon.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
diff --git a/nixos/modules/services/misc/tabby.nix b/nixos/modules/services/misc/tabby.nix
index 8fabd10d90fa..f84ceccc424e 100644
--- a/nixos/modules/services/misc/tabby.nix
+++ b/nixos/modules/services/misc/tabby.nix
@@ -34,7 +34,7 @@ in
           If you want to utilize an existing model that you've already
           downloaded you'll need to move it into tabby's state directory which
           lives in `/var/lib/tabby`. Because the tabby.service is configured to
-          use a DyanmicUser the service will need to have been started at least
+          use a DynamicUser the service will need to have been started at least
           once before you can move the locally existing model into
           `/var/lib/tabby`. You can set the model to 'none' and tabby will
           startup and fail to download a model, but will have created the
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index f40ac3c9138f..7e53ca04cb39 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -51,6 +51,9 @@ in {
         default = null;
         description = ''
           Alertmanager configuration as nix attribute set.
+
+          The contents of the resulting config file are processed using envsubst.
+          `$` needs to be escaped as `$$` to be preserved.
         '';
       };
 
@@ -62,6 +65,9 @@ in {
           defines the text that is written to alertmanager.yml. If null, the
           contents of alertmanager.yml is generated from the structured config
           options.
+
+          The contents of the resulting config file are processed using envsubst.
+          `$` needs to be escaped as `$$` to be preserved.
         '';
       };
 
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 39197c5e69e1..07c6a507074f 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -112,7 +112,7 @@ in
       environment = {
         MEILI_DB_PATH = "/var/lib/meilisearch";
         MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";
-        MEILI_NO_ANALYTICS = toString cfg.noAnalytics;
+        MEILI_NO_ANALYTICS = boolToString cfg.noAnalytics;
         MEILI_ENV = cfg.environment;
         MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";
         MEILI_LOG_LEVEL = cfg.logLevel;
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index a368b6eee2a6..042ca0bb3b36 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -31,6 +31,7 @@ let
     mkOption
     mkPackageOption
     optional
+    optionals
     optionalString
     splitString
     subtractLists
@@ -45,10 +46,22 @@ let
   serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
   clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
   unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
-  certPaths = builtins.map builtins.dirOf [
-    cfg.serverSettings.tls_chain
-    cfg.serverSettings.tls_key
-  ];
+  provisionSecretFiles = filter (x: x != null) (
+    [
+      cfg.provision.idmAdminPasswordFile
+      cfg.provision.adminPasswordFile
+    ]
+    ++ mapAttrsToList (_: x: x.basicSecretFile) cfg.provision.systems.oauth2
+  );
+  secretDirectories = unique (
+    map builtins.dirOf (
+      [
+        cfg.serverSettings.tls_chain
+        cfg.serverSettings.tls_key
+      ]
+      ++ optionals cfg.provision.enable provisionSecretFiles
+    )
+  );
 
   # Merge bind mount paths and remove paths where a prefix is already mounted.
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
@@ -817,7 +830,7 @@ in
         (
           defaultServiceConfig
           // {
-            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ certPaths);
+            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretDirectories);
           }
         )
         {
diff --git a/nixos/modules/services/web-apps/open-web-calendar.nix b/nixos/modules/services/web-apps/open-web-calendar.nix
new file mode 100644
index 000000000000..525c9eb8c28c
--- /dev/null
+++ b/nixos/modules/services/web-apps/open-web-calendar.nix
@@ -0,0 +1,162 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mkDefault
+    types
+    concatMapStringsSep
+    generators
+    ;
+  cfg = config.services.open-web-calendar;
+
+  nixosSpec = calendarSettingsFormat.generate "nixos_specification.json" cfg.calendarSettings;
+  finalPackage = cfg.package.override {
+    # The calendarSettings need to be merged with the default_specification.yml
+    # in the source. This way we use upstreams default values but keep everything overridable.
+    defaultSpecificationFile = pkgs.runCommand "custom-default_specification.yml" { } ''
+      ${pkgs.yq}/bin/yq -s '.[0] * .[1]' ${cfg.package}/${cfg.package.defaultSpecificationPath} ${nixosSpec} > $out
+    '';
+  };
+
+  inherit (finalPackage) python;
+  pythonEnv = python.buildEnv.override {
+    extraLibs = [
+      (python.pkgs.toPythonModule finalPackage)
+      # Allows Gunicorn to set a meaningful process name
+      python.pkgs.gunicorn.optional-dependencies.setproctitle
+    ];
+  };
+
+  settingsFormat = pkgs.formats.keyValue { };
+  calendarSettingsFormat = pkgs.formats.json { };
+in
+{
+  options.services.open-web-calendar = {
+
+    enable = mkEnableOption "OpenWebCalendar service";
+
+    package = mkPackageOption pkgs "open-web-calendar" { };
+
+    domain = mkOption {
+      type = types.str;
+      description = "The domain under which open-web-calendar is made available";
+      example = "open-web-calendar.example.org";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            readOnly = true;
+            description = ''
+              The hosts that the Open Web Calendar permits. This is required to
+              mitigate the Host Header Injection vulnerability.
+
+              We always set this to the empty list, as Nginx already checks the Host header.
+            '';
+            default = "";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration for the server. These are set as environment variables to the gunicorn/flask service.
+
+        See the documentation options in <https://open-web-calendar.quelltext.eu/host/configure/#configuring-the-server>.
+      '';
+    };
+
+    calendarSettings = mkOption {
+      type = types.submodule {
+        freeformType = calendarSettingsFormat.type;
+        options = { };
+      };
+      default = { };
+      description = ''
+        Configure the default calendar.
+
+        See the documentation options in <https://open-web-calendar.quelltext.eu/host/configure/#configuring-the-default-calendar> and <https://github.com/niccokunzmann/open-web-calendar/blob/master/open_web_calendar/default_specification.yml>.
+
+        Individual calendar instances can be further configured outside this module, by specifying the `specification_url` parameter.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = !cfg.settings ? "PORT";
+        message = ''
+          services.open-web-calendar.settings.PORT can't be set, as the service uses a unix socket.
+        '';
+      }
+    ];
+
+    systemd.sockets.open-web-calendar = {
+      before = [ "nginx.service" ];
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "/run/open-web-calendar/socket";
+        SocketUser = "open-web-calendar";
+        SocketGroup = "open-web-calendar";
+        SocketMode = "770";
+      };
+    };
+
+    systemd.services.open-web-calendar = {
+      description = "Open Web Calendar";
+      after = [ "network.target" ];
+      environment.PYTHONPATH = "${pythonEnv}/${python.sitePackages}/";
+      serviceConfig = {
+        Type = "notify";
+        NotifyAccess = "all";
+        ExecStart = ''
+          ${pythonEnv.pkgs.gunicorn}/bin/gunicorn \
+            --name=open-web-calendar \
+            --bind='unix:///run/open-web-calendar/socket' \
+            open_web_calendar.app:app
+        '';
+        EnvironmentFile = settingsFormat.generate "open-web-calendar.env" cfg.settings;
+        ExecReload = "kill -s HUP $MAINPID";
+        KillMode = "mixed";
+        PrivateTmp = true;
+        RuntimeDirectory = "open-web-calendar";
+        User = "open-web-calendar";
+        Group = "open-web-calendar";
+      };
+    };
+
+    users.users.open-web-calendar = {
+      isSystemUser = true;
+      group = "open-web-calendar";
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts."${cfg.domain}" = {
+        forceSSL = mkDefault true;
+        enableACME = mkDefault true;
+        locations."/".proxyPass = "http://unix:///run/open-web-calendar/socket";
+      };
+    };
+
+    users.groups.open-web-calendar.members = [ config.services.nginx.user ];
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+
+}
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 70b455871b4b..c1a5e9c3877d 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -1094,6 +1094,7 @@ in
 
     };
     # We do this because we need the udev rules from the package
+    services.lvm.enable = true;
     boot.initrd.services.lvm.enable = true;
 
     boot.initrd.preFailCommands = mkIf (!config.boot.initrd.systemd.enable) postCommands;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d2ff01f9c7bb..b35d5fa7bf7d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -749,6 +749,7 @@ in {
   openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   opentabletdriver = handleTest ./opentabletdriver.nix {};
   opentelemetry-collector = handleTest ./opentelemetry-collector.nix {};
+  open-web-calendar = handleTest ./web-apps/open-web-calendar.nix {};
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix {};
   owncast = handleTest ./owncast.nix {};
   outline = handleTest ./outline.nix {};
diff --git a/nixos/tests/web-apps/open-web-calendar.nix b/nixos/tests/web-apps/open-web-calendar.nix
new file mode 100644
index 000000000000..b5cd59c56abd
--- /dev/null
+++ b/nixos/tests/web-apps/open-web-calendar.nix
@@ -0,0 +1,51 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    certs = import ../common/acme/server/snakeoil-certs.nix;
+
+    serverDomain = certs.domain;
+  in
+  {
+    name = "open-web-calendar";
+    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+
+    nodes.server =
+      { pkgs, lib, ... }:
+      {
+        services.open-web-calendar = {
+          enable = true;
+          domain = serverDomain;
+          calendarSettings.title = "My custom title";
+        };
+
+        services.nginx.virtualHosts."${serverDomain}" = {
+          enableACME = lib.mkForce false;
+          sslCertificate = certs."${serverDomain}".cert;
+          sslCertificateKey = certs."${serverDomain}".key;
+        };
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+
+        networking.hosts."::1" = [ "${serverDomain}" ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
+      };
+
+    nodes.client =
+      { pkgs, nodes, ... }:
+      {
+        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    testScript = ''
+      start_all()
+      server.wait_for_unit("open-web-calendar.socket")
+      server.wait_until_succeeds("curl -f https://${serverDomain}/ | grep 'My custom title'")
+    '';
+  }
+)
diff --git a/pkgs/applications/editors/neovim/ruby_provider/Gemfile b/pkgs/applications/editors/neovim/ruby_provider/Gemfile
index eebecf2906fb..e59d0636aacc 100644
--- a/pkgs/applications/editors/neovim/ruby_provider/Gemfile
+++ b/pkgs/applications/editors/neovim/ruby_provider/Gemfile
@@ -1,3 +1,4 @@
 source 'https://rubygems.org'
 
 gem 'neovim'
+gem 'logger'
diff --git a/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock b/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
index dc0140032066..ad005030b00e 100644
--- a/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
+++ b/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
@@ -1,7 +1,8 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    msgpack (1.7.2)
+    logger (1.6.1)
+    msgpack (1.7.5)
     multi_json (1.15.0)
     neovim (0.10.0)
       msgpack (~> 1.1)
@@ -11,7 +12,8 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  logger
   neovim
 
 BUNDLED WITH
-   2.3.27
+   2.5.16
diff --git a/pkgs/applications/editors/neovim/ruby_provider/gemset.nix b/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
index e2df8d535c47..75b461a908a3 100644
--- a/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
+++ b/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
@@ -1,13 +1,23 @@
 {
+  logger = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
   msgpack = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a5adcb7bwan09mqhj3wi9ib52hmdzmqg7q08pggn3adibyn5asr";
+      sha256 = "1a5fsgchkpcca4wf3pipbb2jbj523l7fbaq37j10cr0yymwlkc7z";
       type = "gem";
     };
-    version = "1.7.2";
+    version = "1.7.5";
   };
   multi_json = {
     groups = ["default"];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index be1a1fbadb97..5b75cec95a28 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -83,6 +83,11 @@ in
 , zlib
 , pkgsBuildBuild
 
+# Darwin
+, apple-sdk_14
+, cups
+, rsync # used when preparing .app directory
+
 # optionals
 
 ## addon signing/sideloading
@@ -214,6 +219,8 @@ let
     pref("${key}", ${builtins.toJSON value.value});
   '') defaultPrefs));
 
+  toolkit = if stdenv.hostPlatform.isDarwin then "cairo-cocoa" else "cairo-gtk3${lib.optionalString waylandSupport "-wayland"}";
+
 in
 
 buildStdenv.mkDerivation {
@@ -282,7 +289,7 @@ buildStdenv.mkDerivation {
   + extraPostPatch;
 
   # Ignore trivial whitespace changes in patches, this fixes compatibility of
-  # ./env_var_for_system_dir.patch with Firefox >=65 without having to track
+  # ./env_var_for_system_dir-*.patch with Firefox >=65 without having to track
   # two patches.
   patchFlags = [ "-p1" "-l" ];
 
@@ -298,7 +305,6 @@ buildStdenv.mkDerivation {
     makeWrapper
     nodejs
     perl
-    pkg-config
     python3
     rust-cbindgen
     rustPlatform.bindgenHook
@@ -307,6 +313,8 @@ buildStdenv.mkDerivation {
     which
     wrapGAppsHook3
   ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ rsync ]
   ++ lib.optionals crashreporterSupport [ dump_syms patchelf ]
   ++ lib.optionals pgoSupport [ xvfb-run ]
   ++ extraNativeBuildInputs;
@@ -400,20 +408,9 @@ buildStdenv.mkDerivation {
     "--disable-tests"
     "--disable-updater"
     "--enable-application=${application}"
-    "--enable-default-toolkit=cairo-gtk3${lib.optionalString waylandSupport "-wayland"}"
-    "--enable-system-pixman"
+    "--enable-default-toolkit=${toolkit}"
     "--with-distribution-id=org.nixos"
     "--with-libclang-path=${lib.getLib llvmPackagesBuildBuild.libclang}/lib"
-    "--with-system-ffi"
-    "--with-system-icu"
-    "--with-system-jpeg"
-    "--with-system-libevent"
-    "--with-system-libvpx"
-    "--with-system-nspr"
-    "--with-system-nss"
-    "--with-system-png" # needs APNG support
-    "--with-system-webp"
-    "--with-system-zlib"
     "--with-wasi-sysroot=${wasiSysRoot}"
     # for firefox, host is buildPlatform, target is hostPlatform
     "--host=${buildStdenv.buildPlatform.config}"
@@ -429,17 +426,34 @@ buildStdenv.mkDerivation {
   ++ lib.optional (ltoSupport && (buildStdenv.hostPlatform.isAarch32 || buildStdenv.hostPlatform.isi686 || buildStdenv.hostPlatform.isx86_64)) "--disable-elf-hack"
   ++ lib.optional (!drmSupport) "--disable-eme"
   ++ lib.optional (allowAddonSideload) "--allow-addon-sideload"
-  ++ [
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    # MacOS builds use bundled versions of libraries: https://bugzilla.mozilla.org/show_bug.cgi?id=1776255
+    "--enable-system-pixman"
+    "--with-system-ffi"
+    "--with-system-icu"
+    "--with-system-jpeg"
+    "--with-system-libevent"
+    "--with-system-libvpx"
+    "--with-system-nspr"
+    "--with-system-nss"
+    "--with-system-png" # needs APNG support
+    "--with-system-webp"
+    "--with-system-zlib"
+
+    # These options are not available on MacOS, even --disable-*
     (enableFeature alsaSupport "alsa")
+    (enableFeature jackSupport "jack")
+    (enableFeature pulseaudioSupport "pulseaudio")
+    (enableFeature sndioSupport "sndio")
+  ]
+  ++ [
     (enableFeature crashreporterSupport "crashreporter")
     (enableFeature ffmpegSupport "ffmpeg")
     (enableFeature geolocationSupport "necko-wifi")
     (enableFeature gssSupport "negotiateauth")
-    (enableFeature jackSupport "jack")
     (enableFeature jemallocSupport "jemalloc")
-    (enableFeature pulseaudioSupport "pulseaudio")
-    (enableFeature sndioSupport "sndio")
     (enableFeature webrtcSupport "webrtc")
+
     (enableFeature debugBuild "debug")
     (if debugBuild then "--enable-profiling" else "--enable-optimize")
     # --enable-release adds -ffunction-sections & LTO that require a big amount
@@ -454,26 +468,33 @@ buildStdenv.mkDerivation {
 
   buildInputs = [
     bzip2
+    file
+    libGL
+    libGLU
+    libstartup_notification
+    nasm
+    perl
+    zip
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_14
+    cups
+  ]
+  ++ (lib.optionals (!stdenv.hostPlatform.isDarwin) ([
     dbus
     dbus-glib
-    file
     fontconfig
     freetype
     glib
     gtk3
     libffi
-    libGL
-    libGLU
     libevent
     libjpeg
     libpng
-    libstartup_notification
     libvpx
     libwebp
-    nasm
     nspr
     pango
-    perl
     xorg.libX11
     xorg.libXcursor
     xorg.libXdamage
@@ -485,21 +506,20 @@ buildStdenv.mkDerivation {
     xorg.libXtst
     xorg.pixman
     xorg.xorgproto
-    zip
     zlib
-  ]
+    (if (lib.versionAtLeast version "116") then nss_latest else nss_esr/*3.90*/)
+  ] ++ lib.optional  alsaSupport alsa-lib
+    ++ lib.optional  jackSupport libjack2
+    ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
+    ++ lib.optional  sndioSupport sndio
+    ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
+  ))
   # icu73 changed how it follows symlinks which breaks in the firefox sandbox
   # https://bugzilla.mozilla.org/show_bug.cgi?id=1839287
   # icu74 fails to build on 127 and older
   # https://bugzilla.mozilla.org/show_bug.cgi?id=1862601
   ++ [ (if (lib.versionAtLeast version "115") then icu73 else icu72) ]
-  ++ [ (if (lib.versionAtLeast version "116") then nss_latest else nss_esr/*3.90*/) ]
-  ++ lib.optional  alsaSupport alsa-lib
-  ++ lib.optional  jackSupport libjack2
-  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
-  ++ lib.optional  sndioSupport sndio
   ++ lib.optional  gssSupport libkrb5
-  ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
   ++ lib.optional  jemallocSupport jemalloc
   ++ extraBuildInputs;
 
@@ -555,27 +575,45 @@ buildStdenv.mkDerivation {
     cd objdir
   '';
 
-  postInstall = ''
-    # Install distribution customizations
-    install -Dvm644 ${distributionIni} $out/lib/${binaryName}/distribution/distribution.ini
-    install -Dvm644 ${defaultPrefsFile} $out/lib/${binaryName}/browser/defaults/preferences/nixos-default-prefs.js
+  # The target will prepare .app bundle
+  installTargets = lib.optionalString stdenv.hostPlatform.isDarwin "stage-package";
 
-  '' + lib.optionalString buildStdenv.hostPlatform.isLinux ''
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    cp -r dist/${binaryName}/*.app $out/Applications
+
+    appBundlePath=(dist/${binaryName}/*.app)
+    appBundle=''${appBundlePath[0]#dist/${binaryName}}
+    resourceDir=$out/Applications/$appBundle/Contents/Resources
+
+  '' + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     # Remove SDK cruft. FIXME: move to a separate output?
     rm -rf $out/share/idl $out/include $out/lib/${binaryName}-devel-*
 
     # Needed to find Mozilla runtime
     gappsWrapperArgs+=(--argv0 "$out/bin/.${binaryName}-wrapped")
+
+    resourceDir=$out/lib/${binaryName}
+  '' + ''
+    # Install distribution customizations
+    install -Dvm644 ${distributionIni} "$resourceDir/distribution/distribution.ini"
+    install -Dvm644 ${defaultPrefsFile} "$resourceDir/browser/defaults/preferences/nixos-default-prefs.js"
+
+    cd ..
   '';
 
-  postFixup = lib.optionalString crashreporterSupport ''
+  postFixup = lib.optionalString (crashreporterSupport && buildStdenv.hostPlatform.isLinux) ''
     patchelf --add-rpath "${lib.makeLibraryPath [ curl ]}" $out/lib/${binaryName}/crashreporter
   '';
 
+  # Some basic testing
   doInstallCheck = true;
-  installCheckPhase = ''
-    # Some basic testing
-    "$out/bin/${binaryName}" --version
+  installCheckPhase = lib.optionalString buildStdenv.hostPlatform.isDarwin ''
+    bindir=$out/Applications/$appBundle/Contents/MacOS
+  '' + lib.optionalString (!buildStdenv.hostPlatform.isDarwin) ''
+    bindir=$out/bin
+  '' + ''
+    "$bindir/${binaryName}" --version
   '';
 
   passthru = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index fdf8ac09f98d..fc4b697d9388 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -22,7 +22,6 @@ buildMozillaMach rec {
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [ jopejoe1 ];
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit;
     # since Firefox 60, build on 32-bit platforms fails with "out of memory".
     # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index a8781e765841..bb2b934aef75 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -24,7 +24,6 @@ buildMozillaMach rec {
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [ jopejoe1 ];
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit;
     # since Firefox 60, build on 32-bit platforms fails with "out of memory".
     # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-128.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-128.nix
index 2fec0fa28714..f6528930ff8f 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-128.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-128.nix
@@ -21,7 +21,6 @@ buildMozillaMach rec {
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [ hexa ];
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit;
     # since Firefox 60, build on 32-bit platforms fails with "out of memory".
     # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
index b37e1737e779..dfd197b3ef24 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@@ -24,7 +24,6 @@ buildMozillaMach rec {
       hexa
     ];
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit;
     # since Firefox 60, build on 32-bit platforms fails with "out of memory".
     # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 73cdd9103de9..56314b66de49 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -87,7 +87,10 @@ let
                 else [])
        );
 
-      libs =   lib.optionals stdenv.hostPlatform.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils vulkan-loader ]
+       libs = lib.optionals stdenv.hostPlatform.isLinux (
+            [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils vulkan-loader ]
+            ++ lib.optional (cfg.speechSynthesisSupport or true) speechd-minimal
+       )
             ++ lib.optional pipewireSupport pipewire
             ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport libkrb5
@@ -99,7 +102,6 @@ let
             ++ lib.optional sndioSupport sndio
             ++ lib.optional jackSupport libjack2
             ++ lib.optional smartcardSupport opensc
-            ++ lib.optional (cfg.speechSynthesisSupport or true) speechd-minimal
             ++ pkcs11Modules
             ++ gtk_modules;
       gtk_modules = [ libcanberra-gtk3 ];
diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
index 56dc4af350ab..5b6b6e9e61b1 100644
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -50,7 +50,6 @@
       homepage = "https://floorp.app/";
       maintainers = with lib.maintainers; [ christoph-heiss ];
       platforms = lib.platforms.unix;
-      badPlatforms = lib.platforms.darwin;
       broken = stdenv.buildPlatform.is32bit;
       # since Firefox 60, build on 32-bit platforms fails with "out of memory".
       # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix
index 5df6d56dd601..bcaa02cfa948 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@@ -19,7 +19,6 @@ in
     homepage = "https://librewolf.net/";
     maintainers = with lib.maintainers; [ squalus dwrege ];
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
     broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
                                            # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index a3df5958beb6..ba1c6d69c01c 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -24,7 +24,6 @@
   libnatpmp,
   libpulseaudio,
   libupnp,
-  yaml-cpp,
   msgpack-cxx,
   openssl,
   restinio,
@@ -32,6 +31,7 @@
   speex,
   udev,
   webrtc-audio-processing,
+  yaml-cpp,
   zlib,
 
   # for dhtnet
@@ -68,14 +68,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20240823.0";
+  version = "20241031.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-7jGH54sFiS6qrdEiKSS64lJyJXL1FOJVbesxo/FFmyA=";
+    hash = "sha256-LKezdzM+ltUSgW4GmTXICyufx9mI1AVbdEcwSp6tmao=";
     fetchSubmodules = true;
   };
 
@@ -137,7 +137,7 @@ stdenv.mkDerivation rec {
       domain = "git.jami.net";
       owner = "savoirfairelinux";
       repo = "dhtnet";
-      rev = "cfe512b0632eea046f683b22e42d01eeb943d751";
+      rev = "8cd00200669fa5b7632faa447ba206c3847e2879";
       hash = "sha256-SGidaCi5z7hO0ePJIZIkcWAkb+cKsZTdksVS7ldpjME=";
     };
 
@@ -173,6 +173,8 @@ stdenv.mkDerivation rec {
       "-DBUILD_BENCHMARKS=Off"
       "-DBUILD_TOOLS=Off"
       "-DBUILD_TESTING=Off"
+      "-DBUILD_DEPENDENCIES=Off"
+      "-DBUILD_EXAMPLE=Off"
     ];
 
     meta = with lib; {
@@ -188,6 +190,12 @@ stdenv.mkDerivation rec {
     inherit src version meta;
     sourceRoot = "${src.name}/daemon";
 
+    # Fix for libgit2 breaking changes
+    postPatch = ''
+      substituteInPlace src/jamidht/conversationrepository.cpp \
+        --replace-fail "git_commit* const" "const git_commit*"
+    '';
+
     nativeBuildInputs = [
       autoreconfHook
       pkg-config
@@ -212,7 +220,6 @@ stdenv.mkDerivation rec {
       libnatpmp
       libpulseaudio
       libupnp
-      yaml-cpp
       msgpack-cxx
       opendht-jami
       openssl
@@ -222,6 +229,7 @@ stdenv.mkDerivation rec {
       speex
       udev
       webrtc-audio-processing
+      yaml-cpp
       zlib
     ];
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 25f78dbd3dcb..846efdb0542a 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -38,7 +38,6 @@ let
       mainProgram = "thunderbird";
       maintainers = with maintainers; [ lovesegfault pierron vcunat ];
       platforms = platforms.unix;
-      badPlatforms = platforms.darwin;
       broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
                                              # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
       license = licenses.mpl20;
diff --git a/pkgs/applications/version-management/p4/default.nix b/pkgs/applications/version-management/p4/default.nix
index ec01f86a3af0..94bbd7cb0df9 100644
--- a/pkgs/applications/version-management/p4/default.nix
+++ b/pkgs/applications/version-management/p4/default.nix
@@ -62,7 +62,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [ "-sOSVER=26" ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       "-sOSVER=1013"
-      "-sMACOSX_SDK=${emptyDirectory}"
       "-sLIBC++DIR=${lib.getLib stdenv.cc.libcxx}/lib"
     ];
 
@@ -81,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: rec {
       (stdenv.cc.isClang || (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.cc.version "11.0.0"))
       [ "-include" "limits" "-include" "thread" ];
 
+  preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export MACOSX_SDK=$SDKROOT
+  '';
+
   buildPhase = ''
     runHook preBuild
     jam $jamFlags -j$NIX_BUILD_CORES p4
diff --git a/pkgs/applications/misc/bottles/default.nix b/pkgs/by-name/bo/bottles-unwrapped/package.nix
similarity index 84%
rename from pkgs/applications/misc/bottles/default.nix
rename to pkgs/by-name/bo/bottles-unwrapped/package.nix
index bc9d3cb2e444..c6aa927e1c02 100644
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/by-name/bo/bottles-unwrapped/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  gitUpdater,
   python3Packages,
   blueprint-compiler,
   meson,
@@ -25,17 +24,18 @@
   mangohud,
   vkbasalt-cli,
   vmtouch,
+  nix-update-script,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "bottles-unwrapped";
-  version = "51.13";
+  version = "51.15";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = "bottles";
-    rev = version;
-    hash = "sha256-ZcUevGY81H3ATTk390ojBp/4zBE2Lui7Qa+Qe8B0XL4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-HjGAeIh9s7xWBy35Oj66tCtgKCd/DpHg1sMPsdjWKDs=";
   };
 
   patches = [ ./vulkan_icd.patch ];
@@ -102,18 +102,19 @@ python3Packages.buildPythonApplication rec {
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Easy-to-use wineprefix manager";
     homepage = "https://usebottles.com/";
     downloadPage = "https://github.com/bottlesdevs/Bottles/releases";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
       psydvl
       shamilton
+      Gliczy
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "bottles";
   };
 }
diff --git a/pkgs/applications/misc/bottles/vulkan_icd.patch b/pkgs/by-name/bo/bottles-unwrapped/vulkan_icd.patch
similarity index 100%
rename from pkgs/applications/misc/bottles/vulkan_icd.patch
rename to pkgs/by-name/bo/bottles-unwrapped/vulkan_icd.patch
diff --git a/pkgs/applications/misc/bottles/fhsenv.nix b/pkgs/by-name/bo/bottles/package.nix
similarity index 100%
rename from pkgs/applications/misc/bottles/fhsenv.nix
rename to pkgs/by-name/bo/bottles/package.nix
diff --git a/pkgs/by-name/ca/cargo-binstall/package.nix b/pkgs/by-name/ca/cargo-binstall/package.nix
index eb6d5bff0026..e4e644584774 100644
--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.10.7";
+  version = "1.10.13";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-bQYKOo11zVIXNHdoD60oEdzSSYeLKppPJBen6wdrXq8=";
+    hash = "sha256-z18p25myXINtQpuNw+tHiyj1J1oDEmkQ+v4dj4GKYtg=";
   };
 
-  cargoHash = "sha256-Tr++ui715adP1taqj+Sms2yO3hF5SZl7zCrAkPYlSdY=";
+  cargoHash = "sha256-cRTaGqArCbmlu6xthBMijtyyL7s+4mvxl1Yeuw5VS9A=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ex/exfatprogs/package.nix b/pkgs/by-name/ex/exfatprogs/package.nix
index 66505d82b7ec..aef76521b9f5 100644
--- a/pkgs/by-name/ex/exfatprogs/package.nix
+++ b/pkgs/by-name/ex/exfatprogs/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exfatprogs";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-EqSzveqLb0Ms7D5Pczoh0BuKD1sILzAbJMnDLacokl4=";
+    sha256 = "sha256-VUvVPABgQ7EUQu90DbWU7a+YThrWhusTk/YreKSqU/M=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook file ];
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 9a39ca1dc516..9452224d8390 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.8";
+  version = "0.20.9";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-/YoSBjaKlubOqyOKtaykkh20beDHkwCAWarRlyitoOc=";
+    hash = "sha256-iWANQD5+cn/vUYdy6MXBYIEl5BOiG6WPuYYsOyWzUuM=";
   };
 
-  cargoHash = "sha256-5vlVrrgJKObsAd/4Kspu7G3CPfOt6QpbZHgTTKrpuBs=";
+  cargoHash = "sha256-gagCf81TT+6LsxypHoMZXHU0ux4f8wytwDMGyaDbXyg=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/ga/galer/package.nix b/pkgs/by-name/ga/galer/package.nix
index b2a9311a0b46..69012a2519a4 100644
--- a/pkgs/by-name/ga/galer/package.nix
+++ b/pkgs/by-name/ga/galer/package.nix
@@ -5,20 +5,21 @@
 
 buildGoModule rec {
   pname = "galer";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "dwisiswant0";
     repo = "galer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/VvN6LjK+V8E9XYarRUI/TPGitMM0a3g1lfdYhV1yP8=";
+    hash = "sha256-otyvEXBiPBhWvyoJEG6Ho5HA63Lg78odMR4mc0n+xXo=";
   };
 
-  vendorHash = "sha256-WDOwUjU6AP/8QvqiKTEY6wsMBZQFWn/LGWr8nfqDF+8=";
+  vendorHash = "sha256-BS7ZUq8/swZpTaYGjiF5OuZXQpoosZ3mdF9v1euijxo=";
 
   meta = with lib; {
     description = "Tool to fetch URLs from HTML attributes";
     homepage = "https://github.com/dwisiswant0/galer";
+    changelog = "https://github.com/dwisiswant0/galer/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "galer";
diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 102cfe3ddf58..a98459bbc0d1 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -49,5 +49,9 @@ rustPlatform.buildRustPackage rec {
       binary-eater
       m1dugh
     ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
   };
 }
diff --git a/pkgs/by-name/ip/iptraf-ng/package.nix b/pkgs/by-name/ip/iptraf-ng/package.nix
index 5b50bf3c5b01..33f9a83dcded 100644
--- a/pkgs/by-name/ip/iptraf-ng/package.nix
+++ b/pkgs/by-name/ip/iptraf-ng/package.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, ncurses }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.1";
+  version = "1.2.2";
   pname = "iptraf-ng";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1f91w1bjaayr6ld95z2q55ny983bb0m05k1jrw2bcddvcihaiqb1";
+    sha256 = "sha256-SM1cJYNnZlGl3eWaYd8DlPrV4AL9nck1tjdOn0CHVUw=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/by-name/ly/lyra-cursors/package.nix b/pkgs/by-name/ly/lyra-cursors/package.nix
new file mode 100644
index 000000000000..b1ce03d965fb
--- /dev/null
+++ b/pkgs/by-name/ly/lyra-cursors/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenvNoCC,
+  inkscape,
+  xcursorgen,
+  fetchFromGitHub,
+  fetchpatch2,
+}:
+let
+  styles = [
+    "LyraB"
+    "LyraF"
+    "LyraG"
+    "LyraP"
+    "LyraQ"
+    "LyraR"
+    "LyraS"
+    "LyraX"
+    "LyraY"
+  ];
+
+  # This is a patch from a fork of the upstream repository which addresses several issues with the
+  # build script such as the fact that the style to build isn't hardcoded. We don't simply use this
+  # fork as source, as the upstream repository is what we want to track.
+  buildScriptPatch = fetchpatch2 {
+    name = "use-more-flexible-build-script.patch";
+    url = "https://github.com/KiranWells/Lyra-Cursors/commit/2735acb37a51792388497c666cc28370660217cb.patch?full_index=1";
+    hash = "sha256-KCT4zNdep1TB7Oa4qrPw374ahT30o9/QrNTEgobp8zM=";
+  };
+in
+stdenvNoCC.mkDerivation {
+  pname = "lyra-cursors";
+  version = "0-unstable-2021-12-04";
+
+  src = fetchFromGitHub {
+    owner = "yeyushengfan258";
+    repo = "Lyra-Cursors";
+    rev = "c096c54034f95bd35699b3226250e5c5ec015d9a";
+    hash = "sha256-lfaX8ouE0JaQwVBpAGsrLIExQZ2rCSFKPs3cch17eYg=";
+  };
+
+  nativeBuildInputs = [
+    inkscape
+    xcursorgen
+  ];
+
+  patches = [ buildScriptPatch ];
+
+  dontConfigure = true;
+
+  postPatch = ''
+    patchShebangs build.sh
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    rm -r dist
+    for THEME in ${lib.escapeShellArgs styles}; do
+      ./build.sh "$THEME"
+    done
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    mv dist/*-cursors $out/share/icons
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A cursor theme inspired by macOS and based on capitaine-cursors";
+    homepage = "https://github.com/yeyushengfan258/Lyra-Cursors";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ lordmzte ];
+  };
+}
diff --git a/pkgs/by-name/me/memtier-benchmark/package.nix b/pkgs/by-name/me/memtier-benchmark/package.nix
index c63adb0772b0..f0b0d41aa6ff 100644
--- a/pkgs/by-name/me/memtier-benchmark/package.nix
+++ b/pkgs/by-name/me/memtier-benchmark/package.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "memtier-benchmark";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner  = "redislabs";
     repo   = "memtier_benchmark";
     rev    = "refs/tags/${version}";
-    sha256 = "sha256-mYqbtyXVx21rMJmZubFuAVV3qEmk0G3H3fjL6WnUzzM=";
+    sha256 = "sha256-8xo4CbpjAl9+SArUwqSJiTcKCLhPF/rIPernDoPIi3I=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/ml/mlkit/package.nix b/pkgs/by-name/ml/mlkit/package.nix
index 633f126a3561..38babac5b65f 100644
--- a/pkgs/by-name/ml/mlkit/package.nix
+++ b/pkgs/by-name/ml/mlkit/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlkit";
-  version = "4.7.12";
+  version = "4.7.13";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
     rev = "v${version}";
-    sha256 = "sha256-9a2CbIOHdN+kTtm2Z001qOEO/nXuSLrzq0ovgHU1hTQ=";
+    sha256 = "sha256-sh6IaSrVOULGixQFpm1ada4Kzly/TVCgsZwEzV+7lzc=";
   };
 
   nativeBuildInputs = [ autoreconfHook mlton ];
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 00df6946c213..29dfa2a7f7f6 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -18,18 +18,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.61.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     rev = "n8n@${finalAttrs.version}";
-    hash = "sha256-9hIwpid/uly7wUcrBgLkSw+Aah8OQ66MgrMQbs/5v1Y=";
+    hash = "sha256-3fGsghGzqLb9B0qrqPuJV2pypd3kJVUrYohMe9quqG4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lZLWqlR6xq7DYpnydgJK8gL7WdfZcRU+8Autzh6e7kY=";
+    hash = "sha256-n+A7SGfjzvB9NOt8kqi7DswKSjCTef5SJItWtFzNpwA=";
   };
 
   nativeBuildInputs = [
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontStrip = true;
 
-  meta = with lib; {
+  meta = {
     description = "Free and source-available fair-code licensed workflow automation tool";
     longDescription = ''
       Free and source-available fair-code licensed workflow automation tool.
@@ -97,12 +97,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://n8n.io";
     changelog = "https://github.com/n8n-io/n8n/releases/tag/${finalAttrs.src.rev}";
-    maintainers = with maintainers; [
-      freezeboy
+    maintainers = with lib.maintainers; [
       gepbird
     ];
-    license = licenses.sustainableUse;
+    license = lib.licenses.sustainableUse;
     mainProgram = "n8n";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/nm/nmap-formatter/package.nix b/pkgs/by-name/nm/nmap-formatter/package.nix
index 12b73a585b11..173514c7fd0b 100644
--- a/pkgs/by-name/nm/nmap-formatter/package.nix
+++ b/pkgs/by-name/nm/nmap-formatter/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "nmap-formatter";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "vdjagilev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-2XbqpvtlNAYrgtaMnFklYRoHCj3nkltEZlwbZzvfdFU=";
+    hash = "sha256-tB3FPb0k7jJ8RECsT3eLGjVpHqNclOvlh1MgoV6bbwo=";
   };
 
   vendorHash = "sha256-PKoe4rpwPy3omfRRhN70iEJJ/sHliIwxPUHGxRJqrf4=";
diff --git a/pkgs/by-name/no/noseyparker/package.nix b/pkgs/by-name/no/noseyparker/package.nix
index 8e71720b617c..21d213802370 100644
--- a/pkgs/by-name/no/noseyparker/package.nix
+++ b/pkgs/by-name/no/noseyparker/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "noseyparker";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "noseyparker";
     rev = "v${version}";
-    hash = "sha256-pFAtyvnqCLTY3l7c47rpN1jHjQon0fTPT3KaV9mcs3Q=";
+    hash = "sha256-mRGlJto2b/oPLsvktQuBUsIO0kao9i4GjbmgztdAwiQ=";
   };
 
-  cargoHash = "sha256-t4tZDww6aySlTBq1BB4OGhi9w6fGY2gi7mPM1SR2mt8=";
+  cargoHash = "sha256-NibALhXquX/izimso8BBSWDCwDIykvbr7yN610nnOS4=";
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/by-name/oa/oauth2c/package.nix b/pkgs/by-name/oa/oauth2c/package.nix
index db7b3c00729b..5c01d5e10596 100644
--- a/pkgs/by-name/oa/oauth2c/package.nix
+++ b/pkgs/by-name/oa/oauth2c/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "oauth2c";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "cloudentity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-spD6BEyDwY2Nrk/XOWA+XJA1l7ixN4j6N5m9e8DLg88=";
+    hash = "sha256-2EfkNtTbHSa0UZGfYylz0HlyVxGdSJNIUj6682DICSg=";
   };
 
-  vendorHash = "sha256-PdLh/J0HUvr1JjW/ew5PQe9TJNykI4tJhlRoVjRT/hg=";
+  vendorHash = "sha256-ZQFIETfiNKyeZuskwNfoTXBy3MSWmG0tDztz0Mm7xJY=";
 
   doCheck = false; # tests want to talk to oauth2c.us.authz.cloudentity.io
 
diff --git a/pkgs/by-name/op/open-web-calendar/package.nix b/pkgs/by-name/op/open-web-calendar/package.nix
new file mode 100644
index 000000000000..1d1f0ace7145
--- /dev/null
+++ b/pkgs/by-name/op/open-web-calendar/package.nix
@@ -0,0 +1,90 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  nixosTests,
+
+  defaultSpecificationFile ? null,
+}:
+
+let
+  python = python3;
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "open-web-calendar";
+  version = "1.41";
+  pyproject = true;
+
+  disabled = python.pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "open_web_calendar";
+    hash = "sha256-3D1bGAioKCD1XZQVwtMVXi67VzzdJQnRLS6RF+dJNL4=";
+  };
+
+  # The Pypi tarball doesn't contain open_web_calendars/features
+  postPatch = ''
+    ln -s $PWD/features open_web_calendar/features
+  '';
+
+  postInstall = lib.optionalString (defaultSpecificationFile != null) ''
+    install -D ${defaultSpecificationFile} $out/$defaultSpecificationPath
+  '';
+
+  build-system = with python.pkgs; [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies =
+    with python.pkgs;
+    [
+      flask-caching
+      flask-allowed-hosts
+      flask
+      icalendar
+      requests
+      pyyaml
+      recurring-ical-events
+      gunicorn
+      lxml
+      beautifulsoup4
+      lxml-html-clean
+      pytz
+    ]
+    ++ requests.optional-dependencies.socks;
+
+  nativeCheckInputs = with python.pkgs; [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "open_web_calendar/test" ];
+
+  pythonImportsCheck = [ "open_web_calendar.app" ];
+
+  defaultSpecificationPath = "${python.sitePackages}/open_web_calendar/default_specification.yml";
+
+  passthru = {
+    inherit python;
+    tests = {
+      inherit (nixosTests) open-web-calendar;
+    };
+  };
+
+  meta = with lib; {
+    description = "Highly customizable web calendar that can be embedded into websites using ICal source links";
+    homepage = "https://open-web-calendar.quelltext.eu";
+    changelog =
+      let
+        v = builtins.replaceStrings [ "." ] [ "" ] version;
+      in
+      "https://open-web-calendar.quelltext.eu/changelog/#v${v}";
+    license = with licenses; [
+      gpl2Only
+      cc-by-sa-40
+      cc0
+    ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ erictapen ];
+    mainProgram = "open-web-calendar";
+  };
+}
diff --git a/pkgs/by-name/op/opensc/package.nix b/pkgs/by-name/op/opensc/package.nix
index 0f0e5b50757d..82b371875ce4 100644
--- a/pkgs/by-name/op/opensc/package.nix
+++ b/pkgs/by-name/op/opensc/package.nix
@@ -73,7 +73,12 @@ stdenv.mkDerivation rec {
     ) "XSLTPROC=${buildPackages.libxslt}/bin/xsltproc")
   ];
 
-  PCSC_CFLAGS = lib.optionalString withApplePCSC "-I${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/Headers";
+  PCSC_CFLAGS = lib.concatStringsSep " " (
+    lib.optionals withApplePCSC [
+      "-I${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/Headers"
+      "-I${lib.getDev pcsclite}/include/PCSC"
+    ]
+  );
 
   installFlags = [
     "sysconfdir=$(out)/etc"
diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 21372f8aea4c..7641287ebfff 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -60,14 +60,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "openvino";
-  version = "2024.4.1";
+  version = "2024.5.0";
 
   src = fetchFromGitHub {
     owner = "openvinotoolkit";
     repo = "openvino";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    hash = "sha256-v0PPGFUHCGNWdlTff40Ol2NvaYglb/+L/zZAQujk6lk=";
+    hash = "sha256-qRa6vTwTEWiSH57HThT2oGhJqhHwFLIqNsU1eCSLwLs=";
   };
 
   outputs = [
@@ -124,6 +124,7 @@ stdenv.mkDerivation rec {
     (cmakeBool "ENABLE_LTO" true)
     (cmakeBool "ENABLE_ONEDNN_FOR_GPU" false)
     (cmakeBool "ENABLE_OPENCV" true)
+    (cmakeBool "ENABLE_OV_JAX_FRONTEND" false) # auto-patchelf could not satisfy dependency libopenvino_jax_frontend.so.2450
     (cmakeBool "ENABLE_PYTHON" true)
 
     # system libs
@@ -139,6 +140,9 @@ stdenv.mkDerivation rec {
     "libngraph_backend.so"
   ];
 
+  # src/graph/src/plugins/intel_gpu/src/graph/include/reorder_inst.h:24:8: error: type 'struct typed_program_node' violates the C++ One Definition Rule [-Werror=odr]
+  env.NIX_CFLAGS_COMPILE = "-Wno-odr";
+
   buildInputs = [
     flatbuffers
     gflags
diff --git a/pkgs/by-name/pa/payload-dumper-go/package.nix b/pkgs/by-name/pa/payload-dumper-go/package.nix
index e10b41cbef99..e09322a0138c 100644
--- a/pkgs/by-name/pa/payload-dumper-go/package.nix
+++ b/pkgs/by-name/pa/payload-dumper-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "payload-dumper-go";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "ssut";
     repo = "payload-dumper-go";
     rev = "refs/tags/${version}";
-    hash = "sha256-P20/Nd2YOW9A9/OkpavVRBAi/ueYp812zZvVLnwX67Y=";
+    hash = "sha256-TFnBWylOoyleuBx3yYfHl1kWO6jVBiqsi8AMYLMuuk0=";
   };
 
-  vendorHash = "sha256-CqIZFMDN/kK9bT7b/32yQ9NJAQnkI8gZUMKa6MJCaec=";
+  vendorHash = "sha256-XeD47PsFjDT9777SNE8f2LbKZ1cnL5HNPr3Eg7UIpJ0=";
 
   buildInputs = [ xz ];
 
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index ebb545933a1d..39857dd8d7e6 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -8,13 +8,13 @@
 python3.pkgs.toPythonModule (
   python3.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2024-10-05";
+    version = "0-unstable-2024-11-17";
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "e7a4d7d7c3d688b69737f2b1ecd23571f5e3a0b9";
-      hash = "sha256-JfcB19Tfk5e7DyArzz9TNjidOZjkSxTLEU3ZhE105qs=";
+      rev = "10d3af84b833ab2f2d1095efa3a7ba240ffb32fc";
+      hash = "sha256-dXALuiPCzK0Az64Fj9ygsNFoPKf0oJ2LyZDeg00Bfyo=";
     };
 
     postPatch = ''
@@ -52,10 +52,11 @@ python3.pkgs.toPythonModule (
         brotli
         jinja2
         lxml
+        msgspec
         pygments
-        pytomlpp
         pyyaml
         redis
+        typer
         uvloop
         setproctitle
         httpx
diff --git a/pkgs/by-name/se/seilfahrt/package.nix b/pkgs/by-name/se/seilfahrt/package.nix
index be33fe3bf74b..6dd2002b2ad9 100644
--- a/pkgs/by-name/se/seilfahrt/package.nix
+++ b/pkgs/by-name/se/seilfahrt/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "seilfahrt";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Nerdbergev";
     repo = "seilfahrt";
     rev = "v${version}";
-    hash = "sha256-eQcRS3xyqdtjRki+EPnHIaqUJufniFJCh5qU2Za9kyg=";
+    hash = "sha256-w3r/mNb4en32huHjJbYghqDi/VsPGXinwUAfSMcuc+0=";
   };
 
-  vendorHash = "sha256-JU77EFk8SWgZkN4DEtkKS2MsBH16my4j9X/NJC/r6mI=";
+  vendorHash = "sha256-wYxQHr8AVi5KGMqRJcb2rTtbnJbi5som29YSILlO6Po=";
 
   buildInputs = [ pandoc ];
 
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index b7aacf1b70ee..8541b9fd668a 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20241106-1";
+  version = "20241119";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-klIkNt3AlT/msZl7pYPQaFMl/pdI7rcaeLDZekmTIzY=";
+    hash = "sha256-HZNjkOuJOoOSPmJHu6QTYzyxgS4dSC6lWB++xF4rRnI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tabiew/package.nix b/pkgs/by-name/ta/tabiew/package.nix
index 043a2675159e..caa6be91040b 100644
--- a/pkgs/by-name/ta/tabiew/package.nix
+++ b/pkgs/by-name/ta/tabiew/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tabiew";
-  version = "0.6.2";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "shshemi";
     repo = "tabiew";
     rev = "v${version}";
-    hash = "sha256-3f+l1gmJYl/7aTkZGxmCur9khDNSoUNjDGAHhe6T13U=";
+    hash = "sha256-c7Oo0sr/9uvOYwtNRTyYNWYVaBUWJXwJmMXaivv4RTg=";
   };
 
-  cargoHash = "sha256-FT98jzx/NQ1AWtGGLY63izKzGyjHnJNMuuQREqw+qnw=";
+  cargoHash = "sha256-uGxqVA7LrO0bzYVCDaPt4yECxWEzV4PQxxvk+17IX4w=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ti/tideways-daemon/package.nix b/pkgs/by-name/ti/tideways-daemon/package.nix
index 0a76c2dba528..a0d240b8c92f 100644
--- a/pkgs/by-name/ti/tideways-daemon/package.nix
+++ b/pkgs/by-name/ti/tideways-daemon/package.nix
@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.9.18";
+  version = "1.9.22";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-CFVHD2CfY1yOP621PzkflvapCrIuqY0rtTgm20xW41E=";
+        hash = "sha256-qB8R6BwL2dxLiNhR9/ZwMMXKQpKeF7ZtAiVHyyXU+5s=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-59quxF5rClfw8xd8mT2jU1/DVatrZyJw7Rj6pikKXF0=";
+        hash = "sha256-VXZmpX/60WqxwXrkJXMfQ/14X2hOXvSgG9qQBXBJkRo=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-4h7Vn9s8Y63M1BnzwjcxSV8ydRqhNeJnFvG9Cs1Cq8Q=";
+        hash = "sha256-3KaARUt8VnnVxf9fDgt7AcGxIgG78MkR9EEW5mJWxCE=";
       };
     };
     updateScript = "${
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index d15f21ed772b..4fbfd93db9af 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.10.0";
+  version = "24.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UOjR23VfOc65584JQtO+LF2Pp1JER8nIOA64hRnd5UA=";
+    hash = "sha256-s67701Wk+UDRoSCQWC58k54eF/dcCcqn41SijOz6cbQ=";
   };
 
   pythonRelaxDeps = [ "validators" ];
diff --git a/pkgs/by-name/tu/tuxguitar/package.nix b/pkgs/by-name/tu/tuxguitar/package.nix
index e8df3929fc6f..a393c1a85d7c 100644
--- a/pkgs/by-name/tu/tuxguitar/package.nix
+++ b/pkgs/by-name/tu/tuxguitar/package.nix
@@ -10,6 +10,8 @@
   fluidsynth,
   libpulseaudio,
   lilv,
+  which,
+  wrapGAppsHook3,
   nixosTests,
 }:
 
@@ -24,8 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeWrapper
+    wrapGAppsHook3
   ];
 
+  dontWrapGApps = true;
+
   installPhase = ''
     mkdir -p $out/bin
     cp -r dist lib share $out/
@@ -34,9 +39,17 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/dist $out/bin/dist
     ln -s $out/lib $out/bin/lib
     ln -s $out/share $out/bin/share
+  '';
 
+  postFixup = ''
     wrapProgram $out/bin/tuxguitar \
-      --set JAVA "${jre}/bin/java" \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          jre
+          which
+        ]
+      } \
       --prefix LD_LIBRARY_PATH : "$out/lib/:${
         lib.makeLibraryPath [
           swt
diff --git a/pkgs/by-name/wa/walker/package.nix b/pkgs/by-name/wa/walker/package.nix
index 484de327b45e..c6a416788e50 100644
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "walker";
-  version = "0.8.12";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${version}";
-    hash = "sha256-K65bzaUcTBqsqngxbxwEEsTVZA2s8lX6+HEhu03Nywk=";
+    hash = "sha256-nYC6KoLsmMf6uJ74Y2zvDU5wdgeOU9aZb/4zGlnWOJM=";
   };
 
   vendorHash = "sha256-nc/WKBhUxhs1aNUg/GM7vhrKd7FrUdl2uKp7MX2VCdE=";
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index 312ae182466c..ebd4bffa33fa 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -2,13 +2,13 @@
 
 buildGo123Module rec {
   pname = "webdav";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     rev = "v${version}";
-    sha256 = "sha256-a1XAlmEW8gNTgVZiJ200CP/wvbwvyv4Lc3L6KP/4Mik=";
+    sha256 = "sha256-ASc+ioVBpCFESEryI0EwKYZln1JzPCOKLJJWmh7L8oA=";
   };
 
   vendorHash = "sha256-d8WauJ1i429dr79iHgrbFRZCmx+W6OobSINy8aNGG6w=";
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index c3149189b538..884089079e1d 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -17,13 +17,13 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2024.11.4";
+  version = "2024.11.18";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "yt_dlp";
-    hash = "sha256-7SBMG2G8Vj4TREd2bRqzQxc1QHmeE+u5U+iHzn3PaGU=";
+    hash = "sha256-uKTCPTya/X5Ha824fzi2wOjhLjojnXmI8TrLQ0IA9U0=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 798f7302ea66..3e30acbd820f 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -49,23 +49,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.2.5.41699";
-  versions.x86_64-darwin = "6.2.5.41699";
-  versions.x86_64-linux = "6.2.5.2440";
+  versions.aarch64-darwin = "6.2.10.43047";
+  versions.x86_64-darwin = "6.2.10.43047";
+  versions.x86_64-linux = "6.2.10.4983";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-GD3WS4O8Xg2EKYS+CirXWHVjNkn3tQ6Ee5u15x218yA=";
+      hash = "sha256-i6ZO6Gp0PL200oklp7NJ56jGKF/nvuo54EazyfBU0Eo=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-8yEkB7hpvat33VCxuScsLD+zPKvqeTfK4Wx0vjyA9yY=";
+      hash = "sha256-lqmRjIre20VG9gkd7ISosABwYdLaHQDnSPYFKJZKh4Q=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-h+kt+Im0xv1zoLTvE+Ac9sfw1VyoAnvqFThf5/MwjHU=";
+      hash = "sha256-lPUKxkXI3yB/fCY05kQSJhTGSsU6v+t8nq5H6FLwhrk=";
     };
   };
 
diff --git a/pkgs/development/php-packages/tideways/default.nix b/pkgs/development/php-packages/tideways/default.nix
index 6649d0194710..41f764062555 100644
--- a/pkgs/development/php-packages/tideways/default.nix
+++ b/pkgs/development/php-packages/tideways/default.nix
@@ -23,7 +23,7 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-php";
   extensionName = "tideways";
-  version = "5.13.0";
+  version = "5.14.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -43,15 +43,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-x86_64.tar.gz";
-        hash = "sha256-HiH7EjAOqHIYaIRlp/cemhU+QX9Q66ZX8RpX1qcctZ0=";
+        hash = "sha256-jhTlHkdBqnI+HmEPbawpI0z3tIHUJdTwutLsmA5uBsw=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-arm64.tar.gz";
-        hash = "sha256-kntNr8KMrOBK2ZZT/EMTR7MCuRt3rJAqhpt5B0m5qVM=";
+        hash = "sha256-HkYyie3FUIvRwFZ2H/0BuHB+tqrSWSGZYTIAa5HtO6s=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-macos-arm.tar.gz";
-        hash = "sha256-zNVBTXKwCRLKmDlEUUUpP7feB/n2fMevEuKZrgdyAkw=";
+        hash = "sha256-qspHSImQHRVPjcSjeARFBdNgYPD3mOoqktA08X8jGqg=";
       };
     };
 
diff --git a/pkgs/development/python-modules/aemet-opendata/default.nix b/pkgs/development/python-modules/aemet-opendata/default.nix
index d356e78976a0..f720809863ab 100644
--- a/pkgs/development/python-modules/aemet-opendata/default.nix
+++ b/pkgs/development/python-modules/aemet-opendata/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aemet-opendata";
-  version = "0.5.4";
+  version = "0.5.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "AEMET-OpenData";
     rev = "refs/tags/${version}";
-    hash = "sha256-iy1ptkxc4dh/fwWSi/GgPX5KRulyG0zwWTbCNBirsCo=";
+    hash = "sha256-RX2FnXUALE4l5RG+L6KUBR57IlhRUSOxNc9JQMDDgvw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aio-pika/default.nix b/pkgs/development/python-modules/aio-pika/default.nix
index 0b00a8130dae..95759d541fb8 100644
--- a/pkgs/development/python-modules/aio-pika/default.nix
+++ b/pkgs/development/python-modules/aio-pika/default.nix
@@ -4,6 +4,7 @@
   aiormq,
   buildPythonPackage,
   docker,
+  exceptiongroup,
   fetchFromGitHub,
   pamqp,
   poetry-core,
@@ -17,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aio-pika";
-  version = "9.4.3";
+  version = "9.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,13 +27,14 @@ buildPythonPackage rec {
     owner = "mosquito";
     repo = "aio-pika";
     rev = "refs/tags/${version}";
-    hash = "sha256-lzBBcfWzhdT2v9RX5C+VWWSxsBCB7EOeCjm6wUrXGtA=";
+    hash = "sha256-4MweCuZbo/XDur9iwM3MT/P75HjEQvMlPI82bDxuol8=";
   };
 
   build-system = [ poetry-core ];
 
   dependencies = [
     aiormq
+    exceptiongroup
     yarl
   ];
 
diff --git a/pkgs/development/python-modules/aioairq/default.nix b/pkgs/development/python-modules/aioairq/default.nix
index 274b25202a3a..99fddd49b095 100644
--- a/pkgs/development/python-modules/aioairq/default.nix
+++ b/pkgs/development/python-modules/aioairq/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioairq";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "CorantGmbH";
     repo = "aioairq";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ppjhGBAoA5iV+ZfUKkUCNJRYN82JtclRe36pbe85i5w=";
+    hash = "sha256-Bgzwu/9Eu3Miw0eFb0b9jbD8yuPcBlJFnVyom+CsZBE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index 21d831c9e24e..6614f076706e 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.9.5";
+  version = "0.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone";
     rev = "refs/tags/${version}";
-    hash = "sha256-LFMHueSz0ddZNYUL0uuC91dw1ppYcdE/EjKX0ikc+J0=";
+    hash = "sha256-ZD/lJwYiggE7fUVGjimgGQ+H8zCtOZrZRElc0crrKhw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index c34ff9464cd3..4e15614ea378 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.14.0";
+  version = "3.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SEq88e5MLNqssJhxPPwI2ZdpNdTCBomNpI0xmbmz3Pw=";
+    hash = "sha256-heCebvYP1rrExuD7tAMwSsBsds0cbsPvzHLUtBjNwW0=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/aiostream/default.nix b/pkgs/development/python-modules/aiostream/default.nix
index 701278b299c8..184f889bd209 100644
--- a/pkgs/development/python-modules/aiostream/default.nix
+++ b/pkgs/development/python-modules/aiostream/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiostream";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "vxgmichel";
     repo = "aiostream";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MssA4gDo79mlHjVwQAxhX6DZPHB4Quo6V05Nye91oJg=";
+    hash = "sha256-hRbPK1JsB/JQuSjj81YMUAI8eDUyXCOFhdW22ZJ47xU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix
index 126661bc1e17..eae29bbcf565 100644
--- a/pkgs/development/python-modules/aiovlc/default.nix
+++ b/pkgs/development/python-modules/aiovlc/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiovlc";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiovlc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NnctcSgEHWEJUB0yDrSYMochh20CfT5jgtcALKmDjdo=";
+    hash = "sha256-tvMd7kydL4fx9JLTFQgCskBQCV0Zs/swDpPBxtSEvyM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/asdf-astropy/default.nix b/pkgs/development/python-modules/asdf-astropy/default.nix
index a883fc87af81..adf443d35961 100644
--- a/pkgs/development/python-modules/asdf-astropy/default.nix
+++ b/pkgs/development/python-modules/asdf-astropy/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "asdf-astropy";
-  version = "0.6.1";
+  version = "0.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "astropy";
     repo = "asdf-astropy";
     rev = "refs/tags/${version}";
-    hash = "sha256-dOd9QdBOu7QotRiHkXJoIqaHG6U9odTlRmy22/nvvuw=";
+    hash = "sha256-xtDpKlAExMTYNopS9cAhLU2ZnHhtHHaV3KjWCq0yapE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index 9f148a4beabe..d3dcee1b16e4 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "coffea";
-  version = "2024.10.0";
+  version = "2024.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CoffeaTeam";
     repo = "coffea";
     rev = "refs/tags/v${version}";
-    hash = "sha256-n17L/IuJGjDdYhVxW7Q0Qgeg+Y+pz9GphUxpLY4vXDM=";
+    hash = "sha256-QE+la7CB2xrbbIOUL/HtKRHUOGu19IyfDvjL6oucn7g=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index 703a139ed7ff..39ac0c9ec165 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.0.0";
+  version = "3.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aTFas+3+veky+pyz2T1SytMNGwxlF9dAc3E03PKqvrM=";
+    hash = "sha256-oMsskBM0SV1OBxy3/6di1rKcOoV0qGisDyjKHNv72Go=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-filer/default.nix b/pkgs/development/python-modules/django-filer/default.nix
index e87125cd9514..5d4b7395906f 100644
--- a/pkgs/development/python-modules/django-filer/default.nix
+++ b/pkgs/development/python-modules/django-filer/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "django-filer";
-  version = "3.2.3";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "django-cms";
     repo = "django-filer";
     rev = "refs/tags/${version}";
-    hash = "sha256-PoUBnfNymighCsGoJE+iu31lxA9wqVXimFPCytQtPLg=";
+    hash = "sha256-qtvPd0TlFNoxNgzXiRWOOmViouDq0vtVBFGWK4XrIFE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-tastypie/default.nix b/pkgs/development/python-modules/django-tastypie/default.nix
index 1ed2dbc4fe6b..d422a683f81b 100644
--- a/pkgs/development/python-modules/django-tastypie/default.nix
+++ b/pkgs/development/python-modules/django-tastypie/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-tastypie";
-  version = "0.14.7";
+  version = "0.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "django-tastypie";
     repo = "django-tastypie";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bQBq5Wk5P9c+/a5B+LnxG8aCrVK1A3jLsLFK69/UYjo=";
+    hash = "sha256-StXWqwGVILXtK53fa2vSNXSIf7UGfdn7iJyOIzdnth4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dnfile/default.nix b/pkgs/development/python-modules/dnfile/default.nix
index e9bff0525de3..1802b005437f 100644
--- a/pkgs/development/python-modules/dnfile/default.nix
+++ b/pkgs/development/python-modules/dnfile/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dnfile";
-  version = "0.15.0";
+  version = "0.15.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "malwarefrank";
     repo = "dnfile";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HzlMJ4utBHyLLhO+u0uiTfqtk8jX80pEyO75QvpJ3yg=";
+    hash = "sha256-AdGXcdoBNWZ4f8NBP50Fp3in1FTVPFDifGhjeAfp46M=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/elmax-api/default.nix b/pkgs/development/python-modules/elmax-api/default.nix
index 27b168986339..8d86b44706c4 100644
--- a/pkgs/development/python-modules/elmax-api/default.nix
+++ b/pkgs/development/python-modules/elmax-api/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "elmax-api";
-  version = "0.0.5";
+  version = "0.0.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "albertogeniola";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-57pmmH7f893H71CMhdnahvbN/5F2yfrVZ6MFpYQ4+mQ=";
+    hash = "sha256-KMszoyeAIUyHCAuSUuCgbMos7SrQXncz38WqyPblJuE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/environs/default.nix b/pkgs/development/python-modules/environs/default.nix
index acbf0dc39467..aa325cb8e0b6 100644
--- a/pkgs/development/python-modules/environs/default.nix
+++ b/pkgs/development/python-modules/environs/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "environs";
-  version = "11.1.0";
+  version = "11.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "sloria";
     repo = "environs";
     rev = "refs/tags/${version}";
-    hash = "sha256-LL1lNNIJBd4MaU41xKYUu/I8dOd3lpmFmnv8/7lJAu4=";
+    hash = "sha256-BU2D9NGNoUu3F1kx9t4j1VW0HarLVqiXTZEW67pMPV8=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/flask-allowed-hosts/default.nix b/pkgs/development/python-modules/flask-allowed-hosts/default.nix
new file mode 100644
index 000000000000..0d50d9fda344
--- /dev/null
+++ b/pkgs/development/python-modules/flask-allowed-hosts/default.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  flask,
+}:
+
+buildPythonPackage rec {
+  pname = "flask-allowed-hosts";
+  version = "1.1.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "flask_allowed_hosts";
+    hash = "sha256-l25bZlJkOVI+S+HtAK22ZGULP95evx2NASA9ViIax7Q=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ flask ];
+
+  pythonImportsCheck = [ "flask_allowed_hosts" ];
+
+  meta = with lib; {
+    description = "Flask extension that helps you limit access to your API endpoints";
+    homepage = "https://github.com/riad-azz/flask-allowedhosts";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erictapen ];
+  };
+}
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index f301901ef5f7..66d5f8f3fa2c 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pyjwt,
   pytestCheckHook,
   python-dateutil,
@@ -14,15 +14,16 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.21.0";
+  version = "3.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    pname = "ibm_cloud_sdk_core";
-    inherit version;
-    hash = "sha256-G3LvZ13f/aJbCMQ7hLi25U0rXiGvHhvT6FB6LSVxpUQ=";
+  src = fetchFromGitHub {
+    owner = "IBM";
+    repo = "python-sdk-core";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gNEd79kOtDlFJg3Ji9kO6VGGsy/VGxd6GzC/cuen9M0=";
   };
 
   pythonRelaxDeps = [ "requests" ];
@@ -56,6 +57,8 @@ buildPythonPackage rec {
       "test_retry_config_external"
       # assertion error due to requests brotli support
       "test_http_client"
+      # Tests require network access
+      "test_tls_v1_2"
     ]
     ++ lib.optionals (pythonAtLeast "3.12") [
       # Tests are blocking or failing
diff --git a/pkgs/development/python-modules/language-data/default.nix b/pkgs/development/python-modules/language-data/default.nix
index da1a35456152..b83ba0168248 100644
--- a/pkgs/development/python-modules/language-data/default.nix
+++ b/pkgs/development/python-modules/language-data/default.nix
@@ -9,16 +9,16 @@
 
 buildPythonPackage rec {
   pname = "language-data";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "georgkrause";
     repo = "language_data";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TVWyDEDI6NBioc8DqhXzpLS22EFKsZ/nan2vfgFsieQ=";
+    hash = "sha256-qHPie07GtVPKP/PFlP72XVVrl6j+5A8fIO729aPRsrc=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/msgraph-core/default.nix b/pkgs/development/python-modules/msgraph-core/default.nix
index 717c03e50ea6..5707a8906251 100644
--- a/pkgs/development/python-modules/msgraph-core/default.nix
+++ b/pkgs/development/python-modules/msgraph-core/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-core";
-  version = "1.1.6";
+  version = "1.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-W1tttt4jWGftW8zzklHV3SrAyugi6XZv0PYGs3T5gZ4=";
+    hash = "sha256-ADeUlxaDoekKMCE+CJL8biuhijdDqQn0s52yvGi3XCE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index e960018bd61a..67e7c4ed5978 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.51.0";
+  version = "0.53.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-Ti+3f6UGn/A9MdLJVUT9hnAiS8Ce6D8FrSryrGxMV6s=";
+    hash = "sha256-V0oTx2uRz58t5IN2atXVlyLvMg1zavzSbd+2NNEQ6V0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytouchlinesl/default.nix b/pkgs/development/python-modules/pytouchlinesl/default.nix
index 845b734fc59c..7ff2a0da211a 100644
--- a/pkgs/development/python-modules/pytouchlinesl/default.nix
+++ b/pkgs/development/python-modules/pytouchlinesl/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytouchlinesl";
-  version = "0.1.8";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jnsgruk";
     repo = "pytouchlinesl";
     rev = "refs/tags/${version}";
-    hash = "sha256-BSffzy/MKmpPdvk55Ff76i+p4/cY0OHjS/NOc9tEGwo=";
+    hash = "sha256-j/DEzYFopS/wolcycYP70hETT+8Pg/+9vDPYmLcd740=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ee82c16220db..b894bd1c1bf9 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1267";
+  version = "3.0.1268";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-aX9ulyCodTPf/6YhhL0Gf77PbqJEenEyKu/0zhNWgf0=";
+    hash = "sha256-668fJLHnxle3eOQf62D1lbVJnP/ukoBSiENrkxQB9oU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/thinqconnect/default.nix b/pkgs/development/python-modules/thinqconnect/default.nix
index 657eac221a47..e47ca0287792 100644
--- a/pkgs/development/python-modules/thinqconnect/default.nix
+++ b/pkgs/development/python-modules/thinqconnect/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "thinqconnect";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "thinq-connect";
     repo = "pythinqconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-8TDpoV2FNWzcHwXaEDyt5mRCbmFdtfuIYJK7OqXAgvg=";
+    hash = "sha256-kKmC2RMxJpNIX8bhHlPnFwP+0l7+MC+mWlCRjACy4cg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tololib/default.nix b/pkgs/development/python-modules/tololib/default.nix
index 9548f2d77657..9344f14dd0e8 100644
--- a/pkgs/development/python-modules/tololib/default.nix
+++ b/pkgs/development/python-modules/tololib/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tololib";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "MatthiasLohr";
     repo = "tololib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TxWKV2nrnCxZmj6+wBDMSdJRvKV+MsPFbOyIlUJYJ3Q=";
+    hash = "sha256-CVibq5dgjjXW4Fxs3doBmUyXMMbtGfN9fLgNtuTqqiA=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/types-deprecated/default.nix b/pkgs/development/python-modules/types-deprecated/default.nix
index 13b371b4e3fe..3d26a47ee404 100644
--- a/pkgs/development/python-modules/types-deprecated/default.nix
+++ b/pkgs/development/python-modules/types-deprecated/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "types-deprecated";
-  version = "1.2.9.20240311";
+  version = "1.2.15.20241117";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types-Deprecated";
     inherit version;
-    hash = "sha256-BoDomYmoFCcH3oED8V0YJEWlM8EEf9m36MVFkQHpuQo=";
+    hash = "sha256-kkACyLf93sUbpJSXiKcCQRouNjbNmyozq9juEZcB134=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-docopt/default.nix b/pkgs/development/python-modules/types-docopt/default.nix
index 284fa0ea0fcc..3825b907c0cc 100644
--- a/pkgs/development/python-modules/types-docopt/default.nix
+++ b/pkgs/development/python-modules/types-docopt/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-docopt";
-  version = "0.6.11.4";
+  version = "0.6.11.20241107";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mRpkwVaTEMIkCuc0/SwQYnq7ikr6875axvTv+aYB8xo=";
+    hash = "sha256-YcRNA6xIlbW+jUC6XMgM5Spj09dnd60UZp6Utent96c=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/ufmt/default.nix b/pkgs/development/python-modules/ufmt/default.nix
index e18b8062f1ff..97e4106c804b 100644
--- a/pkgs/development/python-modules/ufmt/default.nix
+++ b/pkgs/development/python-modules/ufmt/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "ufmt";
-  version = "2.7.3";
+  version = "2.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "omnilib";
     repo = "ufmt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hXCOsetw5o3V9NCR0TOfYSFyfBnuOOZDMiUd/6ER9WU=";
+    hash = "sha256-oEvvXUju7qne3pCwnrckplMs0kBJavB669qieXJZPKw=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/os-specific/darwin/duti/default.nix b/pkgs/os-specific/darwin/duti/default.nix
index 033591c1fec3..87af500e98e4 100644
--- a/pkgs/os-specific/darwin/duti/default.nix
+++ b/pkgs/os-specific/darwin/duti/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
       a Microsoft Word document has a UTI of com.microsoft.word.doc. Using duti, the
       user can change which application acts as the default handler for a given UTI.
     '';
-    maintainers = with maintainers; [matthewbauer];
+    maintainers = with maintainers; [matthewbauer n-hass];
     platforms = platforms.darwin;
     license = licenses.publicDomain;
     homepage = "https://github.com/moretension/duti/";
diff --git a/pkgs/by-name/op/opentelemetry-collector-builder/package.nix b/pkgs/tools/misc/opentelemetry-collector/builder.nix
similarity index 80%
rename from pkgs/by-name/op/opentelemetry-collector-builder/package.nix
rename to pkgs/tools/misc/opentelemetry-collector/builder.nix
index caf5439ca6ee..1a9eb128bcf7 100644
--- a/pkgs/by-name/op/opentelemetry-collector-builder/package.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/builder.nix
@@ -5,17 +5,19 @@
 }:
 buildGoModule rec {
   pname = "ocb";
-  version = "0.112.0";
+  # Also update `pkgs/tools/misc/opentelemetry-collector/releases.nix`
+  # whenever that version changes.
+  version = "0.114.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "cmd/builder/v${version}";
-    hash = "sha256-0eL9J+PrURiNkL6CzUIlcvjyZor8iS9vKX8j0srLlZ8=";
+    hash = "sha256-zy+TWjh7janUhpxO9fOC8C9vz/tI0mbAyEsCo9zZ1j4=";
   };
 
   sourceRoot = "${src.name}/cmd/builder";
-  vendorHash = "sha256-vZsGSLdzKa4sA/N3RG6Kwn8tMoIIhPJ6uAkM4pheitU=";
+  vendorHash = "sha256-dLNs9Vgn6f10hl5XuPzzE4eFNfvELWSKGsd7FbSiHkU=";
 
   CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
deleted file mode 100644
index 219f7b81c5f3..000000000000
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ buildGoModule
-, fetchFromGitHub
-, lib
-, stdenv
-, systemdMinimal
-, withSystemd ? false
-}:
-
-buildGoModule rec {
-  pname = "opentelemetry-collector-contrib";
-  version = "0.110.0";
-
-  src = fetchFromGitHub {
-    owner = "open-telemetry";
-    repo = "opentelemetry-collector-contrib";
-    rev = "v${version}";
-    hash = "sha256-bDtP7EFKus0NJpLccbD+HlzEusc+KAbKWmS/KGthtwY=";
-  };
-
-  # proxy vendor to avoid hash mismatches between linux and macOS
-  proxyVendor = true;
-  vendorHash = "sha256-pDDEqtXu167b+J1+k7rC1BE5/ehxzG0ZAkhxqmJpHsg=";
-
-  # there is a nested go.mod
-  sourceRoot = "${src.name}/cmd/otelcontribcol";
-
-  # upstream strongly recommends disabling CGO
-  # additionally dependencies have had issues when GCO was enabled that weren't caught upstream
-  # https://github.com/open-telemetry/opentelemetry-collector/blob/main/CONTRIBUTING.md#using-cgo
-  CGO_ENABLED = 0;
-
-  # journalctl is required in-$PATH for the journald receiver tests.
-  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ systemdMinimal ];
-
-  # We don't inject the package into propagatedBuildInputs unless
-  # asked to avoid hard-requiring a large package. For the journald
-  # receiver to work, journalctl will need to be available in-$PATH,
-  # so expose this as an option for those who want more control over
-  # it instead of trusting the global $PATH.
-  propagatedBuildInputs = lib.optionals withSystemd [ systemdMinimal ];
-
-  doCheck = false;
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/open-telemetry/opentelemetry-collector-contrib/internal/version.Version=v${version}"
-  ];
-
-  meta = with lib; {
-    description = "OpenTelemetry Collector superset with additional community collectors";
-    longDescription = ''
-      The OpenTelemetry Collector offers a vendor-agnostic implementation on how
-      to receive, process and export telemetry data. In addition, it removes the
-      need to run, operate and maintain multiple agents/collectors in order to
-      support open-source telemetry data formats (e.g. Jaeger, Prometheus, etc.)
-      sending to multiple open-source or commercial back-ends. The Contrib
-      edition provides aditional vendor specific receivers/exporters and/or
-      components that are only useful to a relatively small number of users and
-      is multiple times larger as a result.
-    '';
-    homepage = "https://github.com/open-telemetry/opentelemetry-collector-contrib";
-    changelog = "https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ uri-canva jk ];
-    mainProgram = "otelcontribcol";
-  };
-}
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
deleted file mode 100644
index f437590936e2..000000000000
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, testers
-, nixosTests
-, opentelemetry-collector
-}:
-
-buildGoModule rec {
-  pname = "opentelemetry-collector";
-  version = "0.109.0";
-
-  src = fetchFromGitHub {
-    owner = "open-telemetry";
-    repo = "opentelemetry-collector";
-    rev = "v${version}";
-    hash = "sha256-ShVUBohSnIoeq2aTWJ9IMXKt0CeRv3CZjlqpYHR9DhY=";
-  };
-  # there is a nested go.mod
-  sourceRoot = "${src.name}/cmd/otelcorecol";
-  vendorHash = "sha256-rXC4lm2ZvO3k6h1ZiYB+FskhW0c2uJyPLZg6n125MZE=";
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  # upstream strongly recommends disabling CGO
-  # additionally dependencies have had issues when GCO was enabled that weren't caught upstream
-  # https://github.com/open-telemetry/opentelemetry-collector/blob/main/CONTRIBUTING.md#using-cgo
-  CGO_ENABLED = 0;
-
-  preBuild = ''
-    # set the build version, can't be done via ldflags
-    sed -i -E 's/Version:(\s*)".*"/Version:\1"${version}"/' main.go
-  '';
-
-  ldflags = [ "-s" "-w" ];
-
-  postInstall = ''
-    installShellCompletion --cmd otelcorecol \
-      --bash <($out/bin/otelcorecol completion bash) \
-      --fish <($out/bin/otelcorecol completion fish) \
-      --zsh <($out/bin/otelcorecol completion zsh)
-  '';
-
-  passthru.tests = {
-    version = testers.testVersion {
-      inherit version;
-      package = opentelemetry-collector;
-      command = "otelcorecol -v";
-    };
-    inherit (nixosTests) opentelemetry-collector;
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/open-telemetry/opentelemetry-collector";
-    changelog = "https://github.com/open-telemetry/opentelemetry-collector/blob/v${version}/CHANGELOG.md";
-    description = "Vendor-agnostic implementation on how to receive, process and export telemetry data";
-    longDescription = ''
-      The OpenTelemetry Collector offers a vendor-agnostic implementation on how
-      to receive, process and export telemetry data. In addition, it removes the
-      need to run, operate and maintain multiple agents/collectors in order to
-      support open-source telemetry data formats (e.g. Jaeger, Prometheus, etc.)
-      sending to multiple open-source or commercial back-ends.
-    '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ uri-canva jk ];
-    mainProgram = "otelcorecol";
-  };
-}
diff --git a/pkgs/tools/misc/opentelemetry-collector/releases.nix b/pkgs/tools/misc/opentelemetry-collector/releases.nix
new file mode 100644
index 000000000000..508fe54693ed
--- /dev/null
+++ b/pkgs/tools/misc/opentelemetry-collector/releases.nix
@@ -0,0 +1,172 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  nixosTests,
+  opentelemetry-collector-builder,
+  pkgs,
+  go,
+  git,
+  cacert,
+  stdenv,
+}:
+let
+  # This is the tool OTEL uses to build their distributions.
+  builder = "${opentelemetry-collector-builder}/bin/ocb";
+
+  # Keep the version in sync with the builder.
+  rev = opentelemetry-collector-builder.src.rev;
+
+  version = lib.removePrefix "cmd/builder/v" rev;
+
+  # This is a weird meta-repo where all the open-telemetry collectors are.
+  src = fetchFromGitHub {
+    owner = "open-telemetry";
+    repo = "opentelemetry-collector-releases";
+    rev = "v${version}";
+    hash = "sha256-wHi3/rby/AA37x3BCbTXlLgRaN4DpATLSXpQb31Jr/o=";
+  };
+
+  # Then from this src, we use the tool to generate some go code, including
+  # the go.mod and go.sum files.
+  #
+  # The output depends on which release.
+  mkDistributionSource =
+    {
+      name,
+      hash,
+    }:
+    stdenv.mkDerivation {
+      inherit name;
+
+      nativeBuildInputs = [
+        cacert
+        git
+        go
+      ];
+
+      inherit src;
+
+      outputHash = hash;
+      outputHashMode = "recursive";
+      outputHashAlgo = if hash == "" then "sha256" else null;
+
+      patchPhase = ''
+        patchShebangs .
+      '';
+
+      configurePhase = ''
+        export HOME=$NIX_BUILD_TOP/home
+        export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
+      '';
+
+      buildPhase = ''
+        # Only generate the go code, skip compilation
+        ./scripts/build.sh -d ${name} -b ${builder} -s true
+      '';
+
+      installPhase = ''
+        mv ./distributions/${name}/_build $out
+
+        # Make it reproducible
+        rm $out/build.log
+      '';
+    };
+
+  # Then, finally, we build the project as a normal go module package.
+  mkDistribution =
+    {
+      name,
+      sourceHash,
+      vendorHash,
+    }:
+    let
+      package = buildGoModule {
+        pname = name;
+        inherit version;
+
+        src = mkDistributionSource {
+          inherit name;
+          hash = sourceHash;
+        };
+
+        inherit vendorHash;
+
+        nativeBuildInputs = [ installShellFiles ];
+
+        # upstream strongly recommends disabling CGO
+        # additionally dependencies have had issues when GCO was enabled that weren't caught upstream
+        # https://github.com/open-telemetry/opentelemetry-collector/blob/main/CONTRIBUTING.md#using-cgo
+        CGO_ENABLED = 0;
+
+        ldflags = [
+          "-s"
+          "-w"
+        ];
+
+        postInstall = ''
+          # Fix binary name
+          mv $out/bin/* $out/bin/$pname
+
+          installShellCompletion --cmd ${name} \
+            --bash <($out/bin/${name} completion bash) \
+            --fish <($out/bin/${name} completion fish) \
+            --zsh <($out/bin/${name} completion zsh)
+        '';
+
+        passthru.tests = {
+          version = testers.testVersion {
+            inherit package version;
+            command = "${name} -v";
+          };
+        };
+
+        meta = with lib; {
+          homepage = "https://github.com/open-telemetry/opentelemetry-collector-releases";
+          description = "OpenTelemetry Collector Official Releases";
+          longDescription = ''
+            The OpenTelemetry Collector offers a vendor-agnostic implementation on how
+            to receive, process and export telemetry data. In addition, it removes the
+            need to run, operate and maintain multiple agents/collectors in order to
+            support open-source telemetry data formats (e.g. Jaeger, Prometheus, etc.)
+            sending to multiple open-source or commercial back-ends.
+          '';
+          license = licenses.asl20;
+          maintainers = with maintainers; [
+            uri-canva
+            jk
+            zimbatm
+          ];
+          mainProgram = name;
+        };
+      };
+    in
+    package;
+in
+lib.recurseIntoAttrs {
+  otelcol = mkDistribution {
+    name = "otelcol";
+    sourceHash = "sha256-EGO5ns2Xi0g8PvPGdzMVxMJcPXvxaZDDi4YaJnIUAFc=";
+    vendorHash = "sha256-dCSOGT0n0I5Oxw30uNeg184Me7hwZUfDuvl1IOdVBeo=";
+  };
+
+  otelcol-contrib = mkDistribution {
+    name = "otelcol-contrib";
+    sourceHash = "sha256-1TIzfR9F6iwSwoDc08SdOWYH378Y3qjwOcQ4IDbHTWE=";
+    vendorHash = "sha256-KObLO3bXqGL1WSTKbJjg+hYJ9sYU4rn9gC/o38U1XJI=";
+  };
+
+  otelcol-k8s = mkDistribution {
+    name = "otelcol-k8s";
+    sourceHash = "sha256-WffBw41dZ/e5/d22ny6611pFReUVeO5lmtqqfaSdGLs=";
+    vendorHash = "sha256-3EVJxma9U7FTzt1jIxotavMespFpCpU/oAAKMC0ya2E=";
+  };
+
+  otelcol-otlp = mkDistribution {
+    name = "otelcol-otlp";
+    sourceHash = "sha256-YQ9dIY9MdX0WtuOnFCZapDDWSl02S/dlTNce6RV48MM=";
+    vendorHash = "sha256-4wiIgYa9eHvGxDgLbqWPTus9zBznYJ4lpsIUvRjRYUQ=";
+  };
+}
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 8e5a0cff74a9..d0a3624b46bb 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.30.0";
+  version = "11.31.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1d04jYnVrbtxVYOJiUYZzNCwJJXZ2O1Bendxj692Sc8=";
+    hash = "sha256-xdnyW9nZSQrTSA6B2dFcKanNVJRcZXgpxLJHsLsL6LQ=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-Sd3uN+rny3J0Z/SIMKR0HEsq21B5ZqcjxrUgqS95FaU=";
+  vendorHash = "sha256-9/N76JWnzR6/k2yeLR49hpxNfKHgrV7lXVb9pnV/tn8=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix b/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
index f31e89c9f4ef..7e7e15ebf3aa 100644
--- a/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGhidraExtension rec {
   pname = "lightkeeper";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "WorksButNotTested";
     repo = "lightkeeper";
     rev = version;
-    hash = "sha256-Emyo4GBrR725jDxRsStC6/4F9mYnRo3S3QY0GeB/BvI=";
+    hash = "sha256-4lj60OyVcam4JHyfIa+4auzITuEYqjz9wOQko/u+2dI=";
   };
   preConfigure = ''
     cd lightkeeper
diff --git a/pkgs/tools/system/nvtop/build-nvtop.nix b/pkgs/tools/system/nvtop/build-nvtop.nix
index f1f855b25383..953565150765 100644
--- a/pkgs/tools/system/nvtop/build-nvtop.nix
+++ b/pkgs/tools/system/nvtop/build-nvtop.nix
@@ -1,29 +1,37 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, gtest
-, cudatoolkit
-, libdrm
-, ncurses
-, testers
-, udev
-, addDriverRunpath
-, amd ? false
-, intel ? false
-, msm ? false
-, nvidia ? false
-, apple ? false
-, panfrost ? false
-, panthor ? false
-, ascend ? false
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gtest,
+  cudatoolkit,
+  libdrm,
+  ncurses,
+  testers,
+  udev,
+  apple-sdk_12,
+  addDriverRunpath,
+  amd ? false,
+  intel ? false,
+  msm ? false,
+  nvidia ? false,
+  apple ? false,
+  panfrost ? false,
+  panthor ? false,
+  ascend ? false,
 }:
 
 let
   drm-postFixup = ''
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${lib.makeLibraryPath [ libdrm ncurses udev ]}" \
+      --set-rpath "${
+        lib.makeLibraryPath [
+          libdrm
+          ncurses
+          udev
+        ]
+      }" \
       $out/bin/nvtop
   '';
   needDrm = (amd || msm || panfrost || panthor);
@@ -51,18 +59,25 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "PANTHOR_SUPPORT" panthor)
     (cmakeBool "ASCEND_SUPPORT" ascend)
   ];
-  nativeBuildInputs = [ cmake gtest ] ++ lib.optional nvidia addDriverRunpath;
+  nativeBuildInputs = [
+    cmake
+    gtest
+  ] ++ lib.optional nvidia addDriverRunpath;
 
-  buildInputs = [ ncurses udev ]
+  buildInputs =
+    [ ncurses ]
+    ++ lib.optional stdenv.isLinux udev
+    ++ lib.optional stdenv.isDarwin apple-sdk_12
     ++ lib.optional nvidia cudatoolkit
-    ++ lib.optional needDrm libdrm
-  ;
+    ++ lib.optional needDrm libdrm;
 
   # this helps cmake to find <drm.h>
   env.NIX_CFLAGS_COMPILE = lib.optionalString needDrm "-isystem ${lib.getDev libdrm}/include/libdrm";
 
   # ordering of fixups is important
-  postFixup = (lib.optionalString needDrm drm-postFixup) + (lib.optionalString nvidia "addDriverRunpath $out/bin/nvtop");
+  postFixup =
+    (lib.optionalString needDrm drm-postFixup)
+    + (lib.optionalString nvidia "addDriverRunpath $out/bin/nvtop");
 
   doCheck = true;
 
@@ -83,8 +98,13 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/Syllo/nvtop";
     changelog = "https://github.com/Syllo/nvtop/releases/tag/${finalAttrs.version}";
     license = licenses.gpl3Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ willibutz gbtb anthonyroussel ];
+    platforms = lib.optional (!apple) platforms.linux ++ lib.optional apple platforms.darwin;
+    maintainers = with maintainers; [
+      willibutz
+      gbtb
+      anthonyroussel
+      moni
+    ];
     mainProgram = "nvtop";
   };
 })
diff --git a/pkgs/tools/system/nvtop/default.nix b/pkgs/tools/system/nvtop/default.nix
index f6e679b6ffef..7e9653102bef 100644
--- a/pkgs/tools/system/nvtop/default.nix
+++ b/pkgs/tools/system/nvtop/default.nix
@@ -1,18 +1,36 @@
-{ callPackage }:
+{ callPackage, stdenv }:
 let
   # this GPU families are supported "by-default" upstream (see https://github.com/Syllo/nvtop/blob/3a69c2d060298cd6f92cb09db944eded98be1c23/CMakeLists.txt#L81)
   # coincidentally, these families are also easy to build in nixpkgs at the moment
-  defaultGPUFamilies = [ "amd" "intel" "msm" "nvidia" "panfrost" "panthor" ];
+  defaultGPUFamilies = [
+    "amd"
+    "apple"
+    "intel"
+    "msm"
+    "nvidia"
+    "panfrost"
+    "panthor"
+  ];
   # these GPU families are partially supported upstream, they are also tricky to build in nixpkgs
   # volunteers with specific hardware needed to build and test these package variants
-  additionalGPUFamilies = [ "apple" "ascend" ];
-  defaultSupport = builtins.listToAttrs (builtins.map (gpu: { name = gpu; value = true; }) defaultGPUFamilies);
+  additionalGPUFamilies = [ "ascend" ];
+  defaultSupport = builtins.listToAttrs (
+    # apple can only build on darwin, and it can't build everything else, and vice versa
+    builtins.map (gpu: {
+      name = gpu;
+      value =
+        (gpu == "apple" && stdenv.buildPlatform.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform)
+        || (gpu != "apple" && stdenv.buildPlatform.isLinux);
+    }) defaultGPUFamilies
+  );
 in
 {
-  full = callPackage ./build-nvtop.nix defaultSupport; #this package supports all default GPU families
+  full = callPackage ./build-nvtop.nix defaultSupport; # this package supports all default GPU families
 }
 # additional packages with only one specific GPU family support
-// builtins.listToAttrs (builtins.map (gpu: { name = gpu; value = (callPackage ./build-nvtop.nix { "${gpu}" = true; }); }) defaultGPUFamilies)
-
-
-
+// builtins.listToAttrs (
+  builtins.map (gpu: {
+    name = gpu;
+    value = (callPackage ./build-nvtop.nix { "${gpu}" = true; });
+  }) defaultGPUFamilies
+)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f7e5f290b52d..2714801933cc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4793,8 +4793,10 @@ with pkgs;
 
   update-systemd-resolved = callPackage ../tools/networking/openvpn/update-systemd-resolved.nix { };
 
-  opentelemetry-collector = callPackage ../tools/misc/opentelemetry-collector { };
-  opentelemetry-collector-contrib = callPackage ../tools/misc/opentelemetry-collector/contrib.nix { };
+  opentelemetry-collector = opentelemetry-collector-releases.otelcol;
+  opentelemetry-collector-builder = callPackage ../tools/misc/opentelemetry-collector/builder.nix { };
+  opentelemetry-collector-contrib = opentelemetry-collector-releases.otelcol-contrib;
+  opentelemetry-collector-releases = callPackage ../tools/misc/opentelemetry-collector/releases.nix { };
 
   openvswitch-dpdk = callPackage ../by-name/op/openvswitch/package.nix { withDPDK = true; };
 
@@ -10477,7 +10479,7 @@ with pkgs;
 
   nvidia-system-monitor-qt = libsForQt5.callPackage ../tools/system/nvidia-system-monitor-qt { };
 
-  nvtopPackages = recurseIntoAttrs (import ../tools/system/nvtop { inherit callPackage; });
+  nvtopPackages = recurseIntoAttrs (import ../tools/system/nvtop { inherit callPackage stdenv; });
 
   inherit (callPackages ../development/libraries/ogre { })
     ogre_13 ogre_14;
@@ -13518,10 +13520,6 @@ with pkgs;
 
   bluejeans-gui = callPackage ../applications/networking/instant-messengers/bluejeans { };
 
-  bottles = callPackage ../applications/misc/bottles/fhsenv.nix { };
-
-  bottles-unwrapped = callPackage ../applications/misc/bottles { };
-
   breezy = with python3Packages; toPythonApplication breezy;
 
   cage = callPackage ../applications/window-managers/cage {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bb36dca8cb49..b4213c581774 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4600,6 +4600,8 @@ self: super: with self; {
 
   flask-admin = callPackage ../development/python-modules/flask-admin { };
 
+  flask-allowed-hosts = callPackage ../development/python-modules/flask-allowed-hosts { };
+
   flask-api = callPackage ../development/python-modules/flask-api { };
 
   flask-appbuilder = callPackage ../development/python-modules/flask-appbuilder { };