diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 655e57df2829..0f14915b6b50 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -650,7 +650,7 @@ If you want your PR to get merged quickly and smoothly, it is in your best inter
 
 For the committer to judge your intention, it's best to explain why you've made your change.
 This does not apply to trivial changes like version updates because the intention is obvious (though linking the changelog is appreciated).
-For any more nuanced changed or even major version upgrades, it helps if you explain the background behind your change a bit.
+For any more nuanced changes or even major version upgrades, it helps if you explain the background behind your change a bit.
 E.g. if you're adding a package, explain what it is and why it should be in Nixpkgs.
 This goes hand in hand with [Writing good commit messages](#writing-good-commit-messages).
 
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index c4831db15b3e..dd360120b3c5 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -155,6 +155,8 @@
 
 - [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](option.html#opt-services.pds).
 
+- [synapse-auto-compressor](https://github.com/matrix-org/rust-synapse-compress-state?tab=readme-ov-file#automated-tool-synapse_auto_compressor), a rust-based matrix-synapse state compressor for postgresql. Available as [services.synapse-auto-compressor](#opt-services.synapse-auto-compressor.enable).
+
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
 
 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0be7e4c72f84..c498c1c61862 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -752,6 +752,7 @@
   ./services/matrix/mx-puppet-discord.nix
   ./services/matrix/pantalaimon.nix
   ./services/matrix/synapse.nix
+  ./services/matrix/synapse-auto-compressor.nix
   ./services/misc/airsonic.nix
   ./services/misc/amazon-ssm-agent.nix
   ./services/misc/ananicy.nix
diff --git a/nixos/modules/services/matrix/synapse-auto-compressor.nix b/nixos/modules/services/matrix/synapse-auto-compressor.nix
new file mode 100644
index 000000000000..ac749602af6a
--- /dev/null
+++ b/nixos/modules/services/matrix/synapse-auto-compressor.nix
@@ -0,0 +1,164 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.synapse-auto-compressor;
+  synapseConfig = config.services.matrix-synapse;
+  postgresEnabled = config.services.postgresql.enable;
+  synapseUsesPostgresql = synapseConfig.settings.database.name == "psycopg2";
+  synapseUsesLocalPostgresql =
+    let
+      args = synapseConfig.settings.database.args;
+    in
+    synapseUsesPostgresql
+    && postgresEnabled
+    && (
+      !(args ? host)
+      || (builtins.elem args.host [
+        "localhost"
+        "127.0.0.1"
+        "::1"
+      ])
+    );
+in
+{
+  options = {
+    services.synapse-auto-compressor = {
+      enable = lib.mkEnableOption "synapse-auto-compressor";
+      package = lib.mkPackageOption pkgs "rust-synapse-state-compress" { };
+      postgresUrl = lib.mkOption {
+        default =
+          let
+            args = synapseConfig.settings.database.args;
+          in
+          if synapseConfig.enable then
+            ''postgresql://${args.user}${lib.optionalString (args ? password) (":" + args.password)}@${
+              lib.escapeURL (if (args ? host) then args.host else "/run/postgresql")
+            }${lib.optionalString (args ? port) (":" + args.port)}/${args.database}''
+          else
+            null;
+        defaultText = lib.literalExpression ''
+          let
+            synapseConfig = config.services.matrix-synapse;
+            args = synapseConfig.settings.database.args;
+          in
+          if synapseConfig.enable then
+            '''postgresql://''${args.user}''${lib.optionalString (args ? password) (":" + args.password)}@''${
+              lib.escapeURL (if (args ? host) then args.host else "/run/postgresql")
+            }''${lib.optionalString (args ? port) (":" + args.port)}''${args.database}'''
+          else
+            null;
+        '';
+        type = lib.types.str;
+        example = "postgresql://username:password@mydomain.com:port/database";
+        description = ''
+          Connection string to postgresql in the
+          [rust `postgres` crate config format](https://docs.rs/postgres/latest/postgres/config/struct.Config.html).
+          The module will attempt to build a URL-style connection string out of the `services.matrix-synapse.settings.database.args`
+          if a local synapse is enabled.
+        '';
+      };
+      startAt = lib.mkOption {
+        default = "weekly";
+        type = with lib.types; either str (listOf str);
+        description = "How often to run this service in systemd calendar syntax (see {manpage}`systemd.time(7)`)";
+        example = "daily";
+      };
+
+      settings = {
+        chunk_size = lib.mkOption {
+          type = lib.types.int;
+          default = 500;
+          description = ''
+            The number of state groups to work on at once. All of the entries from `state_groups_state` are requested
+            from the database for state groups that are worked on. Therefore small chunk sizes may be needed on
+            machines with low memory.
+
+            Note: if the compressor fails to find space savings on the chunk as a whole
+            (which may well happen in rooms with lots of backfill in) then the entire chunk is skipped.
+          '';
+        };
+        chunks_to_compress = lib.mkOption {
+          type = lib.types.int;
+          default = 100;
+          description = ''
+            `chunks_to_compress` chunks of size `chunk_size` will be compressed. The higher this number is set to,
+            the longer the compressor will run for.
+          '';
+        };
+        levels = lib.mkOption {
+          type = with lib.types; listOf int;
+          default = [
+            100
+            50
+            25
+          ];
+          description = ''
+            Sizes of each new level in the compression algorithm, as a comma-separated list. The first entry in
+            the list is for the lowest, most granular level, with each subsequent entry being for the next highest
+            level. The number of entries in the list determines the number of levels that will be used. The sum of
+            the sizes of the levels affects the performance of fetching the state from the database, as the sum of
+            the sizes is the upper bound on the number of iterations needed to fetch a given set of state.
+          '';
+        };
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = synapseConfig.enable && synapseUsesPostgresql;
+        message = "`services.synapse-auto-compressor` requires local synapse to use postgresql as a database backend";
+      }
+    ];
+    systemd.services.synapse-auto-compressor = {
+      description = "synapse-auto-compressor";
+      requires = lib.optionals synapseUsesLocalPostgresql [
+        "postgresql.service"
+      ];
+      inherit (cfg) startAt;
+      serviceConfig = {
+        Type = "oneshot";
+        DynamicUser = true;
+        User = "matrix-synapse";
+        PrivateTmp = true;
+        ExecStart = utils.escapeSystemdExecArgs [
+          "${cfg.package}/bin/synapse_auto_compressor"
+          "-p"
+          cfg.postgresUrl
+          "-c"
+          cfg.settings.chunk_size
+          "-n"
+          cfg.settings.chunks_to_compress
+          "-l"
+          (lib.concatStringsSep "," (builtins.map builtins.toString cfg.settings.levels))
+        ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/cloudflare-dyndns.nix b/nixos/modules/services/networking/cloudflare-dyndns.nix
index e6e9388dd22b..4e2684b39d43 100644
--- a/nixos/modules/services/networking/cloudflare-dyndns.nix
+++ b/nixos/modules/services/networking/cloudflare-dyndns.nix
@@ -92,6 +92,7 @@ in
           DynamicUser = true;
           StateDirectory = "cloudflare-dyndns";
           EnvironmentFile = cfg.apiTokenFile;
+          Environment = [ "XDG_CACHE_HOME=%S/cloudflare-dyndns/.cache" ];
           ExecStart =
             let
               args =
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 10609fff7005..de6ebeaf5170 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -309,7 +309,7 @@ in {
       '';
       example = literalExpression ''
         {
-          inherit (pkgs.nextcloud25Packages.apps) mail calendar contact;
+          inherit (pkgs.nextcloud31Packages.apps) mail calendar contact;
           phonetrack = pkgs.fetchNextcloudApp {
             name = "phonetrack";
             sha256 = "0qf366vbahyl27p9mshfma1as4nvql6w75zy2zk5xwwbp343vsbc";
diff --git a/nixos/tests/wine.nix b/nixos/tests/wine.nix
index ab7fbf6a0713..321469f72e68 100644
--- a/nixos/tests/wine.nix
+++ b/nixos/tests/wine.nix
@@ -75,5 +75,14 @@ listToAttrs (
       # This wayland combination times out after spending many hours.
       # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
       (pkgs.lib.remove "wayland" variants)
+    ++
+      map
+        (makeWineTest "wineWow64Packages" [
+          hello32
+          hello64
+        ])
+        # This wayland combination times out after spending many hours.
+        # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
+        (pkgs.lib.remove "wayland" variants)
   )
 )
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 4dca84788169..d8123435e9fa 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.0";
-    url = "https://dl.winehq.org/wine/source/10.0/wine-${version}.tar.xz";
-    hash = "sha256-xeCz9ffvr7MOnNTZxiS4XFgxcdM1SdkzzTQC80GsNgE=";
+    version = "10.2";
+    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
+    hash = "sha256-nZDfts8QuBCntHifAGdxK0cw0+oqiLkfG+Jzsq0EJD8=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-0mzKoaNaJ6ZDYQtJFU383W5nNe/FKtpBjeWDpiqkmp4=";
+    hash = "sha256-qWje1nJ5LIVFj5PmB6RRITYOWGovXzCLEVFTazmp30o=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/graphics/zgv/add-include.patch b/pkgs/applications/graphics/zgv/add-include.patch
new file mode 100644
index 000000000000..2d6d1b90c960
--- /dev/null
+++ b/pkgs/applications/graphics/zgv/add-include.patch
@@ -0,0 +1,11 @@
+diff --git a/src/modesel.c b/src/modesel.c
+--- src/modesel.c
++++ src/modesel.c
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <stdio.h>
++#include <stdlib.h>
+ #include "zgv_io.h"
+ #include "readnbkey.h"
+ #include "modesel.h"
diff --git a/pkgs/applications/graphics/zgv/default.nix b/pkgs/applications/graphics/zgv/default.nix
index 457d233176b9..25690e80480a 100644
--- a/pkgs/applications/graphics/zgv/default.nix
+++ b/pkgs/applications/graphics/zgv/default.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
+    ./add-include.patch
     (fetchpatch {
       url = "https://foss.aueb.gr/mirrors/linux/gentoo/media-gfx/zgv/files/zgv-5.9-libpng15.patch";
       sha256 = "1blw9n04c28bnwcmcn64si4f5zpg42s8yn345js88fyzi9zm19xw";
diff --git a/pkgs/applications/misc/anup/default.nix b/pkgs/applications/misc/anup/default.nix
deleted file mode 100644
index ef343f346146..000000000000
--- a/pkgs/applications/misc/anup/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  rustPlatform,
-  fetchFromGitHub,
-  Security,
-  sqlite,
-  xdg-utils,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "anup";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "Acizza";
-    repo = "anup";
-    rev = version;
-    sha256 = "sha256-4pXF4p4K8+YihVB9NdgT6bOidmQEgWXUbcbvgXJ0IDA=";
-  };
-
-  buildInputs =
-    [
-      sqlite
-      xdg-utils
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tui-utils-0.10.0" = "sha256-xazeXTGiMFZEcSFEF26te3LQ5oFFcskIiYkLzfsXf/A=";
-    };
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/Acizza/anup";
-    description = "Anime tracker for AniList featuring a TUI";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ natto1784 ];
-    mainProgram = "anup";
-  };
-}
diff --git a/pkgs/build-support/binary-cache/make-binary-cache.py b/pkgs/build-support/binary-cache/make-binary-cache.py
index 8b774cf65adb..9104d64a46d0 100644
--- a/pkgs/build-support/binary-cache/make-binary-cache.py
+++ b/pkgs/build-support/binary-cache/make-binary-cache.py
@@ -16,7 +16,7 @@ def processItem(
 ):
     narInfoHash = dropPrefix(item["path"], nixPrefix).split("-")[0]
 
-    narFile = outDir / "nar" / f"{narInfoHash}{compressionExtension}"
+    narFile = outDir / "nar" / f"{narInfoHash}.nar{compressionExtension}"
     with open(narFile, "wb") as f:
         subprocess.run(
             f"nix-store --dump {item['path']} {compressionCommand}",
@@ -36,7 +36,7 @@ def processItem(
     )
     fileSize = os.path.getsize(narFile)
 
-    finalNarFileName = Path("nar") / f"{fileHash}{compressionExtension}"
+    finalNarFileName = Path("nar") / f"{fileHash}.nar{compressionExtension}"
     os.rename(narFile, outDir / finalNarFileName)
 
     with open(outDir / f"{narInfoHash}.narinfo", "wt") as f:
diff --git a/pkgs/by-name/an/anup/package.nix b/pkgs/by-name/an/anup/package.nix
new file mode 100644
index 000000000000..c40278653f65
--- /dev/null
+++ b/pkgs/by-name/an/anup/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  sqlite,
+  xdg-utils,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "anup";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "Acizza";
+    repo = "anup";
+    tag = version;
+    hash = "sha256-4pXF4p4K8+YihVB9NdgT6bOidmQEgWXUbcbvgXJ0IDA=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-925R5pG514JiA7iUegFkxrDpA3o7T/Ct4Igqqcdo3rw=";
+
+  buildInputs = [
+    sqlite
+    xdg-utils
+  ];
+
+  meta = {
+    homepage = "https://github.com/Acizza/anup";
+    description = "Anime tracker for AniList featuring a TUI";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ natto1784 ];
+    mainProgram = "anup";
+  };
+}
diff --git a/pkgs/by-name/be/bed/package.nix b/pkgs/by-name/be/bed/package.nix
new file mode 100644
index 000000000000..a4baa4b38087
--- /dev/null
+++ b/pkgs/by-name/be/bed/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  which,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "bed";
+  version = "0.2.8";
+
+  src = fetchFromGitHub {
+    owner = "itchyny";
+    repo = "bed";
+    tag = "v${version}";
+    hash = "sha256-NXTQMyCI4PKaQPxZqklH03BEDMUrTCNtFUj2FNwIsNM=";
+  };
+  vendorHash = "sha256-tp83T6V4HM7SgpZASMWnIoqgw/s/DhdJMsCu2C6OuTo=";
+
+  nativeBuildInputs = [ which ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "-version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Binary editor written in Go";
+    homepage = "https://github.com/itchyny/bed";
+    changelog = "https://github.com/itchyny/bed/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "bed";
+  };
+}
diff --git a/pkgs/by-name/ca/cadzinho/package.nix b/pkgs/by-name/ca/cadzinho/package.nix
index 56c333fb6cae..4c20b1e545e0 100644
--- a/pkgs/by-name/ca/cadzinho/package.nix
+++ b/pkgs/by-name/ca/cadzinho/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   env.NIX_CFLAGS_COMPILE = toString (
     [
-      "-I${SDL2.dev}/include/SDL2"
+      "-I${lib.getInclude SDL2}/include/SDL2"
       "-I${SDL2_net.dev}/include/SDL2"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/el/elementary-xfce-icon-theme/package.nix b/pkgs/by-name/el/elementary-xfce-icon-theme/package.nix
index 5d87e72aa9c2..d798058ac647 100644
--- a/pkgs/by-name/el/elementary-xfce-icon-theme/package.nix
+++ b/pkgs/by-name/el/elementary-xfce-icon-theme/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-xfce-icon-theme";
-  version = "0.20.1";
+  version = "0.21";
 
   src = fetchFromGitHub {
     owner = "shimmerproject";
     repo = "elementary-xfce";
     rev = "v${version}";
-    hash = "sha256-4Q3e6w0XqtsXZVnlHNf84CFO6ITwqlgB69D7iqJ2YO8=";
+    hash = "sha256-ncPL76HCC9n4wTciGeqb+YAUcCE9EeOpWGM5DRYUCYg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/fish-fillets-ng/package.nix b/pkgs/by-name/fi/fish-fillets-ng/package.nix
index 73011c6bafd3..7c40b658cbfd 100644
--- a/pkgs/by-name/fi/fish-fillets-ng/package.nix
+++ b/pkgs/by-name/fi/fish-fillets-ng/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   # pass in correct sdl-config for cross builds
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
 
   makeFlags = [
     "AR=${stdenv.cc.targetPrefix}ar"
diff --git a/pkgs/by-name/fr/freedroidrpg/package.nix b/pkgs/by-name/fr/freedroidrpg/package.nix
index 021abb8c7e9b..d6cdcf46ee3f 100644
--- a/pkgs/by-name/fr/freedroidrpg/package.nix
+++ b/pkgs/by-name/fr/freedroidrpg/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
     zlib
   ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
 
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/gl/gltron/package.nix b/pkgs/by-name/gl/gltron/package.nix
index 1ceebc33f76a..4fe74f8b68b1 100644
--- a/pkgs/by-name/gl/gltron/package.nix
+++ b/pkgs/by-name/gl/gltron/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "AR=${stdenv.cc.targetPrefix}ar" ];
 
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
 
   buildInputs = [
     SDL
diff --git a/pkgs/by-name/gu/guesswidth/package.nix b/pkgs/by-name/gu/guesswidth/package.nix
new file mode 100644
index 000000000000..427880f139c4
--- /dev/null
+++ b/pkgs/by-name/gu/guesswidth/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "guesswidth";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "noborus";
+    repo = "guesswidth";
+    tag = "v${version}";
+    hash = "sha256-afZYegG4q+KmvNP2yy/HGvP4V1mpOUCxRLWLTUHAK0M=";
+  };
+
+  vendorHash = "sha256-IGb+fM3ZOlGrLGFSUeUhZ9wDMKOBofDBYByAQlvXY14=";
+
+  ldflags = [
+    "-X github.com/noborus/guesswidth.version=v${version}"
+    "-X github.com/noborus/guesswidth.revision=${src.rev}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd guesswidth \
+        --bash <(${emulator} $out/bin/guesswidth completion bash) \
+        --fish <(${emulator} $out/bin/guesswidth completion fish) \
+        --zsh <(${emulator} $out/bin/guesswidth completion zsh)
+    ''
+  );
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Guess the width (fwf) output without delimiters in commands that output to the terminal";
+    homepage = "https://github.com/noborus/guesswidth";
+    changelog = "https://github.com/noborus/guesswidth/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "guesswidth";
+  };
+}
diff --git a/pkgs/by-name/hh/hheretic/package.nix b/pkgs/by-name/hh/hheretic/package.nix
index c2d7a7909ff1..64a3fa9d82ac 100644
--- a/pkgs/by-name/hh/hheretic/package.nix
+++ b/pkgs/by-name/hh/hheretic/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
-    SDL.dev
+    (lib.getDev SDL)
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/hh/hhexen/package.nix b/pkgs/by-name/hh/hhexen/package.nix
index 4d3601cf43f5..4d994f472128 100644
--- a/pkgs/by-name/hh/hhexen/package.nix
+++ b/pkgs/by-name/hh/hhexen/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
-    SDL.dev
+    (lib.getDev SDL)
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index 5b397213e61a..ad02c7f3258c 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-02-01";
+  version = "0-unstable-2025-03-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "6cc3e7af84f3809f95bd4340847de3fabccb0a8c";
-    hash = "sha256-nd329TNBABpRb+Z2eMUzNwTToMIDM/2Zt47NYfKyXe0=";
+    rev = "e8e2b841c48b4475cc2ae99c4635ea140aa630d6";
+    hash = "sha256-TJMOjayu9lWxg6j9HurXbxGc9RrCb/arXkVSezR2kgc=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/jp/jp-zip-codes/package.nix b/pkgs/by-name/jp/jp-zip-codes/package.nix
index ec43031235eb..c36c53af3f71 100644
--- a/pkgs/by-name/jp/jp-zip-codes/package.nix
+++ b/pkgs/by-name/jp/jp-zip-codes/package.nix
@@ -7,15 +7,15 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jp-zip-code";
-  version = "0-unstable-2025-02-01";
+  version = "0-unstable-2025-03-01";
 
   # This package uses a mirror as the source because the
   # original provider uses the same URL for updated content.
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jp-zip-codes";
-    rev = "2fdcd4f4c00a90de1dacfe16644bbaadbfd377aa";
-    hash = "sha256-i81TzPrhHE3wZdq/HJGnTsvmo/clWCYO74hJf9hMxs4=";
+    rev = "82ea5a76dfaf43da8b838f20827ea535e37bd44c";
+    hash = "sha256-DhQlbYgy+p1FZ2a/PxbauQ4UGR83Q64A2a3bn/yWD6Y=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ju/justbuild/package.nix b/pkgs/by-name/ju/justbuild/package.nix
index 4c912509619c..e62ef9140ef4 100644
--- a/pkgs/by-name/ju/justbuild/package.nix
+++ b/pkgs/by-name/ju/justbuild/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "justbuild";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "just-buildsystem";
     repo = "justbuild";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Hx+MU1W/vwN+hlAAbIieBAmHUw65AGZ10ItBdIG+IEM=";
+    hash = "sha256-HewKW2yezsc7mYZ6r3c0w/M3ybPzXqLPUL8N+plqE8o=";
   };
 
   bazelapi = fetchurl {
diff --git a/pkgs/by-name/ke/keeperrl/package.nix b/pkgs/by-name/ke/keeperrl/package.nix
index 7bb649924ca3..ea8c74e92d14 100644
--- a/pkgs/by-name/ke/keeperrl/package.nix
+++ b/pkgs/by-name/ke/keeperrl/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
-    "-I${SDL2.dev}/include/SDL2"
+    "-I${lib.getInclude SDL2}/include/SDL2"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/lib60870/package.nix b/pkgs/by-name/li/lib60870/package.nix
index 2c9966ab1ac7..1884f873a1e1 100644
--- a/pkgs/by-name/li/lib60870/package.nix
+++ b/pkgs/by-name/li/lib60870/package.nix
@@ -20,6 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/lib60870-C";
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/CMakeLists.txt --replace-warn "-lrt" ""
+  '';
+
   separateDebugInfo = true;
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
new file mode 100644
index 000000000000..1c5f9ea3a98a
--- /dev/null
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -0,0 +1,117 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  config,
+  wrapGAppsHook3,
+  autoPatchelfHook,
+  alsa-lib,
+  curl,
+  dbus-glib,
+  gtk3,
+  libXtst,
+  libva,
+  pciutils,
+  pipewire,
+  adwaita-icon-theme,
+  writeText,
+  patchelfUnstable, # have to use patchelfUnstable to support --no-clobber-old-sections
+}:
+
+let
+  binaryName = "librewolf";
+
+  mozillaPlatforms = {
+    i686-linux = "linux-i686";
+    x86_64-linux = "linux-x86_64";
+    aarch64-linux = "linux-arm64";
+  };
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
+  arch = mozillaPlatforms.${stdenv.hostPlatform.system} or throwSystem;
+
+  policies = config.librewolf.policies or { };
+
+  policiesJson = writeText "librewolf-policies.json" (builtins.toJSON { inherit policies; });
+
+  pname = "librewolf-bin-unwrapped";
+
+  version = "136.0-2";
+in
+
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchurl {
+    url = "https://gitlab.com/api/v4/projects/44042130/packages/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
+    hash =
+      {
+        i686-linux = "sha256-VRY6OY3nBTfwrdoRF8zBjSfwrxCM9SnmjUvAXhLbGSY=";
+        x86_64-linux = "sha256-KjOES7AjoObZ0EPjTFAVafm++8MsxtEs1FgViLsR/hc=";
+        aarch64-linux = "sha256-vUW+eEabJ3Gp0ov/9ms/KyLzwHOCKozpR/CdZGaxA0I=";
+      }
+      .${stdenv.hostPlatform.system} or throwSystem;
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    autoPatchelfHook
+    patchelfUnstable
+  ];
+
+  buildInputs = [
+    gtk3
+    adwaita-icon-theme
+    alsa-lib
+    dbus-glib
+    libXtst
+  ];
+
+  runtimeDependencies = [
+    curl
+    libva.out
+    pciutils
+  ];
+
+  appendRunpaths = [ "${pipewire}/lib" ];
+
+  # Firefox uses "relrhack" to manually process relocations from a fixed offset
+  patchelfFlags = [ "--no-clobber-old-sections" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $prefix/lib $out/bin
+    cp -r . $prefix/lib/librewolf-bin-${version}
+    ln -s $prefix/lib/librewolf-bin-${version}/librewolf $out/bin/${binaryName}
+    # See: https://github.com/mozilla/policy-templates/blob/master/README.md
+    mv $out/lib/librewolf-bin-${version}/distribution/policies.json $out/lib/librewolf-bin-${version}/distribution/extra-policies.json
+    ${lib.optionalString (config.librewolf.policies or false) ''
+      ln -s ${policiesJson} $out/lib/librewolf-bin-${version}/distribution/policies.json
+    ''}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit binaryName;
+    applicationName = "LibreWolf";
+    libName = "librewolf-bin-${version}";
+    ffmpegSupport = true;
+    gssSupport = true;
+    gtk3 = gtk3;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Fork of Firefox, focused on privacy, security and freedom (upstream binary release)";
+    homepage = "https://librewolf.net";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ dwrege ];
+    platforms = builtins.attrNames mozillaPlatforms;
+    mainProgram = "librewolf";
+    hydraPlatforms = [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh b/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh
new file mode 100755
index 000000000000..93f8e0fe14b9
--- /dev/null
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix curl coreutils jq common-updater-scripts
+
+set -eou pipefail
+
+latestVersion=$(curl ${PRIVATE-TOKEN:+-u ":$PRIVATE-TOKEN"} -sL https://gitlab.com/api/v4/projects/44042130/releases | jq -r '.[0].tag_name')
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; librewolf-bin-unwrapped.version or (lib.getVersion librewolf-bin-unwrapped)" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+for i in \
+    "i686-linux linux-i686" \
+    "x86_64-linux linux-x86_64" \
+    "aarch64-linux linux-arm64"; do
+    set -- $i
+    hash=$(nix hash convert --to sri --hash-algo sha256 $(curl ${PRIVATE-TOKEN:+-u ":$PRIVATE-TOKEN"} -sL https://gitlab.com/api/v4/projects/44042130/packages/generic/librewolf/$latestVersion/librewolf-$latestVersion-$2-package.tar.xz.sha256sum))
+    update-source-version librewolf-bin-unwrapped $latestVersion $hash --system=$1 --ignore-same-version
+done
diff --git a/pkgs/by-name/li/librewolf-bin/package.nix b/pkgs/by-name/li/librewolf-bin/package.nix
deleted file mode 100644
index 7d3a23cd489b..000000000000
--- a/pkgs/by-name/li/librewolf-bin/package.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  lib,
-  appimageTools,
-  fetchurl,
-}:
-
-let
-  pname = "librewolf-bin";
-  upstreamVersion = "135.0-1";
-  version = lib.replaceStrings [ "-" ] [ "." ] upstreamVersion;
-  src = fetchurl {
-    url = "https://gitlab.com/api/v4/projects/24386000/packages/generic/librewolf/${upstreamVersion}/LibreWolf.x86_64.AppImage";
-    hash = "sha256-Qg4hc3bpJh3NFMUlq65K1fVtp6Slgtk2OjvcELp4aH8=";
-  };
-  appimageContents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    mv $out/bin/{${pname},librewolf}
-    install -Dm444 ${appimageContents}/io.gitlab.LibreWolf.desktop -t $out/share/applications
-    install -Dm444 ${appimageContents}/librewolf.png -t $out/share/pixmaps
-  '';
-
-  meta = {
-    description = "Fork of Firefox, focused on privacy, security and freedom (upstream AppImage release)";
-    homepage = "https://librewolf.net";
-    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ dwrege ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "librewolf";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/li/libwtk-sdl2/package.nix b/pkgs/by-name/li/libwtk-sdl2/package.nix
index 6415480e135f..2cc178d921fb 100644
--- a/pkgs/by-name/li/libwtk-sdl2/package.nix
+++ b/pkgs/by-name/li/libwtk-sdl2/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2_image
   ];
   # From some reason, this is needed as otherwise SDL.h is not found
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getInclude SDL2}/include/SDL2";
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/ma/macskk/package.nix b/pkgs/by-name/ma/macskk/package.nix
index c366d41a76fe..3915199e5769 100644
--- a/pkgs/by-name/ma/macskk/package.nix
+++ b/pkgs/by-name/ma/macskk/package.nix
@@ -6,15 +6,16 @@
   cpio,
   xar,
   darwin,
+  nix-update-script,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "macskk";
-  version = "1.4.1";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://github.com/mtgto/macSKK/releases/download/${finalAttrs.version}/macSKK-${finalAttrs.version}.dmg";
-    hash = "sha256-lLIFVGwt3VDsXRRGczY5VeqUyUgkX+G9tB3SGrO0voM=";
+    hash = "sha256-CqtW6bfSuAo+9VRmRTgx0aKpBKBEDIxidOh7V5vD7ww=";
   };
 
   nativeBuildInputs = [
@@ -46,6 +47,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Yet Another macOS SKK Input Method";
     homepage = "https://github.com/mtgto/macSKK";
diff --git a/pkgs/by-name/md/mdtsql/package.nix b/pkgs/by-name/md/mdtsql/package.nix
new file mode 100644
index 000000000000..69c3935d2934
--- /dev/null
+++ b/pkgs/by-name/md/mdtsql/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "mdtsql";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "noborus";
+    repo = "mdtsql";
+    tag = "v${version}";
+    hash = "sha256-D9suWLrVQOztz0rRjEo+pjxQlGWOOsk3EUbkN9yuriY=";
+  };
+
+  vendorHash = "sha256-psXnLMhrApyBjDY/S4WwIM1GLczyn4dUmX2fWSTq7mQ=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd mdtsql \
+        --bash <(${emulator} $out/bin/mdtsql completion bash) \
+        --fish <(${emulator} $out/bin/mdtsql completion fish) \
+        --zsh <(${emulator} $out/bin/mdtsql completion zsh)
+    ''
+  );
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Execute SQL to markdown table and convert to other format";
+    homepage = "https://github.com/noborus/mdtsql";
+    changelog = "https://github.com/noborus/mdtsql/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "mdtsql";
+  };
+}
diff --git a/pkgs/by-name/mo/mold/package.nix b/pkgs/by-name/mo/mold/package.nix
index 8ae3b9a4c67e..8d0feca3bacd 100644
--- a/pkgs/by-name/mo/mold/package.nix
+++ b/pkgs/by-name/mo/mold/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.37.0";
+  version = "2.37.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-Be5czR6ODN4NnJ0f3NYP2shLbawJHU/EU2aHqTBRKzE=";
+    hash = "sha256-ZGO3oT8NOOkAYTyoMUKxH3TFP4mw2z0BGdGSF2TbKaE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/picoloop/package.nix b/pkgs/by-name/pi/picoloop/package.nix
index 64165d9d06c4..2ea5d75e0b0a 100644
--- a/pkgs/by-name/pi/picoloop/package.nix
+++ b/pkgs/by-name/pi/picoloop/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libpulseaudio
     SDL2
-    SDL2.dev
+    (lib.getDev SDL2)
     SDL2_image
     SDL2_ttf
     alsa-lib
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "-f Makefile.PatternPlayer_debian_RtAudio_sdl20" ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${SDL2.dev}/include/SDL2" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${lib.getInclude SDL2}/include/SDL2" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/by-name/pm/pmbootstrap/package.nix b/pkgs/by-name/pm/pmbootstrap/package.nix
index 7a9ed331c49c..b8e20a96327f 100644
--- a/pkgs/by-name/pm/pmbootstrap/package.nix
+++ b/pkgs/by-name/pm/pmbootstrap/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.2.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = pname;
     tag = version;
-    hash = "sha256-iJ3XK1aA3d0V5ATj2h6arHlTRKocmJ1AaySiq9bSJrs=";
+    hash = "sha256-2xeUuaxHS2mHuBN3EWGNZwn4S6aRmF6cUQI4LWeXLkE=";
     domain = "gitlab.postmarketos.org";
   };
 
@@ -54,6 +54,7 @@ python3Packages.buildPythonApplication rec {
   # skip impure tests
   disabledTests = [
     "test_pkgrepo_pmaports"
+    "test_random_valid_deviceinfos"
   ];
 
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/qu/quake3e/package.nix b/pkgs/by-name/qu/quake3e/package.nix
index d4d18a33b833..4bd6d9508ee7 100644
--- a/pkgs/by-name/qu/quake3e/package.nix
+++ b/pkgs/by-name/qu/quake3e/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     SDL2
     glibc
   ];
-  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getInclude SDL2}/include/SDL2";
   enableParallelBuilding = true;
 
   postPatch = ''
diff --git a/pkgs/by-name/qu/quba/package.nix b/pkgs/by-name/qu/quba/package.nix
index 1be9b1a481a7..18e95f6bc801 100644
--- a/pkgs/by-name/qu/quba/package.nix
+++ b/pkgs/by-name/qu/quba/package.nix
@@ -1,29 +1,14 @@
 {
   lib,
+  stdenvNoCC,
   appimageTools,
   fetchurl,
+  _7zz,
 }:
 
 let
-  version = "1.4.2";
   pname = "quba";
-
-  src = fetchurl {
-    url = "https://github.com/ZUGFeRD/quba-viewer/releases/download/v${version}/Quba-${version}.AppImage";
-    hash = "sha256-3goMWN5GeQaLJimUKbjozJY/zJmqc9Mvy2+6bVSt1p0=";
-  };
-
-  appimageContents = appimageTools.extractType1 { inherit pname version src; };
-in
-appimageTools.wrapType1 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=${pname}'
-    cp -r ${appimageContents}/usr/share/icons $out/share
-  '';
+  version = "1.4.2";
 
   meta = {
     description = "Viewer for electronic invoices";
@@ -32,6 +17,52 @@ appimageTools.wrapType1 {
     license = lib.licenses.asl20;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ onny ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ] ++ lib.platforms.darwin;
   };
-}
+
+  src = fetchurl {
+    url = "https://github.com/ZUGFeRD/quba-viewer/releases/download/v${version}/Quba-${version}.AppImage";
+    hash = "sha256-3goMWN5GeQaLJimUKbjozJY/zJmqc9Mvy2+6bVSt1p0=";
+  };
+
+  appimageContents = appimageTools.extractType1 { inherit pname version src; };
+
+  linux = appimageTools.wrapType1 {
+    inherit
+      pname
+      version
+      src
+      meta
+      ;
+
+    extraInstallCommands = ''
+      install -m 444 -D ${appimageContents}/quba.desktop -t $out/share/applications
+      substituteInPlace $out/share/applications/quba.desktop \
+        --replace-fail 'Exec=AppRun' 'Exec=quba'
+      cp -r ${appimageContents}/usr/share/icons $out/share
+    '';
+  };
+
+  darwin = stdenvNoCC.mkDerivation {
+    inherit pname version meta;
+
+    src = fetchurl {
+      url = "https://github.com/ZUGFeRD/quba-viewer/releases/download/v${version}/Quba-${version}-universal.dmg";
+      hash = "sha256-q7va2D9AT0BoPhfkub/RFQxGyF12uFaCDpSYIxslqMc=";
+    };
+
+    unpackCmd = "7zz x -bd -osource -xr'!*/Applications' -xr'!*com.apple.provenance' $curSrc";
+
+    nativeBuildInputs = [ _7zz ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      mv Quba.app $out/Applications
+
+      runHook postInstall
+    '';
+  };
+in
+if stdenvNoCC.hostPlatform.isLinux then linux else darwin
diff --git a/pkgs/by-name/re/recastnavigation/package.nix b/pkgs/by-name/re/recastnavigation/package.nix
index ef5f55978adf..eb291fdc1396 100644
--- a/pkgs/by-name/re/recastnavigation/package.nix
+++ b/pkgs/by-name/re/recastnavigation/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       # Expects SDL2.framework in specific location, which we don't have
       # Change where SDL2 headers are searched for to match what we do have
       substituteInPlace RecastDemo/CMakeLists.txt \
-        --replace 'include_directories(''${SDL2_LIBRARY}/Headers)' 'include_directories(${SDL2.dev}/include/SDL2)'
+        --replace 'include_directories(''${SDL2_LIBRARY}/Headers)' 'include_directories(${lib.getInclude SDL2}/include/SDL2)'
     '';
 
   doCheck = true;
diff --git a/pkgs/by-name/re/renpy/package.nix b/pkgs/by-name/re/renpy/package.nix
index 2696c6359f12..a5c0aa7ea091 100644
--- a/pkgs/by-name/re/renpy/package.nix
+++ b/pkgs/by-name/re/renpy/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGLU
     libpng
     SDL2
-    SDL2.dev
+    (lib.getDev SDL2)
     zlib
   ];
 
diff --git a/pkgs/by-name/sa/saga/darwin-patch-1.patch b/pkgs/by-name/sa/saga/darwin-patch-1.patch
new file mode 100644
index 000000000000..224a66204aca
--- /dev/null
+++ b/pkgs/by-name/sa/saga/darwin-patch-1.patch
@@ -0,0 +1,30 @@
+commit 3bbd15676dfc077d7836e9d51810c1d6731f5789
+Author: Palmer Cox <p@lmercox.com>
+Date:   Sun Feb 23 16:41:18 2025 -0500
+
+    Fix copy/paste error in FindPostgres.cmake
+    
+    In f51c6b1513e312002c108fe87d26e33c48671406, EXEC_PROGRAM was changed to
+    execute_process. As part of that, it looks like the second and third
+    invocations were accidentally changed.
+
+diff --git a/saga-gis/cmake/modules/FindPostgres.cmake b/saga-gis/cmake/modules/FindPostgres.cmake
+index f22806fd9..a4b6ec9ac 100644
+--- a/cmake/modules/FindPostgres.cmake
++++ b/cmake/modules/FindPostgres.cmake
+@@ -77,13 +77,13 @@ ELSE(WIN32)
+       SET(POSTGRES_INCLUDE_DIR ${PG_TMP} CACHE STRING INTERNAL)
+ 
+       # set LIBRARY_DIR
+-      execute_process(COMMAND ${POSTGRES_CONFIG} --includedir
++      execute_process(COMMAND ${POSTGRES_CONFIG} --libdir
+         OUTPUT_VARIABLE PG_TMP
+         OUTPUT_STRIP_TRAILING_WHITESPACE)
+       IF (APPLE)
+         SET(POSTGRES_LIBRARY ${PG_TMP}/libpq.dylib CACHE STRING INTERNAL)
+       ELSEIF (CYGWIN)
+-        execute_process(COMMAND ${POSTGRES_CONFIG} --includedir
++        execute_process(COMMAND ${POSTGRES_CONFIG} --libs
+           OUTPUT_VARIABLE PG_TMP
+           OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
diff --git a/pkgs/by-name/sa/saga/darwin-patch-2.patch b/pkgs/by-name/sa/saga/darwin-patch-2.patch
new file mode 100644
index 000000000000..af601923d6ef
--- /dev/null
+++ b/pkgs/by-name/sa/saga/darwin-patch-2.patch
@@ -0,0 +1,24 @@
+commit eb69f594ec439309432e87834bead5276b7dbc9b
+Author: Palmer Cox <p@lmercox.com>
+Date:   Sun Feb 23 16:45:34 2025 -0500
+
+    On Apple, use FIND_LIBRARY to locate libpq
+    
+    I think FIND_LIBRARY() is better than just relying on what pg_config
+    said its libdir was, since, depending on how libpq was installed, it may
+    or may not be in that directory. If its not, FIND_LIBRARY() is able to
+    find it in other locations.
+
+diff --git a/saga-gis/cmake/modules/FindPostgres.cmake b/saga-gis/cmake/modules/FindPostgres.cmake
+index a4b6ec9ac..65e7ac69b 100644
+--- a/cmake/modules/FindPostgres.cmake
++++ b/cmake/modules/FindPostgres.cmake
+@@ -81,7 +81,7 @@ ELSE(WIN32)
+         OUTPUT_VARIABLE PG_TMP
+         OUTPUT_STRIP_TRAILING_WHITESPACE)
+       IF (APPLE)
+-        SET(POSTGRES_LIBRARY ${PG_TMP}/libpq.dylib CACHE STRING INTERNAL)
++        FIND_LIBRARY(POSTGRES_LIBRARY NAMES pq libpq PATHS ${PG_TMP})
+       ELSEIF (CYGWIN)
+         execute_process(COMMAND ${POSTGRES_CONFIG} --libs
+           OUTPUT_VARIABLE PG_TMP
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index 7de5a63f4228..011c1929df58 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -43,6 +43,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "saga-${version}/saga-gis";
 
+  patches = [
+    # Patches from https://sourceforge.net/p/saga-gis/code/merge-requests/38/.
+    # These are needed to fix building on Darwin (technically the first is not
+    # required, but the second doesn't apply without it).
+    ./darwin-patch-1.patch
+    ./darwin-patch-2.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     wrapGAppsHook3
diff --git a/pkgs/by-name/sd/SDL_gfx/package.nix b/pkgs/by-name/sd/SDL_gfx/package.nix
index 65711ff5e396..9b0b74963626 100644
--- a/pkgs/by-name/sd/SDL_gfx/package.nix
+++ b/pkgs/by-name/sd/SDL_gfx/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   # SDL_gfx.pc refers to sdl.pc and some SDL_gfx headers import SDL.h
   propagatedBuildInputs = [ SDL ];
 
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
 
   configureFlags = [
     (lib.enableFeature false "mmx")
diff --git a/pkgs/by-name/sd/SDL_mixer/package.nix b/pkgs/by-name/sd/SDL_mixer/package.nix
index bedfda42842a..9a871a71f4ec 100644
--- a/pkgs/by-name/sd/SDL_mixer/package.nix
+++ b/pkgs/by-name/sd/SDL_mixer/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # pass in correct *-config for cross builds
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
   env.SMPEG_CONFIG = lib.getExe' smpeg.dev "smpeg-config";
 
   configureFlags = [
diff --git a/pkgs/by-name/sd/SDL_sound/package.nix b/pkgs/by-name/sd/SDL_sound/package.nix
index 189a2ac4f67f..1ed4ecd400aa 100644
--- a/pkgs/by-name/sd/SDL_sound/package.nix
+++ b/pkgs/by-name/sd/SDL_sound/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.enableFeature enableSdltest "sdltest")
   ];
 
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/sd/SDL_ttf/package.nix b/pkgs/by-name/sd/SDL_ttf/package.nix
index 64fc256db640..64c2137d25e2 100644
--- a/pkgs/by-name/sd/SDL_ttf/package.nix
+++ b/pkgs/by-name/sd/SDL_ttf/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # pass in correct *-config for cross builds
-  env.SDL_CONFIG = lib.getExe' SDL.dev "sdl-config";
+  env.SDL_CONFIG = lib.getExe' (lib.getDev SDL) "sdl-config";
   env.FREETYPE_CONFIG = lib.getExe' freetype.dev "freetype-config";
 
   configureFlags = [
diff --git a/pkgs/by-name/sd/sdlpop/package.nix b/pkgs/by-name/sd/sdlpop/package.nix
index e79cf801c28d..42a29210c93e 100644
--- a/pkgs/by-name/sd/sdlpop/package.nix
+++ b/pkgs/by-name/sd/sdlpop/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   preBuild = ''
     substituteInPlace src/Makefile \
       --replace "CC = gcc" "CC = ${stdenv.cc.targetPrefix}cc" \
-      --replace "CFLAGS += -I/opt/local/include" "CFLAGS += -I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2"
+      --replace "CFLAGS += -I/opt/local/include" "CFLAGS += -I${lib.getInclude SDL2}/include/SDL2 -I${SDL2_image}/include/SDL2"
   '';
 
   # The prince binary expects two things of the working directory it is called from:
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index faedabdd38aa..a75e4751c22b 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -41,7 +41,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "24.11.2.1";
+  version = "24.11.3.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-MsV/1fPEWMociQfpPQjmyQIXXo9oDtkgIKUlgEG3zHY=";
+    hash = "sha256-DdGCPNmLCp1SgsYPVr7Gr4yqBrV2Ot3nJsWpcuYty5U=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sm/smpeg2/package.nix b/pkgs/by-name/sm/smpeg2/package.nix
index 925b59f3a44a..fa52e9aad9dd 100644
--- a/pkgs/by-name/sm/smpeg2/package.nix
+++ b/pkgs/by-name/sm/smpeg2/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     moveToOutput bin/smpeg2-config "$dev"
     wrapProgram $dev/bin/smpeg2-config \
       --prefix PATH ":" "${pkg-config}/bin" \
-      --prefix PKG_CONFIG_PATH ":" "${SDL2.dev}/lib/pkgconfig"
+      --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL2}/lib/pkgconfig"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/sp/sparrow3d/package.nix b/pkgs/by-name/sp/sparrow3d/package.nix
index 6a430bff6fe6..393781481639 100644
--- a/pkgs/by-name/sp/sparrow3d/package.nix
+++ b/pkgs/by-name/sp/sparrow3d/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
-    SDL.dev
+    (lib.getDev SDL)
     SDL_image
     SDL_ttf
     SDL_mixer
diff --git a/pkgs/by-name/sr/srb2/package.nix b/pkgs/by-name/sr/srb2/package.nix
index 3d2b1aae3e0c..208abc217571 100644
--- a/pkgs/by-name/sr/srb2/package.nix
+++ b/pkgs/by-name/sr/srb2/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
     "-DOPENMPT_INCLUDE_DIR=${libopenmpt.dev}/include"
     "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2.dev}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getInclude SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/by-name/ta/tamatool/package.nix b/pkgs/by-name/ta/tamatool/package.nix
index 254d1b8a036b..8e0af3062c5d 100644
--- a/pkgs/by-name/ta/tamatool/package.nix
+++ b/pkgs/by-name/ta/tamatool/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "-Clinux"
     "VERSION=${finalAttrs.version}"
-    "CFLAGS+=-I${SDL2.dev}/include/SDL2"
+    "CFLAGS+=-I${lib.getInclude SDL2}/include/SDL2"
     "CFLAGS+=-I${SDL2_image}/include/SDL2"
     "DIST_PATH=$(out)"
     "CC=${stdenv.cc.targetPrefix}cc"
diff --git a/pkgs/by-name/to/tome4/package.nix b/pkgs/by-name/to/tome4/package.nix
index b65139f8a374..c9c23e185156 100644
--- a/pkgs/by-name/to/tome4/package.nix
+++ b/pkgs/by-name/to/tome4/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   # disable parallel building as it caused sporadic build failures
   enableParallelBuilding = false;
 
-  env.NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getInclude SDL2}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
 
   makeFlags = [ "config=release" ];
 
diff --git a/pkgs/by-name/tr/trigger/package.nix b/pkgs/by-name/tr/trigger/package.nix
index 1352e9df786d..4c7ec3811a30 100644
--- a/pkgs/by-name/tr/trigger/package.nix
+++ b/pkgs/by-name/tr/trigger/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     cd src
 
     sed s,lSDL2main,lSDL2, -i GNUmakefile
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${SDL2.dev}/include/SDL2"
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${lib.getInclude SDL2}/include/SDL2"
   '';
 
   makeFlags = [
diff --git a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
index db92b64dca1f..9fde5ba1dfd8 100644
--- a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
+++ b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "woodpecker-plugin-git";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "woodpecker-ci";
     repo = "plugin-git";
     tag = version;
-    hash = "sha256-xE5wLW7u5fh+xk/D2Y+Fcx5eTiZX0pJYHKncWVwHDlQ=";
+    hash = "sha256-5YyYCdZpRlchLH4qX9golv8DmlMghosWi5WXP9WxMXU=";
   };
 
   vendorHash = "sha256-XOriHt+qyOcuGZzMtGAZuztxLod92JzjKWWjNq5Giro=";
diff --git a/pkgs/by-name/xl/xlsxsql/package.nix b/pkgs/by-name/xl/xlsxsql/package.nix
new file mode 100644
index 000000000000..21b98b2ade6e
--- /dev/null
+++ b/pkgs/by-name/xl/xlsxsql/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "xlsxsql";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "noborus";
+    repo = "xlsxsql";
+    tag = "v${version}";
+    hash = "sha256-OmNYrohWs4l7cReTBB6Ha9VuKPit1+P7a4QKhYwK5g8=";
+  };
+
+  vendorHash = "sha256-Zrt4NMoQePvipFyYpN+Ipgl2D6j/thCPhrQy4AbXOfQ=";
+
+  ldflags = [
+    "-X main.version=v${version}"
+    "-X main.revision=${src.rev}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd xlsxsql \
+        --bash <(${emulator} $out/bin/xlsxsql completion bash) \
+        --fish <(${emulator} $out/bin/xlsxsql completion fish) \
+        --zsh <(${emulator} $out/bin/xlsxsql completion zsh)
+    ''
+  );
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI tool that executes SQL queries on various files including xlsx files and outputs the results to various files";
+    homepage = "https://github.com/noborus/xlsxsql";
+    changelog = "https://github.com/noborus/xlsxsql/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "xlsxsql";
+  };
+}
diff --git a/pkgs/by-name/xo/xo/package.nix b/pkgs/by-name/xo/xo/package.nix
new file mode 100644
index 000000000000..c0cf53f2651c
--- /dev/null
+++ b/pkgs/by-name/xo/xo/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "xo";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "xo";
+    repo = "xo";
+    tag = "v${version}";
+    hash = "sha256-cmSY+Et2rE+hLZ1+d2Vvwp+CX0hfLz08QKivQQd7SIQ=";
+  };
+
+  vendorHash = "sha256-aTjLoP7u2mMF1Ns/Wb9RR0xAqQCZJjjb5UzY2de6yBU=";
+
+  ldflags = [
+    "-X main.version=v${version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd xo \
+        --bash <(${emulator} $out/bin/xo completion bash) \
+        --fish <(${emulator} $out/bin/xo completion fish) \
+        --zsh <(${emulator} $out/bin/xo completion zsh)
+    ''
+  );
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line tool to generate idiomatic Go code for SQL databases supporting PostgreSQL, MySQL, SQLite, Oracle, and Microsoft SQL Server";
+    homepage = "https://github.com/xo/xo";
+    changelog = "https://github.com/xo/xo/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "xo";
+  };
+}
diff --git a/pkgs/development/python-modules/fastembed/default.nix b/pkgs/development/python-modules/fastembed/default.nix
index 9a16fb135e9c..5e29d425cd92 100644
--- a/pkgs/development/python-modules/fastembed/default.nix
+++ b/pkgs/development/python-modules/fastembed/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "fastembed";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "qdrant";
     repo = "fastembed";
     tag = "v${version}";
-    hash = "sha256-aVeQC0BooVZcbIplVRzY22ozliWW/Ts/asiInTxSBOE=";
+    hash = "sha256-mZClZuSTTGQQSH6KYLcVx0YaNoAwRO25eRxGGjOz8B8=";
   };
 
   build-system = [ poetry-core ];
@@ -64,7 +64,7 @@ buildPythonPackage rec {
   meta = {
     description = "Fast, Accurate, Lightweight Python library to make State of the Art Embedding";
     homepage = "https://github.com/qdrant/fastembed";
-    changelog = "https://github.com/qdrant/fastembed/releases/tag/v${version}";
+    changelog = "https://github.com/qdrant/fastembed/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ happysalada ];
     # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index c31f4db74297..46f3538a6912 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -8,6 +8,7 @@
   buildPythonPackage,
   click,
   cryptography,
+  email-validator,
   fastapi,
   fastapi-sso,
   fetchFromGitHub,
@@ -32,6 +33,7 @@
   rq,
   tiktoken,
   tokenizers,
+  uvloop,
   uvicorn,
 }:
 
@@ -56,6 +58,7 @@ buildPythonPackage rec {
   dependencies = [
     aiohttp
     click
+    email-validator
     importlib-metadata
     jinja2
     jsonschema
@@ -80,6 +83,7 @@ buildPythonPackage rec {
       python-multipart
       pyyaml
       rq
+      uvloop
       uvicorn
     ];
     extra_proxy = [
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index 95e08c1f335d..649c72c0be2a 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -117,7 +117,7 @@ buildPythonPackage rec {
 
   env =
     {
-      SDL_CONFIG = "${SDL2.dev}/bin/sdl2-config";
+      SDL_CONFIG = lib.getExe' (lib.getDev SDL2) "sdl2-config";
     }
     // lib.optionalAttrs stdenv.cc.isClang {
       NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
diff --git a/pkgs/development/python-modules/pytubefix/default.nix b/pkgs/development/python-modules/pytubefix/default.nix
index c6c654a30c37..9986c26c4902 100644
--- a/pkgs/development/python-modules/pytubefix/default.nix
+++ b/pkgs/development/python-modules/pytubefix/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytubefix";
-  version = "8.12.1";
+  version = "8.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JuanBindez";
     repo = "pytubefix";
     tag = "v${version}";
-    hash = "sha256-PZxwF8rAPHmPpw6MKI8OVrl7CRNn9ldPnsPmHlAYahM=";
+    hash = "sha256-1m7d1eLnoIDrja83sGKBh/u8ryZuw6lb1FEO+XNc03M=";
   };
 
   build-system = [ setuptools ];
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = {
     description = "Pytube fork with additional features and fixes";
     homepage = "https://github.com/JuanBindez/pytubefix";
-    changelog = "https://github.com/JuanBindez/pytubefix/releases/tag/v${version}";
+    changelog = "https://github.com/JuanBindez/pytubefix/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ youhaveme9 ];
   };
diff --git a/pkgs/development/python-modules/wxpython/4.2.nix b/pkgs/development/python-modules/wxpython/4.2.nix
index 6a5d3debaf40..b8c537ce0d71 100644
--- a/pkgs/development/python-modules/wxpython/4.2.nix
+++ b/pkgs/development/python-modules/wxpython/4.2.nix
@@ -108,7 +108,7 @@ buildPythonPackage rec {
 
     export DOXYGEN=${doxygen}/bin/doxygen
     export PATH="${wxGTK}/bin:$PATH"
-    export SDL_CONFIG="${SDL.dev}/bin/sdl-config"
+    export SDL_CONFIG="${lib.getExe' (lib.getDev SDL) "sdl-config"}"
     export WAF=$PWD/bin/waf
 
     ${python.pythonOnBuildForHost.interpreter} build.py -v --use_syswx dox etg sip --nodoc build_py
diff --git a/pkgs/development/tools/unityhub/default.nix b/pkgs/development/tools/unityhub/default.nix
index 67b7b2c52f14..d4139e8fcfe7 100644
--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@@ -109,6 +109,7 @@ stdenv.mkDerivation rec {
 
         # Unity Editor 6000 specific dependencies
         harfbuzz
+        vulkan-loader
       ]
       ++ extraLibs pkgs;
   };
diff --git a/pkgs/games/bugdom/default.nix b/pkgs/games/bugdom/default.nix
index 76cf666873df..3c47f02131c2 100644
--- a/pkgs/games/bugdom/default.nix
+++ b/pkgs/games/bugdom/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
     # Expects SDL2.framework in specific location, which we don't have
-    "-DSDL2_INCLUDE_DIRS=${SDL2.dev}/include/SDL2"
+    "-DSDL2_INCLUDE_DIRS=${lib.getInclude SDL2}/include/SDL2"
   ];
 
   installPhase =
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index 92ee59c6891c..b614d3b37f0f 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   env.NIX_CFLAGS_COMPILE = toString [
-    "-I${SDL2.dev}/include/SDL2"
+    "-I${lib.getInclude SDL2}/include/SDL2"
     "-I${opusfile.dev}/include/opus"
   ];
   NIX_CFLAGS_LINK = [ "-lSDL2" ];
diff --git a/pkgs/servers/monitoring/laurel/default.nix b/pkgs/servers/monitoring/laurel/default.nix
index 3db35b40fb4a..6dd83daa56c3 100644
--- a/pkgs/servers/monitoring/laurel/default.nix
+++ b/pkgs/servers/monitoring/laurel/default.nix
@@ -3,31 +3,21 @@
   fetchFromGitHub,
   lib,
   rustPlatform,
-  fetchpatch2,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "laurel";
-  version = "0.6.5";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "threathunters-io";
     repo = "laurel";
     tag = "v${version}";
-    hash = "sha256-1UjIye+btsNtf9Klti/3frgO7M+D05WkC1iP+TPQkZk=";
+    hash = "sha256-fToxRAcZOZvuuzaaWSjweqEwdUu3K2EKXY0K2Qixqpo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-N5mgd2c/eD0QEUQ4Oe7JI/2yI0B1pawYfc4ZKZAu4Sk=";
-
-  patches = [
-    # https://github.com/threathunters-io/laurel/commit/d2fc51c83e78aecd5c4ce922582df649c2600e1e
-    # Unbreaks the userdb::test::userdb test. Will be part of the next release (likely v0.6.6).
-    (fetchpatch2 {
-      url = "https://github.com/threathunters-io/laurel/commit/d2fc51c83e78aecd5c4ce922582df649c2600e1e.patch?full_index=1";
-      hash = "sha256-OId5ZCF71ikoCSggyy3u4USR71onFJpirp53k4M17Vo=";
-    })
-  ];
+  cargoHash = "sha256-i5wsS7y65sIvICfgViVIAbQU9f1E0EmspX+YVKDSKOU=";
 
   postPatch = ''
     # Upstream started to redirect aarch64-unknown-linux-gnu to aarch64-linux-gnu-gcc
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d580b6bc0808..0c93505621a7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12815,10 +12815,6 @@ with pkgs;
 
   antimony = libsForQt5.callPackage ../applications/graphics/antimony { };
 
-  anup = callPackage ../applications/misc/anup {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   apkeep = callPackage ../tools/misc/apkeep {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
@@ -13421,6 +13417,16 @@ with pkgs;
     libName = "librewolf";
   };
 
+  librewolf-bin = wrapFirefox librewolf-bin-unwrapped {
+    pname = "librewolf-bin";
+    extraPrefsFiles = [
+      "${librewolf-bin-unwrapped}/lib/librewolf-bin-${librewolf-bin-unwrapped.version}/librewolf.cfg"
+    ];
+    extraPoliciesFiles = [
+      "${librewolf-bin-unwrapped}/lib/librewolf-bin-${librewolf-bin-unwrapped.version}/distribution/extra-policies.json"
+    ];
+  };
+
   firefox_decrypt = python3Packages.callPackage ../tools/security/firefox_decrypt { };
 
   floorp-unwrapped = import ../applications/networking/browsers/floorp {