diff --git a/ci/OWNERS b/ci/OWNERS
index 3b54070c55d9..95ce60428ebe 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -149,10 +149,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /nixos/modules/services/monitoring/amazon-cloudwatch-agent.nix @philipmw
 /nixos/tests/amazon-cloudwatch-agent.nix                       @philipmw
 
+# Monitoring
+/nixos/modules/services/monitoring/fluent-bit.nix @arianvp
+/nixos/tests/fluent-bit.nix                       @arianvp
+
 # nixos-rebuild-ng
 /pkgs/by-name/ni/nixos-rebuild-ng                 @thiagokokada
 
-
 # Updaters
 ## update.nix
 /maintainers/scripts/update.nix   @jtojnar
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 62dc60284c32..2c76a77283d6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13694,6 +13694,13 @@
     githubId = 10554636;
     name = "Braian A. Diez";
   };
+  linuxwhata = {
+    email = "linuxwhata@qq.com";
+    matrix = "@lwa:envs.net";
+    github = "linuxwhata";
+    githubId = 68576488;
+    name = "Zhou Ke";
+  };
   lionello = {
     email = "lio@lunesu.com";
     github = "lionello";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 135f562ba70a..269b308fc3f8 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -116,6 +116,8 @@
 
 - [Amazon CloudWatch Agent](https://github.com/aws/amazon-cloudwatch-agent), the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as [services.amazon-cloudwatch-agent](options.html#opt-services.amazon-cloudwatch-agent.enable).
 
+- [Fluent Bit](https://github.com/fluent/fluent-bit), a fast Log, Metrics and Traces Processor and Forwarder. Available as [services.fluent-bit](#opt-services.fluent-bit.enable).
+
 - [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](options.html#opt-programs.bat).
 
 - [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 3c13e2baa664..daad3727a341 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -934,6 +934,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix
   ./services/monitoring/gitwatch.nix
diff --git a/nixos/modules/services/monitoring/fluent-bit.nix b/nixos/modules/services/monitoring/fluent-bit.nix
new file mode 100644
index 000000000000..1766825e3fa6
--- /dev/null
+++ b/nixos/modules/services/monitoring/fluent-bit.nix
@@ -0,0 +1,103 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.fluent-bit;
+
+  yamlFormat = pkgs.formats.yaml { };
+in
+{
+  options.services.fluent-bit = {
+    enable = lib.mkEnableOption "Fluent Bit";
+    package = lib.mkPackageOption pkgs "fluent-bit" { };
+    configurationFile = lib.mkOption {
+      type = lib.types.path;
+      default = yamlFormat.generate "fluent-bit.yaml" cfg.settings;
+      defaultText = lib.literalExpression ''yamlFormat.generate "fluent-bit.yaml" cfg.settings'';
+      description = ''
+        Fluent Bit configuration. See
+        <https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/yaml>
+        for supported values.
+
+        {option}`configurationFile` takes precedence over {option}`settings`.
+
+        Note: Restricted evaluation blocks access to paths outside the Nix store.
+        This means detecting content changes for mutable paths (i.e. not input or content-addressed) can't be done.
+        As a result, `nixos-rebuild` won't reload/restart the systemd unit when mutable path contents change.
+        `systemctl restart fluent-bit.service` must be used instead.
+      '';
+      example = "/etc/fluent-bit/fluent-bit.yaml";
+    };
+    settings = lib.mkOption {
+      type = yamlFormat.type;
+      default = { };
+      description = ''
+        See {option}`configurationFile`.
+
+        {option}`configurationFile` takes precedence over {option}`settings`.
+      '';
+      example = {
+        service = {
+          grace = 30;
+        };
+        pipeline = {
+          inputs = [
+            {
+              name = "systemd";
+              systemd_filter = "_SYSTEMD_UNIT=fluent-bit.service";
+            }
+          ];
+          outputs = [
+            {
+              name = "file";
+              path = "/var/log/fluent-bit";
+              file = "fluent-bit.out";
+            }
+          ];
+        };
+      };
+    };
+    # See https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/yaml/service-section.
+    graceLimit = lib.mkOption {
+      type = lib.types.nullOr (
+        lib.types.oneOf [
+          lib.types.ints.positive
+          lib.types.str
+        ]
+      );
+      default = null;
+      description = ''
+        The grace time limit. Sets the systemd unit's `TimeoutStopSec`.
+
+        The `service.grace` option in the Fluent Bit configuration should be ≤ this option.
+      '';
+      example = 30;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # See https://github.com/fluent/fluent-bit/blob/v3.2.6/init/systemd.in.
+    systemd.services.fluent-bit = {
+      description = "Fluent Bit";
+      after = [ "network.target" ];
+      requires = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        # See https://nixos.org/manual/nixos/stable#sec-logging.
+        SupplementaryGroups = "systemd-journal";
+        ExecStart = utils.escapeSystemdExecArgs [
+          (lib.getExe cfg.package)
+          "--config"
+          cfg.configurationFile
+        ];
+        Restart = "always";
+        TimeoutStopSec = lib.mkIf (cfg.graceLimit != null) cfg.graceLimit;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/scrutiny.nix b/nixos/modules/services/monitoring/scrutiny.nix
index 3265d94f6cd3..121dfc0668ad 100644
--- a/nixos/modules/services/monitoring/scrutiny.nix
+++ b/nixos/modules/services/monitoring/scrutiny.nix
@@ -1,10 +1,11 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 let
   inherit (lib) maintainers;
   inherit (lib.meta) getExe;
   inherit (lib.modules) mkIf mkMerge;
   inherit (lib.options) literalExpression mkEnableOption mkOption mkPackageOption;
   inherit (lib.types) bool enum nullOr port str submodule;
+  inherit (utils) genJqSecretsReplacementSnippet;
 
   cfg = config.services.scrutiny;
   # Define the settings format used for this program
@@ -36,6 +37,11 @@ in
           Scrutiny settings to be rendered into the configuration file.
 
           See <https://github.com/AnalogJ/scrutiny/blob/master/example.scrutiny.yaml>.
+
+          Options containing secret data should be set to an attribute set
+          containing the attribute `_secret`. This attribute should be a string
+          or structured JSON with `quote = false;`, pointing to a file that
+          contains the value the option should be set to.
         '';
         default = { };
         type = submodule {
@@ -130,6 +136,11 @@ in
             Collector settings to be rendered into the collector configuration file.
 
             See <https://github.com/AnalogJ/scrutiny/blob/master/example.collector.yaml>.
+
+            Options containing secret data should be set to an attribute set
+            containing the attribute `_secret`. This attribute should be a string
+            or structured JSON with `quote = false;`, pointing to a file that
+            contains the value the option should be set to.
           '';
           default = { };
           type = submodule {
@@ -177,6 +188,9 @@ in
           SCRUTINY_WEB_DATABASE_LOCATION = "/var/lib/scrutiny/scrutiny.db";
           SCRUTINY_WEB_SRC_FRONTEND_PATH = "${cfg.package}/share/scrutiny";
         };
+        preStart = ''
+          ${genJqSecretsReplacementSnippet cfg.settings "/run/scrutiny/config.yaml"}
+        '';
         postStart = ''
           for i in $(seq 300); do
               if "${lib.getExe pkgs.curl}" --fail --silent --head "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}" >/dev/null; then
@@ -191,8 +205,10 @@ in
         '';
         serviceConfig = {
           DynamicUser = true;
-          ExecStart = "${getExe cfg.package} start --config ${settingsFormat.generate "scrutiny.yaml" cfg.settings}";
+          ExecStart = "${getExe cfg.package} start --config /run/scrutiny/config.yaml";
           Restart = "always";
+          RuntimeDirectory = "scrutiny";
+          RuntimeDirectoryMode = "0700";
           StateDirectory = "scrutiny";
           StateDirectoryMode = "0750";
         };
@@ -216,9 +232,14 @@ in
             COLLECTOR_VERSION = "1";
             COLLECTOR_API_ENDPOINT = cfg.collector.settings.api.endpoint;
           };
+          preStart = ''
+            ${genJqSecretsReplacementSnippet cfg.collector.settings "/run/scrutiny-collector/config.yaml"}
+          '';
           serviceConfig = {
             Type = "oneshot";
-            ExecStart = "${getExe cfg.collector.package} run --config ${settingsFormat.generate "scrutiny-collector.yaml" cfg.collector.settings}";
+            ExecStart = "${getExe cfg.collector.package} run --config /run/scrutiny-collector/config.yaml";
+            RuntimeDirectory = "scrutiny-collector";
+            RuntimeDirectoryMode = "0700";
           };
           startAt = cfg.collector.schedule;
         };
diff --git a/nixos/modules/services/networking/vdirsyncer.nix b/nixos/modules/services/networking/vdirsyncer.nix
index 692ce12c7a6c..325c7e60a11d 100644
--- a/nixos/modules/services/networking/vdirsyncer.nix
+++ b/nixos/modules/services/networking/vdirsyncer.nix
@@ -45,6 +45,7 @@ let
       }
       // (optionalAttrs (cfg'.user == null) {
         DynamicUser = true;
+        ProtectHome = true;
       })
       // (optionalAttrs (cfg'.additionalGroups != [ ]) {
         SupplementaryGroups = cfg'.additionalGroups;
@@ -63,7 +64,6 @@ let
       PrivateTmp = true;
       NoNewPrivileges = true;
       ProtectSystem = "strict";
-      ProtectHome = true;
       ProtectKernelTunables = true;
       ProtectKernelModules = true;
       ProtectControlGroups = true;
diff --git a/nixos/modules/services/security/paretosecurity.nix b/nixos/modules/services/security/paretosecurity.nix
index 66d5258b3880..cfcb89fb8f62 100644
--- a/nixos/modules/services/security/paretosecurity.nix
+++ b/nixos/modules/services/security/paretosecurity.nix
@@ -9,6 +9,7 @@
   options.services.paretosecurity = {
     enable = lib.mkEnableOption "[ParetoSecurity](https://paretosecurity.com) [agent](https://github.com/ParetoSecurity/agent) and its root helper";
     package = lib.mkPackageOption pkgs "paretosecurity" { };
+    trayIcon = lib.mkEnableOption "tray icon for ParetoSecurity";
   };
 
   config = lib.mkIf config.services.paretosecurity.enable {
@@ -39,5 +40,12 @@
       };
     };
 
+    systemd.user.services."paretosecurity-trayicon" = lib.mkIf config.services.paretosecurity.trayIcon {
+      wantedBy = [ "graphical-session.target" ];
+      serviceConfig = {
+        ExecStart = "${config.services.paretosecurity.package}/bin/paretosecurity trayicon";
+      };
+    };
+
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0526d9d361a3..2884fdc09d32 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -433,6 +433,7 @@ in {
     imports = [ ./firefox.nix ] ;
     _module.args.firefoxPackage = pkgs.floorp;
   };
+  fluent-bit = handleTest ./fluent-bit.nix {};
   fluentd = handleTest ./fluentd.nix {};
   fluidd = handleTest ./fluidd.nix {};
   fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
@@ -1051,7 +1052,7 @@ in {
   scaphandre = handleTest ./scaphandre.nix {};
   schleuder = handleTest ./schleuder.nix {};
   scion-freestanding-deployment = handleTest ./scion/freestanding-deployment {};
-  scrutiny = handleTest ./scrutiny.nix {};
+  scrutiny = runTest ./scrutiny.nix;
   sddm = handleTest ./sddm.nix {};
   sdl3 = handleTest ./sdl3.nix { };
   seafile = handleTest ./seafile.nix {};
@@ -1275,6 +1276,7 @@ in {
   vault-dev = handleTest ./vault-dev.nix {};
   vault-postgresql = handleTest ./vault-postgresql.nix {};
   vaultwarden = discoverTests (import ./vaultwarden.nix);
+  vdirsyncer = handleTest ./vdirsyncer.nix {};
   vector = handleTest ./vector {};
   velocity = runTest ./velocity.nix;
   vengi-tools = handleTest ./vengi-tools.nix {};
diff --git a/nixos/tests/fluent-bit.nix b/nixos/tests/fluent-bit.nix
new file mode 100644
index 000000000000..9dc68011ea85
--- /dev/null
+++ b/nixos/tests/fluent-bit.nix
@@ -0,0 +1,40 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+  {
+    name = "fluent-bit";
+
+    nodes.machine =
+      { config, pkgs, ... }:
+      {
+        services.fluent-bit = {
+          enable = true;
+          settings = {
+            pipeline = {
+              inputs = [
+                {
+                  name = "systemd";
+                  systemd_filter = "_SYSTEMD_UNIT=fluent-bit.service";
+                }
+              ];
+              outputs = [
+                {
+                  name = "file";
+                  path = "/var/log/fluent-bit";
+                  file = "fluent-bit.out";
+                }
+              ];
+            };
+          };
+        };
+
+        systemd.services.fluent-bit.serviceConfig.LogsDirectory = "fluent-bit";
+      };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("fluent-bit.service")
+      machine.wait_for_file("/var/log/fluent-bit/fluent-bit.out")
+    '';
+  }
+)
diff --git a/nixos/tests/glance.nix b/nixos/tests/glance.nix
index 83cc5fc5bd1d..455ef0868513 100644
--- a/nixos/tests/glance.nix
+++ b/nixos/tests/glance.nix
@@ -40,7 +40,7 @@
     machine_custom_port.wait_for_open_port(5678)
 
     soup = BeautifulSoup(machine_default.succeed("curl http://localhost:8080"))
-    expected_version = "${config.nodes.machine_default.services.glance.package.version}"
+    expected_version = "v${config.nodes.machine_default.services.glance.package.version}"
     assert any(a.text == expected_version for a in soup.select(".footer a"))
   '';
 
diff --git a/nixos/tests/paretosecurity.nix b/nixos/tests/paretosecurity.nix
index 9e4c11c5f5c9..176b6768270b 100644
--- a/nixos/tests/paretosecurity.nix
+++ b/nixos/tests/paretosecurity.nix
@@ -3,14 +3,58 @@
   name = "paretosecurity";
   meta.maintainers = [ lib.maintainers.zupo ];
 
-  nodes.machine =
+  nodes.terminal =
     { config, pkgs, ... }:
     {
+      imports = [ ./common/user-account.nix ];
+
       services.paretosecurity.enable = true;
     };
 
+  nodes.xfce =
+    { config, pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+
+      services.paretosecurity = {
+        enable = true;
+        trayIcon = true;
+      };
+
+      services.xserver.enable = true;
+      services.xserver.displayManager.lightdm.enable = true;
+      services.xserver.desktopManager.xfce.enable = true;
+
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
+
+      environment.systemPackages = [ pkgs.xdotool ];
+      environment.variables.XAUTHORITY = "/home/alice/.Xauthority";
+
+    };
+
+  enableOCR = true;
+
   testScript = ''
-    (status, out) = machine.execute("paretosecurity check")
-    assert status == 1, "paretosecurity did not return 1 on failing checks"
+    terminal.succeed(
+      "su -- alice -c 'paretosecurity check"
+      # Disable some checks that need intricate test setup so that this test
+      # remains simple and fast. Tests for all checks and edge cases available
+      # at https://github.com/ParetoSecurity/agent/tree/main/test/integration
+      + " --skip c96524f2-850b-4bb9-abc7-517051b6c14e"  # SecureBoot
+      + " --skip 37dee029-605b-4aab-96b9-5438e5aa44d8"  # Screen lock
+      + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption
+      + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date
+      + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed
+      + "'"
+    )
+
+    xfce.wait_for_x()
+    xfce.succeed("xdotool mousemove 850 10")
+    xfce.wait_for_text("Pareto Security")
+    xfce.succeed("xdotool click 1")
+    xfce.wait_for_text("Run Checks")
   '';
 }
diff --git a/nixos/tests/scrutiny.nix b/nixos/tests/scrutiny.nix
index a81dd60d8518..17d984f4c1ff 100644
--- a/nixos/tests/scrutiny.nix
+++ b/nixos/tests/scrutiny.nix
@@ -1,83 +1,98 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "scrutiny";
-    meta.maintainers = with lib.maintainers; [ jnsgruk ];
+{
+  name = "scrutiny";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
 
-    nodes = {
-      machine =
-        {
-          self,
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          services = {
-            scrutiny.enable = true;
-            scrutiny.collector.enable = true;
+  nodes = {
+    machine =
+      {
+        self,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services = {
+          scrutiny = {
+            enable = true;
+            settings = {
+              notify.urls = [
+                {
+                  _secret = pkgs.writeText "notify-script" "script://${pkgs.writeShellScript "touch-test-file" ''
+                    echo "HelloWorld" > /run/scrutiny/hello
+                  ''}";
+                }
+              ];
+            };
           };
-
-          environment.systemPackages =
-            let
-              seleniumScript =
-                pkgs.writers.writePython3Bin "selenium-script"
-                  {
-                    libraries = with pkgs.python3Packages; [ selenium ];
-                  }
-                  ''
-                    from selenium import webdriver
-                    from selenium.webdriver.common.by import By
-                    from selenium.webdriver.firefox.options import Options
-                    from selenium.webdriver.support.ui import WebDriverWait
-                    from selenium.webdriver.support import expected_conditions as EC
-
-                    options = Options()
-                    options.add_argument("--headless")
-                    service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
-
-                    driver = webdriver.Firefox(options=options, service=service)
-                    driver.implicitly_wait(10)
-                    driver.get("http://localhost:8080/web/dashboard")
-
-                    wait = WebDriverWait(driver, 10).until(
-                      EC.text_to_be_present_in_element(
-                        (By.TAG_NAME, "body"), "Drive health at a glance")
-                    )
-
-                    body_text = driver.find_element(By.TAG_NAME, "body").text
-                    assert "Temperature history for each device" in body_text
-
-                    driver.close()
-                  '';
-            in
-            with pkgs;
-            [
-              curl
-              firefox-unwrapped
-              geckodriver
-              seleniumScript
-            ];
+          scrutiny.collector.enable = true;
         };
-    };
-    # This is the test code that will check if our service is running correctly:
-    testScript = ''
-      start_all()
 
-      # Wait for Scrutiny to be available
-      machine.wait_for_unit("scrutiny")
-      machine.wait_for_open_port(8080)
+        environment.systemPackages =
+          let
+            seleniumScript =
+              pkgs.writers.writePython3Bin "selenium-script"
+                {
+                  libraries = with pkgs.python3Packages; [ selenium ];
+                }
+                ''
+                  from selenium import webdriver
+                  from selenium.webdriver.common.by import By
+                  from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.support.ui import WebDriverWait
+                  from selenium.webdriver.support import expected_conditions as EC
 
-      # Ensure the API responds as we expect
-      output = machine.succeed("curl localhost:8080/api/health")
-      assert output == '{"success":true}'
+                  options = Options()
+                  options.add_argument("--headless")
+                  service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
 
-      # Start the collector service to send some metrics
-      collect = machine.succeed("systemctl start scrutiny-collector.service")
+                  driver = webdriver.Firefox(options=options, service=service)
+                  driver.implicitly_wait(10)
+                  driver.get("http://localhost:8080/web/dashboard")
 
-      # Ensure the application is actually rendered by the Javascript
-      machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
-    '';
-  }
-)
+                  wait = WebDriverWait(driver, 10).until(
+                    EC.text_to_be_present_in_element(
+                      (By.TAG_NAME, "body"), "Drive health at a glance")
+                  )
+
+                  body_text = driver.find_element(By.TAG_NAME, "body").text
+                  assert "Temperature history for each device" in body_text
+
+                  driver.close()
+                '';
+          in
+          with pkgs;
+          [
+            curl
+            firefox-unwrapped
+            geckodriver
+            seleniumScript
+          ];
+      };
+  };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    # Wait for Scrutiny to be available
+    machine.wait_for_unit("scrutiny")
+    machine.wait_for_open_port(8080)
+
+    # Ensure the API responds as we expect
+    output = machine.succeed("curl localhost:8080/api/health")
+    assert output == '{"success":true}'
+
+    # Start the collector service to send some metrics
+    collect = machine.succeed("systemctl start scrutiny-collector.service")
+
+    # Ensure the application is actually rendered by the Javascript
+    machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
+
+    # Test notification and genJqSecretsReplacementSnippet
+    machine.succeed("curl -X POST http://localhost:8080/api/health/notify")
+    machine.wait_for_file("/run/scrutiny/hello")
+    output = machine.succeed("cat /run/scrutiny/hello")
+    assert "HelloWorld" in output
+  '';
+}
diff --git a/nixos/tests/vdirsyncer.nix b/nixos/tests/vdirsyncer.nix
new file mode 100644
index 000000000000..1267967dac97
--- /dev/null
+++ b/nixos/tests/vdirsyncer.nix
@@ -0,0 +1,300 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+  let
+
+    radicale_calendars = {
+      type = "caldav";
+      url = "http://localhost:5232/";
+      # Radicale needs username/password.
+      username = "alice";
+      password = "password";
+    };
+
+    radicale_contacts = {
+      type = "carddav";
+      url = "http://localhost:5232/";
+      # Radicale needs username/password.
+      username = "alice";
+      password = "password";
+    };
+
+    xandikos_calendars = {
+      type = "caldav";
+      url = "http://localhost:8080/user/calendars";
+      # Xandikos warns
+      # > No current-user-principal returned, re-using URL http://localhost:8080/user/calendars/
+      # but we do not need username/password.
+    };
+
+    xandikos_contacts = {
+      type = "carddav";
+      url = "http://localhost:8080/user/contacts";
+    };
+
+    local_calendars = {
+      type = "filesystem";
+      path = "~/calendars";
+      fileext = ".ics";
+    };
+
+    local_contacts = {
+      type = "filesystem";
+      path = "~/contacts";
+      fileext = ".vcf";
+    };
+
+    mkPairs = a: b: {
+      calendars = {
+        a = "${a}_calendars";
+        b = "${b}_calendars";
+        collections = [
+          "from a"
+          "from b"
+        ];
+      };
+      contacts = {
+        a = "${a}_contacts";
+        b = "${b}_contacts";
+        collections = [
+          "from a"
+          "from b"
+        ];
+      };
+    };
+
+    mkRadicaleProps =
+      tag:
+      pkgs.writeText "Radicale.props" (
+        builtins.toJSON {
+          inherit tag;
+        }
+      );
+
+    writeLines =
+      name: eol: lines:
+      pkgs.writeText name (lib.concatMapStrings (l: "${l}${eol}") lines);
+
+    prodid = "-//NixOS test//EN";
+    dtstamp = "20231129T194743Z";
+
+    writeICS =
+      {
+        uid,
+        summary,
+        dtstart,
+        dtend,
+      }:
+      writeLines "${uid}.ics" "\r\n" [
+        "BEGIN:VCALENDAR"
+        "VERSION:2.0"
+        "PRODID:${prodid}"
+        "BEGIN:VEVENT"
+        "UID:${uid}"
+        "SUMMARY:${summary}"
+        "DTSTART:${dtstart}"
+        "DTEND:${dtend}"
+        "DTSTAMP:${dtstamp}"
+        "END:VEVENT"
+        "END:VCALENDAR"
+      ];
+
+    foo_ics = writeICS {
+      uid = "foo";
+      summary = "Epochalypse";
+      dtstart = "19700101T000000Z";
+      dtend = "20380119T031407Z";
+    };
+
+    bar_ics = writeICS {
+      uid = "bar";
+      summary = "One Billion Seconds";
+      dtstart = "19700101T000000Z";
+      dtend = "20010909T014640Z";
+    };
+
+    writeVCF =
+      {
+        uid,
+        name,
+        displayName,
+        email,
+      }:
+      writeLines "${uid}.vcf" "\r\n" [
+        # One of the tools enforces this order of fields.
+        "BEGIN:VCARD"
+        "VERSION:4.0"
+        "UID:${uid}"
+        "EMAIL;TYPE=INTERNET:${email}"
+        "FN:${displayName}"
+        "N:${name}"
+        "END:VCARD"
+      ];
+
+    foo_vcf = writeVCF {
+      uid = "foo";
+      name = "Doe;John;;;";
+      displayName = "John Doe";
+      email = "john.doe@example.org";
+    };
+
+    bar_vcf = writeVCF {
+      uid = "bar";
+      name = "Doe;Jane;;;";
+      displayName = "Jane Doe";
+      email = "jane.doe@example.org";
+    };
+
+  in
+  {
+    name = "vdirsyncer";
+
+    meta.maintainers = with lib.maintainers; [ schnusch ];
+
+    nodes = {
+      machine = {
+        services.radicale = {
+          enable = true;
+          settings.auth.type = "none";
+        };
+
+        services.xandikos = {
+          enable = true;
+          extraOptions = [ "--autocreate" ];
+        };
+
+        services.vdirsyncer = {
+          enable = true;
+          jobs = {
+
+            alice = {
+              user = "alice";
+              group = "users";
+              config = {
+                statusPath = "/home/alice/.vdirsyncer";
+                storages = {
+                  inherit
+                    local_calendars
+                    local_contacts
+                    radicale_calendars
+                    radicale_contacts
+                    ;
+                };
+                pairs = mkPairs "local" "radicale";
+              };
+              forceDiscover = true;
+            };
+
+            bob = {
+              user = "bob";
+              group = "users";
+              config = {
+                statusPath = "/home/bob/.vdirsyncer";
+                storages = {
+                  inherit
+                    local_calendars
+                    local_contacts
+                    xandikos_calendars
+                    xandikos_contacts
+                    ;
+                };
+                pairs = mkPairs "local" "xandikos";
+              };
+              forceDiscover = true;
+            };
+
+            remote = {
+              config = {
+                storages = {
+                  inherit
+                    radicale_calendars
+                    radicale_contacts
+                    xandikos_calendars
+                    xandikos_contacts
+                    ;
+                };
+                pairs = mkPairs "radicale" "xandikos";
+              };
+              forceDiscover = true;
+            };
+
+          };
+        };
+
+        users.users = {
+          alice.isNormalUser = true;
+          bob.isNormalUser = true;
+        };
+      };
+    };
+
+    testScript = ''
+      def run_unit(name):
+          machine.systemctl(f"start {name}")
+          # The service is Type=oneshot without RemainAfterExit=yes. Once it
+          # is finished it is no longer active and wait_for_unit will fail.
+          # When that happens we check if it actually failed.
+          try:
+              machine.wait_for_unit(name)
+          except:
+              machine.fail(f"systemctl is-failed {name}")
+
+      start_all()
+
+      machine.wait_for_open_port(5232)
+      machine.wait_for_open_port(8080)
+      machine.wait_for_unit("multi-user.target")
+
+      with subtest("alice -> radicale"):
+          # vdirsyncer cannot create create collections on Radicale,
+          # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
+          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/foocal/.Radicale.props")
+          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/foocard/.Radicale.props")
+
+          machine.succeed("runuser -u alice -- install -Dm 644 ${foo_ics} /home/alice/calendars/foocal/foo.ics")
+          machine.succeed("runuser -u alice -- install -Dm 644 ${foo_vcf} /home/alice/contacts/foocard/foo.vcf")
+          run_unit("vdirsyncer@alice.service")
+
+          # test statusPath
+          machine.succeed("test -d /home/alice/.vdirsyncer")
+          machine.fail("test -e /var/lib/private/vdirsyncer/alice")
+
+      with subtest("bob -> xandikos"):
+          # I suspect Radicale shares the namespace for calendars and
+          # contacts, but Xandikos separates them. We just use `barcal` and
+          # `barcard` with Xandikos as well to avoid conflicts.
+          machine.succeed("runuser -u bob -- install -Dm 644 ${bar_ics} /home/bob/calendars/barcal/bar.ics")
+          machine.succeed("runuser -u bob -- install -Dm 644 ${bar_vcf} /home/bob/contacts/barcard/bar.vcf")
+          run_unit("vdirsyncer@bob.service")
+
+          # test statusPath
+          machine.succeed("test -d /home/bob/.vdirsyncer")
+          machine.fail("test -e /var/lib/private/vdirsyncer/bob")
+
+      with subtest("radicale <-> xandikos"):
+          # vdirsyncer cannot create create collections on Radicale,
+          # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
+          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/barcal/.Radicale.props")
+          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/barcard/.Radicale.props")
+
+          run_unit("vdirsyncer@remote.service")
+
+          # test statusPath
+          machine.succeed("test -d /var/lib/private/vdirsyncer/remote")
+
+      with subtest("radicale -> alice"):
+          run_unit("vdirsyncer@alice.service")
+
+      with subtest("xandikos -> bob"):
+          run_unit("vdirsyncer@bob.service")
+
+      with subtest("compare synced files"):
+          # iCalendar files get reordered
+          machine.succeed("diff -u --strip-trailing-cr <(sort /home/alice/calendars/foocal/foo.ics) <(sort /home/bob/calendars/foocal/foo.ics) >&2")
+          machine.succeed("diff -u --strip-trailing-cr <(sort /home/bob/calendars/barcal/bar.ics) <(sort /home/alice/calendars/barcal/bar.ics) >&2")
+
+          machine.succeed("diff -u --strip-trailing-cr /home/alice/contacts/foocard/foo.vcf /home/bob/contacts/foocard/foo.vcf >&2")
+          machine.succeed("diff -u --strip-trailing-cr /home/bob/contacts/barcard/bar.vcf /home/alice/contacts/barcard/bar.vcf >&2")
+    '';
+  }
+)
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 94a8a410f9fe..4928f5c7b88e 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5904,6 +5904,19 @@ final: prev:
     meta.hydraPlatforms = [ ];
   };
 
+  houdini-nvim = buildVimPlugin {
+    pname = "houdini.nvim";
+    version = "2024-08-06";
+    src = fetchFromGitHub {
+      owner = "TheBlob42";
+      repo = "houdini.nvim";
+      rev = "1b7ec0a713a2aa9965848d8b93f66dc93716fd1c";
+      sha256 = "05np3p0lnsra6c6vx3h81vrba3nhwxrqb5l3qkdbx5bl58dds9bn";
+    };
+    meta.homepage = "https://github.com/TheBlob42/houdini.nvim";
+    meta.hydraPlatforms = [ ];
+  };
+
   hover-nvim = buildVimPlugin {
     pname = "hover.nvim";
     version = "2024-12-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 1f111ca7a914..c8dcabe943a0 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -452,6 +452,7 @@ https://github.com/edluffy/hologram.nvim/,,
 https://github.com/urbit/hoon.vim/,,
 https://github.com/smoka7/hop.nvim/,,
 https://github.com/rktjmp/hotpot.nvim/,,
+https://github.com/TheBlob42/houdini.nvim/,HEAD,
 https://github.com/lewis6991/hover.nvim/,HEAD,
 https://github.com/othree/html5.vim/,HEAD,
 https://github.com/julienvincent/hunk.nvim/,HEAD,
diff --git a/pkgs/applications/networking/cluster/rke2/1_29/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_29/images-versions.json
new file mode 100644
index 000000000000..d51126a5f43b
--- /dev/null
+++ b/pkgs/applications/networking/cluster/rke2/1_29/images-versions.json
@@ -0,0 +1,122 @@
+{
+  "images-calico-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "4b3743795b3fb431c53f183d43b004925ff06863bd95e9fbf3949c5c5092c7bd"
+  },
+  "images-calico-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "eca2ac2eda2fcaf055f54dfc1baf7f21a88f3454a84716d8d0f57574f2a36664"
+  },
+  "images-calico-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "d2baf446c4ec832bf870d57bc7cfd496de6bd1df3cc26b83ea7853a8e6e85de9"
+  },
+  "images-calico-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "18922628e7c9a9045b60393fe049a01ec2137b80b3312ea09735bce978ae88c8"
+  },
+  "images-canal-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "351c2c73acc9a88869735430b604a60237122e778f5eb95c503530e8cc42d790"
+  },
+  "images-canal-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "a8b0825efd30f2e4ee0e82730d820b5ab0e2074b76d99a4662555726440a1542"
+  },
+  "images-canal-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "5a43dd70e1efac0ee0deeb5637b8fd8b19c4f70b5854d9af69dde7299c7315c0"
+  },
+  "images-canal-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "d42f6de81cc2a0ca8cb8716189c782c58de3ec7f6159ac240228755bfc586b4a"
+  },
+  "images-cilium-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "b8ead14a0c131f9a91997635670cb03191c4f4e4b14bee77fe0da0b9629d5b01"
+  },
+  "images-cilium-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "b89382ac45f36536ff8d458d74938f6558f510f7bed5cebbaf0834abbb81d03d"
+  },
+  "images-cilium-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "f6918df76be1395bb193091d5a356555284da56294f0ab6ed6e2c5f11bf9ddbb"
+  },
+  "images-cilium-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "7715c4073dfbba766605ec16aa238a7e171b53def9933e9e3cd6c69780dc669c"
+  },
+  "images-core-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "2d138c9f5c08e0783bcec973de388e21cb0733a30a8f87123662f155e22d1cb6"
+  },
+  "images-core-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "2eaae797f44ab269b271fa9fb0f02ecaf14d1209c16d83b395d9549b736c149d"
+  },
+  "images-core-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "caee89bef5f95aa812de8314cc8612b525840b98e7e654c7b256277df7faaf07"
+  },
+  "images-core-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "252cbe2f8f7d262a884094411b84a0e98b16886d2c0e13edea02b81993395283"
+  },
+  "images-flannel-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "1495baefc0b8d727e5baf16b71a56f3d8a9dee414e614e7511fd9ca629e6146f"
+  },
+  "images-flannel-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "925e1b36c1d1fd65e61de76f21816866dd539a3345e29ba9aca8a66b6aa1e135"
+  },
+  "images-flannel-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "fcf737645558c91d525fc8c855c3f674fa0c0dea2d2114b67d2df8236c1905ca"
+  },
+  "images-flannel-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "a1eda6aba79af9eb58614d656106196c9159253bb17f1418ee23c4eabf400410"
+  },
+  "images-harvester-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "3aff7d410d88fbffed80642c044958601e325a7fb3b5f11b7b989179659b8f14"
+  },
+  "images-harvester-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "3d7a80dc64e96c27fd5fe4210c02357c7f2870d25b8067338f45b12c92d80d9f"
+  },
+  "images-harvester-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "4fbefae4e2fd15e97e81f4a6eaa1b407d39125caaf60feb766197b1914afbef6"
+  },
+  "images-harvester-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "d1644e15125da089225372f44d9c537f5c4ac3b298024ecda0b1537bc245f896"
+  },
+  "images-multus-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "2327286a7d695c0596e7536018710373aff10c3f1adc847f07f820c33b68ad81"
+  },
+  "images-multus-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "2d5cb1b383aa2a6bb840d185e01a09e7d667b05c91e4be42a04dffa5cd6b4d92"
+  },
+  "images-multus-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "9bbd253fdb9fd7913569b651c2591e2b97bdd3b98d0398bcc563a09f1387d6a3"
+  },
+  "images-multus-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "ce929e823814cda57d187a219dc2719cbab390bf2a2d939e44d48d70f288d25c"
+  },
+  "images-vsphere-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "d405c544026e9aac8edad7cc64abcb4c20578a3abb8aff114910df3161aac28a"
+  },
+  "images-vsphere-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.29.14%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "d71d9dbc916988b2d9236c56ed46dfdd269db892bcbf8e5e11675d851ec7a3f6"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/rke2/1_29/versions.nix b/pkgs/applications/networking/cluster/rke2/1_29/versions.nix
index 778b8e11ef97..c22c6bece1b5 100644
--- a/pkgs/applications/networking/cluster/rke2/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_29/versions.nix
@@ -8,4 +8,5 @@
   pauseVersion = "3.6";
   ccmVersion = "v1.29.10-0.20241016053521-9510ac25fefb-build20241016";
   dockerizedVersion = "v1.29.14-rke2r1";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_30/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_30/images-versions.json
new file mode 100644
index 000000000000..2de4c9d6d9be
--- /dev/null
+++ b/pkgs/applications/networking/cluster/rke2/1_30/images-versions.json
@@ -0,0 +1,138 @@
+{
+  "images-calico-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "ad47733ffcfa7194ff3f8e9b1aad4028868b6def24bfc613d30104dfbaa103d2"
+  },
+  "images-calico-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "fda9d7d50ed44dd15a31b74720fa71fa5d6d504091a47bfa6f766adbeaf5eb08"
+  },
+  "images-calico-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "bb01eca1bb1a30e2ef83d4c528934a445e56e7e4c38d4ba795699827bcab1f79"
+  },
+  "images-calico-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "020b55868818efbf5b27854416ad2f5c71a757c674a49e493f44c1b4146b16cf"
+  },
+  "images-canal-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "827fe2baa8ba2429cc5a6853c7447461e0452ad46bae46e47ab53d078c34856c"
+  },
+  "images-canal-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "931a778ff65cfca3b76bddf65d71792422d6ffe0abc6feecc1ca8923555550a3"
+  },
+  "images-canal-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "49d4502fab5236c7b96f07636349f902d781c55d03ecd2e563a8f7e544fd30af"
+  },
+  "images-canal-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "f75946b503600b0ca1b24f0da7355ece0a96380772fdc8c75f94ab6839bc559f"
+  },
+  "images-cilium-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "000c57f474e1b70a81dc7f0b831fd01cb8d147664e00eff566ab8d89fa9caf8a"
+  },
+  "images-cilium-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "00a5971a62c02e192de910f6c5f1cd230d23547335d94399fa306a355e23750f"
+  },
+  "images-cilium-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "da8793a53ac5c64387872db810d3b94f11ba063af6e11b48ac6df2a943ea8f79"
+  },
+  "images-cilium-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "85e78feaeac5dba9ef18eac8dd42081afe4f0bffe11921dbfd6b7cc585ca1496"
+  },
+  "images-core-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "c5c4c7389312642c6dc9ef3a07d954be5d3776a8fc1e6df90bb46eb95fd75513"
+  },
+  "images-core-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "8ec619a8b458c27f14bfdb796b1aa399ed34b7db176ea3ae64ba20189f529835"
+  },
+  "images-core-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "413566078e9315aa5d9339e6fb1f7859aea399a7f7934019aa7b1229e223e293"
+  },
+  "images-core-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "586a55ed0aff2bd149bd2a5ad586177ba78814a7da8acb0640365bffaa5c39bb"
+  },
+  "images-flannel-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "6eaa3a7f058abd192eab13533cc47a47d4571eee3f6f688f1c316c8a62c1f9d8"
+  },
+  "images-flannel-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "42e2f3ce038d7262afcea8c5603f59bd501653e6dcbcbf571e71c8637a85297a"
+  },
+  "images-flannel-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "e2a9164923bec9998879224c74edf36fa14e6534cddb20220f399679c28348ef"
+  },
+  "images-flannel-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "8b49d5670be6794813d70fbebf1b681d8d0661ada1cd15d74bf08d6302a85898"
+  },
+  "images-harvester-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "5c0e2ab04cf30e6e862f88d75cc2c5130da68d893be723f91212b9b49caa2a60"
+  },
+  "images-harvester-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "787ae168c950c6d5a10296511fc4a54d819f4587a8ffaaccafd766ea5252cc4d"
+  },
+  "images-harvester-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "89d2713b0843eb9638f3d242fd3d8f6a4ceb35d83c62067940d8624025fbfc0f"
+  },
+  "images-harvester-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "64c2a373c19ed7fc0254e24ce8d9dae4ae21826fea9094b14ece90471706b753"
+  },
+  "images-multus-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "20e1811dae1c233a836162b432540cb3e2f974aecf0d1b57bcf79d4b269a8531"
+  },
+  "images-multus-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "025ded7faf603991975c4f17708b0887bffbc265aa5546e6df96ab625ebb65ac"
+  },
+  "images-multus-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "e8919421560a548576eed90c9d442d84ce1a3cfab0739cd98c400f7ed17876d9"
+  },
+  "images-multus-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "55bb64bd256ac9a185db583d4dd178a609cb8a047123dbae5aadf9b56183f99b"
+  },
+  "images-traefik-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "c219b1c1fb311b2e0981c2c280e0e51e7b0e2081f5521ed0dedcc25aeaf701f4"
+  },
+  "images-traefik-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "5118c0fe338141c154eca5386db49b40d55f29a07d77486e6f82117c433176ae"
+  },
+  "images-traefik-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "0b618a0a48ffb91d61dc0f685dc1a0859ed7824c5ac315b7a62856cdd1282a83"
+  },
+  "images-traefik-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "24f90b544f5b962ca35333b9ae6bb3b1b5ce0bf0d270d006cad7c8c6ffa3f011"
+  },
+  "images-vsphere-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "93f668a01a753c40b72ba9936909bf49bc2c6c857bdb900eef22f237a2600d07"
+  },
+  "images-vsphere-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.30.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "e68ff9127360537ef0f351741fbbd27b6fe927cf792a0a80c25a9a78f1aeeab1"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/rke2/1_30/versions.nix b/pkgs/applications/networking/cluster/rke2/1_30/versions.nix
index 6565e4b3550d..3ac7c852a755 100644
--- a/pkgs/applications/networking/cluster/rke2/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_30/versions.nix
@@ -8,4 +8,5 @@
   pauseVersion = "3.6";
   ccmVersion = "v1.30.6-0.20241016053533-5ec454f50e7a-build20241016";
   dockerizedVersion = "v1.30.10-rke2r1";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_31/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_31/images-versions.json
new file mode 100644
index 000000000000..fb9af4ff20df
--- /dev/null
+++ b/pkgs/applications/networking/cluster/rke2/1_31/images-versions.json
@@ -0,0 +1,138 @@
+{
+  "images-calico-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "5a3b85760345b131e733be993b5a7fff7b244095d04d1f3b09085167eda5ec48"
+  },
+  "images-calico-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "3c4b349c4c5dcf77d5c064ac7d8e7cd17b86575f1861d423f02f5e5dde4bab2a"
+  },
+  "images-calico-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "11db0d5a766421ffd11009f78444d42f20fca5ddc35654aaadcc32aae31f487b"
+  },
+  "images-calico-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "d1570a698616ee0f9dc430e6374f299fc93b0b53da7b61f9b0e0e66562ddb001"
+  },
+  "images-canal-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "d26574208df6e8196066620c12854c73ec3f9d92ae927ba401447f54bbd9bf65"
+  },
+  "images-canal-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "b5945ac08d74bcc67415efc1c293b2af119befe04f377880eb045ca7dcf4276c"
+  },
+  "images-canal-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "8a63fe4069c811d94004132afa16fb21b8ca1548eba075529ef3d812b682119a"
+  },
+  "images-canal-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "8cbb92e40590b372cb1b962de2c2e8d6b92d26bd5d9b71aee577865587e46e56"
+  },
+  "images-cilium-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "f989d984753b166cffbfaec8866ec9b28ca852978de737f5195cd8da929fbd31"
+  },
+  "images-cilium-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "784b5817f5f8ab4226cbce3d074d467d397dd0ed0ed6397e4c1be0a327423f13"
+  },
+  "images-cilium-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "b4dc7787e43d3148cd45f56ba2197469b9901e710a844b49024e7d675862f1d8"
+  },
+  "images-cilium-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "209d566b382c6c8af5ddfd2350228ec0669b341ce503ac001cc79928add3accd"
+  },
+  "images-core-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "e8e687f3063cfdc7e6f93feffc0a2e63b90f3228c4f6c85532d4e1f436fbaeb7"
+  },
+  "images-core-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "2faf4f9ee2e77b7db6963147d3685197f32f6af5b3dd2305221273bcfefa5af9"
+  },
+  "images-core-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "1d514169c112dd295a03f22ba35905edd0c550e0b09ef5191b9389bb7fd1a945"
+  },
+  "images-core-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "b4e3cfe5f250dcdb1daa02002d4caf9349add11c4392df644c9fb16c5605ffd9"
+  },
+  "images-flannel-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "1f069844a35857e264065c2e5f9157b1005fda3eb7dcffd20e2218f7ab64c250"
+  },
+  "images-flannel-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "1bd4e97a5391916cf703d8503d51f05c8db1fe5e130a718fe8fefb4cf8d95e4b"
+  },
+  "images-flannel-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "c49971bcc55765e3ac036f59cb6df5158efcb664d4fc5a3e0f7f40e962e5b153"
+  },
+  "images-flannel-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "9dc874dc452cd3c28cb313c70b1cbfb465195b4c308d893555b1fb8b20296756"
+  },
+  "images-harvester-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "4837a8c559fca6e31436128040b99e90f3ab2210022f02a618405ccfc7185e7a"
+  },
+  "images-harvester-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "a38aa37f2f8362055ef5dfa16a3c4d9f85eaed6e1b56b928bb4888c52e96b76f"
+  },
+  "images-harvester-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "beea6e39cc1f522b59de42598a8431ee006292bb6568cb8a0b46ed614225264d"
+  },
+  "images-harvester-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "cf7f030fd86fcc2425a7a7819c523f6497eae59066fab04a56d8f1cf01c7aac2"
+  },
+  "images-multus-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "d473aee06f24d49d1d6b6baee9bfd2079036ef40c0cda126a83851078b0f7e40"
+  },
+  "images-multus-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "18957569b6a5fa5aab5fd4dc180fec8b403cae2c07ee07b18505a5f6901d5e5b"
+  },
+  "images-multus-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "b5acbce9e9ccd2213807bd27896a6d6b29795dd2f55e5b2281a77dfa41366a60"
+  },
+  "images-multus-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "eb7ea1b45d01cab215a1bba7bfc223ed03c16d1383a5e0df141e5ecee9708def"
+  },
+  "images-traefik-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "2b29e30e1daac4277da7f6a27ad021e0380a4585278d7e8440b38b2e1207ee68"
+  },
+  "images-traefik-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "70147f487109bd7e4db5b525a8a2a01030f3a6e985e4ce06e8c28dd98e6ff131"
+  },
+  "images-traefik-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "15c03df525be312caac8431bfb9d0a3842834b25faf0551bc8e185337d623522"
+  },
+  "images-traefik-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "4b53b94f2dbdc142987718dff210d381cb6d38ad01846278654d77ec1f6f44f0"
+  },
+  "images-vsphere-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "169828a17efdd4a14682c49c0bed437bcec6cde27378d985e15ecbfdfa1523e4"
+  },
+  "images-vsphere-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.31.6%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "4f7663357f47f696eaf2de34d980ba3aebaa8e42de635e17736ae1ef6c58629c"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/rke2/1_31/versions.nix b/pkgs/applications/networking/cluster/rke2/1_31/versions.nix
index 3de4683cd6a3..b5db3ba59059 100644
--- a/pkgs/applications/networking/cluster/rke2/1_31/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_31/versions.nix
@@ -8,4 +8,5 @@
   pauseVersion = "3.6";
   ccmVersion = "v1.31.2-0.20241016053446-0955fa330f90-build20241016";
   dockerizedVersion = "v1.31.6-rke2r1";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
new file mode 100644
index 000000000000..5f81c0449535
--- /dev/null
+++ b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
@@ -0,0 +1,138 @@
+{
+  "images-calico-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "a5bbae876483eac841d0c86d07b9a2f681d14ceba49127d86f206c60416dea02"
+  },
+  "images-calico-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "f5bb26e2d2c755b19459af960c5e06f45771f95c257aa40aa206d65712664784"
+  },
+  "images-calico-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "8a1854a27c1269628a2318ef9b200f861a3a9b390948ac50340d1fa2c338c22d"
+  },
+  "images-calico-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "844d7ed5be7525971de7612980a49f0c326be638dbd59146bf22d02b65687ac6"
+  },
+  "images-canal-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "052ffd11c271daf158361d6b2ad99b8c2a7b30d110e6530b3db1d08a809861b9"
+  },
+  "images-canal-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "c4f2434302fa287e13385d3c7f50ec0b3f9989cf8a16a70f5d0c85232570371a"
+  },
+  "images-canal-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "433d22412cdeadaf3dad899517af66aaf2167c096c95ef2462b0b2ed74bbd036"
+  },
+  "images-canal-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "445cd57b28cc69f487e95698c84c4339729a5a6f11fd36d57b37cc3ef49d11ab"
+  },
+  "images-cilium-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "e6facccbc711757982f5b625427e04e286671a14be7fed13647d7ce59fdd6f5b"
+  },
+  "images-cilium-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "745216763991e712800edb5f04ba0a3a647a73e5076d28237cd44064da0254e8"
+  },
+  "images-cilium-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "3ab86ac3c021681ee1cb10d0d7bb4dd05f96830ea84e8bfdd1d5c239e1c1db00"
+  },
+  "images-cilium-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "b160d69f45818dbc8526aa92784c935c471863d9d6ad5f83a434419cee0d1dd1"
+  },
+  "images-core-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "5da5bc70814ae25f55e75d194d3e56eed9d48d2e2bd50cce329f72a8658a2c71"
+  },
+  "images-core-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "9542793ad13822d02bc5b3aef237c21cb8ea807cde8c1f7edd50c9c8de3257a1"
+  },
+  "images-core-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "b48c79e0e68d7c8ae3dd52f6647f4f859eb0a81e4cb81ca98a08788a3eeb208c"
+  },
+  "images-core-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "97ebc6e37d73d2fefbd861ae9e44a97c649c5876def02fa0e99b136e4cc43834"
+  },
+  "images-flannel-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "cebc30d3648804c8f6a57de63b7a8c6dd131e2338e4c7e40bb4a3a4ec9962033"
+  },
+  "images-flannel-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "2caa2ba283f683070cedfbcef4058a0172541c0675d2582cffc09a8ab97c3af8"
+  },
+  "images-flannel-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "cbbbadf33bb38b22340db52c7f72e2685ad20f64f27a31eb3c90ae2575ac676d"
+  },
+  "images-flannel-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "db13267b1bf8d27003f6056cea683e34af4ff3743d05de7f84bfb089cc2e28ad"
+  },
+  "images-harvester-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "b54b4ba783469334a492fdb4f2cfb68ce4a57a7f700d27d060d11213bb026a33"
+  },
+  "images-harvester-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "68e232d40c9ddb67ce17181e48e8accd6be6b55ee01d78937100ce3faf3f7042"
+  },
+  "images-harvester-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "3847f03a2351ed9182ae52b0b03f8cf7705123b301f1cc4d7da01cfd2359f743"
+  },
+  "images-harvester-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "abdae17a19b8da8aeda83e434052c86e4be24bb37dc64c696e42ed59dac9d3c9"
+  },
+  "images-multus-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "712ff37f4ea472c485fa887ab6b60df441ebda40c7b6bc66c28433b52f69a0d9"
+  },
+  "images-multus-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "e556ae1d1db3923e57a050da3a9176fa9e7c3a0378229f7dd7a1c34145e8b96e"
+  },
+  "images-multus-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "0308c83ee9f8affa237cc7b528639558e18b9fdbf5a914220f1c1818654c5874"
+  },
+  "images-multus-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "d420a305e3d5b95f05da90177484df38b7178381acdb0806bd17aa2612a26583"
+  },
+  "images-traefik-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "39f6f02a012e24237b8ed0106d83f6248f133a6d83feaca2aaf4c692b31edd94"
+  },
+  "images-traefik-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "8608cd8d01fd2ad00fcc28bf7a9a54e89f96b2d0efe45ea6ce940fefc22ba36e"
+  },
+  "images-traefik-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "3a47c3207fcf3e670f8b58262aecb777d63a56f744feb3b99612d86516f63f90"
+  },
+  "images-traefik-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "afd2e4c6066fcbbde4d7cb2245cdc18542b9f510e8908c4ffe07181a459d6703"
+  },
+  "images-vsphere-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "5c5531032ded256f0834169fe4db65e698ef4b44a76128b9aec174d8cc24d6e0"
+  },
+  "images-vsphere-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "5f38ba2a8060f82ee407edb77433afb53635798f1be6f1fa53fbe9921c2eb3a0"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
index b7ac710b54a6..84e6091e6cd2 100644
--- a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
@@ -8,4 +8,5 @@
   pauseVersion = "3.6";
   ccmVersion = "v1.32.0-rc3.0.20241220224140-68fbd1a6b543-build20250101";
   dockerizedVersion = "v1.32.2-rke2r1";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index 88003eebcbde..3fc25f67480a 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -10,6 +10,7 @@ lib:
   pauseVersion,
   ccmVersion,
   dockerizedVersion,
+  imagesVersions,
 }:
 
 # Build dependencies
@@ -20,6 +21,7 @@ lib:
   go,
   makeWrapper,
   fetchzip,
+  fetchurl,
 
   # Runtime dependencies
   procps,
@@ -118,18 +120,19 @@ let
 
     doCheck = false;
 
-    passthru.updateScript = updateScript;
-
-    passthru.tests =
-      {
-        version = testers.testVersion {
-          package = rke2;
-          version = "v${version}";
+    passthru = {
+      inherit updateScript;
+      tests =
+        {
+          version = testers.testVersion {
+            package = rke2;
+            version = "v${version}";
+          };
+        }
+        // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+          inherit (nixosTests) rke2;
         };
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        inherit (nixosTests) rke2;
-      };
+    } // (lib.mapAttrs (_: value: fetchurl value) imagesVersions);
 
     meta = with lib; {
       homepage = "https://github.com/rancher/rke2";
diff --git a/pkgs/applications/networking/cluster/rke2/update-script.sh b/pkgs/applications/networking/cluster/rke2/update-script.sh
index f14214369e65..fa1023bcdb9a 100755
--- a/pkgs/applications/networking/cluster/rke2/update-script.sh
+++ b/pkgs/applications/networking/cluster/rke2/update-script.sh
@@ -39,6 +39,27 @@ cd ${WORKDIR}
 
 FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
+# Get sha256sums for amd64 and arm64
+SHA256_AMD64=$(curl -L "https://github.com/rancher/rke2/releases/download/v${RKE2_VERSION}/sha256sum-amd64.txt")
+SHA256_ARM64=$(curl -L "https://github.com/rancher/rke2/releases/download/v${RKE2_VERSION}/sha256sum-arm64.txt")
+# Merge both sha256sums in a single variable, one entry per line
+SHA256_SUMS="$SHA256_AMD64\n$SHA256_ARM64"
+# Get a list of images archives that are assets of this release, one entry (name and download_url) per line
+IMAGES_ARCHIVES=$(curl "https://api.github.com/repos/rancher/rke2/releases/tags/v${RKE2_VERSION}" | \
+    # Filter the assets by name, discard .txt files and legacy image archives (e.g. rke2-images.linux-arm64.tar.gz)
+    jq -r '.assets[] | select(.name | test("^rke2-images-.*\\.tar\\.")) | "\(.name) \(.browser_download_url)"')
+# Iterate over all lines of IMAGES_ARCHIVES, pick the appropriate sha256, and create a JSON file
+# that can be imported by builder.nix
+while read -r name url; do
+  sha256=$(grep "$name" <<< "$SHA256_SUMS" | cut -d ' ' -f 1)
+  # Remove the rke2 prefix and replace all dots in $name with hyphens
+  clean_name=$(sed -e "s/^rke2-//" -e "s/\./-/g" <<< "$name")
+  jq --null-input --arg name "$clean_name" \
+    --arg url "$url" \
+    --arg sha256 "$sha256" \
+    '{$name: {"url": $url, "sha256": $sha256}}'
+done <<<"${IMAGES_ARCHIVES}" | jq --slurp 'reduce .[] as $item ({}; . * $item)' > "${WORKDIR}/1_${MINOR_VERSION}/images-versions.json"
+
 cat << EOF > "${WORKDIR}/1_${MINOR_VERSION}/versions.nix"
 {
   rke2Version = "${RKE2_VERSION}";
@@ -50,6 +71,7 @@ cat << EOF > "${WORKDIR}/1_${MINOR_VERSION}/versions.nix"
   pauseVersion = "${PAUSE_VERSION}";
   ccmVersion = "${CCM_VERSION}";
   dockerizedVersion = "${DOCKERIZED_VERSION}";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
 EOF
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 92474969a907..2767c602fbbd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -252,13 +252,13 @@
     "vendorHash": "sha256-lQrtAU8zbeIGplfC8+017Ib9d4MFVF0pMvxmE3MLt3M="
   },
   "cloudflare": {
-    "hash": "sha256-ne+G7tn09sDWVoU9JezCJxIn3F/bHXBp9QIDd0UhH9c=",
+    "hash": "sha256-5L5fnJCQU2gcXbbUq8KDid8NhedFXyYBgysggPxNxSY=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v4.51.0",
-    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jZLkDnZpguVEZpbXG/IhgeyyvRLOVWBacoFTs7H8js0="
+    "rev": "v5.2.0",
+    "spdx": "Apache-2.0",
+    "vendorHash": "sha256-vh31Teu4PruX3i7EIlfumOn/R6libKzAxMPqhTxqBTA="
   },
   "cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
diff --git a/pkgs/applications/video/obs-studio/plugins/default.nix b/pkgs/applications/video/obs-studio/plugins/default.nix
index 2eca00244349..3db4dc213b0f 100644
--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@@ -16,6 +16,8 @@
 
   obs-3d-effect = callPackage ./obs-3d-effect.nix { };
 
+  obs-advanced-masks = callPackage ./obs-advanced-masks.nix { };
+
   obs-backgroundremoval = callPackage ./obs-backgroundremoval { };
 
   obs-color-monitor = qt6Packages.callPackage ./obs-color-monitor.nix { };
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-advanced-masks.nix b/pkgs/applications/video/obs-studio/plugins/obs-advanced-masks.nix
new file mode 100644
index 000000000000..764ebfb70f2a
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-advanced-masks.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  obs-studio,
+  cmake,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-advanced-masks";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-advanced-masks";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NtmOWKk3eZeRa3TvclZpg4sj8lbOoY8hUhxs1z6kEW4=";
+  };
+
+  buildInputs = [
+    obs-studio
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  postInstall = ''
+    rm -rf "$out/share"
+    mkdir -p "$out/share/obs"
+    mv "$out/data/obs-plugins" "$out/share/obs"
+    rm -rf "$out/obs-plugins" "$out/data"
+  '';
+
+  meta = {
+    description = "Advanced Masking Plugin for OBS";
+    homepage = "https://github.com/FiniteSingularity/obs-advanced-masks";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ rytswd ];
+    mainProgram = "obs-advanced-masks";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ac/acr-cli/package.nix b/pkgs/by-name/ac/acr-cli/package.nix
index cd5e5121e5a4..0b5f19ac355e 100644
--- a/pkgs/by-name/ac/acr-cli/package.nix
+++ b/pkgs/by-name/ac/acr-cli/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "acr-cli";
-  version = "0.14";
+  version = "0.15";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "acr-cli";
     tag = "v${version}";
-    hash = "sha256-h4vRtxAu/ggEu5HuzaiEoLslOyAXP1rMI1/ua9YARug=";
+    hash = "sha256-5uEaptJSB5mb12vqeSGkRj4oRed+0VgcJx4vpTBQCAU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ep/epson-escpr2/package.nix b/pkgs/by-name/ep/epson-escpr2/package.nix
index 958a2314713a..7861ad96ceb3 100644
--- a/pkgs/by-name/ep/epson-escpr2/package.nix
+++ b/pkgs/by-name/ep/epson-escpr2/package.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.27";
+  version = "1.2.28";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retrieve the download link for source package for arm CPU for the tar.gz (the x86 link targets to rpm source files)
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/77/53/1540531c6f47c62d3846d9a8943b1ecec7f825a1/epson-inkjet-printer-escpr2-1.2.27-1.tar.gz";
-    hash = "sha256-h1RaqkN+hdVGVy0ancqfYoeNp/TTfJYy5oRxhPizO2Q=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/80/15/8bd63ccd14a1966e9c3658d374686c5bb104bb04/epson-inkjet-printer-escpr2-1.2.28-1.tar.gz";
+    hash = "sha256-lv8Hgo7JzT4igY8ek7EXdyFO34l735dpMC+gWkO5rvY=";
   };
 
   buildInputs = [ cups ];
diff --git a/pkgs/by-name/fl/fluent-bit/macos-11-sdk-compat.patch b/pkgs/by-name/fl/fluent-bit/macos-11-sdk-compat.patch
deleted file mode 100644
index 5063e028e656..000000000000
--- a/pkgs/by-name/fl/fluent-bit/macos-11-sdk-compat.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git i/src/flb_utils.c w/src/flb_utils.c
-index 87637f1331d7..7a0036566438 100644
---- i/src/flb_utils.c
-+++ w/src/flb_utils.c
-@@ -1424,11 +1424,11 @@ int flb_utils_get_machine_id(char **out_id, size_t *out_size)
-         return 0;
-     }
- #elif defined (FLB_SYSTEM_MACOS)
-     bool bret;
-     CFStringRef serialNumber;
--    io_service_t platformExpert = IOServiceGetMatchingService(kIOMainPortDefault,
-+    io_service_t platformExpert = IOServiceGetMatchingService(kIOMasterPortDefault,
-         IOServiceMatching("IOPlatformExpertDevice"));
-
-     if (platformExpert) {
-         CFTypeRef serialNumberAsCFString =
-             IORegistryEntryCreateCFProperty(platformExpert,
diff --git a/pkgs/by-name/fl/fluent-bit/package.nix b/pkgs/by-name/fl/fluent-bit/package.nix
index 48ffdd8618a0..23eb27064142 100644
--- a/pkgs/by-name/fl/fluent-bit/package.nix
+++ b/pkgs/by-name/fl/fluent-bit/package.nix
@@ -1,15 +1,29 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  cmake,
-  flex,
+  arrow-glib,
   bison,
-  systemd,
+  c-ares,
+  cmake,
+  curl,
+  fetchFromGitHub,
+  flex,
+  jemalloc,
+  libbacktrace,
+  libbpf,
+  libnghttp2,
   libpq,
-  openssl,
   libyaml,
-  darwin,
+  luajit,
+  nix-update-script,
+  nixosTests,
+  openssl,
+  pkg-config,
+  rdkafka,
+  systemd,
+  versionCheckHook,
+  zlib,
+  zstd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,63 +33,113 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-E+y8lZ5fgJORFkig6aSVMYGk0US1b4xwjO9qnGu4R/Y=";
   };
 
-  # optional only to avoid linux rebuild
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macos-11-sdk-compat.patch ];
+  # The source build documentation covers some dependencies and CMake options.
+  #
+  # - Linux: https://docs.fluentbit.io/manual/installation/sources/build-and-install
+  # - Darwin: https://docs.fluentbit.io/manual/installation/macos#compile-from-source
+  #
+  # Unfortunately, fluent-bit vends many dependencies (e.g. luajit) as source files and tries to compile them by
+  # default, with none of their dependencies and CMake options documented.
+  #
+  # Fortunately, there's the undocumented `FLB_PREFER_SYSTEM_LIBS` CMake option to link against system libraries for
+  # some dependencies.
+  #
+  # See https://github.com/fluent/fluent-bit/blob/v3.2.6/CMakeLists.txt#L211-L218.
+  #
+  # Like `FLB_PREFER_SYSTEM_LIBS`, several CMake options aren't documented.
+  #
+  # See https://github.com/fluent/fluent-bit/blob/v3.2.6/CMakeLists.txt#L111-L157.
+  #
+  # The CMake options may differ across target platforms. We'll stick to the minimum.
+  #
+  # See https://github.com/fluent/fluent-bit/tree/v3.2.6/packaging/distros.
+
+  strictDeps = true;
 
   nativeBuildInputs = [
+    bison
     cmake
     flex
-    bison
+    pkg-config
   ];
 
   buildInputs =
     [
-      openssl
-      libyaml
+      arrow-glib
+      c-ares
+      # Needed by rdkafka.
+      curl
+      jemalloc
+      libbacktrace
+      libnghttp2
       libpq
+      libyaml
+      luajit
+      openssl
+      rdkafka
+      # Needed by rdkafka.
+      zlib
+      # Needed by rdkafka.
+      zstd
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.IOKit
-      darwin.apple_sdk_11_0.frameworks.Foundation
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # libbpf doesn't build for Darwin yet.
+      libbpf
+      systemd
     ];
 
-  cmakeFlags = [
-    "-DFLB_RELEASE=ON"
-    "-DFLB_METRICS=ON"
-    "-DFLB_HTTP_SERVER=ON"
-    "-DFLB_OUT_PGSQL=ON"
-  ];
+  cmakeFlags =
+    [
+      (lib.cmakeBool "FLB_RELEASE" true)
+      (lib.cmakeBool "FLB_PREFER_SYSTEM_LIBS" true)
+    ]
+    ++ lib.optionals stdenv.cc.isClang [
+      # `FLB_SECURITY` causes bad linker options for Clang to be set.
+      (lib.cmakeBool "FLB_SECURITY" false)
+    ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    # Assumes GNU version of strerror_r, and the posix version has an
-    # incompatible return type.
-    lib.optionals (!stdenv.hostPlatform.isGnu) [ "-Wno-int-conversion" ]
-  );
+  # `src/CMakeLists.txt` installs fluent-bit's systemd unit files at the path in the `SYSTEMD_UNITDIR` CMake variable.
+  #
+  # The initial value of `SYSTEMD_UNITDIR` is set in `cmake/FindJournald` which uses pkg-config to find the systemd
+  # unit directory in the systemd package's `systemdsystemunitdir` pkg-config variable. `src/CMakeLists.txt` only
+  # sets `SYSTEMD_UNITDIR` to `/lib/systemd/system` if it's unset.
+  #
+  # By default, this resolves to systemd's Nix store path which is immutable. Consequently, CMake fails when trying
+  # to install fluent-bit's systemd unit files to the systemd Nix store path.
+  #
+  # We fix this by setting the systemd package's `systemdsystemunitdir` pkg-config variable.
+  #
+  # https://man.openbsd.org/pkg-config.1#PKG_CONFIG_$PACKAGE_$VARIABLE
+  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${builtins.placeholder "out"}/lib/systemd/system";
 
   outputs = [
     "out"
     "dev"
   ];
 
-  postPatch = ''
-    substituteInPlace src/CMakeLists.txt \
-      --replace /lib/systemd $out/lib/systemd
-  '';
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    tests = lib.optionalAttrs stdenv.isLinux {
+      inherit (nixosTests) fluent-bit;
+    };
+
+    updateScript = nix-update-script { };
+  };
 
   meta = {
-    changelog = "https://github.com/fluent/fluent-bit/releases/tag/v${finalAttrs.version}";
-    description = "Log forwarder and processor, part of Fluentd ecosystem";
+    description = "Fast and lightweight logs and metrics processor for Linux, BSD, OSX and Windows";
     homepage = "https://fluentbit.io";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      samrose
-      fpletz
-    ];
-    platforms = lib.platforms.unix;
+    mainProgram = "fluent-bit";
+    maintainers = with lib.maintainers; [ arianvp ];
   };
 })
diff --git a/pkgs/by-name/go/golangci-lint-langserver/package.nix b/pkgs/by-name/go/golangci-lint-langserver/package.nix
index 515ed00b4eec..6e9c47172656 100644
--- a/pkgs/by-name/go/golangci-lint-langserver/package.nix
+++ b/pkgs/by-name/go/golangci-lint-langserver/package.nix
@@ -1,29 +1,36 @@
 {
   lib,
   buildGoModule,
+  golangci-lint,
+  writableTmpDirAsHomeHook,
   fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "golangci-lint-langserver";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "nametake";
     repo = "golangci-lint-langserver";
-    rev = "v${version}";
-    sha256 = "sha256-jNRDqg2a5dXo7QI4CBRw0MLwhfpdGuhygpMoSKNcgC0=";
+    tag = "v${version}";
+    hash = "sha256-wNofr/s8K+vbvNZWrQ97g2V0fNAS2P/Zf7tsOmly+gc=";
   };
 
-  vendorHash = "sha256-tAcl6P+cgqFX1eMYdS8vnfdNyb+1QNWwWdJsQU6Fpgg=";
+  vendorHash = "sha256-SsGw26y/ZIBFp9dBk55ebQgJiLWOFRNe21h6huYE84I=";
 
   subPackages = [ "." ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    golangci-lint
+    writableTmpDirAsHomeHook
+  ];
+
+  meta = {
     description = "Language server for golangci-lint";
     homepage = "https://github.com/nametake/golangci-lint-langserver";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kirillrdy ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kirillrdy ];
     mainProgram = "golangci-lint-langserver";
   };
 }
diff --git a/pkgs/by-name/go/gosmee/package.nix b/pkgs/by-name/go/gosmee/package.nix
index 47cd46c5f620..4fb6e3e9a0b7 100644
--- a/pkgs/by-name/go/gosmee/package.nix
+++ b/pkgs/by-name/go/gosmee/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gosmee";
-  version = "0.22.4";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "gosmee";
     rev = "v${version}";
-    hash = "sha256-e+Mkhkk+PTeTipWFnjiJ8jLMYB7D+/FCWaOuaKe1jr4=";
+    hash = "sha256-4Y5aExRjR2JPa9iTJPQE7qCRnQpqLBYVPLf6v7Z07a8=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/ma/maven/package.nix b/pkgs/by-name/ma/maven/package.nix
index e05b96965526..4febe1647aab 100644
--- a/pkgs/by-name/ma/maven/package.nix
+++ b/pkgs/by-name/ma/maven/package.nix
@@ -5,6 +5,7 @@
   jdk_headless,
   makeWrapper,
   stdenvNoCC,
+  testers,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "maven";
@@ -57,6 +58,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           maven = finalAttrs.finalPackage;
         }
       );
+      tests = {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          command = ''
+            env MAVEN_OPTS="-Dmaven.repo.local=$TMPDIR/m2" \
+              mvn --version
+          '';
+        };
+      };
     };
 
   meta = {
diff --git a/pkgs/by-name/mu/multiviewer-for-f1/package.nix b/pkgs/by-name/mu/multiviewer-for-f1/package.nix
index 45a434c5521d..9a9d1019e5cb 100644
--- a/pkgs/by-name/mu/multiviewer-for-f1/package.nix
+++ b/pkgs/by-name/mu/multiviewer-for-f1/package.nix
@@ -22,6 +22,7 @@
   nss,
   pango,
   xorg,
+  writeScript,
 }:
 let
   id = "232635194";
@@ -93,6 +94,30 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = writeScript "update-multiviewer-for-f1" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl common-updater-scripts
+    set -eu -o pipefail
+
+    # Get latest API for packages, store so we only make one request
+    latest=$(curl -s "https://api.multiviewer.app/api/v1/releases/latest/")
+
+    # From the downloaded JSON extract the url, version and id
+    link=$(echo $latest | jq -r '.downloads[] | select(.platform=="linux_deb").url')
+    id=$(echo $latest | jq -r '.downloads[] | select(.platform=="linux_deb").id')
+    version=$(echo $latest | jq -r '.version')
+
+    if [ "$version" != "${version}" ]
+    then
+      # Pre-calculate package hash
+      hash=$(nix-prefetch-url --type sha256 $link)
+
+      # Update ID and version in source
+      update-source-version ${pname} "$id" --version-key=id
+      update-source-version ${pname} "$version" "$hash" --system=x86_64-linux
+    fi
+  '';
+
   meta = with lib; {
     description = "Unofficial desktop client for F1 TV®";
     homepage = "https://multiviewer.app";
diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index 6a128e775047..824def6c114e 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "paretosecurity";
-  version = "0.0.88";
+  version = "0.0.91";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = version;
-    hash = "sha256-UVnZhkajrc9q6AZvIU7oi931ugxkiVSPk1NugAERnek=";
+    hash = "sha256-/kGwV96Jp7U08jh/wPQMcoV48zQe9ixY7gpNdtFyOkk=";
   };
 
-  vendorHash = "sha256-HReQu23sHLaxc5N8h2vYv64ruJPmY4HM9whAEKV+3Eo=";
+  vendorHash = "sha256-kGrYoN0dGcSuQW47Y4LUFdHQYAoY74NOM1LLPdhmLhc=";
   proxyVendor = true;
 
   subPackages = [
@@ -53,7 +53,11 @@ buildGoModule rec {
       root helper, so that you can run the checker in userspace. Some checks
       require root permissions, and the checker asks the helper to run those.
 
-      Additionally, you can run `paretosecurity link` to configure the agent
+      Additionally, if you enable `services.paretosecurity.trayIcon`, you get a
+      little Vilfredo Pareto living in your systray showing your the current
+      status of checks.
+
+      Finally, you can run `paretosecurity link` to configure the agent
       to send the status of checks to https://dash.paretosecurity.com to make
       compliance people happy. No sending happens until your device is linked.
     '';
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/by-name/sn/snac2/package.nix
similarity index 53%
rename from pkgs/servers/snac2/default.nix
rename to pkgs/by-name/sn/snac2/package.nix
index 7a12b94f9168..27921a048117 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/by-name/sn/snac2/package.nix
@@ -5,20 +5,19 @@
   curl,
   openssl,
   nix-update-script,
-  testers,
-  snac2,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "snac2";
-  version = "2.73";
+  version = "2.74";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
-    repo = pname;
-    rev = version;
-    hash = "sha256-5LKDwp5f5BWhm+9uVBlv3mJpLLQ+ETP9lcRXlfD579Y=";
+    repo = "snac2";
+    tag = finalAttrs.version;
+    hash = "sha256-jFII9MP+jmtguqE+QMQLbDQ6tSuhie0FhXeSyf42AaQ=";
   };
 
   buildInputs = [
@@ -35,21 +34,21 @@ stdenv.mkDerivation rec {
     ]
   );
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/snac";
+  doInstallCheck = true;
+
   passthru = {
-    tests.version = testers.testVersion {
-      package = snac2;
-      command = "${meta.mainProgram} || true";
-    };
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
-    homepage = "https://codeberg.org/grunfink/snac2";
+  meta = {
+    changelog = "https://codeberg.org/grunfink/snac2/src/tag/${finalAttrs.version}/RELEASE_NOTES.md";
     description = "Simple, minimalistic ActivityPub instance (2.x, C)";
-    changelog = "https://codeberg.org/grunfink/snac2/src/tag/${version}/RELEASE_NOTES.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ misuzu ];
-    platforms = platforms.unix;
+    homepage = "https://codeberg.org/grunfink/snac2";
+    license = lib.licenses.mit;
     mainProgram = "snac";
+    maintainers = with lib.maintainers; [ misuzu ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/te/tevent/package.nix b/pkgs/by-name/te/tevent/package.nix
index 15ff833851a7..93e9c59c7b54 100644
--- a/pkgs/by-name/te/tevent/package.nix
+++ b/pkgs/by-name/te/tevent/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tevent";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchurl {
     url = "mirror://samba/tevent/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Nilx4PMtwZBfb+RzYxnEuDSMItyFqmw/aQoo7+VIAp4=";
+    sha256 = "sha256-8LvSnfq7y7zp9HGPwWVBDN1PfY7h89/FRhjUwDGZzqM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 7d2d2772b74d..3baf0df2c700 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.25.4";
+  version = "1.25.5";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${version}";
-    hash = "sha256-1KcTY98QNOic0riHhLi4HcSREboMaXq7lb1+LsB0HL0=";
+    hash = "sha256-UNWnjcwIVRCmRp+i02sDKE9nF2YBc9TQuXLNjkpRZhc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-c6Kz6Z8yfdh7QaDlgI2qSCoG+4c/g9rjBikjN31JftM=";
+  cargoHash = "sha256-/VRVFDzUqMS3y6e5I+ZX8ULxJ2kL8ycesWEYUeZSujo=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/xu/xunlei-uos/package.nix b/pkgs/by-name/xu/xunlei-uos/package.nix
new file mode 100644
index 000000000000..02cc121439c3
--- /dev/null
+++ b/pkgs/by-name/xu/xunlei-uos/package.nix
@@ -0,0 +1,102 @@
+{
+  lib,
+  dpkg,
+  stdenv,
+  fetchurl,
+  buildFHSEnv,
+  autoPatchelfHook,
+  writeShellScript,
+  zenity,
+  nss,
+  gtk2,
+  alsa-lib,
+  dbus-glib,
+  libXtst,
+  libXdamage,
+  libXScrnSaver,
+}:
+
+let
+  sources = import ./sources.nix;
+
+  xunlei-unwrapped = stdenv.mkDerivation rec {
+    pname = "xunlei-uos";
+    version = sources.version;
+
+    src =
+      {
+        x86_64-linux = fetchurl {
+          url = sources.amd64_url;
+          hash = sources.amd64_hash;
+        };
+        aarch64-linux = fetchurl {
+          url = sources.arm64_url;
+          hash = sources.arm64_hash;
+        };
+        loongarch64-linux = fetchurl {
+          url = sources.loongarch64_url;
+          hash = sources.loongarch64_hash;
+        };
+      }
+      .${stdenv.hostPlatform.system}
+        or (throw "${pname}-${version}: ${stdenv.hostPlatform.system} is unsupported.");
+
+    buildInputs = [
+      nss
+      gtk2
+      alsa-lib
+      dbus-glib
+      libXtst
+      libXdamage
+      libXScrnSaver
+    ];
+
+    nativeBuildInputs = [
+      dpkg
+      autoPatchelfHook
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/lib
+      cp -r opt/apps/com.xunlei.download/files $out/lib/xunlei
+      cp -r opt/apps/com.xunlei.download/entries $out/share
+      mv $out/share/icons/hicolor/scalable/apps/com.thunder.download.svg \
+        $out/share/icons/hicolor/scalable/apps/com.xunlei.download.svg
+      substituteInPlace $out/share/applications/com.xunlei.download.desktop \
+        --replace-fail "Categories=net" "Categories=Network" \
+        --replace-fail "/opt/apps/com.xunlei.download/files/start.sh" "xunlei-uos" \
+        --replace-fail "/opt/apps/com.xunlei.download/entries/icons/hicolor/256x256/apps/com.xunlei.download.png" "com.xunlei.download"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Download manager supporting HTTP, FTP, BitTorrent, and eDonkey network protocols";
+      homepage = "https://www.xunlei.com";
+      license = lib.licenses.unfree;
+      maintainers = [ lib.maintainers.linuxwhata ];
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "loongarch64-linux"
+      ];
+    };
+  };
+in
+buildFHSEnv {
+  inherit (xunlei-unwrapped) pname version meta;
+  runScript = writeShellScript "xunlei-launcher" ''
+    exec ${xunlei-unwrapped}/lib/xunlei/thunder -start $1 "$@"
+  '';
+  extraInstallCommands = ''
+    mkdir -p $out
+    ln -s ${xunlei-unwrapped}/share $out/share
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  includeClosures = true;
+  targetPkgs = pkgs: [ zenity ]; # system tray click events
+}
diff --git a/pkgs/by-name/xu/xunlei-uos/sources.nix b/pkgs/by-name/xu/xunlei-uos/sources.nix
new file mode 100644
index 000000000000..eb08be168268
--- /dev/null
+++ b/pkgs/by-name/xu/xunlei-uos/sources.nix
@@ -0,0 +1,11 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2025-03-19
+{
+  version = "1.0.0.5";
+  amd64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_amd64.deb";
+  arm64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_arm64.deb";
+  loongarch64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_loongarch64.deb";
+  amd64_hash = "sha256-K+eHPmG2tT5Z+RWxigg03itw6Rcnk5MZlODqS/JtAnk=";
+  arm64_hash = "sha256-iA9mbp0wSe66qC5lphMTFPzmOJjzHfWKubGRPiKcVdg=";
+  loongarch64_hash = "sha256-44QPnB/1uWHaQkd3DBMDvYXfXwch9HywZUvg71z8fts=";
+}
diff --git a/pkgs/by-name/xu/xunlei-uos/update.sh b/pkgs/by-name/xu/xunlei-uos/update.sh
new file mode 100644
index 000000000000..d931853a1c3d
--- /dev/null
+++ b/pkgs/by-name/xu/xunlei-uos/update.sh
@@ -0,0 +1,60 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert nix-prefetch-git gzip
+
+base_url_suffix="https://pro-store-packages.uniontech.com/appstore/dists/eagle/appstore/binary-"
+base_url_appendix="/Packages.gz"
+target_package="com.xunlei.download"
+packages_file="Packages.gz"
+
+url=()
+version=()  # TODO: Currently, there is no version differences between archs. This is reserved for future use.
+hash=()
+
+for i in amd64 arm64 loongarch64
+do
+    current_url=$base_url_suffix$i$base_url_appendix
+    curl -A "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0" -v -L -O $current_url
+    current_version=$(zgrep -A 20 "Package: $target_package" "$packages_file" | awk -v pkg="$target_package" '
+    BEGIN { found = 0 }
+    {
+        if ($0 ~ "^Package: "pkg) {
+            found = 1;
+        }
+        if (found && $1 == "Version:") {
+            print $2;
+            exit;
+        }
+    }
+    ')
+    version+=("$current_version")
+    sha256sum=$(zgrep -A 20 "Package: $target_package" "$packages_file" | awk -v pkg="$target_package" '
+    BEGIN { found = 0 }
+        {
+            if ($0 ~ "^Package: "pkg) {
+            found = 1;
+        }
+        if (found && $1 == "SHA256:") {
+            print $2;
+            exit;
+        }
+    }
+    ')
+    url+=("https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_"$version"_"$i".deb")
+    hash+=("$(nix hash convert --to sri --hash-algo sha256 $sha256sum)")
+done
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{
+  version = "${version[0]}";
+  amd64_url = "${url[0]}";
+  arm64_url = "${url[1]}";
+  loongarch64_url = "${url[2]}";
+  amd64_hash = "${hash[0]}";
+  arm64_hash = "${hash[1]}";
+  loongarch64_hash = "${hash[2]}";
+}
+EOF
+
+rm -r Packages.gz
diff --git a/pkgs/by-name/ze/zed-editor/0001-generate-licenses.patch b/pkgs/by-name/ze/zed-editor/0001-generate-licenses.patch
deleted file mode 100644
index d3f566488090..000000000000
--- a/pkgs/by-name/ze/zed-editor/0001-generate-licenses.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/script/generate-licenses b/script/generate-licenses
-index 368f63b..c2bf3a5 100644
---- a/script/generate-licenses
-+++ b/script/generate-licenses
-@@ -18,17 +18,9 @@ echo -n "" > "$OUTPUT_FILE"
-     echo -e "\n# ###### CODE LICENSES ######\n"
- } >> "$OUTPUT_FILE"
- 
--if ! cargo install --list | grep "cargo-about v$CARGO_ABOUT_VERSION" > /dev/null; then
--  echo "Installing cargo-about@$CARGO_ABOUT_VERSION..."
--  cargo install "cargo-about@$CARGO_ABOUT_VERSION"
--else
--  echo "cargo-about@$CARGO_ABOUT_VERSION is already installed."
--fi
--
- echo "Generating cargo licenses"
- 
- cargo about generate \
--    --fail \
-     -c script/licenses/zed-licenses.toml \
-     "$TEMPLATE_FILE" >> "$OUTPUT_FILE"
- 
diff --git a/pkgs/by-name/ze/zed-editor/0002-linux-linker.patch b/pkgs/by-name/ze/zed-editor/0001-linux-linker.patch
similarity index 100%
rename from pkgs/by-name/ze/zed-editor/0002-linux-linker.patch
rename to pkgs/by-name/ze/zed-editor/0001-linux-linker.patch
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 00d08aae391c..57f61d9740a7 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.177.11";
+  version = "0.178.5";
 
   outputs =
     [ "out" ]
@@ -110,20 +110,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cnzaW0paORio8AONtVVGUZWG+HsWte12aWK2qvfj8oI=";
+    hash = "sha256-YkoIOBoR5hMt99D1bJ1yWLv7C/rY6VKC5J/7c5SMUFs=";
   };
 
   patches = [
-    # Zed uses cargo-install to install cargo-about during the script execution.
-    # We provide cargo-about ourselves and can skip this step.
-    # Until https://github.com/zed-industries/zed/issues/19971 is fixed,
-    # we also skip any crate for which the license cannot be determined.
-    ./0001-generate-licenses.patch
-
     # Upstream delegates linking on Linux to clang to make use of mold,
     # but builds fine with our standard linker.
     # This patch removes their linker override from the cargo config.
-    ./0002-linux-linker.patch
+    ./0001-linux-linker.patch
 
     # See https://github.com/zed-industries/zed/pull/21661#issuecomment-2524161840
     "script/patches/use-cross-platform-livekit.patch"
@@ -136,7 +130,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Hl5QWU9yKXedQFVd60Fz5O7B2e/YUqj3BLNmqC44UP0=";
+  cargoHash = "sha256-xJaiHngsm74RdcEUXaDrc/Hwy4ywZrEiJt7JYTc/NpM=";
 
   nativeBuildInputs =
     [
@@ -192,6 +186,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui/runtime_shaders" ];
 
   env = {
+    ALLOW_MISSING_LICENSES = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;
     FONTCONFIG_FILE = makeFontsConf {
       fontDirectories = [
diff --git a/pkgs/by-name/ze/zellij/package.nix b/pkgs/by-name/ze/zellij/package.nix
index 3ba274737a82..65c7e5b406d1 100644
--- a/pkgs/by-name/ze/zellij/package.nix
+++ b/pkgs/by-name/ze/zellij/package.nix
@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zellij";
-  version = "0.42.0";
+  version = "0.42.1";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qvm8mRm/YYcuNX2Rv0tYjcIXjaF9dkwd7wpL++ho3t0=";
+    hash = "sha256-EK+eQfNhfVxjIsoyj43tcRjHDT9O8/n7hUz24BC42nw=";
   };
 
   # Remove the `vendored_curl` feature in order to link against the libcurl from nixpkgs instead of
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cAO8A/e6tkUY7pm/T4Riz4UPIc22oj5FFC6sQL1QIuc=";
+  cargoHash = "sha256-0+cU2C6zjVv2G8h7oK0ztMDdukVR6QRzN81/SfLZapY=";
 
   env.OPENSSL_NO_VENDOR = 1;
 
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   # Ensure that we don't vendor curl, but instead link against the libcurl from nixpkgs
diff --git a/pkgs/desktops/enlightenment/efl/default.nix b/pkgs/desktops/enlightenment/efl/default.nix
index fc5853479f46..686bb68e0215 100644
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
@@ -60,11 +60,11 @@
 
 stdenv.mkDerivation rec {
   pname = "efl";
-  version = "1.28.0";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/libs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8JpD1rSGG+BswOKEnFMpZBPU5SyOMfUvyV6epfHFmjY=";
+    sha256 = "sha256-hM9hRfnMgr//aQAFviQ5LI88UvjgD/BNjuo3FCnAlCQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/enlightenment/enlightenment/default.nix b/pkgs/desktops/enlightenment/enlightenment/default.nix
index c723ce7b137e..bbc7246e0491 100644
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "enlightenment";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchurl {
     url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-W2a5FMbZCpFrP+ZrX/cKn9kSCIqmOZvd4bOlBarlAzE=";
+    sha256 = "sha256-tB34dx9g47lqGXOuVm10JcU6gznxjlTjEjAhh4HaL6k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bloodyad/default.nix b/pkgs/development/python-modules/bloodyad/default.nix
index eb7db86c9f35..1d56dee30547 100644
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@@ -5,9 +5,8 @@
   cryptography,
   dnspython,
   fetchFromGitHub,
-  gssapi,
   hatchling,
-  ldap3,
+  minikerberos,
   msldap,
   pyasn1,
   pytestCheckHook,
@@ -17,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bloodyad";
-  version = "2.1.8";
+  version = "2.1.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +25,7 @@ buildPythonPackage rec {
     owner = "CravateRouge";
     repo = "bloodyAD";
     tag = "v${version}";
-    hash = "sha256-CggC7Cdw++Rgp6U4zK3er+ctBbfsxtxow9gFkYvIDds=";
+    hash = "sha256-XqCP2GfS8hxlFU4Mndeh+7Ll2kXJ3Dei+AGp/oy0PUg=";
   };
 
   build-system = [ hatchling ];
@@ -35,10 +34,8 @@ buildPythonPackage rec {
     asn1crypto
     cryptography
     dnspython
-    gssapi
-    ldap3
+    minikerberos
     msldap
-    pyasn1
     winacl
   ];
 
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 0d20226cee2c..84c374f0912c 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.37.13";
+  version = "1.37.17";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-vZIxrbBXis/GLIIW9j4jqdQJzSpUtl8xJo4JRw+78FM=";
+    hash = "sha256-kjhXUrThwsdffKfZW1lr7duAbh8DpValQWc2Gsm0PeM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 38cdf6349819..329b8bd41de4 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.37.13";
+  version = "1.37.17";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-6h6aOA5BGcVwzAd6lMc3cn2MgeC4Z6PXXdlL6xe7F7c=";
+    hash = "sha256-ucOh6PtX+3C0mqU4DKvvqzLsAo2KHY9ayD3YNsW0Kag=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/datasets/default.nix b/pkgs/development/python-modules/datasets/default.nix
index 0d663db68e3a..630a8f61cd0a 100644
--- a/pkgs/development/python-modules/datasets/default.nix
+++ b/pkgs/development/python-modules/datasets/default.nix
@@ -15,31 +15,27 @@
   pythonOlder,
   requests,
   responses,
+  setuptools,
   tqdm,
   xxhash,
 }:
-
 buildPythonPackage rec {
   pname = "datasets";
-  version = "3.2.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.8";
+  version = "3.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
-    repo = pname;
+    repo = "datasets";
     tag = version;
-    hash = "sha256-3Q4tNLA9qUb7XdxP1NftYDcVUgq5ol9OZfklhmadk5I=";
+    hash = "sha256-a0c5E4N1X+PtO4+UZn8l1JcLGTNpLPyfEkrrxNsjfLA=";
   };
 
-  # remove pyarrow<14.0.1 vulnerability fix
-  postPatch = ''
-    substituteInPlace src/datasets/features/features.py \
-      --replace "import pyarrow_hotfix" "#import pyarrow_hotfix"
-  '';
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     dill
     fsspec
@@ -53,7 +49,17 @@ buildPythonPackage rec {
     responses
     tqdm
     xxhash
-  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  ];
+
+  pythonRelaxDeps = [
+    # https://github.com/huggingface/datasets/blob/a256b85cbc67aa3f0e75d32d6586afc507cf535b/setup.py#L117
+    # "pin until dill has official support for determinism"
+    "dill"
+    "multiprocess"
+    # https://github.com/huggingface/datasets/blob/a256b85cbc67aa3f0e75d32d6586afc507cf535b/setup.py#L129
+    # "to support protocol=kwargs in fsspec's `open`, `get_fs_token_paths`"
+    "fsspec"
+  ];
 
   # Tests require pervasive internet access
   doCheck = false;
@@ -63,13 +69,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "datasets" ];
 
-  meta = with lib; {
+  meta = {
     description = "Open-access datasets and evaluation metrics for natural language processing";
     mainProgram = "datasets-cli";
     homepage = "https://github.com/huggingface/datasets";
     changelog = "https://github.com/huggingface/datasets/releases/tag/${src.tag}";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ osbm ];
   };
 }
diff --git a/pkgs/development/python-modules/dsnap/default.nix b/pkgs/development/python-modules/dsnap/default.nix
index 3eae904c2314..53f1d4319ca6 100644
--- a/pkgs/development/python-modules/dsnap/default.nix
+++ b/pkgs/development/python-modules/dsnap/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "dsnap";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "RhinoSecurityLabs";
     repo = "dsnap";
     tag = "v${version}";
-    hash = "sha256-yKch+tKjFhvZfzloazMH378dkERF8gnZEX1Som+d670=";
+    hash = "sha256-h5zeyfkBoHnvjqHYahDXEEbGdmMti2Y56R/8OKyxOOM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fastapi-sso/default.nix b/pkgs/development/python-modules/fastapi-sso/default.nix
index de57d71cf53b..1039e258f515 100644
--- a/pkgs/development/python-modules/fastapi-sso/default.nix
+++ b/pkgs/development/python-modules/fastapi-sso/default.nix
@@ -8,7 +8,8 @@
   oauthlib,
   poetry-core,
   pydantic,
-  pylint,
+  pyjwt,
+  pytest-cov-stub,
   pytest-asyncio,
   pytest-xdist,
   pytestCheckHook,
@@ -17,22 +18,18 @@
 
 buildPythonPackage rec {
   pname = "fastapi-sso";
-  version = "0.17.0";
+  version = "0.18.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "tomasvotava";
     repo = "fastapi-sso";
     tag = version;
-    hash = "sha256-CkYAF2GmVCooyHt3Tua6ClYMbgyLosqSa8z/zkV2eIE=";
+    hash = "sha256-591+7Jjg3Pb0qXZsj4tEk8lHqxAzWrs5GO92jFJ4Qmo=";
   };
 
-  postPatch = ''
-    sed -i "/--cov/d" pyproject.toml
-  '';
-
   build-system = [ poetry-core ];
 
   dependencies = [
@@ -40,12 +37,13 @@ buildPythonPackage rec {
     httpx
     oauthlib
     pydantic
-    pylint
-  ];
+    pyjwt
+  ] ++ pydantic.optional-dependencies.email;
 
   nativeCheckInputs = [
     email-validator
     pytest-asyncio
+    pytest-cov-stub
     pytest-xdist
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 9bec5b02bfb6..cdb83a23cab7 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.7.29";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
index 80b248980c46..ac6a036f99f0 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-logging";
-  version = "1.6.1";
+  version = "1.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_bigquery_logging";
     inherit version;
-    hash = "sha256-gkozSu9UENr/4LRmHdS+efRH8t63ZO64zAx7i2cT51E=";
+    hash = "sha256-sVWeTqq4drPOmlUXd6R2O44PpNfcbsglhXeh6umYMZI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 8807f7fa9a09..70125b2cca3e 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.4.1";
+  version = "1.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_iam_logging";
     inherit version;
-    hash = "sha256-+rgtIj4Q+ZL8ENeigmF0dJYzIbJ797A1bOs2mbH4AKI=";
+    hash = "sha256-2tpXDDqP6JN9y8wqku/C3+I9ymns5EfxvfR5eeTDstU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
index 19f9f3c65af8..d63289ce8400 100644
--- a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
+++ b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-network-connectivity";
-  version = "2.7.1";
+  version = "2.7.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "google_cloud_network_connectivity";
-    hash = "sha256-caOyIo4FKGQgpa0x7lKzrsaL5nrqqg8Q1iGITY3foME=";
+    hash = "sha256-7whrWtASCSsmPP6/gj9Jc5dvn56H2QPyEseELxbn0tg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-shell/default.nix b/pkgs/development/python-modules/google-cloud-shell/default.nix
index 3710d414e70f..d5928afbaaa8 100644
--- a/pkgs/development/python-modules/google-cloud-shell/default.nix
+++ b/pkgs/development/python-modules/google-cloud-shell/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-shell";
-  version = "1.12.0";
+  version = "1.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_shell";
     inherit version;
-    hash = "sha256-PQzFvc/ZGAp6SsMGT2mMQJN5feaI5E7WSODWccRNYx4=";
+    hash = "sha256-nRuFxyxtJmKiI0BtV8VEu8mRZ5JU2S0gGU9aef9I6Zg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
index 5f09ae85dd2c..78364c4e2f54 100644
--- a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vpc-access";
-  version = "1.13.0";
+  version = "1.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_vpc_access";
     inherit version;
-    hash = "sha256-jMZtqtbNtocz6NeUJupU+Gkk2L48S5FfrvRrQ5/SZx8=";
+    hash = "sha256-tgSvaJvXhEt6isC6C+w0APq2ULUYkKdva9vb6yZ4MYM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-webrisk/default.nix b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
index 5f5e8a404200..d20b53813f14 100644
--- a/pkgs/development/python-modules/google-cloud-webrisk/default.nix
+++ b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-webrisk";
-  version = "1.17.0";
+  version = "1.17.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_webrisk";
     inherit version;
-    hash = "sha256-Qcw5LyPhu9ZbYSz3Jnkr8byXiTZfW7BtQapT7MhkEug=";
+    hash = "sha256-apCNF81eeLIP4nNdzm9KeUlUO7pjN6quKTrl1xsUn0Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index ef92a66e9eaf..9ed287b200b9 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.68";
+  version = "0.69";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-Lftt4NzOZYYE7q7acdljosE0Ox/5hKbbwsYx4g2OU+Y=";
+    hash = "sha256-dt5f4Mu44YPKdoO6J3WKM5KXrHeAs+hKDF/c5mee6Z8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index bf18f6a5b292..439b8403190c 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-sdk";
-  version = "1.24.0";
+  version = "1.25.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${version}";
-    hash = "sha256-7r7TuGR8J31BZdG8wJJAgWwllbkf3wYj1xLULNm8+xQ=";
+    hash = "sha256-CRs9Pqgv8sVhjlMPmC8UR03b4jP1Pm39Yndn2LF51jU=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 122614f5bb7c..8f105ec21806 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -66,8 +66,8 @@ rec {
       "sha256-rxpBCIXOkSl5UeP1e0Rz8VK4tU3qD7nqG77YiGTv/0U=";
 
   mypy-boto3-amplify =
-    buildMypyBoto3Package "amplify" "1.37.12"
-      "sha256-uUxc61azT+b/eP+nDc1l8BAVYr73sQWg9RMXBHcq7Ic=";
+    buildMypyBoto3Package "amplify" "1.37.17"
+      "sha256-Q9nHb3kc2RHQEbBzZ1H8tYAULuPZlOvEYJvZ1znOj3c=";
 
   mypy-boto3-amplifybackend =
     buildMypyBoto3Package "amplifybackend" "1.37.0"
@@ -134,8 +134,8 @@ rec {
       "sha256-v47OKnLvmkjv8+HBRlrv+wP+MIapoiz3HGplK6SEXGM=";
 
   mypy-boto3-appsync =
-    buildMypyBoto3Package "appsync" "1.37.0"
-      "sha256-KuiUFCfIcGHwIRrKsezOcGodrA3UrqdDPI3yl5Lpkmw=";
+    buildMypyBoto3Package "appsync" "1.37.15"
+      "sha256-4eY2gziQLvX2t39e201UitkV/Cs0E2RSP4yAG6/OdbI=";
 
   mypy-boto3-arc-zonal-shift =
     buildMypyBoto3Package "arc-zonal-shift" "1.37.0"
@@ -210,8 +210,8 @@ rec {
       "sha256-FINgDMmIhMn5M/qVGE3rzZJZEU121rDXNQYa39veAYk=";
 
   mypy-boto3-cleanrooms =
-    buildMypyBoto3Package "cleanrooms" "1.37.0"
-      "sha256-ovn/hkWHBBTUsDkQppzTApcVRYZXwxTOugZHIPnbCQk=";
+    buildMypyBoto3Package "cleanrooms" "1.37.15"
+      "sha256-6hJ2F3fQMPHe8VEcd4ZSb7zyeVs4rG3agDHTyICkCsE=";
 
   mypy-boto3-cloud9 =
     buildMypyBoto3Package "cloud9" "1.37.0"
@@ -314,8 +314,8 @@ rec {
       "sha256-6w2v795pNhcKZlWayROdYe5bzQvSmkITxErl2M0F5o4=";
 
   mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.37.13"
-      "sha256-L9F74KW7z+Q+7hUoGIQR67TQyNiJF8nW4XHWBppFO4Q=";
+    buildMypyBoto3Package "cognito-idp" "1.37.13.post1"
+      "sha256-EHys56ylhnO6wwWLKMABYrjf9K3D02lZbpcghQlXxRI=";
 
   mypy-boto3-cognito-sync =
     buildMypyBoto3Package "cognito-sync" "1.37.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-wvOqjmqNMbCG7E1o+ZSOlWEwBdcCKjD/qVFlepZ51ec=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.37.12"
-      "sha256-tK8CshexXUuOPFxAkWZXtAk82CgiHVR0D5BSjgEztIU=";
+    buildMypyBoto3Package "ec2" "1.37.16"
+      "sha256-04vwzTTK0gE3yWvOVbXUXFXijf4k6/oSZXR6tqxfN3U=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.37.0"
@@ -770,8 +770,8 @@ rec {
       "sha256-E5A6wS8kwjG1rWo1RFT7kwpqmWKGZ7UAmcR4KUvUrzg=";
 
   mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.37.0"
-      "sha256-YbGr1bfbpdFvneTZcX8vZ0OCRtEc3hwrvjHqOHUzM8g=";
+    buildMypyBoto3Package "lambda" "1.37.16"
+      "sha256-1Y8guwQWrrBP2mz6qKLywxUyylAJAEw+K8vorFCoz3w=";
 
   mypy-boto3-lex-models =
     buildMypyBoto3Package "lex-models" "1.37.0"
@@ -858,12 +858,12 @@ rec {
       "sha256-nh2m7H6RlfQlqmiifwYJ3SANi73zcju/v5s9z26HIvo=";
 
   mypy-boto3-mediaconnect =
-    buildMypyBoto3Package "mediaconnect" "1.37.0"
-      "sha256-KFa0yNwhYlFGz4ADpsxt3OCZfYDBv6Hfw9Ti09f7fIc=";
+    buildMypyBoto3Package "mediaconnect" "1.37.16"
+      "sha256-TfeKy6dyjQJVyhmCjttwBxBQNi3iZdJQQwpY/HRvnf0=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.37.4"
-      "sha256-xBMBhCrnTV7sILg2/dXUy2PeNeCuNHkb7plAumD5Pq8=";
+    buildMypyBoto3Package "mediaconvert" "1.37.15"
+      "sha256-bs9Zvpv3AyT/zhucLMqtdhmocG4+hbHkPjyGsvviFJ8=";
 
   mypy-boto3-medialive =
     buildMypyBoto3Package "medialive" "1.37.11"
@@ -950,8 +950,8 @@ rec {
       "sha256-gA8+WKvFzCegzUUWvsTbEmHkYPLIomBrqaIRJHkJqhE=";
 
   mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.37.0"
-      "sha256-O9iEc3Yla0/bmvhouX1PLQQET79uJlbQtuz7aKrOekY=";
+    buildMypyBoto3Package "network-firewall" "1.37.17"
+      "sha256-Lth+Py9qwXU+mnbV21d9H7QoONrwWU1UmMCJWorypxs=";
 
   mypy-boto3-networkmanager =
     buildMypyBoto3Package "networkmanager" "1.37.0"
@@ -1134,8 +1134,8 @@ rec {
       "sha256-axaTu4XmHGc3a/Uzs1/0IqLJdZFBfEQ9pzi42XW11y0=";
 
   mypy-boto3-route53 =
-    buildMypyBoto3Package "route53" "1.37.0"
-      "sha256-mI9acOp7w3pD+5eD3z7pSgTxZHjYWWbkRnWYUWy7UpE=";
+    buildMypyBoto3Package "route53" "1.37.15"
+      "sha256-sXSxaqe0kqx1ZCinJKI67ekBZW81RwoC1fSEDrlCDc4=";
 
   mypy-boto3-route53-recovery-cluster =
     buildMypyBoto3Package "route53-recovery-cluster" "1.37.0"
@@ -1158,8 +1158,8 @@ rec {
       "sha256-/4XdwWIkx8VYxrUp7I8IDCPZ34cFudV+gp3xR4uS8jk=";
 
   mypy-boto3-rum =
-    buildMypyBoto3Package "rum" "1.37.5"
-      "sha256-/cLHocPVefBea8g6oIRrSis6JOL7wFw+AEYyGNEOdx0=";
+    buildMypyBoto3Package "rum" "1.37.14"
+      "sha256-bcK4J78YctKUypiegFviiZ2TorcXA5SPh9dhbRigVhk=";
 
   mypy-boto3-s3 =
     buildMypyBoto3Package "s3" "1.37.0"
@@ -1174,8 +1174,8 @@ rec {
       "sha256-c0vXkW5sR7JkdzvsS/rMFme9EwY1x5eZAbRWYKew0v4=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.37.5"
-      "sha256-CZmB3zmQwsWy85vzK891HXuRfmgNBg2YXEasihOrbUY=";
+    buildMypyBoto3Package "sagemaker" "1.37.16"
+      "sha256-fEvGy0Zp2ouvVGXi+yFpX1RTNVacb53UFXxv0rfNBd0=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.37.0"
@@ -1398,8 +1398,8 @@ rec {
       "sha256-nBigZ8YNNcy6TrQQ+dThN62xZ5IOq92EHbC3/tZbbuE=";
 
   mypy-boto3-wafv2 =
-    buildMypyBoto3Package "wafv2" "1.37.8"
-      "sha256-kFDCZkFA474JtReUOZlN3Si0qZU21sUWOAUVTNl7uFo=";
+    buildMypyBoto3Package "wafv2" "1.37.14"
+      "sha256-wfndS06dDJCEqVLceB+WMTIh1laTi9eVfTzx23K47nk=";
 
   mypy-boto3-wellarchitected =
     buildMypyBoto3Package "wellarchitected" "1.37.0"
diff --git a/pkgs/development/python-modules/nexia/default.nix b/pkgs/development/python-modules/nexia/default.nix
index 05231e965ec6..38b181c0c211 100644
--- a/pkgs/development/python-modules/nexia/default.nix
+++ b/pkgs/development/python-modules/nexia/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nexia";
-  version = "2.4.0";
+  version = "2.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "nexia";
     tag = version;
-    hash = "sha256-DO6UJ/oLCLZdRR2f0rXe4R5nQtByqzHrLXhyUsvY/jw=";
+    hash = "sha256-vw4lUBD7VUpOkm+JGD06tLuM/g2iLQ/qFLIyMobnQS0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/nibe/default.nix b/pkgs/development/python-modules/nibe/default.nix
index a94dd373f120..7546524372da 100644
--- a/pkgs/development/python-modules/nibe/default.nix
+++ b/pkgs/development/python-modules/nibe/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "nibe";
-  version = "2.16.0";
+  version = "2.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "yozik04";
     repo = "nibe";
     tag = version;
-    hash = "sha256-iY7HjHxuQGrkiVPxUhELdij8u6g5IZxp/6Jydo7SOfQ=";
+    hash = "sha256-wq+Gtt2oW8koxOqu3z8G3XvHo6Ur+FhWPe+KslDG754=";
   };
 
   pythonRelaxDeps = [ "async-modbus" ];
diff --git a/pkgs/development/python-modules/plyara/default.nix b/pkgs/development/python-modules/plyara/default.nix
index 3b03163a52dd..c6b3616286b0 100644
--- a/pkgs/development/python-modules/plyara/default.nix
+++ b/pkgs/development/python-modules/plyara/default.nix
@@ -2,9 +2,15 @@
   lib,
   buildPythonPackage,
   pythonOlder,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   ply,
+
+  pytestCheckHook,
+  pycodestyle,
+  pydocstyle,
+  pyflakes,
+  coverage,
 }:
 
 buildPythonPackage rec {
@@ -14,9 +20,11 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.10"; # https://github.com/plyara/plyara: "Plyara requires Python 3.10+"
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-zmpb5r3BcveLsQ0uIgQJx2vUaz2p/0PlO76E0e7elwA=";
+  src = fetchFromGitHub {
+    owner = "plyara";
+    repo = "plyara";
+    tag = "v${version}";
+    hash = "sha256-WaQgqx003it+D0AGDxV6aSKO89F2iR9d8L4zvHyd0iQ=";
   };
 
   build-system = [
@@ -31,11 +39,27 @@ buildPythonPackage rec {
     "plyara"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+    pycodestyle
+    pydocstyle
+    pyflakes
+    coverage
+  ];
+
+  disabledTests = [
+    # touches network
+    "test_third_party_repositories"
+  ];
+
   meta = {
     description = "Parse YARA rules";
-    homepage = "https://pypi.org/project/plyara/";
+    homepage = "https://github.com/plyara/plyara";
     changelog = "https://github.com/plyara/plyara/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ _13621 ];
+    maintainers = with lib.maintainers; [
+      _13621
+      ivyfanchiang
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index 1a1beb444bf8..f9c520426b3d 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.71";
+  version = "0.2.72";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-AE9fD7OKrpi74rXQibtmyQoAeMAO2QCagpCT3HaUGaQ=";
+    hash = "sha256-zWgI6cNSm3hXZXrrQsSpr4BsSPA7JawQOz2hwmnybDI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysmartthings/default.nix b/pkgs/development/python-modules/pysmartthings/default.nix
index a900ab059c73..3306db65501b 100644
--- a/pkgs/development/python-modules/pysmartthings/default.nix
+++ b/pkgs/development/python-modules/pysmartthings/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pysmartthings";
-  version = "2.7.2";
+  version = "2.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "andrewsayre";
     repo = "pysmartthings";
     rev = "v${version}";
-    hash = "sha256-2MBm0I9dBr2N5iorN9BSKecHLnvmiTmcsIuGjDIWIKQ=";
+    hash = "sha256-WkUFAsZzdQI/LopJp5m1Nj4kLsRFmQWRe10eTcAUYGw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index ede2e6a0f238..905cfa9ba186 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.57.0";
+  version = "0.57.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = version;
-    hash = "sha256-9jA1V6Wri923pc2+MXLwF2hNgIPIYh3M8UBj0jc/548=";
+    hash = "sha256-bG0jRGhioNm0QNe7ymRKYO4hdgkiZypul79+gxN3Gsk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pywizlight/default.nix b/pkgs/development/python-modules/pywizlight/default.nix
index 3a925663da96..76841e31d2e3 100644
--- a/pkgs/development/python-modules/pywizlight/default.nix
+++ b/pkgs/development/python-modules/pywizlight/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pywizlight";
-  version = "0.5.14";
+  version = "0.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sbidy";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IkuAYEg5nuUT6zxmuJe6afp4MVWf0+HAnEoAdOrdTvQ=";
+    hash = "sha256-4z1PmVoRs7mql/PhSG9Ek6NRkGXIXAYxaV8nNDoJjeY=";
   };
 
   propagatedBuildInputs = [ click ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index f48b05273df0..c824c2747c92 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -66,7 +66,7 @@
 
 let
   pname = "ray";
-  version = "2.43.0";
+  version = "2.44.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -83,32 +83,32 @@ buildPythonPackage rec {
         x86_64-darwin = "macosx_10_15_x86_64";
         x86_64-linux = "manylinux2014_x86_64";
       };
-      # hashes retrieved via the following command
-      # curl https://pypi.org/pypi/ray/${version}/json | jq -r '.urls[] | "\(.digests.sha256)  \(.filename)"'
+      # ./pkgs/development/python-modules/ray/prefetch.sh
+      # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp39 = "sha256-Xt89oYBB4LYXDGLghICrBQ8HZjYf8/bhElfMBKtG5ZI=";
-          cp310 = "sha256-GHKYOihahbd2vzEcgJ1Vn4SCkJotOerV8qxpz+OqhUQ=";
-          cp311 = "sha256-eMO9vxgrTQGfqaiqvVXDm/cFu2MK6gZPdo8wX8Ry0es=";
-          cp312 = "sha256-tF9HjSnOXfP8GYYd9k/vntXCXx6D+hACjTP63v3soJU=";
+          cp39 = "sha256-Ucy9W/gEXWnx+NL4WpL2aoKBjz2S1wx3xmJ1eYHDDZ8=";
+          cp310 = "sha256-tP29SytbReQT3Bahmkq/UADTbDxYVJCNykaXMj/11+E=";
+          cp311 = "sha256-hk8KabPNfKTrcEP3953JzotxosmC7ux/EX9I8oRrcTw=";
+          cp312 = "sha256-DWWsUjgB5Ao5e79VL0BoZ7uUad0mEEbKY83C7DEQ24c=";
         };
         aarch64-linux = {
-          cp39 = "sha256-h+DKyFGJ3FGa8bbvKr1lSATEiMkyyq3WWLkMqqZfja4=";
-          cp310 = "sha256-VzgcVPIA5sAgPV9wrG+IKxPMGoD68zZRh4ejmm1vZdA=";
-          cp311 = "sha256-R27D4fokZN3V8EnA8nWP+d/swh+430Jm8d8BsngMZlM=";
-          cp312 = "sha256-c3cNTIqYlzCYX/K0KSEpJJ4oweKehFiUcMm6GukcqDI=";
+          cp39 = "sha256-Lxj0j8N95kAxXZNgECbfqiPwr0y6jwd9sT8dd+mR2a8=";
+          cp310 = "sha256-qZ+7mtLBryIYcNhrio49WcGKVROt3p1wiKSiddxZ2n8=";
+          cp311 = "sha256-wzcjfnqKHYcC3PZ+CpjqjNTsA1fSiL8IFviZDCWNi8M=";
+          cp312 = "sha256-KpEeaZ5IOsSHkRC2CLBrNeYCGRwOe5cybKSXxcqv5qg=";
         };
         x86_64-darwin = {
-          cp39 = "sha256-0OJvnbkaWzND8IWOslYlWzXH6X/Gv5cGX1dErX6Mwpc=";
-          cp310 = "sha256-GGJv/zaEUaN6drM9UqcPBbIKIR6whn2GByHI6Gy2lVo=";
-          cp311 = "sha256-/eioEoDwevmDvDdpyZQdtdsnPOEOkquzNI5BvtAj1zU=";
-          cp312 = "sha256-USH99Ly8sP2jubcRZN1sj8x5ouJYAioqOVfkAQGJE/s=";
+          cp39 = "sha256-4373wSlDArrp2SFoCi2jR5iMHh4qmCo+coktEa4A4j4=";
+          cp310 = "sha256-YyeQwyfmkxp6jMrd6P06+utzrTgvh99N1HpSyov+BRw=";
+          cp311 = "sha256-++SDLLLvz8BJPqR0K0gosesNq8/t+H9kvmvh0M6HTGk=";
+          cp312 = "sha256-U9x16itP2GnqSmzKneXgKqJPLw0Y4KCLinZasr5l3Rw=";
         };
         aarch64-darwin = {
-          cp39 = "sha256-2M/ewr9hxIaQ9stDJfFnPg0dAN6pJbWbYxGW5n9Cag4=";
-          cp310 = "sha256-t8T97FmhTWspOdkf7m78hLYUpnIsO+Cyf6Nx4/VjJV8=";
-          cp311 = "sha256-6TwyrQy2fx99p2+sQJ2H1c1eo+sDuDaDDp71zIELwsA=";
-          cp312 = "sha256-fyb3ty2gTDxEIiacMbBnq9Fcs4QktwEtgS3fssd0Yuo=";
+          cp39 = "sha256-Ef62eG+CAQRke2aiklRVNsA36Cl/FP4BI0t7JN2PJzk=";
+          cp310 = "sha256-XfvyazCuw35dRCXGYBReVSApmohVMkaG4vF/yGAb9Mg=";
+          cp311 = "sha256-Uzcifcn4CEKAwpRWmIokTKm0zg+8c4XXMHASD0fkaXk=";
+          cp312 = "sha256-OY6b4ZPJf3NK8Bnw76zh9FyUGVuW7MSmR61gdlDfVyw=";
         };
       };
     in
diff --git a/pkgs/development/python-modules/setupmeta/default.nix b/pkgs/development/python-modules/setupmeta/default.nix
index 8b65a9f1eb4c..e7381b9dd7e0 100644
--- a/pkgs/development/python-modules/setupmeta/default.nix
+++ b/pkgs/development/python-modules/setupmeta/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "setupmeta";
-  version = "3.6.1";
+  version = "3.7.2";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "codrsquad";
     repo = "setupmeta";
     tag = "v${version}";
-    hash = "sha256-L8RDfcAa2Zhr6huFt0AmNt0Qzea2xNtCX1BIULsiQgA=";
+    hash = "sha256-qtnewUmTApPYq7/X82GsduW0VcioW4huRAyDMHUD74Q=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 1a35f306b52c..5651ced8675d 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1340";
+  version = "3.0.1342";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-CbGYPoliqc3RuKC1vMaUwopqrGe/9T/E4i9a0w33UTE=";
+    hash = "sha256-Hjb458+cOIIaPj7OnKmbcliI+caRx0JYoio+d5SrAuw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d125059165a..2fd8d52ecf5d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10429,8 +10429,6 @@ with pkgs;
     scheme = guile;
   };
 
-  snac2 = darwin.apple_sdk_11_0.callPackage ../servers/snac2 { };
-
   soapyairspy = callPackage ../applications/radio/soapyairspy {
     inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.frameworks) IOKit Security;