diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 480cba954acd..8922ab37e1f5 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -168,3 +168,6 @@ fc7a83f8b62e90de5679e993d4d49ca014ea013d
 
 # nrr: format with nixfmt-rfc-style (#334578)
 cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
+
+# nixos/kanidm: inherit lib, nixfmt
+8f18393d380079904d072007fb19dc64baef0a3a
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ed5817f57801..b424321e6436 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2736,7 +2736,7 @@
   };
   blitz = {
     email = "js@alien8.de";
-    matrix = "@js:ukvly.org";
+    matrix = "@blitz:chat.x86.lol";
     github = "blitz";
     githubId = 37907;
     name = "Julian Stecklina";
@@ -16685,6 +16685,13 @@
     githubId = 74465;
     name = "James Fargher";
   };
+  progrm_jarvis = {
+    email = "mrjarviscraft+nix@gmail.com";
+    github = "JarvisCraft";
+    githubId = 7693005;
+    name = "Petr Portnov";
+    keys = [ { fingerprint = "884B 08D2 8DFF 6209 1857  C1C7 7E8F C8F7 D1BB 84A3"; } ];
+  };
   progval = {
     email = "progval+nix@progval.net";
     github = "progval";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 1daee20ff7cc..6534cdcc97b5 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -504,6 +504,7 @@ with lib.maintainers;
     githubTeams = [ "k3s" ];
     members = [
       euank
+      frederictobiasc
       marcusramberg
       mic92
       rorosen
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 4c6a8c561534..af1b1c01ebd8 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -384,6 +384,8 @@
 
 - Kanidm can now be provisioned using the new [`services.kanidm.provision`] option, but requires using a patched version available via `pkgs.kanidm.withSecretProvisioning`.
 
+- Kanidm previously had an incorrect systemd service type, causing dependent units with an `after` and `requires` directive to start before `kanidm*` finished startup. The module has now been updated in line with upstream recommendations.
+
 - To facilitate dependency injection, the `imgui` package now builds a static archive using vcpkg' CMake rules.
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
diff --git a/nixos/modules/services/misc/ollama.nix b/nixos/modules/services/misc/ollama.nix
index a1141c784b4d..f9d151927995 100644
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@@ -127,8 +127,7 @@ in
         example = "10.3.0";
         description = ''
           Override what rocm will detect your gpu model as.
-          For example, make rocm treat your RX 5700 XT (or any other model)
-          as an RX 6900 XT using a value of `"10.3.0"` (gfx 1030).
+          For example, if you have an RX 5700 XT, try setting this to `"10.1.0"` (gfx 1010).
 
           This sets the value of `HSA_OVERRIDE_GFX_VERSION`. See [ollama's docs](
           https://github.com/ollama/ollama/blob/main/docs/gpu.md#amd-radeon
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index 2e572a3d071a..d9c314f5ec64 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -313,11 +313,16 @@ in
       group = cfg.user;
       description = "smokeping daemon user";
       home = smokepingHome;
-      createHome = true;
-      # When `cfg.webService` is enabled, `nginx` requires read permissions on the home directory.
-      homeMode = "711";
     };
+
+    users.users.${config.services.nginx.user} = mkIf cfg.webService {
+      extraGroups = [
+        cfg.user ## user == group in this module
+      ];
+    };
+
     users.groups.${cfg.user} = { };
+
     systemd.services.smokeping = {
       reloadTriggers = [ configPath ];
       requiredBy = [ "multi-user.target" ];
@@ -327,15 +332,23 @@ in
         ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon";
       };
       preStart = ''
-        mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data
-        ln -snf ${cfg.package}/htdocs/css ${smokepingHome}/css
-        ln -snf ${cfg.package}/htdocs/js ${smokepingHome}/js
-        ln -snf ${cgiHome} ${smokepingHome}/smokeping.fcgi
         ${cfg.package}/bin/smokeping --check --config=${configPath}
         ${cfg.package}/bin/smokeping --static --config=${configPath}
       '';
     };
 
+    systemd.tmpfiles.rules = [
+      # create cache and data directories
+      "d ${smokepingHome}/cache 0750 ${cfg.user} ${cfg.user}"
+      "d ${smokepingHome}/data 0750 ${cfg.user} ${cfg.user}"
+      # create symlings
+      "L+ ${smokepingHome}/css - - - - ${cfg.package}/htdocs/css"
+      "L+ ${smokepingHome}/js - - - - ${cfg.package}/htdocs/js"
+      "L+ ${smokepingHome}/smokeping.fcgi - - - - ${cgiHome}"
+      # recursively adjust access mode and ownership (in case config change)
+      "Z ${smokepingHome} 0750 ${cfg.user} ${cfg.user}"
+    ];
+
     # use nginx to serve the smokeping web service
     services.fcgiwrap.instances.smokeping = mkIf cfg.webService {
       process.user = cfg.user;
@@ -367,4 +380,3 @@ in
     nh2
   ];
 }
-
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index dd86fab09a17..cf2fffac3f5d 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -6,10 +6,42 @@
   ...
 }:
 let
+  inherit (lib)
+    any
+    attrNames
+    attrValues
+    concatLines
+    concatLists
+    converge
+    filter
+    filterAttrs
+    filterAttrsRecursive
+    flip
+    foldl'
+    getExe
+    hasInfix
+    hasPrefix
+    isStorePath
+    last
+    mapAttrsToList
+    mkEnableOption
+    mkForce
+    mkIf
+    mkMerge
+    mkOption
+    mkPackageOption
+    optional
+    optionalString
+    splitString
+    subtractLists
+    types
+    unique
+    ;
+
   cfg = config.services.kanidm;
   settingsFormat = pkgs.formats.toml { };
   # Remove null values, so we can document optional values that don't end up in the generated TOML file.
-  filterConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null));
+  filterConfig = converge (filterAttrsRecursive (_: v: v != null));
   serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
   clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
   unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
@@ -22,24 +54,26 @@ let
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
   # paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
   hasPrefixInList =
-    list: newPath:
-    lib.any (path: lib.hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
-  mergePaths = lib.foldl' (
+    list: newPath: any (path: hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
+  mergePaths = foldl' (
     merged: newPath:
     let
       # If the new path is a prefix to some existing path, we need to filter it out
-      filteredPaths = lib.filter (
-        p: !lib.hasPrefix (builtins.toString newPath) (builtins.toString p)
-      ) merged;
+      filteredPaths = filter (p: !hasPrefix (builtins.toString newPath) (builtins.toString p)) merged;
       # If a prefix of the new path is already in the list, do not add it
-      filteredNew = lib.optional (!hasPrefixInList filteredPaths newPath) newPath;
+      filteredNew = optional (!hasPrefixInList filteredPaths newPath) newPath;
     in
     filteredPaths ++ filteredNew
   ) [ ];
 
   defaultServiceConfig = {
+    # Setting the type to notify enables additional healthchecks, ensuring units
+    # after and requiring kanidm-* wait for it to complete startup
+    Type = "notify";
     BindReadOnlyPaths = [
       "/nix/store"
+      # For healthcheck notifications
+      "/run/systemd/notify"
       "-/etc/resolv.conf"
       "-/etc/nsswitch.conf"
       "-/etc/hosts"
@@ -84,13 +118,13 @@ let
 
   mkPresentOption =
     what:
-    lib.mkOption {
+    mkOption {
       description = "Whether to ensure that this ${what} is present or absent.";
-      type = lib.types.bool;
+      type = types.bool;
       default = true;
     };
 
-  filterPresent = lib.filterAttrs (_: v: v.present);
+  filterPresent = filterAttrs (_: v: v.present);
 
   provisionStateJson = pkgs.writeText "provision-state.json" (
     builtins.toJSON { inherit (cfg.provision) groups persons systems; }
@@ -98,7 +132,7 @@ let
 
   # Only recover the admin account if a password should explicitly be provisioned
   # for the account. Otherwise it is not needed for provisioning.
-  maybeRecoverAdmin = lib.optionalString (cfg.provision.adminPasswordFile != null) ''
+  maybeRecoverAdmin = optionalString (cfg.provision.adminPasswordFile != null) ''
     KANIDM_ADMIN_PASSWORD=$(< ${cfg.provision.adminPasswordFile})
     # We always reset the admin account password if a desired password was specified.
     if ! KANIDM_RECOVER_ACCOUNT_PASSWORD=$KANIDM_ADMIN_PASSWORD ${cfg.package}/bin/kanidmd recover-account -c ${serverConfigFile} admin --from-environment >/dev/null; then
@@ -128,7 +162,7 @@ let
           echo "kanidm provision: Failed to recover admin account" >&2
           exit 1
         fi
-        if ! KANIDM_IDM_ADMIN_PASSWORD=$(grep '{"password' <<< "$recover_out" | ${lib.getExe pkgs.jq} -r .password); then
+        if ! KANIDM_IDM_ADMIN_PASSWORD=$(grep '{"password' <<< "$recover_out" | ${getExe pkgs.jq} -r .password); then
           echo "$recover_out" >&2
           echo "kanidm provision: Failed to parse password for idm_admin account" >&2
           exit 1
@@ -140,8 +174,8 @@ let
 
     # Wait for the kanidm server to come online
     count=0
-    while ! ${lib.getExe pkgs.curl} -L --silent --max-time 1 --connect-timeout 1 --fail \
-       ${lib.optionalString cfg.provision.acceptInvalidCerts "--insecure"} \
+    while ! ${getExe pkgs.curl} -L --silent --max-time 1 --connect-timeout 1 --fail \
+       ${optionalString cfg.provision.acceptInvalidCerts "--insecure"} \
        ${cfg.provision.instanceUrl} >/dev/null
     do
       sleep 1
@@ -156,58 +190,58 @@ let
     ${maybeRecoverAdmin}
 
     KANIDM_PROVISION_IDM_ADMIN_TOKEN=$KANIDM_IDM_ADMIN_PASSWORD \
-      ${lib.getExe pkgs.kanidm-provision} \
-        ${lib.optionalString (!cfg.provision.autoRemove) "--no-auto-remove"} \
-        ${lib.optionalString cfg.provision.acceptInvalidCerts "--accept-invalid-certs"} \
+      ${getExe pkgs.kanidm-provision} \
+        ${optionalString (!cfg.provision.autoRemove) "--no-auto-remove"} \
+        ${optionalString cfg.provision.acceptInvalidCerts "--accept-invalid-certs"} \
         --url "${cfg.provision.instanceUrl}" \
         --state ${provisionStateJson}
   '';
 
   serverPort =
     # ipv6:
-    if lib.hasInfix "]:" cfg.serverSettings.bindaddress then
-      lib.last (lib.splitString "]:" cfg.serverSettings.bindaddress)
+    if hasInfix "]:" cfg.serverSettings.bindaddress then
+      last (splitString "]:" cfg.serverSettings.bindaddress)
     else
     # ipv4:
-    if lib.hasInfix "." cfg.serverSettings.bindaddress then
-      lib.last (lib.splitString ":" cfg.serverSettings.bindaddress)
+    if hasInfix "." cfg.serverSettings.bindaddress then
+      last (splitString ":" cfg.serverSettings.bindaddress)
     # default is 8443
     else
       "8443";
 in
 {
   options.services.kanidm = {
-    enableClient = lib.mkEnableOption "the Kanidm client";
-    enableServer = lib.mkEnableOption "the Kanidm server";
-    enablePam = lib.mkEnableOption "the Kanidm PAM and NSS integration";
+    enableClient = mkEnableOption "the Kanidm client";
+    enableServer = mkEnableOption "the Kanidm server";
+    enablePam = mkEnableOption "the Kanidm PAM and NSS integration";
 
-    package = lib.mkPackageOption pkgs "kanidm" { };
+    package = mkPackageOption pkgs "kanidm" { };
 
-    serverSettings = lib.mkOption {
-      type = lib.types.submodule {
+    serverSettings = mkOption {
+      type = types.submodule {
         freeformType = settingsFormat.type;
 
         options = {
-          bindaddress = lib.mkOption {
+          bindaddress = mkOption {
             description = "Address/port combination the webserver binds to.";
             example = "[::1]:8443";
-            type = lib.types.str;
+            type = types.str;
           };
           # Should be optional but toml does not accept null
-          ldapbindaddress = lib.mkOption {
+          ldapbindaddress = mkOption {
             description = ''
               Address and port the LDAP server is bound to. Setting this to `null` disables the LDAP interface.
             '';
             example = "[::1]:636";
             default = null;
-            type = lib.types.nullOr lib.types.str;
+            type = types.nullOr types.str;
           };
-          origin = lib.mkOption {
+          origin = mkOption {
             description = "The origin of your Kanidm instance. Must have https as protocol.";
             example = "https://idm.example.org";
-            type = lib.types.strMatching "^https://.*";
+            type = types.strMatching "^https://.*";
           };
-          domain = lib.mkOption {
+          domain = mkOption {
             description = ''
               The `domain` that Kanidm manages. Must be below or equal to the domain
               specified in `serverSettings.origin`.
@@ -218,58 +252,58 @@ in
             '';
             example = "example.org";
             default = null;
-            type = lib.types.nullOr lib.types.str;
+            type = types.nullOr types.str;
           };
-          db_path = lib.mkOption {
+          db_path = mkOption {
             description = "Path to Kanidm database.";
             default = "/var/lib/kanidm/kanidm.db";
             readOnly = true;
-            type = lib.types.path;
+            type = types.path;
           };
-          tls_chain = lib.mkOption {
+          tls_chain = mkOption {
             description = "TLS chain in pem format.";
-            type = lib.types.path;
+            type = types.path;
           };
-          tls_key = lib.mkOption {
+          tls_key = mkOption {
             description = "TLS key in pem format.";
-            type = lib.types.path;
+            type = types.path;
           };
-          log_level = lib.mkOption {
+          log_level = mkOption {
             description = "Log level of the server.";
             default = "info";
-            type = lib.types.enum [
+            type = types.enum [
               "info"
               "debug"
               "trace"
             ];
           };
-          role = lib.mkOption {
+          role = mkOption {
             description = "The role of this server. This affects the replication relationship and thereby available features.";
             default = "WriteReplica";
-            type = lib.types.enum [
+            type = types.enum [
               "WriteReplica"
               "WriteReplicaNoUI"
               "ReadOnlyReplica"
             ];
           };
           online_backup = {
-            path = lib.mkOption {
+            path = mkOption {
               description = "Path to the output directory for backups.";
-              type = lib.types.path;
+              type = types.path;
               default = "/var/lib/kanidm/backups";
             };
-            schedule = lib.mkOption {
+            schedule = mkOption {
               description = "The schedule for backups in cron format.";
-              type = lib.types.str;
+              type = types.str;
               default = "00 22 * * *";
             };
-            versions = lib.mkOption {
+            versions = mkOption {
               description = ''
                 Number of backups to keep.
 
                 The default is set to `0`, in order to disable backups by default.
               '';
-              type = lib.types.ints.unsigned;
+              type = types.ints.unsigned;
               default = 0;
               example = 7;
             };
@@ -285,14 +319,14 @@ in
       '';
     };
 
-    clientSettings = lib.mkOption {
-      type = lib.types.submodule {
+    clientSettings = mkOption {
+      type = types.submodule {
         freeformType = settingsFormat.type;
 
-        options.uri = lib.mkOption {
+        options.uri = mkOption {
           description = "Address of the Kanidm server.";
           example = "http://127.0.0.1:8080";
-          type = lib.types.str;
+          type = types.str;
         };
       };
       description = ''
@@ -303,20 +337,20 @@ in
       '';
     };
 
-    unixSettings = lib.mkOption {
-      type = lib.types.submodule {
+    unixSettings = mkOption {
+      type = types.submodule {
         freeformType = settingsFormat.type;
 
         options = {
-          pam_allowed_login_groups = lib.mkOption {
+          pam_allowed_login_groups = mkOption {
             description = "Kanidm groups that are allowed to login using PAM.";
             example = "my_pam_group";
-            type = lib.types.listOf lib.types.str;
+            type = types.listOf types.str;
           };
-          hsm_pin_path = lib.mkOption {
+          hsm_pin_path = mkOption {
             description = "Path to a HSM pin.";
             default = "/var/cache/kanidm-unixd/hsm-pin";
-            type = lib.types.path;
+            type = types.path;
           };
         };
       };
@@ -329,73 +363,73 @@ in
     };
 
     provision = {
-      enable = lib.mkEnableOption "provisioning of groups, users and oauth2 resource servers";
+      enable = mkEnableOption "provisioning of groups, users and oauth2 resource servers";
 
-      instanceUrl = lib.mkOption {
+      instanceUrl = mkOption {
         description = "The instance url to which the provisioning tool should connect.";
         default = "https://localhost:${serverPort}";
         defaultText = ''"https://localhost:<port from serverSettings.bindaddress>"'';
-        type = lib.types.str;
+        type = types.str;
       };
 
-      acceptInvalidCerts = lib.mkOption {
+      acceptInvalidCerts = mkOption {
         description = ''
           Whether to allow invalid certificates when provisioning the target instance.
           By default this is only allowed when the instanceUrl is localhost. This is
           dangerous when used with an external URL.
         '';
-        type = lib.types.bool;
-        default = lib.hasPrefix "https://localhost:" cfg.provision.instanceUrl;
-        defaultText = ''lib.hasPrefix "https://localhost:" cfg.provision.instanceUrl'';
+        type = types.bool;
+        default = hasPrefix "https://localhost:" cfg.provision.instanceUrl;
+        defaultText = ''hasPrefix "https://localhost:" cfg.provision.instanceUrl'';
       };
 
-      adminPasswordFile = lib.mkOption {
+      adminPasswordFile = mkOption {
         description = "Path to a file containing the admin password for kanidm. Do NOT use a file from the nix store here!";
         example = "/run/secrets/kanidm-admin-password";
         default = null;
-        type = lib.types.nullOr lib.types.path;
+        type = types.nullOr types.path;
       };
 
-      idmAdminPasswordFile = lib.mkOption {
+      idmAdminPasswordFile = mkOption {
         description = ''
           Path to a file containing the idm admin password for kanidm. Do NOT use a file from the nix store here!
           If this is not given but provisioning is enabled, the idm_admin password will be reset on each restart.
         '';
         example = "/run/secrets/kanidm-idm-admin-password";
         default = null;
-        type = lib.types.nullOr lib.types.path;
+        type = types.nullOr types.path;
       };
 
-      autoRemove = lib.mkOption {
+      autoRemove = mkOption {
         description = ''
           Determines whether deleting an entity in this provisioning config should automatically
           cause them to be removed from kanidm, too. This works because the provisioning tool tracks
           all entities it has ever created. If this is set to false, you need to explicitly specify
           `present = false` to delete an entity.
         '';
-        type = lib.types.bool;
+        type = types.bool;
         default = true;
       };
 
-      groups = lib.mkOption {
+      groups = mkOption {
         description = "Provisioning of kanidm groups";
         default = { };
-        type = lib.types.attrsOf (
-          lib.types.submodule (groupSubmod: {
+        type = types.attrsOf (
+          types.submodule (groupSubmod: {
             options = {
               present = mkPresentOption "group";
 
-              members = lib.mkOption {
+              members = mkOption {
                 description = "List of kanidm entities (persons, groups, ...) which are part of this group.";
-                type = lib.types.listOf lib.types.str;
-                apply = lib.unique;
+                type = types.listOf types.str;
+                apply = unique;
                 default = [ ];
               };
             };
-            config.members = lib.concatLists (
-              lib.flip lib.mapAttrsToList cfg.provision.persons (
+            config.members = concatLists (
+              flip mapAttrsToList cfg.provision.persons (
                 person: personCfg:
-                lib.optional (
+                optional (
                   personCfg.present && builtins.elem groupSubmod.config._module.args.name personCfg.groups
                 ) person
               )
@@ -404,38 +438,38 @@ in
         );
       };
 
-      persons = lib.mkOption {
+      persons = mkOption {
         description = "Provisioning of kanidm persons";
         default = { };
-        type = lib.types.attrsOf (
-          lib.types.submodule {
+        type = types.attrsOf (
+          types.submodule {
             options = {
               present = mkPresentOption "person";
 
-              displayName = lib.mkOption {
+              displayName = mkOption {
                 description = "Display name";
-                type = lib.types.str;
+                type = types.str;
                 example = "My User";
               };
 
-              legalName = lib.mkOption {
+              legalName = mkOption {
                 description = "Full legal name";
-                type = lib.types.nullOr lib.types.str;
+                type = types.nullOr types.str;
                 example = "Jane Doe";
                 default = null;
               };
 
-              mailAddresses = lib.mkOption {
+              mailAddresses = mkOption {
                 description = "Mail addresses. First given address is considered the primary address.";
-                type = lib.types.listOf lib.types.str;
+                type = types.listOf types.str;
                 example = [ "jane.doe@example.com" ];
                 default = [ ];
               };
 
-              groups = lib.mkOption {
+              groups = mkOption {
                 description = "List of groups this person should belong to.";
-                type = lib.types.listOf lib.types.str;
-                apply = lib.unique;
+                type = types.listOf types.str;
+                apply = unique;
                 default = [ ];
               };
             };
@@ -443,119 +477,119 @@ in
         );
       };
 
-      systems.oauth2 = lib.mkOption {
+      systems.oauth2 = mkOption {
         description = "Provisioning of oauth2 resource servers";
         default = { };
-        type = lib.types.attrsOf (
-          lib.types.submodule {
+        type = types.attrsOf (
+          types.submodule {
             options = {
               present = mkPresentOption "oauth2 resource server";
 
-              public = lib.mkOption {
+              public = mkOption {
                 description = "Whether this is a public client (enforces PKCE, doesn't use a basic secret)";
-                type = lib.types.bool;
+                type = types.bool;
                 default = false;
               };
 
-              displayName = lib.mkOption {
+              displayName = mkOption {
                 description = "Display name";
-                type = lib.types.str;
+                type = types.str;
                 example = "Some Service";
               };
 
-              originUrl = lib.mkOption {
+              originUrl = mkOption {
                 description = "The origin URL of the service. OAuth2 redirects will only be allowed to sites under this origin. Must end with a slash.";
                 type =
                   let
-                    originStrType = lib.types.strMatching ".*://.*/$";
+                    originStrType = types.strMatching ".*://.*/$";
                   in
-                  lib.types.either originStrType (lib.types.nonEmptyListOf originStrType);
+                  types.either originStrType (types.nonEmptyListOf originStrType);
                 example = "https://someservice.example.com/";
               };
 
-              originLanding = lib.mkOption {
+              originLanding = mkOption {
                 description = "When redirecting from the Kanidm Apps Listing page, some linked applications may need to land on a specific page to trigger oauth2/oidc interactions.";
-                type = lib.types.str;
+                type = types.str;
                 example = "https://someservice.example.com/home";
               };
 
-              basicSecretFile = lib.mkOption {
+              basicSecretFile = mkOption {
                 description = ''
                   The basic secret to use for this service. If null, the random secret generated
                   by kanidm will not be touched. Do NOT use a path from the nix store here!
                 '';
-                type = lib.types.nullOr lib.types.path;
+                type = types.nullOr types.path;
                 example = "/run/secrets/some-oauth2-basic-secret";
                 default = null;
               };
 
-              enableLocalhostRedirects = lib.mkOption {
+              enableLocalhostRedirects = mkOption {
                 description = "Allow localhost redirects. Only for public clients.";
-                type = lib.types.bool;
+                type = types.bool;
                 default = false;
               };
 
-              enableLegacyCrypto = lib.mkOption {
+              enableLegacyCrypto = mkOption {
                 description = "Enable legacy crypto on this client. Allows JWT signing algorthms like RS256.";
-                type = lib.types.bool;
+                type = types.bool;
                 default = false;
               };
 
-              allowInsecureClientDisablePkce = lib.mkOption {
+              allowInsecureClientDisablePkce = mkOption {
                 description = ''
                   Disable PKCE on this oauth2 resource server to work around insecure clients
                   that may not support it. You should request the client to enable PKCE!
                   Only for non-public clients.
                 '';
-                type = lib.types.bool;
+                type = types.bool;
                 default = false;
               };
 
-              preferShortUsername = lib.mkOption {
+              preferShortUsername = mkOption {
                 description = "Use 'name' instead of 'spn' in the preferred_username claim";
-                type = lib.types.bool;
+                type = types.bool;
                 default = false;
               };
 
-              scopeMaps = lib.mkOption {
+              scopeMaps = mkOption {
                 description = ''
                   Maps kanidm groups to returned oauth scopes.
                   See [Scope Relations](https://kanidm.github.io/kanidm/stable/integrations/oauth2.html#scope-relationships) for more information.
                 '';
-                type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+                type = types.attrsOf (types.listOf types.str);
                 default = { };
               };
 
-              supplementaryScopeMaps = lib.mkOption {
+              supplementaryScopeMaps = mkOption {
                 description = ''
                   Maps kanidm groups to additionally returned oauth scopes.
                   See [Scope Relations](https://kanidm.github.io/kanidm/stable/integrations/oauth2.html#scope-relationships) for more information.
                 '';
-                type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+                type = types.attrsOf (types.listOf types.str);
                 default = { };
               };
 
-              removeOrphanedClaimMaps = lib.mkOption {
+              removeOrphanedClaimMaps = mkOption {
                 description = "Whether claim maps not specified here but present in kanidm should be removed from kanidm.";
-                type = lib.types.bool;
+                type = types.bool;
                 default = true;
               };
 
-              claimMaps = lib.mkOption {
+              claimMaps = mkOption {
                 description = ''
                   Adds additional claims (and values) based on which kanidm groups an authenticating party belongs to.
                   See [Claim Maps](https://kanidm.github.io/kanidm/master/integrations/oauth2.html#custom-claim-maps) for more information.
                 '';
                 default = { };
-                type = lib.types.attrsOf (
-                  lib.types.submodule {
+                type = types.attrsOf (
+                  types.submodule {
                     options = {
-                      joinType = lib.mkOption {
+                      joinType = mkOption {
                         description = ''
                           Determines how multiple values are joined to create the claim value.
                           See [Claim Maps](https://kanidm.github.io/kanidm/master/integrations/oauth2.html#custom-claim-maps) for more information.
                         '';
-                        type = lib.types.enum [
+                        type = types.enum [
                           "array"
                           "csv"
                           "ssv"
@@ -563,10 +597,10 @@ in
                         default = "array";
                       };
 
-                      valuesByGroup = lib.mkOption {
+                      valuesByGroup = mkOption {
                         description = "Maps kanidm groups to values for the claim.";
                         default = { };
-                        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+                        type = types.attrsOf (types.listOf types.str);
                       };
                     };
                   }
@@ -579,26 +613,26 @@ in
     };
   };
 
-  config = lib.mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
+  config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
     assertions =
       let
         entityList =
-          type: attrs: lib.flip lib.mapAttrsToList (filterPresent attrs) (name: _: { inherit type name; });
+          type: attrs: flip mapAttrsToList (filterPresent attrs) (name: _: { inherit type name; });
         entities =
           entityList "group" cfg.provision.groups
           ++ entityList "person" cfg.provision.persons
           ++ entityList "oauth2" cfg.provision.systems.oauth2;
 
         # Accumulate entities by name. Track corresponding entity types for later duplicate check.
-        entitiesByName = lib.foldl' (
+        entitiesByName = foldl' (
           acc: { type, name }: acc // { ${name} = (acc.${name} or [ ]) ++ [ type ]; }
         ) { } entities;
 
         assertGroupsKnown =
           opt: groups:
           let
-            knownGroups = lib.attrNames (filterPresent cfg.provision.groups);
-            unknownGroups = lib.subtractLists knownGroups groups;
+            knownGroups = attrNames (filterPresent cfg.provision.groups);
+            unknownGroups = subtractLists knownGroups groups;
           in
           {
             assertion = (cfg.enableServer && cfg.provision.enable) -> unknownGroups == [ ];
@@ -608,7 +642,7 @@ in
         assertEntitiesKnown =
           opt: entities:
           let
-            unknownEntities = lib.subtractLists (lib.attrNames entitiesByName) entities;
+            unknownEntities = subtractLists (attrNames entitiesByName) entities;
           in
           {
             assertion = (cfg.enableServer && cfg.provision.enable) -> unknownEntities == [ ];
@@ -620,7 +654,7 @@ in
           assertion =
             !cfg.enableServer
             || ((cfg.serverSettings.tls_chain or null) == null)
-            || (!lib.isStorePath cfg.serverSettings.tls_chain);
+            || (!isStorePath cfg.serverSettings.tls_chain);
           message = ''
             <option>services.kanidm.serverSettings.tls_chain</option> points to
             a file in the Nix store. You should use a quoted absolute path to
@@ -631,7 +665,7 @@ in
           assertion =
             !cfg.enableServer
             || ((cfg.serverSettings.tls_key or null) == null)
-            || (!lib.isStorePath cfg.serverSettings.tls_key);
+            || (!isStorePath cfg.serverSettings.tls_key);
           message = ''
             <option>services.kanidm.serverSettings.tls_key</option> points to
             a file in the Nix store. You should use a quoted absolute path to
@@ -677,9 +711,7 @@ in
               && (
                 cfg.provision.adminPasswordFile != null
                 || cfg.provision.idmAdminPasswordFile != null
-                || lib.any (x: x.basicSecretFile != null) (
-                  lib.attrValues (filterPresent cfg.provision.systems.oauth2)
-                )
+                || any (x: x.basicSecretFile != null) (attrValues (filterPresent cfg.provision.systems.oauth2))
               )
             )
             -> cfg.package.enableSecretProvisioning;
@@ -692,48 +724,48 @@ in
         (
           let
             # Filter all names that occurred in more than one entity type.
-            duplicateNames = lib.filterAttrs (_: v: builtins.length v > 1) entitiesByName;
+            duplicateNames = filterAttrs (_: v: builtins.length v > 1) entitiesByName;
           in
           {
             assertion = cfg.provision.enable -> duplicateNames == { };
             message = ''
               services.kanidm.provision requires all entity names (group, person, oauth2, ...) to be unique!
-              ${lib.concatLines (
-                lib.mapAttrsToList (name: xs: "  - '${name}' used as: ${toString xs}") duplicateNames
+              ${concatLines (
+                mapAttrsToList (name: xs: "  - '${name}' used as: ${toString xs}") duplicateNames
               )}'';
           }
         )
       ]
-      ++ lib.flip lib.mapAttrsToList (filterPresent cfg.provision.persons) (
+      ++ flip mapAttrsToList (filterPresent cfg.provision.persons) (
         person: personCfg:
         assertGroupsKnown "services.kanidm.provision.persons.${person}.groups" personCfg.groups
       )
-      ++ lib.flip lib.mapAttrsToList (filterPresent cfg.provision.groups) (
+      ++ flip mapAttrsToList (filterPresent cfg.provision.groups) (
         group: groupCfg:
         assertEntitiesKnown "services.kanidm.provision.groups.${group}.members" groupCfg.members
       )
-      ++ lib.concatLists (
-        lib.flip lib.mapAttrsToList (filterPresent cfg.provision.systems.oauth2) (
+      ++ concatLists (
+        flip mapAttrsToList (filterPresent cfg.provision.systems.oauth2) (
           oauth2: oauth2Cfg:
           [
             (assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.scopeMaps" (
-              lib.attrNames oauth2Cfg.scopeMaps
+              attrNames oauth2Cfg.scopeMaps
             ))
             (assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.supplementaryScopeMaps" (
-              lib.attrNames oauth2Cfg.supplementaryScopeMaps
+              attrNames oauth2Cfg.supplementaryScopeMaps
             ))
           ]
-          ++ lib.concatLists (
-            lib.flip lib.mapAttrsToList oauth2Cfg.claimMaps (
+          ++ concatLists (
+            flip mapAttrsToList oauth2Cfg.claimMaps (
               claim: claimCfg: [
                 (assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.claimMaps.${claim}.valuesByGroup" (
-                  lib.attrNames claimCfg.valuesByGroup
+                  attrNames claimCfg.valuesByGroup
                 ))
                 # At least one group must map to a value in each claim map
                 {
                   assertion =
                     (cfg.provision.enable && cfg.enableServer)
-                    -> lib.any (xs: xs != [ ]) (lib.attrValues claimCfg.valuesByGroup);
+                    -> any (xs: xs != [ ]) (attrValues claimCfg.valuesByGroup);
                   message = "services.kanidm.provision.systems.oauth2.${oauth2}.claimMaps.${claim} does not specify any values for any group";
                 }
                 # Public clients cannot define a basic secret
@@ -762,7 +794,7 @@ in
         )
       );
 
-    environment.systemPackages = lib.mkIf cfg.enableClient [ cfg.package ];
+    environment.systemPackages = mkIf cfg.enableClient [ cfg.package ];
 
     systemd.tmpfiles.settings."10-kanidm" = {
       ${cfg.serverSettings.online_backup.path}.d = {
@@ -772,11 +804,11 @@ in
       };
     };
 
-    systemd.services.kanidm = lib.mkIf cfg.enableServer {
+    systemd.services.kanidm = mkIf cfg.enableServer {
       description = "kanidm identity management daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      serviceConfig = lib.mkMerge [
+      serviceConfig = mkMerge [
         # Merge paths and ignore existing prefixes needs to sidestep mkMerge
         (
           defaultServiceConfig
@@ -789,7 +821,7 @@ in
           StateDirectoryMode = "0700";
           RuntimeDirectory = "kanidmd";
           ExecStart = "${cfg.package}/bin/kanidmd server -c ${serverConfigFile}";
-          ExecStartPost = lib.mkIf cfg.provision.enable postStartScript;
+          ExecStartPost = mkIf cfg.provision.enable postStartScript;
           User = "kanidm";
           Group = "kanidm";
 
@@ -803,9 +835,9 @@ in
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
           # This would otherwise override the CAP_NET_BIND_SERVICE capability.
-          PrivateUsers = lib.mkForce false;
+          PrivateUsers = mkForce false;
           # Port needs to be exposed to the host network
-          PrivateNetwork = lib.mkForce false;
+          PrivateNetwork = mkForce false;
           RestrictAddressFamilies = [
             "AF_INET"
             "AF_INET6"
@@ -817,7 +849,7 @@ in
       environment.RUST_LOG = "info";
     };
 
-    systemd.services.kanidm-unixd = lib.mkIf cfg.enablePam {
+    systemd.services.kanidm-unixd = mkIf cfg.enablePam {
       description = "Kanidm PAM daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
@@ -825,7 +857,7 @@ in
         unixConfigFile
         clientConfigFile
       ];
-      serviceConfig = lib.mkMerge [
+      serviceConfig = mkMerge [
         defaultServiceConfig
         {
           CacheDirectory = "kanidm-unixd";
@@ -848,7 +880,7 @@ in
             "/run/kanidm-unixd:/var/run/kanidm-unixd"
           ];
           # Needs to connect to kanidmd
-          PrivateNetwork = lib.mkForce false;
+          PrivateNetwork = mkForce false;
           RestrictAddressFamilies = [
             "AF_INET"
             "AF_INET6"
@@ -860,7 +892,7 @@ in
       environment.RUST_LOG = "info";
     };
 
-    systemd.services.kanidm-unixd-tasks = lib.mkIf cfg.enablePam {
+    systemd.services.kanidm-unixd-tasks = mkIf cfg.enablePam {
       description = "Kanidm PAM home management daemon";
       wantedBy = [ "multi-user.target" ];
       after = [
@@ -910,25 +942,25 @@ in
     };
 
     # These paths are hardcoded
-    environment.etc = lib.mkMerge [
-      (lib.mkIf cfg.enableServer { "kanidm/server.toml".source = serverConfigFile; })
-      (lib.mkIf options.services.kanidm.clientSettings.isDefined {
+    environment.etc = mkMerge [
+      (mkIf cfg.enableServer { "kanidm/server.toml".source = serverConfigFile; })
+      (mkIf options.services.kanidm.clientSettings.isDefined {
         "kanidm/config".source = clientConfigFile;
       })
-      (lib.mkIf cfg.enablePam { "kanidm/unixd".source = unixConfigFile; })
+      (mkIf cfg.enablePam { "kanidm/unixd".source = unixConfigFile; })
     ];
 
-    system.nssModules = lib.mkIf cfg.enablePam [ cfg.package ];
+    system.nssModules = mkIf cfg.enablePam [ cfg.package ];
 
-    system.nssDatabases.group = lib.optional cfg.enablePam "kanidm";
-    system.nssDatabases.passwd = lib.optional cfg.enablePam "kanidm";
+    system.nssDatabases.group = optional cfg.enablePam "kanidm";
+    system.nssDatabases.passwd = optional cfg.enablePam "kanidm";
 
-    users.groups = lib.mkMerge [
-      (lib.mkIf cfg.enableServer { kanidm = { }; })
-      (lib.mkIf cfg.enablePam { kanidm-unixd = { }; })
+    users.groups = mkMerge [
+      (mkIf cfg.enableServer { kanidm = { }; })
+      (mkIf cfg.enablePam { kanidm-unixd = { }; })
     ];
-    users.users = lib.mkMerge [
-      (lib.mkIf cfg.enableServer {
+    users.users = mkMerge [
+      (mkIf cfg.enableServer {
         kanidm = {
           description = "Kanidm server";
           isSystemUser = true;
@@ -936,7 +968,7 @@ in
           packages = [ cfg.package ];
         };
       })
-      (lib.mkIf cfg.enablePam {
+      (mkIf cfg.enablePam {
         kanidm-unixd = {
           description = "Kanidm PAM daemon";
           isSystemUser = true;
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index 372b47b56c34..c042b1065c26 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -20,7 +20,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       };
       networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
     };
-    machine = { config, lib, pkgs, ... }: {
+    machine = { lib, pkgs, ... }: {
       services.invidious = {
         enable = true;
       };
@@ -81,11 +81,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
 
     def activate_specialisation(name: str):
-        machine.succeed(f"${nodes.machine.config.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
+        machine.succeed(f"${nodes.machine.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
 
 
-    url = "http://localhost:${toString nodes.machine.config.services.invidious.port}"
-    port = ${toString nodes.machine.config.services.invidious.port}
+    url = "http://localhost:${toString nodes.machine.services.invidious.port}"
+    port = ${toString nodes.machine.services.invidious.port}
 
     # start postgres vm now
     postgres_tcp.start()
diff --git a/pkgs/applications/emulators/box64/default.nix b/pkgs/applications/emulators/box64/default.nix
index 5a6e87b0644a..7a9c22999b3e 100644
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@@ -21,13 +21,13 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "box64";
-  version = "0.2.8";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ptitSeb";
     repo = "box64";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P+m+JS3THh3LWMZYW6BQ7QyNWlBuL+hMcUtUbpMHzis=";
+    hash = "sha256-8PpTN7lUjpmSowbaRsfSRWJQRDZICFhVvn05tQYC4PQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index 6b144b683d0e..c100416a55c4 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-x82ek6KsfmVjG9P9EaGlvbncGaORqMB2lMxannZT4YE=";
+    hash = "sha256-Z7cFwR8IUThEd4Te3KHPC8K8v56ymAG7nIM/7pxWq4U=";
   };
 
-  vendorHash = "sha256-z859ZjuvY53HqHXNo8zZkK9XAtMOxh57FeXgGfno3G0=";
+  vendorHash = "sha256-0VVaD1vGIGezgkVCvIhNHmZqVFxFu4UcUUh0wuX2viw=";
 
   subPackages = [ "cmd/clusterctl" ];
 
diff --git a/pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix b/pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix
index cd20e48f734c..ac1f1cbf0b68 100644
--- a/pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubectl-evict-pod";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "rajatjindal";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yA88GDcu1Sg8d5RCC4yiDPYZPxDSnke/4X7nSBSGf88=";
+    sha256 = "sha256-Z1NIueonjyO2GHulBbXbsQtX7V/Z95GUoZv9AqjLIR0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/window-managers/wayfire/wcm.nix b/pkgs/applications/window-managers/wayfire/wcm.nix
index 4f1a6769ffbd..f82dac2e5162 100644
--- a/pkgs/applications/window-managers/wayfire/wcm.nix
+++ b/pkgs/applications/window-managers/wayfire/wcm.nix
@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wcm";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wcm";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-UwHJ4Wi83ATnA1CQKNSt8Qga7ooLnAY7QARz2FXvUIo=";
+    hash = "sha256-oaaEtyu/9XVhFTkmD7WjScMycpKf+M7oPyQatbY23Vo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chatzone-desktop/package.nix b/pkgs/by-name/ch/chatzone-desktop/package.nix
new file mode 100644
index 000000000000..27a0aba212e3
--- /dev/null
+++ b/pkgs/by-name/ch/chatzone-desktop/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  stdenvNoCC,
+  makeDesktopItem,
+  copyDesktopItems,
+  makeWrapper,
+}:
+
+let
+  pname = "chatzone-desktop";
+  version = "5.2.1";
+  src = fetchurl {
+    url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/31072024-1/407/chatzone-desktop-linux-5.2.1.AppImage";
+    hash = "sha256-IXn7mAY3+2q+/PKcNQbRVW+wbAPMWLUh/DGAic6M898=";
+  };
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version;
+
+  src = appimageTools.wrapType2 { inherit pname version src; };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "chatzone";
+      exec = "chatzone-desktop";
+      icon = "chatzone-desktop";
+      terminal = false;
+      desktopName = "Chatzone";
+      genericName = "Ozon corporate messenger";
+      comment = "Mattermost Desktop application for Linux";
+      categories = [
+        "Network"
+        "InstantMessaging"
+        "Chat"
+      ];
+      mimeTypes = [ "x-scheme-handler/mattermost" ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/
+    cp -r bin $out/bin
+
+    mkdir -p $out/share/chatzone-desktop/
+    cp ${appimageContents}/app_icon.png $out/share/chatzone-desktop/
+    cp -r ${appimageContents}/usr/share/icons $out/share
+
+    wrapProgram $out/bin/chatzone-desktop \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Ozon corporate messenger";
+    mainProgram = "chatzone-desktop";
+    homepage = "https://apps.o3team.ru/";
+    downloadPage = "https://apps.o3team.ru/";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/fl/flatpak/package.nix b/pkgs/by-name/fl/flatpak/package.nix
index 34cb1059b4f4..6e98f54facc1 100644
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -231,9 +231,9 @@ stdenv.mkDerivation (finalAttrs: {
       validate-icon = runCommand "test-icon-validation" { } ''
         ${finalAttrs.finalPackage}/libexec/flatpak-validate-icon \
           --sandbox 512 512 \
-          "${nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake-white.svg" > "$out"
+          "${nixos-icons}/share/icons/hicolor/512x512/apps/nix-snowflake.png" > "$out"
 
-        grep format=svg "$out"
+        grep format=png "$out"
       '';
 
       version = testers.testVersion { package = finalAttrs.finalPackage; };
diff --git a/pkgs/by-name/gl/glasskube/package.nix b/pkgs/by-name/gl/glasskube/package.nix
index 15500ed8ea9d..254a27f2cca0 100644
--- a/pkgs/by-name/gl/glasskube/package.nix
+++ b/pkgs/by-name/gl/glasskube/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.16.0";
+  version = "0.17.0";
   gitSrc = fetchFromGitHub {
     owner = "glasskube";
     repo = "glasskube";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NZ7FQMJyQlJW5ZS8dNzsURhRcu0IQXyTn/6e91eGhEg=";
+    hash = "sha256-uo612trSSdbj6XpZHddXELNQideJ/M/qh+LLdzVZL6U=";
   };
   web-bundle = buildNpmPackage rec {
     inherit version;
@@ -20,7 +20,7 @@ let
 
     src = gitSrc;
 
-    npmDepsHash = "sha256-0PzjOOdKkKjKUsi+uWYkGAyEXynMNq2OODH/sX2SsWQ=";
+    npmDepsHash = "sha256-s3ViR6zBUTTu864fiD06N1ouMUYXccj6AMXt5pj+BSc=";
 
     dontNpmInstall = true;
 
@@ -40,7 +40,7 @@ in buildGoModule rec {
 
   src = gitSrc;
 
-  vendorHash = "sha256-bh1ZQhd3xYoz4AEe/EZ4baBryQx4WfdacTQDP1Roi2Y=";
+  vendorHash = "sha256-KzoFPhySX2w7ndU6nndx/KqoUfE8o6OT/9a2DEz5YuI=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index 456dc2b72d37..a68b155a6a21 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nix-update-script, testers, immich-go }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "1.21.3";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     rev = "${version}";
-    hash = "sha256-DgTEkiT9D+8wa6mzWWnsh98f7hEEK5r3QiH2e1yarCU=";
+    hash = "sha256-dSyVn7CQqZ/tCxF/Yl12eubWkZrV5FM8uRexCjZILbw=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
diff --git a/pkgs/by-name/le/legba/package.nix b/pkgs/by-name/le/legba/package.nix
index 0ac2c5718726..3f2453a13d86 100644
--- a/pkgs/by-name/le/legba/package.nix
+++ b/pkgs/by-name/le/legba/package.nix
@@ -5,6 +5,8 @@
 , pkg-config
 , openssl
 , samba
+, stdenv
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,7 +23,9 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-viDfJ214Zf5segjrLSTbHav5T5e219NAF+MvuPow+JQ=";
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ openssl.dev samba ];
+  buildInputs = [ openssl.dev samba ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
 
   # Paho C test fails due to permission issue
   doCheck = false;
diff --git a/pkgs/by-name/lo/loopwm/package.nix b/pkgs/by-name/lo/loopwm/package.nix
index 5b1829a8ee04..bb3f2cca9a05 100644
--- a/pkgs/by-name/lo/loopwm/package.nix
+++ b/pkgs/by-name/lo/loopwm/package.nix
@@ -29,6 +29,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    updateScript = ./update.sh;
+  };
+
   meta = {
     description = "macOS Window management made elegant";
     homepage = "https://github.com/MrKai77/Loop";
diff --git a/pkgs/by-name/lo/loopwm/update.sh b/pkgs/by-name/lo/loopwm/update.sh
new file mode 100755
index 000000000000..82b720fa98fd
--- /dev/null
+++ b/pkgs/by-name/lo/loopwm/update.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused
+
+set -euo pipefail
+
+cd "$(dirname "$0")" || exit 1
+
+# Grab latest release version
+LOOPWM_LATEST_VER="$(curl --fail -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/MrKai77/Loop/releases/latest" | jq -r '.tag_name' | sed 's/^v//')"
+LOOPWM_CURRENT_VER="$(grep -oP 'version = "\K[^"]+' package.nix)"
+
+if [[ "$LOOPWM_LATEST_VER" == "$LOOPWM_CURRENT_VER" ]]; then
+    echo "loopwm is up-to-date"
+    exit 0
+fi
+
+LOOPWM_DARWIN_HASH="$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "https://github.com/MrKai77/Loop/releases/download/${LOOPWM_LATEST_VER}/Loop.zip")")"
+
+sed -i "s#hash = \".*\"#hash = \"$LOOPWM_DARWIN_HASH\"#g" package.nix
+sed -i "s#version = \".*\";#version = \"$LOOPWM_LATEST_VER\";#g" package.nix
diff --git a/pkgs/by-name/md/mdbook-alerts/package.nix b/pkgs/by-name/md/mdbook-alerts/package.nix
index 10f46976dc1a..d3bb146a60f0 100644
--- a/pkgs/by-name/md/mdbook-alerts/package.nix
+++ b/pkgs/by-name/md/mdbook-alerts/package.nix
@@ -7,7 +7,7 @@
   CoreServices ? darwin.apple_sdk.frameworks.CoreServices,
 }:
 let
-  version = "0.6.3";
+  version = "0.6.4";
 in
 rustPlatform.buildRustPackage {
   pname = "mdbook-alerts";
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "lambdalisue";
     repo = "rs-mdbook-alerts";
     rev = "v${version}";
-    hash = "sha256-MoaV/JRhWKYEzUkzxRTgYjqBw+gb2h+Bjb4mEvWEkp8=";
+    hash = "sha256-bg3X7M2H553tGxH8cEkkT0XK20fWwkp2nTVEgtZ819s=";
   };
 
-  cargoHash = "sha256-tHRbeDSK4aULz69jy5MeU4rANVuO2q3GUhDvBA4iQCM=";
+  cargoHash = "sha256-MMhpH3WIAXnjw6xOl2HNfrIFEwjHfVDPquWnFhhZCMU=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/by-name/mi/minijinja/package.nix b/pkgs/by-name/mi/minijinja/package.nix
index 635d593f2851..84aa6de0ba0d 100644
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-BB8uM0yU8M5Crh5hLucJkhvjLC1Vlk5bGKmeO1rCy+Y=";
+    hash = "sha256-ctFer7KPvES/tSV2e3G3rRIe7z2U4wgViB2qxBZuTUM=";
   };
 
-  cargoHash = "sha256-bn7qJZE68UJPNaARQRXy6GPkplv0KAkKByy85ooi5kg=";
+  cargoHash = "sha256-kDWmUg86aZP99ebkv/1aKT2YJv7DdTT5oxnegxpD9gQ=";
 
   # The tests relies on the presence of network connection
   doCheck = false;
diff --git a/pkgs/by-name/nb/nbfc-linux/package.nix b/pkgs/by-name/nb/nbfc-linux/package.nix
index 4e4e5bd4b374..4e41574dcd18 100644
--- a/pkgs/by-name/nb/nbfc-linux/package.nix
+++ b/pkgs/by-name/nb/nbfc-linux/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "nbfc-linux";
-  version = "0.1.15";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "nbfc-linux";
     repo = "nbfc-linux";
     rev = "${finalAttrs.version}";
-    hash = "sha256-+xYr2uIxfMaMAaHGvvA+0WPZjwj3wVAc34e1DWsJLqE=";
+    hash = "sha256-1tLW/xEh01y8BjVbgIa95DkYWf7CDVSo/lI/1U28Xs8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/nbqa/default.nix b/pkgs/by-name/nb/nbqa/package.nix
similarity index 85%
rename from pkgs/tools/misc/nbqa/default.nix
rename to pkgs/by-name/nb/nbqa/package.nix
index 91a501e80319..f4b1a8fdf527 100644
--- a/pkgs/tools/misc/nbqa/default.nix
+++ b/pkgs/by-name/nb/nbqa/package.nix
@@ -1,20 +1,27 @@
-{ black
-, blacken-docs
-, fetchFromGitHub
-, lib
-, python3
-, ruff
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+
+  # optional-dependencies
+  black,
+  blacken-docs,
+  ruff,
+
+  # passthru
+  testers,
+  nbqa,
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "nbqa";
-  version = "1.8.7";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nbQA-dev";
     repo = "nbQA";
     rev = "refs/tags/${version}";
-    hash = "sha256-zn+e/svaxeJU9P1sIaRrVuKW0+FM0GLKZTUx3PfuThk=";
+    hash = "sha256-9s+q2unh+jezU0Er7ZH0tvgntmPFts9OmsgAMeQXRrY=";
   };
 
   build-system = with python3.pkgs; [
@@ -33,7 +40,8 @@ python3.pkgs.buildPythonApplication rec {
     ruff = [ ruff ];
   };
 
-  dependencies = with python3.pkgs;
+  dependencies =
+    with python3.pkgs;
     [
       autopep8
       ipython
@@ -90,6 +98,12 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_include_exclude.py"
   ];
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = nbqa;
+    };
+  };
+
   meta = {
     homepage = "https://github.com/nbQA-dev/nbQA";
     changelog = "https://nbqa.readthedocs.io/en/latest/history.html";
diff --git a/pkgs/by-name/op/opshin/package.nix b/pkgs/by-name/op/opshin/package.nix
index bda3768ca1d7..ce865e9d9218 100644
--- a/pkgs/by-name/op/opshin/package.nix
+++ b/pkgs/by-name/op/opshin/package.nix
@@ -6,15 +6,15 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "opshin";
-  version = "0.22.0";
+  version = "0.23.0";
 
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "OpShin";
     repo = "opshin";
-    rev = version;
-    hash = "sha256-ixA5D7Bm/tjYEFhqaJ4sKkCkqQZpDyrwfD/LgN6Y4Uo=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-H6tuSJYV9bAwXu/5Y8g6aFbbQFCpq2aqcmRaDq2cAEg=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/pr/protoc-gen-prost-crate/package.nix b/pkgs/by-name/pr/protoc-gen-prost-crate/package.nix
index 97c62110931c..3679c10de1d0 100644
--- a/pkgs/by-name/pr/protoc-gen-prost-crate/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-prost-crate/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protoc-gen-prost-crate";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-+TSZ2QstAF8DXsHunV/nQyqF++0bFud1ZWJQEI3JEwc=";
+    hash = "sha256-9rIFDZbI6XGDsNzFMnMYY4loJxojdz6vnQKAz9eDAyQ=";
   };
 
-  cargoHash = "sha256-KbErgnXG11ngzLVSktuyUAupYs1ZD64z3plKVtzLx1A=";
+  cargoHash = "sha256-uAygKDdm+0SEDFBQcaoYTRMRgnodiO/kL1sGbRmdJKE=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pr/protoc-gen-prost-serde/package.nix b/pkgs/by-name/pr/protoc-gen-prost-serde/package.nix
index 3486fbea0e1e..098bec2f7890 100644
--- a/pkgs/by-name/pr/protoc-gen-prost-serde/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-prost-serde/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protoc-gen-prost-serde";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-O2Mpft31ZQncqETWzwD73I1nX1Wt5XVHcTJUk5qhRLY=";
+    hash = "sha256-RQlNVGa6BRIqIGodqNN3eGl//hkUWrq7GpTGpRBCDgE=";
   };
 
-  cargoHash = "sha256-aUWmNS3jF1I0NLApBn3GMMv6ID9mM/j7r7sPFCsFIuw=";
+  cargoHash = "sha256-ZQOlDqDUd1nZi+2iFKCUq4Gnc9HGcLblIGY2cdQyGM0=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pr/protoc-gen-prost/package.nix b/pkgs/by-name/pr/protoc-gen-prost/package.nix
index 7c92095fbeee..8429f8ba27c1 100644
--- a/pkgs/by-name/pr/protoc-gen-prost/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-prost/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protoc-gen-prost";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-ma9sdt3/uq06BMELwsNadMkiEfstQhA4DAQEPdizZJM=";
+    hash = "sha256-Bz5/LyKludw0Tz3r+xr4DMRdMSz/nRzjs7Q66z1PrTU=";
   };
 
-  cargoHash = "sha256-pJDrwX5uDIrycxtmbds8l4wadZE0RdgmNpMwVkUGJDs=";
+  cargoHash = "sha256-X6yEJBgW9XzCNSxEQYj6LdPjbCPyh4SnKwdA/+sNNeg=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pr/protoc-gen-tonic/package.nix b/pkgs/by-name/pr/protoc-gen-tonic/package.nix
index 55c1828618e9..0e3334885ef4 100644
--- a/pkgs/by-name/pr/protoc-gen-tonic/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-tonic/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protoc-gen-tonic";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-3qz1ea9lEsZjhWNA0lcwqsPkNmjj2ZBljqNRr5/2lKM=";
+    hash = "sha256-H7YQ8y6YA8kjR9bhHfBOYu0OEFc8ezqXkqC6jGScs3s=";
   };
 
-  cargoHash = "sha256-nUsRoDaP+omZdOTnaxvHbJT1uNGtyfgXyEFZbp/CeYA=";
+  cargoHash = "sha256-eYX3w/rSi/kuH6gyWCWT4on7pKedPKnl9pht1jXNwpg=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ra/rathole/package.nix b/pkgs/by-name/ra/rathole/package.nix
new file mode 100644
index 000000000000..38d163daf8d8
--- /dev/null
+++ b/pkgs/by-name/ra/rathole/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nixosTests,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "rathole";
+  version = "0.5.0-unstable-2024-06-06";
+
+  src = fetchFromGitHub {
+    owner = "rapiz1";
+    repo = "rathole";
+    rev = "be14d124a22e298d12d92e56ef4fec0e51517998";
+    hash = "sha256-C0/G4JOZ4pTAvcKZhRHsGvlLlwAyWBQ0rMScLvaLSuA=";
+  };
+
+  cargoHash = "sha256-zlwIgzqpoEgYqZe4Gv8owJQ3m7UFgPA5joRMiyq+T/M=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ CoreServices ]);
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.tests = {
+    inherit (nixosTests) rathole;
+  };
+
+  meta = {
+    description = "Reverse proxy for NAT traversal";
+    homepage = "https://github.com/rapiz1/rathole";
+    license = lib.licenses.asl20;
+    mainProgram = "rathole";
+    maintainers = with lib.maintainers; [
+      dit7ya
+      xokdvium
+    ];
+  };
+}
diff --git a/pkgs/by-name/rk/rkboot/package.nix b/pkgs/by-name/rk/rkboot/package.nix
index 5e71406967a6..5cf424a43c3a 100644
--- a/pkgs/by-name/rk/rkboot/package.nix
+++ b/pkgs/by-name/rk/rkboot/package.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , rkbin
-, box64
+, qemu
 }:
 
 stdenv.mkDerivation {
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     do
       # The proprietary, statically linked binaries to perform boot_merge are
       # x86_64 only. Though we use box64 to emulate if building on aarch64-linux
-      ${lib.optionalString stdenv.isAarch64 "${lib.getExe box64}"} ./tools/boot_merger "$i" || true
+      ${lib.optionalString stdenv.isAarch64 "${qemu}/bin/qemu-x86_64"} ./tools/boot_merger "$i" || true
     done
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/by-name/vi/viber/package.nix
similarity index 92%
rename from pkgs/applications/networking/instant-messengers/viber/default.nix
rename to pkgs/by-name/vi/viber/package.nix
index 9459084a4873..30ba2c31de98 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/by-name/vi/viber/package.nix
@@ -43,15 +43,17 @@
 
 stdenv.mkDerivation {
   pname = "viber";
-  version = "21.8.0.11";
+  version = "23.2.0.3";
 
   src = fetchurl {
-    # Official link: https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb
-    url = "https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
+    # Taking Internet Archive snapshot of a specific version to avoid breakage
+    # on new versions
+    url = "https://web.archive.org/web/20240824071651/https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
     hash = "sha256-9WHiI2WlsgEhCPkrQoAunmF6lSb2n5RgQJ2+sdnSShM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [ dpkg ];
 
   dontUnpack = true;
diff --git a/pkgs/applications/video/video-trimmer/default.nix b/pkgs/by-name/vi/video-trimmer/package.nix
similarity index 69%
rename from pkgs/applications/video/video-trimmer/default.nix
rename to pkgs/by-name/vi/video-trimmer/package.nix
index 3ff12dbffcce..dc94d051e4e7 100644
--- a/pkgs/applications/video/video-trimmer/default.nix
+++ b/pkgs/by-name/vi/video-trimmer/package.nix
@@ -1,37 +1,38 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, rustPlatform
-, cargo
-, pkg-config
-, meson
-, rustc
-, wrapGAppsHook4
-, desktop-file-utils
-, blueprint-compiler
-, ninja
-, gtk4
-, libadwaita
-, gst_all_1
-, ffmpeg-headless
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  rustPlatform,
+  cargo,
+  pkg-config,
+  meson,
+  rustc,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  blueprint-compiler,
+  ninja,
+  gtk4,
+  libadwaita,
+  gst_all_1,
+  ffmpeg-headless,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "video-trimmer";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "YaLTeR";
     repo = "video-trimmer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nr0PAvp4wlswQBNN2LLyYQMpk3IIleHf3+978XhUGGQ=";
+    hash = "sha256-GXFbfebwiESplOeYDWxBH8Q0SCgV0vePYV7rv0qgrHM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-YFbLMpQbHUtxRrBVarcoIeDsvc26NWc1YhMeCaLgJAc=";
+    hash = "sha256-szxJzBFtyFZ1T5TZb2MDPFJzn+EYETa/JbPdlg6UrTk=";
   };
 
   nativeBuildInputs = [
@@ -67,12 +68,15 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gitlab.gnome.org/YaLTeR/video-trimmer";
     description = "Trim videos quickly";
-    maintainers = with maintainers; [ doronbehar ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [
+      doronbehar
+      aleksana
+    ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
     mainProgram = "video-trimmer";
   };
 })
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 7578a57afb3f..936d8cbd3598 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-imHJKbE+M4jFzeymhBaFkzUqG1jiY6Bi17Ll+JSsj7w=",
-    "version": "0.2024.08.13.08.02.stable_03"
+    "hash": "sha256-EDhj4Gb0ykFX8W2G8osusjggemcuHO7hkUKb151cQ6g=",
+    "version": "0.2024.08.20.08.02.stable_00"
   },
   "linux": {
-    "hash": "sha256-MkNt6LzZdn/FjLcISm49ELPjIa8KAs/fd3k0/EhAyZQ=",
-    "version": "0.2024.08.13.08.02.stable_04"
+    "hash": "sha256-Uk5pSoAvEppjLnskLc5/ftcCaiJnXATJfCPDP2QpBo8=",
+    "version": "0.2024.08.20.08.02.stable_00"
   }
 }
diff --git a/pkgs/by-name/ya/yandex-music/info.json b/pkgs/by-name/ya/yandex-music/info.json
new file mode 100644
index 000000000000..809ec521526a
--- /dev/null
+++ b/pkgs/by-name/ya/yandex-music/info.json
@@ -0,0 +1,7 @@
+{
+  "branch": "master",
+  "commit_hash": "4ac238a00ca0b36e9755e55e54a22d3107ba443c",
+  "commit_message": "Update packages",
+  "date": "2024-08-27",
+  "tag": "v5.13.2"
+}
diff --git a/pkgs/by-name/ya/yandex-music/package.nix b/pkgs/by-name/ya/yandex-music/package.nix
new file mode 100644
index 000000000000..581bea890456
--- /dev/null
+++ b/pkgs/by-name/ya/yandex-music/package.nix
@@ -0,0 +1,88 @@
+{
+  fetchurl,
+  stdenvNoCC,
+  lib,
+  makeWrapper,
+  p7zip,
+  asar,
+  jq,
+  python3,
+  electron,
+  fetchFromGitHub,
+  electronArguments ? "",
+  trayEnabled ? true,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "yandex-music";
+  version = "5.13.2";
+
+  src = fetchFromGitHub {
+    owner = "cucumber-sp";
+    repo = "yandex-music-linux";
+    rev = "v${version}";
+    hash = "sha256-yQX2GEulAQ02BndpwAAwGdTYtUlNXCgsCUdmXxPwtKU=";
+  };
+
+  nativeBuildInputs = [
+    p7zip
+    asar
+    jq
+    python3
+    makeWrapper
+  ];
+
+  passthru.updateScript = ./update.sh;
+
+  ymExe =
+    let
+      ym_info = builtins.fromJSON (builtins.readFile ./ym_info.json);
+    in
+    fetchurl {
+      url = ym_info.ym.exe_link;
+      sha256 = ym_info.ym.exe_sha256;
+    };
+
+  buildPhase = ''
+    runHook preBuild
+    bash "./repack.sh" -o "./app" "$ymExe"
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/nodejs"
+    mv app/yandex-music.asar "$out/share/nodejs"
+
+    CONFIG_FILE="$out/share/yandex-music.conf"
+    echo "TRAY_ENABLED=${if trayEnabled then "1" else "0"}" >> "$CONFIG_FILE"
+    echo "ELECTRON_ARGS=\"${electronArguments}\"" >> "$CONFIG_FILE"
+
+
+    install -Dm755 "$src/templates/yandex-music.sh" "$out/bin/yandex-music"
+    substituteInPlace "$out/bin/yandex-music"                                  \
+      --replace-fail "%electron_path%" "${electron}/bin/electron"              \
+      --replace-fail "%asar_path%" "$out/share/nodejs/yandex-music.asar"
+
+    wrapProgram "$out/bin/yandex-music"                                        \
+      --set-default YANDEX_MUSIC_CONFIG "$CONFIG_FILE"
+
+    install -Dm644 "./app/favicon.png" "$out/share/pixmaps/yandex-music.png"
+    install -Dm644 "./app/favicon.png" "$out/share/icons/hicolor/48x48/apps/yandex-music.png"
+    install -Dm644 "./app/favicon.svg" "$out/share/icons/hicolor/scalable/apps/yandex-music.svg"
+
+    install -Dm644 "$src/templates/desktop" "$out/share/applications/yandex-music.desktop"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Yandex Music - Personal recommendations, selections for any occasion and new music";
+    homepage = "https://music.yandex.ru/";
+    downloadPage = "https://music.yandex.ru/download/";
+    changelog = "https://github.com/cucumber-sp/yandex-music-linux/releases/tag/v5.13.2";
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ shved ];
+  };
+}
diff --git a/pkgs/by-name/ya/yandex-music/update.sh b/pkgs/by-name/ya/yandex-music/update.sh
new file mode 100755
index 000000000000..92ebdb8d8a2e
--- /dev/null
+++ b/pkgs/by-name/ya/yandex-music/update.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p common-updater-scripts fd jq
+
+set -eou pipefail
+
+OWNER="cucumber-sp"
+REPO="yandex-music-linux"
+URL="https://api.github.com/repos/$OWNER/$REPO"
+RAW="https://raw.githubusercontent.com/$OWNER/$REPO"
+
+latest_release="$(curl --silent "$URL/releases/latest")"
+latest_tag="$(curl --silent "$URL/tags?per_page=1")"
+commit_hash="$(jq -r '.[0].commit.sha' <<<"$latest_tag")"
+latest_commit="$(curl --silent "$URL/commits/$commit_hash"'')"
+commit_message="$(jq -r '.commit.message' <<<"$latest_commit")"
+
+tag=$(jq -r '.tag_name' <<<"$latest_release")
+# drop 'v' prefix
+version="${tag#v}"
+
+branch=$(jq -r '.target_commitish' <<<"$latest_release")
+
+date=$(jq -r '.created_at' <<<"$latest_release")
+# truncate time
+date=${date%T*}
+
+# update version; otherwise fail
+update-source-version yandex-music "$version" --ignore-same-hash
+
+# set yandex-music dir
+dir="pkgs/by-name/ya/yandex-music"
+
+echo -e '{
+  "branch": "'"$branch"'",
+  "commit_hash": "'"$commit_hash"'",
+  "commit_message": "'"$commit_message"'",
+  "date": "'"$date"'",
+  "tag": "'"$tag"'"
+}' >"$dir/info.json" || echo "Please run the script in the root of the Nixpkgs repo"
+
+curl --silent "$RAW/$commit_hash/utility/version_info.json" |\
+        jq . > "$dir/ym_info.json" ||\
+        echo "Please run the script in the root of the Nixpkgs repo"
diff --git a/pkgs/by-name/ya/yandex-music/ym_info.json b/pkgs/by-name/ya/yandex-music/ym_info.json
new file mode 100644
index 000000000000..4a1609ca7119
--- /dev/null
+++ b/pkgs/by-name/ya/yandex-music/ym_info.json
@@ -0,0 +1,14 @@
+{
+  "ym": {
+    "version": "5.13.2",
+    "exe_name": "Yandex_Music_x64_5.13.2.exe",
+    "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.13.2.exe",
+    "exe_sha256": "ac7a489a59e074358559f544a26143ca81a6bdfa41481242f3419b76eaffdb0b"
+  },
+  "electron": {
+    "version": "29.4.6",
+    "x64": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-x64.zip",
+    "armv7l": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-armv7l.zip",
+    "arm64": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-arm64.zip"
+  }
+}
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 7f938f8c9508..7d0f9ac4819a 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -13839,7 +13839,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.149.5"
+version = "0.149.6"
 dependencies = [
  "activity_indicator",
  "anyhow",
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 2c343c4f6517..29d665722acd 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -35,13 +35,13 @@ assert withGLES -> stdenv.isLinux;
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.149.5";
+  version = "0.149.6";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RQGYcJJf65arew9iwtPh/jFYMbXiY9Wg7xEjAsUSvEA=";
+    hash = "sha256-YWXK5heCCw6eXhc1Fh7eIC0tzszC86FP3ovzkCYkdtc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/desktops/lomiri/development/libusermetrics/default.nix b/pkgs/desktops/lomiri/development/libusermetrics/default.nix
index 351900af7f13..7305db4cb593 100644
--- a/pkgs/desktops/lomiri/development/libusermetrics/default.nix
+++ b/pkgs/desktops/lomiri/development/libusermetrics/default.nix
@@ -1,37 +1,40 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, gitUpdater
-, testers
-, cmake
-, cmake-extras
-, dbus
-, doxygen
-, gsettings-qt
-, gtest
-, intltool
-, json-glib
-, libapparmor
-, libqtdbustest
-, pkg-config
-, qdjango
-, qtbase
-, qtdeclarative
-, qtxmlpatterns
-, ubports-click
-, validatePkgConfig
-, wrapQtAppsHook
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  fetchpatch,
+  gitUpdater,
+  testers,
+  cmake,
+  cmake-extras,
+  dbus,
+  doxygen,
+  glibcLocales,
+  gsettings-qt,
+  gtest,
+  intltool,
+  json-glib,
+  libapparmor,
+  libqtdbustest,
+  pkg-config,
+  qdjango,
+  qtbase,
+  qtdeclarative,
+  qtxmlpatterns,
+  ubports-click,
+  validatePkgConfig,
+  wrapQtAppsHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libusermetrics";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/libusermetrics";
     rev = finalAttrs.version;
-    hash = "sha256-jmJH5vByBnBqgQfyb7HNVe+eS/jHcU64R2dnvuLbqss=";
+    hash = "sha256-V4vxNyHMs2YYBILkpco79FN9xnooULgB+z2Kf3V0790=";
   };
 
   outputs = [
@@ -41,21 +44,21 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Not submitted yet, waiting for decision on how CMake testing should be handled
-    ./2001-Remove-custom-check-target.patch
-
-    # Due to https://gitlab.com/ubports/development/core/libusermetrics/-/issues/8, we require knowledge about AppArmor availability at launch time
-    # Custom patch to launch a module-defined service that can handle this
-    ./2002-Launch-module-created-systemd-service.patch
+    # Remove when https://gitlab.com/ubports/development/core/libusermetrics/-/merge_requests/17 merged & in release
+    (fetchpatch {
+      name = "0001-libusermetrics-BUILD_TESTING.patch";
+      url = "https://gitlab.com/ubports/development/core/libusermetrics/-/commit/c1e4847601cc4522034a766755ce491d48132d77.patch";
+      hash = "sha256-UWc9/ngpuiSm0Rd6eBK/R3N/NwDRtMxie78seN3+y/8=";
+    })
   ];
 
   postPatch = ''
     # Tries to query QMake for QT_INSTALL_QML variable, would return broken paths into /build/qtbase-<commit> even if qmake was available
     substituteInPlace src/modules/UserMetrics/CMakeLists.txt \
-      --replace 'query_qmake(QT_INSTALL_QML QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
+      --replace-fail 'query_qmake(QT_INSTALL_QML QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
 
     substituteInPlace doc/CMakeLists.txt \
-      --replace "\''${CMAKE_INSTALL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
+      --replace-fail "\''${CMAKE_INSTALL_FULL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
   '';
 
   strictDeps = true;
@@ -82,8 +85,12 @@ stdenv.mkDerivation (finalAttrs: {
     qtbase
   ];
 
+  # Tests need to be able to check locale
+  LC_ALL = lib.optionalString finalAttrs.finalPackage.doCheck "en_US.UTF-8";
+
   nativeCheckInputs = [
     dbus
+    glibcLocales
   ];
 
   checkInputs = [
@@ -96,14 +103,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "ENABLE_CLICK" true)
-    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
-      # Exclude tests
-      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
-        # Flaky, randomly failing in UserMetricsImplTest.AddTranslatedData (data not ready when signal is emitted?)
-        "^usermetricsoutput-unit-tests"
-      ]})")
-    ]))
   ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
@@ -118,13 +117,13 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = gitUpdater { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Enables apps to locally store interesting numerical data for later presentation";
     homepage = "https://gitlab.com/ubports/development/core/libusermetrics";
     changelog = "https://gitlab.com/ubports/development/core/libusermetrics/-/blob/${finalAttrs.version}/ChangeLog";
-    license = licenses.lgpl3Only;
-    maintainers = teams.lomiri.members;
-    platforms = platforms.linux;
+    license = lib.licenses.lgpl3Only;
+    maintainers = lib.teams.lomiri.members;
+    platforms = lib.platforms.linux;
     mainProgram = "usermetricsinput";
     pkgConfigModules = [
       "libusermetricsinput-1"
diff --git a/pkgs/development/coq-modules/waterproof/default.nix b/pkgs/development/coq-modules/waterproof/default.nix
new file mode 100644
index 000000000000..7d9431c25c28
--- /dev/null
+++ b/pkgs/development/coq-modules/waterproof/default.nix
@@ -0,0 +1,24 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+mkCoqDerivation {
+  pname = "waterproof";
+  owner = "impermeable";
+  repo = "coq-waterproof";
+  inherit version;
+  defaultVersion = let inherit (lib.versions) range; in
+    lib.switch coq.coq-version [
+      { case = range "8.18" "8.18"; out = "2.1.1+8.18"; }
+    ] null;
+  release = {
+    "2.1.1+8.18".sha256  = "sha256-jYuQ9SPFRefNCUfn6+jEaJ4399EnU0gXPPkEDCpJYOI=";
+  };
+
+  mlPlugin = true;
+
+  useDune = true;
+
+  meta = {
+    description = "Coq proofs in a style that resembles non-mechanized mathematical proofs";
+    license = lib.licenses.lgpl3Plus;
+  };
+}
diff --git a/pkgs/development/embedded/avrdude/default.nix b/pkgs/development/embedded/avrdude/default.nix
index 1fb0741061a2..29edb66f9f5f 100644
--- a/pkgs/development/embedded/avrdude/default.nix
+++ b/pkgs/development/embedded/avrdude/default.nix
@@ -1,4 +1,4 @@
-{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, libusb1, elfutils
+{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, pkg-config, libusb1, elfutils
 , libftdi1, readline, hidapi, libserialport, libusb-compat-0_1
 # Documentation building doesn't work on Darwin. It fails with:
 #   Undefined subroutine &Locale::Messages::dgettext called in ... texi2html
@@ -12,16 +12,16 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "avrdude";
-  version = "7.3";
+  version = "8.0";
 
   src = fetchFromGitHub {
     owner = "avrdudes";
-    repo = "avdude";
+    repo = "avrdude";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JqW3AOMmAfcy+PQRcqviWlxA6GoMSEfzIFt1pRYY7Dw=";
+    sha256 = "w58HVCvKuWpGJwllupbj7ndeq4iE9LPs/IjFSUN0DOU=";
   };
 
-  nativeBuildInputs = [ cmake bison flex ] ++ lib.optionals docSupport [
+  nativeBuildInputs = [ cmake bison flex pkg-config ] ++ lib.optionals docSupport [
     unixtools.more
     texliveMedium
     texinfo
@@ -48,11 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = lib.optionals docSupport [ "-DBUILD_DOC=ON" ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ "-DHAVE_LINUXSPI=ON" "-DHAVE_PARPORT=ON" ];
 
-  # dvips output references texlive in comments, resulting in a huge closure
-  postInstall = lib.optionalString docSupport ''
-    rm $out/share/doc/avrdude/*.ps
-  '';
-
   passthru = {
     # Vendored and mutated copy of libelf for avrdudes use.
     # Produces a static library only.
diff --git a/pkgs/development/libraries/rapidyaml/default.nix b/pkgs/development/libraries/rapidyaml/default.nix
index 0ab61d3e7178..bab70f5a6f56 100644
--- a/pkgs/development/libraries/rapidyaml/default.nix
+++ b/pkgs/development/libraries/rapidyaml/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rapidyaml";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "biojppm";
     repo = pname;
     fetchSubmodules = true;
     rev = "v${version}";
-    hash = "sha256-NUPx/1DkhSeCTt3Y5WpsN3wX7pMNOeku7eHdmFv/OWw=";
+    hash = "sha256-vAYafhWo9xavM2j+mT3OGcX7ZSS25mieR/3b79BO+jA=";
   };
 
   nativeBuildInputs = [ cmake git ];
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 085f267cc1a1..a3797f510728 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "25.1.0";
+  version = "25.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = "aioesphomeapi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YRUX7WHiizAIHjGkCZwefqqMXykokXgwrHZ3OwLIVCs=";
+    hash = "sha256-pQ8RR8e9NVQNBKaQMI60WYANI0rSK5L/H+5e2Tu7zUU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/libknot/default.nix b/pkgs/development/python-modules/libknot/default.nix
index effdecfa624f..03f249969a00 100644
--- a/pkgs/development/python-modules/libknot/default.nix
+++ b/pkgs/development/python-modules/libknot/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libknot";
-  version = "3.3.8";
+  version = "3.3.9";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RG2NOFQC6rxeutawn3ArZy9uNLn+gPmEqrv1E0YYJx4=";
+    hash = "sha256-AAjH5+IQdkzTIp1+q638d9dzAfo7nXUudOLQm81P7lU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytouchlinesl/default.nix b/pkgs/development/python-modules/pytouchlinesl/default.nix
index 2cd211c769d5..209c5f270f70 100644
--- a/pkgs/development/python-modules/pytouchlinesl/default.nix
+++ b/pkgs/development/python-modules/pytouchlinesl/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytouchlinesl";
-  version = "0.1.3";
+  version = "0.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jnsgruk";
     repo = "pytouchlinesl";
     rev = "refs/tags/${version}";
-    hash = "sha256-TLKZ3mPNS7jRpbx3nllLlv5jPVQDLcTs44oJr6rNGeQ=";
+    hash = "sha256-kdLMuxA1Ig85mH7s9rlmVjEsItXxRlDA1JTFasnJogg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index cfc4922eccf7..1bddf639b4c7 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RcCTYwM30Bpqj5d6JGrW1zLrEfLgcrsibVmtPSR4HJk=";
+    hash = "sha256-N0TFyLur8YFyhJx3Mb4A3C5eRPjFVtN8hQ54h5SuCvQ=";
   };
 
   # https://github.com/sirfz/tesserocr/issues/314
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 2b26f3898723..4e2fa7b6234d 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.122.2";
+  version = "0.122.4";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+P4FpGH09hgY+PCrFNKAZgh9/hO8C0aFAnv545bA0gw=";
+    hash = "sha256-YpdzwGThmc9r4I+Rx8nxTZToi+J3UbqwZD+F2hYEG8M=";
   };
 
   vendorHash = "sha256-WAYjYIHsBkQiTUmMDRXnx3Q1UAFVfXmZDFxzw7Kh0ds=";
diff --git a/pkgs/development/tools/firebase-tools/default.nix b/pkgs/development/tools/firebase-tools/default.nix
index 8e3d1dab2e94..3e78b575df76 100644
--- a/pkgs/development/tools/firebase-tools/default.nix
+++ b/pkgs/development/tools/firebase-tools/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "13.15.2";
+  version = "13.15.4";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     rev = "v${version}";
-    hash = "sha256-8W602Rs5kPAYhhwhUaSmA7oV0DROA0Ut2+QHBubNqJM=";
+    hash = "sha256-sVLzEswyewffGoHhc/eJvOoHzMbMmoq1M23noJmvWxE=";
   };
 
-  npmDepsHash = "sha256-HWTCpBfMvpa9pUOaYOSDCc/JdZzBhZfEO/ejSNxwnXA=";
+  npmDepsHash = "sha256-hBXcA/rmbictMuBihu1kDgkriunwC+gP/lWEhaPklLM=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/development/tools/language-servers/helm-ls/default.nix b/pkgs/development/tools/language-servers/helm-ls/default.nix
index e160042d35f1..f34d3a8ba732 100644
--- a/pkgs/development/tools/language-servers/helm-ls/default.nix
+++ b/pkgs/development/tools/language-servers/helm-ls/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "helm-ls";
-  version = "0.0.21";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "mrjosh";
     repo = "helm-ls";
     rev = "v${version}";
-    hash = "sha256-O30gdcQdNjKADraPCltTjNglztz37CVx+fUeoVI3/O8=";
+    hash = "sha256-h3ppVj+Y1jtvsZLWzZxmFmmxr0My9Nd4zQBqeDSX0ZI=";
   };
 
   vendorHash = "sha256-AWKCE2BZGVYcr6Pe8URQo11Xnr3sfgWWkm9v7vvILOo=";
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 768e3d230ed6..8f1f2ecc3767 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.30888";
+  version = "0.1.30995";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZnU48pj1xv2GuiDW/lsKzOcdLbwKyVupV0PBw7CJvm0=";
+    sha256 = "sha256-DSgpyQ9luC7RSFq/TbJplQzEKJEDdGIPHsFX3LuzqaQ=";
   };
 
   vendorHash = "sha256-60edYYhbSPiJWmuQXXEt+xCnSxsHf8Q38RgyWwdP6vQ=";
diff --git a/pkgs/servers/invidious/default.nix b/pkgs/servers/invidious/default.nix
index 0cd88f4ffa92..a52d431a1ce9 100644
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@@ -1,7 +1,7 @@
 { lib
 , callPackage
 , crystal
-, fetchFromGitea
+, fetchFromGitHub
 , librsvg
 , pkg-config
 , libxml2
@@ -29,8 +29,7 @@ crystal.buildCrystalPackage rec {
   pname = "invidious";
   inherit (versions.invidious) version;
 
-  src = fetchFromGitea {
-    domain = "gitea.invidious.io";
+  src = fetchFromGitHub {
     owner = "iv-org";
     repo = "invidious";
     fetchSubmodules = true;
diff --git a/pkgs/servers/invidious/shards.nix b/pkgs/servers/invidious/shards.nix
index 8e38d563be20..97979576efa6 100644
--- a/pkgs/servers/invidious/shards.nix
+++ b/pkgs/servers/invidious/shards.nix
@@ -1,8 +1,8 @@
 {
   ameba = {
     url = "https://github.com/crystal-ameba/ameba.git";
-    rev = "v1.5.0";
-    sha256 = "1idivsbpmi40aqvs82fsv37nrgikirprxrj3ls9chsb876fq9p2d";
+    rev = "v1.6.1";
+    sha256 = "1qlgqpgycfxvvrfzih7b9ayb6fvkffz5aw0msbj70z2q7wvsq29p";
   };
   athena-negotiation = {
     url = "https://github.com/athena-framework/negotiation.git";
diff --git a/pkgs/servers/invidious/update.sh b/pkgs/servers/invidious/update.sh
index 2ba5c3452c6c..848a6a9010ea 100755
--- a/pkgs/servers/invidious/update.sh
+++ b/pkgs/servers/invidious/update.sh
@@ -36,7 +36,7 @@ if [ ! -d "$git_dir" ]; then
 fi
 git -C "$git_dir" fetch origin --tags "$git_branch"
 
-new_tag="$(git -C "$git_dir" ls-remote --tags --sort=committerdate origin | head -n1 | grep -Po '(?<=refs/tags/).*')"
+new_tag="$(git -C "$git_dir" ls-remote --tags --sort=-committerdate origin | tail -n1 | grep -Po '(?<=refs/tags/).*')"
 new_version="${new_tag#v}"
 
 if [ "$new_version" = "$old_version" ]; then
@@ -44,8 +44,9 @@ if [ "$new_version" = "$old_version" ]; then
     exit
 fi
 
+info "updating to $new_tag"
 commit="$(git -C "$git_dir" rev-list "$new_tag" --max-count=1 --abbrev-commit)"
-date="$(git -C "$git_dir" log -1 --format=%cd --date=format:%Y.%m.%d)"
+date="$(git -C "$git_dir" log -1 --format=%cd --date=format:%Y.%m.%d "$commit")"
 json_set '.invidious.date' "$date"
 json_set '.invidious.commit' "$commit"
 json_set '.invidious.version' "$new_version"
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 35a6f77b84b6..4a4776b17649 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -1,9 +1,9 @@
 {
   "invidious": {
-    "hash": "sha256-YZ+uhn1ESuRTZxAMoxKCpxEaUfeCUqOrSr3LkdbrTkU=",
-    "version": "2.20240427",
-    "date": "2024.04.27",
-    "commit": "eda7444c"
+    "hash": "sha256-oNkEFATRVgPC8Bhp0v04an3LvqgsSEjLZdeblb7n8TI=",
+    "version": "2.20240825.2",
+    "date": "2024.08.26",
+    "commit": "4782a670"
   },
   "videojs": {
     "hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="
diff --git a/pkgs/servers/monitoring/prometheus/knot-exporter.nix b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
index 55324b9af88d..5750b0116315 100644
--- a/pkgs/servers/monitoring/prometheus/knot-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "3.3.8";
+  version = "3.3.9";
   pyproject = true;
 
   src = fetchPypi {
     pname = "knot_exporter";
     inherit version;
-    hash = "sha256-c6J2c9UpuLOW9rUif+k76PUb7Mh2WIH5Nn3alKaVNyw=";
+    hash = "sha256-8OeMWEXnAaLYpZD/bKAm8vtf0mkGCavmJOV4ThWGDDo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 579885b806ef..4936b4bfd529 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zjVch0NzCmimydk7/Uz4FZhcgQD+9xV6H6sAtPnFhDE=";
+    sha256 = "sha256-BD4gtdlIh5IRgTtrCdEN+o5d00wZsczsH0JbdoFdg4o=";
   };
 
   CGO_ENABLED = 0;
 
-  vendorHash = "sha256-1glSjsuHN7urlktxJ/vR/jfDgbVBWsui0bZWMhmJ50c=";
+  vendorHash = "sha256-Rk6doJqLD8ucU+mGDtteCyM/QvnzbIVnFmFW9b09560=";
 
   ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
 
diff --git a/pkgs/tools/networking/picosnitch/default.nix b/pkgs/tools/networking/picosnitch/default.nix
index c874fbf80c1b..d0cb9f82c56b 100644
--- a/pkgs/tools/networking/picosnitch/default.nix
+++ b/pkgs/tools/networking/picosnitch/default.nix
@@ -39,5 +39,8 @@ python3.pkgs.buildPythonApplication rec {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.elesiuta ];
     platforms = platforms.linux;
+    knownVulnerabilities = [
+      "Allows an unprivileged user to write to arbitrary files as root; see https://github.com/elesiuta/picosnitch/issues/40"
+    ];
   };
 }
diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
deleted file mode 100644
index 8453792e703e..000000000000
--- a/pkgs/tools/networking/rathole/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, pkg-config
-, openssl
-, nixosTests
-, CoreServices
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "rathole";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "rapiz1";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-YfLzR1lHk+0N3YU1XTNxz+KE1S3xaiKJk0zASm6cr1s=";
-  };
-
-  cargoHash = "sha256-UyQXAUPnp32THZJAs/p3bIXZjcXTvjy207QBVLCfkr8=";
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreServices
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  doCheck = false; # https://github.com/rapiz1/rathole/issues/222
-
-  passthru.tests = { inherit (nixosTests) rathole; };
-
-  meta = with lib; {
-    description = "Reverse proxy for NAT traversal";
-    homepage = "https://github.com/rapiz1/rathole";
-    changelog = "https://github.com/rapiz1/rathole/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ dit7ya ];
-    mainProgram = "rathole";
-  };
-}
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index 29be15a5817b..c7144003c429 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.40.0";
+  version = "0.42.0";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-Lyuz1m6JUbh2+pdWCQLoiOz72ZCigZIjUu+y0GYTPlM=";
+    sha256 = "sha256-Sr3cJHnNeEPpYcAl+DmVL6lG0FKFhNHOVejRWBE3yUM=";
   };
 
   vendorHash = "sha256-W4Q4jCbW5lruXEhgKg7ZiPCHGxuYwYqi8Qm2JMyJaFE=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cd0ca8b76f8..efb86221e5d6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10658,8 +10658,6 @@ with pkgs;
 
   nb = callPackage ../tools/misc/nb { };
 
-  nbqa = callPackage ../tools/misc/nbqa { };
-
   kb = callPackage ../tools/misc/kb { };
 
   notable = callPackage ../applications/misc/notable { };
@@ -13685,8 +13683,6 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  video-trimmer = callPackage ../applications/video/video-trimmer { };
-
   via = callPackage ../tools/misc/via { };
 
   vial = callPackage ../tools/misc/vial { };
@@ -18721,10 +18717,6 @@ with pkgs;
 
   ran = callPackage ../servers/http/ran { };
 
-  rathole = callPackage ../tools/networking/rathole {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
-
   retry = callPackage ../tools/system/retry { };
 
   rizin = pkgs.callPackage ../development/tools/analysis/rizin { };
@@ -33335,8 +33327,6 @@ with pkgs;
 
   tart = callPackage ../applications/virtualization/tart { };
 
-  viber = callPackage ../applications/networking/instant-messengers/viber { };
-
   wavebox = callPackage ../applications/networking/instant-messengers/wavebox { };
 
   sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index ecdbe8bd6eff..c6a6ce952f71 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -159,6 +159,7 @@ let
             paco = self.paco.override { version = "4.1.2"; };
           };
        }));
+      waterproof = callPackage ../development/coq-modules/waterproof {};
       zorns-lemma = callPackage ../development/coq-modules/zorns-lemma {};
       filterPackages = doesFilter: if doesFilter then filterCoqPackages self else self;
     };