diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d9d4dd089956..84c9a040d1ae 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -679,6 +679,12 @@
     githubId = 25004152;
     name = "Adrian Gunnar Lauterer";
   };
+  AdrienLemaire = {
+    email = "lemaire.adrien@gmail.com";
+    github = "AdrienLemaire";
+    githubId = 260983;
+    name = "Adrien Lemaire";
+  };
   AdsonCicilioti = {
     name = "Adson Cicilioti";
     email = "adson.cicilioti@live.com";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index eb17c8f20d9a..9e5212541d47 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -145,6 +145,15 @@
 
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
+- The new option [networking.ipips](#opt-networking.ipips) has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip).
+  With the existing [networking.sits](#opt-networking.sits) option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.
+
+- It is now possible to configure the default source address using the new options [networking.defaultGateway.source](#opt-networking.defaultGateway.source),
+  [networking.defaultGateway6.source](#opt-networking.defaultGateway6.source).
+
+- Potential race conditions in the network setup when using `networking.interfaces` have been fixed by disabling duplicate address detection (DAD)
+  for statically configured IPv6 addresses.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 
diff --git a/nixos/modules/services/cluster/kubernetes/flannel.nix b/nixos/modules/services/cluster/kubernetes/flannel.nix
index 7bbb55ba0724..cc1cc0b9574a 100644
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@@ -41,6 +41,7 @@ in
           cniVersion = "0.3.1";
           delegate = {
             isDefaultGateway = true;
+            hairpinMode = true;
             bridge = "mynet";
           };
         }
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
index 5237a24406b1..4df6a6010d78 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
@@ -53,6 +53,11 @@ in
               topic = lib.mkOption {
                 type = lib.types.str;
                 description = ''
+                  __Note:__ when using ntfy.sh and other public instances
+                  it is recommended to set this option to an empty string and set the actual topic via
+                  [](#opt-services.prometheus.alertmanager-ntfy.extraConfigFiles) since
+                  the `topic` in `ntfy.sh` is essentially a password.
+
                   The topic to which alerts should be published.
                   Can either be a hardcoded string or a gval expression that evaluates to a string.
                 '';
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 7bc059d61ea6..48d297a45d73 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -42,6 +42,14 @@ let
     ip link del dev "${i}" 2>/dev/null || true
   '';
 
+  formatIpArgs =
+    args:
+    lib.pipe args [
+      (lib.filterAttrs (n: v: v != null))
+      (lib.mapAttrsToList (n: v: "${n} ${toString v}"))
+      (lib.concatStringsSep " ")
+    ];
+
   # warn that these attributes are deprecated (2017-2-2)
   # Should be removed in the release after next
   bondDeprecation = rec {
@@ -99,6 +107,7 @@ let
             || (hasAttr dev cfg.bonds)
             || (hasAttr dev cfg.macvlans)
             || (hasAttr dev cfg.sits)
+            || (hasAttr dev cfg.ipips)
             || (hasAttr dev cfg.vlans)
             || (hasAttr dev cfg.greTunnels)
             || (hasAttr dev cfg.vswitches)
@@ -160,39 +169,41 @@ let
               EOF
             ''}
 
-            # Set the default gateway.
-            ${optionalString (cfg.defaultGateway != null && cfg.defaultGateway.address != "") ''
-              ${optionalString (cfg.defaultGateway.interface != null) ''
-                ip route replace ${cfg.defaultGateway.address} dev ${cfg.defaultGateway.interface} ${
-                  optionalString (cfg.defaultGateway.metric != null) "metric ${toString cfg.defaultGateway.metric}"
-                } proto static
-              ''}
-              ip route replace default ${
-                optionalString (cfg.defaultGateway.metric != null) "metric ${toString cfg.defaultGateway.metric}"
-              } via "${cfg.defaultGateway.address}" ${
-                optionalString (
-                  cfg.defaultGatewayWindowSize != null
-                ) "window ${toString cfg.defaultGatewayWindowSize}"
-              } ${
-                optionalString (cfg.defaultGateway.interface != null) "dev ${cfg.defaultGateway.interface}"
-              } proto static
-            ''}
-            ${optionalString (cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "") ''
-              ${optionalString (cfg.defaultGateway6.interface != null) ''
-                ip -6 route replace ${cfg.defaultGateway6.address} dev ${cfg.defaultGateway6.interface} ${
-                  optionalString (cfg.defaultGateway6.metric != null) "metric ${toString cfg.defaultGateway6.metric}"
-                } proto static
-              ''}
-              ip -6 route replace default ${
-                optionalString (cfg.defaultGateway6.metric != null) "metric ${toString cfg.defaultGateway6.metric}"
-              } via "${cfg.defaultGateway6.address}" ${
-                optionalString (
-                  cfg.defaultGatewayWindowSize != null
-                ) "window ${toString cfg.defaultGatewayWindowSize}"
-              } ${
-                optionalString (cfg.defaultGateway6.interface != null) "dev ${cfg.defaultGateway6.interface}"
-              } proto static
-            ''}
+            # Set the default gateway
+            ${flip concatMapStrings
+              [
+                {
+                  version = "-4";
+                  gateway = cfg.defaultGateway;
+                }
+                {
+                  version = "-6";
+                  gateway = cfg.defaultGateway6;
+                }
+              ]
+              (
+                { version, gateway }:
+                optionalString (gateway != null && gateway.address != "") ''
+                  ${optionalString (gateway.interface != null) ''
+                    ip ${version} route replace ${gateway.address} proto static ${
+                      formatIpArgs {
+                        metric = gateway.metric;
+                        dev = gateway.interface;
+                      }
+                    }
+                  ''}
+                  ip ${version} route replace default proto static ${
+                    formatIpArgs {
+                      metric = gateway.metric;
+                      via = gateway.address;
+                      window = cfg.defaultGatewayWindowSize;
+                      dev = gateway.interface;
+                      src = gateway.source;
+                    }
+                  }
+                ''
+              )
+            }
           '';
         };
 
@@ -240,10 +251,10 @@ let
                 ''
                   echo "${cidr}" >> $state
                   echo -n "adding address ${cidr}... "
-                  if out=$(ip addr replace "${cidr}" dev "${i.name}" 2>&1); then
+                  if out=$(ip addr replace "${cidr}" dev "${i.name}" nodad 2>&1); then
                     echo "done"
                   else
-                    echo "'ip addr replace \"${cidr}\" dev \"${i.name}\"' failed: $out"
+                    echo "'ip addr replace \"${cidr}\" dev \"${i.name}\"' nodad failed: $out"
                     exit 1
                   fi
                 ''
@@ -617,7 +628,7 @@ let
               deps = deviceDependency v.dev;
             in
             {
-              description = "6-to-4 Tunnel Interface ${n}";
+              description = "IPv6 in IPv4 Tunnel Interface ${n}";
               wantedBy = [
                 "network-setup.service"
                 (subsystemDevice n)
@@ -631,18 +642,65 @@ let
               script = ''
                 # Remove Dead Interfaces
                 ip link show dev "${n}" >/dev/null 2>&1 && ip link delete dev "${n}"
-                ip link add name "${n}" type sit \
-                  ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
-                  ${optionalString (v.local != null) "local \"${v.local}\""} \
-                  ${optionalString (v.ttl != null) "ttl ${toString v.ttl}"} \
-                  ${optionalString (v.dev != null) "dev \"${v.dev}\""} \
-                  ${optionalString (v.encapsulation != null)
-                    "encap ${v.encapsulation.type} encap-dport ${toString v.encapsulation.port} ${
-                      optionalString (
-                        v.encapsulation.sourcePort != null
-                      ) "encap-sport ${toString v.encapsulation.sourcePort}"
-                    }"
+                ip link add name "${n}" type sit ${
+                  formatIpArgs {
+                    inherit (v)
+                      remote
+                      local
+                      ttl
+                      dev
+                      ;
+                    encap = if v.encapsulation.type == "6in4" then null else v.encapsulation.type;
+                    encap-dport = v.encapsulation.port;
+                    encap-sport = v.encapsulation.sourcePort;
                   }
+                }
+                ip link set dev "${n}" up
+              '';
+              postStop = ''
+                ip link delete dev "${n}" || true
+              '';
+            }
+          );
+
+        createIpipDevice =
+          n: v:
+          nameValuePair "${n}-netdev" (
+            let
+              deps = deviceDependency v.dev;
+            in
+            {
+              description = "IP in IP Tunnel Interface ${n}";
+              wantedBy = [
+                "network-setup.service"
+                (subsystemDevice n)
+              ];
+              bindsTo = deps;
+              after = [ "network-pre.target" ] ++ deps;
+              before = [ "network-setup.service" ];
+              serviceConfig.Type = "oneshot";
+              serviceConfig.RemainAfterExit = true;
+              path = [ pkgs.iproute2 ];
+              script = ''
+                # Remove Dead Interfaces
+                ip link show dev "${n}" >/dev/null 2>&1 && ip link delete dev "${n}"
+                ip tunnel add name "${n}" ${
+                  formatIpArgs {
+                    inherit (v)
+                      remote
+                      local
+                      ttl
+                      dev
+                      ;
+                    mode =
+                      {
+                        "4in6" = "ipip6";
+                        "ipip" = "ipip";
+                      }
+                      .${v.encapsulation.type};
+                    encaplimit = if v.encapsulation.type == "ipip" then null else v.encapsulation.limit;
+                  }
+                }
                 ip link set dev "${n}" up
               '';
               postStop = ''
@@ -732,6 +790,7 @@ let
       // mapAttrs' createMacvlanDevice cfg.macvlans
       // mapAttrs' createFouEncapsulation cfg.fooOverUDP
       // mapAttrs' createSitDevice cfg.sits
+      // mapAttrs' createIpipDevice cfg.ipips
       // mapAttrs' createGreDevice cfg.greTunnels
       // mapAttrs' createVlanDevice cfg.vlans
       // {
@@ -748,6 +807,9 @@ let
 in
 
 {
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
   config = mkMerge [
     bondWarnings
     (mkIf (!cfg.useNetworkd) normalConfig)
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 0fcab643aad2..64cba018ca60 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -24,6 +24,7 @@ let
     concatLists (map (bond: bond.interfaces) (attrValues cfg.bonds))
     ++ concatLists (map (bridge: bridge.interfaces) (attrValues cfg.bridges))
     ++ map (sit: sit.dev) (attrValues cfg.sits)
+    ++ map (ipip: ipip.dev) (attrValues cfg.ipips)
     ++ map (gre: gre.dev) (attrValues cfg.greTunnels)
     ++ map (vlan: vlan.interface) (attrValues cfg.vlans)
     # add dependency to physical or independently created vswitch member interface
@@ -46,6 +47,9 @@ let
               // optionalAttrs (gateway.metric != null) {
                 Metric = gateway.metric;
               }
+              // optionalAttrs (gateway.source != null) {
+                PreferredSource = gateway.source;
+              }
             )
           ];
         };
@@ -435,7 +439,7 @@ in
                   // (optionalAttrs (sit.ttl != null) {
                     TTL = sit.ttl;
                   })
-                  // (optionalAttrs (sit.encapsulation != null) (
+                  // (optionalAttrs (sit.encapsulation.type != "6in4") (
                     {
                       FooOverUDP = true;
                       Encapsulation = if sit.encapsulation.type == "fou" then "FooOverUDP" else "GenericUDPEncapsulation";
@@ -454,6 +458,38 @@ in
             }
           )
         ))
+        (mkMerge (
+          flip mapAttrsToList cfg.ipips (
+            name: ipip: {
+              netdevs."40-${name}" = {
+                netdevConfig = {
+                  Name = name;
+                  Kind = if ipip.encapsulation.type == "ipip" then "ipip" else "ip6tnl";
+                };
+                tunnelConfig =
+                  (optionalAttrs (ipip.remote != null) {
+                    Remote = ipip.remote;
+                  })
+                  // (optionalAttrs (ipip.local != null) {
+                    Local = ipip.local;
+                  })
+                  // (optionalAttrs (ipip.ttl != null) {
+                    TTL = ipip.ttl;
+                  })
+                  // (optionalAttrs (ipip.encapsulation.type != "ipip") {
+                    # IPv6 tunnel options
+                    Mode = if ipip.encapsulation.type == "4in6" then "ipip6" else "ip6ip6";
+                    EncapsulationLimit = ipip.encapsulation.type;
+                  });
+              };
+              networks = mkIf (ipip.dev != null) {
+                "40-${ipip.dev}" = {
+                  tunnel = [ name ];
+                };
+              };
+            }
+          )
+        ))
         (mkMerge (
           flip mapAttrsToList cfg.greTunnels (
             name: gre: {
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 7d5b25bf10c4..2b8a938c81ae 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -19,7 +19,8 @@ let
   hasSits = cfg.sits != { };
   hasGres = cfg.greTunnels != { };
   hasBonds = cfg.bonds != { };
-  hasFous = cfg.fooOverUDP != { } || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };
+  hasFous =
+    cfg.fooOverUDP != { } || filterAttrs (_: s: s.encapsulation.type != "6in4") cfg.sits != { };
 
   slaves =
     concatMap (i: i.interfaces) (attrValues cfg.bonds)
@@ -180,6 +181,12 @@ let
           description = "The default gateway metric/preference.";
         };
 
+        source = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = "The default source address.";
+        };
+
       };
 
     };
@@ -656,6 +663,7 @@ in
       example = {
         address = "131.211.84.1";
         interface = "enp3s0";
+        source = "131.211.84.2";
       };
       type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
       description = ''
@@ -669,6 +677,7 @@ in
       example = {
         address = "2001:4d0:1e04:895::1";
         interface = "enp3s0";
+        source = "2001:4d0:1e04:895::2";
       };
       type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
       description = ''
@@ -1134,6 +1143,104 @@ in
         });
     };
 
+    networking.ipips = mkOption {
+      default = { };
+      example = literalExpression ''
+        {
+          wan4in6 = {
+            remote = "2001:db8::1";
+            local = "2001:db8::3";
+            dev = "wan6";
+            encapsulation.type = "4in6";
+            encapsulation.limit = 0;
+          };
+        }
+      '';
+      description = ''
+        This option allows you to define interfaces encapsulating IP
+        packets within IP packets; which should be automatically created.
+
+        For example, this allows you to create 4in6 (RFC 2473)
+        or IP within IP (RFC 2003) tunnels.
+      '';
+      type =
+        with types;
+        attrsOf (submodule {
+          options = {
+
+            remote = mkOption {
+              type = types.str;
+              example = "2001:db8::1";
+              description = ''
+                The address of the remote endpoint to forward traffic over.
+              '';
+            };
+
+            local = mkOption {
+              type = types.str;
+              example = "2001:db8::3";
+              description = ''
+                The address of the local endpoint which the remote
+                side should send packets to.
+              '';
+            };
+
+            ttl = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              example = 255;
+              description = ''
+                The time-to-live of the connection to the remote tunnel endpoint.
+              '';
+            };
+
+            dev = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "wan6";
+              description = ''
+                The underlying network device on which the tunnel resides.
+              '';
+            };
+
+            encapsulation.type = mkOption {
+              type = types.enum [
+                "ipip"
+                "4in6"
+                "ip6ip6"
+              ];
+              default = "ipip";
+              description = ''
+                Select the encapsulation type:
+
+                - `ipip` to create an IPv4 within IPv4 tunnel (RFC 2003).
+
+                - `4in6` to create a 4in6 tunnel (RFC 2473);
+
+                - `ip6ip6` to create an IPv6 within IPv6 tunnel (RFC 2473);
+
+                ::: {.note}
+                For encapsulating IPv6 within IPv4 packets, see
+                the ad-hoc {option}`networking.sits` option.
+                :::
+              '';
+            };
+
+            encapsulation.limit = mkOption {
+              type = types.either (types.enum [ "none" ]) types.ints.unsigned;
+              default = 4;
+              example = "none";
+              description = ''
+                For an IPv6-based tunnel, the maximum number of nested
+                encapsulation to allow. 0 means no nesting, "none" unlimited.
+              '';
+            };
+
+          };
+
+        });
+    };
+
     networking.sits = mkOption {
       default = { };
       example = literalExpression ''
@@ -1151,7 +1258,8 @@ in
         }
       '';
       description = ''
-        This option allows you to define 6-to-4 interfaces which should be automatically created.
+        This option allows you to define interfaces encapsulating IPv6
+        packets within IPv4 packets; which should be automatically created.
       '';
       type =
         with types;
@@ -1195,50 +1303,76 @@ in
               '';
             };
 
-            encapsulation =
-              with types;
-              mkOption {
-                type = nullOr (submodule {
+            encapsulation = mkOption {
+              type = types.nullOr (
+                types.submodule {
                   options = {
                     type = mkOption {
-                      type = enum [
+                      type = types.enum [
+                        "6in4"
                         "fou"
                         "gue"
                       ];
+                      default = "6in4";
                       description = ''
-                        Selects encapsulation type. See
-                        {manpage}`ip-link(8)` for details.
+                        Select the encapsulation type:
+
+                        - `6in4`: the IPv6 packets are encapsulated using the
+                          6in4 protocol (formerly known as SIT, RFC 4213);
+
+                        - `gue`: the IPv6 packets are encapsulated in UDP packets
+                           using the Generic UDP Encapsulation (GUE) scheme;
+
+                        - `foo`: the IPv6 packets are encapsulated in UDP packets
+                           using the Foo over UDP (FOU) scheme.
                       '';
                     };
 
                     port = mkOption {
-                      type = port;
+                      type = types.nullOr types.port;
+                      default = null;
                       example = 9001;
                       description = ''
-                        Destination port for encapsulated packets.
+                        Destination port when using UDP encapsulation.
                       '';
                     };
 
                     sourcePort = mkOption {
-                      type = nullOr types.port;
+                      type = types.nullOr types.port;
                       default = null;
                       example = 9002;
                       description = ''
-                        Source port for encapsulated packets. Will be chosen automatically by
-                        the kernel if unset.
+                        Source port when using UDP encapsulation.
+                        Will be chosen automatically by the kernel if unset.
                       '';
                     };
                   };
-                });
-                default = null;
-                example = {
-                  type = "fou";
-                  port = 9001;
-                };
-                description = ''
-                  Configures encapsulation in UDP packets.
-                '';
+                }
+              );
+              apply =
+                x:
+                if x == null then
+                  lib.warn
+                    ''
+                      The option networking.sits.*.encapsulation no longer accepts `null`
+                      as a valid value. To fix this warning simply remove this definition.
+                    ''
+                    {
+                      type = "6in4";
+                      port = null;
+                      sourcePort = null;
+                    }
+                else
+                  x;
+              default = { };
+              example = {
+                type = "fou";
+                port = 9001;
               };
+              description = ''
+                Configures the type of encapsulation.
+              '';
+            };
 
           };
 
@@ -1541,6 +1675,8 @@ in
 
   ###### implementation
 
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
   config = {
 
     warnings =
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 79b2abdc17af..98519bcab4f7 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -144,7 +144,7 @@ rec {
         (onFullSupported "nixos.tests.networking.scripted.macvlan")
         (onFullSupported "nixos.tests.networking.scripted.privacy")
         (onFullSupported "nixos.tests.networking.scripted.routes")
-        (onFullSupported "nixos.tests.networking.scripted.sit")
+        (onFullSupported "nixos.tests.networking.scripted.sit-fou")
         (onFullSupported "nixos.tests.networking.scripted.static")
         (onFullSupported "nixos.tests.networking.scripted.virtual")
         (onFullSupported "nixos.tests.networking.scripted.vlan")
@@ -158,7 +158,7 @@ rec {
         #(onFullSupported "nixos.tests.networking.networkd.macvlan")
         (onFullSupported "nixos.tests.networking.networkd.privacy")
         (onFullSupported "nixos.tests.networking.networkd.routes")
-        (onFullSupported "nixos.tests.networking.networkd.sit")
+        (onFullSupported "nixos.tests.networking.networkd.sit-fou")
         (onFullSupported "nixos.tests.networking.networkd.static")
         (onFullSupported "nixos.tests.networking.networkd.virtual")
         (onFullSupported "nixos.tests.networking.networkd.vlan")
diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index 312981317735..c5b8b213098d 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -39,11 +39,23 @@ let
           defaultGateway = {
             address = "192.168.1.1";
             interface = "enp1s0";
+            source = "192.168.1.3";
           };
           defaultGateway6 = {
             address = "fd00:1234:5678:1::1";
             interface = "enp1s0";
+            source = "fd00:1234:5678:1::3";
           };
+          interfaces.enp1s0.ipv6.addresses = [
+            {
+              address = "fd00:1234:5678:1::2";
+              prefixLength = 64;
+            }
+            {
+              address = "fd00:1234:5678:1::3";
+              prefixLength = 128;
+            }
+          ];
           interfaces.enp1s0.ipv4.addresses = [
             {
               address = "192.168.1.2";
@@ -89,7 +101,11 @@ let
 
         with subtest("Test default gateway"):
             client.wait_until_succeeds("ping -c 1 192.168.3.1")
-            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:3::1")
+            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
+
+        with subtest("Test default addresses"):
+            client.succeed("ip -4 route show default | grep -q 'src 192.168.1.3'")
+            client.succeed("ip -6 route show default | grep -q 'src fd00:1234:5678:1::3'")
       '';
     };
     routeType = {
@@ -481,7 +497,73 @@ let
           } in fous, "fou4 exists"
         '';
     };
-    sit =
+    sit-6in4 =
+      let
+        node =
+          {
+            address4,
+            remote,
+            address6,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              sits.sit = {
+                inherit remote;
+                local = address4;
+                dev = "enp1s0";
+              };
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto 41 accept";
+              interfaces.enp1s0.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = address4;
+                  prefixLength = 24;
+                }
+              ];
+              interfaces.sit.ipv6.addresses = lib.mkOverride 0 [
+                {
+                  address = address6;
+                  prefixLength = 64;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "Sit-6in4";
+        nodes.client1 = node {
+          address4 = "192.168.1.1";
+          remote = "192.168.1.2";
+          address6 = "fc00::1";
+        };
+        nodes.client2 = node {
+          address4 = "192.168.1.2";
+          remote = "192.168.1.1";
+          address6 = "fc00::2";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test ipv6"):
+              client1.wait_until_succeeds("ping -c 1 fc00::1")
+              client1.wait_until_succeeds("ping -c 1 fc00::2")
+
+              client2.wait_until_succeeds("ping -c 1 fc00::1")
+              client2.wait_until_succeeds("ping -c 1 fc00::2")
+        '';
+      };
+    sit-fou =
       let
         node =
           {
@@ -516,7 +598,7 @@ let
           };
       in
       {
-        name = "Sit";
+        name = "Sit-fou";
         # note on firewalling: the two nodes are explicitly asymmetric.
         # client1 sends SIT packets in UDP, but accepts only proto-41 incoming.
         # client2 does the reverse, sending in proto-41 and accepting only UDP incoming.
@@ -531,7 +613,8 @@ let
             } args)
             {
               networking = {
-                firewall.extraCommands = "iptables -A INPUT -p 41 -j ACCEPT";
+                nftables.enable = true;
+                firewall.extraInputRules = "meta l4proto 41 accept";
                 sits.sit.encapsulation = {
                   type = "fou";
                   port = 9001;
@@ -576,6 +659,140 @@ let
               client2.wait_until_succeeds("ping -c 1 fc00::2")
         '';
       };
+    ipip-4in6 =
+      let
+        node =
+          {
+            address4,
+            remote,
+            address6,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              ipips."4in6" = {
+                inherit remote;
+                local = address6;
+                dev = "enp1s0";
+                encapsulation.type = "4in6";
+              };
+              firewall.enable = false;
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto ipip accept";
+              interfaces.enp1s0.ipv6.addresses = lib.mkOverride 0 [
+                {
+                  address = address6;
+                  prefixLength = 64;
+                }
+              ];
+              interfaces."4in6".ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = address4;
+                  prefixLength = 24;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "ipip-4in6";
+        nodes.client1 = node {
+          address6 = "fc00::1";
+          address4 = "192.168.1.1";
+          remote = "fc00::2";
+        };
+        nodes.client2 = node {
+          address6 = "fc00::2";
+          address4 = "192.168.1.2";
+          remote = "fc00::1";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test ipv6"):
+              client1.wait_until_succeeds("ping -c 1 192.168.1.1")
+              client1.wait_until_succeeds("ping -c 1 192.168.1.2")
+
+              client2.wait_until_succeeds("ping -c 1 192.168.1.1")
+              client2.wait_until_succeeds("ping -c 1 192.168.1.2")
+        '';
+      };
+    ipip =
+      let
+        node =
+          {
+            local,
+            remote,
+            address,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              ipips.ipip = {
+                inherit local remote;
+                dev = "enp1s0";
+                encapsulation.type = "ipip";
+              };
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto 4 accept";
+              interfaces.enp1s0.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = local;
+                  prefixLength = 24;
+                }
+              ];
+              interfaces.ipip.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  inherit address;
+                  prefixLength = 24;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "ipip";
+        nodes.client1 = node {
+          local = "192.168.1.1";
+          remote = "192.168.1.2";
+          address = "192.168.10.1";
+        };
+        nodes.client2 = node {
+          local = "192.168.1.2";
+          remote = "192.168.1.1";
+          address = "192.168.10.2";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test IPIP tunnel"):
+              client1.wait_until_succeeds("ping -c 1 192.168.10.1")
+              client1.wait_until_succeeds("ping -c 1 192.168.10.2")
+
+              client2.wait_until_succeeds("ping -c 1 192.168.10.1")
+              client2.wait_until_succeeds("ping -c 1 192.168.10.2")
+        '';
+      };
     gre =
       let
         node =
@@ -1241,6 +1458,7 @@ lib.mapAttrs (lib.const (
     attrs
     // {
       name = "${attrs.name}-Networking-${if networkd then "Networkd" else "Scripted"}";
+      meta.maintainers = with lib.maintainers; [ rnhmjoj ];
     }
   )
 )) testCases
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index 5a3f688447be..e1091a8043e4 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${version}";
-    hash = "sha256-mnY8cUaE5NS+Ty3tqxg6DATitZQNLFgxEf8ITufI0g4=";
+    hash = "sha256-Nsfqd54QNRkeqUxUA05+0gtcoopz090/wW+zdFsEii8=";
   };
 
-  vendorHash = "sha256-P9ubNA0eiriAA90UPrhU+x76i8667vPvAWLH7rduYLo=";
+  vendorHash = "sha256-fiwxmF91UCTNi3jgrJnWgPswWXQFLg70d+h3frnu7kU=";
 
   proxyVendor = true; # darwin/linux hash mismatch
 
diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index 2faf818d24ea..935387f670f6 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -121,6 +121,7 @@ rec {
         xorg.xrandr
         which
         perl
+        xdg-user-dirs # flutter desktop apps
         xdg-utils
         iana-etc
         krb5
diff --git a/pkgs/build-support/node/import-npm-lock/default.nix b/pkgs/build-support/node/import-npm-lock/default.nix
index d80643d60a32..8b8281778bc7 100644
--- a/pkgs/build-support/node/import-npm-lock/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/default.nix
@@ -4,6 +4,7 @@
   stdenv,
   callPackages,
   runCommand,
+  cctools,
 }:
 
 let
@@ -204,11 +205,14 @@ lib.fix (self: {
       }
       // derivationArgs
       // {
-        nativeBuildInputs = [
-          nodejs
-          nodejs.passthru.python
-          hooks.npmConfigHook
-        ] ++ derivationArgs.nativeBuildInputs or [ ];
+        nativeBuildInputs =
+          [
+            nodejs
+            nodejs.passthru.python
+            hooks.npmConfigHook
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools ]
+          ++ derivationArgs.nativeBuildInputs or [ ];
 
         passAsFile = [
           "package"
diff --git a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
index 2289dfc2425e..aec15f00aafc 100644
--- a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
+++ b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
@@ -42,7 +42,7 @@ linkFarm "writeShellApplication-tests" {
       };
     in
     assert script.meta.mainProgram == "test-meta";
-    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument.";
+    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument";
     script;
 
   test-runtime-inputs = checkShellApplication {
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index a5fa301abcf0..5818f54b71c2 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.1.2";
+  version = "22.1.4";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-akrZca9bRKqEVgmTKS0n1XliVhDq2eeH1Bo5ubjpYnc=";
+    hash = "sha256-tf9VQN2eI+YXTeQBwIXlxCL3mRi1JcYS+n5wA/L1mQY=";
   };
 
-  npmDepsHash = "sha256-Xq5pp1NNOXyCXnq1mNDaxktbjSzz3T0vOYsYZ7drUNQ=";
+  npmDepsHash = "sha256-Nqpj04OdTynAtDLcXHJLa+eFzC/juwws6a67Ds/eIZQ=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/ca/catppuccinifier-gui/package.nix b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
index 875a74173a2c..4388c11c6662 100644
--- a/pkgs/by-name/ca/catppuccinifier-gui/package.nix
+++ b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://github.com/lighttigerXIV/catppuccinifier/releases/download/${version}/Catppuccinifer-Linux-${version}.tar.xz";
-    hash = "sha256-FtsO+3C5Ll1aYYCuohrPI2IQZsLyvBseXPzfK1sQgNc=";
+    url = "https://github.com/lighttigerXIV/catppuccinifier/releases/download/${version}/Catppuccinifier-Linux-${version}.tar.xz";
+    hash = "sha256-wGj0mWxmGqG/z/jmQ5pw1LdxYKzHaf+eOUXhpMT3kgs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index fd8b9d861d87..77556a1bbf20 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.57"
+        "@anthropic-ai/claude-code": "^1.0.58"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.57",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.57.tgz",
-      "integrity": "sha512-zMymGZzjG+JO9iKC5N5pAy8AxyHIMPCL6U3HYCR3vCj5M+Y0s3GAMma6GkvCXWFixRN6KSZItKw3HbQiaIBYlw==",
+      "version": "1.0.58",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.58.tgz",
+      "integrity": "sha512-XcfqklHSCuBRpVV9vZaAGvdJFAyVKb/UHz2VG9osvn1pRqY7e+HhIOU9X7LeI+c116QhmjglGwe+qz4jOC83CQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 92619dda4202..36fddb8be4ec 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.57";
+  version = "1.0.58";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-BNaBl4NGS1x1emJux610HXwUg1QC1wauRZ6UXn3gcR0=";
+    hash = "sha256-Mp3S269iifNGSEz83IF6bqbgdy6Im1bQjR8oaaL3W8c=";
   };
 
-  npmDepsHash = "sha256-TxKqpiPpxEfYowQswMrcWIotAdmLvHJyQ56vK39asNs=";
+  npmDepsHash = "sha256-iAckljEIJFVtlySHjS414HUFg6XVSlPr8azYqTo1py8=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/cortex-tools/package.nix b/pkgs/by-name/co/cortex-tools/package.nix
new file mode 100644
index 000000000000..3578775f00cd
--- /dev/null
+++ b/pkgs/by-name/co/cortex-tools/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  versionCheckHook,
+  installShellFiles,
+  stdenv,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "cortex-tools";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "cortex-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+GWUC+lnCn5Nw2WytSvW/UsIMmMelCCsnKdBCHuue24=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [
+    "cmd/benchtool"
+    "cmd/cortextool"
+    "cmd/e2ealerting"
+    "cmd/logtool"
+  ];
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-X github.com/grafana/cortex-tools/pkg/version.Version=${finalAttrs.src.tag}"
+    "-s"
+    "-w"
+  ];
+
+  doCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd cortextool \
+      --bash <($out/bin/cortextool --completion-script-bash) \
+      --zsh <($out/bin/cortextool --completion-script-zsh)
+
+    $out/bin/cortextool --help-man > cortextool.1
+    installManPage cortextool.1
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "version";
+
+  meta = {
+    changelog = "https://github.com/grafana/cortex-tools/releases/tag/${finalAttrs.src.tag}";
+    description = "Tools used for interacting with Cortex, a Prometheus-compatible server";
+    longDescription = ''
+      Tools used for interacting with Cortex, a horizontally scalable, highly available, multi-tenant, long term Prometheus server:
+
+      - benchtool: A powerful YAML driven tool for benchmarking Cortex write and query API.
+      - cortextool: Interacts with user-facing Cortex APIs and backend storage components.
+      - logtool: Tool which parses Cortex query-frontend logs and formats them for easy analysis.
+      - e2ealerting: Tool that helps measure how long an alert takes from scrape of sample to Alertmanager notification delivery.
+    '';
+    homepage = "https://github.com/grafana/cortex-tools";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux ++ lib.platforms.windows ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ videl ];
+    mainProgram = "cortextool";
+  };
+})
diff --git a/pkgs/by-name/fi/figma-linux/package.nix b/pkgs/by-name/fi/figma-linux/package.nix
index 927163c5dc86..8696d43cf162 100644
--- a/pkgs/by-name/fi/figma-linux/package.nix
+++ b/pkgs/by-name/fi/figma-linux/package.nix
@@ -1,96 +1,89 @@
 {
-  pkgs,
   lib,
-  stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  dpkg,
-  makeWrapper,
-  wrapGAppsHook3,
-  ...
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  electron,
+  p7zip,
+  # there's a setting "use zenity for dialogs"
+  zenity,
+
+  copyDesktopItems,
+  makeBinaryWrapper,
+  makeDesktopItem,
 }:
-stdenv.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "figma-linux";
   version = "0.11.5";
 
-  src = fetchurl {
-    url = "https://github.com/Figma-Linux/figma-linux/releases/download/v${finalAttrs.version}/figma-linux_${finalAttrs.version}_linux_amd64.deb";
-    hash = "sha256-6lFeiecliyuTdnUCCbLpoQWiu5k3OPHxb+VF17GtERo=";
+  src = fetchFromGitHub {
+    owner = "Figma-Linux";
+    repo = "figma-linux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pa0GgAmi9Os4EtZpbo0hSgr4s+WX95zLUrZR8a33TeI=";
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-    wrapGAppsHook3
+    copyDesktopItems
+    makeBinaryWrapper
   ];
 
-  buildInputs =
-    with pkgs;
-    [
-      alsa-lib
-      at-spi2-atk
-      cairo
-      cups.lib
-      dbus.lib
-      expat
-      gdk-pixbuf
-      glib
-      gtk3
-      libdrm
-      libxkbcommon
-      libgbm
-      nspr
-      nss
-      pango
-    ]
-    ++ (with pkgs.xorg; [
-      libX11
-      libXcomposite
-      libXdamage
-      libXext
-      libXfixes
-      libXrandr
-      libxcb
-      libxshmfence
-    ]);
+  npmDepsHash = "sha256-FqgcG52Nkj0wlwsHwIWTXNuIeAs7b+TPkHcg7m5D2og=";
 
-  runtimeDependencies = with pkgs; [ eudev ];
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  };
 
-  unpackCmd = "dpkg -x $src .";
-
-  sourceRoot = ".";
-
-  # Instead of double wrapping the binary, simply pass the `gappsWrapperArgs`
-  # to `makeWrapper` directly
-  dontWrapGApps = true;
+  desktopItems = [
+    (makeDesktopItem {
+      name = "figma-linux";
+      desktopName = "Figma Linux";
+      comment = "Unofficial Figma desktop application for Linux";
+      exec = "figma-linux %U";
+      icon = "figma-linux";
+      terminal = false;
+    })
+  ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/lib && cp -r opt/figma-linux/* $_
-    mkdir -p $out/bin && ln -s $out/lib/figma-linux $_/figma-linux
+    mkdir -p $out/share/figma-linux/resources
 
-    cp -r usr/* $out
+    rm -rf node_modules/7zip-bin
 
-    wrapProgramShell $out/bin/figma-linux \
-      "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime=true}}"
+    cp -r node_modules $out/share/figma-linux/resources
+
+    # transpose [name][size] into [size][name]
+    for icon in resources/icons/*.png; do
+      basename="$(basename "$icon")"
+      size="''${basename%.png}"
+
+      install -Dm444 "$icon" -T "$out/share/icons/hicolor/$size/figma-linux.png"
+    done
+
+    cp -r dist $out/share/figma-linux/resources/app
+
+    makeWrapper ${lib.getExe electron} $out/bin/figma-linux \
+      --add-flag $out/share/figma-linux/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime=true}}" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          p7zip
+          zenity
+        ]
+      }" \
+      --inherit-argv0
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    substituteInPlace $out/share/applications/figma-linux.desktop \
-          --replace "Exec=/opt/figma-linux/figma-linux" "Exec=$out/bin/figma-linux"
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Unofficial Electron-based Figma desktop app for Linux";
     homepage = "https://github.com/Figma-Linux/figma-linux";
-    platforms = [ "x86_64-linux" ];
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
       ercao
       kashw2
     ];
diff --git a/pkgs/by-name/fr/freedv/package.nix b/pkgs/by-name/fr/freedv/package.nix
index bdff43aaef2f..57ba6b6b930e 100644
--- a/pkgs/by-name/fr/freedv/package.nix
+++ b/pkgs/by-name/fr/freedv/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freedv";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3vwFB+3LloumEAGlSJZc2+/I8uI6KLP/KuDGeDOj87k=";
+    hash = "sha256-+hVh5GgSz8MWib10dVV6gx9EvocvLAJm2Eid/4y//2E=";
   };
 
   patches = [
@@ -58,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail "GIT_REPOSITORY https://github.com/drowe67/radae.git" "URL $(realpath radae)" \
         --replace-fail "GIT_TAG main" ""
       patchShebangs test/test_*.sh
+      substituteInPlace cmake/CheckGit.cmake \
+        --replace-fail "git describe --abbrev=4 --always HEAD" "echo v${finalAttrs.version}"
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace CMakeLists.txt \
@@ -74,7 +76,13 @@ stdenv.mkDerivation (finalAttrs: {
       python3
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      macdylibbundler
+      (macdylibbundler.overrideAttrs {
+        # incompatible with darwin.sigtool in Nixpkgs
+        postPatch = ''
+          substituteInPlace src/Utils.cpp \
+            --replace-fail "--deep --preserve-metadata=entitlements,requirements,flags,runtime" ""
+        '';
+      })
       makeWrapper
       darwin.autoSignDarwinBinariesHook
       darwin.sigtool
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 4d844474cb7d..664edf9b73df 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.2.0";
+  version = "18.2.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-e78kokFzVqFGgurlqThxHhfrGiRuZ+XG2g5hRrCuF3Y=";
+      hash = "sha256-h4JklXImKwudJT3pb/UhHwQHKd87c5aSH1xYC0lRWKo=";
     };
 
     vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index b0e6e6dad31e..452d624d23e2 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.2.0";
+  version = "18.2.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-TcDk816n4483SzTuz5bc8e2efrd2eJdM8jWXpM3DMvY=";
+    hash = "sha256-z1Pl3xeaoqeF/9qOVcuCpuciu1r6NQ4UhlLe9gy9+nE=";
   };
 
   vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index aa76ef74a44a..c170a0a5d80b 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.2.0",
-  "repo_hash": "0wkxnhrxq3x2ahbb1hffd2c321mz3y1wi7qh89drg8rn4qgz09cd",
+  "version": "18.2.1",
+  "repo_hash": "1i0y46w18476gn98fmkixdjiyrwajz2347p57dg2ijch4ivzpmlv",
   "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.2.0-ee",
+  "rev": "v18.2.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.2.0",
-    "GITLAB_PAGES_VERSION": "18.2.0",
+    "GITALY_SERVER_VERSION": "18.2.1",
+    "GITLAB_PAGES_VERSION": "18.2.1",
     "GITLAB_SHELL_VERSION": "14.43.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
-    "GITLAB_WORKHORSE_VERSION": "18.2.0"
+    "GITLAB_WORKHORSE_VERSION": "18.2.1"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index c8f129daff95..739a24476dec 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.2.0";
+  version = "18.2.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-fJ1QqVn2t591ZQv9ilwgk+sPwNZNy6bHvpdCPs7S0+s=";
+  vendorHash = "sha256-A+hCyi4P0JkBY2NYGWSpMsHjEgD43g9ZlPrxWL9Vx7Q=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index cb438c5056c9..22998e461649 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-jMifo0vhcCFY8DTuqRYzz483R2NGOWeWr1SR7xkTM/s=";
+    hash = "sha256-Mwgdombfc01Ss8Sy/pMwHNWeI1lxC1riFql9FtqaBmY=";
   };
 
   buildAndTestSubdir = "harper-ls";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PSyJ9EDmxevU/b3xWZS3eqQPfcQ7Us/Bi6SA7WB70J4=";
+  cargoHash = "sha256-aOajrh2NZShP1vXSUEDzY1ULTeMs8dY+BDIspCi1BfY=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 1e11a1330b16..01a956b279c1 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -1,29 +1,32 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchgit,
   autoreconfHook,
-  callPackage,
+  texinfo,
   guile,
   guile-commonmark,
   guile-reader,
-  makeWrapper,
+  makeBinaryWrapper,
   pkg-config,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "haunt";
   version = "0.3.0";
 
-  src = fetchurl {
-    url = "https://files.dthompson.us/haunt/haunt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-mLq+0GvlSgZsPryUQQqR63zEg2fpTVKBMdO6JxSZmSs=";
+  src = fetchgit {
+    url = "https://git.dthompson.us/haunt.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i6MI0eaRiA/JNgkIBJGLAsqMnyJz47aavyD6kOL7sqU=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
+    texinfo
   ];
 
   buildInputs = [
@@ -32,8 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     guile-reader
   ];
 
-  # Test suite is non-deterministic in later versions
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   postInstall = ''
     wrapProgram $out/bin/haunt \
@@ -42,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests = {
-      expectVersion = callPackage ./tests/001-test-version.nix { };
-    };
+    updateScript = gitUpdater { rev-prefix = "v"; };
   };
 
   meta = {
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
       to do things that aren't provided out-of-the-box.
     '';
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ normalcea ];
     inherit (guile.meta) platforms;
   };
 })
diff --git a/pkgs/by-name/ha/haunt/tests/001-test-version.nix b/pkgs/by-name/ha/haunt/tests/001-test-version.nix
deleted file mode 100644
index 09ef5b32947d..000000000000
--- a/pkgs/by-name/ha/haunt/tests/001-test-version.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  stdenv,
-  haunt,
-}:
-
-stdenv.mkDerivation {
-  pname = "haunt-test-version";
-  inherit (haunt) version;
-
-  nativeBuildInputs = [ haunt ];
-
-  dontInstall = true;
-
-  buildCommand = ''
-    haunt --version
-
-    touch $out
-  '';
-
-  meta.timeout = 10;
-}
diff --git a/pkgs/by-name/me/mediawriter/package.nix b/pkgs/by-name/me/mediawriter/package.nix
index c7735a8786ba..90827c58682f 100644
--- a/pkgs/by-name/me/mediawriter/package.nix
+++ b/pkgs/by-name/me/mediawriter/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawriter";
-  version = "5.2.7";
+  version = "5.2.8";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "MediaWriter";
     tag = version;
-    hash = "sha256-wowhV8h8vUw1eehcoXS0DFZtPfLmPfQUTcNDiZjWL3A=";
+    hash = "sha256-8nTWwBf8I4IENh0wColzPg3xjsXg3bubg6ZqNpfLE3c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index 517824d22319..3eeadda88be0 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -14,12 +14,12 @@
   protoc-gen-validate,
 }:
 let
-  version = "0.24.4";
+  version = "0.25.0";
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "memos";
     rev = "v${version}";
-    hash = "sha256-Vimc9Z6X1+UBm2UnNnlsYqXEnOV3JcEPm9SD3obKkLc=";
+    hash = "sha256-M1o7orU4xw/t9PjSFXNj7tiYTarBv7kIIj8X0r3QD8s=";
   };
 
   memos-protobuf-gen = stdenvNoCC.mkDerivation {
@@ -52,7 +52,7 @@ let
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-cJK9wT5uj1MYjYZkzgMSL9nShCO2xPJOYZT+ebndwlY=";
+    outputHash = "sha256-lV92s/KLzWs/KSLbsb61FaA9+PEDMLshl/srDcjdRcU=";
   };
 
   memos-web = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -62,7 +62,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       fetcherVersion = 1;
-      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
+      hash = "sha256-TEWaFWFQ0sHdgfFFvolnwoa4hTaFkzqqyFep56Cevp4=";
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
@@ -93,7 +93,7 @@ buildGoModule {
     memos-protobuf-gen
     ;
 
-  vendorHash = "sha256-EzVgQpWJJA7EUKdnnnCIvecaOXg856f/WQyfV/WuWFU=";
+  vendorHash = "sha256-xiBxnrjJsskRCcUBGKnrc5s5tuhMFSqRoELcr5ww/XU=";
 
   preBuild = ''
     rm -rf server/router/frontend/dist
@@ -113,6 +113,7 @@ buildGoModule {
   meta = {
     homepage = "https://usememos.com";
     description = "Lightweight, self-hosted memo hub";
+    changelog = "https://github.com/usememos/memos/releases/tag/${src.rev}";
     maintainers = with lib.maintainers; [
       indexyz
       kuflierl
diff --git a/pkgs/by-name/mi/mint-l-icons/package.nix b/pkgs/by-name/mi/mint-l-icons/package.nix
index 1641646ffdfc..cda137268dc8 100644
--- a/pkgs/by-name/mi/mint-l-icons/package.nix
+++ b/pkgs/by-name/mi/mint-l-icons/package.nix
@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mint-l-icons";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-icons";
     # They don't really do tags, this is just a named commit.
-    rev = "b442277c822c92f7bb68282cb82c7d1a98e3fd37";
-    hash = "sha256-vPDEribE/CZwoAK1C9fjbWQEO/NWMWCKCUO/Xw/SxZ0=";
+    rev = "64ee205dc270b13f3816030330eed108eaa30360";
+    hash = "sha256-4tavRQ1bWzVYcAAJtZ4avRHcBB+oTDhdXp6dlSGO4C8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/mi/mint-y-icons/package.nix b/pkgs/by-name/mi/mint-y-icons/package.nix
index a11b03fa8c28..4a49fc1acb75 100644
--- a/pkgs/by-name/mi/mint-y-icons/package.nix
+++ b/pkgs/by-name/mi/mint-y-icons/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-y-icons";
     rev = version;
-    hash = "sha256-xGPihqXUraJy9lDCSVjQlNxrhETEcjBTYhyFsZGJRGo=";
+    hash = "sha256-ftiV9l7hTmWdtw36Z2GKpJZuRwQQ3MQWYIgb62VBde0=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,12 @@ stdenvNoCC.mkDerivation rec {
 
   dontDropIconThemeCache = true;
 
+  postPatch = ''
+    # Breaks gtk-update-icon-cache
+    # https://github.com/linuxmint/mint-y-icons/issues/494
+    find usr/share/icons/Mint-Y/apps/ -type l -name "1AC2_Battle.net Launcher.0.png" -delete
+  '';
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/mo/moon/package.nix b/pkgs/by-name/mo/moon/package.nix
index 18e780198120..ce7800bd2332 100644
--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moon";
-  version = "1.38.3";
+  version = "1.38.5";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "moon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PDXH+61Awx9sG/xPvvt78xlcHjU1bV3f9FRqx8I262g=";
+    hash = "sha256-jWLyg7K+ucCsrHwFNrpmWAXznSD+3TaYGfbZ2hWlnP0=";
   };
 
-  cargoHash = "sha256-yB0sbS3OXFnDQkq/bHYIsCDxnuzXCxvcGKSOxXpiE8U=";
+  cargoHash = "sha256-2E59P0d3SDZUgbN5V52Rr9liONiKcFUFv3dSrtFJ8NE=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/by-name/my/mysql-workbench/package.nix b/pkgs/by-name/my/mysql-workbench/package.nix
index 1ef123b5b74b..967f2ad1dd8e 100644
--- a/pkgs/by-name/my/mysql-workbench/package.nix
+++ b/pkgs/by-name/my/mysql-workbench/package.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-workbench";
-  version = "8.0.42";
+  version = "8.0.43";
 
   src = fetchurl {
     url = "https://cdn.mysql.com/Downloads/MySQLGUITools/mysql-workbench-community-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-d4SnNALK76AXWEu0WHX0dZv4co6Q+oCMTYAVV3pd9gU=";
+    hash = "sha256-E9fn72r35WrGzIOoDouIvJFZdpfw9sgDNHwEe/0DdUI=";
   };
 
   patches = [
@@ -90,6 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs tools/get_wb_version.sh
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -115,6 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
     libsecret
     libiodbc
 
+    bash # for shebangs
+
     # python dependencies:
     paramiko
     pycairo
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 046afbd33c40..9cb19efe74db 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -17,19 +17,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.100.1";
+  version = "1.103.0";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-S5GGJRLTpr1HfXnXRXO6hcVjgjRWvbknABEsGkTq428=";
+    hash = "sha256-3Dob4GLTyM6QbdWQBIfC/5rSlM1olYsAFwHS3zwxCj0=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
+    hash = "sha256-LierbGPkVIy5/2vtBl94TQcSpmNX9OUDMntDdo5BeiU=";
   };
 
   nativeBuildInputs =
@@ -113,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
     maintainers = with lib.maintainers; [
       gepbird
+      AdrienLemaire
     ];
     license = lib.licenses.sustainableUse;
     mainProgram = "n8n";
diff --git a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
new file mode 100644
index 000000000000..4f47573bf675
--- /dev/null
+++ b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "nextcloud-spreed-signaling";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "strukturag";
+    repo = "nextcloud-spreed-signaling";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JBYhmIXDpovkXM8oYO3B9n2bs+H0GjmuT4Dl3gEQjPo=";
+  };
+
+  vendorHash = "sha256-MGz0tj6QwDXYDtamgN6d5yfIFHToE+XF3HYVsFRxHhM=";
+
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dedicated signaling backend for nextcloud talk";
+    homepage = "https://github.com/strukturag/nextcloud-spreed-signaling";
+    downloadPage = "https://github.com/strukturag/nextcloud-spreed-signaling/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/strukturag/nextcloud-spreed-signaling/releases/tag/v${finalAttrs.version}";
+    mainProgram = "server";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      hensoko
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/op/open5gs/package.nix b/pkgs/by-name/op/open5gs/package.nix
index a7ea2bf68f40..a632a445d2f0 100644
--- a/pkgs/by-name/op/open5gs/package.nix
+++ b/pkgs/by-name/op/open5gs/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open5gs";
-  version = "2.7.2";
+  version = "2.7.6";
 
   diameter = fetchFromGitHub {
     owner = "open5gs";
     repo = "freeDiameter";
-    rev = "20196a265aecb7b1573ceb526bb619e092c1fd3f"; # r1.5.0
-    hash = "sha256-0sxzQtKBx313+x3TRsmeswAq90Vk5jNA//rOJcEZJTQ=";
+    rev = "13f5a5996b5fa1a46ed780635c7fc6fcd09b4290"; # r1.5.0
+    hash = "sha256-S8jL+9rW9RDwQc7NU8MOzMe9/iRbshWa2QLqXoiV85Q=";
   };
 
   libtins = fetchFromGitHub {
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "open5gs";
     repo = "open5gs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XSDjVW+5l2trrilKMcSfX6QIfh/ijWxjoJg33Bn1DBU=";
+    hash = "sha256-2k+S+OXfdskJPtDUFSxb/+2UZcUiOZzRSSGgsEJWolc=";
   };
 
   webui = buildNpmPackage {
@@ -129,7 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "4G/5G core network components";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    maintainers = with lib.maintainers; [
+      bot-wxt1221
+      xddxdd
+    ];
     changelog = "https://github.com/open5gs/open5gs/releases/tag/v${finalAttrs.version}";
   };
 })
diff --git a/pkgs/by-name/p2/p2pool/package.nix b/pkgs/by-name/p2/p2pool/package.nix
index f2220f8801d5..05101533cef1 100644
--- a/pkgs/by-name/p2/p2pool/package.nix
+++ b/pkgs/by-name/p2/p2pool/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "4.8.1";
+  version = "4.9";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    hash = "sha256-UnvMR4s6o8n7K+9hig3iSFtbN/BmR6yqjc64X443ctk=";
+    hash = "sha256-nFoR5n6vm6Q1UBxX+3U6O6NExcrM1Mab+WjEOgRSKCE=";
     fetchSubmodules = true;
   };
 
@@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "p2pool";
     platforms = platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/po/poetry/unwrapped.nix b/pkgs/by-name/po/poetry/unwrapped.nix
index e73f7432b66d..6a270261eab2 100644
--- a/pkgs/by-name/po/poetry/unwrapped.nix
+++ b/pkgs/by-name/po/poetry/unwrapped.nix
@@ -128,24 +128,30 @@ buildPythonPackage rec {
     unset no_proxy
   '';
 
-  disabledTests = [
-    "test_builder_should_execute_build_scripts"
-    "test_env_system_packages_are_relative_to_lib"
-    "test_install_warning_corrupt_root"
-    "test_no_additional_output_in_verbose_mode"
-    "test_project_plugins_are_installed_in_project_folder"
-    "test_application_command_not_found_messages"
-    # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
-    "test_list_poetry_managed"
-    "test_list_poetry_managed"
-    "test_find_all_with_poetry_managed"
-    "test_find_poetry_managed_pythons"
-    # Flaky
-    "test_threading_property_types"
-    "test_threading_single_thread_safe"
-    "test_threading_property_caching"
-    "test_threading_atomic_cached_property_different_instances"
-  ];
+  disabledTests =
+    [
+      "test_builder_should_execute_build_scripts"
+      "test_env_system_packages_are_relative_to_lib"
+      "test_install_warning_corrupt_root"
+      "test_no_additional_output_in_verbose_mode"
+      "test_project_plugins_are_installed_in_project_folder"
+      "test_application_command_not_found_messages"
+      # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
+      "test_list_poetry_managed"
+      "test_list_poetry_managed"
+      "test_find_all_with_poetry_managed"
+      "test_find_poetry_managed_pythons"
+      # Flaky
+      "test_threading_property_types"
+      "test_threading_single_thread_safe"
+      "test_threading_property_caching"
+      "test_threading_atomic_cached_property_different_instances"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Sandbox violation:
+      # PermissionError: [Errno 1] Operation not permitted: '/Library/Frameworks/Python.framework/Versions'
+      "test_find_all"
+    ];
 
   disabledTestMarks = [
     "network"
diff --git a/pkgs/by-name/sn/snipe-it/package.nix b/pkgs/by-name/sn/snipe-it/package.nix
index e5a26d0cc847..a40a53373de5 100644
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.1.18";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S11RUvblLQNS+LX66zBlVATJTvOMNBxf//zpo+b4AB0=";
+    hash = "sha256-mXcc6wSDoO7z2xYUjwn6hU39OBmsZOw4JeZTpwZMMbI=";
   };
 
-  vendorHash = "sha256-wWm7bB+TUzeRDRPYCL53c9/KspAdsHSEKK759ntiLWo=";
+  vendorHash = "sha256-84kllssopKRAC/Dws+5s6e61/O56B+Uy19jjIV8yLUo=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"
diff --git a/pkgs/by-name/so/soapyuhd/package.nix b/pkgs/by-name/so/soapyuhd/package.nix
index 722d41bb37cc..c3f57dc02081 100644
--- a/pkgs/by-name/so/soapyuhd/package.nix
+++ b/pkgs/by-name/so/soapyuhd/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "soapyuhd";
-  version = "0.4.1";
+  version = "0.4.1-unstable-2025-02-13";
 
   src = fetchFromGitHub {
     owner = "pothosware";
     repo = "SoapyUHD";
-    rev = "soapy-uhd-${version}";
-    sha256 = "14rk9ap9ayks2ma6mygca08yfds9bgfmip8cvwl87l06hwhnlwhj";
+    rev = "6b521393cc45c66770f3d4bc69eac7dda982174c";
+    sha256 = "qg0mbw3S973cnok6tVx7Y38ijOQcJdHtPLi889uo7tI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ts/ts_query_ls/package.nix b/pkgs/by-name/ts/ts_query_ls/package.nix
index 7963eea57575..038bac3fd08b 100644
--- a/pkgs/by-name/ts/ts_query_ls/package.nix
+++ b/pkgs/by-name/ts/ts_query_ls/package.nix
@@ -6,7 +6,7 @@
 }:
 let
   pname = "ts_query_ls";
-  version = "3.3.0";
+  version = "3.8.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -15,13 +15,13 @@ rustPlatform.buildRustPackage {
     owner = "ribru17";
     repo = "ts_query_ls";
     rev = "v${version}";
-    hash = "sha256-CtR5NDvpE8d5KlmATEwk9LVtVHB6NfGMEtT50s1HsWI=";
+    hash = "sha256-CBsiHK+mt3acyR0HGfx0kIzmTO5FLFjkL2wFK+yILx4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I47MCmRumJW50dPOaL8rGB7hRvxvF2gx+XmwzKL67Ok=";
+  cargoHash = "sha256-b2lfuWX2c489Sw76TBbFj/krnNS27QL0u7lVWhx1WwM=";
 
   meta = {
     description = "LSP implementation for Tree-sitter's query files";
diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 71ee44c92531..7150351ba562 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vmware-workstation";
-  version = "17.6.3";
-  build = "24583834";
+  version = "17.6.4";
+  build = "24832109";
 
   src = requireFile {
     name = "VMware-Workstation-Full-${finalAttrs.version}-${finalAttrs.build}.x86_64.bundle";
     url = "https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true";
-    hash = "sha256-eVdZF3KN7UxtC4n0q2qBvpp3PADuto0dEqwNsSVHjuA=";
+    hash = "sha256-ZPv7rqzEiGVGgRQ2Kiu6rekRDMnoe8O9k4OWun8Zqb0=";
   };
 
   vmware-unpack-env = buildFHSEnv {
diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index 49ee23999cab..bc64a4308723 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "25.2.6";
+  version = "25.3.0";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-Le21JODzWgJNLWojGyoYeyJUfi8zk2JNC4C27PC3RlA=";
+    hash = "sha256-S4HjNZrrHxTiHao102fODrUE4isqd2QR7dFfqxEQRx8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xr/xreader/package.nix b/pkgs/by-name/xr/xreader/package.nix
index b0061d28a50c..e41c7789af8a 100644
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -36,13 +36,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.2.6";
+  version = "4.2.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xreader";
     rev = version;
-    hash = "sha256-ELqO8pYMWgU6DUS5vg+F+xFp3w3H6u0Jzms3xaNlTqE=";
+    hash = "sha256-APBVrrvLS5CFtfi0UlIDtYyg4pfCS8qLc2a4KDOU1Zk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index a32350065a4b..5817fca0f464 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.8";
+  version = "3.4.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-Wn1a/tGNIJNGbgDKoMMMo/oCXrqCXDM1nTUgCZt0O/U=";
+    hash = "sha256-WYGX57PUX+WUVVZ1F+oE3QNwKB7ii5FlJdQ/3j5heUA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-2/default.nix b/pkgs/desktops/gnome-2/default.nix
index 14d8ac23b6b5..dd61bbed6828 100644
--- a/pkgs/desktops/gnome-2/default.nix
+++ b/pkgs/desktops/gnome-2/default.nix
@@ -33,9 +33,7 @@ lib.makeScope pkgs.newScope (
 
     #### DESKTOP
 
-    gtksourceview = callPackage ./desktop/gtksourceview {
-      autoreconfHook = pkgs.autoreconfHook269;
-    };
+    gtksourceview = callPackage ./desktop/gtksourceview { };
 
   }
 )
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index 30a33349e5a2..77ced255f1da 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -4,6 +4,7 @@
   fetchpatch,
   fetchurl,
   autoreconfHook,
+  gtk-doc,
   pkg-config,
   atk,
   cairo,
@@ -48,10 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
   # Fix build with gcc 14
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
-  nativeBuildInputs = [
-    pkg-config
-    intltool
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ autoreconfHook ];
+  nativeBuildInputs =
+    [
+      pkg-config
+      intltool
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      autoreconfHook
+      gtk-doc
+    ];
+
   buildInputs =
     [
       atk
@@ -68,10 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
       gtk-mac-integration-gtk2
     ];
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    intltoolize --force
-  '';
-
   doCheck = false; # requires X11 daemon
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index d025d47be128..475d61d06d0a 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -15,99 +15,91 @@
   rustc,
   auditable ? !cargo-auditable.meta.broken,
   cargo-auditable,
-  pkgsBuildBuild,
 }:
 
 rustPlatform.buildRustPackage.override
   {
     cargo-auditable = cargo-auditable.bootstrap;
   }
-  (
-    {
-      pname = "cargo";
-      inherit (rustc.unwrapped) version src;
+  {
+    pname = "cargo";
+    inherit (rustc.unwrapped) version src;
 
-      # the rust source tarball already has all the dependencies vendored, no need to fetch them again
-      cargoVendorDir = "vendor";
-      buildAndTestSubdir = "src/tools/cargo";
+    # the rust source tarball already has all the dependencies vendored, no need to fetch them again
+    cargoVendorDir = "vendor";
+    buildAndTestSubdir = "src/tools/cargo";
 
-      inherit auditable;
+    inherit auditable;
 
-      passthru = {
-        rustc = rustc;
-        inherit (rustc.unwrapped) tests;
-      };
+    passthru = {
+      rustc = rustc;
+      inherit (rustc.unwrapped) tests;
+    };
 
-      # changes hash of vendor directory otherwise
-      dontUpdateAutotoolsGnuConfigScripts = true;
+    # changes hash of vendor directory otherwise
+    dontUpdateAutotoolsGnuConfigScripts = true;
 
-      nativeBuildInputs = [
-        pkg-config
-        cmake
-        installShellFiles
-        makeWrapper
-        (lib.getDev pkgsHostHost.curl)
-        zlib
+    nativeBuildInputs = [
+      pkg-config
+      cmake
+      installShellFiles
+      makeWrapper
+      (lib.getDev pkgsHostHost.curl)
+      zlib
+    ];
+    buildInputs = [
+      file
+      curl
+      python3
+      openssl
+      zlib
+    ];
+
+    # cargo uses git-rs which is made for a version of libgit2 from recent master that
+    # is not compatible with the current version in nixpkgs.
+    #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
+
+    # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
+    RUSTC_BOOTSTRAP = 1;
+
+    postInstall = ''
+      wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
+
+      installManPage src/tools/cargo/src/etc/man/*
+
+      installShellCompletion --bash --name cargo \
+        src/tools/cargo/src/etc/cargo.bashcomp.sh
+
+      installShellCompletion --zsh src/tools/cargo/src/etc/_cargo
+    '';
+
+    checkPhase = ''
+      # Disable cross compilation tests
+      export CFG_DISABLE_CROSS_TESTS=1
+      cargo test
+    '';
+
+    # Disable check phase as there are failures (4 tests fail)
+    doCheck = false;
+
+    doInstallCheck = !stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isElf;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      ${stdenv.cc.targetPrefix}readelf -a $out/bin/.cargo-wrapped | grep -F 'Shared library: [libcurl.so'
+      runHook postInstallCheck
+    '';
+
+    meta = with lib; {
+      homepage = "https://crates.io";
+      description = "Downloads your Rust project's dependencies and builds your project";
+      mainProgram = "cargo";
+      teams = [ teams.rust ];
+      license = [
+        licenses.mit
+        licenses.asl20
       ];
-      buildInputs = [
-        file
-        curl
-        python3
-        openssl
-        zlib
-      ];
-
-      # cargo uses git-rs which is made for a version of libgit2 from recent master that
-      # is not compatible with the current version in nixpkgs.
-      #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
-
-      # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
-      RUSTC_BOOTSTRAP = 1;
-
-      postInstall = ''
-        wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
-
-        installManPage src/tools/cargo/src/etc/man/*
-
-        installShellCompletion --bash --name cargo \
-          src/tools/cargo/src/etc/cargo.bashcomp.sh
-
-        installShellCompletion --zsh src/tools/cargo/src/etc/_cargo
-      '';
-
-      checkPhase = ''
-        # Disable cross compilation tests
-        export CFG_DISABLE_CROSS_TESTS=1
-        cargo test
-      '';
-
-      # Disable check phase as there are failures (4 tests fail)
-      doCheck = false;
-
-      doInstallCheck = !stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isElf;
-      installCheckPhase = ''
-        runHook preInstallCheck
-        ${stdenv.cc.targetPrefix}readelf -a $out/bin/.cargo-wrapped | grep -F 'Shared library: [libcurl.so'
-        runHook postInstallCheck
-      '';
-
-      meta = with lib; {
-        homepage = "https://crates.io";
-        description = "Downloads your Rust project's dependencies and builds your project";
-        mainProgram = "cargo";
-        teams = [ teams.rust ];
-        license = [
-          licenses.mit
-          licenses.asl20
-        ];
-        platforms = platforms.unix;
-        # https://github.com/alexcrichton/nghttp2-rs/issues/2
-        broken = stdenv.hostPlatform.isx86 && stdenv.buildPlatform != stdenv.hostPlatform;
-      };
-    }
-    //
-      lib.optionalAttrs (stdenv.buildPlatform.rust.rustcTarget != stdenv.hostPlatform.rust.rustcTarget)
-        {
-          HOST_PKG_CONFIG_PATH = "${pkgsBuildBuild.pkg-config}/bin/pkg-config";
-        }
-  )
+      platforms = platforms.unix;
+      # https://github.com/alexcrichton/nghttp2-rs/issues/2
+      broken = stdenv.hostPlatform.isx86 && stdenv.buildPlatform != stdenv.hostPlatform;
+    };
+  }
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 22c22102815d..25d210083ec6 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "amaranth";
-  version = "0.5.6";
+  version = "0.5.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "amaranth-lang";
     repo = "amaranth";
     tag = "v${version}";
-    hash = "sha256-fc9mCq7AgxjlR/+KKebV1GGlF5NXN/1Vee5ZLwkNjow=";
+    hash = "sha256-E/PJrvBmlS39KgzDz9sArq4BXwk/JmIMtdxL7MdrWlc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/langchain-ollama/default.nix b/pkgs/development/python-modules/langchain-ollama/default.nix
index 1de471cdb87c..89feb35abbd3 100644
--- a/pkgs/development/python-modules/langchain-ollama/default.nix
+++ b/pkgs/development/python-modules/langchain-ollama/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-ollama";
-  version = "0.3.4";
+  version = "0.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-ollama==${version}";
-    hash = "sha256-biPQAYF9VfF6z0244v1+iXaqX0IAiKCuJ+XyXzxD/Jg=";
+    hash = "sha256-UmfbCctAb0D8mETICl5OJ58vghwhQKWkM1drkPt1aAg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/ollama";
diff --git a/pkgs/development/python-modules/llm-grok/default.nix b/pkgs/development/python-modules/llm-grok/default.nix
index 1e834b795deb..592a957d3768 100644
--- a/pkgs/development/python-modules/llm-grok/default.nix
+++ b/pkgs/development/python-modules/llm-grok/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "llm-grok";
-  version = "1.1.1";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Hiepler";
     repo = "llm-grok";
     tag = "v${version}";
-    hash = "sha256-Zwvf33XSoULJxJMBHftysY3RzGEQ+L46UJ0V8b/+UXQ=";
+    hash = "sha256-YSpo7dsQ0/s+sS2DXeLq7zHBdktxCr0P96vr6PtEu9o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llm-groq/default.nix b/pkgs/development/python-modules/llm-groq/default.nix
index 55364db0921b..e829f14b84fb 100644
--- a/pkgs/development/python-modules/llm-groq/default.nix
+++ b/pkgs/development/python-modules/llm-groq/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "llm-groq";
-  version = "0.8";
+  version = "0.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "angerman";
     repo = "llm-groq";
     tag = "v${version}";
-    hash = "sha256-sZ5d9w43NvypaPrebwZ5BLgRaCHAhd7gBU6uHEdUaF4=";
+    hash = "sha256-9obDB5xz/YFKdnqM/70SC4Ud1t62AsGzAkbGsZTL5Nc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llm-mistral/default.nix b/pkgs/development/python-modules/llm-mistral/default.nix
index 773868d5a875..b0b5cd1649de 100644
--- a/pkgs/development/python-modules/llm-mistral/default.nix
+++ b/pkgs/development/python-modules/llm-mistral/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "llm-mistral";
-  version = "0.14";
+  version = "0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-mistral";
     tag = version;
-    hash = "sha256-NuiqRA/SCjGq0hJsnHJ/vgdncIKu3oE9WqWGht7QRMc=";
+    hash = "sha256-4ajvsq0sm3/vdiHUuNxHsHKdX58VNNpHIwhWI0ws+08=";
   };
 
   build-system = [
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = {
     description = "LLM plugin providing access to Mistral models using the Mistral API";
     homepage = "https://github.com/simonw/llm-mistral";
-    changelog = "https://github.com/simonw/llm-mistral/releases/tag/${version}/CHANGELOG.md";
+    changelog = "https://github.com/simonw/llm-mistral/releases/tag/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ philiptaron ];
   };
diff --git a/pkgs/development/python-modules/pyqt/6.x.nix b/pkgs/development/python-modules/pyqt/6.x.nix
index 39151a7ff25a..be45d1fdff6e 100644
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@@ -19,6 +19,7 @@
   # Not currently part of PyQt6
   #, withConnectivity ? true
   withPrintSupport ? true,
+  withSerialPort ? false,
   cups,
 }:
 
@@ -103,7 +104,8 @@ buildPythonPackage rec {
     # ++ lib.optional withConnectivity qtconnectivity
     ++ lib.optional withMultimedia qtmultimedia
     ++ lib.optional withWebSockets qtwebsockets
-    ++ lib.optional withLocation qtlocation;
+    ++ lib.optional withLocation qtlocation
+    ++ lib.optional withSerialPort qtserialport;
 
   buildInputs =
     with qt6Packages;
@@ -117,7 +119,8 @@ buildPythonPackage rec {
     ]
     # ++ lib.optional withConnectivity qtconnectivity
     ++ lib.optional withWebSockets qtwebsockets
-    ++ lib.optional withLocation qtlocation;
+    ++ lib.optional withLocation qtlocation
+    ++ lib.optional withSerialPort qtserialport;
 
   propagatedBuildInputs =
     # ld: library not found for -lcups
@@ -127,6 +130,7 @@ buildPythonPackage rec {
     inherit sip pyqt6-sip;
     multimediaEnabled = withMultimedia;
     WebSocketsEnabled = withWebSockets;
+    serialPortEnabled = withSerialPort;
   };
 
   dontConfigure = true;
@@ -145,7 +149,8 @@ buildPythonPackage rec {
     ++ lib.optional withWebSockets "PyQt6.QtWebSockets"
     ++ lib.optional withMultimedia "PyQt6.QtMultimedia"
     # ++ lib.optional withConnectivity "PyQt6.QtConnectivity"
-    ++ lib.optional withLocation "PyQt6.QtPositioning";
+    ++ lib.optional withLocation "PyQt6.QtPositioning"
+    ++ lib.optional withSerialPort "PyQt6.QtSerialPort";
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-address-of-temporary";
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 3bafacbb61bc..0dbca4c2b634 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.15.6"; # zen
+      version = "6.15.7"; # zen
       suffix = "zen1"; # zen
-      sha256 = "11nfmnyyqph9d0hihss9dg96z7dgiqk3p16c2i2li6q52walbj6g"; # zen
+      sha256 = "1q68jvcghn5bw1hfnk06kh1b89mq13b84g2f0nal9i5wzrx4qxbr"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 75c17d40a0e0..d51c0bb87aed 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
       revert = true;
     })
     ./unsurprising-ext-password.patch
+    (fetchpatch {
+      name = "suppress-ctrl-event-signal-change.patch";
+      url = "https://w1.fi/cgit/hostap/patch/?id=c330b5820eefa8e703dbce7278c2a62d9c69166a";
+      hash = "sha256-5ti5OzgnZUFznjU8YH8Cfktrj4YBzsbbrEbNvec+ppQ=";
+    })
   ];
 
   # TODO: Patch epoll so that the dbus actually responds
diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index 10a61bfafa53..9a4af7542324 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -2,18 +2,18 @@
   lib,
   stdenv,
   kernel,
-  fetchFromGitLab,
+  fetchFromGitHub,
 }:
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "unstable-2025-02-28";
+  version = "unstable-2025-06-17";
 
-  src = fetchFromGitLab {
-    owner = "shdwchn10";
+  src = fetchFromGitHub {
+    owner = "AliEmreSenel";
     repo = "zenpower3";
-    rev = "138fa0637b46a0b0a087f2ba4e9146d2f9ba2475";
-    sha256 = "sha256-kLtkG97Lje+Fd5FoYf+UlSaEyxFaETtXrSjYzFnHkjY=";
+    rev = "41e042935ee9840c0b9dd55d61b6ddd58bc4fde6";
+    hash = "sha256-0U/JmEd6OJJeUm1ZLFYxpKH15n7+QTWYOgtKIFAuf/4=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 9a4e81572852..d09488f893b8 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -74,6 +74,11 @@ lib.warnIf (withDocs != null)
     patchFlags = [ "-p0" ];
 
     patches = upstreamPatches ++ [
+      # Enable PGRP_PIPE independently of the kernel of the build machine.
+      # This doesn't seem to be upstreamed despite such a mention of in https://github.com/NixOS/nixpkgs/pull/77196,
+      # which originally introduced the patch
+      # Some related discussion can be found in
+      # https://lists.gnu.org/archive/html/bug-bash/2015-05/msg00071.html
       ./pgrp-pipe-5.patch
     ];
 
diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index df47e379ee77..0467a2aae4d6 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -22,11 +22,13 @@ set -e
 
 rm -vf "$PATCH_LIST"
 
-wget "https://tiswww.case.edu/php/chet/gpgkey.asc"
-echo "4ef5051ce7200241e65d29c11eb57df8  gpgkey.asc" > gpgkey.asc.md5
-md5sum -c gpgkey.asc.md5
+# https://savannah.gnu.org/projects/bash/: Group Admins: Chet Ramey
+# https://savannah.gnu.org/users/chet: Download GPG Key
+wget "https://savannah.gnu.org/people/viewgpg.php?user_id=2590" -O gpgkey.asc
+echo "db4041b4d3896b9f21250e6c29861958bd5d4781f521f06beda849a9ed79fae8  gpgkey.asc" > gpgkey.asc.sha256
+sha256sum -c gpgkey.asc.sha256
 gpg --import ./gpgkey.asc
-rm gpgkey.asc{,.md5}
+rm gpgkey.asc{,.sha256}
 
 ( echo "# Automatically generated by \`$(basename "$0")'; do not edit." ;	\
   echo "" ;								\
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c5b09e0da473..0f4efec3312e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -208,7 +208,7 @@ let
   # Make sure that we are not shadowing something from all-packages.nix.
   checkInPkgs =
     n: alias:
-    if builtins.hasAttr n super then throw "Alias ${n} is still in all-packages.nix" else alias;
+    if builtins.hasAttr n super then abort "Alias ${n} is still in all-packages.nix" else alias;
 
   mapAliases =
     aliases: lib.mapAttrs (n: alias: removeRecurseForDerivations (checkInPkgs n alias)) aliases;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index de4e16277a87..448821390be4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -879,11 +879,18 @@ with pkgs;
     name = "set-java-classpath-hook";
   } ../build-support/setup-hooks/set-java-classpath.sh;
 
-  fixDarwinDylibNames = makeSetupHook {
-    name = "fix-darwin-dylib-names-hook";
-    substitutions = { inherit (darwin.binutils) targetPrefix; };
-    meta.platforms = lib.platforms.darwin;
-  } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
+  fixDarwinDylibNames = callPackage (
+    {
+      lib,
+      targetPackages,
+      makeSetupHook,
+    }:
+    makeSetupHook {
+      name = "fix-darwin-dylib-names-hook";
+      substitutions = { inherit (targetPackages.stdenv.cc) targetPrefix; };
+      meta.platforms = lib.platforms.darwin;
+    } ../build-support/setup-hooks/fix-darwin-dylib-names.sh
+  ) { };
 
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
 
@@ -16124,7 +16131,15 @@ with pkgs;
           };
     };
 
-  nixosOptionsDoc = attrs: (import ../../nixos/lib/make-options-doc) ({ inherit pkgs lib; } // attrs);
+  nixosOptionsDoc =
+    attrs:
+    (import ../../nixos/lib/make-options-doc) (
+      {
+        pkgs = pkgs.__splicedPackages;
+        inherit lib;
+      }
+      // attrs
+    );
 
   nix-eval-jobs = callPackage ../tools/package-management/nix-eval-jobs {
     nix = nixVersions.nix_2_29;