diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 838764147658..2dd29d642e5f 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -75,6 +75,8 @@
 
 - [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).
 
+- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
+
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
 - [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index ca4148d81ba8..15059df3f23d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1610,6 +1610,7 @@
   ./services/web-apps/pretix.nix
   ./services/web-apps/privatebin.nix
   ./services/web-apps/prosody-filer.nix
+  ./services/web-apps/reposilite.nix
   ./services/web-apps/rimgo.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix
diff --git a/nixos/modules/services/security/cfssl.nix b/nixos/modules/services/security/cfssl.nix
index 2d0465d6a0b8..514442dbe437 100644
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@@ -164,6 +164,12 @@ in
       ];
       description = "Log level (0 = DEBUG, 5 = FATAL).";
     };
+
+    disable = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.commas;
+      description = "Endpoints to disable (comma-separated list)";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -218,6 +224,7 @@ in
               (opt "tls-remote-ca" tlsRemoteCa)
               (opt "db-config" dbConfig)
               (opt "loglevel" (toString logLevel))
+              (opt "disable" disable)
             ];
         }
         (lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
diff --git a/nixos/modules/services/web-apps/reposilite.nix b/nixos/modules/services/web-apps/reposilite.nix
new file mode 100644
index 000000000000..ac9c9937bcfa
--- /dev/null
+++ b/nixos/modules/services/web-apps/reposilite.nix
@@ -0,0 +1,439 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.reposilite;
+  format = pkgs.formats.cdn { };
+  configFile = format.generate "reposilite.cdn" cfg.settings;
+
+  useEmbeddedDb = cfg.database.type == "sqlite" || cfg.database.type == "h2";
+  useMySQL = cfg.database.type == "mariadb" || cfg.database.type == "mysql";
+  usePostgres = cfg.database.type == "postgresql";
+
+  # db password is appended at runtime by the service script (if needed)
+  dbString =
+    if useEmbeddedDb then
+      "${cfg.database.type} ${cfg.database.path}"
+    else
+      "${cfg.database.type} ${cfg.database.host}:${builtins.toString cfg.database.port} ${cfg.database.dbname} ${cfg.database.user} $(<${cfg.database.passwordFile})";
+
+  certDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
+
+  databaseModule = {
+    options = {
+      type = lib.mkOption {
+        type = lib.types.enum [
+          "h2"
+          "mariadb"
+          "mysql"
+          "postgresql"
+          "sqlite"
+        ];
+        description = ''
+          Database engine to use.
+        '';
+        default = "sqlite";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Path to the embedded database file. Set to `--temporary` to use an in-memory database.
+        '';
+        default = "reposilite.db";
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database host address.
+        '';
+        default = "127.0.0.1";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = ''
+          Database TCP port.
+        '';
+        defaultText = lib.literalExpression ''
+          if type == "postgresql" then 5432 else 3306
+        '';
+        default = if usePostgres then config.services.postgresql.settings.port else 3306;
+      };
+
+      dbname = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database name.
+        '';
+        default = "reposilite";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database user.
+        '';
+        default = "reposilite";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        description = ''
+          Path to the file containing the password for the database connection.
+          This file must be readable by {option}`services.reposilite.user`.
+        '';
+        default = null;
+      };
+    };
+  };
+
+  settingsModule = {
+    freeformType = format.type;
+    options = {
+      hostname = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The hostname to bind to. Set to `0.0.0.0` to accept connections from everywhere, or `127.0.0.1` to restrict to localhost."
+        '';
+        default = "0.0.0.0";
+        example = "127.0.0.1";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = ''
+          The TCP port to bind to.
+        '';
+        default = 3000;
+      };
+
+      database = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Database connection string. Please use {option}`services.reposilite.database` instead.
+          See https://reposilite.com/guide/general#local-configuration for valid values.
+        '';
+        default = null;
+      };
+
+      sslEnabled = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to listen for encrypted connections on {option}`settings.sslPort`.
+        '';
+        default = false;
+      };
+
+      sslPort = lib.mkOption {
+        type = lib.types.port; # cant be null
+        description = "SSL port to bind to. SSL needs to be enabled explicitly via {option}`settings.enableSsl`.";
+        default = 443;
+      };
+
+      keyPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example).
+          You can use `''${WORKING_DIRECTORY}` to refer to paths relative to Reposilite's working directory.
+          If you are using a Java KeyStore, don't forget to specify the password via the {var}`REPOSILITE_LOCAL_KEYPASSWORD` environment variable.
+          See https://reposilite.com/guide/ssl for more information on how to set SSL up.
+        '';
+        default = null;
+        example = "\${WORKING_DIRECTORY}/cert.pem \${WORKING_DIRECTORY}/key.pem";
+      };
+
+      keyPassword = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Plaintext password used to unlock the Java KeyStore set in {option}`services.reposilite.settings.keyPath`.
+          WARNING: this option is insecure and should not be used to store the password.
+          Consider using {option}`services.reposilite.keyPasswordFile` instead.
+        '';
+        default = null;
+      };
+
+      enforceSsl = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to redirect all traffic to SSL.
+        '';
+        default = false;
+      };
+
+      webThreadPool = lib.mkOption {
+        type = lib.types.ints.between 5 65535;
+        description = ''
+          Maximum amount of threads used by the core thread pool. (min: 5)
+          The web thread pool handles the first few steps of incoming HTTP connections, tasks are redirected as soon as possible to the IO thread pool.
+        '';
+        default = 16;
+      };
+
+      ioThreadPool = lib.mkOption {
+        type = lib.types.ints.between 2 65535;
+        description = ''
+          The IO thread pool handles all tasks that may benefit from non-blocking IO. (min: 2)
+          Because most tasks are redirected to IO thread pool, it might be a good idea to keep it at least equal to web thread pool.
+        '';
+        default = 8;
+      };
+
+      databaseThreadPool = lib.mkOption {
+        type = lib.types.ints.positive;
+        description = ''
+          Maximum amount of concurrent connections to the database. (one per thread)
+          Embedded databases (sqlite, h2) do not support truly concurrent connections, so the value will always be `1` if they are used.
+        '';
+        default = 1;
+      };
+
+      compressionStrategy = lib.mkOption {
+        type = lib.types.enum [
+          "none"
+          "gzip"
+        ];
+        description = ''
+          Compression algorithm used by this instance of Reposilite.
+          `none` reduces usage of CPU & memory, but requires transfering more data.
+        '';
+        default = "none";
+      };
+
+      idleTimeout = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        description = ''
+          Default idle timeout used by Jetty.
+        '';
+        default = 30000;
+      };
+
+      bypassExternalCache = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Add cache bypass headers to responses from /api/* to avoid issues with proxies such as Cloudflare.
+        '';
+        default = true;
+      };
+
+      cachedLogSize = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        description = ''
+          Amount of messages stored in the cache logger.
+        '';
+        default = 50;
+      };
+
+      defaultFrontend = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable the default included frontend with a dashboard.
+        '';
+        default = true;
+      };
+
+      basePath = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Custom base path for this Reposilite instance.
+          It is not recommended changing this, you should instead prioritize using a different subdomain.
+        '';
+        default = "/";
+      };
+
+      debugEnabled = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable debug mode.
+        '';
+        default = false;
+      };
+    };
+  };
+in
+{
+  options.services.reposilite = {
+    enable = lib.mkEnableOption "Reposilite";
+    package = lib.mkPackageOption pkgs "reposilite" { } // {
+      apply =
+        pkg:
+        pkg.override (old: {
+          plugins = (old.plugins or [ ]) ++ cfg.plugins;
+        });
+    };
+
+    plugins = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      description = ''
+        List of plugins to add to Reposilite.
+      '';
+      default = [ ];
+      example = "with reposilitePlugins; [ checksum groovy ]";
+    };
+
+    database = lib.mkOption {
+      description = "Database options.";
+      default = { };
+      type = lib.types.submodule databaseModule;
+    };
+
+    keyPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      description = ''
+        Path the the file containing the password used to unlock the Java KeyStore file specified in {option}`services.reposilite.settings.keyPath`.
+        This file must be readable my {option}`services.reposilite.user`.
+      '';
+      default = null;
+    };
+
+    useACMEHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Host of an existing Let's Encrypt certificate to use for SSL.
+        Make sure that the certificate directory is readable by the `reposilite` user or group, for example via {option}`security.acme.certs.<cert>.group`.
+        *Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using {option}`security.acme.certs`*
+      '';
+      default = null;
+    };
+
+    settings = lib.mkOption {
+      description = "Configuration written to the reposilite.cdn file";
+      default = { };
+      type = lib.types.submodule settingsModule;
+    };
+
+    workingDirectory = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Working directory for Reposilite.
+      '';
+      default = "/var/lib/reposilite";
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra arguments/parameters passed to the Reposilite. Can be used for first token generation.
+      '';
+      default = [ ];
+      example = lib.literalExpression ''[ "--token" "name:tempsecrettoken" ]'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The user to run Reposilite under.
+      '';
+      default = "reposilite";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The group to run Reposilite under.
+      '';
+      default = "reposilite";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Whether to open the firewall ports for Reposilite. If SSL is enabled, its port will be opened too.
+      '';
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings.sslEnabled -> cfg.settings.keyPath != null;
+        message = ''
+          Reposilite was configured to enable SSL, but no valid paths to certificate files were provided via `settings.keyPath`.
+          Read more about SSL certificates here: https://reposilite.com/guide/ssl
+        '';
+      }
+      {
+        assertion = cfg.settings.enforceSsl -> cfg.settings.sslEnabled;
+        message = "You cannot enforce SSL if SSL is not enabled.";
+      }
+      {
+        assertion = !useEmbeddedDb -> cfg.database.passwordFile != null;
+        message = "You need to set `services.reposilite.database.passwordFile` when using MySQL or Postgres.";
+      }
+    ];
+
+    services.reposilite.settings.keyPath = lib.mkIf (
+      cfg.useACMEHost != null
+    ) "${certDir}/fullchain.pem ${certDir}/key.pem";
+
+    environment.systemPackages = [ cfg.package ];
+
+    users = {
+      groups.${cfg.group} = lib.mkIf (cfg.group == "reposilite") { };
+      users.${cfg.user} = lib.mkIf (cfg.user == "reposilite") {
+        isSystemUser = true;
+        group = cfg.group;
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall (
+      lib.mkMerge [
+        {
+          allowedTCPPorts = [ cfg.settings.port ];
+        }
+        (lib.mkIf cfg.settings.sslEnabled {
+          allowedTCPPorts = [ cfg.settings.sslPort ];
+        })
+      ]
+    );
+
+    systemd.services.reposilite = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+      after =
+        [ "network.target" ]
+        ++ (lib.optional useMySQL "mysql.service")
+        ++ (lib.optional usePostgres "postgresql.service");
+
+      script =
+        lib.optionalString (cfg.keyPasswordFile != null && cfg.settings.keyPassword == null) ''
+          export REPOSILITE_LOCAL_KEYPASSWORD="$(<${cfg.keyPasswordFile})"
+        ''
+        + ''
+          export REPOSILITE_LOCAL_DATABASE="${dbString}"
+
+          ${lib.getExe cfg.package} --local-configuration ${configFile} --local-configuration-mode none --working-directory ${cfg.workingDirectory} ${lib.escapeShellArgs cfg.extraArgs}
+        '';
+
+      serviceConfig = lib.mkMerge [
+        (lib.mkIf (builtins.dirOf cfg.workingDirectory == "/var/lib") {
+          StateDirectory = builtins.baseNameOf cfg.workingDirectory;
+          StateDirectoryMode = "700";
+        })
+        {
+          Type = "exec";
+          Restart = "on-failure";
+
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.workingDirectory;
+
+          # TODO better hardening
+          LimitNOFILE = "1048576";
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHome = true;
+          ProtectSystem = "strict";
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.uku3lig ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 282235a2ffaf..5700ded7ed86 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1148,6 +1148,7 @@ in
   redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
   renovate = handleTest ./renovate.nix { };
   replace-dependencies = handleTest ./replace-dependencies { };
+  reposilite = runTest ./reposilite.nix;
   restartByActivationScript = handleTest ./restart-by-activation-script.nix { };
   restic-rest-server = handleTest ./restic-rest-server.nix { };
   restic = handleTest ./restic.nix { };
diff --git a/nixos/tests/envfs.nix b/nixos/tests/envfs.nix
index 9e728698ebc3..b9067467eb2b 100644
--- a/nixos/tests/envfs.nix
+++ b/nixos/tests/envfs.nix
@@ -25,8 +25,6 @@ import ./make-test-python.nix (
           "PATH= /usr/bin/env --version",
           "PATH= test -e /usr/bin/sh",
           "PATH= test -e /usr/bin/env",
-          # no stat
-          "! test -e /usr/bin/cp",
           # also picks up PATH that was set after execve
           "! /usr/bin/hello",
           "PATH=${pkgs.hello}/bin /usr/bin/hello",
diff --git a/nixos/tests/reposilite.nix b/nixos/tests/reposilite.nix
new file mode 100644
index 000000000000..f66a95b47a1d
--- /dev/null
+++ b/nixos/tests/reposilite.nix
@@ -0,0 +1,53 @@
+{ lib, ... }:
+{
+  name = "reposilite";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services = {
+          mysql = {
+            enable = true;
+            package = pkgs.mariadb;
+            ensureDatabases = [ "reposilite" ];
+            initialScript = pkgs.writeText "reposilite-test-db-init" ''
+              CREATE USER 'reposilite'@'localhost' IDENTIFIED BY 'ReposiliteDBPass';
+              GRANT ALL PRIVILEGES ON reposilite.* TO 'reposilite'@'localhost';
+              FLUSH PRIVILEGES;
+            '';
+          };
+
+          reposilite = {
+            enable = true;
+            plugins = with pkgs.reposilitePlugins; [
+              checksum
+              groovy
+            ];
+            extraArgs = [
+              "--token"
+              "test:SuperSecretTestToken"
+            ];
+            database = {
+              type = "mariadb";
+              passwordFile = "/run/reposiliteDbPass";
+            };
+            settings.port = 8080;
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.execute("echo \"ReposiliteDBPass\" > /run/reposiliteDbPass && chmod 600 /run/reposiliteDbPass && chown reposilite:reposilite /run/reposiliteDbPass")
+    machine.wait_for_unit("reposilite.service")
+    machine.wait_for_open_port(8080)
+
+    machine.fail("curl -Sf localhost:8080/api/auth/me")
+    machine.succeed("curl -Sfu test:SuperSecretTestToken localhost:8080/api/auth/me")
+  '';
+
+  meta.maintainers = [ lib.maintainers.uku3lig ];
+}
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index eee2d7f1b2dd..8e42515a0320 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "calf";
-  version = "0.90.4";
+  version = "0.90.6";
 
   src = fetchFromGitHub {
     owner = "calf-studio-gear";
     repo = "calf";
     tag = version;
-    hash = "sha256-E9H2YG1HAhIN+zJxDKIJTkJapbNz8h9dfd5YfZp9Zp0=";
+    hash = "sha256-rcMuQFig6BrnyGFyvYaAHmOvabEHGl+1lMNfffLHn1w=";
   };
 
   outputs = [
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 8e3053497b05..57651d9773d2 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -82,9 +82,9 @@ let
         pname
         jdk
         extraWrapperArgs
-        extraLdPath
         extraBuildInputs
         ;
+      extraLdPath = extraLdPath ++ lib.optionals (stdenv.hostPlatform.isLinux) [ libGL ];
       src =
         if fromSource then
           communitySources."${pname}"
@@ -336,7 +336,6 @@ rec {
         libICE
         libSM
         libX11
-        libGL
       ];
     }).overrideAttrs
       (attrs: {
@@ -378,7 +377,6 @@ rec {
           libxcrypt-legacy
           fontconfig
           xorg.libX11
-          libGL
         ]
         ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
           expat
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index 53fa19ff4df0..c9911c347d1b 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2025-03-07";
+  version = "0-unstable-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "9f2b7943db1fb784daf0948b0b493bc7f76919f8";
-    hash = "sha256-fwrfZ0Z/DAtDRuBqxCS11/qNoomAtUgEOf4eOLk9vO0=";
+    rev = "4ee33ff536f14295c178a037f9b5d5a960ce3c6f";
+    hash = "sha256-ZL+aV469RHp5SSBFmK0q+1h2MdcM1q+TZu5Rrv/N0DU=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/bsnes.nix b/pkgs/applications/emulators/libretro/cores/bsnes.nix
index 539bcef66f52..07f1f03b2148 100644
--- a/pkgs/applications/emulators/libretro/cores/bsnes.nix
+++ b/pkgs/applications/emulators/libretro/cores/bsnes.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2025-03-07";
+  version = "0-unstable-2025-04-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "ec353ea2502be9b71f3d9830b7a7b66ee69e254c";
-    hash = "sha256-9QRKEIi1JHd503KN9+DKxLMJMJWyNu9vomPAmlbb/zw=";
+    rev = "8d89089d35bedc257dc13bebd3790f70417311a5";
+    hash = "sha256-0n2N2Ks8MIy7dcuj2SESjDNxma7RRhAgOxQ5sC3XJTM=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003.nix b/pkgs/applications/emulators/libretro/cores/mame2003.nix
index ddc92524eeac..6a21b1681378 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-04-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "8565eec2e963b78f07a5a1f4b74df1271f3ece13";
-    hash = "sha256-pChPUwKIOtP4nl9ReqlrgxOJ/qcO6m2SnHhx3Y+hktM=";
+    rev = "a0547e84a8f58856551ca2d252f05f56212810a4";
+    hash = "sha256-POpKNpPOyOp/EkrUTa2esOJAaWoJvuijDToF6/V41uU=";
   };
 
   # Fix build with GCC 14
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index f107b64f8d5d..445e0cea6ca3 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-03-30";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "4b0894f55fb7244b522fb720f41363e86f2085fe";
-    hash = "sha256-748TR87fO1BLBWwDAJxkEBr327g64RUTdBvvMu6lSEI=";
+    rev = "6091efb4d64ed745495455ba82352ec82f55cb4f";
+    hash = "sha256-9FyD3a6FE7xtt/UGvRNfopvQPgAg/0QGrJ1NNMEIsyg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/emulators/libretro/cores/picodrive.nix b/pkgs/applications/emulators/libretro/cores/picodrive.nix
index f7a8e3bc1bc9..04843e9eee1d 100644
--- a/pkgs/applications/emulators/libretro/cores/picodrive.nix
+++ b/pkgs/applications/emulators/libretro/cores/picodrive.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "picodrive";
-  version = "0-unstable-2025-03-25";
+  version = "0-unstable-2025-04-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "picodrive";
-    rev = "752c266491ae8775dab9a98dbd94472f42b9b16f";
-    hash = "sha256-l9qYOUyQzyleWeQv74rEOEwOk6iyH43WVIUHcC6Aw2Y=";
+    rev = "1a08d73159820bb31941d8c5ed6242a74bd4b332";
+    hash = "sha256-849XeceXoPHpOMlxVtHgL2TYQTHibUbGs0oHBEiCzvw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index a0dd0c6399db..98861e57c740 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-03-25";
+  version = "0-unstable-2025-04-04";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "01d094c0c3ed723b0747079afddfd319001f01d4";
-    hash = "sha256-o8tfYg88spRZBDokc/dkRsVvvfGejYVnDQfvQ1BBRps=";
+    rev = "225e37d0dc7b8a7bb6dc3534b992373477f9923d";
+    hash = "sha256-bY4RwJyS4R/vjae2UCi4SnIW04IzoQyMOYsW4f+UQg8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/scummvm.nix b/pkgs/applications/emulators/libretro/cores/scummvm.nix
index 7e545bb3c28a..13082d102542 100644
--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@@ -25,13 +25,13 @@ let
 in
 mkLibretroCore {
   core = "scummvm";
-  version = "0-unstable-2025-03-09";
+  version = "0-unstable-2025-04-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "scummvm";
-    rev = "8e9d265d81661dcffe0bc326e07e50af5d1d224a";
-    hash = "sha256-BdBQoj358uL7VNPZozRA4oEG5KS09rkucd80vQgkaDo=";
+    rev = "9d31b31c179fd4a43f7cfc383a3435a9070c6aa8";
+    hash = "sha256-E5e30Iowwr8pnryncnzlPjBhpIEuKqAHxHk+HwagEnE=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 853dea8f22e6..31a67dd3c413 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -115,9 +115,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.4";
+    version = "10.5";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-oJAZzlxCuga6kexCPUnY8qmo6sTBqSMMc+HRGWOdXpI=";
+    hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -163,7 +163,7 @@ rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-LteUANxr+w1N9r6LNztjRfr3yXtJnUMi0uayTRtFoSU=";
+    hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/misc/plover/default.nix b/pkgs/applications/misc/plover/default.nix
index 24c14969970f..89c32a27b7ce 100644
--- a/pkgs/applications/misc/plover/default.nix
+++ b/pkgs/applications/misc/plover/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  config,
   fetchFromGitHub,
   python3Packages,
   wmctrl,
@@ -8,8 +9,6 @@
 }:
 
 {
-  stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
-
   dev =
     with python3Packages;
     mkDerivationWith buildPythonPackage rec {
@@ -58,3 +57,6 @@
       '';
     };
 }
+// lib.optionalAttrs config.allowAliases {
+  stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
+}
diff --git a/pkgs/by-name/al/alive2/package.nix b/pkgs/by-name/al/alive2/package.nix
index e69c134d4d1e..89a3587a85b8 100644
--- a/pkgs/by-name/al/alive2/package.nix
+++ b/pkgs/by-name/al/alive2/package.nix
@@ -24,17 +24,19 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    ninja
+    re2c
   ];
   buildInputs = [
-    re2c
     z3
     hiredis
     llvm_18
-    ninja
   ];
+  strictDeps = true;
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
+      --replace-fail '-Werror' "" \
       --replace-fail 'find_package(Git REQUIRED)' ""
   '';
 
diff --git a/pkgs/by-name/an/anyrun/package.nix b/pkgs/by-name/an/anyrun/package.nix
index c9c9e269833d..9b22ba61467a 100644
--- a/pkgs/by-name/an/anyrun/package.nix
+++ b/pkgs/by-name/an/anyrun/package.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "anyrun";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-04-04";
 
   src = fetchFromGitHub {
     owner = "kirottu";
     repo = "anyrun";
-    rev = "06017e753c8886d5296768dca80745ee09402a2d";
-    hash = "sha256-jU88Q9tP4vuvWYGQcmOdFwI9e2uMPVYJHbXdiklIH9o=";
+    rev = "786f539d69d5abcefa68978dbaa964ac14536a00";
+    hash = "sha256-f+oXT9b3xuBDmm4v4nDqJvlHabxxZRB6+pay4Ub/NvA=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/ap/appflowy/package.nix b/pkgs/by-name/ap/appflowy/package.nix
index d7f316ea540f..003fbcd80ef4 100644
--- a/pkgs/by-name/ap/appflowy/package.nix
+++ b/pkgs/by-name/ap/appflowy/package.nix
@@ -17,11 +17,11 @@ let
     rec {
       x86_64-linux = {
         urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-e0G7J2BRRC+2MMqpvu5BNnimS7RRTjRBgo/j1T9iYWU=";
+        hash = "sha256-WUAyGx7RcLlQsYpfcbV69k1ESaif5VraxUFAslMi5lo=";
       };
       x86_64-darwin = {
         urlSuffix = "macos-universal.zip";
-        hash = "sha256-A9BCdYxeWPjCOZ/L0wYTVuqybLHfc1vsWWxAY7IJohw=";
+        hash = "sha256-fB6DCp2+7T9ozHuMdsv6IwwIyD6+t7LxVWMj9lDJ5Fw=";
       };
       aarch64-darwin = x86_64-darwin;
     }
@@ -30,7 +30,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "appflowy";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
diff --git a/pkgs/by-name/ba/backgroundremover/package.nix b/pkgs/by-name/ba/backgroundremover/package.nix
index 1b963d940c7d..37dbc1ff7f45 100644
--- a/pkgs/by-name/ba/backgroundremover/package.nix
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@@ -11,7 +11,7 @@ let
   p = python3.pkgs;
   self = p.buildPythonApplication rec {
     pname = "backgroundremover";
-    version = "0.2.9";
+    version = "0.3.0";
     pyproject = true;
 
     build-system = [
@@ -22,7 +22,7 @@ let
       owner = "nadermx";
       repo = "backgroundremover";
       rev = "v${version}";
-      hash = "sha256-tQ8J3xamOzPPSbFMxIDYKv1TzK1AVwF/DWXdZlrlYvM=";
+      hash = "sha256-fWazMDjc+EoXvO7Iq+zwtJaMEU64ajpO6JtlvU5T0nc=";
     };
 
     models = runCommand "background-remover-models" { } ''
diff --git a/pkgs/by-name/bi/bird2/package.nix b/pkgs/by-name/bi/bird2/package.nix
index 5d28f0add04c..c7e50d9e75a5 100644
--- a/pkgs/by-name/bi/bird2/package.nix
+++ b/pkgs/by-name/bi/bird2/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bird";
-  version = "2.16.1";
+  version = "2.17";
 
   src = fetchurl {
     url = "https://bird.network.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-9uWcvMrKYmaK6gIGhyS9QnuexEnH4PD8VoFQOYjHNbQ=";
+    hash = "sha256-ebvMd8Y+nht6EKSDichvT3WwU/097Ejjxsvg3xuoHrM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index d5236efdea77..6c6f6ba67283 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "4.12.2";
+  version = "4.12.4";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     tag = "v${version}";
-    hash = "sha256-/OdSV/wTrs6roiPiSQCqCLrlWtkB11gm3DM7r7B4HUU=";
+    hash = "sha256-tg2ICxliTmahO3twKgC4LSVyiX9K2jfA7lCcSCkzcbQ=";
   };
 
   nativeBuildInputs =
@@ -28,7 +28,7 @@ buildNpmPackage rec {
       copyDesktopItems
     ];
 
-  npmDepsHash = "sha256-ZM3hFMHuKl5BW1+10czESDknc9jIZ024mUSUdNHF3EM=";
+  npmDepsHash = "sha256-a5OjCVHPeaBEYTFIUOnc9We677oCGwAvwMv8f1QRk9Q=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
@@ -66,7 +66,7 @@ buildNpmPackage rec {
 
       for size in 16 32 48 64 128 256 512; do
         mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-        magick convert -resize "$size"x"$size" icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
+        magick icon.png -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
       done
 
       makeWrapper ${lib.getExe electron} $out/bin/blockbench \
diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix
index 2481b5a236b7..6d9dbaf03da9 100644
--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@@ -9,20 +9,20 @@
 }:
 
 let
-  version = "2025.1.5";
+  version = "2025.2.3";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-QTYeiM2hyZpvSu5oE2wrNrF3qFkp4JJnQftOg3BJqZA=";
+        hash = "sha256-eVtqlZHW1w10tUKlqdwFSbx2kJW5hEtfyq7MuBsNS4Q=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-vIcBRsylS+ftSq5x0HDe6Zb8dtVUtWw6hENBITYmzyQ=";
+        hash = "sha256-XWAaNAdPVxKS7/9uYWpAdbzHt+xNqpKCIOH7dVcUyaI=";
       };
 
   src = fetchurl {
@@ -109,6 +109,7 @@ buildFHSEnv {
     hydraPlatforms = [ ];
     maintainers = with maintainers; [
       bennofs
+      blackzeshi
       fab
     ];
     mainProgram = "burpsuite";
diff --git a/pkgs/tools/misc/chafa/default.nix b/pkgs/by-name/ch/chafa/package.nix
similarity index 99%
rename from pkgs/tools/misc/chafa/default.nix
rename to pkgs/by-name/ch/chafa/package.nix
index 490d1a7049d9..ef46ea903727 100644
--- a/pkgs/tools/misc/chafa/default.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@@ -16,7 +16,6 @@
   docbook_xml_dtd_412,
   docbook_xsl,
   glib,
-  Foundation,
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/misc/chafa/xmlcatalog_patch.patch b/pkgs/by-name/ch/chafa/xmlcatalog_patch.patch
similarity index 100%
rename from pkgs/tools/misc/chafa/xmlcatalog_patch.patch
rename to pkgs/by-name/ch/chafa/xmlcatalog_patch.patch
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 56560fe90f17..fa3dbcc79939 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.62"
+        "@anthropic-ai/claude-code": "^0.2.65"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.62",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.62.tgz",
-      "integrity": "sha512-Mod9/kbqKy344lm5YmDJLn8dR3HYlA2zGCQy4exU7hmECNqg3KlTAz8u4O4YdiRMxXeUJ3Izi9YSJUT7oZOKdg==",
+      "version": "0.2.65",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.65.tgz",
+      "integrity": "sha512-LCxFb/WeHoHfVhQfEQGbGlFURYCm5Brcff4GHD+lVX2N3GtexLTcf0iXElAYz3S2vlWX9km8nGVfB/Yd/ieVUw==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index d7dc872039d9..e6a2c8022be6 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.62";
+  version = "0.2.65";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-O6jkpx3OxEh/npZjyJb+osoeJrG+HZ6NRB9T4EMkdf8=";
+    hash = "sha256-4YFdDEpKi7agSqJUetcItqElec5VD0uQARwDSsh1S8o=";
   };
 
-  npmDepsHash = "sha256-tVA4VbPaPc+KwZzUK0QI9In3QSXXoELaNM2U65wxGGA=";
+  npmDepsHash = "sha256-157BP/8DfEBE2dhOYj3CGzlV7M2EE44L0Zr0qwAQoQw=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
@@ -24,8 +24,7 @@ buildNpmPackage rec {
   AUTHORIZED = "1";
 
   # `claude-code` tries to auto-update by default, this disables that functionality.
-  # Note that the `DISABLE_AUTOUPDATER` environment variable is not documented, so this trick may
-  # not continue to work.
+  # https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview#environment-variables
   postInstall = ''
     wrapProgram $out/bin/claude \
       --set DISABLE_AUTOUPDATER 1
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index 61fe82b61528..240931718aab 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -1,72 +1,64 @@
 {
   lib,
   stdenv,
-  stdenvAdapters,
   fetchFromGitHub,
   rustPlatform,
   libcosmicAppHook,
   just,
   nasm,
   nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
 
-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-bg";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-bg";
+  version = "1.0.0-alpha.6";
 
-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-bg";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-bg";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
+  };
 
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-GLXooTjcGq4MsBNnlpHBBUJGNs5UjKMQJGJuj9UO2wk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-GLXooTjcGq4MsBNnlpHBBUJGNs5UjKMQJGJuj9UO2wk=";
 
-    nativeBuildInputs = [
-      just
-      libcosmicAppHook
-      nasm
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+    nasm
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
     ];
+  };
 
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-bg";
+    description = "Applies Background for the COSMIC Desktop Environment";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
     ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-bg";
-      description = "Applies Background for the COSMIC Desktop Environment";
-      license = lib.licenses.mpl20;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-      mainProgram = "cosmic-bg";
-    };
-  })
+    platforms = lib.platforms.linux;
+    mainProgram = "cosmic-bg";
+  };
+})
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index fba267328761..ac55e2b38390 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -1,70 +1,64 @@
 {
   lib,
   stdenv,
-  stdenvAdapters,
   fetchFromGitHub,
   rustPlatform,
   just,
   libcosmicAppHook,
   nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
 
-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-launcher";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-launcher";
+  version = "1.0.0-alpha.6";
 
-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-launcher";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-launcher";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
+  };
 
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";
 
-    nativeBuildInputs = [
-      just
-      libcosmicAppHook
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-launcher"
+  ];
+
+  env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" = "--cfg tokio_unstable";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
     ];
+  };
 
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-launcher"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-launcher";
+    description = "Launcher for the COSMIC Desktop Environment";
+    mainProgram = "cosmic-launcher";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
     ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      "--cfg tokio_unstable${lib.optionalString withMoldLinker " -C link-arg=-fuse-ld=mold"}";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-launcher";
-      description = "Launcher for the COSMIC Desktop Environment";
-      mainProgram = "cosmic-launcher";
-      license = lib.licenses.gpl3Only;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-    };
-  })
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index e8115fad0f15..34444fe33e2c 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -1,73 +1,65 @@
 {
   lib,
   stdenv,
-  stdenvAdapters,
   fetchFromGitHub,
   rustPlatform,
   just,
   pkg-config,
   wayland,
   nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
 
-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-randr";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-randr";
+  version = "1.0.0-alpha.6";
 
-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-randr";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-randr";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
+  };
 
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
 
-    nativeBuildInputs = [
-      just
-      pkg-config
+  nativeBuildInputs = [
+    just
+    pkg-config
+  ];
+
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
     ];
+  };
 
-    buildInputs = [ wayland ];
-
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-randr";
+    description = "Library and utility for displaying and configuring Wayland outputs";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
     ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-randr";
-      description = "Library and utility for displaying and configuring Wayland outputs";
-      license = lib.licenses.mpl20;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-      mainProgram = "cosmic-randr";
-    };
-  })
+    platforms = lib.platforms.linux;
+    mainProgram = "cosmic-randr";
+  };
+})
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 3cac2e12b85f..7305976a50ee 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  stdenvAdapters,
   fetchFromGitHub,
   rustPlatform,
   cmake,
@@ -19,90 +18,83 @@
   cosmic-randr,
   xkeyboard_config,
   nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
 let
   libcosmicAppHook' = (libcosmicAppHook.__spliced.buildHost or libcosmicAppHook).override {
     includeSettings = false;
   };
 in
-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-settings";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-settings";
+  version = "1.0.0-alpha.6";
 
-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-settings";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-settings";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
+  };
 
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
 
-    nativeBuildInputs = [
-      cmake
-      just
-      libcosmicAppHook'
-      pkg-config
-      rustPlatform.bindgenHook
-      util-linux
+  nativeBuildInputs = [
+    cmake
+    just
+    libcosmicAppHook'
+    pkg-config
+    rustPlatform.bindgenHook
+    util-linux
+  ];
+
+  buildInputs = [
+    expat
+    fontconfig
+    freetype
+    libinput
+    pipewire
+    pulseaudio
+    udev
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
+  ];
+
+  preFixup = ''
+    libcosmicAppWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
+      --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
+      --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
+    )
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
     ];
+  };
 
-    buildInputs = [
-      expat
-      fontconfig
-      freetype
-      libinput
-      pipewire
-      pulseaudio
-      udev
+  meta = {
+    description = "Settings for the COSMIC Desktop Environment";
+    homepage = "https://github.com/pop-os/cosmic-settings";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "cosmic-settings";
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
     ];
-
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
-    ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    preFixup = ''
-      libcosmicAppWrapperArgs+=(
-        --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
-        --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
-        --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
-      )
-    '';
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      description = "Settings for the COSMIC Desktop Environment";
-      homepage = "https://github.com/pop-os/cosmic-settings";
-      license = lib.licenses.gpl3Only;
-      mainProgram = "cosmic-settings";
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-    };
-  })
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index fac1601d14d8..d2c418761f1b 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -17,7 +17,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.0.1";
+  version = "25.0.2";
 
   src =
     let
@@ -30,10 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-p4bVQxP5dazNPSGJN6tu2rsowLf5VPJN30W+q8HiUNM=";
-        aarch64-linux = "sha256-3vrJOqC5szOWcj/oDg3uc1BND5vfbMRR+MNTDcG4vk8=";
-        x86_64-darwin = "sha256-bu67Tz8awAQ69inY2s330g2qPan2tRLWImeYx9HB3tU=";
-        aarch64-darwin = "sha256-3TnswzRm3l7egoZttaOBSfO0aGasD56dOndMZ0howDI=";
+        x86_64-linux = "sha256-UmTy4Flxz/zIh3cLxRi7EhNDf0Ojc7fuzCbRKIE/+CQ=";
+        aarch64-linux = "sha256-I+V/2kfdxGx8zNkH98b2685IQPbVPSe9++qS4QEg0LU=";
+        x86_64-darwin = "sha256-8Qf69OHXPiqdMs//f1jbKbyKoll+oX+P+l3mpdOvraI=";
+        aarch64-darwin = "sha256-bGxn8y9hvJyqj1/i5tScufO5/ZjdlOlPChmeL+DWwoY=";
       };
     in
     fetchurl {
@@ -89,10 +89,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           }"
 
         mkdir -p $out/share/icons/hicolor/256x256/apps
-        # for some reason it's missing from the aarch64 build
-        if [ -e $out/opt/dbeaver/dbeaver.png ]; then
-          ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png
-        fi
+        ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png
 
         mkdir -p $out/share/applications
         ln -s $out/opt/dbeaver/dbeaver-ce.desktop $out/share/applications/dbeaver.desktop
diff --git a/pkgs/by-name/dp/dprint/plugins/default.nix b/pkgs/by-name/dp/dprint/plugins/default.nix
index cefe95973b8d..0c0d2ab0b492 100644
--- a/pkgs/by-name/dp/dprint/plugins/default.nix
+++ b/pkgs/by-name/dp/dprint/plugins/default.nix
@@ -13,7 +13,12 @@ let
       maintainers ? [ lib.maintainers.phanirithvij ],
     }:
     fetchurl {
-      inherit hash url;
+      inherit
+        hash
+        url
+        pname
+        version
+        ;
       name = "${pname}-${version}.wasm";
       meta = {
         inherit
diff --git a/pkgs/by-name/ej/ejabberd/package.nix b/pkgs/by-name/ej/ejabberd/package.nix
index de16727c3bf6..6e6e0668064b 100644
--- a/pkgs/by-name/ej/ejabberd/package.nix
+++ b/pkgs/by-name/ej/ejabberd/package.nix
@@ -53,21 +53,21 @@ let
 
   provider_asn1 = buildRebar3 {
     name = "provider_asn1";
-    version = "0.3.0";
+    version = "0.4.1";
     src = fetchHex {
       pkg = "provider_asn1";
-      version = "0.3.0";
-      sha256 = "sha256-MuelWYZi01rBut8jM6a5alMZizPGZoBE/LveSRu/+wU=";
+      version = "0.4.1";
+      sha256 = "sha256-HqR6IyJyJinvbPJJlhJE14yEiBbNmTGOmR0hqonrOR0=";
     };
     beamDeps = [ ];
   };
   rebar3_hex = buildRebar3 {
     name = "rebar3_hex";
-    version = "7.0.7";
+    version = "7.0.8";
     src = fetchHex {
       pkg = "rebar3_hex";
-      version = "7.0.7";
-      sha256 = "sha256-1S2igSwiInATUgULZ1E6e2dK6YI5gvRffHRfF1Gg5Ok=";
+      version = "7.0.8";
+      sha256 = "sha256-aEY0EEZwRHp6AAuE1pSfm5RjBjU+PaaJuKp7fvXRiBc=";
     };
     beamDeps = [ ];
   };
@@ -141,7 +141,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ejabberd";
-  version = "24.12";
+  version = "25.03";
 
   nativeBuildInputs = [
     makeWrapper
@@ -170,17 +170,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "processone";
     repo = "ejabberd";
     tag = finalAttrs.version;
-    hash = "sha256-9TyIgsinUpUbirwqg61EYnPB/OyE5vhl3MBMRihqAtE=";
+    hash = "sha256-VEH1V8v2wQ9qf6Xcj00xHw30tWo0s9AhPyoB7d5B8k8=";
   };
 
-  patches = [
-    # Fix json_encode_with_kv_list used in mod_matrix_gw
-    (fetchpatch2 {
-      url = "https://github.com/processone/ejabberd/commit/056635119c8b9f169f1c59cccbf81faab88a6712.patch?full_index=1";
-      hash = "sha256-53NMT/SwPtaeo8zaJ1JHW6HUZrxkITi731UOdsFAlJ4=";
-    })
-  ];
-
   passthru.tests = {
     inherit (nixosTests) ejabberd;
   };
diff --git a/pkgs/by-name/ej/ejabberd/rebar-deps.nix b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
index 4fd3e6740b74..bd5b79474028 100644
--- a/pkgs/by-name/ej/ejabberd/rebar-deps.nix
+++ b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
@@ -44,21 +44,21 @@ let
     };
     yconf = builder {
       name = "yconf";
-      version = "1.0.17";
+      version = "1.0.18";
       src = fetchHex {
         pkg = "yconf";
-        version = "1.0.17";
-        sha256 = "sha256-3SiSkjJBRJpGzIRXuewPsUAwcAc1pYhZVWd8c1w0GiU=";
+        version = "1.0.18";
+        sha256 = "sha256-+pUOxlA/ktZBf7jMHZgkA/BBaX6OG79NRYj7kZuVYuo=";
       };
       beamDeps = [ fast_yaml ];
     };
     xmpp = builder {
       name = "xmpp";
-      version = "1.9.1";
+      version = "1.10.0";
       src = fetchHex {
         pkg = "xmpp";
-        version = "1.9.1";
-        sha256 = "sha256-0rFDGvbkwaTIv5DK8MwRzesEe4MjuH6dfkgm1JEyddw=";
+        version = "1.10.0";
+        sha256 = "sha256-zurkO4/pdknY+FRrP38rOOz8kxwM3Vx0Rf+z+A/LfYU=";
       };
       beamDeps = [
         ezlib
@@ -71,11 +71,11 @@ let
     };
     stun = builder {
       name = "stun";
-      version = "1.2.15";
+      version = "1.2.17";
       src = fetchHex {
         pkg = "stun";
-        version = "1.2.15";
-        sha256 = "sha256-9tilQaKf0T8s5li2dsDMZhJiuW4EW1Le8WRLdevA7e8=";
+        version = "1.2.17";
+        sha256 = "sha256-azGCRMIehSSpquOsmgXNgjTumUwcLIFd5o0wYIatdo0=";
       };
       beamDeps = [
         fast_tls
@@ -84,11 +84,11 @@ let
     };
     stringprep = builder {
       name = "stringprep";
-      version = "1.0.30";
+      version = "1.0.31";
       src = fetchHex {
         pkg = "stringprep";
-        version = "1.0.30";
-        sha256 = "sha256-9vybM4SgOHeDD4my84WAyvP0onRIpKMz1qjDl1wiC5o=";
+        version = "1.0.31";
+        sha256 = "sha256-6WmciOjbFrOkHw5FrGh0pNqBpuSFSnfXbt5tCbCONTA=";
       };
       beamDeps = [ p1_utils ];
     };
@@ -117,18 +117,18 @@ let
       version = "1.0.26";
       src = fetchHex {
         pkg = "p1_utils";
-        version = "1.0.26";
-        sha256 = "sha256-0DeejBFWuYvWT4Epwd4CL8yk8v23SGznO/DtLDN2sEw=";
+        version = "1.0.27";
+        sha256 = "sha256-8a+UKwpivPoNWfvjBnm+T/614kGgxJ7V8JTbL1uA9eA=";
       };
       beamDeps = [ ];
     };
     p1_pgsql = builder {
       name = "p1_pgsql";
-      version = "1.1.29";
+      version = "1.1.32";
       src = fetchHex {
         pkg = "p1_pgsql";
-        version = "1.1.29";
-        sha256 = "sha256-pv9Y6LF0mT84ldo+piEan50MVNGm4ouzIdo7PNaLOME=";
+        version = "1.1.32";
+        sha256 = "sha256-JosB6PTrdcIRoxSVolwoFcVJrszi8N8aFhxuCizeBh4=";
       };
       beamDeps = [ xmpp ];
     };
@@ -144,11 +144,11 @@ let
     };
     p1_mysql = builder {
       name = "p1_mysql";
-      version = "1.0.25";
+      version = "1.0.26";
       src = fetchHex {
         pkg = "p1_mysql";
-        version = "1.0.25";
-        sha256 = "sha256-5hh/+ulbcmCY6I8+5vI0SsJZziwm4O5AOwX+7zQa5DQ=";
+        version = "1.0.26";
+        sha256 = "sha256-6hOAg/LFRxm5z1Sdv1gCooiwAZ6j5USbNUx0zAP6/ew=";
       };
       beamDeps = [ ];
     };
@@ -250,11 +250,11 @@ let
     };
     esip = builder {
       name = "esip";
-      version = "1.0.56";
+      version = "1.0.57";
       src = fetchHex {
         pkg = "esip";
-        version = "1.0.56";
-        sha256 = "sha256-nvNmDO+TtiP3No3NXHn05wQ1hjGQnm3UZOM1N4gV2h8=";
+        version = "1.0.57";
+        sha256 = "sha256-GcNX4YF7HgR5LvNZv5AEAPPm0OWt6Sn9cviOqbRK8u0=";
       };
       beamDeps = [
         fast_tls
@@ -284,11 +284,11 @@ let
     };
     eimp = builder {
       name = "eimp";
-      version = "1.0.23";
+      version = "1.0.24";
       src = fetchHex {
         pkg = "eimp";
-        version = "1.0.23";
-        sha256 = "sha256-kHx4ACPLKJPk/Evb5qTwLDVZE4Yqxn8OzCZgXoFrYoo=";
+        version = "1.0.24";
+        sha256 = "sha256-fWFDLrikVlnAvkdfROde62UXQ6pkod6K33hc2tgZYa0=";
       };
       beamDeps = [ p1_utils ];
     };
diff --git a/pkgs/by-name/en/envfs/package.nix b/pkgs/by-name/en/envfs/package.nix
index 6dd4a3472547..3c7b57002fb4 100644
--- a/pkgs/by-name/en/envfs/package.nix
+++ b/pkgs/by-name/en/envfs/package.nix
@@ -1,34 +1,42 @@
 {
-  rustPlatform,
   lib,
   fetchFromGitHub,
+  rustPlatform,
   nixosTests,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "envfs";
-  version = "1.0.6";
+  version = "1.1.0";
+
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "envfs";
-    rev = version;
-    hash = "sha256-kOfnKguvJQHW/AfQOetxVefjoEj7ec5ew6fumhOwP08=";
+    rev = finalAttrs.version;
+    hash = "sha256-bpATdm/lB+zomPYGCxA7omWK/SKPIaqr94J+fjMaXfE=";
   };
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-VvdvYxNBzwJJy09npC30VaOzOU9Fwi++qon9Od4juHE=";
 
-  passthru.tests = {
-    envfs = nixosTests.envfs;
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nMUdAFRHJZDwvLASBVykzzkwk3HxslDehqqm1U99qYg=";
 
   postInstall = ''
     ln -s envfs $out/bin/mount.envfs
     ln -s envfs $out/bin/mount.fuse.envfs
   '';
-  meta = with lib; {
+
+  passthru = {
+    tests = {
+      envfs = nixosTests.envfs;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Fuse filesystem that returns symlinks to executables based on the PATH of the requesting process";
     homepage = "https://github.com/Mic92/envfs";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mic92 ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index 84383c352580..4e9b416979d9 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -146,7 +146,6 @@ buildGoModule rec {
     maintainers = with maintainers; [
       azahi
       flokli
-      emilylange
       hbjydev
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/he/heynote/package.nix b/pkgs/by-name/he/heynote/package.nix
index ed160a6a1823..3859f013e290 100644
--- a/pkgs/by-name/he/heynote/package.nix
+++ b/pkgs/by-name/he/heynote/package.nix
@@ -7,11 +7,11 @@
 }:
 let
   pname = "heynote";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchurl {
     url = "https://github.com/heyman/heynote/releases/download/v${version}/Heynote_${version}_x86_64.AppImage";
-    sha256 = "sha256-O8loDE2GzXQofh3iNQeP5OAWh7i0QCSxl4I++ERcjbU=";
+    sha256 = "sha256-nei4akpXA5MWpQSL/oIcwfNILTKE3lwSi1ij68FMMtQ=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index ca3ad3eb69a6..165d09db6700 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -21,7 +21,7 @@
 }:
 
 let
-  version = "3.6.11";
+  version = "3.6.12";
   icon = fetchurl {
     url = "https://github.com/huanghongxun/HMCL/raw/release-${version}/HMCLauncher/HMCL/HMCL.ico";
     hash = "sha256-+EYL33VAzKHOMp9iXoJaSGZfv+ymDDYIx6i/1o47Dmc=";
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/huanghongxun/HMCL/releases/download/release-${version}/HMCL-${version}.jar";
-    hash = "sha256-ZQNJm7xbOdVSnxtx4krOnM9QBsxibFXo8wx1fCn1gJA=";
+    hash = "sha256-ofrG7CVZIODJoHE6owR9P7viBlChamYF5PEpFeeOH4E=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
index 5634f03dfb79..2320b53976cf 100644
--- a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
+++ b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
@@ -12,21 +12,20 @@ Signed-off-by: Christoph Heiss <christoph@c8h4.io>
  3 files changed, 41 insertions(+), 16 deletions(-)
  create mode 100644 patches/sass-embedded.patch
 
-diff --git a/package.json b/package.json
-index 87e57b9..723e0b6 100644
---- a/package.json
-+++ b/package.json
-@@ -28,5 +28,10 @@
-     "vite-plugin-pwa": "^0.21.1"
-   },
+diff --git i/package.json w/package.json
+index 897b42e..7a91a85 100644
+--- i/package.json
++++ w/package.json
+@@ -32,6 +32,9 @@
    "license": "Apache-2.0",
--  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0"
-+  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0",
-+  "pnpm": {
+   "packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af",
+   "pnpm": {
+-    "neverBuiltDependencies": []
++    "neverBuiltDependencies": [],
 +    "patchedDependencies": {
 +      "sass-embedded": "patches/sass-embedded.patch"
 +    }
-+  }
+   }
  }
 diff --git a/patches/sass-embedded.patch b/patches/sass-embedded.patch
 new file mode 100644
@@ -49,10 +48,10 @@ index 0000000..f941a8e
 +     const platform = process.platform === 'linux' && isLinuxMusl(process.execPath)
 +         ? 'linux-musl'
 +         : process.platform;
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index f347757..d054bea 100644
---- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
+diff --git i/pnpm-lock.yaml w/pnpm-lock.yaml
+index 5df58fb..bb27c4b 100644
+--- i/pnpm-lock.yaml
++++ w/pnpm-lock.yaml
 @@ -4,6 +4,11 @@ settings:
    autoInstallPeers: true
    excludeLinksFromLockfile: false
@@ -65,80 +64,79 @@ index f347757..d054bea 100644
  importers:
 
    .:
-@@ -26,7 +31,7 @@ importers:
-     devDependencies:
+@@ -29,7 +34,7 @@ importers:
+         version: 9.21.0
        '@vitejs/plugin-vue':
          specifier: ^5.2.1
--        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
-+        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
+-        version: 5.2.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)
++        version: 5.2.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)
        '@vue/eslint-config-prettier':
          specifier: ^10.2.0
-         version: 10.2.0(eslint@9.19.0)(prettier@3.4.2)
-@@ -44,13 +49,13 @@ importers:
-         version: 3.4.2
+         version: 10.2.0(eslint@9.21.0)(prettier@3.5.2)
+@@ -50,13 +55,13 @@ importers:
+         version: 3.5.2
        sass-embedded:
-         specifier: ^1.83.4
--        version: 1.83.4
-+        version: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+         specifier: ^1.85.0
+-        version: 1.85.0
++        version: 1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
        vite:
-         specifier: ^6.0.11
--        version: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+        version: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
+         specifier: ^6.1.3
+-        version: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
++        version: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
        vite-plugin-pwa:
          specifier: ^0.21.1
--        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
-+        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+-        version: 0.21.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0)
++        version: 0.21.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0)
 
  packages:
 
-@@ -3683,9 +3688,9 @@ snapshots:
+@@ -3477,9 +3482,9 @@ snapshots:
 
    '@types/trusted-types@2.0.7': {}
 
--  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
-+  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
+-  '@vitejs/plugin-vue@5.2.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)':
++  '@vitejs/plugin-vue@5.2.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)':
      dependencies:
--      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
+-      vite: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
++      vite: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
        vue: 3.5.13
 
    '@vue/compiler-core@3.5.13':
-@@ -4965,7 +4970,7 @@ snapshots:
-   sass-embedded-win32-x64@1.83.4:
+@@ -4702,7 +4707,7 @@ snapshots:
+   sass-embedded-win32-x64@1.85.0:
      optional: true
 
--  sass-embedded@1.83.4:
-+  sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
+-  sass-embedded@1.85.0:
++  sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
      dependencies:
-       '@bufbuild/protobuf': 2.2.0
+       '@bufbuild/protobuf': 2.2.3
        buffer-builder: 0.2.0
-@@ -5286,18 +5291,18 @@ snapshots:
+@@ -5001,25 +5006,25 @@ snapshots:
 
    varint@6.0.0: {}
 
--  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
-+  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+-  vite-plugin-pwa@0.21.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0):
++  vite-plugin-pwa@0.21.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0):
      dependencies:
-       debug: 4.3.7
+       debug: 4.4.0
        pretty-bytes: 6.1.1
-       tinyglobby: 0.2.10
--      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-       workbox-build: 7.1.0
-       workbox-window: 7.1.0
+       tinyglobby: 0.2.12
+-      vite: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
++      vite: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
+       workbox-build: 7.3.0
+       workbox-window: 7.3.0
      transitivePeerDependencies:
        - supports-color
 
--  vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
-+  vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
+-  vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0):
++  vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0):
      dependencies:
        esbuild: 0.24.2
-       postcss: 8.5.1
-@@ -5305,7 +5310,7 @@ snapshots:
+       postcss: 8.5.3
+       rollup: 4.38.0
      optionalDependencies:
        fsevents: 2.3.3
-       sass: 1.79.5
--      sass-embedded: 1.83.4
-+      sass-embedded: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
-       terser: 5.37.0
+-      sass-embedded: 1.85.0
++      sass-embedded: 1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       terser: 5.39.0
        yaml: 2.7.0
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index eaad9c42bd8f..0579e37fbd94 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "homer";
-  version = "25.02.1";
+  version = "25.04.1";
   src = fetchFromGitHub {
     owner = "bastienwirtz";
     repo = "homer";
     rev = "v${version}";
-    hash = "sha256-Fh6qV2eU7VRskbPun7OcJmqgjILVE8w5lV70xH6znmc=";
+    hash = "sha256-hvDrFGv6Mht9whA2lJbDLQnP2LkOiCo3NtjMpWr/q6A=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       src
       patches
       ;
-    hash = "sha256-qeMmPI2B5FW82qLVtbREDjQh76THMCOZRQCM0DgvCqI=";
+    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
diff --git a/pkgs/by-name/ho/hours/package.nix b/pkgs/by-name/ho/hours/package.nix
new file mode 100644
index 000000000000..48c2ab726889
--- /dev/null
+++ b/pkgs/by-name/ho/hours/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  stdenv,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "hours";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "dhth";
+    repo = "hours";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B9M02THTCrr7ylbbflpkpTFMuoIwV2O0PQKOKbyxYPg=";
+  };
+
+  vendorHash = "sha256-5lhn0iTLmXUsaedvtyaL3qWLosmQaQVq5StMDl7pXXI=";
+
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "No-frills time tracking toolkit for command line nerds";
+    homepage = "https://github.com/dhth/hours";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ilarvne ];
+    platforms = lib.platforms.unix;
+    mainProgram = "hours";
+  };
+})
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index 4159f9ab4552..74d105fafb7c 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -28,13 +28,13 @@
 
 gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-U+8HOPgfrNkFEadoyB9GXSPPFW/Uytvb3TxyqW3JOw4=";
+    hash = "sha256-KTRgq+0rMBz31AAjrDvQprPHbVobCwIo9+gkcUujglw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index a818df4cdef6..9591ae16b4d0 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EV3945SnjOCuRVbGRghsWx/9D89FyshnSO1Q6/TuQ14=";
+    hash = "sha256-/6IAEWyb8gC/NKZElxiHChkouiUOrVYNq9YqG0Pzm4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/kc/kclvm/package.nix b/pkgs/by-name/kc/kclvm/package.nix
index aaa3a3cca342..7c33e7e0b9eb 100644
--- a/pkgs/by-name/kc/kclvm/package.nix
+++ b/pkgs/by-name/kc/kclvm/package.nix
@@ -10,19 +10,19 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "kclvm";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "kcl";
     rev = "v${version}";
-    hash = "sha256-OMPo2cT0ngwHuGghVSfGoDgf+FThj2GsZ3Myb1wSxQM=";
+    hash = "sha256-14yFGa8y8w3wbCmx0JOSN0TShXLZZpTdVynEfUKkjuE=";
   };
 
   sourceRoot = "${src.name}/kclvm";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xQgCiNt0lUvB5XmVB45l0GuIiVp5Jm6dZY7396Rsnqw=";
+  cargoHash = "sha256-o7YFyqRWAMjq23mcAqDrcN4infdBgp1KNvviYOLR35s=";
 
   buildInputs =
     [ rustc ]
diff --git a/pkgs/by-name/li/libphidget22/package.nix b/pkgs/by-name/li/libphidget22/package.nix
index f3fa7d72f1c6..8f38eaf8847e 100644
--- a/pkgs/by-name/li/libphidget22/package.nix
+++ b/pkgs/by-name/li/libphidget22/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   # This package should be updated together with libphidget22extra
-  version = "1.21.20241122";
+  version = "1.22.20250324";
 in
 stdenv.mkDerivation {
   pname = "libphidget22";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22/libphidget22-${version}.tar.gz";
-    hash = "sha256-6Sib9CSaPUbAdyHfoSgQ6g4oik7+pjb7g79QftSeVIk=";
+    hash = "sha256-FR/+b4z73LtGQdT4gypre9SZmZSiWzP/Q+00uia1lhA=";
   };
 
   nativeBuildInputs = [ automake ];
diff --git a/pkgs/by-name/li/libphidget22extra/package.nix b/pkgs/by-name/li/libphidget22extra/package.nix
index 1072b798b42f..ffe239d5570e 100644
--- a/pkgs/by-name/li/libphidget22extra/package.nix
+++ b/pkgs/by-name/li/libphidget22extra/package.nix
@@ -9,7 +9,7 @@
 let
 
   # This package should be updated together with libphidget22
-  version = "1.21.20241122";
+  version = "1.22.20250324";
 in
 stdenv.mkDerivation {
   pname = "libphidget22extra";
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22extra/libphidget22extra-${version}.tar.gz";
-    hash = "sha256-l8lwEpdR87U2pb0jOAkrI/157B+87QvSVtAtOfedaBo=";
+    hash = "sha256-8FTd/hyqzZKWN68FAxrV1N0pPglNAbZ/aRH4V6hEgBM=";
   };
 
   nativeBuildInputs = [ automake ];
diff --git a/pkgs/by-name/mq/mqttui/package.nix b/pkgs/by-name/mq/mqttui/package.nix
index da132595b4cb..01d4cddc5bbc 100644
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mqttui";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "EdJoPaTo";
     repo = "mqttui";
     tag = "v${version}";
-    hash = "sha256-q4C4YAs8Q1jHA5P2OApkFZnYM4/aZGxnE8Pd6Hmwd1I=";
+    hash = "sha256-wKqIDKng4pfqDuYtqFRh3UIeZQ4QzzFlLkQn5MXcVlU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pn4wmlMW8p6IAHrYjmvmZxNMjIJwJ2MYRsANz4D6xCU=";
+  cargoHash = "sha256-gk5nA6np7dK4+j26aySNWfMZ9t/+7nZRaPsnhlDEnes=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
 
diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix
index a421c33c44d7..d0b543fa0a37 100644
--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@@ -46,11 +46,15 @@ stdenv.mkDerivation rec {
     "info"
   ];
 
-  configureFlags = [
-    "--sysconfdir=/etc"
-    (lib.enableFeature enableNls "nls")
-    (lib.enableFeature enableTiny "tiny")
-  ];
+  configureFlags =
+    [
+      "--sysconfdir=/etc"
+      (lib.enableFeature enableNls "nls")
+      (lib.enableFeature enableTiny "tiny")
+    ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      "gl_cv_func_strcasecmp_works=yes"
+    ];
 
   postInstall =
     if enableTiny then
@@ -61,6 +65,7 @@ stdenv.mkDerivation rec {
       '';
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index df52ee807ec8..535e7be2055e 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-ZSmyhNbZotNiqoXl4E+Pjap5zewPlwcTlPihcm4v6Qs=";
+    hash = "sha256-p3coR11+1xFQF3flIxfEP6HqQOD7+gHuT0ysOSKQyzc=";
   };
 
-  vendorHash = "sha256-tTFEDTUM3ldH3/NtqYx4LyEazp7o5qZ6ionu01Vxwrw=";
+  vendorHash = "sha256-cT8ZDp1GSdlgMr0i23i2WAVRmSbhwZZa/RKNPezr9l0=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
diff --git a/pkgs/by-name/op/openct/package.nix b/pkgs/by-name/op/openct/package.nix
index 2b25bf2614c5..62c2f5ed9e40 100644
--- a/pkgs/by-name/op/openct/package.nix
+++ b/pkgs/by-name/op/openct/package.nix
@@ -3,28 +3,34 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
-  pkg-config,
-  pcsclite,
-  libusb-compat-0_1,
   doxygen,
   libxslt,
+  pkg-config,
+  pcsclite,
+  libtool,
+  libusb-compat-0_1,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openct";
   version = "0.6.20";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "openct";
-    rev = "${pname}-${version}";
-    sha256 = "09wxq0jxdxhci3zr7jd3zcxjkl3j0r1v00k3q8gqrg9gighh8nk2";
+    rev = "openct-${finalAttrs.version}";
+    hash = "sha256-YloE4YsvvYwfwmMCsEMGctApO/ujyZP/iAz21iXAnSc=";
   };
 
   postPatch = ''
-    sed -i 's,$(DESTDIR),$(out),g' etc/Makefile.am
+    substituteInPlace etc/Makefile.am \
+      --replace-fail "DESTDIR" "out"
   '';
 
+  # unbreak build on GCC 14, remove when https://github.com/OpenSC/openct/pull/12
+  # (or equivalent) is merged and released
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   configureFlags = [
     "--enable-api-doc"
     "--enable-usb"
@@ -35,24 +41,29 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
+    doxygen
+    libxslt # xsltproc
     pkg-config
   ];
+
   buildInputs = [
     pcsclite
+    libtool # libltdl
     libusb-compat-0_1
-    doxygen
-    libxslt
   ];
 
+  strictDeps = true;
+
   preInstall = ''
     mkdir -p $out/etc
   '';
 
-  meta = with lib; {
-    broken = stdenv.hostPlatform.isDarwin;
+  meta = {
     homepage = "https://github.com/OpenSC/openct/";
-    license = licenses.lgpl21;
     description = "Drivers for several smart card readers";
-    platforms = platforms.all;
+    license = lib.licenses.lgpl21;
+    maintainers = [ ];
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})
diff --git a/pkgs/by-name/os/osm2pgsql/package.nix b/pkgs/by-name/os/osm2pgsql/package.nix
index d4fbb130bea9..ddf69d31d81c 100644
--- a/pkgs/by-name/os/osm2pgsql/package.nix
+++ b/pkgs/by-name/os/osm2pgsql/package.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osm2pgsql";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "osm2pgsql-dev";
     repo = "osm2pgsql";
     rev = finalAttrs.version;
-    hash = "sha256-+EFvYloLm/cDOflqj6ZIgjFoljKhYBVIKxD8L9j2Hj4=";
+    hash = "sha256-YKlw/YIRogu0AbkRA3kZ4j4tbbVYbgVcLVYifYarmjE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/os/osv-scanner/package.nix b/pkgs/by-name/os/osv-scanner/package.nix
index 717b0871ea86..df28d244f0fc 100644
--- a/pkgs/by-name/os/osv-scanner/package.nix
+++ b/pkgs/by-name/os/osv-scanner/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "osv-scanner";
     tag = "v${version}";
-    hash = "sha256-iYbCCGZDTUbyW1XvQIpLZEtuzwUhTBAf3EfAwRX9qYU=";
+    hash = "sha256-jE1nzpUpt2WbaG6MQfji8k5qML7bi9mGSVFzQM3+DKQ=";
   };
 
-  vendorHash = "sha256-saD4RehZrKSC5V3A5r5prlq+080BFbhEp1Jo1rCbSHI=";
+  vendorHash = "sha256-E5u4BmsB/jSsGehtNFJEMja9T5YYKDqgwT7askcaAjA=";
 
   subPackages = [
     "cmd/osv-scanner"
diff --git a/pkgs/by-name/pi/picolibc/package.nix b/pkgs/by-name/pi/picolibc/package.nix
new file mode 100644
index 000000000000..afc7a140b819
--- /dev/null
+++ b/pkgs/by-name/pi/picolibc/package.nix
@@ -0,0 +1,226 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  meson,
+  ninja,
+  nix-update-script,
+  pkgsCross,
+
+  # General Build Options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L40-L57
+  multilib ? true,
+  sanitize-bounds ? false,
+  sanitize-trap-on-error ? false,
+  profile ? false,
+  analyzer ? false,
+  assert-verbose ? true,
+  fast-strcmp ? true,
+
+  # Testing options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L75
+  picolib ? stdenv.hostPlatform.isNone,
+  semihost ? stdenv.hostPlatform.isNone,
+
+  # Stdio Options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L114
+  tinystdio ? true,
+  io-c99-formats ? true,
+  io-long-long ? false,
+  io-pos-args ? false,
+  io-long-double ? false,
+
+  # Tinystdio options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L129
+  io-float-exact ? true,
+  atomic-ungetc ? true,
+  posix-console ? !stdenv.hostPlatform.isNone,
+  format-default ? "double",
+  printf-aliases ? true,
+  io-percent-b ? false,
+  printf-small-ultoa ? true,
+  printf-percent-n ? false,
+  minimal-io-long-long ? false,
+  fast-bufio ? false,
+  io-wchar ? false,
+
+  # Internaltionalization options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L181
+  mb-capable ? false,
+  mb-extended-charsets ? false,
+  mb-ucs-charsets ? "auto",
+  mb-iso-charsets ? "auto",
+  mb-jis-charsets ? "auto",
+  mb-windows-charsets ? "auto",
+
+  # Startup/shutdown options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L198
+  picocrt ? stdenv.hostPlatform.isNone,
+  picocrt-enable-mmu ? true,
+  picocrt-lib ? true,
+  picoexit ? true,
+  initfini-array ? true,
+  crt-runtime-size ? false,
+
+  # Legacy (non-picoexit) startup/shutdown options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L217
+  newlib-atexit-dynamic-alloc ? false,
+  newlib-global-atexit ? !stdenv.hostPlatform.isNone,
+  newlib-register-fini ? false,
+
+  # Malloc options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L228
+  newlib-nano-malloc ? true,
+  nano-malloc-clear-freed ? false,
+
+  # Locking options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L237
+  single-thread ? false,
+
+  # TLS storage options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L244
+  thread-local-storage ? "picolibc",
+  tls-model ? if stdenv.hostPlatform.isNone then "local-exec" else "global-dynamic",
+  newlib-global-errno ? false,
+  errno-function ? if stdenv.hostPlatform.isNone then "false" else "auto",
+  tls-rp2040 ? false,
+
+  # Math options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L261
+  want-math-errno ? false,
+}:
+let
+  inherit (lib.strings) mesonBool mesonOption;
+
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "picolibc";
+  version = "1.8.9";
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "picolibc";
+    repo = finalAttrs.pname;
+    tag = finalAttrs.version;
+    hash = "sha256-W1zK9mLMfi5pbOpbSLxiB2qKdiyNjOSQu96NM94/fcY=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  # Default values taken from
+  # Build fails without using them.
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/doc/os.md?plain=1#L183
+  mesonFlags =
+    [
+      (mesonBool "multilib" multilib)
+      (mesonBool "sanitize-bounds" sanitize-bounds)
+      (mesonBool "sanitize-trap-on-error" sanitize-trap-on-error)
+      (mesonBool "profile" profile)
+      (mesonBool "analyzer" analyzer)
+      (mesonBool "assert-verbose" assert-verbose)
+      (mesonBool "fast-strcmp" fast-strcmp)
+
+      # Testing options
+      (mesonBool "picolib" picolib)
+      (mesonBool "semihost" semihost)
+      (mesonBool "use-stdlib" true)
+
+      # Install options
+      (mesonOption "specsdir" "${placeholder "dev"}/lib")
+
+      (mesonBool "tinystdio" tinystdio)
+      (mesonBool "io-c99-formats" io-c99-formats)
+      (mesonBool "io-long-long" io-long-long)
+      (mesonBool "io-pos-args" io-pos-args)
+      (mesonBool "io-long-double" io-long-double)
+
+      (mesonBool "io-float-exact" io-float-exact)
+      (mesonBool "atomic-ungetc" atomic-ungetc)
+      (mesonBool "posix-console" posix-console)
+      (mesonOption "format-default" format-default)
+      (mesonBool "printf-aliases" printf-aliases)
+      (mesonBool "io-percent-b" io-percent-b)
+      (mesonBool "printf-small-ultoa" printf-small-ultoa)
+      (mesonBool "printf-percent-n" printf-percent-n)
+      (mesonBool "minimal-io-long-long" minimal-io-long-long)
+      (mesonBool "fast-bufio" fast-bufio)
+      (mesonBool "io-wchar" io-wchar)
+
+      (mesonBool "mb-capable" mb-capable)
+      (mesonBool "mb-extended-charsets" mb-extended-charsets)
+      (mesonOption "mb-ucs-charsets" mb-ucs-charsets)
+      (mesonOption "mb-iso-charsets" mb-iso-charsets)
+      (mesonOption "mb-jis-charsets" mb-jis-charsets)
+      (mesonOption "mb-windows-charsets" mb-windows-charsets)
+
+      (mesonBool "picocrt" picocrt)
+      (mesonBool "picocrt-enable-mmu" picocrt-enable-mmu)
+      (mesonBool "picocrt-lib" picocrt-lib)
+      (mesonBool "picoexit" picoexit)
+      (mesonBool "newlib-initfini-array" initfini-array)
+      (mesonBool "crt-runtime-size" crt-runtime-size)
+
+      (mesonBool "newlib-atexit-dynamic-alloc" newlib-atexit-dynamic-alloc)
+      (mesonBool "newlib-global-atexit" newlib-global-atexit)
+      (mesonBool "newlib-register-fini" newlib-register-fini)
+
+      (mesonBool "newlib-nano-malloc" newlib-nano-malloc)
+      (mesonBool "nano-malloc-clear-freed" nano-malloc-clear-freed)
+
+      (mesonBool "newlib-multithread" (!single-thread))
+
+      (mesonOption "thread-local-storage" thread-local-storage)
+      (mesonOption "tls-model" tls-model)
+      (mesonBool "newlib-global-errno" newlib-global-errno)
+      (mesonOption "errno-function" errno-function)
+      (mesonBool "tls-rp2040" tls-rp2040)
+
+      (mesonBool "want-math-errno" want-math-errno)
+    ]
+    ++ lib.optionals finalAttrs.doCheck [
+      (mesonBool "tests" true)
+      # Something is broken with this and I'm not sure what.
+      (mesonOption "tests-cdefs" "false")
+    ];
+
+  doCheck = canExecute;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      arm = pkgsCross.arm-embedded.picolibc;
+    };
+  };
+
+  meta =
+    let
+      inherit (lib) licenses maintainers;
+    in
+    {
+      description = "C library designed for embedded 32- and 64- bit systems";
+      longDescription = ''
+        Picolibc is library offering standard C library APIs that targets
+        small embedded systems with limited RAM. Picolibc was formed by blending
+        code from [Newlib](http://sourceware.org/newlib/) and
+        [AVR Libc](https://www.nongnu.org/avr-libc/).
+      '';
+      homepage = "https://keithp.com/picolibc/";
+      changelog = "https://github.com/picolibc/picolibc/releases/tag/${finalAttrs.version}";
+      license = [
+        licenses.bsd2
+        licenses.bsd3
+      ];
+      maintainers = [ maintainers.RossSmyth ];
+      # https://github.com/picolibc/picolibc/tree/db4d0fe5952d5ecd714781e3212d4086d970735a?tab=readme-ov-file#supported-architectures
+      platforms = lib.platforms.all;
+    };
+})
diff --git a/pkgs/by-name/pr/primecount/package.nix b/pkgs/by-name/pr/primecount/package.nix
index f8a402931699..9e2ae25a3244 100644
--- a/pkgs/by-name/pr/primecount/package.nix
+++ b/pkgs/by-name/pr/primecount/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primecount";
-  version = "7.15";
+  version = "7.16";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primecount";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UE+BEYynZGMBi3hjNX51I9cD/I1bbmfj9bO9r8UwwD0=";
+    hash = "sha256-wmq2AmpmDNJE7AEbn+sFbmLYR/ewdVQeEyWkmq16U9o=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ps/ps3-disc-dumper/package.nix b/pkgs/by-name/ps/ps3-disc-dumper/package.nix
index 7d90e7ad1549..59553b16acda 100644
--- a/pkgs/by-name/ps/ps3-disc-dumper/package.nix
+++ b/pkgs/by-name/ps/ps3-disc-dumper/package.nix
@@ -27,12 +27,6 @@ buildDotnetModule rec {
   projectFile = "UI.Avalonia/UI.Avalonia.csproj";
   nugetDeps = ./deps.json;
 
-  preConfigureNuGet = ''
-    # This should really be in the upstream nuget.config
-    dotnet nuget add source https://api.nuget.org/v3/index.json \
-      -n nuget.org --configfile nuget.config
-  '';
-
   runtimeDeps = [
     zlib
     openssl
diff --git a/pkgs/by-name/qu/quesoglc/package.nix b/pkgs/by-name/qu/quesoglc/package.nix
index ff38dc30757a..caf85dd1e926 100644
--- a/pkgs/by-name/qu/quesoglc/package.nix
+++ b/pkgs/by-name/qu/quesoglc/package.nix
@@ -10,13 +10,15 @@
   fribidi,
   libX11,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "quesoglc";
   version = "0.7.2";
+
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0cf9ljdzii5d4i2m23gdmf3kn521ljcldzq69lsdywjid3pg5zjl";
+    url = "mirror://sourceforge/quesoglc/quesoglc-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-VP7y7mhRct80TQb/RpmkQRQ7h6vtDVFFJK3E+JukyTE=";
   };
+
   buildInputs = [
     libGLU
     libGL
@@ -26,8 +28,18 @@ stdenv.mkDerivation rec {
     fribidi
     libX11
   ];
+
+  # required for cross builds
+  configureFlags = [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+    "ac_cv_func_memcmp_working=yes"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   # FIXME: Configure fails to use system glew.
-  meta = with lib; {
+  meta = {
     description = "Free implementation of the OpenGL Character Renderer";
     longDescription = ''
       QuesoGLC is a free (as in free speech) implementation of the OpenGL
@@ -36,8 +48,8 @@ stdenv.mkDerivation rec {
       platform that supports both FreeType and the OpenGL API.
     '';
     homepage = "https://quesoglc.sourceforge.net/";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ astsmtl ];
-    platforms = platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ astsmtl ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/re/recyclarr/package.nix b/pkgs/by-name/re/recyclarr/package.nix
index f729757aed3a..7ac3bb36fb62 100644
--- a/pkgs/by-name/re/recyclarr/package.nix
+++ b/pkgs/by-name/re/recyclarr/package.nix
@@ -1,22 +1,12 @@
 {
   lib,
   openssl,
-  writeText,
   git,
   buildDotnetModule,
   dotnetCorePackages,
   fetchFromGitHub,
   testers,
 }:
-let
-  nuget-config = writeText "nuget.config" ''
-    <configuration>
-      <packageSources>
-        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-      </packageSources>
-    </configuration>
-  '';
-in
 buildDotnetModule (finalAttrs: {
   pname = "recyclarr";
   version = "7.4.1";
@@ -47,8 +37,6 @@ buildDotnetModule (finalAttrs: {
 
   enableParallelBuilding = false;
 
-  dotnetRestoreFlags = [ "--configfile=${nuget-config}" ];
-
   doCheck = false;
 
   dotnet-sdk = dotnetCorePackages.sdk_9_0;
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index 0bb772f90eaf..56994b141155 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "24.3.8";
+  version = "25.1.1";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-7ufF1OXFtT+OZY6UiDDiaohe4witVPEaO9zZaM6wldA=";
+    sha256 = "sha256-HjcgyDEm6m6/ab75GLFy6B5hu3Q7CQDIjxVnTVfCgbA=";
   };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-MdfCc3XdoMv3nnyaCbqU7mwJSgtusw9wVWjYqqJJmHA=";
+  vendorHash = "sha256-syAv40Coxy4uRQ6n20ikL7BTdP81N6Un1VKHpICv458=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/by-name/re/reposilite/package.nix b/pkgs/by-name/re/reposilite/package.nix
index 0cdb557714ca..c19c0f013ebd 100644
--- a/pkgs/by-name/re/reposilite/package.nix
+++ b/pkgs/by-name/re/reposilite/package.nix
@@ -5,6 +5,7 @@
   jre_headless,
   linkFarm,
   makeWrapper,
+  nixosTests,
   plugins ? [ ],
 }:
 let
@@ -41,7 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    tests = nixosTests.reposilite;
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Lightweight and easy-to-use repository management software dedicated for the Maven based artifacts in the JVM ecosystem";
diff --git a/pkgs/by-name/si/sile/package.nix b/pkgs/by-name/si/sile/package.nix
index cfffab29a406..750f31fe0c4d 100644
--- a/pkgs/by-name/si/sile/package.nix
+++ b/pkgs/by-name/si/sile/package.nix
@@ -29,18 +29,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.15.9";
+  version = "0.15.10";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.zst";
-    hash = "sha256-+9pZUDszPYJmFgHbZH0aKtZ6qLcJjh73jG2CFoRKxWc=";
+    hash = "sha256-sPABtKfIpamGNWELnCnkVagHeuHq/1KoT364/aLHDu0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
     dontConfigure = true;
     nativeBuildInputs = [ zstd ];
-    hash = "sha256-FdUrivumG5R69CwZedpkBzds5PcZr4zSsA6QW/+rDBM=";
+    hash = "sha256-57NcGm46aggPO+/54P1arCSPV3BHlAWwmWIzbpkT2js=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/so/source-meta-json-schema/package.nix b/pkgs/by-name/so/source-meta-json-schema/package.nix
index 0c9b70eaf960..afcf8fdd2273 100644
--- a/pkgs/by-name/so/source-meta-json-schema/package.nix
+++ b/pkgs/by-name/so/source-meta-json-schema/package.nix
@@ -5,7 +5,7 @@
   cmake,
 }:
 let
-  version = "7.0.3";
+  version = "8.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "source-meta-json-schema";
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "sourcemeta";
     repo = "jsonschema";
     rev = "v${version}";
-    hash = "sha256-x/bRLeH76zqcHxYodVrJYtb8CO35D3ZWYxHvvZ3Jg9A=";
+    hash = "sha256-EH+wi8MAgAxTy7OPQK/faX6OVY38/Z5fXhaK92xKkyA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stac-validator/package.nix b/pkgs/by-name/st/stac-validator/package.nix
index 9abb9da75c03..d00bce066590 100644
--- a/pkgs/by-name/st/stac-validator/package.nix
+++ b/pkgs/by-name/st/stac-validator/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "stac-validator";
-  version = "3.5.0";
+  version = "3.6.0";
   pyproject = true;
   disabled = python3Packages.pythonOlder "3.8";
 
@@ -14,7 +14,7 @@ python3Packages.buildPythonPackage rec {
     owner = "stac-utils";
     repo = "stac-validator";
     tag = "v${version}";
-    hash = "sha256-/MConEN+fcY3JKqP/24k0l/m2FHNhIqG7k42ldSPZ1U=";
+    hash = "sha256-j29Bo8n+/85fzJtif0eWYxDP86k9n4Osl9/piWmTxSs=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/st/stripe-cli/package.nix b/pkgs/by-name/st/stripe-cli/package.nix
index 71bb01cb86e2..58e61329b4b9 100644
--- a/pkgs/by-name/st/stripe-cli/package.nix
+++ b/pkgs/by-name/st/stripe-cli/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.25.1";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = "stripe-cli";
     rev = "v${version}";
-    hash = "sha256-WlLrWMDOwpSoHUixkJbCoewt/4UgnTbwIMBD5p5SI3c=";
+    hash = "sha256-gnV7BPHtbv6wFcgVUhKfIrskfAZIyZq6LtQwQYAkFCQ=";
   };
-  vendorHash = "sha256-dWLrJ866R+yPEYs4vc8SRADZXC1xCO7sDosHbU1G63o=";
+  vendorHash = "sha256-T8vrEbR240ihkLDG4vu0s+MxKJ5nOLm0aseDgK9EPPE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/un/unshield/package.nix b/pkgs/by-name/un/unshield/package.nix
index e3f2ff9be845..cbcfe71b52d0 100644
--- a/pkgs/by-name/un/unshield/package.nix
+++ b/pkgs/by-name/un/unshield/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "unshield";
-  version = "1.5.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "twogood";
     repo = "unshield";
     rev = version;
-    sha256 = "1p2inn93svm83kr5p0j1al0rx47f1zykmagxsblgy04gi942iza3";
+    sha256 = "sha256-CYlrPwNPneJIwvQCnzyfi6MZiXoflMDfUDCRL79+yBk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index f5f47bb2456f..d22026b9ec9d 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "25.1.4";
+  version = "25.2.0";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-pu9iEAhQE7eHmrjzsyWtIecT79vcZyr5QfPq/Ce3Xxg=";
+    hash = "sha256-fQAnyUh9xuWsR8+yLtDdalJhW6kmBj1GBF20UZM7M6w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wx/wxGTK32/package.nix b/pkgs/by-name/wx/wxGTK32/package.nix
index a1e2ca6b7a5d..06f0148e13d7 100644
--- a/pkgs/by-name/wx/wxGTK32/package.nix
+++ b/pkgs/by-name/wx/wxGTK32/package.nix
@@ -4,6 +4,7 @@
   curl,
   expat,
   fetchFromGitHub,
+  gspell,
   gst_all_1,
   gtk3,
   libGL,
@@ -12,9 +13,12 @@
   libXinerama,
   libXtst,
   libXxf86vm,
+  libnotify,
   libpng,
+  libsecret,
   libtiff,
   libjpeg_turbo,
+  libxkbcommon,
   zlib,
   pcre2,
   pkg-config,
@@ -66,11 +70,15 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       curl
+      gspell # wxTextCtrl spell checking
       gtk3
       libSM
       libXinerama
       libXtst
       libXxf86vm
+      libnotify # wxNotificationMessage backend
+      libsecret # wxSecretStore backend
+      libxkbcommon # proper key codes in key events
       xorgproto
     ]
     ++ lib.optional withMesa libGLU
@@ -142,7 +150,10 @@ stdenv.mkDerivation rec {
       database support, HTML viewing and printing, and much more.
     '';
     license = licenses.wxWindows;
-    maintainers = with maintainers; [ tfmoraes ];
+    maintainers = with maintainers; [
+      tfmoraes
+      fliegendewurst
+    ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 1d6bca02300e..efd8965208dc 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -10,18 +10,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "25.3.2";
+  version = "25.4.8";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3uQ+DDEzi4mo8yTv21ftoSjjFqjQfWMzjUczP6dasO4=";
+  cargoHash = "sha256-RqAolwIQqJQo9cVZ1uA0D+6yAmQKN2a7Uk3f4b/FjHU=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-03-02";
+  env.VERGEN_BUILD_DATE = "2025-04-08";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-xx/SGINyvbXZh0J8LgG2/jjFT1l6krNOzM5JAsRtxGE=";
+      hash = "sha256-oxO7nT4AZJilxA2DliYk57NETHu78xQ8nFdV+UwyKHE=";
     };
 
     man_src = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yazi/package.nix b/pkgs/by-name/ya/yazi/package.nix
index de7be8884cc6..7b45631d0b2d 100644
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@@ -16,6 +16,7 @@
     zoxide
     imagemagick
     chafa
+    resvg
   ],
 
   # deps
@@ -33,6 +34,7 @@
   zoxide,
   imagemagick,
   chafa,
+  resvg,
 
   settings ? { },
   plugins ? { },
diff --git a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
index 76f8734d4e12..fc4a5ba9f315 100644
--- a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
+++ b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
@@ -85,6 +85,7 @@ configureNuget() {
     rootConfig=$(find . -maxdepth 1 -iname nuget.config -print -quit)
     if [[ -z $rootConfig ]]; then
         dotnet new nugetconfig
+        rootConfig=nuget.config
     fi
 
     (
@@ -100,6 +101,12 @@ configureNuget() {
             -i /configuration/packageSources/__new -t attr -n value -v "$nugetSource"
             -r /configuration/packageSources/__new -v add)
 
+        if [[ -n ${keepNugetConfig-} ]] &&
+            ! @xmlstarlet@/bin/xmlstarlet select -t -i "/configuration/packageSources/clear" -nl "$rootConfig" &&
+            ! @xmlstarlet@/bin/xmlstarlet select -t -i "/configuration/packageSources/add[@value='https://api.nuget.org/v3/index.json' or @key='nuget.org']" -nl "$rootConfig"; then
+            dotnet nuget add source https://api.nuget.org/v3/index.json --name nuget.org --configfile "$rootConfig"
+        fi
+
         if [[ -z ${keepNugetConfig-} ]]; then
             xmlConfigArgs+=(-d '//configuration/*')
             xmlRootConfigArgs+=("${xmlSourceConfigArgs[@]}")
diff --git a/pkgs/development/compilers/factor-lang/0.100.nix b/pkgs/development/compilers/factor-lang/0.100.nix
new file mode 100644
index 000000000000..64751dad76a9
--- /dev/null
+++ b/pkgs/development/compilers/factor-lang/0.100.nix
@@ -0,0 +1,9 @@
+{ callPackage, fetchurl }:
+
+callPackage ./unwrapped.nix (rec {
+  version = "0.100";
+  src = fetchurl {
+    url = "https://downloads.factorcode.org/releases/${version}/factor-src-${version}.zip";
+    hash = "sha256-ei1x6mgEoDVe1mKfoWSGC9RgZCONovAPYfIdAlOGi+0=";
+  };
+})
diff --git a/pkgs/development/compilers/factor-lang/0.99.nix b/pkgs/development/compilers/factor-lang/0.99.nix
new file mode 100644
index 000000000000..88c234213af9
--- /dev/null
+++ b/pkgs/development/compilers/factor-lang/0.99.nix
@@ -0,0 +1,9 @@
+{ callPackage, fetchurl }:
+
+callPackage ./unwrapped.nix (rec {
+  version = "0.99";
+  src = fetchurl {
+    url = "https://downloads.factorcode.org/releases/${version}/factor-src-${version}.zip";
+    sha256 = "f5626bb3119bd77de9ac3392fdbe188bffc26557fab3ea34f7ca21e372a8443e";
+  };
+})
diff --git a/pkgs/development/compilers/factor-lang/unwrapped.nix b/pkgs/development/compilers/factor-lang/unwrapped.nix
index 8d7b6dae6661..a8b733a0a2bd 100644
--- a/pkgs/development/compilers/factor-lang/unwrapped.nix
+++ b/pkgs/development/compilers/factor-lang/unwrapped.nix
@@ -8,16 +8,16 @@
   ncurses,
   tzdata,
   unzip,
+
+  # Version-specific attributes
+  version,
+  src,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "factor-lang";
-  version = "0.99";
 
-  src = fetchurl {
-    url = "https://downloads.factorcode.org/releases/${finalAttrs.version}/factor-src-${finalAttrs.version}.zip";
-    sha256 = "f5626bb3119bd77de9ac3392fdbe188bffc26557fab3ea34f7ca21e372a8443e";
-  };
+  inherit src version;
 
   patches = [
     # Use full path to image while bootstrapping
diff --git a/pkgs/development/perl-modules/ImageExifTool/default.nix b/pkgs/development/perl-modules/ImageExifTool/default.nix
index 23ec41875319..073cb0423682 100644
--- a/pkgs/development/perl-modules/ImageExifTool/default.nix
+++ b/pkgs/development/perl-modules/ImageExifTool/default.nix
@@ -11,11 +11,11 @@
 
 buildPerlPackage rec {
   pname = "Image-ExifTool";
-  version = "13.00";
+  version = "13.25";
 
   src = fetchurl {
     url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-    hash = "sha256-SJV4jzT4NHZfhr5KWtWjJDP1ctdXFg7Ne2Eur17TfoQ=";
+    hash = "sha256-HNVVFEhGooKYeDvr86tFIjUnPHg1hBCBPj1Ok8ZTsfo=";
   };
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index f66188ed579f..1d29ce17352a 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitea,
+  fetchpatch,
   replaceVars,
   colord,
   setuptools,
@@ -34,6 +35,11 @@ buildPythonPackage rec {
   };
 
   patches = [
+    (fetchpatch {
+      name = "exiftool-13.23-compat.patch";
+      url = "https://gitlab.mister-muffin.de/josch/img2pdf/commit/59132f20f8a40f6ed4e5cd2a3719bf55473ba4d7.patch";
+      hash = "sha256-A36YSZ6kBFzEa2lSKIVHRg9r6Oi8FGkOnmt2YxlkwWw=";
+    })
     (replaceVars ./default-icc-profile.patch {
       srgbProfile =
         if stdenv.hostPlatform.isDarwin then
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 4f781d6109c5..f998632610d5 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pytestCheckHook,
   fetchFromGitLab,
+  fetchpatch,
   replaceVars,
   bubblewrap,
   exiftool,
@@ -36,6 +37,11 @@ buildPythonPackage rec {
 
   patches =
     [
+      (fetchpatch {
+        name = "exiftool-13.25-compat.patch";
+        url = "https://0xacab.org/jvoisin/mat2/-/commit/473903b70e1b269a6110242a9c098a10c18554e2.patch";
+        hash = "sha256-vxxjAFwiTDlcTT3ZlfhOG4rlzBJS+LhLoA++8y2hEok=";
+      })
       # hardcode paths to some binaries
       (replaceVars ./paths.patch {
         exiftool = lib.getExe exiftool;
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 7b4feb7ac8b2..a30535f53217 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.25.1";
+  version = "2.26.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pipdeptree";
     tag = version;
-    hash = "sha256-vZPxpbR8O3XIyGcp2rn4skjy2xMQb6+5BHc4tjO84tw=";
+    hash = "sha256-Nq+xXzi5PeDDNTtkTaMTWO4HpxkjSUptE4jwfjBoauY=";
   };
 
   postPatch = ''
@@ -66,7 +66,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Command line utility to show dependency tree of packages";
     homepage = "https://github.com/tox-dev/pipdeptree";
-    changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${version}";
+    changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ charlesbaynham ];
     mainProgram = "pipdeptree";
diff --git a/pkgs/development/python-modules/simsimd/default.nix b/pkgs/development/python-modules/simsimd/default.nix
index d61a2e529406..9069f0f539a0 100644
--- a/pkgs/development/python-modules/simsimd/default.nix
+++ b/pkgs/development/python-modules/simsimd/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "simsimd";
-  version = "6.4.0";
+  version = "6.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "simsimd";
     tag = "v${version}";
-    hash = "sha256-o9GhLfFuH3mTE4V6DGyGwU7o3EfP4iEoxUfFvR5gtLc=";
+    hash = "sha256-4t3uCxQG0zSa2JLKE1d2G3OQLr+8E3ZDNnTf9LAYXsk=";
   };
 
   build-system = [
@@ -44,7 +44,11 @@ buildPythonPackage rec {
     changelog = "https://github.com/ashvardanian/SimSIMD/releases/tag/${src.tag}";
     description = "Portable mixed-precision BLAS-like vector math library for x86 and ARM";
     homepage = "https://github.com/ashvardanian/simsimd";
-    license = lib.licenses.asl20;
+    license = with lib.licenses; [
+      asl20
+      # or
+      bsd3
+    ];
     maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/tools/database/surrealdb-migrations/default.nix b/pkgs/development/tools/database/surrealdb-migrations/default.nix
index 25e379eaa01f..ac8e2f1f705f 100644
--- a/pkgs/development/tools/database/surrealdb-migrations/default.nix
+++ b/pkgs/development/tools/database/surrealdb-migrations/default.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "surrealdb-migrations";
-  version = "2.2.0";
+  version = "2.2.1";
 in
 rustPlatform.buildRustPackage rec {
   inherit pname version;
@@ -20,11 +20,11 @@ rustPlatform.buildRustPackage rec {
     owner = "Odonno";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OiH3O74tJQFAW+ZyyspvOXUMcWkqjpd4GVU4cKn1jBg=";
+    hash = "sha256-MeHNBtzl2bNJFGKtM1o9mGnX0vbmnpUPc18ecqG6J+8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-dx5fGtKE0wfjQgTi5HBce6Afmc+0rJA24IRhrBirZbo=";
+  cargoHash = "sha256-l59RbKohfPsAp/70UaT/bhy5Z4orVf7fuJgU+0fuyk4=";
 
   buildInputs = [ ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
diff --git a/pkgs/development/tools/haskell/vaultenv/default.nix b/pkgs/development/tools/haskell/vaultenv/default.nix
index d19f1fb1f5aa..0b44a8b05395 100644
--- a/pkgs/development/tools/haskell/vaultenv/default.nix
+++ b/pkgs/development/tools/haskell/vaultenv/default.nix
@@ -32,13 +32,13 @@
 }:
 mkDerivation rec {
   pname = "vaultenv";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "channable";
     repo = "vaultenv";
     rev = "v${version}";
-    hash = "sha256-Jb+Y/Cbapw2ZCXMwXMw1hsy0vT/K8mM/A/Z1all7y+A=";
+    hash = "sha256-Qb9GMAFjQBsPItwkiWSMWv8WJyc5hOz9Yrq5PPOFVQo=";
   };
 
   buildTools = [ hpack ];
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
index 4787cefc379b..fe6621ab0468 100644
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "starsector";
-  version = "0.98a-RC5";
+  version = "0.98a-RC7";
 
   src = fetchzip {
     url = "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-${version}.zip";
-    sha256 = "sha256-otssjDpc4FjhTjS2A/JttlglJtMNVyDfhyTv9X+NiX0=";
+    sha256 = "sha256-qA4/9AvRWBOIbNKA9U8U7PoPmIwz8wgJZyYFln7LZHw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 27bb6292bc72..af961adba6d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3070,10 +3070,6 @@ with pkgs;
 
   cffconvert = python3Packages.toPythonApplication python3Packages.cffconvert;
 
-  chafa = callPackage ../tools/misc/chafa {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
-
   ckb-next = libsForQt5.callPackage ../tools/misc/ckb-next { };
 
   clamav = callPackage ../tools/security/clamav {
@@ -9260,8 +9256,17 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Carbon OpenGL;
   };
 
-  factorPackages = callPackage ./factor-packages.nix { };
-  factor-lang = factorPackages.factor-lang;
+  factorPackages-0_99 = callPackage ./factor-packages.nix {
+    factor-unwrapped = callPackage ../development/compilers/factor-lang/0.99.nix { };
+  };
+  factorPackages-0_100 = callPackage ./factor-packages.nix {
+    factor-unwrapped = callPackage ../development/compilers/factor-lang/0.100.nix { };
+  };
+  factorPackages = factorPackages-0_100;
+
+  factor-lang-0_99 = factorPackages-0_99.factor-lang;
+  factor-lang-0_100 = factorPackages-0_100.factor-lang;
+  factor-lang = factor-lang-0_100;
 
   far2l = callPackage ../applications/misc/far2l {
     inherit (darwin.apple_sdk.frameworks)
diff --git a/pkgs/top-level/factor-packages.nix b/pkgs/top-level/factor-packages.nix
index eae05e694130..5ddc4ad86599 100644
--- a/pkgs/top-level/factor-packages.nix
+++ b/pkgs/top-level/factor-packages.nix
@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  factor-unwrapped,
   overrides ? (self: super: { }),
 }:
 
@@ -17,7 +18,7 @@ let
           { };
       buildFactorVocab = callPackage ../development/compilers/factor-lang/mk-vocab.nix { };
 
-      factor-unwrapped = callPackage ../development/compilers/factor-lang/unwrapped.nix { };
+      inherit factor-unwrapped;
 
       factor-lang = callPackage ../development/compilers/factor-lang/wrapper.nix { };
       factor-no-gui = callPackage ../development/compilers/factor-lang/wrapper.nix {
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index a2124af1270b..1b2c7126781a 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -57,16 +57,24 @@ with pkgs;
 
       temurin-bin = recurseIntoAttrs (
         let
-          temurinLinux = callPackage ../development/compilers/temurin-bin/jdk-linux.nix { };
-          temurinDarwin = callPackage ../development/compilers/temurin-bin/jdk-darwin.nix { };
+          temurinLinux = import ../development/compilers/temurin-bin/jdk-linux.nix {
+            inherit (pkgs) lib callPackage stdenv;
+          };
+          temurinDarwin = import ../development/compilers/temurin-bin/jdk-darwin.nix {
+            inherit (pkgs) lib callPackage;
+          };
         in
         lib.mapAttrs (name: drv: mkLinuxDarwin drv temurinDarwin.${name}) temurinLinux
       );
 
       semeru-bin = recurseIntoAttrs (
         let
-          semeruLinux = callPackage ../development/compilers/semeru-bin/jdk-linux.nix { };
-          semeruDarwin = callPackage ../development/compilers/semeru-bin/jdk-darwin.nix { };
+          semeruLinux = import ../development/compilers/semeru-bin/jdk-linux.nix {
+            inherit (pkgs) lib callPackage;
+          };
+          semeruDarwin = import ../development/compilers/semeru-bin/jdk-darwin.nix {
+            inherit (pkgs) lib callPackage;
+          };
         in
         lib.mapAttrs (name: drv: mkLinuxDarwin drv semeruDarwin.${name}) semeruLinux
       );