diff --git a/pkgs/by-name/ch/cheating-daddy/bump-yauzl.patch b/pkgs/by-name/ch/cheating-daddy/bump-yauzl.patch
new file mode 100644
index 000000000000..e9f951489e86
--- /dev/null
+++ b/pkgs/by-name/ch/cheating-daddy/bump-yauzl.patch
@@ -0,0 +1,73 @@
+diff --git a/package-lock.json b/package-lock.json
+index 044aa5b..45ebc08 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -2390,16 +2390,6 @@
+                 "ieee754": "^1.1.13"
+             }
+         },
+-        "node_modules/buffer-crc32": {
+-            "version": "0.2.13",
+-            "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-            "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+-            "dev": true,
+-            "license": "MIT",
+-            "engines": {
+-                "node": "*"
+-            }
+-        },
+         "node_modules/buffer-equal-constant-time": {
+             "version": "1.0.1",
+             "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+@@ -4372,16 +4362,6 @@
+                 "reusify": "^1.0.4"
+             }
+         },
+-        "node_modules/fd-slicer": {
+-            "version": "1.1.0",
+-            "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-            "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
+-            "dev": true,
+-            "license": "MIT",
+-            "dependencies": {
+-                "pend": "~1.2.0"
+-            }
+-        },
+         "node_modules/filename-reserved-regex": {
+             "version": "2.0.0",
+             "resolved": "https://registry.npmjs.org/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz",
+@@ -8633,14 +8613,16 @@
+             }
+         },
+         "node_modules/yauzl": {
+-            "version": "2.10.0",
+-            "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-            "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
++            "version": "3.4.0",
++            "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++            "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
+             "dev": true,
+             "license": "MIT",
+             "dependencies": {
+-                "buffer-crc32": "~0.2.3",
+-                "fd-slicer": "~1.1.0"
++                "pend": "~1.2.0"
++            },
++            "engines": {
++                "node": ">=12"
+             }
+         },
+         "node_modules/yocto-queue": {
+diff --git a/package.json b/package.json
+index 369f312..51b8563 100644
+--- a/package.json
++++ b/package.json
+@@ -42,5 +42,8 @@
+         "@electron/fuses": "^1.8.0",
+         "@reforged/maker-appimage": "^5.0.0",
+         "electron": "^30.0.5"
++    },
++    "overrides": {
++        "yauzl": "^3.3.1"
+     }
+ }
diff --git a/pkgs/by-name/ch/cheating-daddy/package.nix b/pkgs/by-name/ch/cheating-daddy/package.nix
index 0cbace76118f..eaebe9439954 100644
--- a/pkgs/by-name/ch/cheating-daddy/package.nix
+++ b/pkgs/by-name/ch/cheating-daddy/package.nix
@@ -22,7 +22,12 @@ buildNpmPackage (finalAttrs: {
     hash = "sha256-/xH3tBnZAnDr/EbewtJc0WpBirW1Obn6tka7NP0ovAc=";
   };
 
-  npmDepsHash = "sha256-xoZ/qz7fGw858GsITkx/ag0FeeL4zcXh32qwb+OTLbg=";
+  patches = [
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
+  ];
+
+  npmDepsHash = "sha256-p26yEuIiK7baeAxf06E+cmuzl45NS2WOmWNeFfTplQA=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/el/electron-fiddle/bump-yauzl.patch b/pkgs/by-name/el/electron-fiddle/bump-yauzl.patch
new file mode 100644
index 000000000000..d1bdf7b757c2
--- /dev/null
+++ b/pkgs/by-name/el/electron-fiddle/bump-yauzl.patch
@@ -0,0 +1,61 @@
+diff --git a/package.json b/package.json
+index 7e49e7a..ab5c306 100644
+--- a/package.json
++++ b/package.json
+@@ -166,6 +166,7 @@
+     ]
+   },
+   "resolutions": {
++    "yauzl": "^3.3.1",
+     "@electron-forge/maker-base": "7.8.1",
+     "@electron-forge/shared-types": "7.8.1"
+   }
+diff --git a/yarn.lock b/yarn.lock
+index a4d91bb..8ae6ff9 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -3653,11 +3653,6 @@ browserslist@^4.21.10:
+     node-releases "^2.0.18"
+     update-browserslist-db "^1.1.0"
+ 
+-buffer-crc32@~0.2.3:
+-  version "0.2.13"
+-  resolved "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz"
+-  integrity sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==
+-
+ buffer-from@^1.0.0:
+   version "1.1.2"
+   resolved "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz"
+@@ -5746,13 +5741,6 @@ faye-websocket@^0.11.3:
+   dependencies:
+     websocket-driver ">=0.5.1"
+ 
+-fd-slicer@~1.1.0:
+-  version "1.1.0"
+-  resolved "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz"
+-  integrity sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==
+-  dependencies:
+-    pend "~1.2.0"
+-
+ fdir@^6.4.4, fdir@^6.4.6:
+   version "6.4.6"
+   resolved "https://registry.yarnpkg.com/fdir/-/fdir-6.4.6.tgz#2b268c0232697063111bbf3f64810a2a741ba281"
+@@ -12352,13 +12340,12 @@ yargs@^17.0.1:
+     y18n "^5.0.5"
+     yargs-parser "^21.1.1"
+ 
+-yauzl@^2.10.0:
+-  version "2.10.0"
+-  resolved "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz"
+-  integrity sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==
++yauzl@^2.10.0, yauzl@^3.3.1:
++  version "3.4.0"
++  resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-3.4.0.tgz#88b2a21455f37ca7dccf2eeb33bacb4392322719"
++  integrity sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==
+   dependencies:
+-    buffer-crc32 "~0.2.3"
+-    fd-slicer "~1.1.0"
++    pend "~1.2.0"
+ 
+ yocto-queue@^0.1.0:
+   version "0.1.0"
diff --git a/pkgs/by-name/el/electron-fiddle/package.nix b/pkgs/by-name/el/electron-fiddle/package.nix
index 0c51aa9310ad..c716e86d7fcb 100644
--- a/pkgs/by-name/el/electron-fiddle/package.nix
+++ b/pkgs/by-name/el/electron-fiddle/package.nix
@@ -25,15 +25,20 @@ let
     hash = "sha256-e9PLgkqWBNLBw7uuNpPluOQ6+aGLYQLyTzcLa+LMOzs=";
   };
 
+  patches = [
+    ./dont-use-initial-releases-json.patch
+
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
+  ];
+
   unwrapped = stdenvNoCC.mkDerivation {
     pname = "${pname}-unwrapped";
-    inherit version src;
-
-    patches = [ ./dont-use-initial-releases-json.patch ];
+    inherit version src patches;
 
     offlineCache = fetchYarnDeps {
-      inherit src;
-      hash = "sha256-mB8WG6tX204u6AJ8qLbWrA+pSN3oDihHqj0t3bWcuAI=";
+      inherit src patches;
+      hash = "sha256-5yUsjXQ3OHwEGFgMTUJAXAuTdAl4zkb8zxTs5OT6sw4=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/lo/logseq/bump-yauzl.patch b/pkgs/by-name/lo/logseq/bump-yauzl.patch
new file mode 100644
index 000000000000..bbb5118dc3e6
--- /dev/null
+++ b/pkgs/by-name/lo/logseq/bump-yauzl.patch
@@ -0,0 +1,61 @@
+diff --git a/resources/package.json b/resources/package.json
+index d42b7fb..6e66826 100644
+--- a/resources/package.json
++++ b/resources/package.json
+@@ -60,6 +60,7 @@
+     "electron-forge-maker-appimage": "https://github.com/logseq/electron-forge-maker-appimage.git"
+   },
+   "resolutions": {
++    "yauzl": "^3.3.1",
+     "**/electron": "38.4.0",
+     "**/node-abi": "4.14.0",
+     "**/node-gyp": "12.0.0",
+diff --git a/static/yarn.lock b/static/yarn.lock
+index 4738ef9..413dcd9 100644
+--- a/static/yarn.lock
++++ b/static/yarn.lock
+@@ -1729,11 +1729,6 @@ browserslist@^4.26.3:
+     node-releases "^2.0.27"
+     update-browserslist-db "^1.1.4"
+ 
+-buffer-crc32@~0.2.3:
+-  version "0.2.13"
+-  resolved "https://registry.yarnpkg.com/buffer-crc32/-/buffer-crc32-0.2.13.tgz#0d333e3f00eac50aa1454abd30ef8c2a5d9a7242"
+-  integrity sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==
+-
+ buffer-equal@^1.0.0:
+   version "1.0.1"
+   resolved "https://registry.yarnpkg.com/buffer-equal/-/buffer-equal-1.0.1.tgz#2f7651be5b1b3f057fcd6e7ee16cf34767077d90"
+@@ -2839,13 +2834,6 @@ fastq@^1.17.1, fastq@^1.6.0:
+   dependencies:
+     reusify "^1.0.4"
+ 
+-fd-slicer@~1.1.0:
+-  version "1.1.0"
+-  resolved "https://registry.yarnpkg.com/fd-slicer/-/fd-slicer-1.1.0.tgz#25c7c89cb1f9077f8891bbe61d8f390eae256f1e"
+-  integrity sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==
+-  dependencies:
+-    pend "~1.2.0"
+-
+ fdir@^6.5.0:
+   version "6.5.0"
+   resolved "https://registry.yarnpkg.com/fdir/-/fdir-6.5.0.tgz#ed2ab967a331ade62f18d077dae192684d50d350"
+@@ -5771,13 +5759,12 @@ yargs@^17.0.1, yargs@^17.6.2:
+     y18n "^5.0.5"
+     yargs-parser "^21.1.1"
+ 
+-yauzl@^2.10.0:
+-  version "2.10.0"
+-  resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-2.10.0.tgz#c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9"
+-  integrity sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==
++yauzl@^2.10.0, yauzl@^3.3.1:
++  version "3.4.0"
++  resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-3.4.0.tgz#88b2a21455f37ca7dccf2eeb33bacb4392322719"
++  integrity sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==
+   dependencies:
+-    buffer-crc32 "~0.2.3"
+-    fd-slicer "~1.1.0"
++    pend "~1.2.0"
+ 
+ yocto-queue@^0.1.0:
+   version "0.1.0"
diff --git a/pkgs/by-name/lo/logseq/package.nix b/pkgs/by-name/lo/logseq/package.nix
index 2bf9f5527f74..54f2e17a7f9b 100644
--- a/pkgs/by-name/lo/logseq/package.nix
+++ b/pkgs/by-name/lo/logseq/package.nix
@@ -61,6 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
     # bumps better-sqlite3 to work with electron 39+
     # also fixes outdated yarn.lock
     ./bump-better-sqlite3.patch
+
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
   ];
 
   mavenRepo = stdenv.mkDerivation {
@@ -115,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "logseq-${finalAttrs.version}-yarn-deps-static-resources";
     inherit (finalAttrs) src patches;
     postPatch = "cd ./static";
-    hash = "sha256-5DBVlCWlUXYvo0bJWQwvSNMW4P9E8kjE9RQe9/ViJM0=";
+    hash = "sha256-TFisR5GwcKmuddGhe0i6rAmr2wDWzed/mXnxVGARYK0=";
   };
 
   yarnOfflineCacheAmplify = fetchYarnDeps {
diff --git a/pkgs/by-name/ma/mailspring/bump-yauzl.patch b/pkgs/by-name/ma/mailspring/bump-yauzl.patch
new file mode 100644
index 000000000000..1a3fc9ab0489
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/bump-yauzl.patch
@@ -0,0 +1,217 @@
+diff --git a/app/package-lock.json b/app/package-lock.json
+index 9b5b874..bc446b7 100644
+--- a/app/package-lock.json
++++ b/app/package-lock.json
+@@ -570,16 +570,6 @@
+         "ieee754": "^1.1.13"
+       }
+     },
+-    "node_modules/buffer-crc32": {
+-      "version": "0.2.13",
+-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+-      "license": "MIT",
+-      "peer": true,
+-      "engines": {
+-        "node": "*"
+-      }
+-    },
+     "node_modules/buffer-from": {
+       "version": "1.1.2",
+       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+@@ -1581,16 +1571,6 @@
+       "license": "MIT",
+       "peer": true
+     },
+-    "node_modules/fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
+-      "license": "MIT",
+-      "peer": true,
+-      "dependencies": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "node_modules/file-uri-to-path": {
+       "version": "1.0.0",
+       "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+@@ -4575,14 +4555,16 @@
+       }
+     },
+     "node_modules/yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
+       "license": "MIT",
+       "peer": true,
+       "dependencies": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
++      },
++      "engines": {
++        "node": ">=12"
+       }
+     }
+   }
+diff --git a/app/package.json b/app/package.json
+index 115cf61..436527d 100644
+--- a/app/package.json
++++ b/app/package.json
+@@ -77,7 +77,9 @@
+     "@types/react": "^17.0.0",
+     "@types/react-dom": "^17.0.0"
+   },
+-  "overrides": {},
++  "overrides": {
++    "yauzl": "^3.3.1"
++  },
+   "optionalDependencies": {
+     "windows-focus-assist": "^1.4.0"
+   }
+diff --git a/package-lock.json b/package-lock.json
+index fdc0d9d..31a4b5f 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -1893,14 +1893,6 @@
+       "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg==",
+       "license": "MIT"
+     },
+-    "node_modules/buffer-crc32": {
+-      "version": "0.2.13",
+-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=",
+-      "engines": {
+-        "node": "*"
+-      }
+-    },
+     "node_modules/buffer-fill": {
+       "version": "1.0.0",
+       "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
+@@ -3446,14 +3438,6 @@
+         "reusify": "^1.0.4"
+       }
+     },
+-    "node_modules/fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
+-      "dependencies": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "node_modules/file-entry-cache": {
+       "version": "6.0.1",
+       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+@@ -5582,7 +5566,8 @@
+     "node_modules/pend": {
+       "version": "1.2.0",
+       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
++      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
++      "license": "MIT"
+     },
+     "node_modules/picomatch": {
+       "version": "2.3.2",
+@@ -7403,12 +7388,15 @@
+       }
+     },
+     "node_modules/yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
++      "license": "MIT",
+       "dependencies": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
++      },
++      "engines": {
++        "node": ">=12"
+       }
+     },
+     "node_modules/yocto-queue": {
+@@ -8663,11 +8651,6 @@
+       "resolved": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz",
+       "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg=="
+     },
+-    "buffer-crc32": {
+-      "version": "0.2.13",
+-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI="
+-    },
+     "buffer-fill": {
+       "version": "1.0.0",
+       "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
+@@ -9692,7 +9675,7 @@
+         "@types/yauzl": "^2.9.1",
+         "debug": "^4.1.1",
+         "get-stream": "^5.1.0",
+-        "yauzl": "^2.10.0"
++        "yauzl": "^3.3.1"
+       },
+       "dependencies": {
+         "get-stream": {
+@@ -9745,14 +9728,6 @@
+         "reusify": "^1.0.4"
+       }
+     },
+-    "fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
+-      "requires": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "file-entry-cache": {
+       "version": "6.0.1",
+       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+@@ -11158,7 +11133,7 @@
+     "pend": {
+       "version": "1.2.0",
+       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
++      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="
+     },
+     "picomatch": {
+       "version": "2.3.2",
+@@ -12389,12 +12364,11 @@
+       "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="
+     },
+     "yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
+       "requires": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
+       }
+     },
+     "yocto-queue": {
+diff --git a/package.json b/package.json
+index 58a4e93..f065078 100644
+--- a/package.json
++++ b/package.json
+@@ -82,5 +82,8 @@
+     "test:e2e": "npx playwright test --config playwright/playwright.config.ts",
+     "tsc-watch": "tsc -w -p ./app --noEmit",
+     "build": "node app/build/build.js"
++  },
++  "overrides": {
++    "yauzl": "^3.3.1"
+   }
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/by-name/ma/mailspring/package.nix b/pkgs/by-name/ma/mailspring/package.nix
index d1e320d9d25b..fecb9bd4c470 100644
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@@ -26,15 +26,20 @@ let
     fetchSubmodules = true;
   };
 
+  patches = [
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
+  ];
+
   electron = electron_41;
 
   mailspring-sync = callPackage ./mailsync.nix { inherit src version; };
 
   mailspring-app = buildNpmPackage {
     pname = "mailspring-app";
-    inherit version src;
-    sourceRoot = "${src.name}/app";
-    npmDepsHash = "sha256-b8CscOVVIbjkdf977LVVzFkWxOwn8XOemYpud5yK6vU=";
+    inherit version src patches;
+    postPatch = "cd app"; # we don't use sourceRoot so that we don't have to make the patch relative to it
+    npmDepsHash = "sha256-/caWmbN4Sl3DVPLXSaXrCHEyRsk/p3FwDqSZ7lfNgUk=";
     dontNpmBuild = true;
     env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
@@ -59,9 +64,9 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "mailspring";
-  inherit version src;
+  inherit version src patches;
 
-  npmDepsHash = "sha256-3uidHfxgGONdtwAnoVytIbRqRjwtz3Yu8tNQ0qT8mJQ=";
+  npmDepsHash = "sha256-nHKFuTdk3qbAiSHksSo++mc8TMasspuym7MYxjuTTHI=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/ri/ride/bump-yauzl.patch b/pkgs/by-name/ri/ride/bump-yauzl.patch
new file mode 100644
index 000000000000..48f44d703fe0
--- /dev/null
+++ b/pkgs/by-name/ri/ride/bump-yauzl.patch
@@ -0,0 +1,131 @@
+diff --git a/package-lock.json b/package-lock.json
+index cc8b8bd..cb5b207 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -2354,6 +2354,7 @@
+       "version": "0.2.13",
+       "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+       "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=",
++      "dev": true,
+       "engines": {
+         "node": "*"
+       }
+@@ -5014,14 +5015,6 @@
+         "node": ">=0.4.0"
+       }
+     },
+-    "node_modules/fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
+-      "dependencies": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "node_modules/figures": {
+       "version": "5.0.0",
+       "resolved": "https://registry.npmjs.org/figures/-/figures-5.0.0.tgz",
+@@ -9118,7 +9111,8 @@
+     "node_modules/pend": {
+       "version": "1.2.0",
+       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
++      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
++      "license": "MIT"
+     },
+     "node_modules/picomatch": {
+       "version": "2.3.1",
+@@ -12371,12 +12365,15 @@
+       }
+     },
+     "node_modules/yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
++      "license": "MIT",
+       "dependencies": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
++      },
++      "engines": {
++        "node": ">=12"
+       }
+     },
+     "node_modules/yocto-queue": {
+@@ -14109,7 +14106,8 @@
+     "buffer-crc32": {
+       "version": "0.2.13",
+       "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI="
++      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=",
++      "dev": true
+     },
+     "buildcheck": {
+       "version": "0.0.6",
+@@ -16094,7 +16092,7 @@
+         "@types/yauzl": "^2.9.1",
+         "debug": "^4.1.1",
+         "get-stream": "^5.1.0",
+-        "yauzl": "^2.10.0"
++        "yauzl": "^3.3.1"
+       }
+     },
+     "fast-deep-equal": {
+@@ -16152,14 +16150,6 @@
+         "websocket-driver": ">=0.5.1"
+       }
+     },
+-    "fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
+-      "requires": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "figures": {
+       "version": "5.0.0",
+       "resolved": "https://registry.npmjs.org/figures/-/figures-5.0.0.tgz",
+@@ -19260,7 +19250,7 @@
+     "pend": {
+       "version": "1.2.0",
+       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
++      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="
+     },
+     "picomatch": {
+       "version": "2.3.1",
+@@ -21718,12 +21708,11 @@
+       "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w=="
+     },
+     "yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
+       "requires": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
+       }
+     },
+     "yocto-queue": {
+diff --git a/package.json b/package.json
+index 4a9025f..76f4407 100644
+--- a/package.json
++++ b/package.json
+@@ -48,5 +48,8 @@
+     "spectron": "^19.0.0",
+     "temp": "^0.9.4",
+     "ws": "^8.13.0"
++  },
++  "overrides": {
++    "yauzl": "^3.3.1"
+   }
+ }
diff --git a/pkgs/by-name/ri/ride/package.nix b/pkgs/by-name/ri/ride/package.nix
index f690c035c227..c6299c576a24 100644
--- a/pkgs/by-name/ri/ride/package.nix
+++ b/pkgs/by-name/ri/ride/package.nix
@@ -24,7 +24,7 @@ buildNpmPackage rec {
     hash = "sha256-11wlKK0z3/KRKMKNrDvZLvK7vV0UzrMTaG0ei9n6VEk=";
   };
 
-  npmDepsHash = "sha256-o8pwjx5P/1eFV3HTWlHGV1/ad9YUSOI0zUWvqkqIf3I=";
+  npmDepsHash = "sha256-6Os6aWkgbA6m4JCp3b6UeZ4NC8N+7pwCWkPBc4xXAHY=";
 
   patches = [
     # Fix info in the "about" page, enable asar, add option to build for the detected system
@@ -34,6 +34,9 @@ buildNpmPackage rec {
 
     # would not build with nodejs_24 and above without this
     ./update-nan.patch
+
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/rs/rstudio/bump-yauzl.patch b/pkgs/by-name/rs/rstudio/bump-yauzl.patch
new file mode 100644
index 000000000000..26a7e6a775a0
--- /dev/null
+++ b/pkgs/by-name/rs/rstudio/bump-yauzl.patch
@@ -0,0 +1,73 @@
+diff --git a/src/node/desktop/package-lock.json b/src/node/desktop/package-lock.json
+index c78746a..93d15e5 100644
+--- a/src/node/desktop/package-lock.json
++++ b/src/node/desktop/package-lock.json
+@@ -4372,16 +4372,6 @@
+         "ieee754": "^1.2.1"
+       }
+     },
+-    "node_modules/buffer-crc32": {
+-      "version": "0.2.13",
+-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+-      "dev": true,
+-      "license": "MIT",
+-      "engines": {
+-        "node": "*"
+-      }
+-    },
+     "node_modules/buffer-from": {
+       "version": "1.1.2",
+       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+@@ -6777,16 +6767,6 @@
+         "node": ">=0.8.0"
+       }
+     },
+-    "node_modules/fd-slicer": {
+-      "version": "1.1.0",
+-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
+-      "dev": true,
+-      "license": "MIT",
+-      "dependencies": {
+-        "pend": "~1.2.0"
+-      }
+-    },
+     "node_modules/fecha": {
+       "version": "4.2.3",
+       "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
+@@ -14054,14 +14034,16 @@
+       }
+     },
+     "node_modules/yauzl": {
+-      "version": "2.10.0",
+-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
++      "version": "3.4.0",
++      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
++      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
+       "dev": true,
+       "license": "MIT",
+       "dependencies": {
+-        "buffer-crc32": "~0.2.3",
+-        "fd-slicer": "~1.1.0"
++        "pend": "~1.2.0"
++      },
++      "engines": {
++        "node": ">=12"
+       }
+     },
+     "node_modules/yn": {
+diff --git a/src/node/desktop/package.json b/src/node/desktop/package.json
+index 613361f..c18514f 100644
+--- a/src/node/desktop/package.json
++++ b/src/node/desktop/package.json
+@@ -85,5 +85,8 @@
+     "vue": "3.5.29",
+     "winston": "3.19.0",
+     "winston-syslog": "2.7.1"
++  },
++  "overrides": {
++    "yauzl": "^3.3.1"
+   }
+ }
diff --git a/pkgs/by-name/rs/rstudio/package.nix b/pkgs/by-name/rs/rstudio/package.nix
index 490111062d5a..c0f40c003651 100644
--- a/pkgs/by-name/rs/rstudio/package.nix
+++ b/pkgs/by-name/rs/rstudio/package.nix
@@ -204,6 +204,9 @@ stdenv.mkDerivation (finalAttrs: {
     # Partly taken from https://github.com/rstudio/rstudio/pull/17470
     ./electron-41.patch
 
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
+
     # Hack RStudio to only use the input R and provided libclang.
     (replaceVars ./r-location.patch {
       R = lib.getBin R;
@@ -254,7 +257,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "rstudio-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
     postPatch = "cd ${finalAttrs.npmRoot}";
-    hash = "sha256-MuTY+vjtbgbk73dm6bsCUmi34z/HCDnB5/RLkZ/rrVo=";
+    hash = "sha256-rdtnQKaOUp9jfWRA4BuEOyJn8emimiy+Kvxu1939H30=";
   };
 
   preConfigure = ''
diff --git a/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch b/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch
new file mode 100644
index 000000000000..01fcc933bd93
--- /dev/null
+++ b/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch
@@ -0,0 +1,123 @@
+diff --git a/package.json b/package.json
+index d0f7837..fbdcb92 100644
+--- a/package.json
++++ b/package.json
+@@ -55,5 +55,10 @@
+     "update-electron-app": "^3.1.1",
+     "utf-8-validate": "^6.0.5"
+   },
++  "pnpm": {
++    "overrides": {
++      "yauzl": "^3.3.1"
++    }
++  },
+   "packageManager": "pnpm@10.18.1+sha512.77a884a165cbba2d8d1c19e3b4880eee6d2fcabd0d879121e282196b80042351d5eb3ca0935fa599da1dc51265cc68816ad2bddd2a2de5ea9fdf92adbec7cd34"
+-}
+\ No newline at end of file
++}
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 9c7ff44..7e9007d 100644
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -4,6 +4,9 @@ settings:
+   autoInstallPeers: true
+   excludeLinksFromLockfile: false
+ 
++overrides:
++  yauzl: ^3.3.1
++
+ importers:
+ 
+   .:
+@@ -1086,9 +1089,6 @@ packages:
+     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+     engines: {node: '>=8'}
+ 
+-  buffer-crc32@0.2.13:
+-    resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
+-
+   buffer-from@1.1.2:
+     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
+ 
+@@ -1575,9 +1575,6 @@ packages:
+   fastq@1.19.1:
+     resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
+ 
+-  fd-slicer@1.1.0:
+-    resolution: {integrity: sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==}
+-
+   figures@2.0.0:
+     resolution: {integrity: sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==}
+     engines: {node: '>=4'}
+@@ -1722,7 +1719,7 @@ packages:
+ 
+   glob@7.2.3:
+     resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
+-    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
++    deprecated: Glob versions prior to v9 are no longer supported
+ 
+   glob@8.1.0:
+     resolution: {integrity: sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==}
+@@ -2883,7 +2880,7 @@ packages:
+   tar@6.2.1:
+     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
+     engines: {node: '>=10'}
+-    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
++    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me
+ 
+   temp@0.9.4:
+     resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
+@@ -3174,8 +3171,9 @@ packages:
+     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+     engines: {node: '>=12'}
+ 
+-  yauzl@2.10.0:
+-    resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==}
++  yauzl@3.4.0:
++    resolution: {integrity: sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==}
++    engines: {node: '>=12'}
+ 
+   yocto-queue@0.1.0:
+     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+@@ -4439,8 +4437,6 @@ snapshots:
+     dependencies:
+       fill-range: 7.1.1
+ 
+-  buffer-crc32@0.2.13: {}
+-
+   buffer-from@1.1.2: {}
+ 
+   buffer@5.7.1:
+@@ -5110,7 +5106,7 @@ snapshots:
+     dependencies:
+       debug: 4.4.3
+       get-stream: 5.2.0
+-      yauzl: 2.10.0
++      yauzl: 3.4.0
+     optionalDependencies:
+       '@types/yauzl': 2.10.3
+     transitivePeerDependencies:
+@@ -5136,10 +5132,6 @@ snapshots:
+     dependencies:
+       reusify: 1.1.0
+ 
+-  fd-slicer@1.1.0:
+-    dependencies:
+-      pend: 1.2.0
+-
+   figures@2.0.0:
+     dependencies:
+       escape-string-regexp: 1.0.5
+@@ -6839,10 +6831,9 @@ snapshots:
+       y18n: 5.0.8
+       yargs-parser: 21.1.1
+ 
+-  yauzl@2.10.0:
++  yauzl@3.4.0:
+     dependencies:
+-      buffer-crc32: 0.2.13
+-      fd-slicer: 1.1.0
++      pend: 1.2.0
+ 
+   yocto-queue@0.1.0: {}
+ 
diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index 998282b00828..d7a4998172b7 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-l4kxlPwohaxserVyNAb3Dp4f5XhnPUKeuRJwrOl9EWc=";
   };
 
+  patches = [
+    # zip extraction fails on newer nodejs versions without this fix
+    ./bump-yauzl.patch
+  ];
+
   postPatch = ''
     # Disable auto-updates
     sed -i '/updateElectronApp([^)]*)/d' src/main.ts
@@ -54,10 +59,15 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
     fetcherVersion = 3;
     pnpm = pnpm_10;
-    hash = "sha256-bIDwEmt/8URBMx7XIQ1EP4SucwMuyGZE1hlQM0rxDnw=";
+    hash = "sha256-0v+MHYFgnIN4FvzFkv5D3Bqc7538763yCIWu05XR+fA=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/yt/ytmdesktop/bump-yauzl.patch b/pkgs/by-name/yt/ytmdesktop/bump-yauzl.patch
new file mode 100644
index 000000000000..705807420f82
--- /dev/null
+++ b/pkgs/by-name/yt/ytmdesktop/bump-yauzl.patch
@@ -0,0 +1,51 @@
+diff --git a/yarn.lock b/yarn.lock
+index baa6475..4ff4481 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -2952,13 +2952,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"buffer-crc32@npm:~0.2.3":
+-  version: 0.2.13
+-  resolution: "buffer-crc32@npm:0.2.13"
+-  checksum: 10c0/cb0a8ddf5cf4f766466db63279e47761eb825693eeba6a5a95ee4ec8cb8f81ede70aa7f9d8aeec083e781d47154290eb5d4d26b3f7a465ec57fb9e7d59c47150
+-  languageName: node
+-  linkType: hard
+-
+ "buffer-from@npm:^1.0.0":
+   version: 1.1.2
+   resolution: "buffer-from@npm:1.1.2"
+@@ -4750,15 +4743,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"fd-slicer@npm:~1.1.0":
+-  version: 1.1.0
+-  resolution: "fd-slicer@npm:1.1.0"
+-  dependencies:
+-    pend: "npm:~1.2.0"
+-  checksum: 10c0/304dd70270298e3ffe3bcc05e6f7ade2511acc278bc52d025f8918b48b6aa3b77f10361bddfadfe2a28163f7af7adbdce96f4d22c31b2f648ba2901f0c5fc20e
+-  languageName: node
+-  linkType: hard
+-
+ "fdir@npm:^6.4.4":
+   version: 6.4.5
+   resolution: "fdir@npm:6.4.5"
+@@ -9915,12 +9899,11 @@ __metadata:
+   linkType: hard
+ 
+ "yauzl@npm:^2.10.0":
+-  version: 2.10.0
+-  resolution: "yauzl@npm:2.10.0"
++  version: 3.4.0
++  resolution: "yauzl@npm:3.4.0"
+   dependencies:
+-    buffer-crc32: "npm:~0.2.3"
+-    fd-slicer: "npm:~1.1.0"
+-  checksum: 10c0/f265002af7541b9ec3589a27f5fb8f11cf348b53cc15e2751272e3c062cd73f3e715bc72d43257de71bbaecae446c3f1b14af7559e8ab0261625375541816422
++    pend: "npm:~1.2.0"
++  checksum: 10c0/17a98c42c0065e8af429eb8a61f7a0e4562181ed54080366b838f34f741b6829f167f804787c86b7646bb042707f35871739f053de0548285e405a2eae4da025
+   languageName: node
+   linkType: hard
+ 
diff --git a/pkgs/by-name/yt/ytmdesktop/package.nix b/pkgs/by-name/yt/ytmdesktop/package.nix
index bc40ef00f13a..84ef3a767a3d 100644
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@@ -47,6 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
     # Remove after upstream updates to Yarn 4.14
     # https://github.com/ytmdesktop/ytmdesktop/blob/v2.0.11/package.json#L77
     ./yarn-4.14-support.patch
+
+    # zip extraction fails on newer nodejs versions without this fix
+    # generated by running `yarn set resolution yauzl@npm:^2.10.0 npm:^3.3.1`
+    ./bump-yauzl.patch
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -61,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-Vvvhi1db/ld2rNz+XhtNzlgI/4z3ym6QENG0GMlZAd0=";
+    hash = "sha256-VpNK+44/FwHxZ+Hyx0QShpZ9fdP06VhhpoXxMFeLUzE=";
   };
 
   nativeBuildInputs = [