diff --git a/doc/build-helpers/images/dockertools.section.md b/doc/build-helpers/images/dockertools.section.md
index 6732f790733d..26c1d9c14a26 100644
--- a/doc/build-helpers/images/dockertools.section.md
+++ b/doc/build-helpers/images/dockertools.section.md
@@ -453,7 +453,7 @@ See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand how the
 `streamLayeredImage` allows scripts to be run when creating the additional layer with symlinks, allowing custom behaviour to affect the final results of the image (see the documentation of the `extraCommands` and `fakeRootCommands` attributes).
 
 The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` attribute).
+By default, that image will use a static creation date (see documentation for the `created` and `mtime` attributes).
 This allows the function to produce reproducible images.
 
 ### Inputs {#ssec-pkgs-dockerTools-streamLayeredImage-inputs}
@@ -516,6 +516,7 @@ This allows the function to produce reproducible images.
 `created` (String; _optional_)
 
 : Specifies the time of creation of the generated image.
+  This date will be used for the image metadata.
   This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
 
   :::{.caution}
@@ -524,6 +525,18 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `"1970-01-01T00:00:01Z"`.
 
+`mtime` (String; _optional_)
+
+: Specifies the time used for the modification timestamp of files within the layers of the generated image.
+  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
+
+  :::{.caution}
+  Using a non-constant date will cause built layers to have a different hash each time, preventing deduplication.
+  Using `"now"` also means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
+  :::
+
+  _Default value:_ `"1970-01-01T00:00:01Z"`.
+
 `uid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-uid}
 `gid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-gid}
 `uname` (String; _optional_) []{#dockerTools-buildLayeredImage-arg-uname}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8cc8bd2a5999..a2a689a9f61b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3339,6 +3339,12 @@
     githubId = 141733;
     name = "Andrew Bruce";
   };
+  camerondugan = {
+    email = "cameron.dugan@protonmail.com";
+    github = "camerondugan";
+    githubId = 54632731;
+    name = "Cameron Dugan";
+  };
   cameronfyfe = {
     email = "cameron.j.fyfe@gmail.com";
     github = "cameronfyfe";
@@ -9168,6 +9174,12 @@
     githubId = 1817528;
     name = "Igor Polyakov";
   };
+  iosmanthus = {
+    email = "myosmanthustree@gmail.com";
+    github = "iosmanthus";
+    githubId = 16307070;
+    name = "iosmanthus";
+  };
   iquerejeta = {
     github = "iquerejeta";
     githubId = 31273774;
@@ -18205,12 +18217,6 @@
     github = "rosehobgoblin";
     githubId = 84164410;
   };
-  roshaen = {
-    name = "Roshan Kumar";
-    email = "roshaen09@gmail.com";
-    github = "roshaen";
-    githubId = 58213083;
-  };
   RossComputerGuy = {
     name = "Tristan Ross";
     email = "tristan.ross@midstall.com";
@@ -23295,6 +23301,12 @@
     github = "YoshiRulz";
     githubId = 13409956;
   };
+  youhaveme9 = {
+    name = "Roshan Kumar";
+    email = "roshaen09@gmail.com";
+    github = "youhaveme9";
+    githubId = 58213083;
+  };
   yrashk = {
     email = "yrashk@gmail.com";
     github = "yrashk";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 68cd01c3c6f4..36744aacff9c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1192,6 +1192,7 @@
   ./services/networking/scion/scion-daemon.nix
   ./services/networking/scion/scion-dispatcher.nix
   ./services/networking/scion/scion-router.nix
+  ./services/networking/scion/scion-ip-gateway.nix
   ./services/networking/seafile.nix
   ./services/networking/searx.nix
   ./services/networking/shadowsocks.nix
diff --git a/nixos/modules/services/databases/tigerbeetle.md b/nixos/modules/services/databases/tigerbeetle.md
index 12d920e7bcc7..7cf3bedda5e0 100644
--- a/nixos/modules/services/databases/tigerbeetle.md
+++ b/nixos/modules/services/databases/tigerbeetle.md
@@ -35,3 +35,10 @@ Note that the TigerBeetle module won't open any firewall ports automatically, so
 
 A complete list of options for TigerBeetle can be found [here](#opt-services.tigerbeetle.enable).
 
+## Upgrading {#module-services-tigerbeetle-upgrading}
+
+Usually, TigerBeetle's [upgrade process](https://docs.tigerbeetle.com/operating/upgrading) only requires replacing the binary used for the servers.
+This is not directly possible with NixOS since the new binary will be located at a different place in the Nix store.
+
+However, since TigerBeetle is managed through systemd on NixOS, the only action you need to take when upgrading is to make sure the version of TigerBeetle you're upgrading to supports upgrades from the version you're currently running.
+This information will be on the [release notes](https://github.com/tigerbeetle/tigerbeetle/releases) for the version you're upgrading to.
diff --git a/nixos/modules/services/databases/tigerbeetle.nix b/nixos/modules/services/databases/tigerbeetle.nix
index a9c7a24250a6..7b512055e44e 100644
--- a/nixos/modules/services/databases/tigerbeetle.nix
+++ b/nixos/modules/services/databases/tigerbeetle.nix
@@ -42,8 +42,8 @@ in
       };
 
       cacheGridSize = mkOption {
-        type = types.strMatching "[0-9]+(K|M|G)B";
-        default = "1GB";
+        type = types.strMatching "[0-9]+(K|M|G)iB";
+        default = "1GiB";
         description = ''
           The grid cache size.
           The grid cache acts like a page cache for TigerBeetle.
@@ -97,16 +97,26 @@ in
         '';
 
         serviceConfig = {
-          Type = "exec";
-
-          DynamicUser = true;
-          ProtectHome = true;
           DevicePolicy = "closed";
-
+          DynamicUser = true;
+          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          LockPersonality = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "noaccess";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
           StateDirectory = "tigerbeetle";
           StateDirectoryMode = 700;
-
-          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          Type = "exec";
         };
       };
 
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 75b08bb0593b..95b77da250b2 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -30,6 +30,10 @@ let
       ENGINE = "haystack.backends.whoosh_backend.WhooshEngine";
       PATH = "/var/lib/mailman-web/fulltext-index";
     };
+  } // lib.optionalAttrs cfg.enablePostfix {
+    EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend";
+    EMAIL_HOST = "127.0.0.1";
+    EMAIL_PORT = 25;
   } // cfg.webSettings;
 
   webSettingsJSON = pkgs.writeText "settings.json" (builtins.toJSON webSettings);
diff --git a/nixos/modules/services/networking/scion/scion-ip-gateway.nix b/nixos/modules/services/networking/scion/scion-ip-gateway.nix
new file mode 100644
index 000000000000..1801828c8ad0
--- /dev/null
+++ b/nixos/modules/services/networking/scion/scion-ip-gateway.nix
@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  globalCfg = config.services.scion;
+  cfg = config.services.scion.scion-ip-gateway;
+  toml = pkgs.formats.toml { };
+  json = pkgs.formats.json { };
+  connectionDir = if globalCfg.stateless then "/run" else "/var/lib";
+  defaultConfig = {
+    tunnel = { };
+    gateway = {
+      traffic_policy_file = "${trafficConfigFile}";
+    };
+  };
+  defaultTrafficConfig = {
+    ASes = { };
+    ConfigVersion = 9001;
+  };
+  configFile = toml.generate "scion-ip-gateway.toml" (recursiveUpdate defaultConfig cfg.config);
+  trafficConfigFile = json.generate "scion-ip-gateway-traffic.json" (
+    recursiveUpdate defaultTrafficConfig cfg.trafficConfig
+  );
+in
+{
+  options.services.scion.scion-ip-gateway = {
+    enable = mkEnableOption "the scion-ip-gateway service";
+    config = mkOption {
+      default = { };
+      type = toml.type;
+      example = literalExpression ''
+        {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        }
+      '';
+      description = ''
+        scion-ip-gateway daemon configuration
+      '';
+    };
+    trafficConfig = mkOption {
+      default = { };
+      type = json.type;
+      example = literalExpression ''
+        {
+          ASes = {
+            "2-ffaa:0:b" = {
+              Nets = [
+                  "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        }
+      '';
+      description = ''
+        scion-ip-gateway traffic configuration
+      '';
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.scion-ip-gateway = {
+      description = "SCION IP Gateway Service";
+      after = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wants = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Group = if (config.services.scion.scion-dispatcher.enable == true) then "scion" else null;
+        ExecStart = "${globalCfg.package}/bin/scion-ip-gateway --config ${configFile}";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+        Restart = "on-failure";
+        KillMode = "control-group";
+        RemainAfterExit = false;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/scion/scion.nix b/nixos/modules/services/networking/scion/scion.nix
index efab97f7cd8d..0b26f24e7ed0 100644
--- a/nixos/modules/services/networking/scion/scion.nix
+++ b/nixos/modules/services/networking/scion/scion.nix
@@ -42,6 +42,7 @@ in
       scion-daemon.enable = true;
       scion-router.enable = true;
       scion-control.enable = true;
+      scion-ip-gateway.enable = true;
     };
     assertions = [
       { assertion = cfg.bypassBootstrapWarning == true;
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 668bccab2e2d..d439e0c2a586 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -339,7 +339,7 @@ in
     services.dbus.packages = [ cups.out ] ++ optional polkitEnabled cups-pk-helper;
     services.udev.packages = cfg.drivers;
 
-    # Allow asswordless printer admin for members of wheel group
+    # Allow passwordless printer admin for members of wheel group
     security.polkit.extraConfig = mkIf polkitEnabled ''
       polkit.addRule(function(action, subject) {
           if (action.id == "org.opensuse.cupspkhelper.mechanism.all-edit" &&
diff --git a/nixos/modules/services/web-apps/stirling-pdf.nix b/nixos/modules/services/web-apps/stirling-pdf.nix
index ea7d7fbf54e5..48fe744b6014 100644
--- a/nixos/modules/services/web-apps/stirling-pdf.nix
+++ b/nixos/modules/services/web-apps/stirling-pdf.nix
@@ -59,6 +59,7 @@ in
           pngquant
           tesseract
           python3Packages.weasyprint
+          ghostscript_headless
         ]
         ++ lib.optional (cfg.environment.INSTALL_BOOK_AND_ADVANCED_HTML_OPS or "false" == "true") calibre;
 
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 32a52041e57a..c995016d85c7 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -168,7 +168,7 @@ in {
     assertions = [{
       assertion = !((cfg.channel != null) && (cfg.flake != null));
       message = ''
-        The options 'system.autoUpgrade.channels' and 'system.autoUpgrade.flake' cannot both be set.
+        The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
       '';
     }];
 
diff --git a/nixos/modules/tasks/filesystems/nfs.nix b/nixos/modules/tasks/filesystems/nfs.nix
index a81bec27bce2..f5e205e26e94 100644
--- a/nixos/modules/tasks/filesystems/nfs.nix
+++ b/nixos/modules/tasks/filesystems/nfs.nix
@@ -16,7 +16,7 @@ let
     lib.optionalAttrs (cfg.server.nproc != null) {
       nfsd.threads = cfg.server.nproc;
     } // lib.optionalAttrs (cfg.server.hostName != null) {
-      nfsd.host= cfg.hostName;
+      nfsd.host = cfg.server.hostName;
     } // lib.optionalAttrs (cfg.server.mountdPort != null) {
       mountd.port = cfg.server.mountdPort;
     } // lib.optionalAttrs (cfg.server.statdPort != null) {
diff --git a/nixos/tests/scion/freestanding-deployment/bootstrap.sh b/nixos/tests/scion/freestanding-deployment/bootstrap.sh
new file mode 100644
index 000000000000..3e2f7da07443
--- /dev/null
+++ b/nixos/tests/scion/freestanding-deployment/bootstrap.sh
@@ -0,0 +1,73 @@
+set -euo pipefail
+
+mkdir /tmp/tutorial-scion-certs && cd /tmp/tutorial-scion-certs
+mkdir AS{1..5}
+
+# Create voting and root keys and (self-signed) certificates for core ASes
+pushd AS1
+scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
+scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
+popd
+
+pushd AS2
+scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
+popd
+
+pushd AS3
+scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
+popd
+
+# Create the TRC (Trust Root Configuration)
+mkdir tmp
+echo '
+isd = 42
+description = "Demo ISD 42"
+serial_version = 1
+base_version = 1
+voting_quorum = 2
+
+core_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
+authoritative_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
+cert_files = ["AS1/sensitive-voting.pem", "AS1/regular-voting.pem", "AS1/cp-root.pem", "AS2/cp-root.pem", "AS3/sensitive-voting.pem", "AS3/regular-voting.pem"]
+
+[validity]
+not_before = '$(date +%s)'
+validity = "365d"' \
+> trc-B1-S1-pld.tmpl
+
+scion-pki trc payload --out=tmp/ISD42-B1-S1.pld.der --template trc-B1-S1-pld.tmpl
+rm trc-B1-S1-pld.tmpl
+
+# Sign and bundle the TRC
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-sensitive.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-regular.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-sensitive.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-regular.trc
+
+scion-pki trc combine tmp/ISD42-B1-S1.AS{1,3}-{sensitive,regular}.trc --payload tmp/ISD42-B1-S1.pld.der --out ISD42-B1-S1.trc
+rm tmp -r
+
+# Create CA key and certificate for issuing ASes
+pushd AS1
+scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+popd
+pushd AS2
+scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+popd
+
+# Create AS key and certificate chains
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+
+for i in {1..5}
+do
+  mkdir -p $out/AS$i
+  cp AS$i/cp-as.{key,pem} $out/AS$i
+done
+
+mv *.trc $out
diff --git a/nixos/tests/scion/freestanding-deployment/default.nix b/nixos/tests/scion/freestanding-deployment/default.nix
index e060f9c31270..55b2322ab02d 100644
--- a/nixos/tests/scion/freestanding-deployment/default.nix
+++ b/nixos/tests/scion/freestanding-deployment/default.nix
@@ -5,81 +5,8 @@ let
     buildInputs = [
       pkgs.scion
     ];
-  } ''
-    set -euo pipefail
+  } (builtins.readFile ./bootstrap.sh);
 
-    mkdir /tmp/tutorial-scion-certs && cd /tmp/tutorial-scion-certs
-    mkdir AS{1..5}
-
-    # Create voting and root keys and (self-signed) certificates for core ASes
-    pushd AS1
-    scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-    scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
-    scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
-    popd
-
-    pushd AS2
-    scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
-    popd
-
-    pushd AS3
-    scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-    scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
-    popd
-
-    # Create the TRC (Trust Root Configuration)
-    mkdir tmp
-    echo '
-    isd = 42
-    description = "Demo ISD 42"
-    serial_version = 1
-    base_version = 1
-    voting_quorum = 2
-
-    core_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
-    authoritative_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
-    cert_files = ["AS1/sensitive-voting.pem", "AS1/regular-voting.pem", "AS1/cp-root.pem", "AS2/cp-root.pem", "AS3/sensitive-voting.pem", "AS3/regular-voting.pem"]
-
-    [validity]
-    not_before = '$(date +%s)'
-    validity = "365d"' \
-    > trc-B1-S1-pld.tmpl
-
-    scion-pki trc payload --out=tmp/ISD42-B1-S1.pld.der --template trc-B1-S1-pld.tmpl
-    rm trc-B1-S1-pld.tmpl
-
-    # Sign and bundle the TRC
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-sensitive.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-regular.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-sensitive.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-regular.trc
-
-    scion-pki trc combine tmp/ISD42-B1-S1.AS{1,3}-{sensitive,regular}.trc --payload tmp/ISD42-B1-S1.pld.der --out ISD42-B1-S1.trc
-    rm tmp -r
-
-    # Create CA key and certificate for issuing ASes
-    pushd AS1
-    scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
-    popd
-    pushd AS2
-    scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
-    popd
-
-    # Create AS key and certificate chains
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
-
-    for i in {1..5}
-    do
-      mkdir -p $out/AS$i
-      cp AS$i/cp-as.{key,pem} $out/AS$i
-    done
-
-    mv *.trc $out
-  '';
   imports = hostId: [
     ({
       services.scion = {
@@ -121,9 +48,47 @@ in
     };
     scion04 = { ... }: {
       imports = (imports 4);
+      networking.interfaces."lo".ipv4.addresses = [{ address = "172.16.1.1"; prefixLength = 32; }];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.1.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:5" = {
+              Nets = [
+                "172.16.100.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
     };
     scion05 = { ... }: {
       imports = (imports 5);
+      networking.interfaces."lo".ipv4.addresses = [{ address = "172.16.100.1"; prefixLength = 32; }];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:4" = {
+              Nets = [
+                "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
     };
   };
   testScript = let
@@ -131,25 +96,35 @@ in
       addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
       timeout=100
       wait_for_all() {
+        ret=0
         for as in "$@"
         do
           scion showpaths $as --no-probe > /dev/null
-          return 1
+          ret=$?
+          if [ "$ret" -ne "0" ]; then
+            break
+          fi
         done
-        return 0
+        return $ret
       }
       ping_all() {
+        ret=0
         for as in "$@"
         do
           scion ping "$as,127.0.0.1" -c 3
+          ret=$?
+          if [ "$ret" -ne "0" ]; then
+            break
+          fi
         done
-        return 0
+        return $ret
       }
       for i in $(seq 0 $timeout); do
-        wait_for_all $addresses && exit 0
-        ping_all $addresses && exit 0
         sleep 1
+        wait_for_all $addresses || continue
+        ping_all $addresses && exit 0
       done
+      exit 1
     '';
   in
   ''
@@ -183,9 +158,16 @@ in
     # Wait for scion-control.service on all instances
     wait_for_unit("scion-control.service")
 
+    # Ensure cert is valid against TRC
+    succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
+
     # Execute pingAll command on all instances
     succeed("${pingAll} >&2")
 
+    # Execute ICMP pings across scion-ip-gateway
+    scion04.succeed("ping -c 3 172.16.100.1 >&2")
+    scion05.succeed("ping -c 3 172.16.1.1 >&2")
+
     # Restart all scion services and ping again to test robustness
     succeed("systemctl restart scion-* >&2")
     succeed("${pingAll} >&2")
diff --git a/nixos/tests/scion/freestanding-deployment/topology4.json b/nixos/tests/scion/freestanding-deployment/topology4.json
index 03c507a4daf5..0526c1f1edd6 100644
--- a/nixos/tests/scion/freestanding-deployment/topology4.json
+++ b/nixos/tests/scion/freestanding-deployment/topology4.json
@@ -36,5 +36,11 @@
         }
       }
     }
+  },
+  "sigs": {
+    "sig-1": {
+      "ctrl_addr": "127.0.0.1:30256",
+      "data_addr": "127.0.0.1:30056"
+    }
   }
 }
diff --git a/nixos/tests/scion/freestanding-deployment/topology5.json b/nixos/tests/scion/freestanding-deployment/topology5.json
index 6114c1f73c2a..1326bd3c2955 100644
--- a/nixos/tests/scion/freestanding-deployment/topology5.json
+++ b/nixos/tests/scion/freestanding-deployment/topology5.json
@@ -36,5 +36,11 @@
         }
       }
     }
+  },
+  "sigs": {
+    "sig-1": {
+      "ctrl_addr": "127.0.0.1:30256",
+      "data_addr": "127.0.0.1:30056"
+    }
   }
 }
diff --git a/pkgs/applications/audio/amberol/default.nix b/pkgs/applications/audio/amberol/default.nix
deleted file mode 100644
index 8ec6c3e6b1ab..000000000000
--- a/pkgs/applications/audio/amberol/default.nix
+++ /dev/null
@@ -1,79 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, rustPlatform
-, cargo
-, desktop-file-utils
-, appstream-glib
-, meson
-, ninja
-, pkg-config
-, reuse
-, rustc
-, m4
-, wrapGAppsHook4
-, glib
-, gtk4
-, gst_all_1
-, libadwaita
-, dbus
-}:
-
-stdenv.mkDerivation rec {
-  pname = "amberol";
-  version = "0.10.3";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
-    repo = pname;
-    rev = version;
-    hash = "sha256-nAoUO0bGToNGD2W8qJmTegrETOJDdM04hI1jjiYkZXI=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-4ZoliqQ665KPDFl+1eBCE+1fZgr+FA7vesPstoRs0RU=";
-  };
-
-  postPatch = ''
-    patchShebangs build-aux
-  '';
-
-  nativeBuildInputs = [
-    appstream-glib
-    desktop-file-utils
-    meson
-    ninja
-    pkg-config
-    reuse
-    m4
-    wrapGAppsHook4
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-  ];
-
-  buildInputs = [
-    glib
-    gtk4
-    libadwaita
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-libav
-    dbus
-  ];
-
-  meta = with lib; {
-    homepage = "https://gitlab.gnome.org/World/amberol";
-    description = "Small and simple sound and music player";
-    maintainers = with maintainers; [ linsui ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    mainProgram = "amberol";
-  };
-}
diff --git a/pkgs/applications/audio/cardinal/default.nix b/pkgs/applications/audio/cardinal/default.nix
index 9c318e916a45..74c7708a0588 100644
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cardinal";
-  version = "24.05";
+  version = "24.09";
 
   src = fetchurl {
     url = "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    hash = "sha256-ZUJI5utUtST+idlL7WKBIs850EpK98cnmO47g8/iZcI=";
+    hash = "sha256-vJxKtZ0rVjf0RJfTNRxpzps1F2k0hHuiPnd1OwpULhQ=";
   };
 
   prePatch = ''
diff --git a/pkgs/applications/audio/ncmpcpp/default.nix b/pkgs/applications/audio/ncmpcpp/default.nix
index e2ecb813f552..fdc377118d27 100644
--- a/pkgs/applications/audio/ncmpcpp/default.nix
+++ b/pkgs/applications/audio/ncmpcpp/default.nix
@@ -1,53 +1,88 @@
-{ lib
-, stdenv
-, fetchurl
-, boost
-, libmpdclient
-, ncurses
-, pkg-config
-, readline
-, libiconv
-, icu
-, curl
-, outputsSupport ? true # outputs screen
-, visualizerSupport ? false, fftw # visualizer screen
-, clockSupport ? true # clock screen
-, taglibSupport ? true, taglib # tag editor
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  boost,
+  libmpdclient,
+  ncurses,
+  pkg-config,
+  readline,
+  libiconv,
+  icu,
+  curl,
+  autoconf,
+  automake,
+  libtool,
+  outputsSupport ? true, # outputs screen
+  visualizerSupport ? false,
+  fftw, # visualizer screen
+  clockSupport ? true, # clock screen
+  taglibSupport ? true,
+  taglib, # tag editor
 }:
 
 stdenv.mkDerivation rec {
   pname = "ncmpcpp";
-  version = "0.9.2";
+  version = "0.10";
 
-  src = fetchurl {
-    url = "https://rybczak.net/ncmpcpp/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+qv2FXyMsbJKBZryduFi+p+aO5zTgQxDuRKIYMk4Ohs=";
+  src = fetchFromGitHub {
+    owner = "ncmpcpp";
+    repo = "ncmpcpp";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-HRJQ+IOQ8xP1QkPlLI+VtDUWaI2m0Aw0fCDWHhgsOLY=";
   };
 
   enableParallelBuilding = true;
 
   strictDeps = true;
 
-  configureFlags = [ "BOOST_LIB_SUFFIX=" ]
-    ++ lib.optional outputsSupport "--enable-outputs"
-    ++ lib.optional visualizerSupport "--enable-visualizer --with-fftw"
-    ++ lib.optional clockSupport "--enable-clock"
-    ++ lib.optional taglibSupport "--with-taglib";
+  configureFlags = [
+    "BOOST_LIB_SUFFIX="
+    (lib.enableFeature outputsSupport "outputs")
+    (lib.enableFeature visualizerSupport "enable-visualizer")
+    (lib.withFeature visualizerSupport "fftw")
+    (lib.enableFeature clockSupport "clock")
+    (lib.withFeature taglibSupport "taglib")
+  ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    libmpdclient
+    ncurses
+    readline
+    libiconv
+    icu
+    curl
+  ] ++ lib.optional visualizerSupport fftw
     ++ lib.optional taglibSupport taglib;
 
-  buildInputs = [ boost libmpdclient ncurses readline libiconv icu curl ]
-    ++ lib.optional visualizerSupport fftw
-    ++ lib.optional taglibSupport taglib;
+  preConfigure =
+    ''
+      ./autogen.sh
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      # std::result_of was removed in c++20 and unusable for clang16
+      substituteInPlace ./configure \
+        --replace-fail "std=c++20" "std=c++17"
+    '';
 
-  meta = with lib; {
+  meta =  {
     description = "Featureful ncurses based MPD client inspired by ncmpc";
-    homepage    = "https://rybczak.net/ncmpcpp/";
-    changelog   = "https://github.com/ncmpcpp/ncmpcpp/blob/${version}/CHANGELOG.md";
-    license     = licenses.gpl2Plus;
-    maintainers = with maintainers; [ koral lovek323 ];
-    platforms   = platforms.all;
+    homepage = "https://rybczak.net/ncmpcpp/";
+    changelog = "https://github.com/ncmpcpp/ncmpcpp/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      koral
+      lovek323
+    ];
+    platforms = lib.platforms.all;
     mainProgram = "ncmpcpp";
   };
 }
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index fdac36e492f2..1ffdeca5b38d 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -1,25 +1,11 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  python3,
 }:
 
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      pyunifiprotect = super.pyunifiprotect.overridePythonAttrs {
-        version = "unstable-2024-06-08";
-        src = fetchFromGitHub {
-          owner = "ep1cman";
-          repo = "pyunifiprotect";
-          rev = "d967bca2c65e0aa6a7363afb6367c3745c076747";
-          hash = "sha256-gSAK/T9cjIiRC/WjwrdLP+LHzEEUsNbwpXClYqpnMio=";
-        };
-      };
-    };
-  };
-in
-
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
   version = "0.11.0";
   pyproject = true;
@@ -31,18 +17,25 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-t4AgPFqKS6u9yITIkUUB19/SxVwR7X8Cc01oPx3M+E0=";
   };
 
+  patches = [
+    # Switch to using UIProtect library, https://github.com/ep1cman/unifi-protect-backup/pull/160
+    (fetchpatch {
+      name = "switch-uiprotect.patch";
+      url = "https://github.com/ep1cman/unifi-protect-backup/commit/ccf2cde27229ade5c70ebfa902f289bf1a439f64.patch";
+      hash = "sha256-kogl/crvLE+7t9DLTuZqeW3/WB5/sytWDgbndoBw+RQ=";
+    })
+  ];
+
   pythonRelaxDeps = [
     "aiorun"
     "aiosqlite"
     "click"
-    "pyunifiprotect"
+    "uiprotect"
   ];
 
-  nativeBuildInputs = with python.pkgs; [
-    poetry-core
-  ];
+  nativeBuildInputs = with python3.pkgs; [ poetry-core ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     aiocron
     aiolimiter
     aiorun
@@ -52,12 +45,10 @@ python.pkgs.buildPythonApplication rec {
     click
     expiring-dict
     python-dateutil
-    pyunifiprotect
+    uiprotect
   ];
 
-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Python tool to backup unifi event clips in realtime";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 7a6c1e0417b8..19e00aa288fa 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1816,8 +1816,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.9";
-          hash = "sha256-VsjISVDZGGh6/pf3Fd5g8pYDvWXA1+0oZKlQEGLBp4M=";
+          version = "0.7.10";
+          hash = "sha256-m8W21ztTmEOjDI1KCymeBgQzg9jdgKG9dCFp+U1D818=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
diff --git a/pkgs/applications/networking/cluster/calico/default.nix b/pkgs/applications/networking/cluster/calico/default.nix
index d5afb172885b..509a0385c850 100644
--- a/pkgs/applications/networking/cluster/calico/default.nix
+++ b/pkgs/applications/networking/cluster/calico/default.nix
@@ -2,16 +2,16 @@
 
 builtins.mapAttrs (pname: { doCheck ? true, mainProgram ? pname, subPackages }: buildGoModule rec {
   inherit pname;
-  version = "3.28.1";
+  version = "3.28.2";
 
   src = fetchFromGitHub {
     owner = "projectcalico";
     repo = "calico";
     rev = "v${version}";
-    hash = "sha256-IQGDuxk3ZDtrY/RLp2DfdCWtBNMTYPOitcVCcxH7HoY=";
+    hash = "sha256-ZENlUmSLI+aY33a69LNsfer/TLz8gmzxEv8Gddz6faU=";
   };
 
-  vendorHash = "sha256-F44n+n9jfGYBQC1I33ylp8ZJtMi+uzjOLeG+5MbVePs=";
+  vendorHash = "sha256-6ZHb4SUa22/KfN4B2hg710FOSpg69rlT9FbZ/wCjpDc=";
 
   inherit doCheck subPackages;
 
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index ca3321967031..66bd0f480bdb 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.20.2";
+  version = "5.20.3";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-JMpqZnlFMHC6b+nQ6UIcOF0HKz4VE8/YXEnofUMHhxY=";
+    hash = "sha256-WbXIg453VewOejX/hyGi1DEi0cSwcQ+hKUFG8Ne4cPE=";
   };
 
   vendorHash = "sha256-VkaFANSzKOpmHWUwFp7YjwvsJegcJOrvJOBNNAIxOak=";
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 9310154d0444..995284672bb8 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "rambox";
-  version = "2.3.4";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    hash = "sha256-YaLvqd0yr0wlsvjtoN/9GXoZIpjH26DInhWC0Vg62Rs=";
+    hash = "sha256-pm4Ji1gv5vNMgB9ZWNKMLZSUE9wBklQ/MnFOKHP+Rcc=";
   };
 
   desktopItem = (makeDesktopItem {
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index a6a6fe89aadd..c35ad2d2eef1 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240913";
+  version = "20240924-2";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-Rtoxa0LYL2ElBtt6KxRmKAkRDc8PNvRCoP0s51h+sIM=";
+    hash = "sha256-YnblQjZpKsnphbaRQ6FyHhssnns7U5VoNe/r3goQ0g8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index 40e1b8f10107..4fd9c7d7dec1 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     changelog = "https://github.com/nextcloud/desktop/releases/tag/v${version}";
-    description = "Nextcloud themed desktop client";
+    description = "Desktop sync client for Nextcloud";
     homepage = "https://nextcloud.com";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ kranzes SuperSandro2000 ];
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 54793401abbe..c9ff19468745 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -30,13 +30,13 @@ stdenv.mkDerivation rec {
   pname = "qbittorrent"
     + lib.optionalString (guiSupport && qtVersion == "5") "-qt5"
     + lib.optionalString (!guiSupport) "-nox";
-  version = "4.6.5";
+  version = "4.6.7";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qBittorrent";
     rev = "release-${version}";
-    hash = "sha256-umJObvPv4VjdAZdQEuhqFCRvi1eZQViu1IO88oeTTq8=";
+    hash = "sha256-vUC8YIuyoGnl46FajfJG/XFXG+2lM9EaHWl2Hfo3T7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/shellhub-agent/default.nix b/pkgs/applications/networking/shellhub-agent/default.nix
index 192f8f02c71c..c4b6ffdba0a5 100644
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@@ -11,18 +11,18 @@
 
 buildGoModule rec {
   pname = "shellhub-agent";
-  version = "0.16.0";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    hash = "sha256-CJ9ZkoQmZlDI9mgZkEOWuJn66Dvt2f1DjPGf140qJDg=";
+    hash = "sha256-oIRMzifp/MVw+0s/QjhZpW7HEjNPHiCyEoNQq6ZRBGE=";
   };
 
   modRoot = "./agent";
 
-  vendorHash = "sha256-QWscqQlkvpfvJnI4C74qqD2P9V7ZAY29kCLF1WTTJ7Q=";
+  vendorHash = "sha256-qqh9KdhOt6KDgwUhf6lzb6I7YAhocBSZ7UeyBT0e0eM=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index a76ad3ab4421..87f7080f2fd4 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.68.0";
+  version = "1.68.1";
 
   outputs = [ "out" "man" ];
 
@@ -14,7 +14,7 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     rev = "v${version}";
-    hash = "sha256-xLTzfS3/9XBqh0B7/VeRKYEHAgc4rY3QcIUS3f1/e0M=";
+    hash = "sha256-qVk1l6PLB2S9KlUiccBN60wbaApZnPXTjq1LYsf7pyE=";
   };
 
   vendorHash = "sha256-vZxdayoKTo/fs5PgEdT4gepNq0kNNmLQhlybWY5kpx0=";
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index 3dc090921941..b0e51f5a8e54 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -25,13 +25,13 @@
 }:
 
 let
-  version = "2.11.6";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RNX+KS2h9zrOK8QzeQWH55pkNPTDW4gic2HLG+XXLRg=";
+    hash = "sha256-txqwVGLUel74ObCqwMWSqa4Nd2eDRf0SqAIes5tlMDg=";
   };
 
   # subpath installation is broken with uvicorn >= 0.26
@@ -76,7 +76,7 @@ let
       cd src-ui
     '';
 
-    npmDepsHash = "sha256-ML1Yp3JIMbRF6kVu190ReoY7oDUtUfNkHE7dHF6YUAE=";
+    npmDepsHash = "sha256-hb2z2cPMTN5bHtUldTR5Mvgo4nZL8/S+Uhfis37gF44=";
 
     nativeBuildInputs = [
       pkg-config
@@ -116,16 +116,22 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "paperless-ngx";
-  format = "other";
+  pyproject = false;
 
   inherit version src;
 
+  postPatch = ''
+    # pytest-xdist makes the tests flaky
+    substituteInPlace src/setup.cfg \
+      --replace-fail "--numprocesses auto --maxprocesses=16" ""
+  '';
+
   nativeBuildInputs = [
     gettext
     xorg.lndir
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
     bleach
     channels
     channels-redis
@@ -192,7 +198,7 @@ python.pkgs.buildPythonApplication rec {
   '';
 
   installPhase = let
-    pythonPath = python.pkgs.makePythonPath propagatedBuildInputs;
+    pythonPath = python.pkgs.makePythonPath dependencies;
   in ''
     runHook preInstall
 
@@ -203,7 +209,7 @@ python.pkgs.buildPythonApplication rec {
     makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
       --prefix PYTHONPATH : "${pythonPath}" \
       --prefix PATH : "${path}"
-    makeWrapper ${python.pkgs.celery}/bin/celery $out/bin/celery \
+    makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
       --prefix PYTHONPATH : "${pythonPath}:$out/lib/paperless-ngx/src" \
       --prefix PATH : "${path}"
 
@@ -225,7 +231,6 @@ python.pkgs.buildPythonApplication rec {
     pytest-httpx
     pytest-mock
     pytest-rerunfailures
-    pytest-xdist
     pytestCheckHook
   ];
 
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index ebc72aa2aabd..7c10b9953cdc 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.11.2";
+  version = "4.11.4";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-yEe8zBaczCCY5Cs9lIc2J3GYSeDwmB1vsX9cANXQIC0=";
+    hash = "sha256-ADNMSXvfeAT53coAtCu3CVCU5XUFhLbvAH3WPFoKJVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/messer-slim/default.nix b/pkgs/applications/science/biology/messer-slim/default.nix
index 3812e9980cdf..24b9a96019da 100644
--- a/pkgs/applications/science/biology/messer-slim/default.nix
+++ b/pkgs/applications/science/biology/messer-slim/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, gcc, gcc-unwrapped }:
 
 stdenv.mkDerivation rec {
-  version = "4.2.2";
+  version = "4.3";
   pname = "messer-slim";
 
   src = fetchFromGitHub {
     owner = "MesserLab";
     repo = "SLiM";
     rev = "v${version}";
-    sha256 = "sha256-TlB7Hj4pVN4p4VanACWjQBeTxP9/DvRvdCdgelrXx60=";
+    hash = "sha256-Hgh1ianEdITRUIDKLiLW32kQlPlXKIfN4PSv3cOXTGI=";
   };
 
   nativeBuildInputs = [ cmake gcc gcc-unwrapped ];
diff --git a/pkgs/applications/science/misc/foldingathome/control.nix b/pkgs/applications/science/misc/foldingathome/control.nix
deleted file mode 100644
index a64c973914c6..000000000000
--- a/pkgs/applications/science/misc/foldingathome/control.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ lib, stdenv
-, dpkg
-, fahviewer
-, fetchurl
-, makeWrapper
-, python2
-}:
-let
-  majMin = lib.versions.majorMinor version;
-  version = "7.6.21";
-
-  python = python2.withPackages
-    (
-      ps: [
-        ps.pycairo
-        ps.pygobject2
-        ps.pygtk
-      ]
-    );
-in
-stdenv.mkDerivation rec {
-  inherit version;
-  pname = "fahcontrol";
-
-  src = fetchurl {
-    url = "https://download.foldingathome.org/releases/public/release/fahcontrol/debian-stable-64bit/v${majMin}/fahcontrol_${version}-1_all.deb";
-    sha256 = "1vfrdqkrvdlyxaw3f6z92w5dllrv6810lmf8yhcmjcwmphipvf71";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    makeWrapper
-  ];
-
-  buildInputs = [ fahviewer python ];
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-  '';
-
-  installPhase = "cp -ar usr $out";
-
-  postFixup = ''
-    sed -e "s|/usr/bin|$out/bin|g" -i $out/share/applications/FAHControl.desktop
-    wrapProgram "$out/bin/FAHControl" \
-      --suffix PATH : "${fahviewer.outPath}/bin" \
-      --set PYTHONPATH "$out/lib/python2.7/dist-packages"
-  '';
-
-  meta = {
-    description = "Folding@home control";
-    homepage = "https://foldingathome.org/";
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.zimbatm ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/science/misc/foldingathome/viewer.nix b/pkgs/applications/science/misc/foldingathome/viewer.nix
deleted file mode 100644
index bb2c3c0abe30..000000000000
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ lib, stdenv
-, autoPatchelfHook
-, dpkg
-, fetchurl
-, libglut
-, gcc-unwrapped
-, libGL
-, libGLU
-, makeWrapper
-, zlib
-}:
-let
-  majMin = lib.versions.majorMinor version;
-  version = "7.6.21";
-in
-stdenv.mkDerivation rec {
-  inherit version;
-  pname = "fahviewer";
-
-  src = fetchurl {
-    url = "https://download.foldingathome.org/releases/public/release/fahviewer/debian-stable-64bit/v${majMin}/fahviewer_${version}_amd64.deb";
-    sha256 = "00fd00pf6fcpplcaahvy9ir60mk69d9rcmwsyq3jrv9mxqm9aq7p";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-  ];
-
-  buildInputs = [
-    libglut
-    gcc-unwrapped.lib
-    libGL
-    libGLU
-    zlib
-  ];
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-    sed -e "s|/usr/bin|$out/bin|g" -i usr/share/applications/FAHViewer.desktop
-  '';
-
-  installPhase = ''
-    cp -ar usr $out
-  '';
-
-  meta = {
-    description = "Folding@home viewer";
-    homepage = "https://foldingathome.org/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.zimbatm ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index 86978c7cf7cf..f9c59ad18ebf 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.46";
+  version = "2.47";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    hash = "sha256-eWRDarMx0QzTdTx3nFl1y12k25NqxGzuhLZd52Yr4qU=";
+    hash = "sha256-LFzUvDMNGxp5HzdjlaN0VS7HpIzN8GA5MQL61teKRvo=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 0d7d036d6618..928480e6c4f6 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -323,15 +323,15 @@ rec {
   };
 
   docker_27 = callPackage dockerGen rec {
-    version = "27.2.0";
+    version = "27.3.0";
     cliRev = "v${version}";
-    cliHash = "sha256-Fa1EUwJjxh5jzhQJ4tllDZBfB7KACHDEe9ETVzMfUNY=";
+    cliHash = "sha256-1z2MmWq+HD2fhpZqXu0G7oBL3Mc0NN/fR69aMWRelns=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-grxKlsbhxumQZNOyM96aURSiVFE1Fe5NFxUoPzFX/Qk=";
-    runcRev = "v1.1.13";
-    runcHash = "sha256-RQsM8Q7HogDVGbNpen3wxXNGR9lfqmNhkXTRoC+LBk8=";
-    containerdRev = "v1.7.21";
-    containerdHash = "sha256-cL1RKFg+B2gTPMg963DKup5BCLLgF9t9VZn2WlmmWPI=";
+    mobyHash = "sha256-AKl06k2ePWOFhL3oH086HcLLYs2Da+wLOcGjGnQ0SXE=";
+    runcRev = "v1.1.14";
+    runcHash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
+    containerdRev = "v1.7.22";
+    containerdHash = "sha256-8IHBKai4PvvTuHPDTgx9wFEBzz4MM7Mwo8Q/bzFRzfk=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
diff --git a/pkgs/applications/virtualization/spike/default.nix b/pkgs/applications/virtualization/spike/default.nix
index 171268504811..d0e79c4f9812 100644
--- a/pkgs/applications/virtualization/spike/default.nix
+++ b/pkgs/applications/virtualization/spike/default.nix
@@ -1,30 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, dtc, pkgsCross }:
+{ lib, stdenv, fetchFromGitHub, dtc, pkgsCross }:
 
 stdenv.mkDerivation rec {
   pname = "spike";
-  version = "1.1.0";
+  version = "1.1.0-unstable-2024-09-21";
 
   src = fetchFromGitHub {
     owner = "riscv";
     repo = "riscv-isa-sim";
-    rev = "v${version}";
-    sha256 = "sha256-4D2Fezej0ioOOupw3kgMT5VLs+/jXQjwvek6v0AVMzI=";
+    rev = "de5094a1a901d77ff44f89b38e00fefa15d4018e";
+    sha256 = "sha256-mAgR2VzDgeuIdmPEgrb+MaA89BnWfmNanOVidqn0cgc=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fesvr-fix-compilation-with-gcc-13.patch";
-      url = "https://github.com/riscv-software-src/riscv-isa-sim/commit/0a7bb5403d0290cea8b2356179d92e4c61ffd51d.patch";
-      hash = "sha256-JUMTbGawvLkoOWKkruzLzUFQytVR3wqTlGu/eegRFEE=";
-    })
-  ];
-
   nativeBuildInputs = [ dtc ];
   enableParallelBuilding = true;
 
   postPatch = ''
     patchShebangs scripts/*.sh
-    patchShebangs tests/ebreak.py
   '';
 
   doCheck = true;
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 033bce988ae9..c19df2937539 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -907,6 +907,7 @@ rec {
     , config ? { }
     , architecture ? defaultArchitecture
     , created ? "1970-01-01T00:00:01Z"
+    , mtime ? "1970-01-01T00:00:01Z"
     , uid ? 0
     , gid ? 0
     , uname ? "root"
@@ -1009,7 +1010,7 @@ rec {
 
         conf = runCommand "${baseName}-conf.json"
           {
-            inherit fromImage maxLayers created uid gid uname gname;
+            inherit fromImage maxLayers created mtime uid gid uname gname;
             imageName = lib.toLower name;
             preferLocalBuild = true;
             passthru.imageTag =
@@ -1029,10 +1030,13 @@ rec {
             imageTag="${tag}"
           ''}
 
-          # convert "created" to iso format
+          # convert "created" and "mtime" to iso format
           if [[ "$created" != "now" ]]; then
               created="$(date -Iseconds -d "$created")"
           fi
+          if [[ "$mtime" != "now" ]]; then
+              mtime="$(date -Iseconds -d "$mtime")"
+          fi
 
           paths() {
             cat $paths ${lib.concatMapStringsSep " "
@@ -1089,6 +1093,7 @@ rec {
               "customisation_layer", $customisation_layer,
               "repo_tag": $repo_tag,
               "created": $created,
+              "mtime": $mtime,
               "uid": $uid,
               "gid": $gid,
               "uname": $uname,
@@ -1100,6 +1105,7 @@ rec {
               --arg customisation_layer ${customisationLayer} \
               --arg repo_tag "$imageName:$imageTag" \
               --arg created "$created" \
+              --arg mtime "$mtime" \
               --arg uid "$uid" \
               --arg gid "$gid" \
               --arg uname "$uname" \
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
index d3778625ccdf..0078c1cb764e 100644
--- a/pkgs/build-support/docker/stream_layered_image.py
+++ b/pkgs/build-support/docker/stream_layered_image.py
@@ -307,6 +307,15 @@ def add_bytes(tar, path, content, mtime):
     tar.addfile(ti, io.BytesIO(content))
 
 
+now = datetime.now(tz=timezone.utc)
+
+
+def parse_time(s):
+    if s == "now":
+        return now
+    return datetime.fromisoformat(s)
+
+
 def main():
     arg_parser = argparse.ArgumentParser(
         description="""
@@ -342,12 +351,8 @@ Docker Image Specification v1.2 as reference [1].
     with open(args.conf, "r") as f:
         conf = json.load(f)
 
-    created = (
-        datetime.now(tz=timezone.utc)
-        if conf["created"] == "now"
-        else datetime.fromisoformat(conf["created"])
-    )
-    mtime = int(created.timestamp())
+    created = parse_time(conf["created"])
+    mtime = int(parse_time(conf["mtime"]).timestamp())
     uid = int(conf["uid"])
     gid = int(conf["gid"])
     uname = conf["uname"]
diff --git a/pkgs/by-name/ae/aerogramme/0001-update-time-rs.patch b/pkgs/by-name/ae/aerogramme/0001-update-time-rs.patch
new file mode 100644
index 000000000000..cbfffbe09018
--- /dev/null
+++ b/pkgs/by-name/ae/aerogramme/0001-update-time-rs.patch
@@ -0,0 +1,59 @@
+From ad754664a05808bdbb976906a86ad0b08f16eb32 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 20:38:19 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 0a159ae..cf6b1c4 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -2468,6 +2468,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
++[[package]]
++name = "num-conv"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++
+ [[package]]
+ name = "num-integer"
+ version = "0.1.45"
+@@ -3579,12 +3585,13 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.31"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
++ "num-conv",
+  "powerfmt",
+  "serde",
+  "time-core",
+@@ -3599,10 +3606,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.16"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
++ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
diff --git a/pkgs/by-name/ae/aerogramme/Cargo.lock b/pkgs/by-name/ae/aerogramme/Cargo.lock
index 0a159ae3487d..cf6b1c43b0eb 100644
--- a/pkgs/by-name/ae/aerogramme/Cargo.lock
+++ b/pkgs/by-name/ae/aerogramme/Cargo.lock
@@ -2468,6 +2468,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@@ -3579,12 +3585,13 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
+ "num-conv",
  "powerfmt",
  "serde",
  "time-core",
@@ -3599,10 +3606,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
diff --git a/pkgs/by-name/ae/aerogramme/package.nix b/pkgs/by-name/ae/aerogramme/package.nix
index 86e3ef5b7dd9..49379db4a2c6 100644
--- a/pkgs/by-name/ae/aerogramme/package.nix
+++ b/pkgs/by-name/ae/aerogramme/package.nix
@@ -6,17 +6,20 @@
   openssl,
 }:
 
-rustPlatform.buildRustPackage {
-  RUSTC_BOOTSTRAP = true;
-
+rustPlatform.buildRustPackage rec {
   pname = "aerogramme";
   version = "0.3.0";
 
   src = fetchgit {
     url = "https://git.deuxfleurs.fr/Deuxfleurs/aerogramme/";
+    rev = "refs/tags/${version}";
     hash = "sha256-ER+P/XGqNzTLwDLK5EBZq/Dl29ZZKl2FdxDb+oLEJ8Y=";
   };
 
+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
   # must use our own Cargo.lock due to git dependencies
   cargoLock = {
     lockFile = ./Cargo.lock;
@@ -31,8 +34,11 @@ rustPlatform.buildRustPackage {
   # disable network tests as Nix sandbox breaks them
   doCheck = false;
 
-  # get openssl-sys to use pkg-config
-  OPENSSL_NO_VENDOR = 1;
+  env = {
+    # get openssl-sys to use pkg-config
+    OPENSSL_NO_VENDOR = true;
+    RUSTC_BOOTSTRAP = true;
+  };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/am/amberol/package.nix b/pkgs/by-name/am/amberol/package.nix
new file mode 100644
index 000000000000..ba530618be91
--- /dev/null
+++ b/pkgs/by-name/am/amberol/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  rustPlatform,
+  cargo,
+  desktop-file-utils,
+  appstream-glib,
+  meson,
+  ninja,
+  pkg-config,
+  reuse,
+  rustc,
+  m4,
+  wrapGAppsHook4,
+  glib,
+  gtk4,
+  gst_all_1,
+  libadwaita,
+  dbus,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "amberol";
+  version = "2024.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "amberol";
+    rev = version;
+    hash = "sha256-WuyvTgh9Qc5WcgEssxkytwQpSACd82l5WKeMD0NFOp8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "amberol-${version}";
+    hash = "sha256-C1ENyNUpgwGlZus/zIWD1mUrmWT9L0fH/1T4QaIxGJw=";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    cargo
+    desktop-file-utils
+    m4
+    meson
+    ninja
+    pkg-config
+    reuse
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      dbus
+      glib
+      gtk4
+      libadwaita
+    ]
+    ++ (with gst_all_1; [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+      gst-libav
+    ]);
+
+  meta = {
+    homepage = "https://gitlab.gnome.org/World/amberol";
+    description = "Small and simple sound and music player";
+    maintainers = with lib.maintainers; [ linsui ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "amberol";
+  };
+}
diff --git a/pkgs/by-name/an/anchor/0001-update-time-rs.patch b/pkgs/by-name/an/anchor/0001-update-time-rs.patch
new file mode 100644
index 000000000000..7b6a5852889f
--- /dev/null
+++ b/pkgs/by-name/an/anchor/0001-update-time-rs.patch
@@ -0,0 +1,88 @@
+From ff4dfb52767695c066b4ad027983c0d4958094b3 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 17:20:19 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index d588e86c..f09caad8 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1432,9 +1432,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
++version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
++checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
++dependencies = [
++ "powerfmt",
++]
+ 
+ [[package]]
+ name = "derivation-path"
+@@ -2629,6 +2632,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
++[[package]]
++name = "num-conv"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++
+ [[package]]
+ name = "num-derive"
+ version = "0.3.3"
+@@ -3014,6 +3023,12 @@ dependencies = [
+  "rand 0.8.5",
+ ]
+ 
++[[package]]
++name = "powerfmt"
++version = "0.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
++
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -5276,12 +5291,14 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.29"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
++ "num-conv",
++ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -5295,10 +5312,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.15"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
++ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
diff --git a/pkgs/by-name/an/anchor/Cargo.lock b/pkgs/by-name/an/anchor/Cargo.lock
index d588e86c40e2..f09caad8dbf9 100644
--- a/pkgs/by-name/an/anchor/Cargo.lock
+++ b/pkgs/by-name/an/anchor/Cargo.lock
@@ -1432,9 +1432,12 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
 
 [[package]]
 name = "derivation-path"
@@ -2629,6 +2632,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@@ -3014,6 +3023,12 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -5276,12 +5291,14 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.29"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
+ "num-conv",
+ "powerfmt",
  "serde",
  "time-core",
  "time-macros",
@@ -5295,10 +5312,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
diff --git a/pkgs/by-name/an/anchor/package.nix b/pkgs/by-name/an/anchor/package.nix
index 40276f51a2b0..78165b6b1224 100644
--- a/pkgs/by-name/an/anchor/package.nix
+++ b/pkgs/by-name/an/anchor/package.nix
@@ -1,8 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, stdenv
-, darwin
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -17,6 +18,10 @@ rustPlatform.buildRustPackage rec {
     fetchSubmodules = true;
   };
 
+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
@@ -36,7 +41,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=tests::test_get_anchor_version_from_commit"
   ];
 
-
   meta = with lib; {
     description = "Solana Sealevel Framework";
     homepage = "https://github.com/coral-xyz/anchor";
diff --git a/pkgs/by-name/ba/bazecor/package.nix b/pkgs/by-name/ba/bazecor/package.nix
index fbab03b3cf5e..548b6bbdf88f 100644
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@@ -6,12 +6,12 @@
 }:
 let
   pname = "bazecor";
-  version = "1.4.5";
+  version = "1.5.0";
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-cvzUjOmeTWB07vSe6taUyGDmTlN62fhsQw/OMgvIJ2M=";
+      hash = "sha256-cxDTNtxy2APAjnHw/cVd1/hUazASJs46rCHNGQ/JbSM=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
diff --git a/pkgs/development/tools/bloaty/default.nix b/pkgs/by-name/bl/bloaty/package.nix
similarity index 72%
rename from pkgs/development/tools/bloaty/default.nix
rename to pkgs/by-name/bl/bloaty/package.nix
index 1393a7ca54e9..fab4550cbdb0 100644
--- a/pkgs/development/tools/bloaty/default.nix
+++ b/pkgs/by-name/bl/bloaty/package.nix
@@ -1,16 +1,19 @@
-{ lib, stdenv, cmake, zlib, fetchFromGitHub, re2, abseil-cpp, protobuf, capstone, gtest, pkg-config, lit, llvmPackages_16 }:
-
-stdenv.mkDerivation rec {
-  pname = "bloaty";
-  version = "1.1-unstable-2023-11-06";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "bloaty";
-    rev = "16f9fe54d9cd0e9abe1d25fc1a9b44c214cfaa9f";
-    hash = "sha256-mIVlNMKtJMfH2QdYZ6+oV7619oYzvKkq3fHY6uofqlM=";
-  };
-
+{
+  lib,
+  stdenv,
+  cmake,
+  zlib,
+  fetchFromGitHub,
+  re2,
+  abseil-cpp,
+  protobuf,
+  capstone,
+  gtest,
+  pkg-config,
+  lit,
+  llvmPackages_16,
+}:
+let
   # Old vendored package which has no other use than here, so not packaged in nixpkgs.
   demumble = fetchFromGitHub {
     owner = "nico";
@@ -18,6 +21,17 @@ stdenv.mkDerivation rec {
     rev = "01098eab821b33bd31b9778aea38565cd796aa85";
     hash = "sha256-605SsXd7TSdm3BH854ChHIZbOXcHI/n8RN+pFMz4Ex4=";
   };
+in
+stdenv.mkDerivation {
+  pname = "bloaty";
+  version = "1.1-unstable-2024-09-23";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "bloaty";
+    rev = "0c89acd7e8b9d91fd1e9c8c129be627b4e47f1ea";
+    hash = "sha256-txZDPytWnkjkiVkPL2SWLwCPEtVvqoI/MVRvbJ2kBGw=";
+  };
 
   cmakeFlags = [
     "-DLIT_EXECUTABLE=${lit}/bin/lit"
@@ -39,9 +53,21 @@ stdenv.mkDerivation rec {
     rm -rf tests/wasm
   '';
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = [ zlib re2 abseil-cpp protobuf capstone gtest lit llvmPackages_16.libllvm ];
+  buildInputs = [
+    zlib
+    re2
+    abseil-cpp
+    protobuf
+    capstone
+    gtest
+    lit
+    llvmPackages_16.libllvm
+  ];
 
   doCheck = true;
 
@@ -54,12 +80,12 @@ stdenv.mkDerivation rec {
     install -Dm755 {.,$out/bin}/bloaty
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Size profiler for binaries";
     mainProgram = "bloaty";
     homepage = "https://github.com/google/bloaty";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ momeemt ];
   };
 }
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index 42d619d4302a..85cf62c4c80e 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "4.10.4";
+  version = "4.11.0";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     rev = "v${version}";
-    hash = "sha256-TjT93nx52PxuHuW4NONTfI3G7+Dl0NFX2aKpZDEF8+8=";
+    hash = "sha256-SmG8JMHdFTGkxLCTTbD1IhjQgmsRMvxQsB4rluHy6yI=";
   };
 
   nativeBuildInputs =
@@ -28,7 +28,7 @@ buildNpmPackage rec {
       copyDesktopItems
     ];
 
-  npmDepsHash = "sha256-WkOn1bLJ9xmJdQcY6ak+hs/YW+crIXhTWA6tjMSVq9I=";
+  npmDepsHash = "sha256-vbwoKijDt7TbXfU8Il5dwnfyGc2HsbLdAJhQzYuq6eo=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
diff --git a/pkgs/by-name/ca/cargo2junit/0001-update-time-rs.patch b/pkgs/by-name/ca/cargo2junit/0001-update-time-rs.patch
new file mode 100644
index 000000000000..a76deea7a0e8
--- /dev/null
+++ b/pkgs/by-name/ca/cargo2junit/0001-update-time-rs.patch
@@ -0,0 +1,154 @@
+From 84e19417eb0c7768922cd5e05bc246b278c64ce2 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 21:12:03 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 61 ++++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 43 insertions(+), 18 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index c56ff81..b20dca4 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -28,6 +28,15 @@ dependencies = [
+  "strip-ansi-escapes",
+ ]
+ 
++[[package]]
++name = "deranged"
++version = "0.3.11"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
++dependencies = [
++ "powerfmt",
++]
++
+ [[package]]
+ name = "derive-getters"
+ version = "0.2.0"
+@@ -64,20 +73,32 @@ version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
++[[package]]
++name = "num-conv"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++
++[[package]]
++name = "powerfmt"
++version = "0.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
++
+ [[package]]
+ name = "proc-macro2"
+-version = "1.0.55"
++version = "1.0.86"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1d0dd4be24fcdcfeaa12a432d588dc59bbad6cad3510c67e74a2b6b2fc950564"
++checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+ dependencies = [
+  "unicode-ident",
+ ]
+ 
+ [[package]]
+ name = "quote"
+-version = "1.0.26"
++version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
++checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+ dependencies = [
+  "proc-macro2",
+ ]
+@@ -107,22 +128,22 @@ checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+ 
+ [[package]]
+ name = "serde"
+-version = "1.0.159"
++version = "1.0.210"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3c04e8343c3daeec41f58990b9d77068df31209f2af111e059e9fe9646693065"
++checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+ dependencies = [
+  "serde_derive",
+ ]
+ 
+ [[package]]
+ name = "serde_derive"
+-version = "1.0.159"
++version = "1.0.210"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4c614d17805b093df4b147b51339e7e44bf05ef59fba1e45d83500bcfb4d8585"
++checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.13",
++ "syn 2.0.77",
+ ]
+ 
+ [[package]]
+@@ -158,9 +179,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "syn"
+-version = "2.0.13"
++version = "2.0.77"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4c9da457c5285ac1f936ebd076af6dac17a61cfe7826f2076b4d015cf47bc8ec"
++checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -184,16 +205,19 @@ checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.13",
++ "syn 2.0.77",
+ ]
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.20"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
++ "deranged",
+  "itoa",
++ "num-conv",
++ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -201,16 +225,17 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.0"
++version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
++checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.8"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fd80a657e71da814b8e5d60d3374fc6d35045062245d80224748ae522dd76f36"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
++ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
diff --git a/pkgs/development/tools/rust/cargo2junit/default.nix b/pkgs/by-name/ca/cargo2junit/package.nix
similarity index 75%
rename from pkgs/development/tools/rust/cargo2junit/default.nix
rename to pkgs/by-name/ca/cargo2junit/package.nix
index 907d92e3c437..f2aac9a19180 100644
--- a/pkgs/development/tools/rust/cargo2junit/default.nix
+++ b/pkgs/by-name/ca/cargo2junit/package.nix
@@ -1,4 +1,8 @@
-{ fetchCrate, lib, rustPlatform }:
+{
+  fetchCrate,
+  lib,
+  rustPlatform,
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo2junit";
@@ -9,7 +13,11 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-R3a87nXCnGhdeyR7409hFR5Cj3TFUWqaLNOtlXPsvto=";
   };
 
-  cargoHash = "sha256-u5Pd967qxjqFl9fV/KkClLDBwKql7p66WqbIVBvWKuM=";
+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
+  cargoHash = "sha256-ncRELlbT8Dy8huLgZrroRWohCLeN5cRjMWrIW4JNcCM=";
 
   meta = with lib; {
     description = "Converts cargo's json output (from stdin) to JUnit XML (to stdout)";
diff --git a/pkgs/by-name/cy/cyme/package.nix b/pkgs/by-name/cy/cyme/package.nix
index 401b175b463a..f1a1ca496bf8 100644
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cyme";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${version}";
-    hash = "sha256-bmVgl6E+MdjzM4wfhKHdii+58srAStRTYU+IP/OTqdU=";
+    hash = "sha256-DFO12ylrUIPxxOf3+sSXf/MN918U/IUeUfr72Lbnxvc=";
   };
 
-  cargoHash = "sha256-dpdtjeejt+jfSlSN1NZeAWSMcDq8mOGAHTJlmBkp/4s=";
+  cargoHash = "sha256-uw+Z0F2NoU1BFGwsNaIKT9hWclhqmJK2se5mm0xUQyc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 6ef7fb885233..f0409ac39041 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "databricks-cli";
-  version = "0.227.0";
+  version = "0.228.1";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-bmTPtxkVtGzjxgmXpIHus7vUUg3IKGWmlUT8iOU+dtM=";
+    hash = "sha256-zQ39PwVjyxOTo6P+RA4F20/28loMbu3Bprd4C3jgu5A=";
   };
 
-  vendorHash = "sha256-ItcGzgGIDQOnAwUA/mPy+oNjChKPTVo7QK3gsidB1xQ=";
+  vendorHash = "sha256-SOeVIwMbx1eRzBvyfT3aaJOL7BCb745yezn1QYrf5vU=";
 
   excludedPackages = [ "bundle/internal" ];
 
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index f940c8390f7b..b69d67556ea4 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -27,7 +27,7 @@ let
     doInstallCheck = false;
   });
 
-  version = "1.1";
+  version = "1.2";
 in rustPlatform.buildRustPackage {
   pname = "devenv";
   inherit version;
@@ -36,10 +36,10 @@ in rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-7o2OBUwE51ZNMCBB4rg5LARc8S6C9vuzRXnqk3d/lN4=";
+    hash = "sha256-95MYldiApQ7gqoUa79yolPahudKmFv6B2HnF+ZqWiGI=";
   };
 
-  cargoHash = "sha256-Yos8iOWfRJcOqbanskUg75cX05dvxWnq42NhmQt/jf4=";
+  cargoHash = "sha256-A2s+DXq00T0DCVXUHy2ZN6XvqpHy6PmL0H9l1NIfFVU=";
 
   buildAndTestSubdir = "devenv";
 
diff --git a/pkgs/development/tools/ejs/default.nix b/pkgs/by-name/ej/ejs/package.nix
similarity index 66%
rename from pkgs/development/tools/ejs/default.nix
rename to pkgs/by-name/ej/ejs/package.nix
index b9242836b62b..90934f9002ec 100644
--- a/pkgs/development/tools/ejs/default.nix
+++ b/pkgs/by-name/ej/ejs/package.nix
@@ -1,17 +1,20 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
 }:
-
-buildNpmPackage rec {
+let
+  version = "3.1.10";
+in
+buildNpmPackage {
   pname = "ejs";
-  version = "3.1.9";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "mde";
     repo = "ejs";
     rev = "v${version}";
-    hash = "sha256-bOZclhsnV3onxc32ZGfLpuGS5Jz6S12/BmkmwL4M6Dg=";
+    hash = "sha256-3Rq+7oiYJlIY7sGPasx728sz2zj0ndAvKpHGsQX4tlc=";
   };
 
   npmDepsHash = "sha256-829eWfJiMw9KRlhdmzD0ha//bgUQ5nPEzO+ayUPLxXY=";
@@ -29,6 +32,6 @@ buildNpmPackage rec {
     homepage = "http://ejs.co";
     license = lib.licenses.asl20;
     mainProgram = "ejs";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ momeemt ];
   };
 }
diff --git a/pkgs/by-name/fa/fastcompmgr/package.nix b/pkgs/by-name/fa/fastcompmgr/package.nix
new file mode 100644
index 000000000000..82d8f711ee3b
--- /dev/null
+++ b/pkgs/by-name/fa/fastcompmgr/package.nix
@@ -0,0 +1,45 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  xorg,
+  pkgs,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fastcompmgr";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "tycho-kirchner";
+    repo = "fastcompmgr";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-UKX0gjhbbXSXfyw/NGA31vTOfgd4kdnxO7lIs+mkgFs=";
+  };
+
+  nativeBuildInputs = [ pkgs.pkg-config ];
+
+  buildInputs = [
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXdamage
+    xorg.libXfixes
+    xorg.libXrender
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp fastcompmgr $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast compositor for X11";
+    homepage = "https://github.com/tycho-kirchner/fastcompmgr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ camerondugan ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fo/follow/package.nix b/pkgs/by-name/fo/follow/package.nix
new file mode 100644
index 000000000000..dba8ba8eb2cc
--- /dev/null
+++ b/pkgs/by-name/fo/follow/package.nix
@@ -0,0 +1,107 @@
+{
+  electron,
+  fetchFromGitHub,
+  imagemagick,
+  lib,
+  makeDesktopItem,
+  makeWrapper,
+  nodejs,
+  pnpm,
+  stdenv,
+}:
+stdenv.mkDerivation rec {
+  pname = "follow";
+
+  version = "0.0.1-alpha.17";
+
+  src = fetchFromGitHub {
+    owner = "RSSNext";
+    repo = "Follow";
+    rev = "v${version}";
+    hash = "sha256-amW+jpJ2E7muKwiWbblONRFzH849js2SaT+poUWQWZI=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    makeWrapper
+    imagemagick
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit pname version src;
+    hash = "sha256-JFAONU1C8pB2Hu4PJqqdqcXk9Ec+iPiAL8J+dk4oPj0=";
+  };
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    # This environment variables inject the production Vite config at build time.
+    # Copy from:
+    # 1. https://github.com/RSSNext/Follow/blob/0745ac07dd2a4a34e4251c034678ace15c302697/.github/workflows/build.yml#L18
+    # 2. And logs in the corresponding GitHub Actions: https://github.com/RSSNext/Follow/actions/workflows/build.yml
+    VITE_WEB_URL = "https://app.follow.is";
+    VITE_API_URL = "https://api.follow.is";
+    VITE_IMGPROXY_URL = "https://thumbor.follow.is";
+    VITE_SENTRY_DSN = "https://e5bccf7428aa4e881ed5cb713fdff181@o4507542488023040.ingest.us.sentry.io/4507570439979008";
+    VITE_BUILD_TYPE = "production";
+    VITE_POSTHOG_KEY = "phc_EZGEvBt830JgBHTiwpHqJAEbWnbv63m5UpreojwEWNL";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "follow";
+    desktopName = "Follow";
+    comment = "Next generation information browser";
+    icon = "follow";
+    exec = "follow";
+    categories = [ "Utility" ];
+    mimeTypes = [ "x-scheme-handler/follow" ];
+  };
+
+  icon = src + "/resources/icon.png";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --offline electron-vite build
+    # Remove dev dependencies.
+    pnpm --ignore-scripts prune --prod
+    # Clean up broken symlinks left behind by `pnpm prune`
+    find node_modules/.bin -xtype l -delete
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{applications,follow}
+    cp -r . $out/share/follow
+    rm -rf $out/share/follow/{.vscode,.github}
+
+    makeWrapper "${electron}/bin/electron" "$out/bin/follow" \
+      --inherit-argv0 \
+      --add-flags --disable-gpu-compositing \
+      --add-flags $out/share/follow \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
+
+    install -m 444 -D "${desktopItem}/share/applications/"* \
+        -t $out/share/applications/
+
+    for size in 16 24 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      convert -background none -resize "$size"x"$size" ${icon} $out/share/icons/hicolor/"$size"x"$size"/apps/follow.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Next generation information browser";
+    homepage = "https://github.com/RSSNext/Follow";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ iosmanthus ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "follow";
+  };
+}
diff --git a/pkgs/by-name/fo/forbidden/package.nix b/pkgs/by-name/fo/forbidden/package.nix
index 57c1aa9fa7ec..21fb34ccf946 100644
--- a/pkgs/by-name/fo/forbidden/package.nix
+++ b/pkgs/by-name/fo/forbidden/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "forbidden";
-  version = "11.2";
+  version = "12.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ivan-sincek";
     repo = "forbidden";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XRN5zQgyBbMxDKAutW3XNIAbBVdAeXZtxsNbmjLyKRc=";
+    hash = "sha256-ZxEkkg1gFs/pSAnrW85UqDQKczXqLW1q4kW58TagEA0=";
   };
 
   build-system = with python3.pkgs; [
@@ -20,6 +20,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
+    alive-progress
     colorama
     datetime
     pycurl
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index c38eb75de8cc..523253607e85 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -121,7 +121,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.24";
+  version = "1.9.25";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -132,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-jAR/c8hedprteCj5wrjST4yo8TxJ4JmLbPXSwBO3gJs=";
+    hash = "sha256-Yfj2Usto4BSnnBSvffdF02UeK4Ys8ZKzEsxrd2/XZe8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/git-upstream/package.nix b/pkgs/by-name/gi/git-upstream/package.nix
index f038db5a9dac..d94ca080b630 100644
--- a/pkgs/by-name/gi/git-upstream/package.nix
+++ b/pkgs/by-name/gi/git-upstream/package.nix
@@ -5,7 +5,7 @@
   nix-update-script,
 }: let
   pname = "git-upstream";
-  version = "1.1.0";
+  version = "1.2.0";
 in
   rustPlatform.buildRustPackage {
     inherit pname version;
@@ -14,17 +14,17 @@ in
       owner = "9999years";
       repo = pname;
       rev = "refs/tags/v${version}";
-      hash = "sha256-Pq0Z1WwrTP7dCwk6V/E0zu9sLLWr3kNuT3aJRZuRzhI=";
+      hash = "sha256-GnsqZSztDLXMO4T16nfcOKMKXap88CJzJ5nObzGwhMA=";
     };
 
-    cargoHash = "sha256-jNpleFrOvt1m2TXTeBXfhTSjWNpCknNoKooF2xsO46w=";
+    cargoHash = "sha256-a12C/fpeo0ZJ0MFQlKHVZER9dVrXF95YI1i8MwCTCJo=";
 
-    meta = with lib; {
+    meta = {
       homepage = "https://github.com/9999years/git-upstream";
       changelog = "https://github.com/9999years/git-upstream/releases/tag/v${version}";
       description = "Shortcut for `git push --set-upstream`";
-      license = [licenses.mit];
-      maintainers = [maintainers._9999years];
+      license = [lib.licenses.mit];
+      maintainers = [lib.maintainers._9999years];
       mainProgram = "git-upstream";
     };
 
diff --git a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix b/pkgs/by-name/gi/gitea-actions-runner/package.nix
similarity index 73%
rename from pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
rename to pkgs/by-name/gi/gitea-actions-runner/package.nix
index 10e07234aafa..d84c0de480b2 100644
--- a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
+++ b/pkgs/by-name/gi/gitea-actions-runner/package.nix
@@ -1,23 +1,24 @@
-{ lib
-, fetchFromGitea
-, buildGoModule
-, testers
-, gitea-actions-runner
+{
+  lib,
+  fetchFromGitea,
+  buildGo123Module,
+  testers,
+  gitea-actions-runner,
 }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "gitea-actions-runner";
-  version = "0.2.10";
+  version = "0.2.11";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "act_runner";
     rev = "v${version}";
-    hash = "sha256-YRWFBMHw9Fcmzkmglh2I1kXJkAAivqvCBcenLTjE/bI=";
+    hash = "sha256-PmDa8XIe1uZ4SSrs9zh5HBmFaOuj+uuLm7jJ4O5V1dI=";
   };
 
-  vendorHash = "sha256-8sdSQhg9DnRLgghDZzWrUMM4vjinhCgu3dTKU7MBVQU=";
+  vendorHash = "sha256-lYJFySGqkhT89vHDp1FcTiiC7DG4ziQ1DaBHLh/kXQc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gr/granian/Cargo.lock b/pkgs/by-name/gr/granian/Cargo.lock
index cf314d522b59..f6a3c5cd6736 100644
--- a/pkgs/by-name/gr/granian/Cargo.lock
+++ b/pkgs/by-name/gr/granian/Cargo.lock
@@ -17,6 +17,17 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.86"
@@ -62,6 +73,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
 [[package]]
 name = "bitflags"
 version = "2.6.0"
@@ -77,6 +94,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -85,15 +111,27 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.6.1"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a12916984aab3fa6e39d655a33e09c0071eb36d6ab3aea5c2d78551f1df6d952"
+checksum = "8318a53db07bb3f8dca91a600466bdb3f2eaadeedfdbcf02e1accbad9271ba50"
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
 
 [[package]]
 name = "cc"
-version = "1.1.7"
+version = "1.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26a5c3fd7bfa1ce3897a3a3501d362b2d87b7f2583ebcb4a949ec25911025cbc"
+checksum = "57b6a275aa2903740dc87da01c62040406b8812552e97129a63ea8850a17c6e6"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -102,10 +140,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "cpufeatures"
-version = "0.2.12"
+name = "cipher"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51e852e6dc9a5bed1fae92dd2375037bf2b768725bf3be87811edee3249d09ad"
 dependencies = [
  "libc",
 ]
@@ -141,6 +195,16 @@ version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
 
+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -149,6 +213,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -287,7 +352,7 @@ checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
 [[package]]
 name = "granian"
-version = "1.5.2"
+version = "1.6.0"
 dependencies = [
  "anyhow",
  "crossbeam-channel",
@@ -298,8 +363,10 @@ dependencies = [
  "itertools",
  "log",
  "mimalloc",
+ "pem",
  "percent-encoding",
  "pin-project",
+ "pkcs8",
  "pyo3",
  "pyo3-log",
  "rustls-pemfile",
@@ -314,9 +381,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -349,6 +416,15 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.1.0"
@@ -417,9 +493,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ab92f4f49ee4fb4f997c784b7a2e0fa70050211e0b6a287f898c3c9785ca956"
+checksum = "cde7055719c54e36e95e8719f95883f22072a48ede39db7fc17a4e1d5281e9b9"
 dependencies = [
  "bytes",
  "futures-util",
@@ -432,9 +508,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "68b900aa2f7301e21c36462b170ee99994de34dff39a4a6a528e80e7376d07e5"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -446,6 +522,16 @@ version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -463,9 +549,9 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "d8adc4bb1803a324070e64a98ae98f38934d91957a99cfb3a43dcbc01bc56439"
 
 [[package]]
 name = "libmimalloc-sys"
@@ -528,9 +614,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4569e456d394deccd22ce1c1913e6ea0e54519f577285001215d33557431afe4"
+checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
  "hermit-abi",
  "libc",
@@ -540,9 +626,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.2"
+version = "0.36.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f203fa8daa7bb185f760ae12bd8e097f63d17041dcdcaf675ac54cdf863170e"
+checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
 dependencies = [
  "memchr",
 ]
@@ -576,6 +662,26 @@ dependencies = [
  "windows-targets",
 ]
 
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e459365e590736a54c3fa561947c84837534b8e9af6fc5bf781307e82658fae"
+dependencies = [
+ "base64",
+ "serde",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -614,6 +720,33 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs5"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
+dependencies = [
+ "aes",
+ "cbc",
+ "der",
+ "pbkdf2",
+ "scrypt",
+ "sha2",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "pkcs5",
+ "rand_core",
+ "spki",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.7.0"
@@ -622,12 +755,11 @@ checksum = "da544ee218f0d287a911e9c99a39a8c9bc8fcad3cb8db5959940044ecfc67265"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.19"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2288c0e17cc8d342c712bb43a257a80ebffce59cdb33d5000d8348f3ec02528b"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
  "zerocopy",
- "zerocopy-derive",
 ]
 
 [[package]]
@@ -725,9 +857,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
  "proc-macro2",
 ]
@@ -808,9 +940,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+checksum = "196fe16b00e106300d3e45ecfcb764fa292a535d7326a29a5875c579c7417425"
 dependencies = [
  "base64",
  "rustls-pki-types",
@@ -833,12 +965,52 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "pbkdf2",
+ "salsa20",
+ "sha2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.209"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99fce0ffe7310761ca6bf9faf5115afbc19688edd00171d81b1bb1b116c63e09"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.209"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -850,6 +1022,23 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@@ -890,6 +1079,16 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -898,9 +1097,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.72"
+version = "2.0.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
+checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -909,9 +1108,9 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.15"
+version = "0.12.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4873307b7c257eddcb50c9bedf158eb669578359fb28428bef438fec8e6ba7c2"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "thiserror"
@@ -935,9 +1134,9 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemalloc-sys"
-version = "0.5.4+5.3.0-patched"
+version = "0.6.0+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9402443cb8fd499b6f327e40565234ff34dbda27460c5b47db0db77443dd85d1"
+checksum = "cd3c60906412afa9c2b5b5a48ca6a5abe5736aec9eb48ad05037a677e52e4e2d"
 dependencies = [
  "cc",
  "libc",
@@ -945,9 +1144,9 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemallocator"
-version = "0.5.4"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "965fe0c26be5c56c94e38ba547249074803efd52adfb66de62107d95aab3eaca"
+checksum = "4cec5ff18518d81584f477e9bfdf957f5bb0979b0bac3af4ca30b5b3ae2d2865"
 dependencies = [
  "libc",
  "tikv-jemalloc-sys",
@@ -968,9 +1167,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.39.2"
+version = "1.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daa4fb1bc778bd6f04cbfc4bb2d06a7396a8f299dc33ea1900cedaa316f467b1"
+checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
 dependencies = [
  "backtrace",
  "bytes",
diff --git a/pkgs/by-name/gr/granian/package.nix b/pkgs/by-name/gr/granian/package.nix
index e318f439ad40..ce2b033f2773 100644
--- a/pkgs/by-name/gr/granian/package.nix
+++ b/pkgs/by-name/gr/granian/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "granian";
-  version = "1.5.2";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     rev = "v${version}";
-    hash = "sha256-3kwdPLOkKKSY1w42av3ejarrRKNtai8KB80ZrujSjPo=";
+    hash = "sha256-ZIwZrLl7goweYUj3t5e0yaOqeppFHXvK9PL3chNZZRw=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/by-name/gr/grype/package.nix b/pkgs/by-name/gr/grype/package.nix
index 6d5809e30381..b8a19586772e 100644
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.80.0";
+  version = "0.80.2";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "grype";
     rev = "refs/tags/v${version}";
-    hash = "sha256-28/BR4oKOW7CK4gv4ESVZsvsyd6gKwW2XPvA1vU8/Wc=";
+    hash = "sha256-Q3KixUjyiPMLxoBIafyAUOeYRK6fhqgc150bLdwEk7M=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -30,7 +30,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-F8r332smhjVRxAQ42CvJDmBl2rjxgwUZpoMDhFsBYSA=";
+  vendorHash = "sha256-PXx5SyuKvxOZwJBspIiL8L7QzXzort6ZU3ZfrE8o700=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/gu/gungnir/package.nix b/pkgs/by-name/gu/gungnir/package.nix
index 571a9e1ac7f7..5ca7388338ef 100644
--- a/pkgs/by-name/gu/gungnir/package.nix
+++ b/pkgs/by-name/gu/gungnir/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gungnir";
-  version = "1.0.9";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "g0ldencybersec";
     repo = "gungnir";
     rev = "v${version}";
-    hash = "sha256-A4MPRsUSeYwKlhCHByty6T33wEp/BopZMDWOnOqlQqQ=";
+    hash = "sha256-iMawBuSPPeJztQ3Pdd2dUKSNaWCbbKcUW/IGBFifyng=";
   };
 
-  vendorHash = "sha256-r2aU59L0fnSdc/lpR04K/GQ1eZ7ihV+tKlyuS6sPX2o=";
+  vendorHash = "sha256-2RCIZS8oawaXtAYZDiLgNsco9llWCxNwQcA67F51rag=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/it/itch/package.nix b/pkgs/by-name/it/itch/package.nix
index e49f389babd8..29558080375f 100644
--- a/pkgs/by-name/it/itch/package.nix
+++ b/pkgs/by-name/it/itch/package.nix
@@ -91,6 +91,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     makeWrapper ${steam-run}/bin/steam-run $out/bin/itch \
       --add-flags ${electron}/bin/electron \
       --add-flags $out/share/itch/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       --set BROTH_USE_LOCAL butler,itch-setup \
       --prefix PATH : ${butler}:${itch-setup}
   '';
diff --git a/pkgs/by-name/ka/kas/package.nix b/pkgs/by-name/ka/kas/package.nix
index d7a3eb4118a9..51cbae22afdb 100644
--- a/pkgs/by-name/ka/kas/package.nix
+++ b/pkgs/by-name/ka/kas/package.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kas";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "siemens";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ws2V16HSGn2zyMmcG601ScHfONSE/DBVO3Gaj8dktf4=";
+    hash = "sha256-J64yy2G8+5uT31Vpwhge5R7ZqId+NzE5ykXBHjc0qgQ=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ setuptools kconfiglib jsonschema distro pyyaml gitpython ];
diff --git a/pkgs/by-name/kb/kbld/package.nix b/pkgs/by-name/kb/kbld/package.nix
new file mode 100644
index 000000000000..6b2a7f996989
--- /dev/null
+++ b/pkgs/by-name/kb/kbld/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "kbld";
+  version = "0.44.1";
+
+  src = fetchFromGitHub {
+    owner = "carvel-dev";
+    repo = "kbld";
+    rev = "v${version}";
+    hash = "sha256-sEzCA32r3nSY1hT1r4EPPWsF9Kgn0rXnaAKlatFjZIo=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/kbld" ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-X=carvel.dev/kbld/pkg/kbld/version.Version=${version}"
+  ];
+
+  meta = {
+    description = "Seamlessly incorporates image building and image pushing into your development and deployment workflows";
+    homepage = "https://carvel.dev/kbld/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ benchand ];
+    mainProgram = "kbld";
+  };
+}
diff --git a/pkgs/by-name/kc/kchat/package.nix b/pkgs/by-name/kc/kchat/package.nix
index 22a3496f6a81..baec68b0a573 100644
--- a/pkgs/by-name/kc/kchat/package.nix
+++ b/pkgs/by-name/kc/kchat/package.nix
@@ -5,12 +5,12 @@
 
 appimageTools.wrapType2 rec {
   pname = "kchat";
-  version = "3.3.1";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "https://download.storage5.infomaniak.com/kchat/kchat-desktop-${version}-linux-x86_64.AppImage";
     name = "kchat-${version}.AppImage";
-    hash = "sha256-f9wWgZSPSMP7bLZGfR5F6l/eAVHVhRmF1c7S6/qLgIA=";
+    hash = "sha256-5Nk2IMGk7BDDL7fuoOBO3wEcbtJDDDnQvUiqa8Pt8yU=";
   };
 
   extraInstallCommands =
diff --git a/pkgs/by-name/lu/lubelogger/package.nix b/pkgs/by-name/lu/lubelogger/package.nix
index 504490b82526..4e19ef4809e4 100644
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "lubelogger";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "hargata";
     repo = "lubelog";
     rev = "v${version}";
-    hash = "sha256-gfnfxm/xxFx77UnEinr+D8GoIN/KMz3BEbjpCYqQ6as=";
+    hash = "sha256-Rs+aB6H5FzeADpJjK68srjI2JE2QDV0sCIKQwbnFTMg=";
   };
 
   projectFile = "CarCareTracker.sln";
diff --git a/pkgs/by-name/mo/mov-cli/mov-cli-test.nix b/pkgs/by-name/mo/mov-cli/mov-cli-test.nix
index f135d863c1d5..7c34524eabcd 100644
--- a/pkgs/by-name/mo/mov-cli/mov-cli-test.nix
+++ b/pkgs/by-name/mo/mov-cli/mov-cli-test.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "A mov-cli plugin that let's you test mov-cli's capabilities by watching free films and animations in the creative commons";
     homepage = "https://github.com/mov-cli/mov-cli-test";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ roshaen ];
+    maintainers = with lib.maintainers; [ youhaveme9 ];
   };
 }
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index 112523e1fb74..3fa847f2e6a4 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -1,4 +1,4 @@
-{ buildGoModule
+{ buildGo123Module
 , buildPackages
 , fetchFromGitHub
 , fetchNpmDeps
@@ -15,25 +15,25 @@
 , ffmpegSupport ? true
 }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "navidrome";
-  version = "0.52.5";
+  version = "0.53.2";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${version}";
-    hash = "sha256-M1BxR4Mmkfbr9Wb2YwWEeVGgKOCtD/8pgFZiv8mTi7s=";
+    hash = "sha256-ghjQZc+KWtgDcW9nU7L2FV8mOL6nn7V5Dn0JiG5gii8=";
   };
 
-  vendorHash = "sha256-puldHJs5GiaXvyvwuzAX00nMLUxoBESpxLOEtBYD7o4=";
+  vendorHash = "sha256-+acLAn9cicXYRVn3tL+GzFeCxHtXHDMgKisu4BzvGQs=";
 
   npmRoot = "ui";
 
   npmDeps = fetchNpmDeps {
     inherit src;
     sourceRoot = "${src.name}/ui";
-    hash = "sha256-OZvEPC+MobCJn16d3MsMtrStbsmRD9Ef0/leVSXtVZ8=";
+    hash = "sha256-SebqSsng/t6g2874Hejc9wubiyYLE0jb3oLFnGwTRMA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index a7e4b02fbc65..d5b8cea948c9 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -33,13 +33,13 @@ let
     webkitgtk
   ];
 in
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.70.4";
+  version = "0.71.1";
 
   src = fetchurl {
-    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-4L2hoWUFAmxyUCbQFWoIQlIhbdyncN0fGFmahPMk0FU=";
+    url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
+    hash = "sha256-bZZTsL2jf4m6Gvc9cXDbAsiPoluljnb1AKshMM4325Q=";
   };
 
   nativeBuildInputs = [
@@ -68,12 +68,12 @@ stdenvNoCC.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { url = "https://github.com/buchen/portfolio.git"; };
 
-  meta = with lib; {
+  meta = {
     description = "Simple tool to calculate the overall performance of an investment portfolio";
     homepage = "https://www.portfolio-performance.info/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.epl10;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.epl10;
+    maintainers = with lib.maintainers; [
       kilianar
       oyren
       shawn8901
@@ -81,4 +81,4 @@ stdenvNoCC.mkDerivation rec {
     mainProgram = "portfolio";
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/by-name/pr/pragtical/package.nix b/pkgs/by-name/pr/pragtical/package.nix
index eb92f27d55f4..7cac519f039f 100644
--- a/pkgs/by-name/pr/pragtical/package.nix
+++ b/pkgs/by-name/pr/pragtical/package.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pragtical";
-  version = "3.4.4";
+  version = "3.5.0";
   pluginManagerVersion = "1.2.9";
 
   src = fetchFromGitHub {
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
       find subprojects -type d -name .git -prune -execdir rm -r {} +
     '';
 
-    hash = "sha256-YAIndKTqne4I+wuCrVtfkjdp1rsFF+xyBnl5WcuDyz4=";
+    hash = "sha256-a9LnLKtJ33YHtlnhWmKBeW5dOjjwa7PmaZjYh0+Nx9g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pu/pulsar/001-patch-wrapper.patch b/pkgs/by-name/pu/pulsar/001-patch-wrapper.patch
deleted file mode 100644
index 2270ad3c8aea..000000000000
--- a/pkgs/by-name/pu/pulsar/001-patch-wrapper.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/resources/pulsar.sh	2023-03-16 04:11:14.000000000 +0100
-+++ b/resources/pulsar.sh	2023-03-24 14:37:13.468813964 +0100
-@@ -123,7 +123,7 @@
- elif [ $OS == 'Linux' ]; then
-   SCRIPT=$(readlink -f "$0")
- 
--  PULSAR_PATH="/opt/Pulsar/pulsar"
-+  # PULSAR_PATH is set-up via `wrapProgram` in the postFixup phase
- 
-   #Set tmpdir only if tmpdir is unset
-   : ${TMPDIR:=/tmp}
diff --git a/pkgs/by-name/pu/pulsar/package.nix b/pkgs/by-name/pu/pulsar/package.nix
index 1f7123e468b7..83b1d4416a7f 100644
--- a/pkgs/by-name/pu/pulsar/package.nix
+++ b/pkgs/by-name/pu/pulsar/package.nix
@@ -7,6 +7,7 @@
 , alsa-lib
 , at-spi2-atk
 , cairo
+, coreutils
 , cups
 , dbus
 , expat
@@ -34,13 +35,13 @@
 
 let
   pname = "pulsar";
-  version = "1.120.0";
+  version = "1.121.0";
 
   sourcesPath = {
     x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz";
-    x86_64-linux.hash = "sha256-35/ZMi6YsXs27icV3kXuKl3Kl8IHLLYbV0aO49qMJ2Q=";
+    x86_64-linux.hash = "sha256-xouxKl4GTNZkT5wn8qbG2W2PbVAbsK9povmIL/Mikk4=";
     aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz";
-    aarch64-linux.hash = "sha256-N1CAWeBHePd2KnnePEJQnvIKfIxal1RQ5UB8pxpVJCk=";
+    aarch64-linux.hash = "sha256-qRBX8jO5xDXkZ/6TWkgNa1NS3l+z8K/JyJDAa/3me5Q=";
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   newLibpath = lib.makeLibraryPath [
@@ -86,10 +87,6 @@ stdenv.mkDerivation {
     inherit hash;
   };
 
-  patches = [
-    ./001-patch-wrapper.patch
-  ];
-
   nativeBuildInputs = [
     wrapGAppsHook3
     copyDesktopItems
@@ -187,10 +184,11 @@ stdenv.mkDerivation {
     asar p $asarBundle $opt/resources/app.asar
     rm -rf $asarBundle
 
-    # We have patched the original wrapper, but now it needs the "PULSAR_PATH" env var
+    # Pulsar uses `PULSAR_PATH` to know where it is intalled
     mkdir -p $out/bin
     wrapProgram $opt/resources/pulsar.sh \
-      --prefix "PULSAR_PATH" : "$opt/pulsar"
+      --suffix "PATH" : "${lib.makeBinPath [ coreutils ]}" \
+      --set "PULSAR_PATH" "$opt"
     ln -s $opt/resources/pulsar.sh $out/bin/pulsar
     ln -s $opt/resources/app/ppm/bin/apm $out/bin/ppm
 
@@ -230,7 +228,7 @@ stdenv.mkDerivation {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ bryango ];
+    maintainers = with lib.maintainers; [ bryango pbsds ];
     knownVulnerabilities = [
       # electron 12.2.3, efforts are in place to bump it
       "CVE-2023-5217"
diff --git a/pkgs/by-name/py/pytr/package.nix b/pkgs/by-name/py/pytr/package.nix
index 64de02060d7b..4e6d13cd7189 100644
--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pytr";
-  version = "0.2.4";
+  version = "0.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytr-org";
     repo = "pytr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ejXedAfbZJzfCSkW9X1yH+I03+kjIs/xiSkyJk7FEO0=";
+    hash = "sha256-9FKG4QgRBU+DaaYJIDMDqqxFMCAguv5iRUUrQr6RMz8=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 407d19d50b39..fb4fb88eb210 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.14.2";
+  version = "3.14.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-LYh+vWOMghjdwBXqgbdQd945+OX2lKbRTFJ1GIzOyH0=";
+    hash = "sha256-N0NLP8VvUvr/oi3U1McD+jyV8UXGXCwuITRbwudw1Q0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
new file mode 100644
index 000000000000..3404e3a959ed
--- /dev/null
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  darwin,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  stdenv,
+}:
+let
+  version = "0.2.4";
+in
+rustPlatform.buildRustPackage {
+  inherit version;
+  pname = "rainfrog";
+
+  src = fetchFromGitHub {
+    owner = "achristmascarl";
+    repo = "rainfrog";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3B56081ZiQPVFAheea2c7h2hQyruWI/q2crb4temVZc=";
+  };
+
+  cargoHash = "sha256-rO9tSgtO9q1ad0lzD8aINZhDupR5Q27ZPZPX/S7BM+I=";
+
+  buildInputs = lib.optionals stdenv.isDarwin (
+    with darwin.apple_sdk.frameworks;
+    [
+      AppKit
+      CoreGraphics
+      SystemConfiguration
+    ]
+  );
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/achristmascarl/rainfrog/releases/tag/v${version}";
+    description = "A database management TUI for postgres";
+    homepage = "https://github.com/achristmascarl/rainfrog";
+    license = lib.licenses.mit;
+    mainProgram = "rainfrog";
+    maintainers = with lib.maintainers; [ patka ];
+  };
+}
diff --git a/pkgs/by-name/re/resticprofile/package.nix b/pkgs/by-name/re/resticprofile/package.nix
index 57d1f1c95d1c..f052c2ba34b3 100644
--- a/pkgs/by-name/re/resticprofile/package.nix
+++ b/pkgs/by-name/re/resticprofile/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  go_1_23,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -9,15 +10,19 @@
   resticprofile,
 }:
 
-buildGoModule rec {
+let
+  # can be removed when the default go version is at least 1.23
+  buildGoModule' = buildGoModule.override { go = go_1_23; };
+in
+buildGoModule' rec {
   pname = "resticprofile";
-  version = "0.27.1";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "creativeprojects";
     repo = "resticprofile";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HHFeWsEO1KUzL5Y6Iwy7MylA//JYzY3h1EwKrUHfXpY=";
+    hash = "sha256-Ab+XesAw/GkNEGwAp1ERUlfDlI9Kxmd0UnS52v+nWIs=";
   };
 
   postPatch = ''
@@ -32,7 +37,7 @@ buildGoModule rec {
 
   '';
 
-  vendorHash = "sha256-t2R5uNsliSn+rIvRM0vT6lQJY62DhhozXnONiCJ9CMc=";
+  vendorHash = "sha256-LLFdVB4n07Sq/QH1C7rutdpzfhkJvM9lvRg5exyYixM=";
 
   ldflags = [
     "-X main.commit=${src.rev}"
diff --git a/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock b/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock
index cb2a54f8a663..406c1525a8f8 100644
--- a/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock
+++ b/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock
@@ -224,7 +224,7 @@ checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 [[package]]
 name = "arboard"
 version = "3.4.0"
-source = "git+https://github.com/rustdesk-org/arboard#a04bdb1b368a99691822c33bf0f7ed497d6a7a35"
+source = "git+https://github.com/rustdesk-org/arboard#747ab2d9b40a5c9c5102051cf3b0bb38b4845e60"
 dependencies = [
  "clipboard-win",
  "core-graphics 0.23.2",
@@ -860,6 +860,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chrono"
 version = "0.4.38"
@@ -3037,7 +3043,7 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "hwcodec"
 version = "0.7.0"
-source = "git+https://github.com/rustdesk-org/hwcodec#6abd1898f3a03481ed0c038507b5218d6ea94267"
+source = "git+https://github.com/rustdesk-org/hwcodec#f74410edec91435252b8394c38f8eeca87ad2a26"
 dependencies = [
  "bindgen 0.59.2",
  "cc",
@@ -3959,11 +3965,23 @@ checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
  "bitflags 2.6.0",
  "cfg-if 1.0.0",
- "cfg_aliases",
+ "cfg_aliases 0.1.1",
  "libc",
  "memoffset 0.9.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.6.0",
+ "cfg-if 1.0.0",
+ "cfg_aliases 0.2.1",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -5179,7 +5197,7 @@ dependencies = [
 [[package]]
 name = "rdev"
 version = "0.5.0-2"
-source = "git+https://github.com/rustdesk-org/rdev#b3434caee84c92412b45a2f655a15ac5dad33488"
+source = "git+https://github.com/rustdesk-org/rdev#d4c1759926d693ba269e2cb8cf9f87b13e424e4e"
 dependencies = [
  "cocoa 0.24.1",
  "core-foundation 0.9.4",
@@ -5454,7 +5472,7 @@ dependencies = [
 
 [[package]]
 name = "rustdesk"
-version = "1.3.0"
+version = "1.3.1"
 dependencies = [
  "android-wakelock",
  "android_logger",
@@ -5486,6 +5504,7 @@ dependencies = [
  "flutter_rust_bridge",
  "fon",
  "fruitbasket",
+ "gtk",
  "hbb_common",
  "hex",
  "hound",
@@ -5500,6 +5519,7 @@ dependencies = [
  "libpulse-simple-binding",
  "mac_address",
  "magnum-opus",
+ "nix 0.29.0",
  "num_cpus",
  "objc",
  "objc_id",
@@ -5531,6 +5551,7 @@ dependencies = [
  "system_shutdown",
  "tao",
  "tauri-winrt-notification",
+ "termios",
  "totp-rs",
  "tray-icon",
  "url",
@@ -5551,7 +5572,7 @@ dependencies = [
 
 [[package]]
 name = "rustdesk-portable-packer"
-version = "1.3.0"
+version = "1.3.1"
 dependencies = [
  "brotli",
  "dirs 5.0.1",
diff --git a/pkgs/by-name/ru/rustdesk-flutter/package.nix b/pkgs/by-name/ru/rustdesk-flutter/package.nix
index 18e2234a355a..2dd1b134eaa6 100644
--- a/pkgs/by-name/ru/rustdesk-flutter/package.nix
+++ b/pkgs/by-name/ru/rustdesk-flutter/package.nix
@@ -4,7 +4,7 @@
   cargo,
   copyDesktopItems,
   fetchFromGitHub,
-  flutter316,
+  flutter319,
   ffmpeg,
   gst_all_1,
   fuse3,
@@ -29,7 +29,7 @@ let
 
   flutterRustBridge = rustPlatform.buildRustPackage rec {
     pname = "flutter_rust_bridge_codegen";
-    version = "1.80.1"; # https://github.com/rustdesk/rustdesk/blob/1.3.0/.github/workflows/bridge.yml#L10
+    version = "1.80.1"; # https://github.com/rustdesk/rustdesk/blob/1.3.1/.github/workflows/bridge.yml#L10
 
     src = fetchFromGitHub {
       owner = "fzyzcjy";
@@ -49,14 +49,14 @@ let
   sharedLibraryExt = rustc.stdenv.hostPlatform.extensions.sharedLibrary;
 
 in
-flutter316.buildFlutterApplication rec {
+flutter319.buildFlutterApplication rec {
   pname = "rustdesk";
-  version = "1.3.0";
+  version = "1.3.1";
   src = fetchFromGitHub {
     owner = "rustdesk";
     repo = "rustdesk";
     rev = version;
-    hash = "sha256-pDGURsF0eft2BkuXOzaMtNCHp9VFgZZh4bbNRa5NDII=";
+    hash = "sha256-PioaSdvgJ9oXC5DAbl+em7rxcGx1om9+sjCMdrvox90=";
   };
 
   strictDeps = true;
@@ -64,7 +64,7 @@ flutter316.buildFlutterApplication rec {
 
   # Configure the Flutter/Dart build
   sourceRoot = "${src.name}/flutter";
-  # curl https://raw.githubusercontent.com/rustdesk/rustdesk/1.3.0/flutter/pubspec.lock | yq > pubspec.lock.json
+  # curl https://raw.githubusercontent.com/rustdesk/rustdesk/1.3.1/flutter/pubspec.lock | yq > pubspec.lock.json
   pubspecLock = lib.importJSON ./pubspec.lock.json;
   gitHashes = {
     dash_chat_2 = "sha256-J5Bc6CeCoRGN870aNEVJ2dkQNb+LOIZetfG2Dsfz5Ow=";
@@ -84,13 +84,13 @@ flutter316.buildFlutterApplication rec {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "android-wakelock-0.1.0" = "sha256-09EH/U1BBs3l4galQOrTKmPUYBgryUjfc/rqPZhdYc4=";
-      "arboard-3.4.0" = "sha256-lZIG5z115ExR6DcUut1rk9MrYFzSyCYH9kNGIikOPJM=";
+      "arboard-3.4.0" = "sha256-xuMfMakHVj/zjiUr6PVFy+aNQxwsXtAAFlTYxUt12fU=";
       "cacao-0.4.0-beta2" = "sha256-U5tCLeVxjmZCm7ti1u71+i116xmozPaR69pCsA4pxrM=";
       "clipboard-master-4.0.0-beta.6" = "sha256-GZyzGMQOZ0iwGNZa/ZzFp8gU2tQVWZBpAbim8yb6yZA=";
       "confy-0.4.0-2" = "sha256-V7BCKISrkJIxWC3WT5+B5Vav86YTQvdO9TO6A++47FU=";
       "core-foundation-0.9.3" = "sha256-iB4OVmWZhuWbs9RFWvNc+RNut6rip2/50o5ZM6c0c3g=";
       "evdev-0.11.5" = "sha256-aoPmjGi/PftnH6ClEWXHvIj0X3oh15ZC1q7wPC1XPr0=";
-      "hwcodec-0.7.0" = "sha256-pfzcaD7h/U5ou+P7qRLR56iXOkm043rF74y+Q0FsVLo=";
+      "hwcodec-0.7.0" = "sha256-SswZI2BJ4pRXT379cziJlisPsc5sOiOiDqJ5WaPETnA=";
       "impersonate_system-0.1.0" = "sha256-pIV7s2qGoCIUrhaRovBDCJaGQ/pMdJacDXJmeBpkcyI=";
       "keepawake-0.4.3" = "sha256-cqSpkq/PCz+5+ZUyPy5hF6rP3fBzuZDywyxMUQ50Rk4=";
       "machine-uid-0.3.0" = "sha256-rEOyNThg6p5oqE9URnxSkPtzyW8D4zKzLi9pAnzTElE=";
@@ -98,7 +98,7 @@ flutter316.buildFlutterApplication rec {
       "pam-0.7.0" = "sha256-o47tVoFlW9RiL7O8Lvuwz7rMYQHO+5TG27XxkAdHEOE=";
       "pam-sys-1.0.0-alpha4" = "sha256-5HIErVWnanLo5054NgU+DEKC2wwyiJ8AHvbx0BGbyWo=";
       "parity-tokio-ipc-0.7.3-4" = "sha256-PKw2Twd2ap+tRrQxqg8T1FvpoeKn0hvBqn1Z44F1LcY=";
-      "rdev-0.5.0-2" = "sha256-KrzNa4sKyuVw3EV/Ec9VBNRyJy7QFR2Gu4c2WkltwUw=";
+      "rdev-0.5.0-2" = "sha256-G+PvnA5mZyN080uoI5CGj/dQ9B1J4h5iYd7214MKBR8=";
       "reqwest-0.11.23" = "sha256-kEUT+gs4ziknDiGdPMLnj5pmxC5SBpLopZ8jZ34GDWc=";
       "rust-pulsectl-0.2.12" = "sha256-8jXTspWvjONFcvw9/Z8C43g4BuGZ3rsG32tvLMQbtbM=";
       "sciter-rs-0.5.57" = "sha256-5Nd9npdx8yQJEczHv7WmSmrE1lBfvp5z7BubTbYBg3E=";
@@ -172,7 +172,7 @@ flutter316.buildFlutterApplication rec {
   '';
 
   preBuild = ''
-    # Disable static linking of ffmpeg since https://github.com/21pages/hwcodec/commit/1873c34e3da070a462540f61c0b782b7ab15dc84¶
+    # Disable static linking of ffmpeg since https://github.com/21pages/hwcodec/commit/1873c34e3da070a462540f61c0b782b7ab15dc84
     sed -i 's/static=//g' /build/cargo-vendor-dir/hwcodec-*/build.rs
 
     # Build the Flutter/Rust bridge bindings
@@ -200,7 +200,6 @@ flutter316.buildFlutterApplication rec {
     mkdir -p $out/share/polkit-1/actions $out/share/icons/hicolor/{256x256,scalable}/apps
     cp ../res/128x128@2x.png $out/share/icons/hicolor/256x256/apps/rustdesk.png
     cp ../res/scalable.svg $out/share/icons/hicolor/scalable/apps/rustdesk.svg
-    cp ../res/com.rustdesk.RustDesk.policy $out/share/polkit-1/actions/
   '';
 
   desktopItems = [
diff --git a/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json b/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json
index a077b296731b..a0a7ad0d8076 100644
--- a/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json
+++ b/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json
@@ -473,6 +473,26 @@
       "source": "git",
       "version": "0.0.1+1"
     },
+    "extended_text": {
+      "dependency": "direct main",
+      "description": {
+        "name": "extended_text",
+        "sha256": "7f382de3af12992e34bd72ddd36becf90c4720900af126cb9859f0189af71ffe",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "13.0.0"
+    },
+    "extended_text_library": {
+      "dependency": "transitive",
+      "description": {
+        "name": "extended_text_library",
+        "sha256": "55d09098ec56fab0d9a8a68950ca0bbf2efa1327937f7cec6af6dfa066234829",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "12.0.0"
+    },
     "external_path": {
       "dependency": "direct main",
       "description": {
@@ -633,8 +653,8 @@
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "38951317afe79d953ab25733667bd96e172a80d3",
-        "resolved-ref": "38951317afe79d953ab25733667bd96e172a80d3",
+        "ref": "2ded7f146437a761ffe6981e2f742038f85ca68d",
+        "resolved-ref": "2ded7f146437a761ffe6981e2f742038f85ca68d",
         "url": "https://github.com/rustdesk-org/flutter_gpu_texture_renderer"
       },
       "source": "git",
@@ -2013,7 +2033,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.2.0 <4.0.0",
-    "flutter": ">=3.16.0"
+    "dart": ">=3.3.0 <4.0.0",
+    "flutter": ">=3.19.0"
   }
 }
diff --git a/pkgs/by-name/se/sequoia-sq/package.nix b/pkgs/by-name/se/sequoia-sq/package.nix
index 5de7ab47962c..450113dda742 100644
--- a/pkgs/by-name/se/sequoia-sq/package.nix
+++ b/pkgs/by-name/se/sequoia-sq/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia-sq";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia-sq";
     rev = "v${version}";
-    hash = "sha256-D22ECJvbGbnyvusWXfU5F1aLF/ETuMyhAStT5HPWR2U=";
+    hash = "sha256-Zzk7cQs5zD+houNjK8s3tP9kZ2/eAUV/OE3/GrNAXk8=";
   };
 
-  cargoHash = "sha256-jFpqZKyRCMkMtOezsYJy3Fy1WXUPyn709wZxuwKlSYI=";
+  cargoHash = "sha256-Ou+YKfEOmMTZVg9unqoOibMQYsdNAYTq4ZoOANLRk2Y=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/servers/softether/default.nix b/pkgs/by-name/so/softether/package.nix
similarity index 83%
rename from pkgs/servers/softether/default.nix
rename to pkgs/by-name/so/softether/package.nix
index 976521f061d9..2f7cba342808 100644
--- a/pkgs/servers/softether/default.nix
+++ b/pkgs/by-name/so/softether/package.nix
@@ -1,6 +1,13 @@
-{ lib, stdenv, fetchurl
-, openssl, readline, ncurses, zlib
-, dataDir ? "/var/lib/softether" }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  openssl,
+  readline,
+  ncurses,
+  zlib,
+  dataDir ? "/var/lib/softether",
+}:
 
 stdenv.mkDerivation rec {
   pname = "softether";
@@ -12,7 +19,12 @@ stdenv.mkDerivation rec {
     sha256 = "0d8zahi9lkv72jh8yj66pwrsi4451vk113d3khzrzgbic6s2i0g6";
   };
 
-  buildInputs = [ openssl readline ncurses zlib ];
+  buildInputs = [
+    openssl
+    readline
+    ncurses
+    zlib
+  ];
 
   preConfigure = ''
     ./configure
diff --git a/pkgs/by-name/so/sourcery/package.nix b/pkgs/by-name/so/sourcery/package.nix
index 62cf70fde673..6c35b807790b 100644
--- a/pkgs/by-name/so/sourcery/package.nix
+++ b/pkgs/by-name/so/sourcery/package.nix
@@ -11,18 +11,20 @@ let
   platformInfos = {
     "x86_64-linux" = {
       platform = "manylinux1_x86_64";
-      hash = "sha256-IJFuMtrddHciuHGeiCuv4hgco9E3GJveegL7dBmVmAw=";
+      hash = "sha256-aTANmCWyR8QVZVQGk1WbgjWjZeBSUN2ZVNg5ab9s6n0=";
     };
     "x86_64-darwin" = {
       platform = "macosx_10_9_universal2";
-      hash = "sha256-eTD8NnmDTMSB0dt5skPOlWbnW6AexxEkKZ9ABc+kUas=";
+      hash = "sha256-9ihkrgcREVbp7GDvl7w1MlpAWmpjHFusJYNqvBnQij4=";
     };
   };
-  platformInfo = platformInfos.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");
+
+  inherit (stdenv.hostPlatform) system;
+  platformInfo = platformInfos.${system} or (throw "Unsupported platform ${system}");
 in
 python3Packages.buildPythonApplication rec {
   pname = "sourcery";
-  version = "1.19.0";
+  version = "1.23.0";
   format = "wheel";
 
   src = fetchPypi {
diff --git a/pkgs/by-name/sp/spade/Cargo.lock b/pkgs/by-name/sp/spade/Cargo.lock
index 604659a01e9e..274d64e6947b 100644
--- a/pkgs/by-name/sp/spade/Cargo.lock
+++ b/pkgs/by-name/sp/spade/Cargo.lock
@@ -26,15 +26,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "ansi_term"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
-dependencies = [
- "winapi",
-]
-
 [[package]]
 name = "anstream"
 version = "0.6.14"
@@ -146,9 +137,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.5.4"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
+checksum = "64acc1846d54c1fe936a78dc189c34e28d3f5afc348403f28ecf53660b9b8462"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -156,9 +147,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.2"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+checksum = "6fb8393d67ba2e7bfaf28a23458e4e2b543cc73a99595511eb207fdb8aede942"
 dependencies = [
  "anstream",
  "anstyle",
@@ -168,9 +159,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.4"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
+checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -435,9 +426,9 @@ checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
 
 [[package]]
 name = "itertools"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
 dependencies = [
  "either",
 ]
@@ -592,9 +583,9 @@ dependencies = [
 
 [[package]]
 name = "nu-ansi-term"
-version = "0.49.0"
+version = "0.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c073d3c1930d0751774acf49e66653acecb416c3a54c6ec095a9b11caddb5a68"
+checksum = "dd2800e1520bdc966782168a627aa5d1ad92e33b984bf7c7615d31280c83ff14"
 dependencies = [
  "windows-sys 0.48.0",
 ]
@@ -758,11 +749,11 @@ dependencies = [
 
 [[package]]
 name = "prettydiff"
-version = "0.6.4"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ff1fec61082821f8236cf6c0c14e8172b62ce8a72a0eedc30d3b247bb68dc11"
+checksum = "abec3fb083c10660b3854367697da94c674e9e82aa7511014dc958beeb7215e9"
 dependencies = [
- "ansi_term",
+ "owo-colors",
  "pad",
 ]
 
@@ -1000,7 +991,7 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "spade"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "clap",
  "codespan",
@@ -1034,15 +1025,16 @@ dependencies = [
 
 [[package]]
 name = "spade-ast"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
+ "itertools",
  "num",
  "spade-common",
 ]
 
 [[package]]
 name = "spade-ast-lowering"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "itertools",
  "local-impl",
@@ -1060,14 +1052,13 @@ dependencies = [
 
 [[package]]
 name = "spade-common"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan",
  "codespan-reporting 0.12.0",
  "logos",
  "num",
  "serde",
- "tracing",
 ]
 
 [[package]]
@@ -1086,30 +1077,21 @@ dependencies = [
 
 [[package]]
 name = "spade-diagnostics"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan",
  "codespan-reporting 0.12.0",
- "colored",
  "insta",
  "itertools",
- "local-impl",
- "logos",
- "spade-ast",
  "spade-common",
- "spade-macros",
- "thiserror",
- "tracing",
 ]
 
 [[package]]
 name = "spade-hir"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
- "codespan-reporting 0.12.0",
  "colored",
  "itertools",
- "local-impl",
  "num",
  "serde",
  "spade-common",
@@ -1122,12 +1104,9 @@ dependencies = [
 
 [[package]]
 name = "spade-hir-lowering"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
- "codespan",
- "codespan-reporting 0.12.0",
  "colored",
- "indoc",
  "itertools",
  "local-impl",
  "num",
@@ -1137,18 +1116,16 @@ dependencies = [
  "spade-common",
  "spade-diagnostics",
  "spade-hir",
- "spade-macros",
  "spade-mir",
  "spade-typeinference",
  "spade-types",
  "spade-wordlength-inference",
- "thiserror",
  "tracing",
 ]
 
 [[package]]
 name = "spade-macros"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1158,7 +1135,7 @@ dependencies = [
 
 [[package]]
 name = "spade-mir"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan",
  "codespan-reporting 0.12.0",
@@ -1166,7 +1143,6 @@ dependencies = [
  "derive-where",
  "indoc",
  "itertools",
- "logos",
  "nesty",
  "num",
  "pretty_assertions",
@@ -1174,12 +1150,11 @@ dependencies = [
  "serde",
  "spade-common",
  "spade-diagnostics",
- "spade-macros",
 ]
 
 [[package]]
 name = "spade-parser"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan",
  "colored",
@@ -1197,7 +1172,7 @@ dependencies = [
 
 [[package]]
 name = "spade-python"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan-reporting 0.12.0",
  "color-eyre",
@@ -1226,7 +1201,7 @@ dependencies = [
 
 [[package]]
 name = "spade-simulation-ext"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan-reporting 0.12.0",
  "color-eyre",
@@ -1254,7 +1229,7 @@ dependencies = [
 
 [[package]]
 name = "spade-tests"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "codespan-reporting 0.12.0",
  "colored",
@@ -1282,14 +1257,11 @@ dependencies = [
 
 [[package]]
 name = "spade-typeinference"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "assert_matches",
- "codespan",
- "codespan-reporting 0.12.0",
  "colored",
  "itertools",
- "local-impl",
  "num",
  "serde",
  "spade-ast",
@@ -1305,7 +1277,7 @@ dependencies = [
 
 [[package]]
 name = "spade-types"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "num",
  "serde",
@@ -1314,24 +1286,15 @@ dependencies = [
 
 [[package]]
 name = "spade-wordlength-inference"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
- "codespan",
- "codespan-reporting 0.12.0",
- "colored",
- "local-impl",
  "num",
- "serde",
- "spade-ast",
  "spade-common",
  "spade-diagnostics",
  "spade-hir",
  "spade-macros",
- "spade-parser",
  "spade-typeinference",
  "spade-types",
- "thiserror",
- "tracing",
 ]
 
 [[package]]
@@ -1509,11 +1472,11 @@ dependencies = [
 
 [[package]]
 name = "tracing-tree"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65139ecd2c3f6484c3b99bc01c77afe21e95473630747c7aca525e78b0666675"
+checksum = "f459ca79f1b0d5f71c54ddfde6debfc59c8b6eeb46808ae492077f739dc7b49c"
 dependencies = [
- "nu-ansi-term 0.49.0",
+ "nu-ansi-term 0.50.0",
  "tracing-core",
  "tracing-log",
  "tracing-subscriber",
diff --git a/pkgs/by-name/sp/spade/package.nix b/pkgs/by-name/sp/spade/package.nix
index 6612f355a1fd..678bcfc7235d 100644
--- a/pkgs/by-name/sp/spade/package.nix
+++ b/pkgs/by-name/sp/spade/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spade";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "spade";
     rev = "v${version}";
-    hash = "sha256-DVvdCt/t7aA2IAs+cL6wT129PX8s3P5gHawcLAvAAGw=";
+    hash = "sha256-IAb9Vj5KwyXpARD2SIgYRXhz1ihwcgCTwx3zbgoN6dE=";
     # only needed for vatch, which contains test data
     fetchSubmodules = true;
   };
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ python312 ];
-  env.NIX_CFLAGS_LINK = lib.optionals stdenv.hostPlatform.isDarwin "-L${python312}/lib/python3.12/config-3.12-darwin -lpython3.12";
+  env.NIX_CFLAGS_LINK = lib.optionalString stdenv.hostPlatform.isDarwin "-L${python312}/lib/python3.12/config-3.12-darwin -lpython3.12";
 
   meta = with lib; {
     description = "Better hardware description language";
diff --git a/pkgs/by-name/sv/svp/mpv.nix b/pkgs/by-name/sv/svp/mpv.nix
index ac597bd91708..8c4e7839c1ca 100644
--- a/pkgs/by-name/sv/svp/mpv.nix
+++ b/pkgs/by-name/sv/svp/mpv.nix
@@ -1,7 +1,7 @@
-{ lib
-, mpv-unwrapped
-, ocl-icd
-, ...
+{
+  lib,
+  mpv-unwrapped,
+  ocl-icd,
 }:
 
 mpv-unwrapped.wrapper {
diff --git a/pkgs/by-name/sv/svp/package.nix b/pkgs/by-name/sv/svp/package.nix
index 30e540ba7416..0978a9e64f69 100644
--- a/pkgs/by-name/sv/svp/package.nix
+++ b/pkgs/by-name/sv/svp/package.nix
@@ -1,25 +1,26 @@
-{ stdenv
-, buildFHSEnv
-, writeShellScriptBin
-, fetchurl
-, callPackage
-, makeDesktopItem
-, copyDesktopItems
-, ffmpeg
-, glibc
-, jq
-, lib
-, libmediainfo
-, libsForQt5
-, libusb1
-, ocl-icd
-, p7zip
-, patchelf
-, socat
-, vapoursynth
-, xdg-utils
-, xorg
-, zenity
+{
+  stdenv,
+  buildFHSEnv,
+  writeShellScriptBin,
+  fetchurl,
+  callPackage,
+  makeDesktopItem,
+  copyDesktopItems,
+  ffmpeg,
+  glibc,
+  jq,
+  lib,
+  libmediainfo,
+  libsForQt5,
+  libusb1,
+  ocl-icd,
+  p7zip,
+  patchelf,
+  socat,
+  vapoursynth,
+  xdg-utils,
+  xorg,
+  zenity,
 }:
 let
   mpvForSVP = callPackage ./mpv.nix { };
@@ -60,13 +61,16 @@ let
 
   svp-dist = stdenv.mkDerivation rec {
     pname = "svp-dist";
-    version = "4.5.210-2";
+    version = "4.6.263";
     src = fetchurl {
       url = "https://www.svp-team.com/files/svp4-linux.${version}.tar.bz2";
-      hash = "sha256-dY9uQ9jzTHiN2XSnOrXtHD11IIJW6t9BUzGGQFfZ+yg=";
+      sha256 = "sha256-HyRDVFHVmTan/Si3QjGQpC3za30way10d0Hk79oXG98=";
     };
 
-    nativeBuildInputs = [ p7zip patchelf ];
+    nativeBuildInputs = [
+      p7zip
+      patchelf
+    ];
     dontFixup = true;
 
     unpackPhase = ''
@@ -129,14 +133,25 @@ stdenv.mkDerivation {
       desktopName = "SVP 4 Linux";
       genericName = "Real time frame interpolation";
       icon = "svp-manager4";
-      categories = [ "AudioVideo" "Player" "Video" ];
-      mimeTypes = [ "video/x-msvideo" "video/x-matroska" "video/webm" "video/mpeg" "video/mp4" ];
+      categories = [
+        "AudioVideo"
+        "Player"
+        "Video"
+      ];
+      mimeTypes = [
+        "video/x-msvideo"
+        "video/x-matroska"
+        "video/webm"
+        "video/mpeg"
+        "video/mp4"
+      ];
       terminal = false;
       startupNotify = true;
     })
   ];
 
   meta = with lib; {
+    mainProgram = "SVPManager";
     description = "SmoothVideo Project 4 (SVP4) converts any video to 60 fps (and even higher) and performs this in real time right in your favorite video player";
     homepage = "https://www.svp-team.com/wiki/SVP:Linux";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index 1844e08ddf8b..d49899480e3b 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -8,13 +8,13 @@
 let
   technitium-library = buildDotnetModule rec {
     pname = "TechnitiumLibrary";
-    version = "570ec570b57d8591daa3df682ca9e6f37f373db6";
+    version = "5af89bb453dd67ae3119771597451e438a938591";
 
     src = fetchFromGitHub {
       owner = "TechnitiumSoftware";
       repo = "TechnitiumLibrary";
       rev = version;
-      hash = "sha256-xPwRoRp/XYrlGX3B9EiHUz2Tueh+hygbBopxFvdASLQ";
+      hash = "sha256-ezYC2Nh5lgaN95OEP4TYcH6+3AbHbyTfv1RU19DXI3c=";
       name = "${pname}-${version}";
     };
 
@@ -30,13 +30,13 @@ let
 in
 buildDotnetModule rec {
   pname = "technitium-dns-server";
-  version = "12.2.1";
+  version = "13.0.1";
 
   src = fetchFromGitHub {
     owner = "TechnitiumSoftware";
     repo = "DnsServer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2RB/pUlA9z7TJ4xd509nsbO1BnxY3mv2jou6OGRd/yM=";
+    hash = "sha256-O5QJAo6GjoKes5W4ajMcsYpR3j7EcR1vVMiKtTLcwDE=";
     name = "${pname}-${version}";
   };
 
diff --git a/pkgs/applications/system/thumbdrives/default.nix b/pkgs/by-name/th/thumbdrives/package.nix
similarity index 68%
rename from pkgs/applications/system/thumbdrives/default.nix
rename to pkgs/by-name/th/thumbdrives/package.nix
index 89711e996831..f4f4015c8ed4 100644
--- a/pkgs/applications/system/thumbdrives/default.nix
+++ b/pkgs/by-name/th/thumbdrives/package.nix
@@ -1,21 +1,22 @@
-{ lib
-, python3
-, fetchFromSourcehut
-, gtk3
-, libhandy_0
-, gobject-introspection
-, meson
-, pkg-config
-, ninja
-, gettext
-, glib
-, desktop-file-utils
-, wrapGAppsHook3
+{
+  lib,
+  python3,
+  fetchFromSourcehut,
+  gtk3,
+  libhandy_0,
+  gobject-introspection,
+  meson,
+  pkg-config,
+  ninja,
+  gettext,
+  glib,
+  desktop-file-utils,
+  wrapGAppsHook3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "thumbdrives";
-  version = "0.3.1";
+  version = "0.3.2";
 
   format = "other";
 
@@ -23,7 +24,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "~martijnbraam";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CPZKswbvsG61A6J512FOCKAntoJ0sUb2s+MKb0rO+Xw=";
+    hash = "sha256-Mh3NSEYscnzw6kjR9m0XbTygj07cIQwdyLcdLpfKi3Y=";
   };
 
   postPatch = ''
@@ -56,7 +57,10 @@ python3.pkgs.buildPythonApplication rec {
     description = "USB mass storage emulator for Linux handhelds";
     homepage = "https://sr.ht/~martijnbraam/thumbdrives/";
     license = licenses.mit;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [
+      chuangzhu
+      Luflosi
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/17/default.nix b/pkgs/development/compilers/openjdk/openjfx/17/default.nix
index e3ddceac7d43..d43ffc8b6862 100644
--- a/pkgs/development/compilers/openjdk/openjfx/17/default.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17/default.nix
@@ -48,6 +48,9 @@ in stdenv.mkDerivation {
       -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
          modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h
 
+    substituteInPlace modules/javafx.web/src/main/native/Source/JavaScriptCore/offlineasm/parser.rb \
+      --replace-fail "File.exists?" "File.exist?"
+
     ln -s $config gradle.properties
   '';
 
diff --git a/pkgs/development/libraries/LAStools/default.nix b/pkgs/development/libraries/LAStools/default.nix
index 8a34168484eb..e4d86733ab39 100644
--- a/pkgs/development/libraries/LAStools/default.nix
+++ b/pkgs/development/libraries/LAStools/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
 
 stdenv.mkDerivation rec {
   pname = "LAStools";
@@ -19,6 +24,8 @@ stdenv.mkDerivation rec {
     "format"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-Wno-narrowing";
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/development/libraries/avro-c/default.nix b/pkgs/development/libraries/avro-c/default.nix
index a62d0449b385..53f1d4430cc9 100644
--- a/pkgs/development/libraries/avro-c/default.nix
+++ b/pkgs/development/libraries/avro-c/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avro-c";
-  version = "1.11.3";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "mirror://apache/avro/avro-${version}/c/avro-c-${version}.tar.gz";
-    sha256 = "sha256-chfKrPt9XzRhF2ZHOmbC4nm8e/rxuimMfwSzsvulc2U=";
+    sha256 = "sha256-dDM9QxB5w113DO9plstN4EBY0Z6BvQuaNjvP04V1A38=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mapnik/catch2-src.patch b/pkgs/development/libraries/mapnik/catch2-src.patch
deleted file mode 100644
index 04c6f7add217..000000000000
--- a/pkgs/development/libraries/mapnik/catch2-src.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 0705ddce1..771291b88 100644
---- a/test/CMakeLists.txt
-+++ b/test/CMakeLists.txt
-@@ -7,8 +7,7 @@ include(FetchContent)
- 
- FetchContent_Declare(
-   Catch2
--  GIT_REPOSITORY https://github.com/catchorg/Catch2.git
--  GIT_TAG        v2.13.7)
-+  SOURCE_DIR @catch2_src@)
- FetchContent_MakeAvailable(Catch2)
- 
- if(${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.19.0") 
diff --git a/pkgs/development/libraries/mapnik/default.nix b/pkgs/development/libraries/mapnik/default.nix
index 7d8848f59b58..2038a185ed94 100644
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@@ -1,29 +1,29 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, buildPackages
-, cmake
-, pkg-config
-, substituteAll
-, boost
-, cairo
-, freetype
-, gdal
-, harfbuzz
-, icu
-, libjpeg
-, libpng
-, libtiff
-, libwebp
-, libxml2
-, proj
-, python3
-, sqlite
-, zlib
-, catch2
-, postgresql
-, protozero
-, sparsehash
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildPackages,
+  cmake,
+  pkg-config,
+  boost,
+  cairo,
+  freetype,
+  gdal,
+  harfbuzz,
+  icu,
+  libjpeg,
+  libpng,
+  libtiff,
+  libwebp,
+  libxml2,
+  proj,
+  python3,
+  sqlite,
+  zlib,
+  catch2,
+  postgresql,
+  protozero,
+  sparsehash,
 }:
 
 stdenv.mkDerivation rec {
@@ -56,18 +56,16 @@ stdenv.mkDerivation rec {
     # Upstream HarfBuzz wants to drop CMake support anyway.
     # See discussion: https://github.com/mapnik/mapnik/issues/4265
     ./cmake-harfbuzz.patch
-    # prevent CMake from trying to get libraries on the Internet
-    (substituteAll {
-      src = ./catch2-src.patch;
-      catch2_src = catch2.src;
-    })
     # Account for full paths when generating libmapnik.pc
     ./export-pkg-config-full-paths.patch
     # Use 'sparsehash' package.
     ./use-sparsehash-package.patch
   ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
   buildInputs = [
     boost
@@ -100,6 +98,8 @@ stdenv.mkDerivation rec {
     (lib.cmakeBool "USE_EXTERNAL_MAPBOX_PROTOZERO" true)
     # macOS builds fail when using memory mapped file cache.
     (lib.cmakeBool "USE_MEMORY_MAPPED_FILE" (!stdenv.hostPlatform.isDarwin))
+    # don't try to download sources for catch2, use our own
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CATCH2" "${catch2.src}")
   ];
 
   doCheck = true;
@@ -122,7 +122,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Open source toolkit for developing mapping applications";
     homepage = "https://mapnik.org";
-    maintainers = with maintainers; [ hrdinka hummeltech ];
+    maintainers = with maintainers; [
+      hrdinka
+      hummeltech
+    ];
     license = licenses.lgpl21Plus;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index d1cd9d068913..c3fa57204987 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlt";
-  version = "7.26.0";
+  version = "7.28.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    hash = "sha256-MC7D7bgguDFZi8Dyip1wAa2zxxkpLupl05xFiDc8Byw=";
+    hash = "sha256-rXxjHXXIFFggd2v9ZlNBs0XUDmvJxLvR2JfGkTxDYEA=";
     # The submodule contains glaxnimate code, since MLT uses internally some functions defined in glaxnimate.
     # Since glaxnimate is not available as a library upstream, we cannot remove for now this dependency on
     # submodules until upstream exports glaxnimate as a library: https://gitlab.com/mattbas/glaxnimate/-/issues/545
diff --git a/pkgs/development/libraries/science/math/tensorflow-lite/default.nix b/pkgs/development/libraries/science/math/tensorflow-lite/default.nix
index 9f9405dec318..218b05b911e4 100644
--- a/pkgs/development/libraries/science/math/tensorflow-lite/default.nix
+++ b/pkgs/development/libraries/science/math/tensorflow-lite/default.nix
@@ -7,7 +7,7 @@
 let
   buildPlatform = stdenv.buildPlatform;
   hostPlatform = stdenv.hostPlatform;
-  pythonEnv = buildPackages.python3.withPackages (ps: [ ps.numpy ]);
+  pythonEnv = buildPackages.python3.withPackages (ps: with ps; [ distutils numpy ]);
   bazelDepsSha256ByBuildAndHost = {
     x86_64-linux = {
       x86_64-linux = "sha256-61qmnAB80syYhURWYJOiOnoGOtNa1pPkxfznrFScPAo=";
diff --git a/pkgs/development/python-modules/aioaseko/default.nix b/pkgs/development/python-modules/aioaseko/default.nix
index 7deb0174408a..15822fe46e53 100644
--- a/pkgs/development/python-modules/aioaseko/default.nix
+++ b/pkgs/development/python-modules/aioaseko/default.nix
@@ -14,11 +14,11 @@ buildPythonPackage rec {
   version = "1.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "milanmeu";
-    repo = pname;
+    repo = "aioaseko";
     rev = "refs/tags/v${version}";
     hash = "sha256-jUvpu/lOFKRUwEuYD1zRp0oODjf4AgH84fnGngtv9jw=";
   };
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     description = "Module to interact with the Aseko Pool Live API";
     homepage = "https://github.com/milanmeu/aioaseko";
     changelog = "https://github.com/milanmeu/aioaseko/releases/tag/v${version}";
-    license = with licenses; [ lgpl3Plus ];
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index bb6227377203..960ba0dc9f84 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioopenexchangerates";
-  version = "0.6.2";
+  version = "0.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XsNeIUgHFPatGAhxcwtfSXUi+0sCQf9E6GH5C8OrpJg=";
+    hash = "sha256-JWf8MXwYKUF0brS+NcsPZkMS5XBtpZyFPD7dOS3g/6M=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
diff --git a/pkgs/development/python-modules/aiorussound/default.nix b/pkgs/development/python-modules/aiorussound/default.nix
index 3e700c818985..7c0f045c6222 100644
--- a/pkgs/development/python-modules/aiorussound/default.nix
+++ b/pkgs/development/python-modules/aiorussound/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "aiorussound";
-  version = "3.0.5";
+  version = "3.1.5";
   pyproject = true;
 
   # requires newer f-strings introduced in 3.12
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "noahhusby";
     repo = "aiorussound";
     rev = "refs/tags/${version}";
-    hash = "sha256-tv/Box8YqmFXvnezp44lKrPscK9K24+mXBv9aZw/3M4=";
+    hash = "sha256-c9elemUdvX8Q8/Sr4DSXEx9SdRoLKibQFbY+WSDg/yM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/bring-api/default.nix b/pkgs/development/python-modules/bring-api/default.nix
index 596b17315114..eb38597a222f 100644
--- a/pkgs/development/python-modules/bring-api/default.nix
+++ b/pkgs/development/python-modules/bring-api/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bring-api";
-  version = "0.8.1";
+  version = "0.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "miaucl";
     repo = "bring-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-w7DV+Idcg7OobFx+ECimngQKk0SCzd5F+DTg+WcnJwA=";
+    hash = "sha256-eXT7H2GGNpSo58eK5f6b5eLWYgjxEV8iLgaVTpkt9EU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index 1f06cf0faf12..4388c972c4d6 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-core";
-  version = "1.8.6";
+  version = "1.8.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Zd1qPTfJgoGpkrMSt0K1jAdYAxICdru9vIXXqbmZryo=";
+    hash = "sha256-1NvdRAr8T2dDgtyj5tUIqhjHIu4sZYS+oj7hOMEqs0A=";
   };
 
   sourceRoot = "${src.name}/core";
diff --git a/pkgs/development/python-modules/devgoldyutils/default.nix b/pkgs/development/python-modules/devgoldyutils/default.nix
index fb70dba6d40c..db7b236e19ee 100644
--- a/pkgs/development/python-modules/devgoldyutils/default.nix
+++ b/pkgs/development/python-modules/devgoldyutils/default.nix
@@ -25,6 +25,6 @@ buildPythonPackage rec {
     description = "Collection of utility functions for Python used by mov-cli";
     homepage = "https://github.com/THEGOLDENPRO/devgoldyutils";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ roshaen ];
+    maintainers = with lib.maintainers; [ youhaveme9 ];
   };
 }
diff --git a/pkgs/development/python-modules/dirigera/default.nix b/pkgs/development/python-modules/dirigera/default.nix
index 7ad69d67384b..7bb2a1150aef 100644
--- a/pkgs/development/python-modules/dirigera/default.nix
+++ b/pkgs/development/python-modules/dirigera/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dirigera";
-  version = "1.1.9";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Leggin";
     repo = "dirigera";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5vvWBJhTIFmYKIPQqZ1q2zSkru32SyPll8WNgOAdZwU=";
+    hash = "sha256-JmrKeHypWhqOWO0LpzNe1qyeXuYnMyZoM+2IQbz6WDU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-stubs-ext/default.nix b/pkgs/development/python-modules/django-stubs-ext/default.nix
index 557e6410daea..e899451185cc 100644
--- a/pkgs/development/python-modules/django-stubs-ext/default.nix
+++ b/pkgs/development/python-modules/django-stubs-ext/default.nix
@@ -3,15 +3,17 @@
   buildPythonPackage,
   django,
   fetchPypi,
+  oracledb,
   pytestCheckHook,
   pythonOlder,
+  redis,
   setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "django-stubs-ext";
-  version = "5.0.4";
+  version = "5.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,16 +21,21 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "django_stubs_ext";
     inherit version;
-    hash = "sha256-hdoGUiQgR3Qgi+KcfQK0SC1aaSGKcoRlwvvkFyX9yBk=";
+    hash = "sha256-7X1RwLcxZRh5/HXzMfsIBtmLZ7+rRk6W4nJNtrRu+SY=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     typing-extensions
   ];
 
+  optional-dependencies = {
+    redis = [ redis ];
+    oracle = [ oracledb ];
+  };
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "django_stubs_ext" ];
diff --git a/pkgs/development/python-modules/e3-core/0001-use-distro-over-ld.patch b/pkgs/development/python-modules/e3-core/0001-use-distro-over-ld.patch
deleted file mode 100644
index 15548b7aec1c..000000000000
--- a/pkgs/development/python-modules/e3-core/0001-use-distro-over-ld.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 189681bbfb703a7026ca7bbb3b21ef554807b144 Mon Sep 17 00:00:00 2001
-From: tali auster <taliauster@gmail.com>
-Date: Wed, 15 Nov 2023 12:15:34 -0700
-Subject: [PATCH] use distro over ld
-
-The `ld` module (linux distribution) was renamed to `distro`, presumably
-so as not to subsume binutils name.
-
----
- setup.py              | 2 +-
- src/e3/os/platform.py | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/setup.py b/setup.py
-index c32f46f..de1ada6 100644
---- a/setup.py
-+++ b/setup.py
-@@ -25,7 +25,7 @@ for p in ("darwin", "linux", "linux2", "win32"):
-     platform_string = ":sys_platform=='%s'" % p
-     extras_require[platform_string] = ["psutil"]
-     if p in ("linux", "linux2"):
--        extras_require[platform_string].append("ld")
-+        extras_require[platform_string].append("distro")
- 
- # Get e3 version from the VERSION file.
- version_file = os.path.join(os.path.dirname(__file__), "VERSION")
-diff --git a/src/e3/os/platform.py b/src/e3/os/platform.py
-index 2d4e174..a9d12d3 100644
---- a/src/e3/os/platform.py
-+++ b/src/e3/os/platform.py
-@@ -78,7 +78,7 @@ class SystemInfo:
- 
-         # Fetch linux distribution info on linux OS
-         if cls.uname.system == "Linux":  # linux-only
--            import ld
-+            import distro as ld
- 
-             cls.ld_info = {
-                 "name": ld.name(),
--- 
-2.40.1
-
diff --git a/pkgs/development/python-modules/e3-core/default.nix b/pkgs/development/python-modules/e3-core/default.nix
index a6538d67eb25..9f37786ba4d6 100644
--- a/pkgs/development/python-modules/e3-core/default.nix
+++ b/pkgs/development/python-modules/e3-core/default.nix
@@ -1,18 +1,19 @@
 {
+  lib,
+  stdenv,
   autoPatchelfHook,
   buildPythonPackage,
   colorama,
   distro,
   fetchFromGitHub,
-  lib,
   packaging,
   psutil,
   python-dateutil,
+  pythonOlder,
   pyyaml,
-  requests,
   requests-cache,
   requests-toolbelt,
-  stdenv,
+  requests,
   setuptools,
   stevedore,
   tqdm,
@@ -20,38 +21,37 @@
 
 buildPythonPackage rec {
   pname = "e3-core";
-  version = "22.5.0";
+  version = "22.6.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "e3-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7csZYohU89uavSMPOKGJ8HClmtiweGSghyR7QgFfSY8=";
+    hash = "sha256-6rClGDo8KhBbOg/Rw0nVISVtOAACf5cwSafNInlBGCw=";
   };
 
-  patches = [ ./0001-use-distro-over-ld.patch ];
+  build-system = [ setuptools ];
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    setuptools
-  ];
+  nativeBuildInputs = [ autoPatchelfHook ];
 
-  propagatedBuildInputs =
+  dependencies =
     [
       colorama
       packaging
-      pyyaml
       python-dateutil
+      pyyaml
       requests
       requests-cache
       requests-toolbelt
-      tqdm
       stevedore
+      tqdm
     ]
     ++ lib.optional stdenv.hostPlatform.isLinux [
-      # See setup.py:24. These are required only on Linux. Darwin has its own set
-      # of requirements.
+      # See https://github.com/AdaCore/e3-core/blob/v22.6.0/pyproject.toml#L37-L42
+      # These are required only on Linux. Darwin has its own set of requirements
       psutil
       distro
     ];
diff --git a/pkgs/development/python-modules/e3-testsuite/default.nix b/pkgs/development/python-modules/e3-testsuite/default.nix
index bf8ba8850a3d..9ec1dc51addf 100644
--- a/pkgs/development/python-modules/e3-testsuite/default.nix
+++ b/pkgs/development/python-modules/e3-testsuite/default.nix
@@ -1,8 +1,9 @@
 {
+  lib,
   buildPythonPackage,
   e3-core,
   fetchFromGitHub,
-  lib,
+  pythonOlder,
   setuptools,
 }:
 
@@ -11,23 +12,25 @@ buildPythonPackage rec {
   version = "26.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.9";
+
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "e3-testsuite";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-V20tX0zi2DRHO42udUcW/CDMyBxh1uSTgac0zZGubsI=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ e3-core ];
+  dependencies = [ e3-core ];
 
   pythonImportsCheck = [ "e3" ];
 
   meta = with lib; {
+    description = "Generic testsuite framework in Python";
     changelog = "https://github.com/AdaCore/e3-testsuite/releases/tag/${src.rev}";
     homepage = "https://github.com/AdaCore/e3-testsuite/";
-    description = "Generic testsuite framework in Python";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ heijligen ];
     platforms = platforms.linux;
diff --git a/pkgs/development/python-modules/flickrapi/default.nix b/pkgs/development/python-modules/flickrapi/default.nix
index 9f55251a2c99..9bbd11bd65b6 100644
--- a/pkgs/development/python-modules/flickrapi/default.nix
+++ b/pkgs/development/python-modules/flickrapi/default.nix
@@ -9,23 +9,32 @@
   pytestCheckHook,
   responses,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "flickrapi";
   version = "2.4";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "sybrenstuvel";
-    repo = pname;
+    repo = "flickrapi";
     rev = "version-${version}";
     hash = "sha256-vRZrlXKI0UDdmDevh3XUngH4X8G3VlOCSP0z/rxhIgw=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace tests/test_tokencache.py \
+      --replace-fail "assertEquals" "assertEqual" \
+      --replace-fail "assertNotEquals" "assertNotEqual"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     requests
     requests-toolbelt
     requests-oauthlib
@@ -61,6 +70,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python interface to the Flickr API";
     homepage = "https://stuvel.eu/flickrapi";
+    changelog = "https://github.com/sybrenstuvel/flickrapi/blob/version-${version}/CHANGELOG.md";
     license = licenses.psfl;
     maintainers = with maintainers; [ obadz ];
   };
diff --git a/pkgs/development/python-modules/foolscap/default.nix b/pkgs/development/python-modules/foolscap/default.nix
index 246c97aa9c01..a5f3eb9c60b1 100644
--- a/pkgs/development/python-modules/foolscap/default.nix
+++ b/pkgs/development/python-modules/foolscap/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "foolscap";
-  version = "23.3.0";
+  version = "24.9.0";
 
   pyproject = true;
   build-system = [
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Vu7oXC1brsgBwr2q59TAgx8j1AFRbi5mjRNIWZTbkUU=";
+    hash = "sha256-vWsAdUDbWQuG3e0oAtLq8rA4Ys2wg38fD/h+E1ViQQg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mapclassify/default.nix b/pkgs/development/python-modules/mapclassify/default.nix
index 67fac8b840f2..9a01fd479016 100644
--- a/pkgs/development/python-modules/mapclassify/default.nix
+++ b/pkgs/development/python-modules/mapclassify/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mapclassify";
-  version = "2.8.0";
+  version = "2.8.1";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "pysal";
     repo = "mapclassify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JrFKWkMUu8rjJJb1KK8+R9ANkLhTPf1EmWpzhfE7MAE=";
+    hash = "sha256-VClkMOR8P9sX3slVjJ2xYYLVnvZuOgVYZiCGrBxoZEc=";
   };
 
   build-system = [ setuptools-scm ];
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   meta = {
     description = "Classification Schemes for Choropleth Maps";
     homepage = "https://pysal.org/mapclassify/";
+    changelog = "https://github.com/pysal/mapclassify/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = lib.teams.geospatial.members;
   };
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 66a865f3c719..9c3d5e35e838 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -78,8 +78,8 @@ rec {
       "sha256-/muCi4o6A3bmAvc4w5lSla9ZtE3rMkJoL3LlEjzKoms=";
 
   mypy-boto3-apigateway =
-    buildMypyBoto3Package "apigateway" "1.35.0"
-      "sha256-C+E2aFhPewVkNm0bIAdX2g19A+UoTIFaPM+cE8Khy3A=";
+    buildMypyBoto3Package "apigateway" "1.35.25"
+      "sha256-6jtBmuho1j8GE+6sxqdYYf1XtonWoUu3Vi7tMDkTpa4=";
 
   mypy-boto3-apigatewaymanagementapi =
     buildMypyBoto3Package "apigatewaymanagementapi" "1.35.0"
@@ -142,8 +142,8 @@ rec {
       "sha256-l5hKmbwel2Z5BvQbuKXRsfusKU28laF5mVDDPW+Ij0g=";
 
   mypy-boto3-athena =
-    buildMypyBoto3Package "athena" "1.35.0"
-      "sha256-f/q3R4ZvUQ2+r/XXdGT/MFqiilKaCmdRwj7QuCJ1ZJo=";
+    buildMypyBoto3Package "athena" "1.35.25"
+      "sha256-XcD23pDz3oaNwME+iqmDQr9Lbz8z7NVduFEiTnxV55c=";
 
   mypy-boto3-auditmanager =
     buildMypyBoto3Package "auditmanager" "1.35.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-wBJ7PnAlsi88AZIRPoNgbzOhPwUAJBegtwk+tw1lOwU=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.35.8"
-      "sha256-9M2+Uk/0A5ZozBaOPG+caASEgasz37D12JK78kKNHvI=";
+    buildMypyBoto3Package "ec2" "1.35.25"
+      "sha256-+dD1Rkw+iYThkoPgjL69njG1PXZJWGx/hlYC34VA9lE=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.35.0"
@@ -506,8 +506,8 @@ rec {
       "sha256-ARmcy8oINHgph9PqNtQYyBVEVshBuSHDeju2ynNSqQ8=";
 
   mypy-boto3-emr-serverless =
-    buildMypyBoto3Package "emr-serverless" "1.35.0"
-      "sha256-50WhDh7x/5EPaxeZzNAZrM6FbwvNQlSVpobfSvdBl04=";
+    buildMypyBoto3Package "emr-serverless" "1.35.25"
+      "sha256-9aQOr3oGVejk34AInlyoS9//4DBIR0JBbHGumvanOtw=";
 
   mypy-boto3-entityresolution =
     buildMypyBoto3Package "entityresolution" "1.35.3"
@@ -574,8 +574,8 @@ rec {
       "sha256-RJEZBr3yU/lGEainrpidLsdYBvVOPMq3cIaIpsTAziQ=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.35.23"
-      "sha256-v0uU9EREtfyjbUazDMPPWod/qFITlQrWgnPJoghJXZk=";
+    buildMypyBoto3Package "glue" "1.35.25"
+      "sha256-hWpxnfHPaCUlxFg/3vNhluQnc2IHYoNVq9owH3D2eME=";
 
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.35.0"
@@ -1086,8 +1086,8 @@ rec {
       "sha256-85yUjKQ8oiECUYHhmmYrDssyFSQb6itfIRY2iuwCZdo=";
 
   mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.35.22"
-      "sha256-moU0RLvQFknHPerOQcvXSZw+9CdZ/5Yeno4dZVoXfNo=";
+    buildMypyBoto3Package "rds" "1.35.25"
+      "sha256-I4lTEWslkWlrayRnTG9wZcSdihSEDd51F37a/zdaMY8=";
 
   mypy-boto3-rds-data =
     buildMypyBoto3Package "rds-data" "1.35.0"
@@ -1114,8 +1114,8 @@ rec {
       "sha256-MKlBdSJGl7WCnD66fx5nCPhGAtLtLjoahe08KHTT+KM=";
 
   mypy-boto3-resource-explorer-2 =
-    buildMypyBoto3Package "resource-explorer-2" "1.35.0"
-      "sha256-SWlnIn6Xn5rhngjMTHQWPyqfzZieE9WN1iCB5WxCsnM=";
+    buildMypyBoto3Package "resource-explorer-2" "1.35.25"
+      "sha256-49Ysavsq6tDUQAcJiP4GQkt5zgBz36qufByA88bltco=";
 
   mypy-boto3-resource-groups =
     buildMypyBoto3Package "resource-groups" "1.35.0"
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 5583f0a42614..e879bec83842 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -35,7 +35,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.46.0";
+  version = "1.47.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7.1";
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-f8t/6T7IwWgt3WjMMdx04dunR7i4j6FBDN/abuGlEU0=";
+    hash = "sha256-8zH9G28Z4CpbqQxGkPnKiD4DxasuDuK1t4jr9PpPv3I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/proton-core/default.nix b/pkgs/development/python-modules/proton-core/default.nix
index 12df2934bff2..91bffd81e2ce 100644
--- a/pkgs/development/python-modules/proton-core/default.nix
+++ b/pkgs/development/python-modules/proton-core/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "proton-core";
-  version = "0.2.0";
+  version = "0.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IiKmtgcCSe2q3qaNuUSaC/D/vSQzVq7w8VN2Xq81+tQ=";
+    hash = "sha256-2Drlai/PYzi1z1CtDYfNhol2wamb/HNrvUhj0XsiyHg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index 6e9c6ca53f26..84e97f2bf050 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pyquil";
-  version = "4.14.2";
+  version = "4.14.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = "pyquil";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9P2AJPr65jNOHsKuF9qYcF/8s8IIIb9WeNUfAwrnlgE=";
+    hash = "sha256-kGrOvec2q1GoVweu5tTbz8kvnjG6RAfjlF64Uf3RTxw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/python-ffmpeg/default.nix b/pkgs/development/python-modules/python-ffmpeg/default.nix
index 3eba0ddb1d22..1991f7492667 100644
--- a/pkgs/development/python-modules/python-ffmpeg/default.nix
+++ b/pkgs/development/python-modules/python-ffmpeg/default.nix
@@ -25,6 +25,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/jonghwanhyeon/python-ffmpeg";
     description = "Python binding for FFmpeg which provides sync and async APIs";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ roshaen ];
+    maintainers = with lib.maintainers; [ youhaveme9 ];
   };
 }
diff --git a/pkgs/development/python-modules/pytubefix/default.nix b/pkgs/development/python-modules/pytubefix/default.nix
index a42273fee7cc..343bcca0a965 100644
--- a/pkgs/development/python-modules/pytubefix/default.nix
+++ b/pkgs/development/python-modules/pytubefix/default.nix
@@ -39,6 +39,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/JuanBindez/pytubefix";
     description = "Pytube fork with additional features and fixes";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ roshaen ];
+    maintainers = with lib.maintainers; [ youhaveme9 ];
   };
 }
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
deleted file mode 100644
index bfbd39ce5cc4..000000000000
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  lib,
-  aiofiles,
-  aiohttp,
-  aioshutil,
-  async-timeout,
-  buildPythonPackage,
-  dateparser,
-  fetchFromGitHub,
-  ffmpeg,
-  hatch-vcs,
-  hatchling,
-  ipython,
-  orjson,
-  packaging,
-  pillow,
-  platformdirs,
-  py,
-  pydantic,
-  pyjwt,
-  pytest-aiohttp,
-  pytest-asyncio,
-  pytest-benchmark,
-  pytest-timeout,
-  pytest-xdist,
-  pytestCheckHook,
-  python-dotenv,
-  pythonOlder,
-  pytz,
-  termcolor,
-  typer,
-}:
-
-buildPythonPackage rec {
-  pname = "pyunifiprotect";
-  version = "5.1.2";
-  pyproject = true;
-
-  disabled = pythonOlder "3.9";
-
-  src = fetchFromGitHub {
-    owner = "briis";
-    repo = "pyunifiprotect";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-DtQm6u3O0kdVJ23Ch+hJQ6HTOt5iAMdhCzC1K/oICWk=";
-  };
-
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "--strict-markers -ra -Wd --ignore=.* --no-cov-on-fail --cov=pyunifiprotect --cov-append --maxfail=10 -n=auto" ""
-  '';
-
-  build-system = [
-    hatch-vcs
-    hatchling
-  ];
-
-  dependencies = [
-    aiofiles
-    aiohttp
-    aioshutil
-    dateparser
-    orjson
-    packaging
-    pillow
-    platformdirs
-    pydantic
-    pyjwt
-    pytz
-    typer
-  ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
-
-  passthru.optional-dependencies = {
-    shell = [
-      ipython
-      python-dotenv
-      termcolor
-    ];
-  };
-
-  nativeCheckInputs = [
-    ffmpeg # Required for command ffprobe
-    py
-    pytest-aiohttp
-    pytest-asyncio
-    pytest-benchmark
-    pytest-timeout
-    pytest-xdist
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "pyunifiprotect" ];
-
-  pytestFlagsArray = [ "--benchmark-disable" ];
-
-  meta = with lib; {
-    description = "Library for interacting with the Unifi Protect API";
-    mainProgram = "unifi-protect";
-    homepage = "https://github.com/briis/pyunifiprotect";
-    changelog = "https://github.com/AngellusMortis/pyunifiprotect/releases/tag/v${version}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/development/python-modules/ray/binary-hashes.nix b/pkgs/development/python-modules/ray/binary-hashes.nix
index 636d285e52ef..4ce40625e3c3 100644
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@@ -1,11 +1,11 @@
 {
   cp310 = {
-    hash = "sha256-74ryZ6SIQ3pBX+tZOKjf5XpVOhyoRRI8RllkRj5452g=";
+    hash = "sha256-KZMkQeaKt9rTWydsdjZwv0Lr9yHN3E9N6CAL2SrAXFg=";
   };
   cp311 = {
-    hash = "sha256-WAidlVzqyYPVhbA9QCQ3nxUViAsJHqz1oaMm8yEgxCM=";
+    hash = "sha256-tCAnnKFPAswn/Fkv8fKNqaoIuWIxa/Zd3zcNuHcILpE=";
   };
   cp312 = {
-    hash = "sha256-V6ye3HTXk8NYNaui1BbXyJwmtdLZurbsIiH8LpV4rcc=";
+    hash = "sha256-AmjHvC6Ltu+buJaSmd61hXv2cr/LWdqV23SVqKUC+Lo=";
   };
 }
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 19728becf147..6a9532f953d5 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -56,7 +56,7 @@
 
 let
   pname = "ray";
-  version = "2.36.1";
+  version = "2.37.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -162,6 +162,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/ray-project/ray/releases/tag/ray-${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ billhuang ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index ccf537e9a20e..d77410a53a8b 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.7.8";
+  version = "0.7.9";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-2UXkfijLeMOpyurR1Bz0dbQxKO7efRp3UcqXIUWRjs0=";
+    hash = "sha256-O3dxfO8MrTKaYRCBNygZlXKuIA3rjEr8TCtR/vrUYmo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 3fd302784c4d..1e36afd6e60f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1238";
+  version = "3.0.1239";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-+cLGJA4iZvcrzk5R7J/7l7oSQeU6DuhkChldndSOFEM=";
+    hash = "sha256-clFRMofnDhC+9+cIGfhSq/03rxujG6WDu3xW1PC/hUI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 7ead573d36df..fd56262a2e74 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.18.4";
+  version = "2.19.0";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-nVeIdwTg1BdRrnvwVlmo0bZh1OopMn3WCBaHxpoJas8=";
+    hash = "sha256-2t1X0SVkJBHcVqTCPdclDoZt8Z+ko9KE572cAQAcpxE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/butane/default.nix b/pkgs/development/tools/butane/default.nix
index 01ba6089364e..f525d9e5ce4c 100644
--- a/pkgs/development/tools/butane/default.nix
+++ b/pkgs/development/tools/butane/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "butane";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "butane";
     rev = "v${version}";
-    hash = "sha256-KsI+mt7nJHwrq0+GPNcI79jRy/4WEjHp2/egw0PcRLM=";
+    hash = "sha256-ELCERcgw01RcSMQjM0PL8CyTKrdfEPV9U8/RSf7YxCs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/database/surrealdb-migrations/default.nix b/pkgs/development/tools/database/surrealdb-migrations/default.nix
index 2fb443491650..e47174c93450 100644
--- a/pkgs/development/tools/database/surrealdb-migrations/default.nix
+++ b/pkgs/development/tools/database/surrealdb-migrations/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "surrealdb-migrations";
-  version = "2.0.0-preview.3";
+  version = "2.0.0";
 in
 rustPlatform.buildRustPackage rec {
   inherit pname version;
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage rec {
     owner = "Odonno";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BSLUhXxZyffH6HX3RR6PqXts76ERa0bpct/qs0Sf0NE=";
+    hash = "sha256-MrIawJr8EydfYFVzxODUZ7jDj0B0M1FAuX4Arktbf4Y=";
   };
 
-  cargoHash = "sha256-jj1ytX44XoNKR+TCn/MpWk8CFM/DvHSwyfjVe3ca+AA=";
+  cargoHash = "sha256-ELYBEQrh80LdNYNZwcGVh9GE+dSfjF+RuO8fd0PabIw=";
 
   buildInputs = [ ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
diff --git a/pkgs/development/tools/extism-cli/default.nix b/pkgs/development/tools/extism-cli/default.nix
index ac577f16a970..9148c79da228 100644
--- a/pkgs/development/tools/extism-cli/default.nix
+++ b/pkgs/development/tools/extism-cli/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "extism-cli";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "extism";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kAdvQtc3FWXQffL1KRg4peeAJ+0439n609jTV9u11aA=";
+    hash = "sha256-6EM+J5LLSt18/Sl7zUG3SDlawVA28IBUbb9tQgK6d3E=";
   };
 
-  vendorHash = "sha256-yQ6LGWNVWxrUqFskt22+G9OfbcKfHXh1bf4uNoATsxg=";
+  vendorHash = "sha256-n4Ue2TSG0zbC2uqXiNakqWQjxhbOgXnC2Y7EKP2BM8Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index 3390127d678a..8dc6c61283be 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.13.21";
+  version = "1.13.22";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-xzg2KTZpa8DkxifQH7Q6pvyNEZj/mnXkBktNThMbI5k=";
+    hash = "sha256-zFF8cHElrWtLOa5xtO5N0520JC47rGOQ7YshEf12tCw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/games/heroic/default.nix b/pkgs/games/heroic/default.nix
index 4a4e2abd66d1..a9c85e26b513 100644
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@@ -1,26 +1,28 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pnpm
-, nodejs
-, makeWrapper
-, electron
-, vulkan-helper
-, gogdl
-, legendary-gl
-, nile
-, comet-gog
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  pnpm,
+  nodejs,
+  makeWrapper,
+  electron,
+  vulkan-helper,
+  gogdl,
+  legendary-gl,
+  nile,
+  comet-gog,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "heroic-unwrapped";
-  version = "2.15.1";
+  version = "2.15.2";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+OQRcBOf9Y34DD7FOp/3SO05mREG6or/HPiOkasHWPM=";
+    hash = "sha256-AndJqk1VAUdC4pOTRzyfhdxmzJMskGF6pUiqPs3fIy4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
@@ -93,6 +95,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    inherit (finalAttrs) pnpmDeps;
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Native GOG, Epic, and Amazon Games Launcher for Linux, Windows and Mac";
     homepage = "https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher";
diff --git a/pkgs/games/heroic/fhsenv.nix b/pkgs/games/heroic/fhsenv.nix
index 54732d0e87d5..4fe942919319 100644
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@@ -1,7 +1,8 @@
-{ buildFHSEnv
-, heroic-unwrapped
-, extraPkgs ? pkgs: [ ]
-, extraLibraries ? pkgs: [ ]
+{
+  buildFHSEnv,
+  heroic-unwrapped,
+  extraPkgs ? pkgs: [ ],
+  extraLibraries ? pkgs: [ ],
 }:
 
 buildFHSEnv {
@@ -15,120 +16,131 @@ buildFHSEnv {
   # required by Electron
   unshareIpc = false;
 
-  targetPkgs = pkgs: with pkgs; [
-    heroic-unwrapped
-    gamemode
-    curl
-    gawk
-    zenity
-    plasma5Packages.kdialog
-    mangohud
-    nettools
-    opencl-headers
-    p7zip
-    perl
-    psmisc
-    python3
-    unzip
-    which
-    xorg.xrandr
-    zstd
-  ] ++ extraPkgs pkgs;
+  targetPkgs =
+    pkgs:
+    with pkgs;
+    [
+      heroic-unwrapped
+      gamemode
+      curl
+      gawk
+      zenity
+      plasma5Packages.kdialog
+      mangohud
+      nettools
+      opencl-headers
+      p7zip
+      perl
+      psmisc
+      python3
+      unzip
+      which
+      xorg.xrandr
+      zstd
+    ]
+    ++ extraPkgs pkgs;
 
-  multiPkgs = let
-    xorgDeps = pkgs: with pkgs.xorg; [
-      libpthreadstubs
-      libSM
-      libX11
-      libXaw
-      libxcb
-      libXcomposite
-      libXcursor
-      libXdmcp
-      libXext
-      libXi
-      libXinerama
-      libXmu
-      libXrandr
-      libXrender
-      libXv
-      libXxf86vm
-    ];
-    gstreamerDeps = pkgs: with pkgs.gst_all_1; [
-      gstreamer
-      gst-plugins-base
-      gst-plugins-good
-      gst-plugins-ugly
-      gst-plugins-bad
-      gst-libav
-    ];
-  in pkgs: with pkgs; [
-    alsa-lib
-    alsa-plugins
-    bash
-    cabextract
-    cairo
-    coreutils
-    cups
-    dbus
-    freealut
-    freetype
-    fribidi
-    giflib
-    glib
-    gnutls
-    gtk3
-    icu
-    lcms2
-    libevdev
-    libgcrypt
-    libGLU
-    libglvnd
-    libgpg-error
-    libgudev
-    libjpeg
-    libkrb5
-    libmpeg2
-    libogg
-    libopus
-    libpng
-    libpulseaudio
-    libselinux
-    libsndfile
-    libsoup
-    libtheora
-    libtiff
-    libunwind
-    libusb1
-    libv4l
-    libva
-    libvdpau
-    libvorbis
-    libvpx
-    libwebp
-    libxkbcommon
-    libxml2
-    mpg123
-    ncurses
-    ocl-icd
-    openal
-    openldap
-    openssl
-    pango
-    pipewire
-    samba4
-    sane-backends
-    SDL2
-    speex
-    sqlite
-    udev
-    unixODBC
-    util-linux
-    v4l-utils
-    vulkan-loader
-    wayland
-    zlib
-  ] ++ xorgDeps pkgs
+  multiPkgs =
+    let
+      xorgDeps =
+        pkgs: with pkgs.xorg; [
+          libpthreadstubs
+          libSM
+          libX11
+          libXaw
+          libxcb
+          libXcomposite
+          libXcursor
+          libXdmcp
+          libXext
+          libXi
+          libXinerama
+          libXmu
+          libXrandr
+          libXrender
+          libXv
+          libXxf86vm
+        ];
+      gstreamerDeps =
+        pkgs: with pkgs.gst_all_1; [
+          gstreamer
+          gst-plugins-base
+          gst-plugins-good
+          gst-plugins-ugly
+          gst-plugins-bad
+          gst-libav
+        ];
+    in
+    pkgs:
+    with pkgs;
+    [
+      alsa-lib
+      alsa-plugins
+      bash
+      cabextract
+      cairo
+      coreutils
+      cups
+      dbus
+      freealut
+      freetype
+      fribidi
+      giflib
+      glib
+      gnutls
+      gtk3
+      icu
+      lcms2
+      libevdev
+      libgcrypt
+      libGLU
+      libglvnd
+      libgpg-error
+      libgudev
+      libjpeg
+      libkrb5
+      libmpeg2
+      libogg
+      libopus
+      libpng
+      libpulseaudio
+      libselinux
+      libsndfile
+      libsoup
+      libtheora
+      libtiff
+      libunwind
+      libusb1
+      libv4l
+      libva
+      libvdpau
+      libvorbis
+      libvpx
+      libwebp
+      libxkbcommon
+      libxml2
+      mpg123
+      ncurses
+      ocl-icd
+      openal
+      openldap
+      openssl
+      pango
+      pipewire
+      samba4
+      sane-backends
+      SDL2
+      speex
+      sqlite
+      udev
+      unixODBC
+      util-linux
+      v4l-utils
+      vulkan-loader
+      wayland
+      zlib
+    ]
+    ++ xorgDeps pkgs
     ++ gstreamerDeps pkgs
     ++ extraLibraries pkgs;
 
diff --git a/pkgs/games/rpg-cli/default.nix b/pkgs/games/rpg-cli/default.nix
index cdd6eb0e574a..f6c3249c7259 100644
--- a/pkgs/games/rpg-cli/default.nix
+++ b/pkgs/games/rpg-cli/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rpg-cli";
-  version = "1.0.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "facundoolano";
     repo = pname;
     rev = version;
-    sha256 = "sha256-rhG/EK68PWvQYoZdjhk0w7oNmh/QiTaAt4/WgEkgxEA=";
+    sha256 = "sha256-xNkM8qN9vg/WGRR/96aCQRVjIbSdSs2845l6oE6+tzg=";
   };
 
-  cargoHash = "sha256-YXQohmDmkClziaLkL2N4cGURZ0tewyt7BuNY4hS+a4w=";
+  cargoHash = "sha256-AiNyyLEpVhNhDGq2vngna1ZJmPiI0rFT00gj7vXOW20=";
 
   # tests assume the authors macbook, and thus fail
   doCheck = false;
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index b47dbec76164..274047afe95e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -158,7 +158,7 @@ let
     ];
 
     propagatedBuildInputs = [
-      libapparmor.python
+      (libapparmor.python or null)
 
       # Used by aa-notify
       python.pkgs.notify2
diff --git a/pkgs/servers/mail/mlmmj/default.nix b/pkgs/servers/mail/mlmmj/default.nix
index 2795ba1af358..76ce2d011599 100644
--- a/pkgs/servers/mail/mlmmj/default.nix
+++ b/pkgs/servers/mail/mlmmj/default.nix
@@ -1,27 +1,32 @@
-{ lib, stdenv, fetchurl }:
-
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  autoreconfHook,
+  atf,
+  pkg-config,
+  kyua,
+}:
 stdenv.mkDerivation rec {
-
   pname = "mlmmj";
-  version = "1.3.0";
+  version = "1.4.7";
 
-  src = fetchurl {
-    url = "http://mlmmj.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "1sghqvwizvm1a9w56r34qy5njaq1c26bagj85r60h32gh3fx02bn";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = pname;
+    repo = pname;
+    rev = "refs/tags/RELEASE_" + lib.replaceStrings ["."] ["_"] version;
+    hash = "sha256-QetxCxny9elPetKuAsgKF0xTov1bNIRxi7gWhv6dYyU=";
   };
 
+  nativeBuildInputs = [autoreconfHook atf pkg-config kyua];
+
   configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # AC_FUNC_MALLOC is broken on cross builds.
     "ac_cv_func_malloc_0_nonnull=yes"
     "ac_cv_func_realloc_0_nonnull=yes"
   ];
 
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: getlistdelim.o:/build/mlmmj-1.3.0/src/../include/mlmmj.h:84: multiple definition of
-  #     `subtype_strs'; mlmmj-send.o:/build/mlmmj-1.3.0/src/../include/mlmmj.h:84: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
   postInstall = ''
     # grab all documentation files
     docfiles=$(find -maxdepth 1 -name "[[:upper:]][[:upper:]]*")
@@ -31,9 +36,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://mlmmj.org";
     description = "Mailing List Management Made Joyful";
-    maintainers = [ maintainers.edwtjo ];
+    maintainers = [maintainers.edwtjo];
     platforms = platforms.linux;
     license = licenses.mit;
   };
-
 }
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index fdb0d6cb5c4d..61076419ee15 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       --set PHOTOPRISM_ASSETS_PATH ${assets_path} \
       --set PHOTOPRISM_DARKTABLE_BIN ${darktable}/bin/darktable-cli \
       --set PHOTOPRISM_RAWTHERAPEE_BIN ${rawtherapee}/bin/rawtherapee-cli \
-      --set PHOTOPRISM_HEIFCONVERT_BIN ${libheif}/bin/heif-convert \
+      --set PHOTOPRISM_HEIFCONVERT_BIN ${libheif}/bin/heif-dec \
       --set PHOTOPRISM_RSVGCONVERT_BIN ${librsvg}/bin/rsvg-convert \
       --set PHOTOPRISM_FFMPEG_BIN ${ffmpeg}/bin/ffmpeg \
       --set PHOTOPRISM_EXIFTOOL_BIN ${exiftool}/bin/exiftool \
diff --git a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
index ed0bfde0caba..42d055a029ae 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, openssl, zlib, readline, libkrb5, libxcrypt }:
+{ lib, stdenv, fetchFromGitHub, postgresql }:
 
 stdenv.mkDerivation rec {
   pname = "pg_auto_failover";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_repack.nix b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
index b2a608a2bc39..3361e2100da2 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_repack.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
@@ -4,7 +4,6 @@
 , postgresql
 , postgresqlTestHook
 , testers
-, zlib
 }:
 
 stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/servers/sql/postgresql/ext/pg_similarity.nix b/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
index 20e5299da25a..a0669331055b 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
@@ -12,7 +12,9 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ postgresql gcc ];
-  buildPhase = "USE_PGXS=1 make";
+
+  makeFlags = [ "USE_PGXS=1" ];
+
   installPhase = ''
     install -D pg_similarity${postgresql.dlSuffix} -t $out/lib/
     install -D ./{pg_similarity--unpackaged--1.0.sql,pg_similarity--1.0.sql,pg_similarity.control} -t $out/share/postgresql/extension
diff --git a/pkgs/servers/sql/postgresql/ext/plr.nix b/pkgs/servers/sql/postgresql/ext/plr.nix
index 1800b424716f..05d22c19a8b0 100644
--- a/pkgs/servers/sql/postgresql/ext/plr.nix
+++ b/pkgs/servers/sql/postgresql/ext/plr.nix
@@ -13,9 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ R postgresql ];
-  preBuild = ''
-    export USE_PGXS=1
-  '';
+
+  makeFlags = [ "USE_PGXS=1" ];
+
   installPhase = ''
     install -D plr${postgresql.dlSuffix} -t $out/lib/
     install -D {plr--*.sql,plr.control} -t $out/share/postgresql/extension
diff --git a/pkgs/servers/sql/postgresql/ext/repmgr.nix b/pkgs/servers/sql/postgresql/ext/repmgr.nix
index dd55743a43cf..565f3fdaf60d 100644
--- a/pkgs/servers/sql/postgresql/ext/repmgr.nix
+++ b/pkgs/servers/sql/postgresql/ext/repmgr.nix
@@ -5,7 +5,6 @@
 , flex
 , curl
 , json_c
-, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/servers/sql/postgresql/ext/system_stats.nix b/pkgs/servers/sql/postgresql/ext/system_stats.nix
index bc2a0973b95f..c1700fc0380d 100644
--- a/pkgs/servers/sql/postgresql/ext/system_stats.nix
+++ b/pkgs/servers/sql/postgresql/ext/system_stats.nix
@@ -6,7 +6,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "system_stats";
-  version = "3.0";
+  version = "3.2";
 
   buildInputs = [ postgresql ];
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner = "EnterpriseDB";
     repo = "system_stats";
     rev = "v${version}";
-    hash = "sha256-LuX7/LOi0rl6L/kjbjq7rr2zPcGIOYB7hdZBNJ9xqak=";
+    hash = "sha256-/xXnui0S0ZjRw7P8kMAgttHVv8T41aOhM3pM8P0OTig=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index b24131411987..e1b26e12cca8 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -15,7 +15,7 @@
 }:
 
 let
-  version = "1.74.0";
+  version = "1.74.1";
 in
 buildGoModule {
   pname = "tailscale";
@@ -25,7 +25,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-KTg1rxyCgvZAwkGxhFXLff5UggKlqa6VLMItK81JV2k=";
+    hash = "sha256-672FtDKgz7Nmoufoe4Xg/b8sA8EuKH8X+3n9PAKYjFk=";
   };
 
   patches = [
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index e1149cf9c687..cf4337a98fe7 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,14 +5,14 @@
 , git, nix, nixfmt-classic, jq, coreutils, gnused, curl, cacert, bash }:
 
 stdenv.mkDerivation rec {
-  version = "2024-09-01";
+  version = "2024-09-22";
   pname = "oh-my-zsh";
 
   src = fetchFromGitHub {
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    rev = "b8c69d265257fae88fe504ea43cbcf2728bc1308";
-    sha256 = "sha256-Q0SjYWkWY5/haoPunp5yusYoXIXzmB2tces/9gOZgJM=";
+    rev = "f11cc8fea190eb9a1638dc67877436d0b8475ff5";
+    sha256 = "sha256-9rk9iyz7uK1JfNfBq3jxrB3qzdR7xo43899KIivS/Zo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/admin/afterburn/default.nix b/pkgs/tools/admin/afterburn/default.nix
index 10f196979d70..918a9ab7fc20 100644
--- a/pkgs/tools/admin/afterburn/default.nix
+++ b/pkgs/tools/admin/afterburn/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "afterburn";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "afterburn";
     rev = "v${version}";
-    sha256 = "sha256-IAYQJviSQHKeayI0uAEbXX+vQxfAbMOqP2fH+2VPamQ=";
+    sha256 = "sha256-j2eQUro0Rx1axBAaZDNICRrkygb4JAyxVAER/5BXXLY=";
   };
 
-  cargoHash = "sha256-BJ8WV8FcRrwPHhCY2GiOWDP72/T3K9eJIrPeoIa+9Sk=";
+  cargoHash = "sha256-rk/lVoPdA9Uj/MorMchVlQQB9bYmNC90NqM6w9FXLoc=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index 4fbe229b2c6d..89f1ad466b10 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-prvdxWdv580BmhjhP6h4FHyjCDlgr5/Z1kg2wOS+pR0=";
+    sha256 = "sha256-BVliK88TRcpQEWnj2PVBJOtdehn4ZuYUWX9lr5MRbIM=";
   };
 
-  vendorHash = "sha256-g7GKABv7SunVhRUd4y3ZSqD5lnFxM5nuaHJhxFuF/FE=";
+  vendorHash = "sha256-uKzs+plk1W2S7iPv2J1Mi1Ff88+82zrIXLy2eTzD/Hc=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index e83ff967b96d..7345f54a99f3 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.21.5";
+  version = "1.21.6";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Zv5hHDqjfpKiXYhM8CTXVJxqFE8dZ5mFDNnq6k0GWwM=";
+    hash = "sha256-VDHsSMVxdkCnJlNXbuoR1PS0W5YUuj+Yh4VLWREVG1k=";
   };
   vendorHash = "sha256-TuxYJ3u4/5PJYRoRgom+M1au9XerZ+vj9X3jUWTPM58=";
 
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index cb0a8f7c7e29..f761ffbce26f 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.25.15";
+  version = "2.25.16";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-fSB/CnxzqCK63gBpHB3rkUCE492W3jmb4hfQXuJchiQ=";
+    hash = "sha256-DewkWiPWPcF/8GDdqKMf99UxSXOeZhGsAywYJZAxxKA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 gobject-introspection ];
diff --git a/pkgs/tools/misc/macchina/default.nix b/pkgs/tools/misc/macchina/default.nix
index d5b4343362a6..4427366bbedf 100644
--- a/pkgs/tools/misc/macchina/default.nix
+++ b/pkgs/tools/misc/macchina/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "6.1.8";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MntHq5nphfjbO0Rx7v6WjsnabSMH5Ke3aR9/embG/rk=";
+    hash = "sha256-v1EaC4VBOvZFL2GoKlTDBMjSe8+4bxaLFvy2V7e7RW4=";
   };
 
-  cargoHash = "sha256-w8WIpT8rUe7olB5kdpDyrId6D698AhcqzsfpOlutaHQ=";
+  cargoHash = "sha256-k17x7BEaBWo4Ka2HIjHd4DrO/tolKR/+s7Mm5ZzJk/Y=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/poop/default.nix b/pkgs/tools/misc/poop/default.nix
index d3b444d9472f..9b42801c5ebd 100644
--- a/pkgs/tools/misc/poop/default.nix
+++ b/pkgs/tools/misc/poop/default.nix
@@ -1,39 +1,23 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, zig_0_11
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  zig,
 }:
 
 stdenv.mkDerivation rec {
   pname = "poop";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "andrewrk";
     repo = "poop";
     rev = version;
-    hash = "sha256-ekZpulQ1NpEOCG9KU2I4O0NL8mD+CC7bKF0tZbl7vHo=";
+    hash = "sha256-zrqR/TTELhsBIX42PysFsHPRs8Lx/zHcmi+VMDw1SdQ=";
   };
 
-  # fix compilation with zig 0.11
-  patches = [
-    # https://github.com/andrewrk/poop/pull/41
-    (fetchpatch {
-      name = "update-to-zig-0-11-0.patch";
-      url = "https://github.com/andrewrk/poop/commit/15c794d9dea91570485104cda26346f2ae5c9365.patch";
-      hash = "sha256-iv3IuYIDPzs98wiTXcO0igngaRRdQnASvzA4bYET54c=";
-    })
-    # https://github.com/andrewrk/poop/pull/36
-    (fetchpatch {
-      name = "update-zig-to-latest-0-11-0-dev-3883-7166407d8.patch";
-      url = "https://github.com/andrewrk/poop/commit/b1ca37c0cf637e9bbbf24cd243bafaedf02fa8c7.patch";
-      hash = "sha256-/j2zqi0Q2Pl7ZL+4GflwD/MnqcKScT/1SdYJAQ3o4bU=";
-    })
-  ];
-
   nativeBuildInputs = [
-    zig_0_11.hook
+    zig.hook
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/security/ares-rs/default.nix b/pkgs/tools/security/ares-rs/default.nix
index 433cdaa5792a..b23f13de05ef 100644
--- a/pkgs/tools/security/ares-rs/default.nix
+++ b/pkgs/tools/security/ares-rs/default.nix
@@ -1,25 +1,26 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ares-rs";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "bee-san";
     repo = "ares";
-    rev = "refs/tags/${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-F+uBGRL1G8kiNZUCsiPbISBfId5BPwShenusqkcsHug=";
   };
 
-  cargoHash = "sha256-7zDq66oWT+j6t9LEBUoeby8MQ1Ihhvk3KLwWPQAThyc=";
+  cargoHash = "sha256-c50HCwWwW4Fyg6hC1JqBfKtwq6kgReSOIBYXvwm04yA=";
 
   meta = with lib; {
     description = "Automated decoding of encrypted text without knowing the key or ciphers used";
     homepage = "https://github.com/bee-san/ares";
-    changelog = "https://github.com/bee-san/Ares/releases/tag${version}";
+    changelog = "https://github.com/bee-san/Ares/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "ares";
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 098bd180b5a3..2d34dc01646c 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.19.0";
+  version = "11.23.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-37i7lbkw70DpwCUvZtv6548l6csx3ozG+1gPTKhJQFg=";
+    hash = "sha256-oZCKNsbDdsqlh763/T23+A03Qt8f/XyC8MItMah+U3w=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-8+qS6fR/5oYHP1QhoHfByQ7AayYPYVg4xEtF3617aJM=";
+  vendorHash = "sha256-QqK527y4W+B7jhRoOkpt9QRyERA6Tn4Dwaq+gzN3k4U=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/cyclonedx-gomod/default.nix b/pkgs/tools/security/cyclonedx-gomod/default.nix
index 2a27f7b6a35b..a8f75da90f54 100644
--- a/pkgs/tools/security/cyclonedx-gomod/default.nix
+++ b/pkgs/tools/security/cyclonedx-gomod/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cyclonedx-gomod";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-gomod";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RM8ZH1mO+72ptoU7YKXlCZAyDhYZ7MFXyDYrqBQwsDI=";
+    hash = "sha256-s5kzyQPf29RZPnPtgFf4IVHnOtVZOtGSQqy1BNVVykQ=";
   };
 
-  vendorHash = "sha256-1ibMneSOYs5C6Ul8m/rVXVFBJHZrH1D5eWRwVVJ6a+A=";
+  vendorHash = "sha256-Sz2NCznyD0tMuho9kr+U35I8bS/WK276nPdt83k1zfU=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index af20cb3ff775..61c5daf41a23 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ggshield";
-  version = "1.31.0";
+  version = "1.32.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ShczC0DvAO92apkNq5oyYRbkqGdqwl6vaCY1hn8O6so=";
+    hash = "sha256-yqR5kgXhR4YUih46RuSlOmD2CgdN40QpUho6WTha60U=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/security/gotestwaf/default.nix b/pkgs/tools/security/gotestwaf/default.nix
index 28305ceb4e8e..6cbe088d6871 100644
--- a/pkgs/tools/security/gotestwaf/default.nix
+++ b/pkgs/tools/security/gotestwaf/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gotestwaf";
-  version = "0.4.19";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = "gotestwaf";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ax2HPhdaqawpFe2AZg3SVsEJLG7gEgL7632iRADpaa8=";
+    hash = "sha256-stGjxv9cgYxxclQpyytN6dhFm2G1Gxbf9MdyKw6gEC4=";
   };
 
-  vendorHash = null;
+  vendorHash = "sha256-mPqCphweDF9RQibdjTaXXfXdO8NENHVMdIPxrJEw2g4=";
 
   # Some tests require networking as of v0.4.0
   doCheck = false;
@@ -28,11 +28,6 @@ buildGoModule rec {
     "-X=github.com/wallarm/gotestwaf/internal/version.Version=v${version}"
   ];
 
-  postFixup = ''
-    # Rename binary
-    mv $out/bin/cmd $out/bin/${pname}
-  '';
-
   passthru.tests.version = testers.testVersion {
     command = "gotestwaf --version";
     package = gotestwaf;
@@ -41,10 +36,10 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Tool for API and OWASP attack simulation";
-    mainProgram = "gotestwaf";
     homepage = "https://github.com/wallarm/gotestwaf";
     changelog = "https://github.com/wallarm/gotestwaf/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "gotestwaf";
   };
 }
diff --git a/pkgs/tools/security/gowitness/default.nix b/pkgs/tools/security/gowitness/default.nix
index ab31281bbd28..d4b893d9f870 100644
--- a/pkgs/tools/security/gowitness/default.nix
+++ b/pkgs/tools/security/gowitness/default.nix
@@ -1,20 +1,21 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "gowitness";
-  version = "2.5.1";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "sensepost";
     repo = "gowitness";
     rev = "refs/tags/${version}";
-    hash = "sha256-37OorjzxDu27FNAz4LTtQdFjt0tL9jSb9tGZhlq797Q=";
+    hash = "sha256-yKG4qLjeZThFEMqMnUv4ryvM2e3uH5GLuVP3oa6XHtE=";
   };
 
-  vendorHash = "sha256-Exw5NfR3nDYH+hWMPOKuVIRyrVkOJyP7Kwe4jzQwnsI=";
+  vendorHash = "sha256-PjbC10Dh3tDF0mP2k4ei6ZSS3ND2wAaB1+Llmj37TR8=";
 
   ldflags = [
     "-s"
@@ -23,10 +24,10 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Web screenshot utility";
-    mainProgram = "gowitness";
     homepage = "https://github.com/sensepost/gowitness";
     changelog = "https://github.com/sensepost/gowitness/releases/tag/${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "gowitness";
   };
 }
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 683e32288773..0362b8545d7e 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.82.2";
+  version = "3.82.3";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-reQJE3UG1bWS3RrMW2c4nq/2AOQ3mYtbXVKu+cwzrJM=";
+    hash = "sha256-Kv7IS7kladdTbPPWbgylqPrqSdn4r9USUMm4rnC4H08=";
   };
 
-  vendorHash = "sha256-h3thO9sYYv2yiVcBPEu36RiYgYNnumRc73bNXNOIdA4=";
+  vendorHash = "sha256-dRxnxwxQKdFNf6Ng0E2AQDef1zb3RlBH7glczfYKWMQ=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/virtualization/jumppad/default.nix b/pkgs/tools/virtualization/jumppad/default.nix
index 78dd09d53c1f..ee521f6b5260 100644
--- a/pkgs/tools/virtualization/jumppad/default.nix
+++ b/pkgs/tools/virtualization/jumppad/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "jumppad";
-  version = "0.13.3";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "jumppad-labs";
     repo = "jumppad";
     rev = version;
-    hash = "sha256-k8ZSiV+9pEmczTCb51rj5HP1rm6Us78HWi81uJhL9EM=";
+    hash = "sha256-f9V3dws4zvjh3H61FWNv9r/G9EplWR0aA2af2EdjhBs=";
   };
-  vendorHash = "sha256-R1B6JQBD2qOEWFngMDkQH0rxvLNdVGS6B3aF+UWH3C4=";
+  vendorHash = "sha256-S4SyuidH8sxJbuG7yHgSP/iHcuP1h5EHaW8X6gG4GNw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3df3d70f44c7..9661a24a7225 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -454,6 +454,8 @@ mapAliases {
 
   ### F ###
 
+  fahcontrol = throw "fahcontrol has been removed because the download is no longer available"; # added 2024-09-24
+  fahviewer = throw "fahviewer has been removed because the download is no longer available"; # added 2024-09-24
   fam = throw "'fam' (aliased to 'gamin') has been removed as it is unmaintained upstream"; # Added 2024-04-19
   fancypp = throw "'fancypp' was removed because it and its dependants are unmaintained"; # Added 2024-02-14
   faustStk = faustPhysicalModeling; # Added 2023-05-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5937b43ba9aa..aef1a9a89ffd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1685,8 +1685,6 @@ with pkgs;
 
   crypto-tracker = callPackage ../tools/misc/crypto-tracker { };
 
-  ejs = callPackage ../development/tools/ejs { };
-
   ejson2env = callPackage ../tools/admin/ejson2env { };
 
   davinci-resolve = callPackage ../applications/video/davinci-resolve { };
@@ -2995,8 +2993,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  amberol = callPackage ../applications/audio/amberol { };
-
   inherit (callPackages ../development/tools/ammonite {})
     ammonite_2_12
     ammonite_2_13;
@@ -3485,7 +3481,9 @@ with pkgs;
 
   cyclone-scheme = callPackage ../development/interpreters/cyclone { };
 
-  cyclonedx-gomod = callPackage ../tools/security/cyclonedx-gomod { };
+  cyclonedx-gomod = callPackage ../tools/security/cyclonedx-gomod {
+    buildGoModule = buildGo123Module;
+  };
 
   cyclonedx-python = callPackage ../tools/misc/cyclonedx-python { };
 
@@ -5214,6 +5212,10 @@ with pkgs;
 
   grobi = callPackage ../tools/X11/grobi { };
 
+  grype = callPackage ../by-name/gr/grype/package.nix {
+    buildGoModule = buildGo123Module;
+  };
+
   gsctl = callPackage ../applications/misc/gsctl { };
 
   gsocket = callPackage ../tools/networking/gsocket { };
@@ -7972,8 +7974,6 @@ with pkgs;
 
   git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { };
 
-  gitea-actions-runner = callPackage ../development/tools/continuous-integration/gitea-actions-runner { };
-
   gokart = callPackage ../development/tools/gokart { };
 
   gl2ps = callPackage ../development/libraries/gl2ps { };
@@ -12941,8 +12941,6 @@ with pkgs;
 
   threema-desktop = callPackage ../applications/networking/instant-messengers/threema-desktop { };
 
-  thumbdrives = callPackage ../applications/system/thumbdrives { };
-
   tidy-viewer = callPackage ../tools/text/tidy-viewer { };
 
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };
@@ -15676,8 +15674,6 @@ with pkgs;
   );
   buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
 
-  cargo2junit = callPackage ../development/tools/rust/cargo2junit { };
-
   cargo-web = callPackage ../development/tools/rust/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };
@@ -17320,8 +17316,6 @@ with pkgs;
 
   blackmagic = callPackage ../development/embedded/blackmagic { };
 
-  bloaty = callPackage ../development/tools/bloaty { };
-
   bloomrpc = callPackage ../development/web/bloomrpc { };
 
   bloop = callPackage ../development/tools/build-managers/bloop { };
@@ -25113,8 +25107,6 @@ with pkgs;
 
   oidentd = callPackage ../servers/identd/oidentd { };
 
-  softether = callPackage ../servers/softether { };
-
   qboot = pkgsi686Linux.callPackage ../applications/virtualization/qboot { };
 
   rust-hypervisor-firmware = callPackage ../applications/virtualization/rust-hypervisor-firmware { };
@@ -27102,7 +27094,9 @@ with pkgs;
 
   clearlooks-phenix = callPackage ../data/themes/clearlooks-phenix { };
 
-  cnspec = callPackage ../tools/security/cnspec { };
+  cnspec = callPackage ../tools/security/cnspec {
+    buildGoModule = buildGo123Module;
+  };
 
   cnstrokeorder = callPackage ../data/fonts/cnstrokeorder { };
 
@@ -37517,8 +37511,6 @@ with pkgs;
   flockit = callPackage ../tools/backup/flockit { };
 
   fahclient = callPackage ../applications/science/misc/foldingathome/client.nix { };
-  fahcontrol = callPackage ../applications/science/misc/foldingathome/control.nix { };
-  fahviewer = callPackage ../applications/science/misc/foldingathome/viewer.nix { };
 
   fbmark = callPackage ../tools/misc/fbmark { };
 
@@ -37558,13 +37550,17 @@ with pkgs;
 
   gobuster = callPackage ../tools/security/gobuster { };
 
-  gotestwaf = callPackage ../tools/security/gotestwaf { };
+  gotestwaf = callPackage ../tools/security/gotestwaf {
+    buildGoModule = buildGo123Module;
+  };
 
   gotrue = callPackage ../tools/security/gotrue { };
 
   gotrue-supabase = callPackage ../tools/security/gotrue/supabase.nix { };
 
-  gowitness = callPackage ../tools/security/gowitness { };
+  gowitness = callPackage ../tools/security/gowitness {
+    buildGoModule = buildGo123Module;
+  };
 
   guetzli = callPackage ../applications/graphics/guetzli { };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 9fd21df75e73..9c26e747a421 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -518,6 +518,7 @@ mapAliases ({
   pytorchWithoutCuda = torchWithoutCuda; # added 2022-09-30
   pytwitchapi = twitchapi; # added 2022-03-07
   pyuavcan = throw "pyuavcan has been renamed to pycyphal and the old package deprecated, use pycyphal instead"; # added 2024-02-09
+  pyunifiprotect = throw "pyunifiprotect has disappeared from GitHub and PyPI, use uiprotect instead"; # added 2024-09-17
   pyutilib = throw "pyutilib has been removed, since it is no longer maintained"; # added 2024-07-28
   pyvcf = throw "pyvcf has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2023-05-19
   pyvicare = pyvicare-neo; # added 2024-08-31
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e7fff1bca2b9..2e1409202bef 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13006,8 +13006,6 @@ self: super: with self; {
 
   pyunifi = callPackage ../development/python-modules/pyunifi { };
 
-  pyunifiprotect = callPackage ../development/python-modules/pyunifiprotect { };
-
   pyupdate = callPackage ../development/python-modules/pyupdate { };
 
   pyupgrade = callPackage ../development/python-modules/pyupgrade { };