diff --git a/.github/workflows/no-channel.yml b/.github/workflows/no-channel.yml
index 90c38f22c007..623a011c6e73 100644
--- a/.github/workflows/no-channel.yml
+++ b/.github/workflows/no-channel.yml
@@ -1,18 +1,17 @@
 name: "No channel PR"
 
 on:
-  pull_request:
+  pull_request_target:
+    # Re-run should be triggered when the base branch is updated, instead of silently failing
+    types: [opened, synchronize, reopened, edited]
     branches:
       - 'nixos-**'
       - 'nixpkgs-**'
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   fail:
-    permissions:
-      contents: none
     name: "This PR is is targeting a channel branch"
     runs-on: ubuntu-latest
     steps:
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 1dd9eb1cae47..06758b4af6c4 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -115,6 +115,15 @@
 
 - `ps3-disc-dumper` was updated to 4.2.5, which removed the CLI project and now exclusively offers the GUI
 
+- [](#opt-services.nextcloud.config.dbtype) is unset by default, the previous default was `sqlite`.
+  This was done because `sqlite` is not a reasonable default since it's
+  [not recommended by upstream](https://docs.nextcloud.com/server/30/admin_manual/installation/system_requirements.html)
+  and thus doesn't qualify as default.
+
+- Nextcloud's default FPM pool settings have been increased according to upstream recommentations. It's advised
+  to review the new defaults and description of
+  [](#opt-services.nextcloud.poolSettings).
+
 - `asusd` has been upgraded to version 6 which supports multiple aura devices. To account for this, the single `auraConfig` configuration option has been replaced with `auraConfigs` which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that `text` is used for your existing configs, e.g.:
   ```diff
   -services.asusd.asusdConfig = '''file contents'''
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index eae005bca545..64c17aa44b4a 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -374,14 +374,18 @@ in {
       type = with types; attrsOf (oneOf [ str int bool ]);
       default = {
         "pm" = "dynamic";
-        "pm.max_children" = "32";
-        "pm.start_servers" = "2";
-        "pm.min_spare_servers" = "2";
-        "pm.max_spare_servers" = "4";
+        "pm.max_children" = "120";
+        "pm.start_servers" = "12";
+        "pm.min_spare_servers" = "6";
+        "pm.max_spare_servers" = "18";
         "pm.max_requests" = "500";
       };
       description = ''
-        Options for nextcloud's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
+        Options for nextcloud's PHP pool. See the documentation on `php-fpm.conf` for details on
+        configuration directives. The above are recommended for a server with 4GiB of RAM.
+
+        It's advisable to read the [section about PHPFPM tuning in the upstream manual](https://docs.nextcloud.com/server/30/admin_manual/installation/server_tuning.html#tune-php-fpm)
+        and consider customizing the values.
       '';
     };
 
@@ -416,7 +420,6 @@ in {
     config = {
       dbtype = mkOption {
         type = types.enum [ "sqlite" "pgsql" "mysql" ];
-        default = "sqlite";
         description = "Database type.";
       };
       dbname = mkOption {
diff --git a/nixos/modules/services/x11/window-managers/dwm.nix b/nixos/modules/services/x11/window-managers/dwm.nix
index c81a834a0679..10ec7563d4af 100644
--- a/nixos/modules/services/x11/window-managers/dwm.nix
+++ b/nixos/modules/services/x11/window-managers/dwm.nix
@@ -6,15 +6,20 @@ let
 
   cfg = config.services.xserver.windowManager.dwm;
 
-in
-
-{
+in {
 
   ###### interface
 
   options = {
     services.xserver.windowManager.dwm = {
       enable = mkEnableOption "dwm";
+      extraSessionCommands = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Shell commands executed just before dwm is started.
+        '';
+      };
       package = mkPackageOption pkgs "dwm" {
         example = ''
           pkgs.dwm.overrideAttrs (oldAttrs: rec {
@@ -30,20 +35,20 @@ in
     };
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {
 
-    services.xserver.windowManager.session = singleton
-      { name = "dwm";
-        start =
-          ''
-            export _JAVA_AWT_WM_NONREPARENTING=1
-            dwm &
-            waitPID=$!
-          '';
-      };
+    services.xserver.windowManager.session = singleton {
+      name = "dwm";
+      start = ''
+        ${cfg.extraSessionCommands}
+
+        export _JAVA_AWT_WM_NONREPARENTING=1
+        dwm &
+        waitPID=$!
+      '';
+    };
 
     environment.systemPackages = [ cfg.package ];
 
diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix
index f8306503d85f..217f22714c1c 100644
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@@ -59,6 +59,7 @@ runTest (
 
           services.nextcloud = {
             enable = true;
+            config.dbtype = "sqlite";
             datadir = "/var/lib/nextcloud-data";
             autoUpdateApps = {
               enable = true;
diff --git a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
index 6b0dd71f85ef..74343a22b7ae 100644
--- a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
+++ b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
@@ -69,14 +69,13 @@ runTest (
 
           services.postgresql = {
             enable = true;
-            package = pkgs.postgresql_14;
           };
           systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''
             password=$(cat ${config.services.nextcloud.config.dbpassFile})
             ${config.services.postgresql.package}/bin/psql <<EOF
               CREATE ROLE ${adminuser} WITH LOGIN PASSWORD '$password' CREATEDB;
               CREATE DATABASE nextcloud;
-              GRANT ALL PRIVILEGES ON DATABASE nextcloud TO ${adminuser};
+              ALTER DATABASE nextcloud OWNER to ${adminuser};
             EOF
           '';
 
diff --git a/nixos/tests/nextcloud/with-objectstore.nix b/nixos/tests/nextcloud/with-objectstore.nix
index 48e1edea67ba..5f24fc48851c 100644
--- a/nixos/tests/nextcloud/with-objectstore.nix
+++ b/nixos/tests/nextcloud/with-objectstore.nix
@@ -36,6 +36,8 @@ runTest (
           networking.firewall.allowedTCPPorts = [ 9000 ];
           environment.systemPackages = [ pkgs.minio-client ];
 
+          services.nextcloud.config.dbtype = "sqlite";
+
           services.nextcloud.config.objectstore.s3 = {
             enable = true;
             bucket = "nextcloud";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
index 2225dff0872d..86109b57a2ac 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
@@ -4,23 +4,44 @@
   editorconfig,
   f,
   fetchFromGitHub,
+  replaceVars,
   nodejs,
   s,
   melpaBuild,
+  copilot-node-server,
 }:
+let
+  # The Emacs package isn't compatible with the latest
+  # copilot-node-server so we have to set a specific revision
+  # https://github.com/copilot-emacs/copilot.el/issues/344
+  pinned-copilot-node-server = copilot-node-server.overrideAttrs (old: rec {
+    version = "1.27.0";
+    src = fetchFromGitHub {
+      owner = "jfcherng";
+      repo = "copilot-node-server";
+      rev = version;
+      hash = "sha256-Ds2agoO7LBXI2M1dwvifQyYJ3F9fm9eV2Kmm7WITgyo=";
+    };
+  });
+in
 melpaBuild {
   pname = "copilot";
-  version = "0-unstable-2024-05-01";
+  version = "0-unstable-2024-12-28";
 
   src = fetchFromGitHub {
     owner = "copilot-emacs";
     repo = "copilot.el";
-    rev = "733bff26450255e092c10873580e9abfed8a81b8";
-    sha256 = "sha256-Knp36PtgA73gtYO+W1clQfr570bKCxTFsGW3/iH86A0=";
+    rev = "c5dfa99f05878db5e6a6a378dc7ed09f11e803d4";
+    sha256 = "sha256-FzI08AW7a7AleEM7kSQ8LsWsDYID8SW1SmSN6/mIB/A=";
   };
 
   files = ''(:defaults "dist")'';
 
+  patches = [
+    (replaceVars ./specify-copilot-install-dir.patch {
+      copilot-node-server = pinned-copilot-node-server;
+    })
+  ];
   packageRequires = [
     dash
     editorconfig
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/specify-copilot-install-dir.patch b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/specify-copilot-install-dir.patch
new file mode 100644
index 000000000000..c10f19133cac
--- /dev/null
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/specify-copilot-install-dir.patch
@@ -0,0 +1,14 @@
+diff --git a/copilot.el b/copilot.el
+index f1f5e51..ddf2b5b 100644
+--- a/copilot.el
++++ b/copilot.el
+@@ -132,8 +132,7 @@ (defcustom copilot-indentation-alist
+ (defconst copilot-server-package-name "copilot-node-server"
+   "The name of the package to install copilot server.")
+ 
+-(defcustom copilot-install-dir (expand-file-name
+-                                (locate-user-emacs-file (f-join ".cache" "copilot")))
++(defcustom copilot-install-dir "@copilot-node-server@"
+   "Directory in which the servers will be installed."
+   :risky t
+   :type 'directory
diff --git a/pkgs/applications/networking/p2p/gnunet/gtk.nix b/pkgs/applications/networking/p2p/gnunet/gtk.nix
index 95c1780256d7..56dc9ae6b701 100644
--- a/pkgs/applications/networking/p2p/gnunet/gtk.nix
+++ b/pkgs/applications/networking/p2p/gnunet/gtk.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnunet-gtk";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/gnunet-gtk-${version}.tar.gz";
-    hash = "sha256-vQFtKFI57YG64WpKVngx1kq687hI+f1kpP9ooK53/aw=";
+    hash = "sha256-bpSEdymFT7q5OQKshD8lGwwMF26yXp0RyUAvNVzua6U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 3a340c4766c4..12881e4a0bac 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -124,6 +124,8 @@ let
         "ssl/certs"
         "ca-certificates"
         "pki"
+        # Custom dconf profiles
+        "dconf"
       ];
     in
     map (path: "/etc/${path}") files;
diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index d5835283ee76..266ae4b0d5b0 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   rustPlatform,
-  apple-sdk_11,
   nixosTests,
 }:
 
@@ -39,10 +38,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_11
-  ];
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd atuin \
       --bash <($out/bin/atuin gen-completions -s bash) \
@@ -67,11 +62,11 @@ rustPlatform.buildRustPackage rec {
     "--skip=build_aliases"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";
     homepage = "https://github.com/atuinsh/atuin";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       SuperSandro2000
       sciencentistguy
       _0x4A6F
diff --git a/pkgs/by-name/aw/aws-sso-util/package.nix b/pkgs/by-name/aw/aws-sso-util/package.nix
new file mode 100644
index 000000000000..c083f6254933
--- /dev/null
+++ b/pkgs/by-name/aw/aws-sso-util/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchPypi,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "aws-sso-util";
+  version = "4.33.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "aws_sso_util";
+    inherit version;
+    hash = "sha256-5I1/WRFENFDSjhrBYT+BuaoVursbIFW0Ux34fbQ6Cd8=";
+  };
+
+  build-system = [
+    python3Packages.poetry-core
+  ];
+
+  dependencies = with python3Packages; [
+    aws-error-utils
+    aws-sso-lib
+    boto3
+    click
+    jsonschema
+    python-dateutil
+    pyyaml
+    requests
+  ];
+
+  meta = {
+    description = "Utilities to make AWS SSO easier";
+    homepage = "https://pypi.org/project/aws-sso-util/";
+    downloadPage = "https://pypi.org/project/aws-sso-util/#files";
+    changelog = "https://github.com/benkehoe/aws-sso-util/releases";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ cterence ];
+    mainProgram = "aws-sso-util";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/br/breakpad/package.nix b/pkgs/by-name/br/breakpad/package.nix
index 5539543a33ac..a3bdd857bc40 100644
--- a/pkgs/by-name/br/breakpad/package.nix
+++ b/pkgs/by-name/br/breakpad/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchgit,
+  fetchpatch,
   zlib,
 }:
 let
@@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8AkC/8oX4OWAcV21laJ0AeMRB9G04rFc6UJFy7Wus4A=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "gcc-14-fixes.patch";
+      url = "https://github.com/google/breakpad/commit/898a997855168c0e6a689072fefba89246271a5d.patch";
+      hash = "sha256-OxodMx7XfKiD9j6b8oFvloslYagSSpQn7BPdpMVOoDY=";
+    })
+  ];
+
   buildInputs = [ zlib ];
 
   postUnpack = ''
diff --git a/pkgs/by-name/by/byzanz/package.nix b/pkgs/by-name/by/byzanz/package.nix
index 36e477751c88..c12ea0e7777c 100644
--- a/pkgs/by-name/by/byzanz/package.nix
+++ b/pkgs/by-name/by/byzanz/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = builtins.concatStringsSep " " [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=incompatible-pointer-types"
+    "-Wno-error=discarded-qualifiers"
   ];
 
   nativeBuildInputs = [
@@ -61,11 +62,11 @@ stdenv.mkDerivation {
       wrapGAppsHook3
     ]);
 
-  meta = with lib; {
+  meta = {
     description = "Tool to record a running X desktop to an animation suitable for presentation in a web browser";
     homepage = "https://github.com/GNOME/byzanz";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = [ ];
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
   };
 }
diff --git a/pkgs/by-name/da/datafusion-cli/package.nix b/pkgs/by-name/da/datafusion-cli/package.nix
index e347b5be35a1..50e114fbd983 100644
--- a/pkgs/by-name/da/datafusion-cli/package.nix
+++ b/pkgs/by-name/da/datafusion-cli/package.nix
@@ -8,19 +8,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "datafusion-cli";
-  version = "43.0.0";
+  version = "44.0.0";
 
   src = fetchFromGitHub {
     name = "datafusion-cli-source";
     owner = "apache";
     repo = "arrow-datafusion";
     rev = version;
-    sha256 = "sha256-/7qiVjvWwcRrCyXbQfcyzT6TcsLf/NyDVpIEJjzJHEc=";
+    sha256 = "sha256-235z+dyEt36sPY2UMVMMdakrDe2WWqPCk2/flEX6s4Y=";
   };
 
   sourceRoot = "${src.name}/datafusion-cli";
 
-  cargoHash = "sha256-oKrfaaBnbCuIkz2p94rnIN71b/GrvYxAji7Eo3bcS14=";
+  cargoHash = "sha256-jqL/o4vSTJfQEFurtmNoi8pNzCLslhqlNKISm8dp6hs=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/dn/dnsproxy/package.nix b/pkgs/by-name/dn/dnsproxy/package.nix
index 51a95bb88187..a0d31cb054b1 100644
--- a/pkgs/by-name/dn/dnsproxy/package.nix
+++ b/pkgs/by-name/dn/dnsproxy/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.73.5";
+  version = "0.74.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     rev = "v${version}";
-    hash = "sha256-U3OqRfJUtH0rMdVypaoFF3Mi6oBvgt08ufnERPFVjC4=";
+    hash = "sha256-s6VJXlWzrbHu/kOeng3gnySd5YMJFaUelZy/GoL611c=";
   };
 
   vendorHash = "sha256-d1WrUfE31Gvgz8tw7cVdPhWf4OHsuuyEHDSn9bETCjI=";
diff --git a/pkgs/by-name/ft/ftjam/package.nix b/pkgs/by-name/ft/ftjam/package.nix
deleted file mode 100644
index b78215472a7c..000000000000
--- a/pkgs/by-name/ft/ftjam/package.nix
+++ /dev/null
@@ -1,117 +0,0 @@
-{
-  lib,
-  bison,
-  buildPackages,
-  fetchurl,
-  installShellFiles,
-  pkgsBuildTarget,
-  stdenv,
-  testers,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ftjam";
-  version = "2.5.2";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/freetype/ftjam/${finalAttrs.version}/ftjam-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-6JdzUAqSkS3pGOn+v/q+S2vOedaa8ZRDX04DK4ptZqM=";
-  };
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  nativeBuildInputs = [
-    bison
-    installShellFiles
-  ];
-
-  # Doesn't understand how to cross compile once bootstrapped, so we'll just use
-  # the Makefile for the bootstrapping portion
-  configurePlatforms = [
-    "build"
-    "target"
-  ];
-
-  configureFlags = [
-    "CC=${buildPackages.stdenv.cc.targetPrefix}cc"
-    "--host=${stdenv.buildPlatform.config}"
-  ];
-
-  makeFlags = [
-    "CC=${buildPackages.stdenv.cc.targetPrefix}cc"
-  ];
-
-  env = {
-    LOCATE_TARGET = "bin.unix";
-    # Jam uses c89 conventions
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-std=c89";
-  };
-
-  enableParallelBuilding = true;
-
-  strictDeps = true;
-
-  # Jambase expects ar to have flags.
-  preConfigure = ''
-    export AR="$AR rc"
-  '';
-
-  # When cross-compiling, we need to set the preprocessor macros
-  # OSMAJOR/OSMINOR/OSPLAT to the values from the target platform, not the host
-  # platform. This looks a little ridiculous because the vast majority of build
-  # tools don't embed target-specific information into their binary, but in this
-  # case we behave more like a compiler than a make(1)-alike.
-  postPatch =
-    ''
-      substituteInPlace Jamfile \
-        --replace "strip" "${stdenv.cc.targetPrefix}strip"
-    ''
-    + lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
-      cat >>jam.h <<EOF
-      #undef OSMAJOR
-      #undef OSMINOR
-      #undef OSPLAT
-      $(
-         ${pkgsBuildTarget.targetPackages.stdenv.cc}/bin/${pkgsBuildTarget.targetPackages.stdenv.cc.targetPrefix}cc -E -dM jam.h | grep -E '^#define (OSMAJOR|OSMINOR|OSPLAT) '
-      )
-      EOF
-    '';
-
-  buildPhase = ''
-    runHook preBuild
-    make $makeFlags jam0
-    ./jam0 -j$NIX_BUILD_CORES -sCC=${buildPackages.stdenv.cc.targetPrefix}cc jambase.c
-    ./jam0 -j$NIX_BUILD_CORES
-    runHook postBuild
-  '';
-
-  # The configure script does not recognize --docdir; because of it, the outputs
-  # can't be split
-  installPhase = ''
-    runHook preInstall
-
-    installBin bin.unix/jam
-    install -Dm644 -t ''${!outputDoc}/share/doc/jam-${finalAttrs.version}/ *.html
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "jam -v";
-    };
-  };
-
-  meta = {
-    homepage = "https://freetype.org/jam/";
-    description = "FreeType's enhanced, backwards-compatible Jam clone";
-    license = lib.licenses.free;
-    mainProgram = "jam";
-    maintainers = with lib.maintainers; [
-      impl
-      AndersonTorres
-    ];
-    platforms = lib.platforms.unix;
-  };
-})
diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index 2edd0471f85c..e5946c5c682f 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "ghostunnel";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
     rev = "v${version}";
-    hash = "sha256-OWjYa8LOWClAWhZERJ24e6tIaOJZUuOzaYXN04rvv8s=";
+    hash = "sha256-WO7dyz+S8dBSFfNCTHHg1lGDlUGSBqa5pcR5GCiWsl8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index 4ae2f37d757a..66738bfc88b2 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.62.2";
+  version = "1.63.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-8Itq4tWqJa9agGcPoQaJoQOgy/qhhegzPORDztS9T30=";
+    hash = "sha256-Q7SwLm+rnwyjlXf8iArUQWYC0DyjFZI9HIWJsgNplyw=";
   };
 
-  vendorHash = "sha256-SEoF+k7MYYq81v9m3eaDbIv1k9Hek5iAZ0TTJEgAsI4=";
+  vendorHash = "sha256-Rsg/bVbMsA2dUz0GjAdzifBTpDDVrFYY+ptyB5m3AgM=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/by-name/ij/ijq/package.nix b/pkgs/by-name/ij/ijq/package.nix
index 7a4486a3c997..02ff350787d0 100644
--- a/pkgs/by-name/ij/ijq/package.nix
+++ b/pkgs/by-name/ij/ijq/package.nix
@@ -1,6 +1,6 @@
 {
   buildGoModule,
-  fetchFromSourcehut,
+  fetchFromGitea,
   lib,
   jq,
   installShellFiles,
@@ -13,8 +13,9 @@ buildGoModule rec {
   pname = "ijq";
   version = "1.1.2";
 
-  src = fetchFromSourcehut {
-    owner = "~gpanders";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "gpanders";
     repo = "ijq";
     rev = "v${version}";
     hash = "sha256-7vG9T+gC6HeSGwFDf3m7nM0hBz32n6ATiM30AKNC1Og=";
@@ -49,7 +50,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Interactive wrapper for jq";
     mainProgram = "ijq";
-    homepage = "https://git.sr.ht/~gpanders/ijq";
+    homepage = "https://codeberg.org/gpanders/ijq";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [
       justinas
diff --git a/pkgs/by-name/li/libfishsound/fix-callbacks.patch b/pkgs/by-name/li/libfishsound/fix-callbacks.patch
new file mode 100644
index 000000000000..992efcf23ec8
--- /dev/null
+++ b/pkgs/by-name/li/libfishsound/fix-callbacks.patch
@@ -0,0 +1,20 @@
+--- a/src/libfishsound/flac.c
++++ b/src/libfishsound/flac.c
+@@ -106,7 +106,7 @@ fs_flac_command (FishSound * fsound, int command, void * data, int datasize)
+ #if FS_DECODE
+ static FLAC__StreamDecoderReadStatus
+ fs_flac_read_callback(const FLAC__StreamDecoder *decoder,
+-                      FLAC__byte buffer[], unsigned int *bytes,
++                      FLAC__byte buffer[], size_t *bytes,
+                       void *client_data)
+ {
+   FishSound* fsound = (FishSound*)client_data;
+@@ -346,7 +346,7 @@ dec_err:
+ #if FS_ENCODE
+ static FLAC__StreamEncoderWriteStatus
+ fs_flac_enc_write_callback(const FLAC__StreamEncoder *encoder,
+-                           const FLAC__byte buffer[], unsigned bytes,
++                           const FLAC__byte buffer[], size_t bytes,
+                            unsigned samples, unsigned current_frame,
+                            void *client_data)
+ {
diff --git a/pkgs/by-name/li/libfishsound/package.nix b/pkgs/by-name/li/libfishsound/package.nix
index 0c5ea9c4c023..63b0838b4b01 100644
--- a/pkgs/by-name/li/libfishsound/package.nix
+++ b/pkgs/by-name/li/libfishsound/package.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
     sha256 = "1iz7mn6hw2wg8ljaw74f4g2zdj68ib88x4vjxxg3gjgc5z75f2rf";
   };
 
+  patches = [
+    ./fix-callbacks.patch
+  ];
+
   propagatedBuildInputs = [
     libvorbis
     speex
diff --git a/pkgs/by-name/li/libspnav/package.nix b/pkgs/by-name/li/libspnav/package.nix
index 92d3baa5541c..51a4805581ac 100644
--- a/pkgs/by-name/li/libspnav/package.nix
+++ b/pkgs/by-name/li/libspnav/package.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   libX11,
-  fixDarwinDylibNames,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,14 +16,18 @@ stdenv.mkDerivation rec {
     hash = "sha256-qBewSOiwf5iaGKLGRWOQUoHkUADuH8Q1mJCLiWCXmuQ=";
   };
 
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ libX11 ];
 
   configureFlags = [ "--disable-debug" ];
-  makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "AR=${stdenv.cc.targetPrefix}ar"
-  ];
+  makeFlags =
+    [
+      "CC=${stdenv.cc.targetPrefix}cc"
+      "AR=${stdenv.cc.targetPrefix}ar"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "shared=-dynamiclib"
+      "shared+=-Wl,-install_name,$(out)/lib/$(lib_so)"
+    ];
 
   preInstall = ''
     mkdir -p $out/{lib,include}
diff --git a/pkgs/by-name/lu/lubelogger/deps.json b/pkgs/by-name/lu/lubelogger/deps.json
index 5a9dc48bba66..b27469702b66 100644
--- a/pkgs/by-name/lu/lubelogger/deps.json
+++ b/pkgs/by-name/lu/lubelogger/deps.json
@@ -1,8 +1,8 @@
 [
   {
     "pname": "BouncyCastle.Cryptography",
-    "version": "2.3.0",
-    "hash": "sha256-TIBOegJAEfFRyvtwuPakvKsQbqoPHj1RSTmK7SKYsf0="
+    "version": "2.4.0",
+    "hash": "sha256-DoDZNWtYM+0OLIclOEZ+tjcGXymGlXvdvq2ZMPmiAJA="
   },
   {
     "pname": "CsvHelper",
@@ -16,8 +16,8 @@
   },
   {
     "pname": "MailKit",
-    "version": "4.5.0",
-    "hash": "sha256-quU88XNBF+tzb1yr7+lSfx90kmvZpbX43+YJtdYgPzk="
+    "version": "4.8.0",
+    "hash": "sha256-ONvrVOwjxyNrIQM8FMzT5mLzlU56Kc8oOwkzegNAiXM="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
@@ -51,18 +51,18 @@
   },
   {
     "pname": "MimeKit",
-    "version": "4.5.0",
-    "hash": "sha256-Nsk3Br9yLOC5wDLtRQyw04Kq205y5QCISpyiB13mwLU="
+    "version": "4.8.0",
+    "hash": "sha256-4EB54ktBXuq5QRID9i8E7FzU7YZTE4wwH+2yr7ivi/Q="
   },
   {
     "pname": "Npgsql",
-    "version": "8.0.3",
-    "hash": "sha256-weBGo/IXKI5ufixBCuWG7OqDSyIqvGV07oxrG0XnQIQ="
+    "version": "8.0.5",
+    "hash": "sha256-vGIznPqwfhg8wY9bt5XlinyNWMr5kJ2jJZHDXc73uhI="
   },
   {
     "pname": "System.Formats.Asn1",
-    "version": "8.0.0",
-    "hash": "sha256-AVMl6N3SG2AqAcQHFruf2QDQeQIC3CICxID+Sh0vBxI="
+    "version": "8.0.1",
+    "hash": "sha256-may/Wg+esmm1N14kQTG4ESMBi+GQKPp0ZrrBo/o6OXM="
   },
   {
     "pname": "System.IdentityModel.Tokens.Jwt",
diff --git a/pkgs/by-name/lu/lubelogger/package.nix b/pkgs/by-name/lu/lubelogger/package.nix
index 30be2f60a375..74c964920e3e 100644
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -6,17 +6,17 @@
 
 buildDotnetModule rec {
   pname = "lubelogger";
-  version = "1.3.8";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "hargata";
     repo = "lubelog";
     rev = "v${version}";
-    hash = "sha256-f9lj2Er0gQpptzmLpZsxR8hSU6kJlJkwHwpZ7wAq6bk=";
+    hash = "sha256-Ee9jwbZNc5M9edGkPvbO7xaraYXVMbVazVOU6DV6nFc=";
   };
 
   projectFile = "CarCareTracker.sln";
-  nugetDeps = ./deps.json; # File generated with `nix-build -A package.passthru.fetch-deps`.
+  nugetDeps = ./deps.json; # File generated with `nix-build -A lubelogger.passthru.fetch-deps`.
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
diff --git a/pkgs/by-name/ma/mangayomi/package.nix b/pkgs/by-name/ma/mangayomi/package.nix
index d88a2169d943..5c94734957f0 100644
--- a/pkgs/by-name/ma/mangayomi/package.nix
+++ b/pkgs/by-name/ma/mangayomi/package.nix
@@ -5,34 +5,6 @@
   pkg-config,
   webkitgtk_4_1,
   mpv,
-  libass,
-  ffmpeg,
-  libplacebo,
-  libunwind,
-  shaderc,
-  vulkan-loader,
-  lcms,
-  libdovi,
-  libdvdnav,
-  libdvdread,
-  mujs,
-  libbluray,
-  lua,
-  rubberband,
-  libuchardet,
-  zimg,
-  alsa-lib,
-  openal,
-  pipewire,
-  libpulseaudio,
-  libcaca,
-  libdrm,
-  libgbm,
-  libXScrnSaver,
-  nv-codec-headers-11,
-  libXpresent,
-  libva,
-  libvdpau,
   rustPlatform,
   stdenv,
   copyDesktopItems,
@@ -103,34 +75,6 @@ flutter324.buildFlutterApplication {
   buildInputs = [
     webkitgtk_4_1
     mpv
-    libass
-    ffmpeg
-    libplacebo
-    libunwind
-    shaderc
-    vulkan-loader
-    lcms
-    libdovi
-    libdvdnav
-    libdvdread
-    mujs
-    libbluray
-    lua
-    rubberband
-    libuchardet
-    zimg
-    alsa-lib
-    openal
-    pipewire
-    libpulseaudio
-    libcaca
-    libdrm
-    libgbm
-    libXScrnSaver
-    libXpresent
-    nv-codec-headers-11
-    libva
-    libvdpau
   ];
 
   desktopItems = [
diff --git a/pkgs/by-name/pc/pcsx2-bin/package.nix b/pkgs/by-name/pc/pcsx2-bin/package.nix
index 11d008c559f2..220c2b162148 100644
--- a/pkgs/by-name/pc/pcsx2-bin/package.nix
+++ b/pkgs/by-name/pc/pcsx2-bin/package.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pcsx2-bin";
-  version = "2.3.10";
+  version = "2.3.82";
 
   src = fetchurl {
     url = "https://github.com/PCSX2/pcsx2/releases/download/v${finalAttrs.version}/pcsx2-v${finalAttrs.version}-macos-Qt.tar.xz";
-    hash = "sha256-szQgGIBH+h/mH18zY3RQGiyhoYwQ07+rq/zX3uNfgME=";
+    hash = "sha256-Jcp6qXnEAtX5KYf4TkRD+FmZimh2G8B72lTligLPRfI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/raylib/package.nix b/pkgs/by-name/ra/raylib/package.nix
index 3a8757e5ce2a..51c40b5101df 100644
--- a/pkgs/by-name/ra/raylib/package.nix
+++ b/pkgs/by-name/ra/raylib/package.nix
@@ -1,85 +1,85 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, fetchpatch
-, libgbm
-, libGLU
-, glfw
-, libX11
-, libXi
-, libXcursor
-, libXrandr
-, libXinerama
-, alsaSupport ? stdenv.hostPlatform.isLinux
-, alsa-lib
-, pulseSupport ? stdenv.hostPlatform.isLinux
-, libpulseaudio
-, sharedLib ? true
-, includeEverything ? true
-, raylib-games
-, darwin
-, autoPatchelfHook
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  autoPatchelfHook,
+  glfw,
+  SDL2,
+  alsa-lib,
+  libpulseaudio,
+  raylib-games,
+  libGLU,
+  libX11,
+  platform ? "Desktop", # Note that "Web", "Android" and "Raspberry Pi" do not currently work
+  pulseSupport ? stdenv.hostPlatform.isLinux,
+  alsaSupport ? false,
+  sharedLib ? true,
+  includeEverything ? true,
 }:
 let
-  inherit (darwin.apple_sdk.frameworks) Carbon Cocoa OpenGL;
-in
-stdenv.mkDerivation (finalAttrs: {
+  inherit (lib) optional;
+
   pname = "raylib";
-  version = "5.0";
+in
 
-  src = fetchFromGitHub {
-    owner = "raysan5";
-    repo = "raylib";
-    rev = finalAttrs.version;
-    hash = "sha256-gEstNs3huQ1uikVXOW4uoYnIDr5l8O9jgZRTX1mkRww=";
-  };
+lib.checkListOfEnum "${pname}: platform"
+  [
+    "Desktop"
+    "Web"
+    "Android"
+    "Raspberry Pi"
+    "SDL"
+  ]
+  [ platform ]
+  (
+    stdenv.mkDerivation (finalAttrs: {
+      __structuredAttrs = true;
 
-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+      inherit pname;
+      version = "5.5";
 
-  buildInputs = [ glfw ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libgbm libXi libXcursor libXrandr libXinerama ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon Cocoa ]
-    ++ lib.optional alsaSupport alsa-lib
-    ++ lib.optional pulseSupport libpulseaudio;
+      src = fetchFromGitHub {
+        owner = "raysan5";
+        repo = "raylib";
+        rev = finalAttrs.version;
+        hash = "sha256-J99i4z4JF7d6mJNuJIB0rHNDhXJ5AEkG0eBvvuBLHrY=";
+      };
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libGLU libX11 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ OpenGL ];
+      # autoPatchelfHook is needed for appendRunpaths
+      nativeBuildInputs = [
+        cmake
+      ] ++ optional (builtins.length finalAttrs.appendRunpaths > 0) autoPatchelfHook;
 
-  # https://github.com/raysan5/raylib/wiki/CMake-Build-Options
-  cmakeFlags = [
-    "-DUSE_EXTERNAL_GLFW=ON"
-    "-DBUILD_EXAMPLES=OFF"
-    "-DCUSTOMIZE_BUILD=1"
-  ] ++ lib.optional includeEverything "-DINCLUDE_EVERYTHING=ON"
-  ++ lib.optional sharedLib "-DBUILD_SHARED_LIBS=ON";
+      buildInputs = optional (platform == "Desktop") glfw ++ optional (platform == "SDL") SDL2;
 
-  passthru.tests = { inherit raylib-games; };
+      propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libGLU libX11 ];
 
-  patches = [
-    # Patch version in CMakeLists.txt to 5.0.0
-    # The library author doesn't use cmake, so when updating this package please
-    # check that the resulting library extension matches the package version
-    # and remove/update this patch
-    (fetchpatch {
-      url = "https://github.com/raysan5/raylib/commit/032cc497ca5aaca862dc926a93c2a45ed8017737.patch";
-      hash = "sha256-qsX5AwyQaGoRsbdszOO7tUF9dR+AkEFi4ebNkBVHNEY=";
+      # https://github.com/raysan5/raylib/wiki/CMake-Build-Options
+      cmakeFlags =
+        [
+          "-DCUSTOMIZE_BUILD=ON"
+          "-DPLATFORM=${platform}"
+        ]
+        ++ optional (platform == "Desktop") "-DUSE_EXTERNAL_GLFW=ON"
+        ++ optional includeEverything "-DINCLUDE_EVERYTHING=ON"
+        ++ optional sharedLib "-DBUILD_SHARED_LIBS=ON";
+
+      appendRunpaths = optional stdenv.hostPlatform.isLinux (
+        lib.makeLibraryPath (optional alsaSupport alsa-lib ++ optional pulseSupport libpulseaudio)
+      );
+
+      passthru.tests = {
+        inherit raylib-games;
+      };
+
+      meta = {
+        description = "Simple and easy-to-use library to enjoy videogames programming";
+        homepage = "https://www.raylib.com/";
+        license = lib.licenses.zlib;
+        maintainers = [ lib.maintainers.diniamo ];
+        platforms = lib.platforms.all;
+        changelog = "https://github.com/raysan5/raylib/blob/${finalAttrs.version}/CHANGELOG";
+      };
     })
-  ];
-
-  # fix libasound.so/libpulse.so not being found
-  appendRunpaths = lib.optionals stdenv.hostPlatform.isLinux [
-    (lib.makeLibraryPath (lib.optional alsaSupport alsa-lib ++ lib.optional pulseSupport libpulseaudio))
-  ];
-
-  meta = with lib; {
-    description = "Simple and easy-to-use library to enjoy videogames programming";
-    homepage = "https://www.raylib.com/";
-    license = licenses.zlib;
-    maintainers = [ ];
-    platforms = platforms.all;
-    changelog = "https://github.com/raysan5/raylib/blob/${finalAttrs.version}/CHANGELOG";
-  };
-})
+  )
diff --git a/pkgs/by-name/re/resources/package.nix b/pkgs/by-name/re/resources/package.nix
index d196fbc6bfb5..9f70e2c1325a 100644
--- a/pkgs/by-name/re/resources/package.nix
+++ b/pkgs/by-name/re/resources/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , appstream-glib
+, autoAddDriverRunpath
 , cargo
 , desktop-file-utils
 , meson
@@ -37,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     appstream-glib
+    autoAddDriverRunpath
     desktop-file-utils
     meson
     ninja
diff --git a/pkgs/by-name/sp/spotifyd/package.nix b/pkgs/by-name/sp/spotifyd/package.nix
index 45e43876ae0c..627a15215fdc 100644
--- a/pkgs/by-name/sp/spotifyd/package.nix
+++ b/pkgs/by-name/sp/spotifyd/package.nix
@@ -25,16 +25,16 @@
 
 rustPackages.rustPlatform.buildRustPackage rec {
   pname = "spotifyd";
-  version = "0.3.5-unstable-2024-10-21";
+  version = "0.3.5-unstable-2024-12-27";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
-    rev = "b25538f5c4dfc5b376927e7edf71c7c988492ace";
-    hash = "sha256-50eUVax3yqwncQUWgCPc0PHVUuUERQ9iORSSajPHB9c=";
+    rev = "c6e6af449b75225224158aeeef64de485db1139e";
+    hash = "sha256-0HDrnEeqynb4vtJBnXyItprJkP+ZOAKIBP68Ht9xr2c=";
   };
 
-  cargoHash = "sha256-3aEBLPyf72o9gF58j9OANpcqD/IClb2alfAEKRFzatU=";
+  cargoHash = "sha256-bRO7cK+BlAUEr6DlK7GSJf/WNoCM4SYq/lZ8e9ENJZw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ve/venera/package.nix b/pkgs/by-name/ve/venera/package.nix
index e2c93b092fd0..4bed65e02238 100644
--- a/pkgs/by-name/ve/venera/package.nix
+++ b/pkgs/by-name/ve/venera/package.nix
@@ -9,13 +9,13 @@
 }:
 flutter327.buildFlutterApplication rec {
   pname = "venera";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "venera-app";
     repo = "venera";
     tag = "v${version}";
-    hash = "sha256-zf3KeSoMLmXdD0aEYRPN5IYy0LdMYpqOkCFDmLi2ix0=";
+    hash = "sha256-zjlu+rdS+ctp8R1laeT9OF+HCLvTyQsAJIBA1fEiNMg=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -58,13 +58,15 @@ flutter327.buildFlutterApplication rec {
   ];
 
   extraWrapProgramArgs = ''
-    --prefix LD_LIBRARY_PATH : "$out/app/venera/lib"
+    --prefix LD_LIBRARY_PATH : $out/app/venera/lib
   '';
 
   postInstall = ''
     install -Dm0644 ./debian/gui/venera.png $out/share/pixmaps/venera.png
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Comic reader that support reading local and network comics";
     homepage = "https://github.com/venera-app/venera";
diff --git a/pkgs/by-name/ve/venera/pubspec.lock.json b/pkgs/by-name/ve/venera/pubspec.lock.json
index ee6895dc7537..c13e95a43078 100644
--- a/pkgs/by-name/ve/venera/pubspec.lock.json
+++ b/pkgs/by-name/ve/venera/pubspec.lock.json
@@ -4,11 +4,11 @@
       "dependency": "direct main",
       "description": {
         "name": "app_links",
-        "sha256": "ad1a6d598e7e39b46a34f746f9a8b011ee147e4c275d407fa457e7a62f84dd99",
+        "sha256": "433df2e61b10519407475d7f69e470789d23d593f28224c38ba1068597be7950",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.2"
+      "version": "6.3.3"
     },
     "app_links_linux": {
       "dependency": "transitive",
@@ -84,11 +84,11 @@
       "dependency": "direct main",
       "description": {
         "name": "battery_plus",
-        "sha256": "220c8f1961efb01d6870493b5ac5a80afaeaffc8757f7a11ed3025a8570d29e7",
+        "sha256": "a0409fe7d21905987eb1348ad57c634f913166f14f0c8936b73d3f5940fac551",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.2.0"
+      "version": "6.2.1"
     },
     "battery_plus_platform_interface": {
       "dependency": "transitive",
@@ -528,11 +528,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_rust_bridge",
-        "sha256": "fb9d3c9395eae3c71d4fe3ec343b9f30636c9988150c8bb33b60047549b34e3d",
+        "sha256": "35c257fc7f98e34c1314d6c145e5ed54e7c94e8a9f469947e31c9298177d546f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.0"
+      "version": "2.7.0"
     },
     "flutter_saf": {
       "dependency": "direct main",
@@ -555,11 +555,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "flutter_to_arch",
-        "sha256": "656cffc182b05af38aa96a1115931620b8865c4b0cfe00813b26fcff0875f2ab",
+        "sha256": "b68b2757a89a517ae2141cbc672acdd1f69721dd686cacad03876b6f436ff040",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0"
+      "version": "1.0.1"
     },
     "flutter_to_debian": {
       "dependency": "direct dev",
@@ -993,11 +993,11 @@
       "dependency": "direct main",
       "description": {
         "name": "rhttp",
-        "sha256": "581d57b5b6056d31489af94db8653a1c11d7b59050cbbc41ece4279e50414de5",
+        "sha256": "8212cbc816cc3e761eecb8d4dbbaa1eca95de715428320a198a4e7a89acdcd2e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.6"
+      "version": "0.9.8"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -1064,21 +1064,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "9c9bafd4060728d7cdb2464c341743adbd79d327cb067ec7afb64583540b47c8",
+        "sha256": "6327c3f233729374d0abaafd61f6846115b2a481b4feddd8534211dc10659400",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.2"
+      "version": "10.1.3"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "c57c0bbfec7142e3a0f55633be504b796af72e60e3c791b44d5a017b985f7a48",
+        "sha256": "cc012a23fc2d479854e6c80150696c4a5f5bb62cb89af4de1c505cf78d0a5d0b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.1"
+      "version": "5.0.2"
     },
     "shimmer": {
       "dependency": "direct main",
@@ -1140,11 +1140,11 @@
       "dependency": "direct main",
       "description": {
         "name": "sqlite3_flutter_libs",
-        "sha256": "636b0fe8a2de894e5455572f6cbbc458f4ffecfe9f860b79439e27041ea4f0b9",
+        "sha256": "73016db8419f019e807b7a5e5fbf2a7bd45c165fed403b8e7681230f3a102785",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.27"
+      "version": "0.5.28"
     },
     "stack_trace": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/ve/venera/update.sh b/pkgs/by-name/ve/venera/update.sh
new file mode 100755
index 000000000000..7d9761ca3a5d
--- /dev/null
+++ b/pkgs/by-name/ve/venera/update.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq yq nix bash coreutils nix-update
+
+set -eou pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+
+latestTag=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/venera-app/venera/releases/latest | jq --raw-output .tag_name)
+latestVersion=$(echo "$latestTag" | sed 's/^v//')
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; venera.version or (lib.getVersion venera)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+nix-update venera
+
+curl https://raw.githubusercontent.com/venera-app/venera/${latestTag}/pubspec.lock | yq . >$ROOT/pubspec.lock.json
diff --git a/pkgs/by-name/xo/xoscope/fix-gcc14.patch b/pkgs/by-name/xo/xoscope/fix-gcc14.patch
new file mode 100644
index 000000000000..8f36a09e7a39
--- /dev/null
+++ b/pkgs/by-name/xo/xoscope/fix-gcc14.patch
@@ -0,0 +1,15 @@
+--- a/configure
++++ b/configure
+@@ -7054,9 +7054,10 @@
+ 	   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ 
++#include <stddef.h>
+ #include <comedilib.h>
+-main() {
+-       comedi_get_cmd_generic_timed(NULL, NULL, NULL, 0, 0);
++void main() {
++       comedi_get_cmd_generic_timed(NULL, 0, NULL, 0, 0);
+ }
+ _ACEOF
+ if ac_fn_c_try_compile "$LINENO"; then :
diff --git a/pkgs/by-name/xo/xoscope/package.nix b/pkgs/by-name/xo/xoscope/package.nix
index 03c975184539..d911f997cd76 100644
--- a/pkgs/by-name/xo/xoscope/package.nix
+++ b/pkgs/by-name/xo/xoscope/package.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "0a5ycfc1qdmibvagc82r2mhv2i99m6pndy5i6ixas3j2297g6pgq";
   };
 
+  patches = [ ./fix-gcc14.patch ];
+
   nativeBuildInputs = [
     pkg-config
     gnum4
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index 8317d9da71bb..971c68aa0c76 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -75,6 +75,14 @@ python3Packages.buildPythonApplication rec {
   # Requires network
   doCheck = false;
 
+  # curl-cffi 0.7.2 and 0.7.3 are broken, but 0.7.4 is fixed
+  # https://github.com/lexiforest/curl_cffi/issues/394
+  postPatch = ''
+    substituteInPlace yt_dlp/networking/_curlcffi.py \
+      --replace-fail "(0, 7, 0) <= curl_cffi_version < (0, 7, 2)" \
+        "((0, 7, 0) <= curl_cffi_version < (0, 7, 2)) or curl_cffi_version >= (0, 7, 4)"
+  '';
+
   postInstall = lib.optionalString withAlias ''
     ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
   '';
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 183c139d12a5..0b2581aaf458 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -50,23 +50,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.3.0.44805";
-  versions.x86_64-darwin = "6.3.0.44805";
-  versions.x86_64-linux = "6.3.0.5527";
+  versions.aarch64-darwin = "6.3.1.45300";
+  versions.x86_64-darwin = "6.3.1.45300";
+  versions.x86_64-linux = "6.3.1.5673";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-S4uBJw0FPcPv1O2zcTbEaEONrNLkRCkWYazpR5chYbE=";
+      hash = "sha256-WPhqYof/XR6TDkuA4NK2a30ksdhN7NBfs4KCQwqKJ0g=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-PKIxhy+bnBpMn0oUL1cAfhOT+osXPDBIRoY1HLgO26s=";
+      hash = "sha256-BywBvJCcNXARHTkO/UJbOFRjuiXRkmFWmSuZsW9t1pk=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-5Tk8lU6D0cgyr5pe1oVZFCURQ1YznBpWPPM9nogOT6Q=";
+      hash = "sha256-0gREcRnGkiFj6kIra0laR5PUqrb0Jvoj6gDfpAVLRtg=";
     };
   };
 
diff --git a/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix b/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
index b87acb6bdb2f..e6e1644f0228 100644
--- a/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
+++ b/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
@@ -18,6 +18,7 @@ let
       {
         _0_9_1 = "sha256-Gl3ArdSuw3/yi/JX6oloKJqerSJjTfK8HXRNei/LO+4=";
         _0_9_6 = "sha256-a11UxG8nbIng+6uOWq/BZxdtRmRINl/7UOc6ap2mgrk=";
+        _0_9_8 = "sha256-/1qj0N83wgkPSQnGb3CHTS/ox6OpJCKF5mVpuKTqUBQ=";
       }
       .${"_" + (lib.replaceStrings [ "." ] [ "_" ] version)} or (throw ''
         Unsupported version of pub 'rhttp': '${version}'
diff --git a/pkgs/development/compilers/flutter/versions/3_27/data.json b/pkgs/development/compilers/flutter/versions/3_27/data.json
index 67aa504685be..cd44befc2230 100644
--- a/pkgs/development/compilers/flutter/versions/3_27/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_27/data.json
@@ -1,33 +1,33 @@
 {
-  "version": "3.27.0-0.1.pre",
-  "engineVersion": "af0f0d559c8a87d912a20971bbd84afc80a54b0f",
+  "version": "3.27.1",
+  "engineVersion": "cb4b5fff73850b2e42bd4de7cb9a4310a78ac40d",
   "engineSwiftShaderHash": "sha256-mRLCvhNkmHz7Rv6GzXkY7OB1opBSq+ATWZ466qZdgto=",
   "engineSwiftShaderRev": "2fa7e9b99ae4e70ea5ae2cc9c8d3afb43391384f",
-  "channel": "beta",
+  "channel": "stable",
   "engineHashes": {
     "aarch64-linux": {
-      "aarch64-linux": "sha256-xEUUengFzRbQhFB7jxTBd8eTMWUhyBTTKyT/ObuyD/o=",
-      "x86_64-linux": "sha256-xEUUengFzRbQhFB7jxTBd8eTMWUhyBTTKyT/ObuyD/o="
+      "aarch64-linux": "sha256-Qk4pKuuS9ixC2ufuevBGkL+JoMoI4e9l3jtJ6T9uqME=",
+      "x86_64-linux": "sha256-Qk4pKuuS9ixC2ufuevBGkL+JoMoI4e9l3jtJ6T9uqME="
     },
     "x86_64-linux": {
-      "aarch64-linux": "sha256-YFmK7eSt9lK/iEMPC5jxp5Vf2pnDjUDyPVoHzgxc8mA=",
-      "x86_64-linux": "sha256-YFmK7eSt9lK/iEMPC5jxp5Vf2pnDjUDyPVoHzgxc8mA="
+      "aarch64-linux": "sha256-CwoRJUGfp3ZedloMNCtOQvzpbBuyIt2sKPzYENepSH8=",
+      "x86_64-linux": "sha256-CwoRJUGfp3ZedloMNCtOQvzpbBuyIt2sKPzYENepSH8="
     }
   },
-  "dartVersion": "3.6.0-334.3.beta",
+  "dartVersion": "3.6.0",
   "dartHash": {
-    "x86_64-linux": "sha256-xErMxL9HK+MSq++DcSiV95TInMPvKkc9tqQzzMRPYDU=",
-    "aarch64-linux": "sha256-1grsqBcTmfRlMMTB1rWHVVyzZS2RLA10AADkrV4kk9I=",
-    "x86_64-darwin": "sha256-4YwpUjyFXTk6/h5OMbOKwd0gTEX0CmHo0TByVs0milA=",
-    "aarch64-darwin": "sha256-bp2tSs+JDSj3xqurc2NOOfmhbq7u/meFbA7VZPNAyZ8="
+    "x86_64-linux": "sha256-Fte5Fvb2/pW7utKm+j5vVZbFX4Ex2uPWqUWYz+F9Tzc=",
+    "aarch64-linux": "sha256-GiZWwHEccyxM+nfYNyKTeHP4XuctQVR1Rba5bzZfi88=",
+    "x86_64-darwin": "sha256-47ch7I4jtYO2FPxa28sAbiNKvcyFCxwoZetwm7IeCrI=",
+    "aarch64-darwin": "sha256-BqqA1/jx+3vDY053H1klUhxlQernOWY+nFHdbFppcXM="
   },
-  "flutterHash": "sha256-M9zETok2sIJP8V8QlvbQdobhnM0QM6OHiHF5mwUosB4=",
+  "flutterHash": "sha256-WK6Ecaxs2MAlqOyKDPfXg1d4mqyAi7NZ/lFdMZwqkzQ=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-U29WM+8wPYmBifPWXS4TNdZM2ORsFzhV73B82RAH2TU=",
-      "aarch64-linux": "sha256-ABHHLnhJIqm4mT9FLMaMjJzecDgh6rLUJpVIuVqfUZg=",
-      "x86_64-darwin": "sha256-U29WM+8wPYmBifPWXS4TNdZM2ORsFzhV73B82RAH2TU=",
-      "x86_64-linux": "sha256-ABHHLnhJIqm4mT9FLMaMjJzecDgh6rLUJpVIuVqfUZg="
+      "aarch64-darwin": "sha256-6MxPG5SM6qR/kVyFVjOEfLc1SgcHbwCp9ZTg0qnPlJA=",
+      "aarch64-linux": "sha256-x8l6etAf4Rwc6dwnN1ESkgd9Ug6QWZzVacw6r7Bh7fQ=",
+      "x86_64-darwin": "sha256-6MxPG5SM6qR/kVyFVjOEfLc1SgcHbwCp9ZTg0qnPlJA=",
+      "x86_64-linux": "sha256-x8l6etAf4Rwc6dwnN1ESkgd9Ug6QWZzVacw6r7Bh7fQ="
     },
     "fuchsia": {
       "aarch64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
@@ -36,38 +36,38 @@
       "x86_64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk="
     },
     "ios": {
-      "aarch64-darwin": "sha256-7faP4+NeYI79nUjts0UPcmWBI4R/CtGOSdhbozrMvYg=",
-      "aarch64-linux": "sha256-7faP4+NeYI79nUjts0UPcmWBI4R/CtGOSdhbozrMvYg=",
-      "x86_64-darwin": "sha256-7faP4+NeYI79nUjts0UPcmWBI4R/CtGOSdhbozrMvYg=",
-      "x86_64-linux": "sha256-7faP4+NeYI79nUjts0UPcmWBI4R/CtGOSdhbozrMvYg="
+      "aarch64-darwin": "sha256-56CVLFN8km5lra4r+mD/nARSa+FdvgTiyMkZqn1uucU=",
+      "aarch64-linux": "sha256-56CVLFN8km5lra4r+mD/nARSa+FdvgTiyMkZqn1uucU=",
+      "x86_64-darwin": "sha256-56CVLFN8km5lra4r+mD/nARSa+FdvgTiyMkZqn1uucU=",
+      "x86_64-linux": "sha256-56CVLFN8km5lra4r+mD/nARSa+FdvgTiyMkZqn1uucU="
     },
     "linux": {
-      "aarch64-darwin": "sha256-bKyDwhYmbpcOa8Uk68+VP1KNpsbDPFqA95TeO/0oiNk=",
-      "aarch64-linux": "sha256-bKyDwhYmbpcOa8Uk68+VP1KNpsbDPFqA95TeO/0oiNk=",
-      "x86_64-darwin": "sha256-BCGsqIRYtAACYoBsLlV7m5J1P+M8Kyl9tUNj2jql/q4=",
-      "x86_64-linux": "sha256-BCGsqIRYtAACYoBsLlV7m5J1P+M8Kyl9tUNj2jql/q4="
+      "aarch64-darwin": "sha256-4n4t8RchtHr1VglhREQA+/D5YTMPK41u+wB6nq97YDs=",
+      "aarch64-linux": "sha256-4n4t8RchtHr1VglhREQA+/D5YTMPK41u+wB6nq97YDs=",
+      "x86_64-darwin": "sha256-NmtvMof+onO8ZYrSd8RAao8OsDmnupbAkQhlhF82cNs=",
+      "x86_64-linux": "sha256-NmtvMof+onO8ZYrSd8RAao8OsDmnupbAkQhlhF82cNs="
     },
     "macos": {
-      "aarch64-darwin": "sha256-vYzob2BxI2Ol/H/K6/D8y9mx07PnDzbaZvZe/ukkVqk=",
-      "aarch64-linux": "sha256-vYzob2BxI2Ol/H/K6/D8y9mx07PnDzbaZvZe/ukkVqk=",
-      "x86_64-darwin": "sha256-vYzob2BxI2Ol/H/K6/D8y9mx07PnDzbaZvZe/ukkVqk=",
-      "x86_64-linux": "sha256-vYzob2BxI2Ol/H/K6/D8y9mx07PnDzbaZvZe/ukkVqk="
+      "aarch64-darwin": "sha256-I67I2HbhNF1dZ+yXOnFGrqPH49Uq3DOLMeYohAbueL8=",
+      "aarch64-linux": "sha256-I67I2HbhNF1dZ+yXOnFGrqPH49Uq3DOLMeYohAbueL8=",
+      "x86_64-darwin": "sha256-I67I2HbhNF1dZ+yXOnFGrqPH49Uq3DOLMeYohAbueL8=",
+      "x86_64-linux": "sha256-I67I2HbhNF1dZ+yXOnFGrqPH49Uq3DOLMeYohAbueL8="
     },
     "universal": {
-      "aarch64-darwin": "sha256-s6v1V/Xjt8OZgbjQLrSx+1NTKG9YpTpydQxtvmu3Bo8=",
-      "aarch64-linux": "sha256-KmwJH7uDLbdGQQsUhdTjjwuGB39cX7db5PncSQVbJ5U=",
-      "x86_64-darwin": "sha256-iL7+1bwMolQWWWLuXxfnBJWayEGk/KtDnXh+oHpBaZg=",
-      "x86_64-linux": "sha256-0oE3278pTid3n6zVXVxXV+nEzffCs2R1vzS61c76P5g="
+      "aarch64-darwin": "sha256-W6X355Fck0op/b6YuR+BOMVl+h+UIQEpaGL/Y7vApzg=",
+      "aarch64-linux": "sha256-k6JykwlucffTtt49QJULea5ldzR58f/qZ8QoCwKCU4g=",
+      "x86_64-darwin": "sha256-CJ6TZnb7X6wHHIf53OK+V+zdVQ7s58sm/T31NogywUA=",
+      "x86_64-linux": "sha256-01GvK8iBy+HrbjYkXnT7hBYpEHxlb8Zc+CS2ax/05KE="
     },
     "web": {
-      "aarch64-darwin": "sha256-jpT7q3iHqM0mXRNRgKeLJMA9P5c3P8Qg2m5EwnjtlKg=",
-      "aarch64-linux": "sha256-jpT7q3iHqM0mXRNRgKeLJMA9P5c3P8Qg2m5EwnjtlKg=",
-      "x86_64-darwin": "sha256-jpT7q3iHqM0mXRNRgKeLJMA9P5c3P8Qg2m5EwnjtlKg=",
-      "x86_64-linux": "sha256-jpT7q3iHqM0mXRNRgKeLJMA9P5c3P8Qg2m5EwnjtlKg="
+      "aarch64-darwin": "sha256-5iw2jKBWOkZYXu03OLUFhRerMr30kyXarc6HjhxhCuU=",
+      "aarch64-linux": "sha256-5iw2jKBWOkZYXu03OLUFhRerMr30kyXarc6HjhxhCuU=",
+      "x86_64-darwin": "sha256-5iw2jKBWOkZYXu03OLUFhRerMr30kyXarc6HjhxhCuU=",
+      "x86_64-linux": "sha256-5iw2jKBWOkZYXu03OLUFhRerMr30kyXarc6HjhxhCuU="
     },
     "windows": {
-      "x86_64-darwin": "sha256-LJxwZd/lDtrIMfLrMgG+/KOIAlGpW+b/EebMIngIq3w=",
-      "x86_64-linux": "sha256-LJxwZd/lDtrIMfLrMgG+/KOIAlGpW+b/EebMIngIq3w="
+      "x86_64-darwin": "sha256-91KAFNbrJEt5+0joKSqvE+T8jxkN0KZyHkh7tXbH0vQ=",
+      "x86_64-linux": "sha256-91KAFNbrJEt5+0joKSqvE+T8jxkN0KZyHkh7tXbH0vQ="
     }
   },
   "pubspecLock": {
diff --git a/pkgs/development/python-modules/aws-error-utils/default.nix b/pkgs/development/python-modules/aws-error-utils/default.nix
new file mode 100644
index 000000000000..ed4de1388093
--- /dev/null
+++ b/pkgs/development/python-modules/aws-error-utils/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  poetry-core,
+  botocore,
+}:
+
+buildPythonPackage rec {
+  pname = "aws-error-utils";
+  version = "2.7.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "aws_error_utils";
+    inherit version;
+    hash = "sha256-BxB68qLCZwbNlSW3/77UPy0HtQ0n45+ekVbBGy6ZPJc=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    botocore
+  ];
+
+  pythonImportsCheck = [
+    "aws_error_utils"
+  ];
+
+  meta = {
+    description = "Error-handling functions for boto3/botocore";
+    homepage = "https://pypi.org/project/aws-error-utils/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ cterence ];
+  };
+}
diff --git a/pkgs/development/python-modules/aws-sso-lib/default.nix b/pkgs/development/python-modules/aws-sso-lib/default.nix
new file mode 100644
index 000000000000..21afcf8aab8f
--- /dev/null
+++ b/pkgs/development/python-modules/aws-sso-lib/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  poetry-core,
+  aws-error-utils,
+  boto3,
+}:
+
+buildPythonPackage rec {
+  pname = "aws-sso-lib";
+  version = "1.14.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "aws_sso_lib";
+    inherit version;
+    hash = "sha256-sCA6ZMy2a6ePme89DrZpr/57wyP2q5yqyX81whoDzqU=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    aws-error-utils
+    boto3
+  ];
+
+  pythonImportsCheck = [
+    "aws_sso_lib"
+  ];
+
+  meta = {
+    description = "Library to make AWS SSO easier";
+    homepage = "https://pypi.org/project/aws-sso-lib/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ cterence ];
+  };
+}
diff --git a/pkgs/development/python-modules/curl-cffi/default.nix b/pkgs/development/python-modules/curl-cffi/default.nix
index 38a11e353d74..31dad93e5e89 100644
--- a/pkgs/development/python-modules/curl-cffi/default.nix
+++ b/pkgs/development/python-modules/curl-cffi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "curl-cffi";
-  version = "0.7.2";
+  version = "0.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lexiforest";
     repo = "curl_cffi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-s8P/7erdAeGZuykUrgpCcm0a4ym3Y8F6kKFXoDXsOdQ=";
+    hash = "sha256-Q1VppzQ1Go+ia1D1BemTf40o9wV0miWyoGy/tY+95qE==";
   };
 
   patches = [ ./use-system-libs.patch ];
diff --git a/pkgs/development/python-modules/kivy/default.nix b/pkgs/development/python-modules/kivy/default.nix
index 273de9cca3da..2f42ef165d6a 100644
--- a/pkgs/development/python-modules/kivy/default.nix
+++ b/pkgs/development/python-modules/kivy/default.nix
@@ -82,7 +82,14 @@ buildPythonPackage rec {
   # prefer pkg-config over hardcoded framework paths
   USE_OSX_FRAMEWORKS = 0;
   # work around python distutils compiling C++ with $CC (see issue #26709)
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isGNU [
+      "-Wno-error=incompatible-pointer-types"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-I${lib.getDev libcxx}/include/c++/v1"
+    ]
+  );
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace kivy/lib/mtdev.py \
diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index c0a51cd1dd39..b905f1c4a75d 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -2,13 +2,13 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonAtLeast,
   pythonOlder,
   hatchling,
   hatch-vcs,
   numpy,
   packaging,
   importlib-resources,
+  typing-extensions,
   pydicom,
   pillow,
   h5py,
@@ -22,25 +22,28 @@
 
 buildPythonPackage rec {
   pname = "nibabel";
-  version = "5.2.1";
+  version = "5.3.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tsgLLnKOS8K2XxFC2bjSKHqRAqi/hHfhFe8NgzRVmXU=";
+    hash = "sha256-C9ymUDsceEtEbHRaRUI2fed1bPug1yFDuR+f+3i+Vps=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
     hatch-vcs
   ];
 
-  propagatedBuildInputs = [
-    numpy
-    packaging
-  ] ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
+  dependencies =
+    [
+      numpy
+      packaging
+    ]
+    ++ lib.optionals (pythonOlder "3.12") [ importlib-resources ]
+    ++ lib.optionals (pythonOlder "3.13") [ typing-extensions ];
 
   optional-dependencies = rec {
     all = dicom ++ dicomfs ++ minc2 ++ spm ++ zstd;
@@ -65,11 +68,6 @@ buildPythonPackage rec {
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
-    # uses distutils
-    "nisext/tests/test_sexts.py"
-  ];
-
   meta = with lib; {
     homepage = "https://nipy.org/nibabel";
     changelog = "https://github.com/nipy/nibabel/blob/${version}/Changelog";
diff --git a/pkgs/development/python-modules/pydicom/default.nix b/pkgs/development/python-modules/pydicom/default.nix
index 94822a24d444..13fbb8e4d0d5 100644
--- a/pkgs/development/python-modules/pydicom/default.nix
+++ b/pkgs/development/python-modules/pydicom/default.nix
@@ -3,54 +3,59 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
   flit-core,
   numpy,
-  pillow,
   pytestCheckHook,
-  pythonOlder,
-  setuptools,
+
+  # optional/test dependencies
+  gdcm,
+  pillow,
+  pylibjpeg,
+  pylibjpeg-libjpeg,
 }:
-
 let
-  pname = "pydicom";
-  version = "2.4.4";
-
-  src = fetchFromGitHub {
-    owner = "pydicom";
-    repo = "pydicom";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-iJE1horEmdL7bKPn+NlZLgmtCbLZCZWQ8NjDBQPzXk8=";
-  };
-
   # Pydicom needs pydicom-data to run some tests. If these files aren't downloaded
   # before the package creation, it'll try to download during the checkPhase.
   test_data = fetchFromGitHub {
     owner = "pydicom";
     repo = "pydicom-data";
-    rev = "cbb9b2148bccf0f550e3758c07aca3d0e328e768";
-    hash = "sha256-nF/j7pfcEpWHjjsqqTtIkW8hCEbuQ3J4IxpRk0qc1CQ=";
+    rev = "8da482f208401d63cd63f3f4efc41b6856ef36c7";
+    hash = "sha256-ji7SppKdiszaXs8yCSIPkJj4Ld++XWNw9FuxLoFLfFo=";
   };
 in
-buildPythonPackage {
-  inherit pname version src;
+buildPythonPackage rec {
+  pname = "pydicom";
+  version = "3.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
-  patches = [
-    # backport of https://github.com/pydicom/pydicom/commit/2513a20cc41743a42bdb86f4cbb4873899b7823c
-    ./pillow-10.1.0-compat.patch
-  ];
+  src = fetchFromGitHub {
+    owner = "pydicom";
+    repo = "pydicom";
+    tag = "v${version}";
+    hash = "sha256-SvRevQehRaSp+vCtJRQVEJiC5noIJS+bGG1/q4p7/XU=";
+  };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
-    pillow
-    setuptools
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  optional-dependencies = {
+    pixeldata = [
+      pillow
+      #pyjpegls # not in nixpkgs
+      #pylibjpeg.optional-dependencies.openjpeg # infinite recursion
+      #pylibjpeg.optional-dependencies.rle # not in nixpkgs
+      pylibjpeg-libjpeg
+      gdcm
+    ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.pixeldata;
 
   # Setting $HOME to prevent pytest to try to create a folder inside
   # /homeless-shelter which is read-only.
@@ -65,6 +70,14 @@ buildPythonPackage {
     [
       # tries to remove a dicom inside $HOME/.pydicom/data/ and download it again
       "test_fetch_data_files"
+
+      # test_reference_expl{,_binary}[parametric_map_float.dcm] tries to download that file for some reason even though it's present in test-data
+      "test_reference_expl"
+      "test_reference_expl_binary"
+
+      # slight error in regex matching
+      "test_no_decoders_raises"
+      "test_deepcopy_bufferedreader_raises"
     ]
     ++ lib.optionals stdenv.hostPlatform.isAarch64 [
       # https://github.com/pydicom/pydicom/issues/1386
diff --git a/pkgs/development/python-modules/pydicom/pillow-10.1.0-compat.patch b/pkgs/development/python-modules/pydicom/pillow-10.1.0-compat.patch
deleted file mode 100644
index 2599f955f7dd..000000000000
--- a/pkgs/development/python-modules/pydicom/pillow-10.1.0-compat.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/pydicom/pixel_data_handlers/pillow_handler.py b/pydicom/pixel_data_handlers/pillow_handler.py
-index ff781025d..a44eb9a41 100644
---- a/pydicom/pixel_data_handlers/pillow_handler.py
-+++ b/pydicom/pixel_data_handlers/pillow_handler.py
-@@ -119,18 +119,12 @@ def _decompress_single_frame(
-     # space prior to compression, setting the value of "mode" to YCbCr
-     # signals Pillow to not apply any color transformation upon
-     # decompression.
--    if (transfer_syntax in PillowJPEGTransferSyntaxes and
--            photometric_interpretation == 'RGB'):
--        if 'adobe_transform' not in image.info:
--            color_mode = 'YCbCr'
--            image.tile = [(
--                'jpeg',
--                image.tile[0][1],
--                image.tile[0][2],
--                (color_mode, ''),
--            )]
--            image.mode = color_mode
--            image.rawmode = color_mode
-+    if (
-+        transfer_syntax in PillowJPEGTransferSyntaxes
-+        and photometric_interpretation == 'RGB'
-+        and "adobe_transform" not in image.info
-+    ):
-+        image.draft("YCbCr", image.size)
-     return image
- 
- 
diff --git a/pkgs/development/python-modules/pylibjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg/default.nix
index 155b3f1fe8c0..2e253d8d63b3 100644
--- a/pkgs/development/python-modules/pylibjpeg/default.nix
+++ b/pkgs/development/python-modules/pylibjpeg/default.nix
@@ -9,6 +9,7 @@
   pydicom,
   pylibjpeg-data,
   pylibjpeg-libjpeg,
+  pylibjpeg-openjpeg,
 }:
 
 buildPythonPackage rec {
@@ -29,6 +30,12 @@ buildPythonPackage rec {
 
   dependencies = [ numpy ];
 
+  optional-dependencies = {
+    libjpeg = [ pylibjpeg-libjpeg ];
+    openjpeg = [ pylibjpeg-openjpeg ];
+    #rle = [ pylibjpeg-rle ]; # not in Nixpkgs
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
     pydicom
diff --git a/pkgs/development/python-modules/yoto-api/default.nix b/pkgs/development/python-modules/yoto-api/default.nix
new file mode 100644
index 000000000000..85bc4e936ba1
--- /dev/null
+++ b/pkgs/development/python-modules/yoto-api/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pytz,
+  requests,
+  paho-mqtt,
+}:
+
+buildPythonPackage rec {
+  pname = "yoto-api";
+  version = "1.24.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cdnninja";
+    repo = "yoto_api";
+    tag = "v${version}";
+    hash = "sha256-wbqeRTYHDpxKqOwTRkkYGtgYOmnyNQY50dnvI0WprwA=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pytz
+    requests
+    paho-mqtt
+  ];
+
+  # All tests require access to and authentication with the Yoto API (api.yotoplay.com).
+  doCheck = false;
+
+  pythonImportsCheck = [ "yoto_api" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/cdnninja/yoto_api/releases/tag/${src.tag}";
+    homepage = "https://github.com/cdnninja/yoto_api";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ seberm ];
+    license = licenses.mit;
+    description = "A python package that makes it a bit easier to work with the yoto play API.";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index e5bfb0f9c4cc..06d1e09975c5 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -43,6 +43,7 @@
   unidiff,
   glibcLocales,
   nixosTests,
+  fetchpatch,
 }:
 
 let
@@ -140,6 +141,11 @@ buildPythonApplication rec {
   ];
 
   patches = [
+    (fetchpatch {
+      name = "remove-uses-of-twisted-python-constants.patch";
+      url = "https://github.com/buildbot/buildbot/commit/ac46c0aa77be46eaa64e09bef03da6f8dbaacfa7.patch";
+      hash = "sha256-XoODSKY0GzFh2H5gWxiXm/QxngGN2MM0yId5D1RQflQ=";
+    })
     # This patch disables the test that tries to read /etc/os-release which
     # is not accessible in sandboxed builds.
     ./skip_test_linux_distro.patch
diff --git a/pkgs/games/openmw/0001-function-inclusion-fixes-for-gcc14.patch b/pkgs/games/openmw/0001-function-inclusion-fixes-for-gcc14.patch
new file mode 100644
index 000000000000..c0b6fb92a783
--- /dev/null
+++ b/pkgs/games/openmw/0001-function-inclusion-fixes-for-gcc14.patch
@@ -0,0 +1,41 @@
+From 59f8403616e8db6dcf8f3489c44b61524044fe64 Mon Sep 17 00:00:00 2001
+From: Fernando Rodrigues <alpha@sigmasquadron.net>
+Date: Thu, 2 Jan 2025 04:28:42 +0000
+Subject: [PATCH] Function inclusion fixes for GCC 14
+
+This patch includes <algorithm> in bsa_file.cpp and <list> in
+charactermanager.hpp to prevent a build failure with GCC 14.
+
+Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
+---
+ apps/openmw/mwstate/charactermanager.hpp | 1 +
+ components/bsa/bsa_file.cpp              | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/apps/openmw/mwstate/charactermanager.hpp b/apps/openmw/mwstate/charactermanager.hpp
+index 8b3f2b8f8f..fac73b3d44 100644
+--- a/apps/openmw/mwstate/charactermanager.hpp
++++ b/apps/openmw/mwstate/charactermanager.hpp
+@@ -4,6 +4,7 @@
+ #include <boost/filesystem/path.hpp>
+
+ #include "character.hpp"
++#include <list>
+
+ namespace MWState
+ {
+diff --git a/components/bsa/bsa_file.cpp b/components/bsa/bsa_file.cpp
+index 4f795ec0d4..38e97b267b 100644
+--- a/components/bsa/bsa_file.cpp
++++ b/components/bsa/bsa_file.cpp
+@@ -25,6 +25,7 @@
+
+ #include <components/files/constrainedfilestream.hpp>
+
++#include <algorithm>
+ #include <cassert>
+
+ #include <boost/filesystem/path.hpp>
+--
+2.47.0
+
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index 91497b50bd19..c83c5648eb62 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -78,6 +78,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-zkjVt3GfQZsFXl2Ht3lCuQtDMYQWxhdFO4aGSb3rsyo=";
   };
 
+  patches = [ ./0001-function-inclusion-fixes-for-gcc14.patch ];
+
   postPatch =
     ''
       sed '1i#include <memory>' -i components/myguiplatform/myguidatamanager.cpp # gcc12
diff --git a/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix b/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix
new file mode 100644
index 000000000000..f005c0ecc365
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildHomeAssistantComponent,
+  yoto-api,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "cdnninja";
+  domain = "yoto";
+  version = "1.22.0";
+
+  src = fetchFromGitHub {
+    owner = "cdnninja";
+    repo = "yoto_ha";
+    tag = "v${version}";
+    hash = "sha256-uaakUxuPxYqLnE2UK6ept91Lycvvhr0r9vZw44y1W4g=";
+  };
+
+  dependencies = [
+    yoto-api
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/cdnninja/yoto_ha/releases/tag/${src.tag}";
+    description = "Home Assistant Integration for Yoto.";
+    homepage = "https://github.com/cdnninja/yoto_ha";
+    maintainers = with maintainers; [ seberm ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index d0e600f056ec..b2584ca00e35 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -11,7 +11,6 @@
 , perl
 , libtool_2
 , libkrb5
-, fetchpatch
 }:
 
 let
@@ -26,26 +25,7 @@ stdenv.mkDerivation {
   version = "${version}-${kernel.modDirVersion}";
   inherit src;
 
-  patches = [
-    # Linux: Define Clear/Set PageError macros as NOPs
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/15964/revisions/917d071a1b3c3e23c984ca8e5501ddccd62a01b6/patch";
-      decode = "base64 -d";
-      hash = "sha256-WqAHRN1YZj7Cz4X4iF1K3DJC1h8nXlnA9gveClL3KHc=";
-    })
-    # Linux: Refactor afs_linux_write_begin() variants
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/15965/revisions/c955b666b904b96620df10328a9a37c2fb5f2ed6/patch";
-      decode = "base64 -d";
-      hash = "sha256-U2W+8YrD1K7Pb/Jq08uBcuPnGkVvcSyTpwaWWcTbq0w=";
-    })
-    # Linux: Use folios for aops->write_begin/end
-    (fetchpatch {
-      url = "https://gerrit.openafs.org/changes/15966/revisions/d1706bdc5080b86b1876d10f062c369e8d898188/patch";
-      decode = "base64 -d";
-      hash = "sha256-jY+r9LO/4g6K9J1stxNCa38nyr1/J3beOhG9YilEbzg=";
-    })
-  ];
+  patches = [ ];
 
   nativeBuildInputs = [ autoconf automake flex libtool_2 perl which bison ]
     ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/servers/openafs/1.8/srcs.nix b/pkgs/servers/openafs/1.8/srcs.nix
index 3c4c24f1661b..82aadbb0f6ea 100644
--- a/pkgs/servers/openafs/1.8/srcs.nix
+++ b/pkgs/servers/openafs/1.8/srcs.nix
@@ -1,16 +1,16 @@
 { fetchurl }:
 rec {
-  version = "1.8.13";
+  version = "1.8.13.1";
   src = fetchurl {
     url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    hash = "sha256-eRABcMokkLEpXZuLEwWPMOI9eruJe/GgcXVddnB4vdE=";
+    hash = "sha256-eVc9fu/RzGUODFSd1oeiObxrGn7iys82KxoqOz9G/To=";
   };
 
   srcs = [
     src
     (fetchurl {
       url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      hash = "sha256-1PPUL05XZkfbIV2rc8Nl0gQ9MmrT0hqA+MRzGdPkP+U=";
+      hash = "sha256-JwGqr0g1tanct8VISVOggiH63BOfrAVQ2kIukG5Xtcs=";
     })
   ];
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f0445cf28187..931ef57cee91 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -411,6 +411,7 @@ mapAliases {
   framework-system-tools = framework-tool; # added 2023-12-09
   francis = kdePackages.francis; # added 2024-07-13
   frostwire = throw "frostwire was removed, as it was broken due to reproducibility issues, use `frostwire-bin` package instead."; # added 2024-05-17
+  ftjam = throw "ftjam was removed, as it hasn't been updated since 2007 and fails to build"; # added 2025-01-02
   fuse2fs = if stdenv.hostPlatform.isLinux then e2fsprogs.fuse2fs else null; # Added 2022-03-27 preserve, reason: convenience, arch has a package named fuse2fs too.
   fuse-common = throw "fuse-common was removed, because the udev rule was early included by systemd-udevd and the config is done by NixOS module `programs.fuse`"; # added 2024-09-29
   futuresql = libsForQt5.futuresql; # added 2023-11-11
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b60d3574d51a..759ff0e5e2e9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1115,6 +1115,8 @@ self: super: with self; {
 
   aws-encryption-sdk = callPackage ../development/python-modules/aws-encryption-sdk { };
 
+  aws-error-utils = callPackage ../development/python-modules/aws-error-utils { };
+
   aws-lambda-builders = callPackage ../development/python-modules/aws-lambda-builders { };
 
   aws-request-signer = callPackage ../development/python-modules/aws-request-signer { };
@@ -1123,6 +1125,8 @@ self: super: with self; {
 
   aws-secretsmanager-caching = callPackage ../development/python-modules/aws-secretsmanager-caching { };
 
+  aws-sso-lib = callPackage ../development/python-modules/aws-sso-lib { };
+
   aws-xray-sdk = callPackage ../development/python-modules/aws-xray-sdk { };
 
   awscrt = callPackage ../development/python-modules/awscrt {
@@ -18311,6 +18315,8 @@ self: super: with self; {
     python3 = python;
   });
 
+  yoto-api = callPackage ../development/python-modules/yoto-api { };
+
   youless-api = callPackage ../development/python-modules/youless-api { };
 
   youseedee = callPackage ../development/python-modules/youseedee { };