diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index db4b1172bc5d..0fd6c5d4807f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17916,7 +17916,10 @@
     github = "JarvisCraft";
     githubId = 7693005;
     name = "Petr Portnov";
-    keys = [ { fingerprint = "884B 08D2 8DFF 6209 1857  C1C7 7E8F C8F7 D1BB 84A3"; } ];
+    keys = [
+      { fingerprint = "884B 08D2 8DFF 6209 1857  C1C7 7E8F C8F7 D1BB 84A3"; }
+      { fingerprint = "AA96 35AA F392 52BF 0E60  825E 1192 2217 F828 8484"; }
+    ];
   };
   progval = {
     email = "progval+nix@progval.net";
diff --git a/nixos/modules/services/networking/zapret.nix b/nixos/modules/services/networking/zapret.nix
index b66221007d42..ee4177736496 100644
--- a/nixos/modules/services/networking/zapret.nix
+++ b/nixos/modules/services/networking/zapret.nix
@@ -214,7 +214,6 @@ in
   );
 
   meta.maintainers = with lib.maintainers; [
-    voronind
     nishimara
   ];
 }
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 922df1ea03ab..145c86028de8 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1305,8 +1305,7 @@ in
         # System Call Filtering
         SystemCallArchitectures = "native";
         SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ]
-          ++ optional cfg.enableQuicBPF [ "bpf" ]
-          ++ optionals ((cfg.package != pkgs.tengine) && (cfg.package != pkgs.openresty) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
+          ++ optional cfg.enableQuicBPF [ "bpf" ];
       };
     };
 
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 13721c2c0b40..5043fc0ca670 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -237,7 +237,7 @@ let
             preStop = ''
               state="/run/nixos/network/routes/${i.name}"
               if [ -e "$state" ]; then
-                while read cidr; do
+                while read -r cidr; do
                   echo -n "deleting route $cidr... "
                   ip route del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
                 done < "$state"
@@ -246,7 +246,7 @@ let
 
               state="/run/nixos/network/addresses/${i.name}"
               if [ -e "$state" ]; then
-                while read cidr; do
+                while read -r cidr; do
                   echo -n "deleting address $cidr... "
                   ip addr del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
                 done < "$state"
diff --git a/pkgs/applications/version-management/git-workspace/default.nix b/pkgs/applications/version-management/git-workspace/default.nix
index 299f9046290e..36ca542517f9 100644
--- a/pkgs/applications/version-management/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-workspace/default.nix
@@ -13,26 +13,23 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cAAEbeA7+lnFH5vr+cfOlkhRjZJnIWX7AoKnow68k3I=";
+    sha256 = "sha256-sS452PCX2G49Q5tnScG+ySkUAhFctGsGZrMvQXL7WkY=";
   };
 
-  cargoHash = "sha256-xLsN9yiAo7HP2HpixZ5SUu0Wnv07nL9D8t+JPT6uKb0=";
+  cargoHash = "sha256-OrAZ4SGhqP+cGYB2gUIh6rON67hBRmgnq1nn9cEUAU0=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv Security ];
 
-  passthru = {
-    updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = git-workspace; };
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Sync personal and work git repositories from multiple providers";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix b/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
index 49150c647c23..942e01e5cc71 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-3d-effect";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-3d-effect";
     rev = version;
-    sha256 = "sha256-eHX5GH7Jmx+Q8ji5Flwajk2Ak37aaVO4mnEHGICOicY=";
+    sha256 = "sha256-BJumEIxJTXZgPxXhxfT6zdZctCHFXb26EdnsYtA8ztE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ce/cedar/package.nix b/pkgs/by-name/ce/cedar/package.nix
new file mode 100644
index 000000000000..16963c41058d
--- /dev/null
+++ b/pkgs/by-name/ce/cedar/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  cedar,
+  testers,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cedar";
+  version = "4.2.2";
+
+  src = fetchFromGitHub {
+    owner = "cedar-policy";
+    repo = "cedar";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-p8idQx3HGO/ikL0pDTPXx5+rD2sRpXANqs/g51BL554=";
+  };
+
+  cargoHash = "sha256-GuXifjQkH8jV9mT3UYU6rUZB1qO5Xl9tvYJW7MjcW0U=";
+
+  passthru = {
+    tests.version = testers.testVersion { package = cedar; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Implementation of the Cedar Policy Language";
+    homepage = "https://github.com/cedar-policy/cedar";
+    changelog = "https://github.com/cedar-policy/cedar/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ meain ];
+    mainProgram = "cedar";
+  };
+}
diff --git a/pkgs/by-name/fl/fluent-bit/package.nix b/pkgs/by-name/fl/fluent-bit/package.nix
index 8c6c762e66c3..be8b5085c4eb 100644
--- a/pkgs/by-name/fl/fluent-bit/package.nix
+++ b/pkgs/by-name/fl/fluent-bit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.1.10";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/YKXWYaDqkJ8fWgcYktXWJPcjDJTupgRTSQVp0cWruY=";
+    hash = "sha256-BnrULjcWVBAOHfxlmd1RTQ8gfwlfZcwrUyLU27/9Z3M=";
   };
 
   # optional only to avoid linux rebuild
diff --git a/pkgs/by-name/gd/gdbuspp/package.nix b/pkgs/by-name/gd/gdbuspp/package.nix
index 7dca39208964..8faf4b8990ee 100644
--- a/pkgs/by-name/gd/gdbuspp/package.nix
+++ b/pkgs/by-name/gd/gdbuspp/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "gdbuspp";
-  version = "2";
+  version = "3";
   src = fetchFromGitHub {
     owner = "OpenVPN";
     repo = "gdbuspp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-A0sl4zZa17zMec/jJASE8lDVNohzJzEGZbWjjsorB2Y=";
+    hash = "sha256-LwEUNBQ7BUyoTm8tBgE4hwL7AbimCY/grQus8lWSI/M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/go/go-blueprint/package.nix b/pkgs/by-name/go/go-blueprint/package.nix
index 54908b491a11..fe478ddb999b 100644
--- a/pkgs/by-name/go/go-blueprint/package.nix
+++ b/pkgs/by-name/go/go-blueprint/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "go-blueprint";
-  version = "0.8.2";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "Melkeydev";
     repo = "go-blueprint";
     rev = "v${version}";
-    hash = "sha256-4KEshM6y27CD+PiyYoz4IWKkfLWRXOTA7bMFfxVYfaI=";
+    hash = "sha256-wNS8Tv0LzAPK9F98Rm2fS+fOoZXiJYYq97wYy9KzQ0g=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/hy/hyprlauncher/package.nix b/pkgs/by-name/hy/hyprlauncher/package.nix
index f7ad3cc1d5fb..343a7b5da876 100644
--- a/pkgs/by-name/hy/hyprlauncher/package.nix
+++ b/pkgs/by-name/hy/hyprlauncher/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprlauncher";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "hyprutils";
     repo = "hyprlauncher";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yP3g/hWhQj0JwXNbZFMRJrg0a4upOUwDD0EkW1W8acE=";
+    hash = "sha256-+CFMGWK7W8BWIY2Xg4P7VLYQ7wQmmmjGSM5Rzq8yMSY=";
   };
 
-  cargoHash = "sha256-ehFkZKiMtJyH0DVBzxI08uVlMACslnYfxZX5gQ7xbPU=";
+  cargoHash = "sha256-epvUpsWkkJqWuUjsbHQaHMcBkDc06ke56I/5/QEag/g=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index c42fbfa6a11b..af51ef299e24 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.9.0",
-    "hash": "sha256-i3jpLRidpkg6+LwNFTRKXJoiWOJdd1H41e1wIFAc7Bw="
+    "version": "5.10.2",
+    "hash": "sha256-Qyhl6uZy70208j07vaWdwN5GGmX66kkOpA3Ny48PdtI="
   },
   "beta": {
-    "version": "5.9.0",
-    "hash": "sha256-i3jpLRidpkg6+LwNFTRKXJoiWOJdd1H41e1wIFAc7Bw="
+    "version": "5.11.0-beta.1",
+    "hash": "sha256-qpzbnfAd7P4f2jFgnCx7gTmZXYUUGreEHRY3/HGbZco="
   }
 }
diff --git a/pkgs/tools/networking/magic-wormhole-rs/default.nix b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
similarity index 76%
rename from pkgs/tools/networking/magic-wormhole-rs/default.nix
rename to pkgs/by-name/ma/magic-wormhole-rs/package.nix
index 7e62d1d78af3..ab3dba19efc1 100644
--- a/pkgs/tools/networking/magic-wormhole-rs/default.nix
+++ b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
@@ -1,11 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, libxcb
-, installShellFiles
-, Security
-, AppKit
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  libxcb,
+  installShellFiles,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "magic-wormhole-rs";
@@ -20,14 +19,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-+OcjILDwGg0eybzBgVIZeVelnQatPU6rgd/b6buvTRQ=";
 
-  buildInputs = [ libxcb ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security AppKit ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];
 
   nativeBuildInputs = [ installShellFiles ];
 
-  # all tests involve networking and are bound fail
-  doCheck = false;
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd wormhole-rs \
       --bash <($out/bin/wormhole-rs completion bash) \
@@ -40,7 +35,10 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/magic-wormhole/magic-wormhole.rs";
     changelog = "https://github.com/magic-wormhole/magic-wormhole.rs/raw/${version}/changelog.md";
     license = licenses.eupl12;
-    maintainers = with maintainers; [ zeri piegames ];
+    maintainers = with maintainers; [
+      zeri
+      piegames
+    ];
     mainProgram = "wormhole-rs";
   };
 }
diff --git a/pkgs/by-name/mi/minio-client/package.nix b/pkgs/by-name/mi/minio-client/package.nix
index a51ec1d79b29..286f81f7cfc4 100644
--- a/pkgs/by-name/mi/minio-client/package.nix
+++ b/pkgs/by-name/mi/minio-client/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-10-02T08-27-28Z";
+  version = "2024-11-17T19-35-25Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-o+VNWrGV8LvdDbPPiiXCaGgHRZprfL+HOaATfnzDIVg=";
+    sha256 = "sha256-T99mHRRy0+Zmk+dlJVGg2h7wFnXKz5Prj21PZrkVWpI=";
   };
 
-  vendorHash = "sha256-MJsfYCd2VqvJDcWgiJZX1/jcbHQrFQ7TOkskDf0vuSw=";
+  vendorHash = "sha256-teG+GrzmUgJ6QhcxDSbWXP32hRuCgoCvH2BoNL8ddUc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/README.md b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
index 9a565de2dd18..41bfb43ba3c9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/README.md
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
@@ -107,9 +107,9 @@ ruff format .
 - [ ] Port `nixos-rebuild.passthru.tests`
 - [ ] Change module system to allow easier opt-in, like
   `system.switch.enableNg` for `switch-to-configuration-ng`
-- [ ] Improve documentation
+- [x] Improve documentation
 - [x] `nixos-rebuild repl`
-- [ ] Generate tab completion via [`shtab`](https://docs.iterative.ai/shtab/)
+- [x] Generate tab completion via [`shtab`](https://docs.iterative.ai/shtab/)
 - [x] Reduce build closure
 
 ## TODON'T
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
new file mode 100644
index 000000000000..25581f91c0f3
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -0,0 +1,335 @@
+nixos-rebuild(8) ["nixpkgs"]
+; quick summary:
+; # new section
+; comments starts with ;
+; - this is a list
+; 	- sub-list
+; - *bold*: _underline_, force a line break++
+; - [tables], \[ can be used to force an actual [
+; . numbered list
+; please configure your editor to use hard tabs
+; see `man 5 scdoc` for more information about syntax
+; or https://man.archlinux.org/man/scdoc.5.en
+
+# NAME
+
+nixos-rebuild - reconfigure a NixOS machine
+
+# SYNOPSIS
+
+_nixos-rebuild_ \[--verbose] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS]++
+	\[--include INCLUDE] [--quiet] [--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file]++
+	\[--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file] [--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT]++
+	\[--no-build-output] [--use-substitutes] [--help] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader] [--profile-name PROFILE_NAME]++
+	\[--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--fast]++
+	\[--build-host BUILD_HOST] [--target-host TARGET_HOST]++
+	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-vm,build-vm-with-bootloader,list-generations}]
+
+# DESCRIPTION
+
+This command updates the system so that it corresponds to the configuration
+specified in /etc/nixos/configuration.nix, /etc/nixos/flake.nix or the file and
+attribute specified by the *--file* and/or *--attr* options. Thus, every
+time you modify the configuration or any other NixOS module, you must run
+*nixos-rebuild* to make the changes take effect. It builds the new system in
+/nix/store, runs its activation script, and stop and (re)starts any system
+services if needed. Please note that user services need to be started manually
+as they aren't detected by the activation script at the moment.
+
+This command has one required argument, which specifies the desired operation.
+It must be one of the following:
+
+*switch*
+	Build and activate the new configuration, and make it the boot default.
+	That is, the configuration is added to the GRUB boot menu as the
+	default menu entry, so that subsequent reboots will boot the system
+	into the new configuration. Previous configurations activated with
+	nixos-rebuild switch or nixos-rebuild boot remain available in the GRUB
+	menu.
+
+	Note that if you are using specializations, running just nixos-rebuild
+	switch will switch you back to the unspecialized, base system — in that
+	case, you might want to use this instead:
+
+		$ nixos-rebuild switch --specialisation your-specialisation-name
+
+	This command will build all specialisations and make them bootable
+	just like regular nixos-rebuild switch does — the only thing different
+	is that it will switch to given specialisation instead of the base
+	system; it can be also used to switch from the base system into a
+	specialised one, or to switch between specialisations.
+
+*boot*
+	Build the new configuration and make it the boot default (as with
+	*nixos-rebuild switch*), but do not activate it. That is, the system
+	continues to run the previous configuration until the next reboot.
+
+*test*
+	Build and activate the new configuration, but do not add it to the GRUB
+	boot menu. Thus, if you reboot the system (or if it crashes), you will
+	automatically revert to the default configuration (i.e. the
+	configuration resulting from the last call to *nixos-rebuild switch* or
+	*nixos-rebuild boot*).
+
+	Note that if you are using specialisations, running just nixos-rebuild
+	test will activate the unspecialised, base system — in that case, you
+	might want to use this instead:
+
+		$ nixos-rebuild test --specialisation your-specialisation-name
+
+	This command can be also used to switch from the base system into a
+	specialised one, or to switch between specialisations.
+
+*build*
+	Build the new configuration, but neither activate it nor add it to the
+	GRUB boot menu. It leaves a symlink named result in the current
+	directory, which points to the output of the top-level “system”
+	derivation. This is essentially the same as doing
+
+		$ nix-build /path/to/nixpkgs/nixos -A system
+
+	Note that you do not need to be root to run *nixos-rebuild build*.
+
+*dry-build*
+	Show what store paths would be built or downloaded by any of the
+	operations above, but otherwise do nothing.
+
+*dry-activate*
+	Build the new configuration, but instead of activating it, show what
+	changes would be performed by the activation (i.e. by *nixos-rebuild*
+	test). For instance, this command will print which systemd units would be
+	restarted. The list of changes is not guaranteed to be complete.
+
+*edit*
+	Opens _configuration.nix_ in the default editor.
+
+*repl*
+	Opens the configuration in *nix repl*.
+
+*build-vm*
+	Build a script that starts a NixOS virtual machine with the desired
+	configuration. It leaves a symlink _result_ in the current directory that
+	points (under ‘result/bin/run-_hostname_-vm’) at the script that starts
+	the VM. Thus, to test a NixOS configuration in a virtual machine, you
+	should do the following:
+
+		$ nixos-rebuild build-vm && ./result/bin/run-\*-vm
+
+	The VM is implemented using the ‘qemu’ package. For best performance, you
+	should load the ‘kvm-intel’ or ‘kvm-amd’ kernel modules to get hardware
+	virtualisation.
+
+	The VM mounts the Nix store of the host through the 9P file system. The
+	host Nix store is read-only, so Nix commands that modify the Nix store
+	will not work in the VM. This includes commands such as *nixos-rebuild*;
+	to change the VM’s configuration, you must halt the VM and re-run the
+	commands above.
+
+	The VM has its own ext3 root file system, which is automatically created
+	when the VM is first started, and is persistent across reboots of the VM.
+	It is stored in ‘./_hostname_.qcow2’.
+
+*build-vm-with-bootloader*
+	Like build-vm, but boots using the regular boot loader of your
+	configuration (e.g. GRUB 1 or 2), rather than booting directly into the
+	kernel and initial ramdisk of the system. This al‐ lows you to test
+	whether the boot loader works correctly. However, it does not guarantee
+	that your NixOS configuration will boot successfully on the host
+	hardware (i.e., after running *nixos-rebuild switch*), because the
+	hardware and boot loader configuration in the VM are different. The boot
+	loader is installed on an automatically generated virtual disk
+	containing a /boot partition.
+
+*list-generations [--json]*
+	List the available generations in a similar manner to the boot loader
+	menu. It shows the generation number, build date and time, NixOS
+	version, kernel version and the configuration revi‐ sion. There is also
+	a json version of output available.
+
+# OPTIONS
+
+*--upgrade, --upgrade-all*
+	Update the root user's channel named ‘nixos’ before rebuilding the
+	system.
+
+	In addition to the ‘nixos’ channel, the root user's channels which have
+	a file named ‘.update-on-nixos-rebuild’ in their base directory will
+	also be updated.
+
+	Passing *--upgrade-all* updates all of the root user's channels.
+
+*--install-bootloader*
+	Causes the boot loader to be (re)installed on the device specified by
+	the relevant configuration options.
+
+*--fast*
+	Normally, *nixos-rebuild* first finds and builds itself from the
+	_config.system.build.nixos-rebuild_ attribute from the current user
+	channel or flake and exec into it. This allows *nixos-rebuild* to run
+	with the latest bug-fixes. This option disables it, using the current
+	*nixos-rebuild* instance instead.
+
+*--rollback*
+	Instead of building a new configuration as specified by
+	_/etc/nixos/configuration.nix_, roll back to the previous configuration.
+	(The previous configuration is defined as the one before the “current”
+	generation of the Nix profile _/nix/var/nix/profiles/system_.)
+
+*--builders* _builder-spec_
+	Allow ad-hoc remote builders for building the new system. This requires
+	the user executing *nixos-rebuild* (usually root) to be configured as a
+	trusted user in the Nix daemon. This can be achieved by using the
+	_nix.settings.trusted-users_ NixOS option. Examples values for that
+	option are described in the “Remote builds” chapter in the Nix manual,
+	(i.e. ‘--builders "ssh://bigbrother x86_64-linux"‘). By specifying an
+	empty string existing builders specified in /etc/nix/machines can be
+	ignored: ‘--builders ""‘ for example when they are not reachable due to
+	network connectivity.
+
+*--profile-name* _name_, *-p* _name_
+	Instead of using the Nix profile _/nix/var/nix/profiles/system_ to keep
+	track of the current and previous system configurations, use
+	_/nix/var/nix/profiles/system-profiles/name_. When you use GRUB 2, for
+	every system profile created with this flag, NixOS will create a submenu
+	named “NixOS - Profile _name_“ in GRUB's boot menu, containing the
+	current and previous configurations of this profile.
+
+	For instance, if you want to test a configuration file named _test.nix_
+	without affecting the default system profile, you would do:
+
+		$ nixos-rebuild switch -p test -I nixos-config=./test.nix
+
+	The new configuration will appear in the GRUB 2 submenu “NixOS - Profile
+	‘test’“.
+
+*--specialisation* _name_, *-c* _name_
+	Activates given specialisation; when not specified, switching and testing
+	will activate the base, unspecialised system.
+
+*--build-host* _host_
+	Instead of building the new configuration locally, use the specified host
+	to perform the build. The host needs to be accessible with ssh, and must
+	be able to perform Nix builds. If the option *--target-host* is not set,
+	the build will be copied back to the local machine when done.
+
+	You can include a remote user name in the host name (_user@host_). You
+	can also set ssh options by defining the NIX_SSHOPTS environment
+	variable.
+
+*--target-host* _host_
+	Specifies the NixOS target host. By setting this to something other than
+	an empty string, the system activation will happen on the remote host
+	instead of the local machine. The remote host needs to be accessible
+	over *ssh*, and for the commands *switch*, *boot* and *test* you need
+	root access.
+
+	If *--build-host* is not explicitly specified or empty, building will
+	take place locally.
+
+	You can include a remote user name in the host name (_user@host_). You
+	can also set ssh options by defining the NIX_SSHOPTS environment
+	variable.
+
+	Note that *nixos-rebuild* honors the _nixpkgs.crossSystem_ setting of
+	the given configuration but disregards the true architecture of the
+	target host. Hence the _nixpkgs.crossSystem_ setting has to match the
+	target platform or else activation will fail.
+
+*--use-substitutes*
+	When set, nixos-rebuild will add *--use-substitutes* to each invocation
+	of _nix-copy-closure_/_nix copy_. This will only affect the behavior of
+	nixos-rebuild if *--target-host* or *--build-host* is also set. This is
+	useful when the target-host connection to cache.nixos.org is faster than
+	the connection between hosts.
+
+*--sudo*
+	When set, *nixos-rebuild* prefixes activation commands with sudo.
+	Setting this option allows deploying as a non-root user.
+
+*--ask-sudo-password*
+	When set, *nixos-rebuild* will ask for sudo password for remote
+	activation (i.e.: on *--target-host*) at the start of the build process.
+
+*--file* _path_, *-f* _path_
+	Enable and build the NixOS system from the specified file. The file must
+	evaluate to an attribute set, and it must contain a valid NixOS
+	configuration at attribute _attrPath_. This is useful for building a
+	NixOS system from a nix file that is not a flake or a NixOS
+	configuration module. Attribute set a with valid NixOS configuration can
+	be made using _nixos_ function in nixpkgs or importing and calling
+	nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr*
+	option, builds the configuration from the top-level attribute of the
+	file.
+
+*--attr* _attrPath_, *-A* _attrPath_
+	Enable and build the NixOS system from nix file and use the specified
+	attribute path from file specified by the *--file* option. If specified
+	without *--file* option, uses _default.nix_ in current directory.
+
+*--flake* _flake-uri[#name]_
+	Build the NixOS system from the specified flake. It defaults to the
+	directory containing the target of the symlink _/etc/nixos/flake.nix_,
+	if it exists. The flake must contain an output named
+	‘nixosConfigurations.name’. If name is omitted, it default to the
+	current host name.
+
+*--no-flake*
+	Do not imply *--flake* if _/etc/nixos/flake.nix exists_. With this
+	option, it is possible to build non-flake NixOS configurations even if
+	the current NixOS systems uses flakes.
+
+In addition, *nixos-rebuild* accepts following options from nix commands that
+the tool calls:
+
+Flake-related options:
+
+*--accept-flake-config*, *--refresh*, *--impure*, *--offline*, *--no-net*
+*--recreate-lock-file*, *--no-update-lock-file*, *--no-write-lock-file*,
+*--no-registries*, *--commit-lock-file*, *--update-input* _input-path_,
+*--override-input* _input-path_ _flake-url_
+
+Builder options:
+
+*--verbose,*  *-v*,  *--quiet*,  *--log-format*,  *--no-build-output*, *-Q*,
+*--max-jobs*, *-j*, *--cores*, *--keep-going*, *-k*, *--keep-failed*, *-K*,
+*--fallback*, *--incllude*, *-I*, *--option*, *--repair*, *--builders*,
+*--print-build-logs*, *-L*, *--show-trace*
+
+See the Nix manual, *nix flake lock --help* or *nix-build --help* for details.
+
+# ENVIRONMENT
+
+NIXOS_CONFIG
+	Path to the main NixOS configuration module. Defaults to
+	_/etc/nixos/configuration.nix_.
+
+NIX_PATH
+	A colon-separated list of directories used to look up Nix expressions
+	enclosed in angle brackets (e.g. <nixpkgs>). Example:
+
+		nixpkgs=./my-nixpkgs
+
+NIX_SSHOPTS
+	Additional options to be passed to ssh on the command line.
+
+# FILES
+
+/etc/nixos/flake.nix
+	If this file exists, then *nixos-rebuild* will use it as if the
+	*--flake* option was given. This file may be a symlink to a
+	flake.nix in an actual flake; thus _/etc/nixos_ need not be a
+	flake.
+
+/run/current-system
+	A symlink to the currently active system configuration in the
+	Nix store.
+
+/nix/var/nix/profiles/system
+	The Nix profile that contains the current and previous system
+	configurations. Used to generate the GRUB boot menu.
+
+# AUTHORS
+
+Nixpkgs/NixOS contributors
+
+; vim: set noet
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
index 4ef9d29807f5..e64d4208c73e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
@@ -3,12 +3,16 @@
   installShellFiles,
   mkShell,
   nix,
-  nixos-rebuild,
   python3,
   python3Packages,
   runCommand,
+  scdoc,
   withNgSuffix ? true,
+  withShellFiles ? true,
 }:
+let
+  executable = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild";
+in
 python3Packages.buildPythonApplication rec {
   pname = "nixos-rebuild-ng";
   version = "0.0.0";
@@ -23,8 +27,10 @@ python3Packages.buildPythonApplication rec {
     tabulate
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals withShellFiles [
     installShellFiles
+    python3Packages.shtab
+    scdoc
   ];
 
   propagatedBuildInputs = [
@@ -39,16 +45,23 @@ python3Packages.buildPythonApplication rec {
     nix
   ];
 
-  postInstall =
-    ''
-      installManPage ${nixos-rebuild}/share/man/man8/nixos-rebuild.8
+  postPatch = ''
+    substituteInPlace nixos_rebuild/__init__.py \
+      --subst-var-by executable ${executable} \
+      --subst-var-by withShellFiles ${lib.boolToString withShellFiles}
 
-      installShellCompletion \
-        --bash ${nixos-rebuild}/share/bash-completion/completions/_nixos-rebuild
-    ''
-    + lib.optionalString withNgSuffix ''
-      mv $out/bin/nixos-rebuild $out/bin/nixos-rebuild-ng
-    '';
+    substituteInPlace pyproject.toml \
+      --replace-fail nixos-rebuild ${executable}
+  '';
+
+  postInstall = lib.optionalString withShellFiles ''
+    scdoc < ${./nixos-rebuild.8.scd} > ${executable}.8
+    installManPage ${executable}.8
+
+    installShellCompletion --cmd ${executable} \
+      --bash <(shtab --shell bash nixos_rebuild.get_main_parser) \
+      --zsh <(shtab --shell zsh nixos_rebuild.get_main_parser)
+  '';
 
   nativeCheckInputs = with python3Packages; [
     pytestCheckHook
@@ -98,6 +111,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nixos-rebuild-ng";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.thiagokokada ];
-    mainProgram = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild";
+    mainProgram = executable;
   };
 }
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index c7dbf8acb350..bdec4797e5c3 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -30,6 +30,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     common_flags.add_argument("--option", nargs=2)
 
     common_build_flags = argparse.ArgumentParser(add_help=False)
+    common_build_flags.add_argument("--builders")
     common_build_flags.add_argument("--include", "-I")
     common_build_flags.add_argument("--quiet", action="store_true")
     common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
@@ -72,32 +73,103 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
         add_help=False,
         allow_abbrev=False,
     )
-    main_parser.add_argument("--help", "-h", action="store_true")
-    main_parser.add_argument("--file", "-f")
-    main_parser.add_argument("--attr", "-A")
-    main_parser.add_argument("--flake", nargs="?", const=True)
-    main_parser.add_argument("--no-flake", dest="flake", action="store_false")
-    main_parser.add_argument("--install-bootloader", action="store_true")
-    main_parser.add_argument("--install-grub", action="store_true")  # deprecated
-    main_parser.add_argument("--profile-name", "-p", default="system")
-    main_parser.add_argument("--specialisation", "-c")
-    main_parser.add_argument("--rollback", action="store_true")
-    main_parser.add_argument("--upgrade", action="store_true")
-    main_parser.add_argument("--upgrade-all", action="store_true")
-    main_parser.add_argument("--json", action="store_true")
-    main_parser.add_argument("--sudo", action="store_true")
-    main_parser.add_argument("--ask-sudo-password", action="store_true")
-    main_parser.add_argument("--use-remote-sudo", action="store_true")  # deprecated
-    main_parser.add_argument("--no-ssh-tty", action="store_true")  # deprecated
-    main_parser.add_argument("--fast", action="store_true")
-    main_parser.add_argument("--build-host")
-    main_parser.add_argument("--target-host")
-    main_parser.add_argument("--no-build-nix", action="store_true")  # deprecated
+    main_parser.add_argument("--help", "-h", action="store_true", help="Show manpage")
+    main_parser.add_argument(
+        "--file", "-f", help="Enable and build the NixOS system from the specified file"
+    )
+    main_parser.add_argument(
+        "--attr",
+        "-A",
+        help="Enable and build the NixOS system from nix file and use the "
+        + "specified attribute path from file specified by the --file option",
+    )
+    main_parser.add_argument(
+        "--flake",
+        nargs="?",
+        const=True,
+        help="Build the NixOS system from the specified flake",
+    )
+    main_parser.add_argument(
+        "--no-flake",
+        dest="flake",
+        action="store_false",
+        help="Do not imply --flake if /etc/nixos/flake.nix exists",
+    )
+    main_parser.add_argument(
+        "--install-bootloader",
+        action="store_true",
+        help="Causes the boot loader to be (re)installed on the device specified "
+        + "by the relevant configuration options",
+    )
+    main_parser.add_argument(
+        "--install-grub",
+        action="store_true",
+        help="Deprecated, use '--install-bootloader' instead",
+    )
+    main_parser.add_argument(
+        "--profile-name",
+        "-p",
+        default="system",
+        help="Use nix profile /nix/var/nix/profiles/system-profiles/<profile-name>",
+    )
+    main_parser.add_argument(
+        "--specialisation", "-c", help="Activates given specialisation"
+    )
+    main_parser.add_argument(
+        "--rollback",
+        action="store_true",
+        help="Roll back to the previous configuration",
+    )
+    main_parser.add_argument(
+        "--upgrade",
+        action="store_true",
+        help="Update the root user's channel named 'nixos' before rebuilding "
+        + "the system and channels which have a file named '.update-on-nixos-rebuild'",
+    )
+    main_parser.add_argument(
+        "--upgrade-all",
+        action="store_true",
+        help="Same as --upgrade, but updates all root user's channels",
+    )
+    main_parser.add_argument(
+        "--json",
+        action="store_true",
+        help="JSON output, only implemented for 'list-generations' right now",
+    )
+    main_parser.add_argument(
+        "--ask-sudo-password",
+        action="store_true",
+        help="Asks for sudo password for remote activation, implies --sudo",
+    )
+    main_parser.add_argument(
+        "--sudo", action="store_true", help="Prefixes activation commands with sudo"
+    )
+    main_parser.add_argument(
+        "--use-remote-sudo",
+        action="store_true",
+        help="Deprecated, use '--sudo' instead",
+    )
+    main_parser.add_argument("--no-ssh-tty", action="store_true", help="Deprecated")
+    main_parser.add_argument(
+        "--fast",
+        action="store_true",
+        help="Skip possibly expensive operations",
+    )
+    main_parser.add_argument("--build-host", help="Specifies host to perform the build")
+    main_parser.add_argument(
+        "--target-host", help="Specifies host to activate the configuration"
+    )
+    main_parser.add_argument("--no-build-nix", action="store_true", help="Deprecated")
     main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
     return main_parser, sub_parsers
 
 
+# For shtab to generate completions
+def get_main_parser() -> argparse.ArgumentParser:
+    return get_parser()[0]
+
+
 def parse_args(
     argv: list[str],
 ) -> tuple[argparse.Namespace, dict[str, argparse.Namespace]]:
@@ -108,6 +180,14 @@ def parse_args(
         for group, parser in sub_parsers.items()
     }
 
+    if args.help or args.action is None:
+        if "@withShellFiles@" == "true":
+            r = run(["man", "8", "@executable@"], check=False)
+            parser.exit(r.returncode)
+        else:
+            parser.print_help()
+            parser.exit()
+
     def parser_warn(msg: str) -> None:
         print(f"{parser.prog}: warning: {msg}", file=sys.stderr)
 
@@ -122,10 +202,6 @@ def parse_args(
     if args.ask_sudo_password:
         args.sudo = True
 
-    if args.help or args.action is None:
-        r = run(["man", "8", "nixos-rebuild"], check=False)
-        parser.exit(r.returncode)
-
     # TODO: use deprecated=True in Python >=3.13
     if args.install_grub:
         parser_warn("--install-grub deprecated, use --install-bootloader instead")
@@ -192,7 +268,7 @@ def reexec(
         logger.warning("could not find a newer version of nixos-rebuild")
 
     if drv:
-        new = drv / "bin/nixos-rebuild-ng"
+        new = drv / "bin/@executable@"
         current = Path(argv[0])
         # Disable re-exec during development
         if current.name != "__main__.py" and new != current:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 7c9338b3ef92..e2e1cea2327d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -77,7 +77,6 @@ def remote_build(
     r = run_wrapper(
         [
             "nix-instantiate",
-            "--raw",
             build_attr.path,
             "--attr",
             build_attr.to_attr(attr),
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 07d01c6f121b..10666b47d657 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -144,7 +144,7 @@ def run_wrapper(
 
         return r
     except subprocess.CalledProcessError:
-        if sudo and remote:
+        if sudo and remote and remote.sudo_password is None:
             logger.error(
                 "while running command with remote sudo, did you forget to use "
                 + "--ask-sudo-password?"
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
index d773e8888923..9d3f92f5471e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
@@ -3,14 +3,14 @@ requires = ["setuptools"]
 build-backend = "setuptools.build_meta"
 
 [project]
-name = "nixos-rebuild-ng"
+name = "nixos-rebuild"
 version = "0.0.0"
 
 [project.scripts]
 nixos-rebuild = "nixos_rebuild:main"
 
 [tool.setuptools.package-data]
-nixos_rebuild = ["*.template.nix"]
+nixos_rebuild = ["*.nix.template"]
 
 [tool.mypy]
 # `--strict` config, but explicit options to avoid breaking build when mypy is
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 6a34f98bd066..928c0e8616a8 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -94,7 +94,6 @@ def test_remote_build(mock_run: Any, monkeypatch: Any) -> None:
             call(
                 [
                     "nix-instantiate",
-                    "--raw",
                     "<nixpkgs/nixos>",
                     "--attr",
                     "preAttr.config.system.build.toplevel",
diff --git a/pkgs/by-name/op/openjph/package.nix b/pkgs/by-name/op/openjph/package.nix
index 8e8538e1cc4f..d499c898541b 100644
--- a/pkgs/by-name/op/openjph/package.nix
+++ b/pkgs/by-name/op/openjph/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openjph";
-  version = "0.17.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "aous72";
     repo = "openjph";
     rev = finalAttrs.version;
-    hash = "sha256-ljvdCrvKL3slVGqX97Ui65/6Doyucf2kdUEw6NWW9og=";
+    hash = "sha256-cgJlgb4SrmVFqvmqGcG3+qMDteyVFlYzoy1IOo8BjA8=";
   };
 
   nativeBuildInputs = [ cmake validatePkgConfig ];
diff --git a/pkgs/by-name/op/openvpn3/0001-build-reduce-hardcode-in-asio_path.patch b/pkgs/by-name/op/openvpn3/0001-build-reduce-hardcode-in-asio_path.patch
deleted file mode 100644
index bd289b0965ae..000000000000
--- a/pkgs/by-name/op/openvpn3/0001-build-reduce-hardcode-in-asio_path.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 30b2528054e6627a7124ac04cb018356ef23d864 Mon Sep 17 00:00:00 2001
-From: Petr Portnov <mrjarviscraft@gmail.com>
-Date: Mon, 2 Sep 2024 22:25:33 +0300
-Subject: [PATCH 1/1] build: reduce hardcode in `asio_path`
-
-Currently, `asio_path` variable value is concatenated with `/asio/include`
-to specify the path to custom `asio` installation.
-The problem is that this is too strict as some distros (namely NixOS)
-may have the `include` directory with a differently named parent.
-Thus this change minimizes the hardcoded part of the path to make it more flexible.
-
-Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
----
- meson.build       | 2 +-
- meson_options.txt | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index c9e0a2d..c01eb8e 100644
---- a/meson.build
-+++ b/meson.build
-@@ -74,7 +74,7 @@ endif
- #
- #  Setup additional include header dirs
- #
--asio_inc = get_option('asio_path') / 'asio' / 'include'
-+asio_inc = get_option('asio_path') / 'include'
- message ('ASIO library: ' + asio_inc)
- 
- openvpn3_core_inc = get_option('openvpn3_core_path')
-diff --git a/meson_options.txt b/meson_options.txt
-index d9cf02e..43e301e 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -26,7 +26,7 @@ option('debug_options', type: 'boolean', value: false,
- #
- #  Build environment and related build time options
- #
--option('asio_path', type: 'string', value: './vendor/asio',
-+option('asio_path', type: 'string', value: './vendor/asio/asio',
-        description: 'Path to the ASIO header files')
- 
- option('openvpn3_core_path', type: 'string', value: './openvpn3-core',
--- 
-2.43.0
-
diff --git a/pkgs/by-name/op/openvpn3/0002-build-allow-installation-directories-customization.patch b/pkgs/by-name/op/openvpn3/0002-build-allow-installation-directories-customization.patch
deleted file mode 100644
index 535f522fa64b..000000000000
--- a/pkgs/by-name/op/openvpn3/0002-build-allow-installation-directories-customization.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 848cc46d05c203de393d75434a3f571d78687f50 Mon Sep 17 00:00:00 2001
-From: Petr Portnov <mrjarviscraft@gmail.com>
-Date: Sun, 22 Sep 2024 13:16:02 +0300
-Subject: [PATCH] build: allow installation directories' customization
-
-This allows to configure the installation directories
-for systemd and D-Bus files.
-
-Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
----
- distro/systemd/meson.build |  9 +++++++--
- meson.build                | 12 ++++++++++--
- meson_options.txt          | 12 ++++++++++++
- src/configmgr/meson.build  | 10 ++++++----
- 4 files changed, 35 insertions(+), 8 deletions(-)
-
-diff --git a/distro/systemd/meson.build b/distro/systemd/meson.build
-index 36d556c..9c636b6 100644
---- a/distro/systemd/meson.build
-+++ b/distro/systemd/meson.build
-@@ -15,12 +15,17 @@ systemd_cfg = configuration_data({
- 
- systemd_service_cfg = dependency('systemd')
- 
-+systemd_system_unit_dir = get_option('systemd_system_unit_dir')
-+if systemd_system_unit_dir == ''
-+  systemd_system_unit_dir = systemd_service_cfg.get_variable('systemdsystemunitdir')
-+endif
-+
- configure_file(
-     input: 'openvpn3-autoload.service.in',
-     output: 'openvpn3-autoload.service',
-     configuration: systemd_cfg,
-     install: true,
--    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
-+    install_dir: systemd_system_unit_dir,
- )
- 
- configure_file(
-@@ -28,7 +33,7 @@ configure_file(
-     output: 'openvpn3-session@.service',
-     configuration: systemd_cfg,
-     install: true,
--    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
-+    install_dir: systemd_system_unit_dir,
- )
- 
- custom_target('openvpn3-systemd',
-diff --git a/meson.build b/meson.build
-index 586c72a..ba41440 100644
---- a/meson.build
-+++ b/meson.build
-@@ -203,8 +203,16 @@ message('OpenVPN 3 Linux service binary directory: ' + get_option('prefix') / li
- 
- #
- #  D-Bus configuration
--dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
--dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
-+dbus_policy_dir = get_option('dbus_policy_dir')
-+if dbus_policy_dir == ''
-+    dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
-+endif
-+
-+dbus_service_dir = get_option('dbus_system_service_dir')
-+if dbus_service_dir == ''
-+    dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
-+endif
-+
- dbus_config = {
-     'OPENVPN_USERNAME': get_option('openvpn_username'),
-     'LIBEXEC_PATH': get_option('prefix') / libexec_dir,
-diff --git a/meson_options.txt b/meson_options.txt
-index 43e301e..04809df 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -93,6 +93,18 @@ option('use-legacy-polkit-pkla', type: 'feature', value: 'disabled',
- option('polkit_pkla_rulesdir', type: 'string', value: '',
-        description: 'Override PolicyKit PKLA rules directory')
- 
-+#
-+# Installation
-+#
-+option('dbus_policy_dir', type: 'string',
-+       description: 'D-Bus policy directory')
-+option('dbus_system_service_dir', type: 'string',
-+       description: 'D-Bus system service directory')
-+option('systemd_system_unit_dir', type: 'string',
-+       description: 'Path to systemd system unit directory')
-+option('create_statedir', type: 'feature', value: 'enabled',
-+       description: 'Create directory for OpenVPN 3 state during install phase')
-+
- #
- #  Testing tools
- #
-diff --git a/src/configmgr/meson.build b/src/configmgr/meson.build
-index 5d0a649..6f788b7 100644
---- a/src/configmgr/meson.build
-+++ b/src/configmgr/meson.build
-@@ -52,7 +52,9 @@ configure_file(
-     install_dir: dbus_service_dir,
- )
- 
--# Create the configs directory for persistent configuration profiles
--# NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
--#       is available on all supported distros
--meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
-+if get_option('create_statedir').enabled()
-+    # Create the configs directory for persistent configuration profiles
-+    # NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
-+    #       is available on all supported distros
-+    meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
-+endif
--- 
-2.45.2
-
diff --git a/pkgs/by-name/op/openvpn3/package.nix b/pkgs/by-name/op/openvpn3/package.nix
index b1c18f5fe011..f5b959d15479 100644
--- a/pkgs/by-name/op/openvpn3/package.nix
+++ b/pkgs/by-name/op/openvpn3/package.nix
@@ -28,25 +28,18 @@
 stdenv.mkDerivation rec {
   pname = "openvpn3";
   # also update openvpn3-core
-  version = "23";
+  version = "24";
 
   src = fetchFromGitHub {
     owner = "OpenVPN";
     repo = "openvpn3-linux";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5gkutqyUPZDwRPzSFdUXg2G5mtQKbdhZu8xnNAdXoF0=";
+    hash = "sha256-e3NRLrznTEolTzMO+kGEh48MCrcEr8p7JG3hG889aK4=";
     # `openvpn3-core` is a submodule.
     # TODO: make it into a separate package
     fetchSubmodules = true;
   };
 
-  patches = [
-    # Merged in upstream, will land in v24
-    # https://github.com/OpenVPN/openvpn3-linux/commit/75abb7dc9366ba85fb1a144d88f02a1e8a62f538
-    ./0001-build-reduce-hardcode-in-asio_path.patch
-    ./0002-build-allow-installation-directories-customization.patch
-  ];
-
   postPatch = ''
     echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
     #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"
@@ -106,7 +99,7 @@ stdenv.mkDerivation rec {
     (lib.mesonOption "dbus_policy_dir" "${placeholder "out"}/share/dbus-1/system.d")
     (lib.mesonOption "dbus_system_service_dir" "${placeholder "out"}/share/dbus-1/system-services")
     (lib.mesonOption "systemd_system_unit_dir" "${placeholder "out"}/lib/systemd/system")
-    (lib.mesonOption "create_statedir" "disabled")
+    (lib.mesonOption "create_statedir" "false")
     (lib.mesonOption "sharedstatedir" "/etc")
   ];
 
diff --git a/pkgs/by-name/pr/prometheus-cpp/package.nix b/pkgs/by-name/pr/prometheus-cpp/package.nix
index dda515932f2c..2a0f4a88c5ea 100644
--- a/pkgs/by-name/pr/prometheus-cpp/package.nix
+++ b/pkgs/by-name/pr/prometheus-cpp/package.nix
@@ -1,46 +1,54 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, gbenchmark
-, gtest
-, civetweb
-, zlib
-, curl
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  civetweb,
+  curl,
+  gbenchmark,
+  gtest,
+  zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "prometheus-cpp";
-  version = "1.1.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jupp0r";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-qx6oBxd0YrUyFq+7ArnKBqOwrl5X8RS9nErhRDUJ7+8=";
+    repo = "prometheus-cpp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XQ8N+affKVqn/hrMHWg0eN+0Op6m9ZdVNNAW0GpDAng=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ gbenchmark gtest zlib curl ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    curl
+    gbenchmark
+    gtest
+    zlib
+  ];
   propagatedBuildInputs = [ civetweb ];
   strictDeps = true;
 
   cmakeFlags = [
-    "-DUSE_THIRDPARTY_LIBRARIES=OFF"
     "-DBUILD_SHARED_LIBS=ON"
+    "-DOVERRIDE_CXX_STANDARD_FLAGS=OFF"
+    "-DUSE_THIRDPARTY_LIBRARIES=OFF"
   ];
 
-  outputs = [ "out" "dev" ];
-
-  postInstall = ''
-    mkdir -p $dev/lib/pkgconfig
-    substituteAll ${./prometheus-cpp.pc.in} $dev/lib/pkgconfig/prometheus-cpp.pc
-  '';
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   meta = {
     description = "Prometheus Client Library for Modern C++";
     homepage = "https://github.com/jupp0r/prometheus-cpp";
     license = [ lib.licenses.mit ];
   };
-
-}
+})
diff --git a/pkgs/by-name/pr/prometheus-cpp/prometheus-cpp.pc.in b/pkgs/by-name/pr/prometheus-cpp/prometheus-cpp.pc.in
deleted file mode 100644
index c373f4153b55..000000000000
--- a/pkgs/by-name/pr/prometheus-cpp/prometheus-cpp.pc.in
+++ /dev/null
@@ -1,10 +0,0 @@
-prefix=@out@
-includedir=${prefix}/include
-libdir=${prefix}/lib
-
-Name: prometheus-cpp
-Description: Prometheus Client Library for Modern C++
-URL: https://github.com/jupp0r/prometheus-cpp
-Version: @version@
-Cflags: -isystem${includedir}
-Libs: -Wl,-rpath,${libdir} -L${libdir} -lprometheus-cpp-core -lprometheus-cpp-pull -lprometheus-cpp-push
diff --git a/pkgs/by-name/qu/quark-engine/package.nix b/pkgs/by-name/qu/quark-engine/package.nix
index ec6eda3d8111..a5651b71c1cd 100644
--- a/pkgs/by-name/qu/quark-engine/package.nix
+++ b/pkgs/by-name/qu/quark-engine/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
-  version = "24.11.1";
+  version = "24.12.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quark-engine";
     repo = "quark-engine";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-Nv4k/AN906ue13tlif+JsHLSWxdoI4maJ3EUGOZkDNI=";
+    tag = "v${version}";
+    hash = "sha256-aOhqUuTT13xhcXXnY/P8NnF1PAqFn/2+wMizSA1Jb6o=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index db5c231b45de..54dfcbdd46e6 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -1,17 +1,22 @@
-{ lib, fetchzip, buildGo123Module, nixosTests }:
+{
+  lib,
+  fetchzip,
+  buildGo123Module,
+  nixosTests,
+}:
 
 buildGo123Module rec {
   pname = "traefik";
-  version = "3.1.4";
+  version = "3.2.1";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-e77PCMeN6Ck6hQ3Rx7MU4EL+f/1kpA2E+gVcISoUnf4=";
+    hash = "sha256-MOYSq7LjAPnyjYALzeMdunTQtQykOOP1ILvpYOgFsYA=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-iYwA/y9AuHomyEckOyl4845lkQkeBAFDsGiZWESylqs=";
+  vendorHash = "sha256-NQB8vPcnLKvZhf/n/y+L/fFhhOB1EdViCI8j1XUdHtw=";
 
   subPackages = [ "cmd/traefik" ];
 
@@ -28,7 +33,9 @@ buildGo123Module rec {
 
   doCheck = false;
 
-  passthru.tests = { inherit (nixosTests) traefik; };
+  passthru.tests = {
+    inherit (nixosTests) traefik;
+  };
 
   meta = with lib; {
     homepage = "https://traefik.io";
diff --git a/pkgs/by-name/ty/typos/package.nix b/pkgs/by-name/ty/typos/package.nix
index 484c4e62b862..537a5459d6d5 100644
--- a/pkgs/by-name/ty/typos/package.nix
+++ b/pkgs/by-name/ty/typos/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.28.1";
+  version = "1.28.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-a3EInGYsVt5vmAovT+FSWtNIRY/5ckWvDOZi1EV0ZsU=";
+    hash = "sha256-6qu5Xe0lDT8u21VxU9lqs2BTre7BRa7+qNf8oukzTmc=";
   };
 
-  cargoHash = "sha256-8Y7DZCQakP6gsXXA294gz8SlZROoKATJfxLY8ITlIf8=";
+  cargoHash = "sha256-lC0K56eslfePdZfP75Lz6XRh3LORsAPShC15ZFj/UG4=";
 
   passthru = {
     tests.version = testers.testVersion { package = typos; };
diff --git a/pkgs/by-name/ur/url-parser/package.nix b/pkgs/by-name/ur/url-parser/package.nix
index 1a84e92d322f..c3b8a37b1103 100644
--- a/pkgs/by-name/ur/url-parser/package.nix
+++ b/pkgs/by-name/ur/url-parser/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "url-parser";
-  version = "2.0.5";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tMbB0u0BxoWGLPOsebwxd0QQcAlpSuhfCRdBEGpLpRU=";
+    hash = "sha256-XXTa/FtvxXU34avQA+ykJjBRndMaOYTJDlJLbqzFqvM=";
   };
 
-  vendorHash = "sha256-gLhVbd0rca+khY8i776EN/PoySNq/oYYNFbioMjgxPc=";
+  vendorHash = "sha256-kXVNJgaA2Oon0+fTxk4WtN3P4PlaQszbaXEvSyS2lWU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vu/vuls/package.nix b/pkgs/by-name/vu/vuls/package.nix
index 25cc8b5b5494..626f83b38ee7 100644
--- a/pkgs/by-name/vu/vuls/package.nix
+++ b/pkgs/by-name/vu/vuls/package.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "vuls";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "future-architect";
     repo = "vuls";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+KEcK9GLx1QErRQlSVGeFnvYoWY3lVFr7S4Zb34Djzo=";
+    hash = "sha256-J7kH9XUk+DQmoo5pQd9I0NuGPmR3pYrZ0WG0hKaPFvk=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-XTKPsXCOzrji3qq+L4NR8FLBnXcafLj8w3K+UwowLQU=";
+  vendorHash = "sha256-vrIbD6HB7JikBQZk0rmt5EQxS2JYjQkzFaLYBPvdx+Q=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 8c260b3dd7b2..c558bdef7a30 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -11,20 +11,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = "yazi";
     rev = "v${version}";
-    hash = "sha256-bTDf8muJN0G4+c6UagtWgNLlmGN15twEBjdmKEP0bCE=";
+    hash = "sha256-GA7wn2C35jwAaE1l/fw2fnQO/KH+dHQ3kuA6dV6/mCk=";
   };
 
-  cargoHash = "sha256-8UsdanF8y4uFoXdC7aAw7pVFRd9GACcfVvqkUtFmN5k=";
+  cargoHash = "sha256-fUnYnBvOZONqLYS3r7hlr0dHX/+EXURCkIJ6w5GwhS0=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2024-09-04";
+  env.VERGEN_BUILD_DATE = "2024-12-08";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
diff --git a/pkgs/by-name/ya/yazi/package.nix b/pkgs/by-name/ya/yazi/package.nix
index 4378f814eea5..fbf4e408a6fe 100644
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@@ -9,7 +9,7 @@
     jq
     poppler_utils
     _7zz
-    ffmpegthumbnailer
+    ffmpeg
     fd
     ripgrep
     fzf
@@ -26,7 +26,7 @@
   jq,
   poppler_utils,
   _7zz,
-  ffmpegthumbnailer,
+  ffmpeg,
   fd,
   ripgrep,
   fzf,
diff --git a/pkgs/by-name/yq/yq-go/package.nix b/pkgs/by-name/yq/yq-go/package.nix
index c225756b09e2..abaf4cde3cf9 100644
--- a/pkgs/by-name/yq/yq-go/package.nix
+++ b/pkgs/by-name/yq/yq-go/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.44.5";
+  version = "4.44.6";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-UvijtuUkwliJTzKdWQ1mPTs5Hy60FQHOMiQicJ0O+ds=";
+    hash = "sha256-C9ql10PnEeGF8mnyLR25ibwLyE4SlqnpDNcPei9FnBw=";
   };
 
-  vendorHash = "sha256-SljvJ5R/9j4QozbljEJORaZqihhCGJVpzBYnptFQ1nA=";
+  vendorHash = "sha256-B6ivzm7J0wYdYruGZ2N6SyvghsRRJlVlk84CuaF5PVA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index a52d5b7557e6..fea7ad92cb34 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -6,13 +6,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "ytdl-sub";
-  version = "2024.11.6";
+  version = "2024.12.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "ytdl_sub";
-    hash = "sha256-YMki+1rC726RtbZceoVbcpk/Gi3F81xxERQjpqLjn+A=";
+    hash = "sha256-8Qd5JQy9tuQoB0W7uBQiWQsRkUmM78UA+1laVaQ6zwU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index b171005ca281..7babe42c9458 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "janet";
-  version = "1.36.0";
+  version = "1.37.1";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = "janet";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lAasSRQwqkc86jobSejLFGAiaCu+EM+2sc92Kc2KxMs=";
+    hash = "sha256-KwuBJY3SG5Ao/sFgjrp0pzEasdI7AAWrG49uHjVA1Rs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index b1e565266f86..4de3f7887bc8 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -114,13 +114,13 @@ stdenv.mkDerivation rec {
   # NOTE: You must also bump:
   # <nixpkgs/pkgs/development/python-modules/libvirt/default.nix>
   # SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
-  version = "10.9.0";
+  version = "10.10.0";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-LYQYA5UIKYs+8rSNZDymmrxuTWsgmukP5Y17lGB5UQs=";
+    hash = "sha256-czo5G+zL4NFkYehTfymgSwk3bGWcrnike2MYPzeQOPg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 74401482119c..1af98b0c3dc4 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.8.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    hash = "sha256-qBDpNyBxcW/OPnrbmL+NmKWIF69p1OoZFqlP6mwPi9U=";
+    hash = "sha256-D9u54+CZYKcYZFedwgmI515s2MruZsVoJ3AZi494ohM=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/bidsschematools/default.nix b/pkgs/development/python-modules/bidsschematools/default.nix
index 40567f42658f..d9e75b998db7 100644
--- a/pkgs/development/python-modules/bidsschematools/default.nix
+++ b/pkgs/development/python-modules/bidsschematools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "bidsschematools";
-  version = "0.11.3.post3";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "bidsschematools";
     inherit version;
-    hash = "sha256-GGMNAEW/gyBaduVuzPN5+9hmHYp+XQJwG8KQBeVkKfc=";
+    hash = "sha256-XqtCKtg3oqLCz5KihW9yk96fJ1uDcgag6qKCU9Bdqe4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
index fc625999c54e..cc3574d7e3d1 100644
--- a/pkgs/development/python-modules/craft-application/default.nix
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "craft-application";
-  version = "4.4.0";
+  version = "4.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-application";
     rev = "refs/tags/${version}";
-    hash = "sha256-Sb7/p5g03stipnvfE5FceXv6xDA4c45qnxllBUWhmY8=";
+    hash = "sha256-uhIJmoh6++hJinSGjwLwSAgVGQp3CENkE1CSL5t1mvI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index b6541db48f17..9a8fb1232c27 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "cvelib";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "RedHatProductSecurity";
     repo = "cvelib";
-    rev = "refs/tags/${version}";
-    hash = "sha256-voUBd4JQLk1Ik7JrhFYnY06AucVTj7WwAjDfjOTSENo=";
+    tag = version;
+    hash = "sha256-AhA+2lEI/hsbIVCfSWO0vI6eWkObjsq5xYOSqVvUPkU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index d65c75556af4..d7f6d3b67ae9 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.7.23";
+  version = "1.7.25";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "fastcore";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-YsZBPcGWKxE5Cl3HCmB2ZDecFuQa5Q5aTEbZ5ijmB24=";
   };
 
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index 965e5731c535..1937656cba93 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.12.0";
+  version = "0.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "yanyongyu";
     repo = "githubkit";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-GejPudg3tc0r7jKKGgZ6zERzH8wT3utGb05pfW1lQyw=";
+    tag = "v${version}";
+    hash = "sha256-ewPCALnkGDhzxn3P9GO5QUaFZDhqsbQNeCmyTCXd7kE=";
   };
 
   pythonRelaxDeps = [ "hishel" ];
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 1260c41a1690..7dc864d0f2dd 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.50.1";
+  version = "3.51.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,8 +29,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-spanner";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-eRCu+CwzJmhixN7VkLZkvlBEe9PMiSDtAIoyktdgN3M=";
+    tag = "v${version}";
+    hash = "sha256-ug3xtPykH4emiQuK1UxWGUeKmXqkY/EX0mSncCkGCQg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
index d2a4acd7277e..fa0b83e607e5 100644
--- a/pkgs/development/python-modules/libvirt/default.nix
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "10.9.0";
+  version = "10.10.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "libvirt";
     repo = "libvirt-python";
     rev = "v${version}";
-    hash = "sha256-/kjpB19X90btIewW+hjLjLagJvI5X2oIHXpcSZVtu2I=";
+    hash = "sha256-zOjTGXwxjd6QT01AaIln0FdP/8UZS0W3yPltUhlocpk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/py-tes/default.nix b/pkgs/development/python-modules/py-tes/default.nix
index b7d46b97f5b1..ef7f7a47fb9a 100644
--- a/pkgs/development/python-modules/py-tes/default.nix
+++ b/pkgs/development/python-modules/py-tes/default.nix
@@ -9,27 +9,32 @@
   pythonOlder,
   requests,
   requests-mock,
+  setuptools,
+  sphinx-rtd-theme,
 }:
 
 buildPythonPackage rec {
   pname = "py-tes";
-  version = "0.4.2";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ohsu-comp-bio";
-    repo = pname;
-    rev = version;
-    hash = "sha256-HZeyCQHiqfdquWQD5axS73JDjDMUieONwm5VyA+vTFk=";
+    repo = "py-tes";
+    rev = "refs/tags/${version}";
+    hash = "sha256-PP6l9HITC8JDOUVwf+S5tDOZDIFST9Uz+ttG0xJwrB0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     attrs
     future
     python-dateutil
     requests
+    sphinx-rtd-theme
   ];
 
   nativeCheckInputs = [
@@ -39,10 +44,16 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "tes" ];
 
+  disabledTestPaths = [
+    # Tests require running funnel
+    "tests/integration"
+  ];
+
   meta = with lib; {
     description = "Python SDK for the GA4GH Task Execution API";
     homepage = "https://github.com/ohsu-comp-bio/py-tes";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/ohsu-comp-bio/py-tes/releases/tag/${version}";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index 06d177b851b9..e8a1a72cc91e 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.18.2";
+  version = "5.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-JA5xBoqNC6F97Obs+0ig/ALw1rkUVX7A0bStKHS+uv4=";
+    tag = "v${version}";
+    hash = "sha256-Tx3liE/MLInEfNMc7e+YtvXg/hOsfOyJq6FwfmAIwz0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-apt/default.nix b/pkgs/development/python-modules/python-apt/default.nix
index fbb7933595ce..e1cd8b3f5f91 100644
--- a/pkgs/development/python-modules/python-apt/default.nix
+++ b/pkgs/development/python-modules/python-apt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apt";
-  version = "2.8.0";
+  version = "2.9.2";
 
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "apt-team";
     repo = "python-apt";
     rev = "refs/tags/${version}";
-    hash = "sha256-7l7rgyJ28iQuL6ShF/KYwL/kAXpLPTqnUIavVxNF+wU=";
+    hash = "sha256-T2Bl3KnIdlHh0bKiE30nal5ekixjShPBkXSMJRAJYHI=";
   };
 
   buildInputs = [ apt.dev ];
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index de3f12e7680b..6406321ad254 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   beautifulsoup4,
   extruct,
+  isodate,
   language-tags,
   regex,
   requests,
@@ -33,6 +34,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     beautifulsoup4
     extruct
+    isodate
     language-tags
     regex
     requests
diff --git a/pkgs/development/python-modules/weblate-language-data/default.nix b/pkgs/development/python-modules/weblate-language-data/default.nix
index a8f24fa0a1fe..5265b6a55d8c 100644
--- a/pkgs/development/python-modules/weblate-language-data/default.nix
+++ b/pkgs/development/python-modules/weblate-language-data/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "weblate-language-data";
-  version = "2024.13";
+  version = "2024.14";
   pyproject = true;
 
   src = fetchPypi {
     pname = "weblate_language_data";
     inherit version;
-    hash = "sha256-fAT3dI3Tbu329BWaal/n4ka0JSVDzPrJLnzL7/LRjhs=";
+    hash = "sha256-Q03gtpdS/CVJusP/A6N3KbfFx/wwHWTlVDraCk6yL/0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/rust/cargo-outdated/default.nix b/pkgs/development/tools/rust/cargo-outdated/default.nix
index 0c575c604cf8..41003605dab9 100644
--- a/pkgs/development/tools/rust/cargo-outdated/default.nix
+++ b/pkgs/development/tools/rust/cargo-outdated/default.nix
@@ -13,19 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-outdated";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-+GPP8Mdoc3LsR2puNu3/pzKg4Umvjd7CxivkHC8YxgM=";
+    hash = "sha256-bAo3098QxepKbvBb9uF6iGNW0+RAKCCMyWfuG5WyREo=";
   };
 
-  cargoHash = "sha256-8sW4d9qb7psoHuftQweChTPt4upKPEXdnjHSZAPpBHE=";
-
-  # Note: bump `time` dependency to be able to build with rust 1.80, should be removed on the next
-  # release (see: https://github.com/NixOS/nixpkgs/issues/332957)
-  # Upstream PR: https://github.com/kbknapp/cargo-outdated/pull/398
-  cargoPatches = [ ./time.patch ];
+  cargoHash = "sha256-YGGmzdcy3x4RF1S8jMPXTAglThlfG7nZTD0IATGvePw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/cargo-outdated/time.patch b/pkgs/development/tools/rust/cargo-outdated/time.patch
deleted file mode 100644
index 6539343123ef..000000000000
--- a/pkgs/development/tools/rust/cargo-outdated/time.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-commit 21e8b5005f62afd9ef804758323f36f3f470e7b0
-Author: Cole Helbling <cole.e.helbling@outlook.com>
-Date:   Fri Aug 16 08:59:30 2024 -0700
-
-    chore: update time dependency to fix builds against newer Rust versions
-
-diff --git a/Cargo.lock b/Cargo.lock
-index 52014c7..a09df20 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1957,6 +1957,12 @@ dependencies = [
-  "winapi",
- ]
- 
-+[[package]]
-+name = "num-conv"
-+version = "0.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-+
- [[package]]
- name = "num-traits"
- version = "0.2.17"
-@@ -2781,13 +2787,14 @@ dependencies = [
- 
- [[package]]
- name = "time"
--version = "0.3.30"
-+version = "0.3.36"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
-+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
- dependencies = [
-  "deranged",
-  "itoa",
-  "libc",
-+ "num-conv",
-  "num_threads",
-  "powerfmt",
-  "serde",
-@@ -2803,10 +2810,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
- 
- [[package]]
- name = "time-macros"
--version = "0.2.15"
-+version = "0.2.18"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
-+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
- dependencies = [
-+ "num-conv",
-  "time-core",
- ]
- 
-
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 449e1cc660e4..1152a7eb8ac3 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -439,7 +439,6 @@ let self = {
     };
 
     inputs = [ curl geoip libmodsecurity libxml2 lmdb yajl ];
-    disableIPC = true;
 
     meta = with lib; {
       description = "Open source, cross platform web application firewall (WAF)";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cbc53530fc3d..21aced67debf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14623,10 +14623,6 @@ with pkgs;
 
   magic-wormhole = with python3Packages; toPythonApplication magic-wormhole;
 
-  magic-wormhole-rs = callPackage ../tools/networking/magic-wormhole-rs {
-    inherit (darwin.apple_sdk.frameworks) Security AppKit;
-  };
-
   magnetophonDSP = lib.recurseIntoAttrs {
     CharacterCompressor = callPackage ../applications/audio/magnetophonDSP/CharacterCompressor { };
     CompBus = callPackage ../applications/audio/magnetophonDSP/CompBus { };