diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 768bbf144342..50384d58d488 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11481,6 +11481,14 @@
     ];
     name = "Ioannis Koutras";
   };
+  jolars = {
+    email = "jolars@posteo.com";
+    matrix = "@jola:mozilla.org";
+    github = "jolars";
+    githubId = 13087841;
+    name = "Johan Larsson";
+    keys = [ { fingerprint = "F0D6 BDE7 C7D1 6B3F 7883  73E7 2A41 C0FE DD6F F540"; } ];
+  };
   jonaenz = {
     name = "Jona Enzinger";
     email = "5xt3zyy5l@mozmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 0ef44a7ded92..c4831db15b3e 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -204,6 +204,9 @@
 
 - `pkgs.nextcloud28` has been removed since it's out of support upstream.
 
+- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
+  Environment variables have to be passed via the `env` attribute.
+
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.
 
   Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.
@@ -275,6 +278,8 @@
   See the [1.3.0 changelog](https://git.sr.ht/~mil/mepo/refs/1.3.0)
   for more details.
 
+- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.
+
 - The `earlyoom` service is now using upstream systemd service, which enables
   hardening and filesystem isolation by default. If you need filesystem write
   access or want to access home directory via `killHook`, hardening setting can
@@ -540,6 +545,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
+
 - hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
 
 - The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.
diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
index e114520c4825..dbace6c4fdaa 100644
--- a/nixos/modules/programs/feedbackd.nix
+++ b/nixos/modules/programs/feedbackd.nix
@@ -25,6 +25,8 @@ in
     services.dbus.packages = [ cfg.package ];
     services.udev.packages = [ cfg.package ];
 
+    # TODO: also enable systemd unit fbd-alert-slider for OnePlus 6/6T devices, see release notes of feedbackd v0.5.0
+
     users.groups.feedbackd = { };
   };
 }
diff --git a/nixos/modules/security/ca.nix b/nixos/modules/security/ca.nix
index 5e85fe902de6..e1e8dae2a918 100644
--- a/nixos/modules/security/ca.nix
+++ b/nixos/modules/security/ca.nix
@@ -5,7 +5,6 @@
   ...
 }:
 let
-
   cfg = config.security.pki;
 
   cacertPackage = pkgs.cacert.override {
@@ -88,22 +87,31 @@ in
       '';
     };
 
+    security.pki.caBundle = lib.mkOption {
+      type = lib.types.path;
+      readOnly = true;
+      description = ''
+        (Read-only) the path to the final bundle of certificate authorities as a single file.
+      '';
+    };
   };
 
-  config = lib.mkIf cfg.installCACerts {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.installCACerts {
 
-    # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
+      # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
+      environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
 
-    # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
+      # Old NixOS compatibility.
+      environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
 
-    # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+      # CentOS/Fedora compatibility.
+      environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
 
-    # P11-Kit trust source.
-    environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
-
-  };
+      # P11-Kit trust source.
+      environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
+    })
+    { security.pki.caBundle = caBundle; }
+  ];
 
 }
diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index 130fd3ecdb9a..6ac4286b2e4c 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -59,7 +59,7 @@ in
         BindReadOnlyPaths = [
           # gonic can access scrobbling services
           "-/etc/resolv.conf"
-          "-/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
         ] ++ cfg.settings.music-path
         ++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert
diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix
index e69bfef48438..41d3da158bca 100644
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@@ -118,9 +118,7 @@ in
             BindReadOnlyPaths =
               [
                 # navidrome uses online services to download additional album metadata / covers
-                "${
-                  config.environment.etc."ssl/certs/ca-certificates.crt".source
-                }:/etc/ssl/certs/ca-certificates.crt"
+                "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
                 builtins.storeDir
                 "/etc"
               ]
diff --git a/nixos/modules/services/continuous-integration/gocd-agent/default.nix b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
index 607ac0e6ce9b..dd5014542507 100644
--- a/nixos/modules/services/continuous-integration/gocd-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
@@ -213,7 +213,7 @@ in
         rm -f config/autoregister.properties
         ln -s "${pkgs.writeText "autoregister.properties" cfg.agentConfig}" config/autoregister.properties
 
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java ${lib.concatStringsSep " " cfg.startupOptions} \
                         ${lib.concatStringsSep " " cfg.extraOptions} \
                               -jar ${pkgs.gocd-agent}/go-agent/agent-bootstrapper.jar \
diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix
index 0997cb394cbe..0c3091f85b49 100644
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@@ -217,7 +217,7 @@ in
       path = cfg.packages;
 
       script = ''
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java -server ${concatStringsSep " " cfg.startupOptions} \
                                ${concatStringsSep " " cfg.extraOptions}  \
                               -jar ${pkgs.gocd-server}/go-server/lib/go.jar
diff --git a/nixos/modules/services/editors/emacs.nix b/nixos/modules/services/editors/emacs.nix
index 93c814acad2e..50bca3596032 100644
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -26,7 +26,7 @@ in
       description = ''
         Whether to enable a user service for the Emacs daemon. Use `emacsclient` to connect to the
         daemon. If `true`, {var}`services.emacs.install` is
-        considered `true`, whatever its value.
+        considered `true`.
       '';
     };
 
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 309e03266197..826c1e0a463f 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -591,10 +591,11 @@ in
 
       tlsTrustedAuthorities = lib.mkOption {
         type = lib.types.str;
-        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        defaultText = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
+        default = config.security.pki.caBundle;
+        defaultText = lib.literalExpression "config.security.pki.caBundle";
+        example = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
         description = ''
-          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
+          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This sets [smtp_tls_CAfile](https://www.postfix.org/postconf.5.html#smtp_tls_CAfile). Defaults to system trusted certificates (see `security.pki.*` options).
         '';
       };
 
diff --git a/nixos/modules/services/misc/db-rest.nix b/nixos/modules/services/misc/db-rest.nix
index 6cb9dd3da577..d1cedfd2b838 100644
--- a/nixos/modules/services/misc/db-rest.nix
+++ b/nixos/modules/services/misc/db-rest.nix
@@ -162,7 +162,7 @@ in
         };
         environment = {
           NODE_ENV = "production";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
           HOSTNAME = cfg.host;
           PORT = toString cfg.port;
         };
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 245ced135c51..f96c6f548b0b 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -244,7 +244,7 @@ let
         ${optionalString (cfg.smtp.authentication != null) "authentication: :${cfg.smtp.authentication},"}
         enable_starttls_auto: ${boolToString cfg.smtp.enableStartTLSAuto},
         tls: ${boolToString cfg.smtp.tls},
-        ca_file: "/etc/ssl/certs/ca-certificates.crt",
+        ca_file: "${config.security.pki.caBundle}",
         openssl_verify_mode: '${cfg.smtp.opensslVerifyMode}'
       }
     end
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 0ab9d69df96a..33a49fb25ee7 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -285,7 +285,7 @@ in
             in
             {
               PORTUNUS_SERVER_HTTP_SECURE = "true";
-              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = "/etc/ssl/certs/ca-certificates.crt";
+              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = config.security.pki.caBundle;
               PORTUNUS_SLAPD_TLS_CERTIFICATE = "${acmeDirectory}/cert.pem";
               PORTUNUS_SLAPD_TLS_DOMAIN_NAME = cfg.domain;
               PORTUNUS_SLAPD_TLS_PRIVATE_KEY = "${acmeDirectory}/key.pem";
diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index cd7a2452223a..e849c8dee817 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -45,6 +45,7 @@ let
         BindReadOnlyPaths = [
           "${cfg.configFile}:${env.RAD_HOME}/config.json"
           "${if lib.types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
         ];
         KillMode = "process";
         StateDirectory = [ "radicle" ];
@@ -57,7 +58,6 @@ let
       {
         BindReadOnlyPaths = [
           "-/etc/resolv.conf"
-          "/etc/ssl/certs/ca-certificates.crt"
           "/run/systemd"
         ];
         AmbientCapabilities = "";
diff --git a/nixos/modules/services/misc/tandoor-recipes.nix b/nixos/modules/services/misc/tandoor-recipes.nix
index b56185bd0c45..8f1cb4cbadde 100644
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@@ -118,9 +118,7 @@ in
         RuntimeDirectory = "tandoor-recipes";
 
         BindReadOnlyPaths = [
-          "${
-            config.environment.etc."ssl/certs/ca-certificates.crt".source
-          }:/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
           "-/etc/resolv.conf"
           "-/etc/nsswitch.conf"
diff --git a/nixos/modules/services/monitoring/ocsinventory-agent.nix b/nixos/modules/services/monitoring/ocsinventory-agent.nix
index 83fec3b2b57d..fba1ebcae4a5 100644
--- a/nixos/modules/services/monitoring/ocsinventory-agent.nix
+++ b/nixos/modules/services/monitoring/ocsinventory-agent.nix
@@ -53,7 +53,8 @@ in
 
             ca = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 Path to CA certificates file in PEM format, for server
                 SSL certificate validation.
@@ -72,7 +73,6 @@ in
         };
         default = { };
         example = {
-          ca = "/etc/ssl/certs/ca-certificates.crt";
           debug = true;
           server = "https://ocsinventory.localhost:8080/ocsinventory";
           tag = "01234567890123";
diff --git a/nixos/modules/services/monitoring/parsedmarc.nix b/nixos/modules/services/monitoring/parsedmarc.nix
index 22c37f3e26e2..4b3991ebf188 100644
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@@ -371,7 +371,8 @@ in
 
             cert_path = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 The path to a TLS certificate bundle used to verify
                 the server's certificate.
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 3b15cb80a861..c673a09832b0 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -24,7 +24,7 @@ in
         default = { };
         example = {
           PORT = "4000";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = lib.literalExpression "config.security.pki.caBundle";
         };
         description = ''
           Additional configuration for Uptime Kuma, see
diff --git a/nixos/modules/services/networking/biboumi.nix b/nixos/modules/services/networking/biboumi.nix
index ec28cadd8da2..a8318aff59b1 100644
--- a/nixos/modules/services/networking/biboumi.nix
+++ b/nixos/modules/services/networking/biboumi.nix
@@ -57,7 +57,8 @@ in
           };
           options.ca_file = lib.mkOption {
             type = lib.types.path;
-            default = "/etc/ssl/certs/ca-certificates.crt";
+            default = config.security.pki.caBundle;
+            defaultText = lib.literalExpression "config.security.pki.caBundle";
             description = ''
               Specifies which file should be used as the list of trusted CA
               when negotiating a TLS session.
diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix
index 9c9353f175e9..c57c8377bdac 100644
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@@ -282,9 +282,8 @@ in
         # This allows setting absolute key/crt paths
         ca-directory = "/var/empty";
         certificate-directory = "/run/privoxy/certs";
-        trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
+        trusted-cas-file = config.security.pki.caBundle;
       });
-
   };
 
   imports =
diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix
index ddc50a04789a..0e02cc74184c 100644
--- a/nixos/modules/services/networking/stunnel.nix
+++ b/nixos/modules/services/networking/stunnel.nix
@@ -123,7 +123,7 @@ in
         description = ''
           Define the client configurations.
 
-          By default, verifyChain and OCSPaia are enabled and a CAFile is provided from pkgs.cacert.
+          By default, verifyChain and OCSPaia are enabled and CAFile is set to `security.pki.caBundle`.
 
           See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`.
         '';
@@ -144,7 +144,7 @@ in
             applyDefaults =
               c:
               {
-                CAFile = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+                CAFile = config.security.pki.caBundle;
                 OCSPaia = true;
                 verifyChain = true;
               }
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 7786f6a8d4d5..26c43521b2c1 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -195,7 +195,7 @@ in {
         interface = mkDefault ([ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1"));
         access-control = mkDefault ([ "127.0.0.0/8 allow" ] ++ (optional config.networking.enableIPv6 "::1/128 allow"));
         auto-trust-anchor-file = mkIf cfg.enableRootTrustAnchor rootTrustAnchorFile;
-        tls-cert-bundle = mkDefault "/etc/ssl/certs/ca-certificates.crt";
+        tls-cert-bundle = mkDefault config.security.pki.caBundle;
         # prevent race conditions on system startup when interfaces are not yet
         # configured
         ip-freebind = mkDefault true;
diff --git a/nixos/modules/services/search/hound.nix b/nixos/modules/services/search/hound.nix
index 98ef752aa8e8..87066c79374a 100644
--- a/nixos/modules/services/search/hound.nix
+++ b/nixos/modules/services/search/hound.nix
@@ -118,7 +118,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.home;
-        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo /etc/ssl/certs/ca-certificates.crt";
+        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo ${config.security.pki.caBundle}";
         ExecStart = "${cfg.package}/bin/houndd -addr ${cfg.listen} -conf /etc/hound/config.json";
       };
     };
diff --git a/nixos/modules/services/system/nix-daemon.nix b/nixos/modules/services/system/nix-daemon.nix
index 78787d08b1e1..bc5bbcf06cf1 100644
--- a/nixos/modules/services/system/nix-daemon.nix
+++ b/nixos/modules/services/system/nix-daemon.nix
@@ -218,7 +218,7 @@ in
       environment =
         cfg.envVars
         // {
-          CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+          CURL_CA_BUNDLE = config.security.pki.caBundle;
         }
         // config.networking.proxy.envVars;
 
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 397b11c3e013..65501ecf7f4c 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -361,7 +361,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       environment = {
-        CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
+        CURL_CA_BUNDLE = config.security.pki.caBundle;
         TRANSMISSION_WEB_HOME = lib.mkIf (cfg.webHome != null) cfg.webHome;
       };
 
diff --git a/nixos/modules/services/web-apps/cryptpad.nix b/nixos/modules/services/web-apps/cryptpad.nix
index f2493d57e3cf..a5f142553495 100644
--- a/nixos/modules/services/web-apps/cryptpad.nix
+++ b/nixos/modules/services/web-apps/cryptpad.nix
@@ -239,7 +239,7 @@ in
             "-/etc/resolv.conf"
             "-/run/systemd"
             "/etc/hosts"
-            "/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
         };
       };
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index 13af63892fe9..37b27ae8f1cd 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -117,7 +117,7 @@ in
             "-/etc/localtime"
             "-/etc/nsswitch.conf"
             "-/etc/resolv.conf"
-            "-/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
           BindPaths = optional (cfg.settings.storage.type == "postgres") "/var/run/postgresql";
           # ProtectClock= adds DeviceAllow=char-rtc r
diff --git a/nixos/modules/services/web-apps/grav.nix b/nixos/modules/services/web-apps/grav.nix
index 25743bc3e3f0..6549002c47ac 100644
--- a/nixos/modules/services/web-apps/grav.nix
+++ b/nixos/modules/services/web-apps/grav.nix
@@ -132,7 +132,7 @@ in
             "opcache.memory_consumption" = "128";
             "opcache.revalidate_freq" = "1";
             "opcache.fast_shutdown" = "1";
-            "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+            "openssl.cafile" = config.security.pki.caBundle;
             catch_workers_output = "yes";
 
             upload_max_filesize = cfg.maxUploadSize;
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 1943e06804a6..10609fff7005 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -19,7 +19,7 @@ let
     "opcache.memory_consumption" = "128";
     "opcache.revalidate_freq" = "1";
     "opcache.fast_shutdown" = "1";
-    "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+    "openssl.cafile" = config.security.pki.caBundle;
     catch_workers_output = "yes";
   };
 
@@ -400,7 +400,7 @@ in {
 
     phpOptions = mkOption {
       type = with types; attrsOf (oneOf [ str int ]);
-      defaultText = literalExpression (generators.toPretty { } defaultPHPSettings);
+      defaultText = literalExpression (generators.toPretty { } (defaultPHPSettings // { "openssl.cafile" = literalExpression "config.security.pki.caBundle"; }));
       description = ''
         Options for PHP's php.ini file for nextcloud.
 
@@ -1040,12 +1040,12 @@ in {
           restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
-              if [ -z "$(<$CREDENTIALS_DIRECTORY/dbpass)" ]; then
+              if [ -z "$(<"$CREDENTIALS_DIRECTORY/dbpass")" ]; then
                 echo "dbpassFile ${c.dbpassFile} is empty!"
                 exit 1
               fi
             ''}
-            if [ -z "$(<$CREDENTIALS_DIRECTORY/adminpass)" ]; then
+            if [ -z "$(<"$CREDENTIALS_DIRECTORY/adminpass")" ]; then
               echo "adminpassFile ${c.adminpassFile} is empty!"
               exit 1
             fi
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index f52a4ccf6266..2fe726e61525 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -16,7 +16,7 @@ let
   env = {
     NODE_CONFIG_DIR = "/var/lib/peertube/config";
     NODE_ENV = "production";
-    NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+    NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
     NPM_CONFIG_CACHE = "/var/cache/peertube/.npm";
     NPM_CONFIG_PREFIX = cfg.package;
     HOME = cfg.package;
diff --git a/nixos/modules/services/web-apps/sogo.nix b/nixos/modules/services/web-apps/sogo.nix
index c34896d1112e..ddf673dcaf42 100644
--- a/nixos/modules/services/web-apps/sogo.nix
+++ b/nixos/modules/services/web-apps/sogo.nix
@@ -113,7 +113,7 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."sogo/sogo.conf.raw".source ];
 
-      environment.LDAPTLS_CACERT = "/etc/ssl/certs/ca-certificates.crt";
+      environment.LDAPTLS_CACERT = config.security.pki.caBundle;
 
       serviceConfig = {
         Type = "forking";
diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index c1d89af2f3e2..335b8f8e6426 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -60,7 +60,7 @@ import ../make-test-python.nix (
 
     nodes = {
       server =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -83,8 +83,12 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.1"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server.networking.primaryIPAddress}"
+              # The interface selection logic of flannel would normally use eth0, as the nixos
+              # testing driver sets a default route via dev eth0. However, in test setups we
+              # have to use eth1 for inter-node communication.
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -93,19 +97,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.1";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
         };
 
       server2 =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -119,7 +114,7 @@ import ../make-test-python.nix (
             enable = true;
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.1:6443";
+            serverAddr = "https://${nodes.server.networking.primaryIPAddress}:6443";
             clusterInit = false;
             extraFlags = [
               "--disable coredns"
@@ -127,8 +122,9 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.3"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server2.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -137,19 +133,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.3";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.3";
-              prefixLength = 24;
-            }
-          ];
         };
 
       agent =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           virtualisation.memorySize = 1024;
           virtualisation.diskSize = 2048;
@@ -159,23 +146,15 @@ import ../make-test-python.nix (
             role = "agent";
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.3:6443";
+            serverAddr = "https://${nodes.server2.networking.primaryIPAddress}:6443";
             extraFlags = [
               "--pause-image test.local/pause:local"
-              "--node-ip 192.168.1.2"
+              "--node-ip ${nodes.agent.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [ 6443 ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.2";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
         };
     };
 
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index d3a39fa521d9..f1e5d3771b0f 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -24,7 +24,7 @@
   gvfs,
   libcdio,
   pcre,
-  projectm,
+  projectm_3,
   protobuf,
   qca-qt5,
   pkg-config,
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       liblastfm
       libpulseaudio
       pcre
-      projectm
+      projectm_3
       protobuf
       qca-qt5
       qjson
diff --git a/pkgs/applications/audio/projectm/default.nix b/pkgs/applications/audio/projectm_3/default.nix
similarity index 100%
rename from pkgs/applications/audio/projectm/default.nix
rename to pkgs/applications/audio/projectm_3/default.nix
diff --git a/pkgs/applications/editors/emacs/build-support/elpa.nix b/pkgs/applications/editors/emacs/build-support/elpa.nix
index fcaef43953ef..50abadccf9d9 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/elpa.nix
@@ -43,7 +43,9 @@ lib.extendMkDerivation {
 
           emacs --batch -Q -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$src" "$out/share/emacs/site-lisp/elpa"
+              "$src" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';
diff --git a/pkgs/applications/editors/emacs/build-support/elpa2nix.el b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
index 97cf2fd58a06..5b363b7b6640 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
@@ -5,8 +5,10 @@
   (if (not noninteractive)
       (error "`elpa2nix-install-package' is to be used only with -batch"))
   (pcase command-line-args-left
-    (`(,archive ,elpa)
-     (progn (setq package-user-dir elpa)
+    (`(,archive ,elpa ,turn-compilation-warning-to-error ,ignore-compilation-error)
+     (progn (setq byte-compile-error-on-warn (string= turn-compilation-warning-to-error "t"))
+            (setq byte-compile-debug (string= ignore-compilation-error "nil"))
+            (setq package-user-dir elpa)
             (elpa2nix-install-file archive)))))
 
 (defun elpa2nix-install-from-buffer ()
@@ -31,13 +33,3 @@ The file can either be a tar file or an Emacs Lisp file."
 
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
-
-(let ((flag (getenv "turnCompilationWarningToError")))
-  (when (and flag
-             ;; we do not use `string-empty-p' because it requires subr-x in Emacs <= 26
-             (not (string= flag "")))
-    (setq byte-compile-error-on-warn t)))
-
-(let ((flag (getenv "ignoreCompilationError")))
-  (when (string= flag "")
-    (setq byte-compile-debug t)))
diff --git a/pkgs/applications/editors/emacs/build-support/generic.nix b/pkgs/applications/editors/emacs/build-support/generic.nix
index ddab4bc70a00..b4e96f6490fb 100644
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@@ -61,6 +61,7 @@ lib.extendMkDerivation {
       propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;
 
       strictDeps = args.strictDeps or true;
+      __structuredAttrs = args.__structuredAttrs or true;
 
       inherit turnCompilationWarningToError ignoreCompilationError;
 
diff --git a/pkgs/applications/editors/emacs/build-support/melpa.nix b/pkgs/applications/editors/emacs/build-support/melpa.nix
index bdca913e865d..876cf9a46ddc 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/melpa.nix
@@ -185,7 +185,9 @@ lib.extendMkDerivation {
           emacs --batch -Q \
               -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$archive" "$out/share/emacs/site-lisp/elpa"
+              "$archive" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 2ed31090e106..40a6f2f7aec3 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -153,8 +153,10 @@ let
         # https://github.com/Golevka/emacs-clang-complete-async/issues/90
         auto-complete-clang-async = (addPackageRequires super.auto-complete-clang-async [ self.auto-complete ]).overrideAttrs (old: {
           buildInputs = old.buildInputs ++ [ pkgs.llvmPackages.llvm ];
-          CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
-          LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          env = old.env or { } // {
+            CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
+            LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          };
         });
 
         # part of a larger package
@@ -242,7 +244,7 @@ let
           #   - https://github.com/vedang/pdf-tools/issues/102
           #   - https://github.com/vedang/pdf-tools/issues/103
           #   - https://github.com/vedang/pdf-tools/issues/109
-          CXXFLAGS = "-std=c++17";
+          env = old.env or { } // { CXXFLAGS = "-std=c++17"; };
 
           nativeBuildInputs = old.nativeBuildInputs ++ [
             pkgs.autoconf
@@ -294,7 +296,7 @@ let
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [ ] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env = old.env or { } // { NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR"; };
           preConfigure = ''
             pushd server
           '';
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 75f90b2f4431..baff4e6918e1 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -68,14 +68,10 @@ let
   openvdb_tbb_2021_8 = openvdb.override { tbb = tbb_2021_11; };
   wxGTK-override' = if wxGTK-override == null then wxGTK-prusa else wxGTK-override;
   opencascade-override' = if opencascade-override == null then opencascade-occt_7_6_1 else opencascade-override;
-
-  patches = [
-  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prusa-slicer";
   version = "2.9.0";
-  inherit patches;
 
   src = fetchFromGitHub {
     owner = "prusa3d";
@@ -84,6 +80,12 @@ stdenv.mkDerivation (finalAttrs: {
     rev = "version_${finalAttrs.version}";
   };
 
+  # https://github.com/prusa3d/PrusaSlicer/pull/14010
+  patches = [(fetchpatch {
+    url = "https://github.com/prusa3d/PrusaSlicer/commit/cdc3db58f9002778a0ca74517865527f50ade4c3.patch";
+    hash = "sha256-zgpGg1jtdnCBaWjR6oUcHo5sGuZx5oEzpux3dpRdMAM=";
+  })];
+
   # required for GCC 14
   # (not applicable to super-slicer fork)
   postPatch = lib.optionalString (finalAttrs.pname == "prusa-slicer") ''
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index e04a8122d7cc..d08ad5686990 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.19.3";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-0P3cvBI5CM03y6Km7d31Z3ZzpGW3y1oKkprpPglrujg=";
+    hash = "sha256-BgxWsT/s5Hv5cvzcSjfrgAmZhcoquaydSZKdPmld4Rg=";
   };
 
   goDeps =
@@ -40,7 +40,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-o7eH3f+yeRr5CnBIuL2jMtVQaBLVihz2dg5RTF8RvaM=";
+      vendorHash = "sha256-ntk4WyJYEi6ZX2MyXMGgsYVqhAUQSGJLHWiNLkCwMEY=";
     }).goModules;
 in
 stdenv.mkDerivation {
diff --git a/pkgs/applications/radio/qsstv/default.nix b/pkgs/applications/radio/qsstv/default.nix
index ba49faf73e39..afe8427430af 100644
--- a/pkgs/applications/radio/qsstv/default.nix
+++ b/pkgs/applications/radio/qsstv/default.nix
@@ -19,7 +19,7 @@ mkDerivation rec {
   pname = "qsstv";
 
   src = fetchurl {
-    url = "http://users.telenet.be/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
+    url = "https://www.qsl.net/o/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
     sha256 = "0s3sivc0xan6amibdiwfnknrl3248wzgy98w6gyxikl0qsjpygy0";
   };
 
@@ -48,7 +48,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Qt-based slow-scan TV and fax";
     mainProgram = "qsstv";
-    homepage = "http://users.telenet.be/on4qz/";
+    homepage = "https://www.qsl.net/on4qz/";
     platforms = platforms.linux;
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ hax404 ];
diff --git a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
index bd103adb090c..03a838dcc1b5 100644
--- a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
@@ -1,4 +1,4 @@
-{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm }:
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm_3 }:
 
 buildKodiBinaryAddon rec {
   pname = "visualization-projectm";
@@ -12,7 +12,7 @@ buildKodiBinaryAddon rec {
     hash = "sha256-J3RtVl+hO8DspLyF2KAVMLDIJBiEb0bKosKhJyKy9hk=";
   };
 
-  extraBuildInputs = [ pkg-config libGL projectm ];
+  extraBuildInputs = [ pkg-config libGL projectm_3 ];
 
   propagatedBuildInputs = [ glm ];
   meta = with lib; {
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index db9c2d784f6b..6b17568a81a6 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -13,6 +13,10 @@
 , cargo
 , jq
 , libiconv
+# Controls codegen parallelization for all crates.
+# May be overriden on a per-crate level.
+# See <https://doc.rust-lang.org/rustc/codegen-options/index.html#codegen-units>
+, defaultCodegenUnits ? 1
 }:
 
 let
@@ -339,7 +343,7 @@ crate_: lib.makeOverridable
       colors = lib.attrByPath [ "colors" ] "always" crate;
       extraLinkFlags = lib.concatStringsSep " " (crate.extraLinkFlags or [ ]);
       edition = crate.edition or null;
-      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else 1;
+      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else defaultCodegenUnits;
       extraRustcOpts =
         lib.optionals (crate ? extraRustcOpts) crate.extraRustcOpts
           ++ extraRustcOpts_
diff --git a/pkgs/by-name/ae/aerc/package.nix b/pkgs/by-name/ae/aerc/package.nix
index 7fa713a762e6..14a25b37b414 100644
--- a/pkgs/by-name/ae/aerc/package.nix
+++ b/pkgs/by-name/ae/aerc/package.nix
@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromSourcehut,
   ncurses,
+  withNotmuch ? true,
   notmuch,
   scdoc,
   python3Packages,
@@ -50,14 +51,13 @@ buildGoModule rec {
 
   buildInputs = [
     python3Packages.python
-    notmuch
     gawk
-  ];
+  ] ++ lib.optional withNotmuch notmuch;
 
   installPhase = ''
     runHook preInstall
 
-    make $makeFlags GOFLAGS="$GOFLAGS -tags=notmuch" install
+    make $makeFlags GOFLAGS="$GOFLAGS${lib.optionalString withNotmuch " -tags=notmuch"}" install
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/be/benchexec/package.nix b/pkgs/by-name/be/benchexec/package.nix
index be860eaad4d0..bca21cbc4506 100644
--- a/pkgs/by-name/be/benchexec/package.nix
+++ b/pkgs/by-name/be/benchexec/package.nix
@@ -9,17 +9,22 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "benchexec";
-  version = "3.21";
+  version = "3.27";
 
   src = fetchFromGitHub {
     owner = "sosy-lab";
     repo = "benchexec";
     rev = version;
-    hash = "sha256-bE3brmmLHZQakDKvd47I1hm9Dcsu6DrSeJyjWWtEZWI=";
+    hash = "sha256-lokz7klAQAascij0T/T43/PrbMh6ZUAvFnIqg13pVUk=";
   };
 
   pyproject = true;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'setuptools ==' 'setuptools >='
+  '';
+
   nativeBuildInputs = with python3.pkgs; [ setuptools ];
 
   # NOTE: CPU Energy Meter is not added,
diff --git a/pkgs/by-name/bu/buffybox/package.nix b/pkgs/by-name/bu/buffybox/package.nix
index e264825e97fe..b134c7f105a0 100644
--- a/pkgs/by-name/bu/buffybox/package.nix
+++ b/pkgs/by-name/bu/buffybox/package.nix
@@ -15,15 +15,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "buffybox";
-  version = "3.2.0-unstable-2024-12-09";
+  version = "3.2.0-unstable-2025-02-27";
 
   src = fetchFromGitLab {
     domain = "gitlab.postmarketos.org";
     owner = "postmarketOS";
     repo = "buffybox";
     fetchSubmodules = true; # to use its vendored lvgl
-    rev = "32f4837e836fbb0b820d68c74c3278c925369b04";
-    hash = "sha256-d9fa/Zqbm/+WMRmO0hBW83PCTDgaVOAxyRuSTItr9Xs=";
+    rev = "6bf7a8406f3a3fa79831d2d151e519b703b9e135";
+    hash = "sha256-q3TNYRv5Cim+WklXw2ZTW6Ico1h8Xxs9MhTFhHZUMW0=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/bu/bunster/package.nix b/pkgs/by-name/bu/bunster/package.nix
index 0e31ecf2bb07..a9d285bdf5cb 100644
--- a/pkgs/by-name/bu/bunster/package.nix
+++ b/pkgs/by-name/bu/bunster/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "bunster";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "yassinebenaid";
     repo = "bunster";
     tag = "v${version}";
-    hash = "sha256-ZooaM9zi6tC7Y6Oks7OEtMPX0+4kd1UaBGzfNLgCj10=";
+    hash = "sha256-HE5Wp5A0wc5jgs9kNkCH1f82Y+SkILHvOwlQAsC6DVU=";
   };
 
   vendorHash = "sha256-Gs+8J+yEVynsBte3Hnx7jnYRPa/61CIISDbMyDKhPRE=";
diff --git a/pkgs/by-name/du/dunst/package.nix b/pkgs/by-name/du/dunst/package.nix
index f877e4f8ac82..6d7ec750e2c1 100644
--- a/pkgs/by-name/du/dunst/package.nix
+++ b/pkgs/by-name/du/dunst/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dunst";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MC35UE6cA1xA1qaOppvHAjuevbl2z0Twct1G5Uv84pU=";
+    hash = "sha256-i5/rRlxs+voEXL3udY+55l2mU54yep8RpmLOZpGtDeM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fe/feedbackd/package.nix b/pkgs/by-name/fe/feedbackd/package.nix
index 5c0ab1d28498..092ac7cc6dc5 100644
--- a/pkgs/by-name/fe/feedbackd/package.nix
+++ b/pkgs/by-name/fe/feedbackd/package.nix
@@ -20,6 +20,7 @@
   dbus,
   gmobile,
   umockdev,
+  nix-update-script,
 }:
 
 let
@@ -33,7 +34,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd";
-  version = "0.4.1";
+  version = "0.7.0";
 
   outputs = [
     "out"
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Librem5";
     repo = "feedbackd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ta14DYqkid8Cp8fx9ZMGOOJroCBszN9/VrTN6mrpTZg=";
+    hash = "sha256-qwyq1v+20Gotpk0CbUe6MdDJ5bmKmTHOen+rxWljjeA=";
   };
 
   depsBuildBuild = [
@@ -106,11 +107,18 @@ stdenv.mkDerivation (finalAttrs: {
     fi
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Daemon to provide haptic (and later more) feedback on events";
     homepage = "https://source.puri.sm/Librem5/feedbackd";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pacman99 ];
+    maintainers = with maintainers; [
+      pacman99
+      Luflosi
+    ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/by-name/fi/fishy/package.nix b/pkgs/by-name/fi/fishy/package.nix
new file mode 100644
index 000000000000..3546c4c2fd88
--- /dev/null
+++ b/pkgs/by-name/fi/fishy/package.nix
@@ -0,0 +1,43 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fishy";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "p2panda";
+    repo = "fishy";
+    tag = "v${version}";
+    hash = "sha256-nRkP53v9+VzqHKTsHs+cBeLjh3yASFE18sSEY02NR1s=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-F4zbalop1PEb381DctUIzdm3v71b6M/hnuw9BuIEkBU=";
+
+  OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Create, manage and deploy p2panda schemas";
+    homepage = "https://github.com/p2panda/fishy";
+    changelog = "https://github.com/p2panda/fishy/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ confusedalex ];
+    mainProgram = "fishy";
+  };
+}
diff --git a/pkgs/by-name/fp/fping/package.nix b/pkgs/by-name/fp/fping/package.nix
index bf97d0c3155a..f38c77f38cb8 100644
--- a/pkgs/by-name/fp/fping/package.nix
+++ b/pkgs/by-name/fp/fping/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fping";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchurl {
     url = "https://www.fping.org/dist/fping-${version}.tar.gz";
-    hash = "sha256-p2ktENc/sLt24fdFmqfxm7zb/Frb7e8C9GiXSxiw5C8=";
+    hash = "sha256-1XvQFBrqCC4638GYv8PbXf0SpwFMfCZV6X9hzVSQHQ4=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff b/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff
new file mode 100644
index 000000000000..e9813c00be20
--- /dev/null
+++ b/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff
@@ -0,0 +1,11 @@
+--- a/dmd-script
++++ b/dmd-script
+@@ -72,7 +72,7 @@ my @run_args;
+ # for the target prefix.
+ basename($0) =~ m/^(.*-)?g?dmd(-.*)?$/;
+ my $target_prefix = $1?$1:"";
+-my $gdc_dir = abs_path(dirname($0));
++my $gdc_dir = "@gdc_dir@";
+ my $gdc = File::Spec->catfile( $gdc_dir, $target_prefix . "gdc" . ($2?$2:""));
+ 
+ sub osHasEXE() {
diff --git a/pkgs/by-name/gd/gdmd/package.nix b/pkgs/by-name/gd/gdmd/package.nix
new file mode 100644
index 000000000000..6f98c8a491c8
--- /dev/null
+++ b/pkgs/by-name/gd/gdmd/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  substituteAll,
+  gdc,
+  perl,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "gdmd";
+  version = "0.1.0-unstable-2024-05-30";
+
+  src = fetchFromGitHub {
+    owner = "D-Programming-GDC";
+    repo = "gdmd";
+    rev = "dc0ad9f739795f3ce5c69825efcd5d1d586bb013";
+    hash = "sha256-Sw8ExEPDvGqGKcM9VKnOI6MGgXW0tAu51A90Wi4qrRE=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0001-gdc-store-path.diff;
+      gdc_dir = "${gdc}/bin";
+    })
+  ];
+
+  buildInputs = [
+    gdc
+    perl
+  ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "prefix="
+  ];
+
+  preInstall = ''
+    install -d $out/bin $out/share/man/man1
+  '';
+
+  meta = {
+    description = "Wrapper for GDC that emulates DMD's command line";
+    homepage = "https://gdcproject.org";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jtbx ];
+    mainProgram = "gdmd";
+  };
+}
diff --git a/pkgs/by-name/gi/gitxray/package.nix b/pkgs/by-name/gi/gitxray/package.nix
index fea415c56cd3..de005f4dc030 100644
--- a/pkgs/by-name/gi/gitxray/package.nix
+++ b/pkgs/by-name/gi/gitxray/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitxray";
-  version = "1.0.17.2";
+  version = "1.0.17.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kulkansecurity";
     repo = "gitxray";
     tag = version;
-    hash = "sha256-EcDKjUC1Zi6zSvOQRhozzKPrBLjODk8+Lqpagh55LCc=";
+    hash = "sha256-MfYK6D6QkIQRTsnNAiJsfPeYcUTO/BTe0AtczeONSsg=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index 5d1d78aedb0c..06d786255197 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -27,8 +27,8 @@
 }:
 
 let
-  version = "1.37.1";
-  patterns_version = "1.37.1";
+  version = "1.37.4";
+  patterns_version = "1.37.4";
 
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "WerWolv";
     repo = "ImHex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0vfetOUYQmi3FNWI8+QkBHJe2Crg4LNrKeT1vSTdsjM=";
+    hash = "sha256-uenwAaIjtBzrtiLdy6fh5TxtbWtUJbtybNOLP3+8blA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/jw/jwx/package.nix b/pkgs/by-name/jw/jwx/package.nix
index 4f3b16cdebd7..2350f9673073 100644
--- a/pkgs/by-name/jw/jwx/package.nix
+++ b/pkgs/by-name/jw/jwx/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "jwx";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CuxBfR+q+2JCe7F1gruGrVM+UBkrmz5dEyrDtFdmbhM=";
+    hash = "sha256-UXiF3X1jLk4dCGKmZlx9V08hzNJV+s/K2Wei9i+A6dg=";
   };
 
   vendorHash = "sha256-ZS7xliFymXTE8hlc3GEMNonP5sJTZGirw5YQNzPCl3Y=";
diff --git a/pkgs/by-name/li/libipt/package.nix b/pkgs/by-name/li/libipt/package.nix
index 8b2baaad6ce1..33e01b9d7a83 100644
--- a/pkgs/by-name/li/libipt/package.nix
+++ b/pkgs/by-name/li/libipt/package.nix
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD freebsd.libstdthreads;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_LDFLAGS = "-lstdthreads";
+  };
+
   meta = with lib; {
     description = "Intel Processor Trace decoder library";
     homepage = "https://github.com/intel/libipt";
diff --git a/pkgs/by-name/li/libprojectm/package.nix b/pkgs/by-name/li/libprojectm/package.nix
new file mode 100644
index 000000000000..b67e2d525519
--- /dev/null
+++ b/pkgs/by-name/li/libprojectm/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libGL,
+  xorg,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libprojectm";
+  version = "4.1.4";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "projectm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gf1k9iSDARp6/M2/Po1wdOEY6y/QG2nq5uhSFU6bxAM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libGL
+    xorg.libX11
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "Cross-platform Milkdrop-compatible Music Visualization Library";
+    homepage = "https://github.com/projectM-visualizer/projectm";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
+    longDescription = ''
+      The open-source project that reimplements the esteemed Winamp Milkdrop by
+      Geiss in a more modern, cross-platform reusable library.
+      Read an audio input and produces mesmerizing visuals, detecting tempo, and
+      rendering advanced equations into a limitless array of user-contributed visualizations.
+    '';
+  };
+})
diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 4240654d6b34..62111043d782 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -1,18 +1,21 @@
 {
   lib,
   stdenv,
-  perl,
   linuxPackages_latest,
+  perl,
+  man,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "linux-manual";
   inherit (linuxPackages_latest.kernel) version src;
 
   nativeBuildInputs = [ perl ];
+  nativeInstallCheckInputs = [ man ];
 
   dontConfigure = true;
   dontBuild = true;
+  doInstallCheck = true;
 
   postPatch = ''
     patchShebangs --build \
@@ -21,25 +24,37 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mandir=$out/share/man/man9
-    mkdir -p $mandir
+    runHook preInstall
 
-    KBUILD_BUILD_TIMESTAMP=$(stat -c %Y Makefile) \
+    export mandir="$out/share/man/man9"
+    mkdir -p "$mandir"
+
+    KBUILD_BUILD_TIMESTAMP="$(date -u -d "@$SOURCE_DATE_EPOCH")" \
     grep -F -l -Z \
       --exclude-dir Documentation \
       --exclude-dir tools \
       -R '/**' \
-      | xargs -0 -n 256 -P $NIX_BUILD_CORES \
-        $SHELL -c '{ scripts/kernel-doc -man "$@" || :; } \
-          | scripts/split-man.pl '$mandir kernel-doc
+      | xargs -0 -n 256 -P "$NIX_BUILD_CORES" \
+        "$SHELL" -c '{ scripts/kernel-doc -man "$@" || :; } \
+          | scripts/split-man.pl "$mandir"' kernel-doc
 
-    test -f $mandir/kmalloc.9
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check for well‐known man page
+    man -M "$out/share/man" -P cat 9 kmalloc >/dev/null
+
+    runHook postInstallCheck
+  '';
+
+  meta = {
     homepage = "https://kernel.org/";
     description = "Linux kernel API manual pages";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ mvs ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ mvs ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
index f10b48d26d34..323e1df227fb 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@@ -1 +1 @@
-2024-12-04
+2025-03-03
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
index fef426625f0c..95e0871add42 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@@ -14,6 +14,7 @@
   mtl,
   parser-combinators,
   pretty-simple,
+  process,
   safe-exceptions,
   scientific,
   text,
@@ -24,8 +25,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.6.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/a4639036723e510d8331124c80d9ca14dd7aba02.tar.gz";
-    sha256 = "0zpkljcvfnwn1ik5cgvq396xkpp053k4lh62a24c4g434n2vz0rj";
+    url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz";
+    sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s";
   };
   isLibrary = true;
   isExecutable = true;
@@ -46,6 +47,7 @@ mkDerivation {
     directory
     file-embed
     filepath
+    process
     safe-exceptions
     text
     transformers
diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index 788dc8ade7f7..d6a88fdeb916 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.3.9";
+  version = "3.3.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-9P8KSuhTI/m0m51PUTZGU+qRbnT3izPbHTzsqZNbMJE=";
+    hash = "sha256-5+alARFuxwJlPYki5TU+4GdaJhBEYXbXH0BrCj2/aic=";
   };
 
-  vendorHash = "sha256-CTdB/+aVaXKqtiwHn8pgmhXjZ0mIDrmLvnKmisExi74=";
+  vendorHash = "sha256-l3733hg11+Qg4h68DnXoD8LyYiB+iFyZyKggpCAsx7Q=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index a97558b8419b..969f1e752375 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo124Module,
   fetchFromGitHub,
   fetchpatch,
   buildEnv,
@@ -44,17 +44,19 @@ assert builtins.elem acceleration [
 let
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.5.12";
+  version = "0.5.13";
+
+  buildGoModule = buildGo124Module;
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${version}";
-    hash = "sha256-le3OeGC/rddY9NNgmO7YcFthsZSQiO+gGSkpcV+TNXo=";
+    hash = "sha256-GRufz01lTSgBmDzRImY02xuAeuzjlIEFWv578fI8ciY=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-ON9ow9/KglBy+RKNhw1n3E5AJtpjPQvJwNAQTaWzEFA=";
+  vendorHash = "sha256-s/qvMISNpxeEAZx8Je2v4yb2aPWhSYcKhwHQcEXJ20Y=";
 
   validateFallback = lib.warnIf (config.rocmSupport && config.cudaSupport) (lib.concatStrings [
     "both `nixpkgs.config.rocmSupport` and `nixpkgs.config.cudaSupport` are enabled, "
diff --git a/pkgs/by-name/os/osu-lazer-bin/package.nix b/pkgs/by-name/os/osu-lazer-bin/package.nix
index 6b0ad51896c8..5e1ab48b4a74 100644
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-8KwLHRaGOdlTcByGzQzD28rxPiHhQewFc8bOU3Wh2Ak=";
+        hash = "sha256-VbzHD7LQstBXmSIkDpue6kPGHEzFO+Fy22eLYj+rNcw=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-0CWRMB4JjC+uY1b2jMQsRuIcBNCKtcV27N9Q5uW4DFs=";
+        hash = "sha256-1KC0PnTMgN0GFhNYmlqfqWSVEpo8i+gb4nVHEwBMSS8=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-detSX0/akBJE2bdTxUvUUlBMKswHPF1qg9tsWZ00zso=";
+        hash = "sha256-A9CWoTvByyNkULQ2abeVgiwAmSmyHx9IZqtHGS+bW6Y=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/os/osu-lazer/deps.json b/pkgs/by-name/os/osu-lazer/deps.json
index b0dd10e0c408..358f21b34335 100644
--- a/pkgs/by-name/os/osu-lazer/deps.json
+++ b/pkgs/by-name/os/osu-lazer/deps.json
@@ -666,8 +666,8 @@
   },
   {
     "pname": "ppy.osu.Game.Resources",
-    "version": "2025.217.0",
-    "hash": "sha256-ERVop92Ss/SdmcN7m1sxQRqC8Sxr9NaL3v/V3JxqUq4="
+    "version": "2025.303.0",
+    "hash": "sha256-+Lnin+oEo67ARp9RFWOe00JcOL73O9gh/XJFIF151Yg="
   },
   {
     "pname": "ppy.osuTK.NS20",
diff --git a/pkgs/by-name/os/osu-lazer/package.nix b/pkgs/by-name/os/osu-lazer/package.nix
index 06435097d2e8..6870c819fe57 100644
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-iqIzspQn1W+Qd5lCkuVknog8I2BEBLdO46Pw+j0H1zc=";
+    hash = "sha256-SqPwVQGmtkaF/Mkcp4WnKRYNXSQD3+56XbNVw9ZMr+A=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/by-name/pp/ppsspp/package.nix b/pkgs/by-name/pp/ppsspp/package.nix
index f965d598dd3d..c909425f7814 100644
--- a/pkgs/by-name/pp/ppsspp/package.nix
+++ b/pkgs/by-name/pp/ppsspp/package.nix
@@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
       libffi
     ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "HEADLESS" (!enableQt))
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" useSystemFfmpeg)
@@ -147,9 +149,16 @@ stdenv.mkDerivation (finalAttrs: {
         lib.optionals enableVulkan [
           "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
         ]
-        ++ lib.optionals (!enableQt) [
-          "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
-        ]
+        ++ (
+          if enableQt then
+            [
+              "\${qtWrapperArgs[@]}"
+            ]
+          else
+            [
+              "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
+            ]
+        )
       );
       binToBeWrapped = if enableQt then "PPSSPPQt" else "PPSSPPSDL";
     in
diff --git a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
new file mode 100644
index 000000000000..8ef432e17b37
--- /dev/null
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libprojectm,
+  poco,
+  utf8proc,
+  SDL2,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation {
+  pname = "projectm-sdl-cpp";
+  version = "0-unstable-2024-08-07";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "frontend-sdl-cpp";
+    rev = "df6bfb51d7be335b4c258e2085f13d14e27f14a9";
+    hash = "sha256-WcQMwI0i7hON31FpgBSSUoqqlENj6SUwKTXfl7i6jn4=";
+    fetchSubmodules = true;
+  };
+
+  # Probably an artifact of the vcpkg package
+  postPatch = ''
+    substituteInPlace ImGui.cmake \
+      --replace-fail "SDL2::SDL2main" ""
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "SDL2::SDL2main" ""
+  '';
+
+  cmakeFlags = [
+    # Doesn't seem to be present in the source tree, so the installation fails if enabled
+    (lib.cmakeBool "ENABLE_DESKTOP_ICON" false)
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libprojectm
+    poco
+    utf8proc
+    SDL2
+  ];
+
+  # poco 1.14 requires c++17
+  NIX_CFLAGS_COMPILE = [ "-std=gnu++17" ];
+
+  strictDeps = true;
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Standalone application based on libprojectM and libSDL that turns your desktop audio into awesome visuals";
+    homepage = "https://github.com/projectM-visualizer/frontend-sdl-cpp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "projectMSDL";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/ro/roc-toolkit/package.nix b/pkgs/by-name/ro/roc-toolkit/package.nix
index 410563c4150e..db097741eaff 100644
--- a/pkgs/by-name/ro/roc-toolkit/package.nix
+++ b/pkgs/by-name/ro/roc-toolkit/package.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!libunwindSupport) "--disable-libunwind"
     ++ lib.optional (!pulseaudioSupport) "--disable-pulseaudio"
     ++ lib.optional (!libsndfileSupport) "--disable-sndfile"
+    ++ lib.optional stdenv.hostPlatform.isFreeBSD "--platform=unix"
     ++ (
       if (!openfecSupport) then
         [ "--disable-openfec" ]
@@ -78,6 +79,11 @@ stdenv.mkDerivation rec {
         ]
     );
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_CFLAGS_COMPILE = "-D_XOPEN_SOURCE=700 -D__BSD_VISIBLE";
+    NIX_LDFLAGS = "-lpthread";
+  };
+
   meta = with lib; {
     description = "Roc is a toolkit for real-time audio streaming over the network";
     homepage = "https://github.com/roc-streaming/roc-toolkit";
diff --git a/pkgs/by-name/ru/rust-synapse-state-compress/Cargo.lock b/pkgs/by-name/ru/rust-synapse-compress-state/Cargo.lock
similarity index 100%
rename from pkgs/by-name/ru/rust-synapse-state-compress/Cargo.lock
rename to pkgs/by-name/ru/rust-synapse-compress-state/Cargo.lock
diff --git a/pkgs/by-name/ru/rust-synapse-state-compress/package.nix b/pkgs/by-name/ru/rust-synapse-compress-state/package.nix
similarity index 100%
rename from pkgs/by-name/ru/rust-synapse-state-compress/package.nix
rename to pkgs/by-name/ru/rust-synapse-compress-state/package.nix
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 560420c1be5b..101f6dbcd688 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -35,20 +35,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.1.22";
+  version = "3.1.24";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t7BJBip28xPT4/iNL/zTKzFCcQOt0E4IAT00l/iX6TM=";
+    hash = "sha256-BrFyMaxACkdjQy151vIYiJ9WotogEbEKWnFXNhyqKw4=";
   };
 
   kernel = buildGo123Module {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-iO4Qtt0+nHpiYz0gSq+z3XWRp8TBJU8psI0Hz4ofZGA=";
+    vendorHash = "sha256-2ryd+GciVGmvqLNgdvoHC1tjjnFZgWO2uObj8uNwu0E=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-GW/shXuaETg/8+d0T876mh5pKJHS4slfakObj8zrNXc=";
+    hash = "sha256-yfcgSCL78hGcq/QDvqx9jMLivW06oRVzI8iqQ7gCrlQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/sm/sm64coopdx/package.nix b/pkgs/by-name/sm/sm64coopdx/package.nix
index 52d4911ae070..4727d240eed7 100644
--- a/pkgs/by-name/sm/sm64coopdx/package.nix
+++ b/pkgs/by-name/sm/sm64coopdx/package.nix
@@ -36,13 +36,13 @@ in
 # note: there is a generic builder in pkgs/games/sm64ex/generic.nix that is meant to help build sm64ex and its forks; however sm64coopdx has departed significantly enough in its build that it doesn't make sense to use that other than the baseRom derivation
 stdenv.mkDerivation (finalAttrs: {
   pname = "sm64coopdx";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "coop-deluxe";
     repo = "sm64coopdx";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ktdvzOUYSh6H49BVDovqYt5CGyvJi4UW6nJOOD/HGGU=";
+    hash = "sha256-QWxhu7wGIjOIJyqjqakUzhhF+WxQslZdX3aEWYdDZbw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sn/snakefmt/package.nix b/pkgs/by-name/sn/snakefmt/package.nix
new file mode 100644
index 000000000000..ba565b5c20b3
--- /dev/null
+++ b/pkgs/by-name/sn/snakefmt/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "snakefmt";
+  version = "0.10.2";
+  pyproject = true;
+
+  disabled = python3.pythonOlder "3.8.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-QoalkDtm2n5SdjxegYTaTtyVETt1j0RIUogE+1T5t1o=";
+  };
+
+  build-system = [ python3.pkgs.poetry-core ];
+
+  dependencies = with python3.pkgs; [
+    black
+    click
+    importlib-metadata
+    toml
+  ];
+
+  pythonImportsCheck = [ "snakefmt" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Uncompromising Snakemake code formatter";
+    homepage = "https://pypi.org/project/snakefmt/";
+    changelog = "https://github.com/snakemake/snakefmt/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jolars ];
+    mainProgram = "snakefmt";
+  };
+}
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index e96fa46fe336..e15aca393b30 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -1,51 +1,137 @@
-{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron }:
+{
+  buildNpmPackage,
+  copyDesktopItems,
+  electron,
+  fetchFromGitHub,
+  lib,
+  makeDesktopItem,
+  nix-update-script,
+  npm-lockfile-fix,
+  python3,
+  stdenv,
+}:
 
-stdenv.mkDerivation rec {
+buildNpmPackage rec {
   pname = "super-productivity";
-  version = "11.1.2";
+  version = "11.1.3";
 
-  src = fetchurl {
-    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-x86_64.AppImage";
-    sha256 = "sha256-AtN7x0Vt0wWxNoXwRc78drFE8UfMpssFBYZ83w1QgbU=";
-    name = "${pname}-${version}.AppImage";
+  src = fetchFromGitHub {
+    owner = "johannesjo";
+    repo = "super-productivity";
+    tag = "v${version}";
+    hash = "sha256-GWpKz1q3pmAozlzawi2ITxo3KH0MSrJCszVQdGTeOXA=";
+
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} -r $out/package-lock.json
+    '';
   };
 
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
+  npmDepsHash = "sha256-iP1op4R7OUA7cSW/dJCBBGcb5r6icSbx/X7mYogiMkA=";
+  npmFlags = [ "--legacy-peer-deps" ];
+  makeCacheWritable = true;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    CHROMEDRIVER_SKIP_DOWNLOAD = "true";
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
-  dontUnpack = true;
-  dontConfigure = true;
-  dontBuild = true;
+  nativeBuildInputs =
+    [ copyDesktopItems ]
+    ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+      (python3.withPackages (ps: [ ps.setuptools ]))
+    ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  # package.json does not include `core-js` and the comment suggests
+  # it is only needed on some mobile platforms
+  postPatch = ''
+    substituteInPlace electron-builder.yaml \
+      --replace-fail "notarize: true" "notarize: false"
+    substituteInPlace src/polyfills.ts \
+      --replace-fail "import 'core-js/es/object';" ""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # electronDist needs to be modifiable on Darwin
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm run buildFrontend:prod:es6
+    npm run electron:build
+    npm exec electron-builder -- --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir -p $out/Applications
+          cp -r "app-builds/mac"*"/Super Productivity.app" "$out/Applications"
+          makeWrapper "$out/Applications/Super Productivity.app/Contents/MacOS/Super Productivity" "$out/bin/super-productivity"
+        ''
+      else
+        ''
+          mkdir -p $out/share/super-productivity/{app,defaults,static/plugins,static/resources/plugins}
+          cp -r app-builds/*-unpacked/{locales,resources{,.pak}} "$out/share/super-productivity/app"
 
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/superproductivity.desktop $out/share/applications/${pname}.desktop
-    cp -a ${appimageContents}/usr/share/icons $out/share
+          for size in 16 32 48 64 128 256 512 1024; do
+            local sizexsize="''${size}x''${size}"
+            mkdir -p $out/share/icons/hicolor/$sizexsize/apps
+            cp -v build/icons/$sizexsize.png \
+              $out/share/icons/hicolor/$sizexsize/apps/super-productivity.png
+          done
 
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+          makeWrapper '${lib.getExe electron}' "$out/bin/super-productivity" \
+            --add-flags "$out/share/super-productivity/app/resources/app.asar" \
+            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+            --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+            --inherit-argv0
+        ''
+    }
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar
-  '';
+  # copied from deb file
+  desktopItems = [
+    (makeDesktopItem {
+      name = "super-productivity";
+      desktopName = "superProductivity";
+      exec = "super-productivity %u";
+      terminal = false;
+      type = "Application";
+      icon = "super-productivity";
+      startupWMClass = "superProductivity";
+      comment = builtins.replaceStrings [ "\n" ] [ " " ] meta.longDescription;
+      categories = [ "Utility" ];
+    })
+  ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "To Do List / Time Tracker with Jira Integration";
+    longDescription = ''
+      Experience the best ToDo app for digital professionals and get more done!
+      Super Productivity comes with integrated time-boxing and time tracking capabilities
+      and you can load your task from your calendars and from
+      Jira, Gitlab, GitHub, Open Project and others all into a single ToDo list.
+    '';
     homepage = "https://super-productivity.com";
-    license = licenses.mit;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ offline ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      offline
+      pineapplehunter
+    ];
     mainProgram = "super-productivity";
   };
 }
diff --git a/pkgs/by-name/ta/tauon/package.nix b/pkgs/by-name/ta/tauon/package.nix
index f8cbae0fe90a..ec9388a4435b 100644
--- a/pkgs/by-name/ta/tauon/package.nix
+++ b/pkgs/by-name/ta/tauon/package.nix
@@ -139,7 +139,7 @@ python3Packages.buildPythonApplication rec {
     description = "Linux desktop music player from the future";
     mainProgram = "tauon";
     homepage = "https://tauonmusicbox.rocks/";
-    changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
+    changelog = "https://github.com/Taiko2k/Tauon/releases/tag/v${version}";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jansol ];
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/by-name/te/terraform-compliance/package.nix b/pkgs/by-name/te/terraform-compliance/package.nix
index 31929ef65555..4f87bb553e04 100644
--- a/pkgs/by-name/te/terraform-compliance/package.nix
+++ b/pkgs/by-name/te/terraform-compliance/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.3.49";
+  version = "1.3.50";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "terraform-compliance";
     repo = "cli";
     tag = version;
-    hash = "sha256-wg9n7x7KDqFecZZVmJwpE1kP0eKt1Gmld6XEcavcyU0=";
+    hash = "sha256-FwePzXXxwiV5tWY1a+mG5pcv6XB801qG6Lx+XUe662E=";
   };
 
   postPatch = ''
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "BDD test framework for terraform";
     mainProgram = "terraform-compliance";
     homepage = "https://github.com/terraform-compliance/cli";
-    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [
       kalbasit
diff --git a/pkgs/by-name/wm/wmenu/package.nix b/pkgs/by-name/wm/wmenu/package.nix
index faa58a57799a..e5704bc65656 100644
--- a/pkgs/by-name/wm/wmenu/package.nix
+++ b/pkgs/by-name/wm/wmenu/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.9";
+  version = "0.1.9-unstable-2025-03-01";
 
   strictDeps = true;
 
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     domain = "codeberg.org";
     owner = "adnano";
     repo = "wmenu";
-    rev = version;
-    hash = "sha256-TF5BvgThvTOqxyfz5Zt/Z1cqjFJwvla+dgdyvz7Zhrg=";
+    rev = "fc69aa6e2bccca461a0bd0c10b448b64ccda1d42";
+    hash = "sha256-ZssptllD6LPQUinKZime9A1dZJ3CkQvp+DUmk+iyaOA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py b/pkgs/by-name/xk/xkeysnail/emacs.py
similarity index 73%
rename from pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py
rename to pkgs/by-name/xk/xkeysnail/emacs.py
index 347ac17d33fc..0df5042e277a 100644
--- a/pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py
+++ b/pkgs/by-name/xk/xkeysnail/emacs.py
@@ -3,22 +3,21 @@ import re
 from xkeysnail.transform import *
 
 aa = False
-def aa_setvar(v):
-    def _aa_setvar():
+def aaset(v):
+    def _aaset():
         transform._mark_set = False
         global aa; aa = v
-    return _aa_setvar
-def aa_ifvar():
-    def _aa_ifvar():
-        transform._mark_set = False
-        global aa
+    return _aaset
+def aaif():
+    def _aaif():
+        global aa; transform._mark_set = False
         if aa: aa = False; return K("esc")
         return K("enter")
-    return _aa_ifvar
-def aa_flipmark():
-    def _aa_flipmark():
+    return _aaif
+def aaflip():
+    def _aaflip():
         transform._mark_set = not transform._mark_set;
-    return _aa_flipmark
+    return _aaflip
 
 define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-b"): with_mark(K("left")),
@@ -37,17 +36,17 @@ define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-d"): [K("delete"), set_mark(False)],
     K("M-d"): [K("C-delete"), set_mark(False)],
     K("M-backspace"): [K("C-backspace"), set_mark(False)],
-
     K("C-slash"): [K("C-z"), set_mark(False)],
-    K("C-space"): aa_flipmark(),
+
+    K("C-space"): aaflip(),
+    # K("C-space"): set_mark(True),
     K("C-M-space"): with_or_set_mark(K("C-right")),
 
+    K("enter"): aaif(),
+    K("C-s"): [K("F3"), aaset(True)],
+    K("C-r"): [K("Shift-F3"), aaset(True)],
+    K("C-g"): [K("esc"), aaset(False)]
     # K("C-s"): K("F3"),
     # K("C-r"): K("Shift-F3"),
     # K("C-g"): [K("esc"), set_mark(False)]
-
-    K("C-s"): [K("F3"), aa_setvar(True)],
-    K("C-r"): [K("Shift-F3"), aa_setvar(True)],
-    K("C-g"): [K("esc"), aa_setvar(False)],
-    K("enter"): aa_ifvar()
 })
diff --git a/pkgs/by-name/xk/xkeysnail/package.nix b/pkgs/by-name/xk/xkeysnail/package.nix
index 3ab9d84f5481..4ebbfe05edd7 100644
--- a/pkgs/by-name/xk/xkeysnail/package.nix
+++ b/pkgs/by-name/xk/xkeysnail/package.nix
@@ -1,22 +1,28 @@
 {
   lib,
   fetchFromGitHub,
-  makeWrapper,
   python3Packages,
+  fetchpatch,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "xkeysnail";
-  version = "0.4.0";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner = "mooz";
     repo = pname;
     rev = "bf3c93b4fe6efd42893db4e6588e5ef1c4909cfb";
-    sha256 = "0plcpb4ndzfsd5hj32m0g32swnhyph9sd759cdhhzmjvlq3j8q6p";
+    hash = "sha256-12AkB6Zb1g9hY6mcphO8HlquxXigiiFhadr9Zsm6jF4=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mooz/xkeysnail/commit/457ab424fb32c4bfc6e6ea307752a2ce5d77853b.patch";
+      hash = "sha256-yqsAfn3SibRW2clbtVwVZi1dJ8pAiXoYpittpz7S/wU=";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     evdev
     xlib
@@ -24,15 +30,9 @@ python3Packages.buildPythonApplication rec {
     appdirs
   ];
 
-  doCheck = false;
-
   postInstall = ''
-    mkdir -p $out/share
-    cp ./example/config.py $out/share/example.py
-    cp ${./browser-emacs-bindings.py} $out/share/browser.py
+    install -Dm444 ${./emacs.py} $out/share/browser.py
 
-    makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-example \
-      --add-flags "-q" --add-flags "$out/share/example.py"
     makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-browser \
       --add-flags "-q" --add-flags "$out/share/browser.py"
   '';
diff --git a/pkgs/by-name/xl/xlights/package.nix b/pkgs/by-name/xl/xlights/package.nix
index 4a7bd0852b2e..7ce354eb2e93 100644
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "xlights";
-  version = "2025.03";
+  version = "2025.04";
 
   src = fetchurl {
     url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-ASDiIpVLs02Q0vfGCih+a2kKmDbK8BLM8vcdDDaKfSU=";
+    hash = "sha256-YpFOQs+fDHTTWOkkw8dqKoFOVO998/nq2PUOjjA303A=";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index fbcbf4109c10..154885ab2951 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomeconnect";
-  version = "0.16.2";
+  version = "0.16.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${version}";
-    hash = "sha256-AlmlZoqQxd4RE667rBYFzyAhFN9GJ0Rmk1lniDZKRnM=";
+    hash = "sha256-BwLbShldDhd5jqes4WvzP/+c7vjrY83KWLbYs0ON3K4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 9bcc73c74152..3dcf8217e327 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.1.6";
+  version = "5.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-eqyRiMNMmhg08Pga+AGnhGXfUoTMOuIHEPOEEGboIPE=";
+    hash = "sha256-BxhHqWpTZLcx46RofnXzZ5nj4xDPcj7hNng9ppUN5Hw=";
   };
 
   patches =
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index f74c9758604d..a7d252500b69 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-WuEVLpFQlPiCYNbAGy3IIOmcbm9MertEQ4tlbd/8OqQ=";
+    hash = "sha256-VnL8rCSpNEs0NnghhgSO4k1Q+yqP5LCMZirC/hLZRO4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index b3b33cfc4bd6..db4d5cbca45f 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-Zou0l/t9dWls2GKxcU3SDPxb0RaI2emyg07xLyengDo=";
+    hash = "sha256-Wra0H43eS6kVamavR1lUeonqSIz/BAJBlhoWshDDhZ0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysmartthings/default.nix b/pkgs/development/python-modules/pysmartthings/default.nix
index 0f706ae0d733..2dc9bd80fdc6 100644
--- a/pkgs/development/python-modules/pysmartthings/default.nix
+++ b/pkgs/development/python-modules/pysmartthings/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pysmartthings";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "andrewsayre";
     repo = "pysmartthings";
     rev = "v${version}";
-    hash = "sha256-BHPua3JzCTTPPM5QfJN/aWY4iv8Z1TU888p9Y5Hfy/I=";
+    hash = "sha256-ocLJWefXGq2gk6EBi5cKP8kdNBkPiF4I4NXFAaIkAjs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix
index d51853953bf4..4dbf353e8552 100644
--- a/pkgs/development/python-modules/semgrep/common.nix
+++ b/pkgs/development/python-modules/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.74.0";
+  version = "1.104.0";
 
-  srcHash = "sha256-PH0fTT6n6o3Jtuq+cyyRb048Tuv3VGNduCZCEKTXMrE=";
+  srcHash = "sha256-rVBnjG+g7OaOQ8LYCurqNC2dYY/Dm4hdocgotc4lADg=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "9f38254957c50c68ea402eebae0f7aa40dd01cbf";
-      hash = "sha256-/P8b7nSwNZSrm7dUFkehDaGz+r+bofrlFfuIo4U7tJM=";
+      rev = "5e0c767ec323f3f2356d3bf8dbdf7c7836497d8a";
+      hash = "sha256-RvkUbS+q/UqkKLDBCvDWkuRYDzWXp+JonFE7qVkEsY8=";
     };
   };
 
@@ -24,20 +24,20 @@ rec {
   # on github releases
   core = {
     x86_64-linux = {
-      platform = "any";
-      hash = "sha256-ZA5KlbSLkC0IJGqyK0XhuDKRx53987vf53vSM0zwD9k=";
+      platform = "musllinux_1_0_x86_64.manylinux2014_x86_64";
+      hash = "sha256-Qn97ZJI1//n47z/qX87AuIWRvvXurwH26C/vBrZ12gc=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-aHq87uzk9TtnlMDfAS6492ocXRJSHdBinng0hu2xLas=";
+      hash = "sha256-vuLuxsqnaPSbcVuwyhRRTTTwDVCZvOkRJURZUKnh/9I=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-OorDXQ0oYHV8aPu9o1dQAd22u78/EjpUWA2yPYG0S9E=";
+      hash = "sha256-QWESQQyBzyupzC1V5zs1GgZBtHEUgayvcKwDn+5pXUc=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-g8sFLh2V9NDIvAZOaDhMpFxKqbS/S1eKep4v1vlOOo8=";
+      hash = "sha256-gkX82X79L+v5A1Mby6sCqXcx79fgJGIfmRdARtULmUc=";
     };
   };
 
diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix
index 939454a71975..ad8ec602008d 100644
--- a/pkgs/development/python-modules/semgrep/default.nix
+++ b/pkgs/development/python-modules/semgrep/default.nix
@@ -7,6 +7,31 @@
 
 , pytestCheckHook
 , git
+
+# python packages
+, attrs
+, boltons
+, colorama
+, click
+, click-option-group
+, glom
+, requests
+, rich
+, ruamel-yaml
+, tqdm
+, packaging
+, jsonschema
+, wcmatch
+, peewee
+, defusedxml
+, urllib3
+, typing-extensions
+, python-lsp-jsonrpc
+, tomli
+, opentelemetry-api
+, opentelemetry-sdk
+, opentelemetry-exporter-otlp-proto-http
+, opentelemetry-instrumentation-requests
 }:
 
 # testing locally post build:
@@ -52,7 +77,7 @@ buildPythonPackage rec {
     "glom"
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
+  dependencies =  [
     attrs
     boltons
     colorama
@@ -72,6 +97,10 @@ buildPythonPackage rec {
     typing-extensions
     python-lsp-jsonrpc
     tomli
+    opentelemetry-api
+    opentelemetry-sdk
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-requests
   ];
 
   doCheck = true;
@@ -86,8 +115,8 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/default/e2e"
-    "tests/default/e2e-pro"
     "tests/default/e2e-pysemgrep"
+    "tests/default/e2e-other"
   ];
 
   disabledTests = [
@@ -99,6 +128,8 @@ buildPythonPackage rec {
     "TestConfigLoaderForProducts"
     # doesn't start flaky plugin correctly
     "test_debug_performance"
+    # requires .git directory
+    "clean_project_url"
   ];
 
   preCheck = ''
@@ -108,11 +139,6 @@ buildPythonPackage rec {
     # tests need access to `semgrep-core`
     export OLD_PATH="$PATH"
     export PATH="$PATH:${semgrepBinPath}"
-
-    # we're in cli
-    # replace old semgrep with wrapped one
-    rm ./bin/semgrep
-    ln -s $out/bin/semgrep ./bin/semgrep
   '';
 
   postCheck = ''
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index fd5f1b37a445..5a598631ceae 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       inherit version;
       format = "wheel";
       dist = python;
-      python = "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311";
+      python = "cp39.cp310.cp311.py39.py310.py311";
       inherit (data) platform hash;
     };
 
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index c9bb1ba1a15f..5a29ef8f1aac 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -16,8 +16,8 @@ let
       hash = "sha256-hHIWjD4f0L/yh+aUsFP8y78gV5o/+VJrYzO+q432Wo0=";
     };
     "10" = {
-      version = "10.5.2";
-      hash = "sha256-eamNqpAki1CBXjFGB5DxGMVv4JkRM3CCbKoBU75tq6U=";
+      version = "10.6.1";
+      hash = "sha256-gSBIRaOWliqcS0nMLWyvu0mnWGUtPCQ/ISjLxjgIT+I=";
     };
   };
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 0203c86671f9..283becae93a8 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.3.0";
+  version = "2025.3.1";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 59ace4cff11a..76073d9b21d9 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -383,7 +383,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.3.0";
+  hassVersion = "2025.3.1";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -404,13 +404,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-zMsJ/YAwMIdLDF256rxj63QsZD26p71SgYpf4zwzD1A=";
+    hash = "sha256-tM23n0/98kzB7fqCNZ0+qREQnLxlc6oBmPAKv//TDNk=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-jsRIStPIbWXj24qjh9ZxH0QPN+zUOZeP6efRGYovUms=";
+    hash = "sha256-s+4l9FZQ5A0cvPXXypxzxzpMgrEnrgogzH/S7VwUZe4=";
   };
 
   build-system = with python.pkgs; [
@@ -554,6 +554,7 @@ python.pkgs.buildPythonApplication rec {
       # some components are needed even if tests in tests/components are disabled
       "default_config"
       "hue"
+      "qwikswitch"
     ];
 
   pytestFlagsArray = [
@@ -566,17 +567,6 @@ python.pkgs.buildPythonApplication rec {
     "--showlocals"
     # AssertionError: assert 1 == 0
     "--deselect tests/test_config.py::test_merge"
-    # AssertionError: assert 6 == 5
-    "--deselect=tests/helpers/test_translation.py::test_caching"
-    # assert "Detected that integration 'hue' attempted to create an asyncio task from a thread at homeassistant/components/hue/light.py, line 23
-    "--deselect=tests/util/test_async.py::test_create_eager_task_from_thread_in_integration"
-    # Services were renamed to Actions in language strings, but the tests are lagging behind
-    "--deselect=tests/test_core.py::test_serviceregistry_service_that_not_exists"
-    "--deselect=tests/test_core.py::test_services_call_return_response_requires_blocking"
-    "--deselect=tests/test_core.py::test_serviceregistry_return_response_arguments"
-    "--deselect=tests/helpers/test_script.py::test_parallel_error"
-    "--deselect=tests/helpers/test_script.py::test_propagate_error_service_not_found"
-    "--deselect=tests/helpers/test_script.py::test_continue_on_error_automation_issue"
     # checks whether pip is installed
     "--deselect=tests/util/test_package.py::test_check_package_fragment"
     # tests are located in tests/
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 8ff4f51f2a4a..54b4b316e9ff 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20250305.0";
+  version = "20250306.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-tzyJp1aKOXnmANR7p6C3rtC90VkGntURiaRgIjL8dDM=";
+    hash = "sha256-Nsh5zCyD72bjQ89BW5lmHdyWW9rxo+v2AW5fSOux/OA=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index 3fdec67a3507..a92f6174345b 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.220";
+  version = "0.13.222";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     rev = "refs/tags/${version}";
-    hash = "sha256-p/pC0dgKRVPlu3kOiSmeGhbfRW7cPm5W0Lr38XWlcnQ=";
+    hash = "sha256-a7bRxG2rDfxJ/1kfPQFXLaGxlGS6vuxADbJhs5qytkM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index cea002e1612f..42258f65d400 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.3.0";
+  version = "2025.3.1";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4Chn8PRvTERiTQqhp3ScoV6woISvEWHFoohCKzLJCP8=";
+    hash = "sha256-EtgSd9TXyGjNvFYB7klcdJNhiVQsAfF18b6J35/7bUM=";
   };
 
   build-system = [
diff --git a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
index a5b320423d25..d84cb5d931dd 100644
--- a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postgres_exporter";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "postgres_exporter";
     rev = "v${version}";
-    sha256 = "sha256-M7CnAbyAeVLfFyPDGYOCubcE7i/caQ0MDLi3JKeN6FA=";
+    sha256 = "sha256-F7nLz6NkvWSeZTzjo1/wNWCPn3Veo9/SkJdlFRwdlo4=";
   };
 
   vendorHash = "sha256-Dl44VTaDE90nhOU0zxZvd/zrVe8bLRnT16ISqJMpzpU=";
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 84c8d7ce74bb..808b04d6687e 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   meson,
   ninja,
   pkg-config,
@@ -201,15 +202,26 @@ let
     in
     stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.23.16";
+      version = "0.23.17";
 
       src = fetchFromGitHub {
         owner = "MusicPlayerDaemon";
         repo = "MPD";
         rev = "v${version}";
-        sha256 = "sha256-0To+V+4xLjymGpRSpsyE/Une5uUpCEiAg+d041guPA0=";
+        sha256 = "sha256-1+eVLvwMp6mR38y39wV73rhPA998ip7clyyKcJ008z0=";
       };
 
+      patches = [
+        # Revert of https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43
+        # We use a yajl fork that fixed this issue in the pkg-config manifest
+        (fetchpatch2 {
+          name = "revert-yajl-include-fix.patch";
+          url = "https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43.diff";
+          hash = "sha256-p/sYvWpr0GTw8gjt+W9FQysadOK/QOUp81ykTI50UYg=";
+          revert = true;
+        })
+      ];
+
       buildInputs =
         [
           glib
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index e548337948ab..4ca3038d410d 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
       perlPackages.XMLParser
       m4
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ glib ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ glib ]
     # gstreamer plugin discovery requires wrapping
     ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook3;
 
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
       fftwFloat
       check
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       glib
       dbus
     ]
@@ -139,6 +139,8 @@ stdenv.mkDerivation rec {
       Cocoa
       CoreServices
       CoreAudio
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD) [
       libintl
     ]
     ++ lib.optionals (!libOnly) (
@@ -179,6 +181,13 @@ stdenv.mkDerivation rec {
       ++ lib.optional zeroconfSupport avahi
     );
 
+  env =
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/3848
+        NIX_LDFLAGS = "--undefined-version";
+      };
+
   mesonFlags =
     [
       (lib.mesonEnable "alsa" (!libOnly && alsaSupport))
@@ -274,7 +283,9 @@ stdenv.mkDerivation rec {
       done
     '';
 
-  passthru.tests = { inherit (nixosTests) pulseaudio; };
+  passthru.tests = {
+    inherit (nixosTests) pulseaudio;
+  };
 
   meta = {
     description = "Sound server for POSIX and Win32 systems";
diff --git a/pkgs/tools/misc/qt6ct/default.nix b/pkgs/tools/misc/qt6ct/default.nix
index a6495283da19..5fb7301afd4e 100644
--- a/pkgs/tools/misc/qt6ct/default.nix
+++ b/pkgs/tools/misc/qt6ct/default.nix
@@ -1,12 +1,12 @@
 {
+  cmake,
+  fetchFromGitLab,
   lib,
-  stdenv,
-  fetchFromGitHub,
   qtbase,
   qtsvg,
-  qtwayland,
-  qmake,
   qttools,
+  qtwayland,
+  stdenv,
   wrapQtAppsHook,
 }:
 
@@ -14,15 +14,16 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "qt6ct";
   version = "0.10";
 
-  src = fetchFromGitHub {
-    owner = "ilya-fedin";
+  src = fetchFromGitLab {
+    domain = "www.opencode.net";
+    owner = "trialuser";
     repo = "qt6ct";
     tag = finalAttrs.version;
-    hash = "sha256-ePY+BEpEcAq11+pUMjQ4XG358x3bXFQWwI1UAi+KmLo=";
+    hash = "sha256-o2k/b4AGiblS1CkNInqNrlpM1Y7pydIJzEVgVd3ao50=";
   };
 
   nativeBuildInputs = [
-    qmake
+    cmake
     qttools
     wrapQtAppsHook
   ];
@@ -33,15 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
     qtwayland
   ];
 
-  qmakeFlags = [
-    "LRELEASE_EXECUTABLE=${lib.getDev qttools}/bin/lrelease"
-    "PLUGINDIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
-    "LIBDIR=${placeholder "out"}/lib"
-  ];
+  postPatch = ''
+    substituteInPlace src/qt6ct-qtplugin/CMakeLists.txt src/qt6ct-style/CMakeLists.txt \
+      --replace-fail "\''${PLUGINDIR}" "$out/${qtbase.qtPluginPrefix}"
+  '';
 
   meta = {
     description = "Qt6 Configuration Tool";
-    homepage = "https://github.com/ilya-fedin/qt6ct";
+    homepage = "https://www.opencode.net/trialuser/qt6ct";
     platforms = lib.platforms.linux;
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index bf342aba8ffb..1452f282549d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -933,7 +933,7 @@ mapAliases {
   matrique = throw "'matrique' has been renamed to/replaced by 'spectral'"; # Converted to throw 2024-10-17
   matrix-sliding-sync = throw "matrix-sliding-sync has been removed as matrix-synapse 114.0 and later covers its functionality"; # Added 2024-10-20
   matrix-synapse-tools = recurseIntoAttrs {
-    rust-synapse-state-compress = lib.warnOnInstantiate "`matrix-synapse-tools.rust-synapse-compress-state` has been renamed to `rust-synapse-compress-state`" rust-synapse-state-compress;
+    rust-synapse-compress-state = lib.warnOnInstantiate "`matrix-synapse-tools.rust-synapse-compress-state` has been renamed to `rust-synapse-compress-state`" rust-synapse-compress-state;
     synadm = lib.warnOnInstantiate "`matrix-synapse-tools.synadm` has been renamed to `synadm`" synadm;
   }; # Added 2025-02-20
   maui-nota = libsForQt5.mauiPackages.nota; # added 2022-05-17
@@ -1183,6 +1183,7 @@ mapAliases {
   poac = cabinpkg; # Added 2025-01-22
   poretools = throw "poretools has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-06-03
   powerdns = pdns; # Added 2022-03-28
+  projectm = throw "Since version 4, 'projectm' has been split into 'libprojectm' (the library) and 'projectm-sdl-cpp' (the SDL2 frontend). ProjectM 3 has been moved to 'projectm_3'"; # Added 2024-11-10
 
   # postgresql plugins
   cstore_fdw = postgresqlPackages.cstore_fdw;
@@ -1312,6 +1313,7 @@ mapAliases {
   rtx = mise; # Added 2024-01-05
   runCommandNoCC = runCommand;
   runCommandNoCCLocal = runCommandLocal;
+  rust-synapse-state-compress = rust-synapse-compress-state;
   rustc-wasm32 = rustc; # Added 2023-12-01
   rustfilt = throw "'rustfilt' has been removed due to lack of upstream maintenance"; # Added 2025-01-26
   rustic-rs = rustic; # Added 2024-08-02
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 46af20ee6651..d580b6bc0808 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4692,7 +4692,7 @@ with pkgs;
     jdk = jdk8;
   };
 
-  projectm = libsForQt5.callPackage ../applications/audio/projectm { };
+  projectm_3 = libsForQt5.callPackage ../applications/audio/projectm_3 { };
 
   proxmark3 = libsForQt5.callPackage ../tools/security/proxmark3/default.nix {
     inherit (darwin.apple_sdk_11_0.frameworks) Foundation AppKit;