diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4e9e663963cb..340a24cac087 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5028,6 +5028,12 @@
     github = "definfo";
     githubId = 66514911;
   };
+  deftdawg = {
+    name = "DeftDawg";
+    github = "deftdawg";
+    email = "deftdawg@gmail.com";
+    githubId = 4991612;
+  };
   deifactor = {
     name = "Ash Zahlen";
     email = "ext0l@riseup.net";
@@ -10747,6 +10753,13 @@
     githubId = 46386452;
     name = "Jeroen Wijenbergh";
   };
+  jwillikers = {
+    email = "jordan@jwillikers.com";
+    github = "jwillikers";
+    githubId = 19399197;
+    name = "Jordan Williams";
+    keys = [ { fingerprint = "A6AB 406A F5F1 DE02 CEA3 B6F0 9FB4 2B0E 7F65 7D8C"; } ];
+  };
   jwygoda = {
     email = "jaroslaw@wygoda.me";
     github = "jwygoda";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 9155b8f04715..1d0c8e509738 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -17,6 +17,10 @@
     [2.24](https://nix.dev/manual/nix/latest/release-notes/rl-2.24).
   Notable changes include improvements to Git fetching, documentation comment support in `nix-repl> :doc`, as well as many quality of life improvements.
 
+- This will be the last release of Nixpkgs to support versions of CUDA prior to CUDA 12.0.
+  These versions only work with old compiler versions that will be unsupported by the time of the Nixpkgs 25.05 release.
+  In future, users should expect CUDA versions to be dropped as the compiler versions they require leave upstream support windows.
+
 - Convenience options for `amdgpu`, open source driver for Radeon cards, is now available under `hardware.amdgpu`.
 
 - [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured as `hardware.amdgpu.amdvlk` option.
@@ -128,6 +132,8 @@
 
 - [Gotenberg](https://gotenberg.dev), an API server for converting files to PDFs that can be used alongside Paperless-ngx. Available as [services.gotenberg](options.html#opt-services.gotenberg).
 
+- [Suricata](https://suricata.io/), a free and open source, mature, fast and robust network threat detection engine. Available as [services.suricata](options.html#opt-services.suricata).
+
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
 
 - [MenhirLib](https://gitlab.inria.fr/fpottier/menhir/-/tree/master/coq-menhirlib) A support library for verified Coq parsers produced by Menhir.
@@ -163,6 +169,8 @@
 
 - [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).
 
+- [Fedimint](https://github.com/fedimint/fedimint), a module based system for building federated applications (Federated E-Cash Mint). Available as [services.fedimintd](#opt-services.fedimintd).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
@@ -618,6 +626,8 @@
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.
 
+- ZFS now imports its pools in `postResumeCommands` rather than `postDeviceCommands`. If you had `postDeviceCommands` scripts that depended on ZFS pools being imported, those now need to be in `postResumeCommands`.
+
 ## Detailed migration information {#sec-release-24.11-migration}
 
 ### `sound` options removal {#sec-release-24.11-migration-sound}
diff --git a/nixos/modules/config/terminfo.nix b/nixos/modules/config/terminfo.nix
index bf8bc43d6bb5..78d4847092d5 100644
--- a/nixos/modules/config/terminfo.nix
+++ b/nixos/modules/config/terminfo.nix
@@ -24,25 +24,35 @@
 
   config = {
 
+    # This should not contain packages that are broken or can't build, since it
+    # will break this expression
+    #
+    # Currently broken packages:
+    # - contour
+    #
     # can be generated with:
     # lib.attrNames (lib.filterAttrs
     #  (_: drv: (builtins.tryEval (lib.isDerivation drv && drv ? terminfo)).value)
     #  pkgs)
-    environment.systemPackages = lib.mkIf config.environment.enableAllTerminfo (map (x: x.terminfo) (with pkgs.pkgsBuildBuild; [
-      alacritty
-      contour
-      foot
-      kitty
-      mtm
-      rio
-      rxvt-unicode-unwrapped
-      rxvt-unicode-unwrapped-emoji
-      st
-      termite
-      tmux
-      wezterm
-      yaft
-    ]));
+    environment.systemPackages = lib.mkIf config.environment.enableAllTerminfo (
+      map (x: x.terminfo) (
+        with pkgs.pkgsBuildBuild;
+        [
+          alacritty
+          foot
+          kitty
+          mtm
+          rio
+          rxvt-unicode-unwrapped
+          rxvt-unicode-unwrapped-emoji
+          st
+          termite
+          tmux
+          wezterm
+          yaft
+        ]
+      )
+    );
 
     environment.pathsToLink = [
       "/share/terminfo"
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 2aa8899e5b35..63abf88cab09 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -8,7 +8,7 @@ let
    * to a menuentry for use in grub.
    *
    *  * defaults: {name, image, params, initrd}
-   *  * options: [ option... ]
+   *  * options: [ option... ]
    *  * option: {name, params, class}
    */
   menuBuilderGrub2 =
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fe67d39e70f9..dabeebb34e1e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1031,6 +1031,7 @@
   ./services/networking/expressvpn.nix
   ./services/networking/fakeroute.nix
   ./services/networking/fastnetmon-advanced.nix
+  ./services/networking/fedimintd.nix
   ./services/networking/ferm.nix
   ./services/networking/firefox-syncserver.nix
   ./services/networking/fireqos.nix
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index f7774e685f7e..a9cb396f13fd 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -344,7 +344,7 @@ let
       serviceConfig = commonServiceConfig // {
         Group = data.group;
 
-        # Let's Encrypt Failed Validation Limit allows 5 retries per hour, per account, hostname and hour.
+        # Let's Encrypt Failed Validation Limit allows 5 retries per hour, per account, hostname and hour.
         # This avoids eating them all up if something is misconfigured upon the first try.
         RestartSec = 15 * 60;
 
diff --git a/nixos/modules/services/monitoring/datadog-agent.nix b/nixos/modules/services/monitoring/datadog-agent.nix
index 5ac98bdf0382..04232b3c9346 100644
--- a/nixos/modules/services/monitoring/datadog-agent.nix
+++ b/nixos/modules/services/monitoring/datadog-agent.nix
@@ -288,7 +288,7 @@ in {
         path = [ ];
         script = ''
           export DD_API_KEY=$(head -n 1 ${cfg.apiKeyFile})
-          ${datadogPkg}/bin/trace-agent -config /etc/datadog-agent/datadog.yaml
+          ${datadogPkg}/bin/trace-agent --config /etc/datadog-agent/datadog.yaml
         '';
       });
 
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix b/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
index ba438ea74a3b..9028d1fd5a66 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
@@ -21,8 +21,8 @@ in
     };
     leasesPath = mkOption {
       type = types.path;
-      default = "/var/lib/misc/dnsmasq.leases";
-      example = "/var/lib/dnsmasq/dnsmasq.leases";
+      default = "/var/lib/dnsmasq/dnsmasq.leases";
+      example = "/var/lib/misc/dnsmasq.leases";
       description = ''
         Path to the `dnsmasq.leases` file.
       '';
diff --git a/nixos/modules/services/networking/fedimintd.nix b/nixos/modules/services/networking/fedimintd.nix
new file mode 100644
index 000000000000..1ede3a50553d
--- /dev/null
+++ b/nixos/modules/services/networking/fedimintd.nix
@@ -0,0 +1,304 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    concatLists
+    filterAttrs
+    mapAttrs'
+    mapAttrsToList
+    mkEnableOption
+    mkIf
+    mkOption
+    mkOverride
+    mkPackageOption
+    nameValuePair
+    recursiveUpdate
+    types
+    ;
+
+  fedimintdOpts =
+    {
+      config,
+      lib,
+      name,
+      ...
+    }:
+    {
+      options = {
+        enable = mkEnableOption "fedimintd";
+
+        package = mkPackageOption pkgs "fedimint" { };
+
+        environment = mkOption {
+          type = types.attrsOf types.str;
+          description = "Extra Environment variables to pass to the fedimintd.";
+          default = {
+            RUST_BACKTRACE = "1";
+          };
+          example = {
+            RUST_LOG = "info,fm=debug";
+            RUST_BACKTRACE = "1";
+          };
+        };
+
+        p2p = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Opens port in firewall for fedimintd's p2p port";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8173;
+            description = "Port to bind on for p2p connections from peers";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "0.0.0.0";
+            description = "Address to bind on for p2p connections from peers";
+          };
+          url = mkOption {
+            type = types.str;
+            example = "fedimint://p2p.myfedimint.com";
+            description = ''
+              Public address for p2p connections from peers
+            '';
+          };
+        };
+        api = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Opens port in firewall for fedimintd's api port";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8174;
+            description = "Port to bind on for API connections relied by the reverse proxy/tls terminator.";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = "Address to bind on for API connections relied by the reverse proxy/tls terminator.";
+          };
+          url = mkOption {
+            type = types.str;
+            description = ''
+              Public URL of the API address of the reverse proxy/tls terminator. Usually starting with `wss://`.
+            '';
+          };
+        };
+        bitcoin = {
+          network = mkOption {
+            type = types.str;
+            default = "signet";
+            example = "bitcoin";
+            description = "Bitcoin network to participate in.";
+          };
+          rpc = {
+            url = mkOption {
+              type = types.str;
+              default = "http://127.0.0.1:38332";
+              example = "signet";
+              description = "Bitcoin node (bitcoind/electrum/esplora) address to connect to";
+            };
+
+            kind = mkOption {
+              type = types.str;
+              default = "bitcoind";
+              example = "electrum";
+              description = "Kind of a bitcoin node.";
+            };
+
+            secretFile = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = ''
+                If set the URL specified in `bitcoin.rpc.url` will get the content of this file added
+                as an URL password, so `http://user@example.com` will turn into `http://user:SOMESECRET@example.com`.
+
+                Example:
+
+                `/etc/nix-bitcoin-secrets/bitcoin-rpcpassword-public` (for nix-bitcoin default)
+              '';
+            };
+          };
+        };
+
+        consensus.finalityDelay = mkOption {
+          type = types.ints.unsigned;
+          default = 10;
+          description = "Consensus peg-in finality delay.";
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/fedimintd-${name}/";
+          readOnly = true;
+          description = ''
+            Path to the data dir fedimintd will use to store its data.
+            Note that due to using the DynamicUser feature of systemd, this value should not be changed
+            and is set to be read only.
+          '';
+        };
+
+        nginx = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether to configure nginx for fedimintd
+            '';
+          };
+          fqdn = mkOption {
+            type = types.str;
+            example = "api.myfedimint.com";
+            description = "Public domain of the API address of the reverse proxy/tls terminator.";
+          };
+          config = mkOption {
+            type = types.submodule (
+              recursiveUpdate (import ../web-servers/nginx/vhost-options.nix {
+                inherit config lib;
+              }) { }
+            );
+            default = { };
+            description = "Overrides to the nginx vhost section for api";
+          };
+        };
+      };
+    };
+in
+{
+  options = {
+    services.fedimintd = mkOption {
+      type = types.attrsOf (types.submodule fedimintdOpts);
+      default = { };
+      description = "Specification of one or more fedimintd instances.";
+    };
+  };
+
+  config =
+    let
+      eachFedimintd = filterAttrs (fedimintdName: cfg: cfg.enable) config.services.fedimintd;
+      eachFedimintdNginx = filterAttrs (fedimintdName: cfg: cfg.nginx.enable) eachFedimintd;
+    in
+    mkIf (eachFedimintd != { }) {
+
+      networking.firewall.allowedTCPPorts = concatLists (
+        mapAttrsToList (
+          fedimintdName: cfg:
+          (lib.optional cfg.api.openFirewall cfg.api.port ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port)
+        ) eachFedimintd
+      );
+
+      systemd.services = mapAttrs' (
+        fedimintdName: cfg:
+        (nameValuePair "fedimintd-${fedimintdName}" (
+          let
+            startScript = pkgs.writeShellScript "fedimintd-start" (
+              (
+                if cfg.bitcoin.rpc.secretFile != null then
+                  ''
+                    secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}")
+                    prefix="''${FM_BITCOIN_RPC_URL%*@*}"  # Everything before the last '@'
+                    suffix="''${FM_BITCOIN_RPC_URL##*@}"  # Everything after the last '@'
+                    FM_BITCOIN_RPC_URL="''${prefix}:''${secret}@''${suffix}"
+                  ''
+                else
+                  ""
+              )
+              + ''
+                exec ${cfg.package}/bin/fedimintd
+              ''
+            );
+          in
+          {
+            description = "Fedimint Server";
+            documentation = [ "https://github.com/fedimint/fedimint/" ];
+            wantedBy = [ "multi-user.target" ];
+            environment = lib.mkMerge [
+              {
+                FM_BIND_P2P = "${cfg.p2p.bind}:${toString cfg.p2p.port}";
+                FM_BIND_API = "${cfg.api.bind}:${toString cfg.api.port}";
+                FM_P2P_URL = cfg.p2p.url;
+                FM_API_URL = cfg.api.url;
+                FM_DATA_DIR = cfg.dataDir;
+                FM_BITCOIN_NETWORK = cfg.bitcoin.network;
+                FM_BITCOIN_RPC_URL = cfg.bitcoin.rpc.url;
+                FM_BITCOIN_RPC_KIND = cfg.bitcoin.rpc.kind;
+              }
+              cfg.environment
+            ];
+            serviceConfig = {
+              DynamicUser = true;
+
+              StateDirectory = "fedimintd-${fedimintdName}";
+              StateDirectoryMode = "0700";
+              ExecStart = startScript;
+
+              Restart = "always";
+              RestartSec = 10;
+              StartLimitBurst = 5;
+              UMask = "007";
+              LimitNOFILE = "100000";
+
+              LockPersonality = true;
+              MemoryDenyWriteExecute = true;
+              NoNewPrivileges = true;
+              PrivateDevices = true;
+              PrivateMounts = true;
+              PrivateTmp = true;
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectSystem = "full";
+              RestrictAddressFamilies = [
+                "AF_INET"
+                "AF_INET6"
+              ];
+              RestrictNamespaces = true;
+              RestrictRealtime = true;
+              SystemCallArchitectures = "native";
+              SystemCallFilter = [
+                "@system-service"
+                "~@privileged"
+              ];
+            };
+          }
+        ))
+      ) eachFedimintd;
+
+      services.nginx.virtualHosts = mapAttrs' (
+        fedimintdName: cfg:
+        (nameValuePair cfg.nginx.fqdn (
+          lib.mkMerge [
+            cfg.nginx.config
+
+            {
+              # Note: we want by default to enable OpenSSL, but it seems anything 100 and above is
+              # overriden by default value from vhost-options.nix
+              enableACME = mkOverride 99 true;
+              forceSSL = mkOverride 99 true;
+              # Currently Fedimint API only support JsonRPC on `/ws/` endpoint, so no need to handle `/`
+              locations."/ws/" = {
+                proxyPass = "http://127.0.0.1:${toString cfg.api.port}/";
+                proxyWebsockets = true;
+                extraConfig = ''
+                  proxy_pass_header Authorization;
+                '';
+              };
+            }
+          ]
+        ))
+      ) eachFedimintdNginx;
+    };
+
+  meta.maintainers = with lib.maintainers; [ dpc ];
+}
diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
new file mode 100644
index 000000000000..5473fc913ebc
--- /dev/null
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -0,0 +1,282 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.suricata;
+  pkg = cfg.package;
+  yaml = pkgs.formats.yaml { };
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    types
+    literalExpression
+    filterAttrsRecursive
+    concatStringsSep
+    strings
+    lists
+    mkIf
+    ;
+in
+{
+  meta.maintainers = with lib.maintainers; [ felbinger ];
+
+  options.services.suricata = {
+    enable = mkEnableOption "Suricata";
+
+    package = mkPackageOption pkgs "suricata" { };
+
+    configFile = mkOption {
+      type = types.path;
+      visible = false;
+      default = pkgs.writeTextFile {
+        name = "suricata.yaml";
+        text = ''
+          %YAML 1.1
+          ---
+          ${builtins.readFile (
+            yaml.generate "suricata-settings-raw.yaml" (
+              filterAttrsRecursive (name: value: value != null) cfg.settings
+            )
+          )}
+        '';
+      };
+      description = ''
+        Configuration file for suricata.
+
+        It is not usual to override the default values; it is recommended to use `settings`.
+        If you want to include extra configuration to the file, use the `settings.includes`.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule (import ./settings.nix { inherit config lib yaml; });
+      example = literalExpression ''
+        vars.address-groups.HOME_NET = "192.168.178.0/24";
+        outputs = [
+          {
+            fast = {
+              enabled = true;
+              filename = "fast.log";
+              append = "yes";
+            };
+          }
+          {
+            eve-log = {
+              enabled = true;
+              filetype = "regular";
+              filename = "eve.json";
+              community-id = true;
+              types = [
+                {
+                  alert.tagged-packets = "yes";
+                }
+              ];
+            };
+          }
+        ];
+        af-packet = [
+          {
+            interface = "eth0";
+            cluster-id = "99";
+            cluster-type = "cluster_flow";
+            defrag = "yes";
+          }
+          {
+            interface = "default";
+          }
+        ];
+        af-xdp = [
+          {
+            interface = "eth1";
+          }
+        ];
+        dpdk.interfaces = [
+          {
+            interface = "eth2";
+          }
+        ];
+        pcap = [
+          {
+            interface = "eth3";
+          }
+        ];
+        app-layer.protocols = {
+          telnet.enabled = "yes";
+          dnp3.enabled = "yes";
+          modbus.enabled = "yes";
+        };
+      '';
+      description = "Suricata settings";
+    };
+
+    enabledSources = mkOption {
+      type = types.listOf types.str;
+      # see: nix-shell -p suricata python3Packages.pyyaml --command 'suricata-update list-sources'
+      default = [
+        "et/open"
+        "etnetera/aggressive"
+        "stamus/lateral"
+        "oisf/trafficid"
+        "tgreen/hunting"
+        "sslbl/ja3-fingerprints"
+        "sslbl/ssl-fp-blacklist"
+        "malsilo/win-malware"
+        "pawpatrules"
+      ];
+      description = ''
+        List of sources that should be enabled.
+        Currently sources which require a secret-code are not supported.
+      '';
+    };
+
+    disabledRules = mkOption {
+      type = types.listOf types.str;
+      # protocol dnp3 seams to be disabled, which causes the signature evaluation to fail, so we disable the
+      # dnp3 rules, see https://github.com/OISF/suricata/blob/master/rules/dnp3-events.rules for more details
+      default = [
+        "2270000"
+        "2270001"
+        "2270002"
+        "2270003"
+        "2270004"
+      ];
+      description = ''
+        List of rules that should be disabled.
+      '';
+    };
+  };
+
+  config =
+    let
+      captureInterfaces =
+        let
+          inherit (lists) unique optionals;
+        in
+        unique (
+          map (e: e.interface) (
+            (optionals (cfg.settings.af-packet != null) cfg.settings.af-packet)
+            ++ (optionals (cfg.settings.af-xdp != null) cfg.settings.af-xdp)
+            ++ (optionals (
+              cfg.settings.dpdk != null && cfg.settings.dpdk.interfaces != null
+            ) cfg.settings.dpdk.interfaces)
+            ++ (optionals (cfg.settings.pcap != null) cfg.settings.pcap)
+          )
+        );
+    in
+    mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = (builtins.length captureInterfaces) > 0;
+          message = ''
+            At least one capture interface must be configured:
+            - `services.suricata.settings.af-packet`
+            - `services.suricata.settings.af-xdp`
+            - `services.suricata.settings.dpdk.interfaces`
+            - `services.suricata.settings.pcap`
+          '';
+        }
+      ];
+
+      boot.kernelModules = mkIf (cfg.settings.af-packet != null) [ "af_packet" ];
+
+      users = {
+        groups.${cfg.settings.run-as.group} = { };
+        users.${cfg.settings.run-as.user} = {
+          group = cfg.settings.run-as.group;
+          isSystemUser = true;
+        };
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${cfg.settings."default-log-dir"} 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
+        "d /var/lib/suricata 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
+        "d ${cfg.settings."default-rule-path"} 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
+      ];
+
+      systemd.services = {
+        suricata-update = {
+          description = "Update Suricata Rules";
+          wantedBy = [ "multi-user.target" ];
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+
+          script =
+            let
+              python = pkgs.python3.withPackages (ps: with ps; [ pyyaml ]);
+              enabledSourcesCmds = map (
+                src: "${python.interpreter} ${pkg}/bin/suricata-update enable-source ${src}"
+              ) cfg.enabledSources;
+            in
+            ''
+              ${concatStringsSep "\n" enabledSourcesCmds}
+              ${python.interpreter} ${pkg}/bin/suricata-update update-sources
+              ${python.interpreter} ${pkg}/bin/suricata-update update --suricata-conf ${cfg.configFile} --no-test \
+                --disable-conf ${pkgs.writeText "suricata-disable-conf" "${concatStringsSep "\n" cfg.disabledRules}"}
+            '';
+          serviceConfig = {
+            Type = "oneshot";
+
+            PrivateTmp = true;
+            PrivateDevices = true;
+            PrivateIPC = true;
+
+            DynamicUser = true;
+            User = cfg.settings.run-as.user;
+            Group = cfg.settings.run-as.group;
+
+            ReadOnlyPaths = cfg.configFile;
+            ReadWritePaths = [
+              "/var/lib/suricata"
+              cfg.settings."default-rule-path"
+            ];
+          };
+        };
+        suricata = {
+          description = "Suricata";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "suricata-update.service" ];
+          serviceConfig =
+            let
+              interfaceOptions = strings.concatMapStrings (interface: " -i ${interface}") captureInterfaces;
+            in
+            {
+              ExecStartPre = "!${pkg}/bin/suricata -c ${cfg.configFile} -T";
+              ExecStart = "!${pkg}/bin/suricata -c ${cfg.configFile}${interfaceOptions}";
+              Restart = "on-failure";
+
+              User = cfg.settings.run-as.user;
+              Group = cfg.settings.run-as.group;
+
+              NoNewPrivileges = true;
+              PrivateTmp = true;
+              PrivateDevices = true;
+              PrivateIPC = true;
+              ProtectSystem = "strict";
+              DevicePolicy = "closed";
+              LockPersonality = true;
+              MemoryDenyWriteExecute = true;
+              ProtectHostname = true;
+              ProtectProc = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectControlGroups = true;
+              ProcSubset = "pid";
+              RestrictNamespaces = true;
+              RestrictRealtime = true;
+              RestrictSUIDSGID = true;
+              SystemCallArchitectures = "native";
+              RemoveIPC = true;
+
+              ReadOnlyPaths = cfg.configFile;
+              ReadWritePaths = cfg.settings."default-log-dir";
+              RuntimeDirectory = "suricata";
+            };
+        };
+      };
+    };
+}
diff --git a/nixos/modules/services/networking/suricata/settings.nix b/nixos/modules/services/networking/suricata/settings.nix
new file mode 100644
index 000000000000..f96d78ca66d5
--- /dev/null
+++ b/nixos/modules/services/networking/suricata/settings.nix
@@ -0,0 +1,625 @@
+{
+  lib,
+  config,
+  yaml,
+  ...
+}:
+let
+  cfg = config.services.suricata;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    literalExpression
+    ;
+  mkDisableOption =
+    name:
+    mkEnableOption name
+    // {
+      default = true;
+      example = false;
+    };
+in
+{
+  freeformType = yaml.type;
+  options = {
+    vars = mkOption {
+      type = types.nullOr (
+        types.submodule {
+          options = {
+            address-groups = mkOption {
+              type = (
+                types.submodule {
+                  options = {
+                    HOME_NET = mkOption { default = "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"; };
+                    EXTERNAL_NET = mkOption { default = "!$HOME_NET"; };
+                    HTTP_SERVERS = mkOption { default = "$HOME_NET"; };
+                    SMTP_SERVERS = mkOption { default = "$HOME_NET"; };
+                    SQL_SERVERS = mkOption { default = "$HOME_NET"; };
+                    DNS_SERVERS = mkOption { default = "$HOME_NET"; };
+                    TELNET_SERVERS = mkOption { default = "$HOME_NET"; };
+                    AIM_SERVERS = mkOption { default = "$EXTERNAL_NET"; };
+                    DC_SERVERS = mkOption { default = "$HOME_NET"; };
+                    DNP3_SERVER = mkOption { default = "$HOME_NET"; };
+                    DNP3_CLIENT = mkOption { default = "$HOME_NET"; };
+                    MODBUS_CLIENT = mkOption { default = "$HOME_NET"; };
+                    MODBUS_SERVER = mkOption { default = "$HOME_NET"; };
+                    ENIP_CLIENT = mkOption { default = "$HOME_NET"; };
+                    ENIP_SERVER = mkOption { default = "$HOME_NET"; };
+                  };
+                }
+              );
+              default = { };
+              example = {
+                HOME_NET = "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]";
+                EXTERNAL_NET = "!$HOME_NET";
+                HTTP_SERVERS = "$HOME_NET";
+                SMTP_SERVERS = "$HOME_NET";
+                SQL_SERVERS = "$HOME_NET";
+                DNS_SERVERS = "$HOME_NET";
+                TELNET_SERVERS = "$HOME_NET";
+                AIM_SERVERS = "$EXTERNAL_NET";
+                DC_SERVERS = "$HOME_NET";
+                DNP3_SERVER = "$HOME_NET";
+                DNP3_CLIENT = "$HOME_NET";
+                MODBUS_CLIENT = "$HOME_NET";
+                MODBUS_SERVER = "$HOME_NET";
+                ENIP_CLIENT = "$HOME_NET";
+                ENIP_SERVER = "$HOME_NET";
+              };
+              description = ''
+                The address group variables for suricata, if not defined the
+                default value of suricata (see example) will be used.
+                Your settings will extend the predefined values in example.
+              '';
+            };
+
+            port-groups = mkOption {
+              type = with types; nullOr (attrsOf str);
+              default = {
+                HTTP_PORTS = "80";
+                SHELLCODE_PORTS = "!80";
+                ORACLE_PORTS = "1521";
+                SSH_PORTS = "22";
+                DNP3_PORTS = "20000";
+                MODBUS_PORTS = "502";
+                FILE_DATA_PORTS = "[$HTTP_PORTS,110,143]";
+                FTP_PORTS = "21";
+                GENEVE_PORTS = "6081";
+                VXLAN_PORTS = "4789";
+                TEREDO_PORTS = "3544";
+              };
+              description = ''
+                The port group variables for suricata.
+              '';
+            };
+          };
+        }
+      );
+      default = { }; # add default values to config
+    };
+
+    stats = mkOption {
+      type =
+        with types;
+        nullOr (submodule {
+          options = {
+            enable = mkEnableOption "suricata global stats";
+
+            interval = mkOption {
+              type = types.str;
+              default = "8";
+              description = ''
+                The interval field (in seconds) controls the interval at
+                which stats are updated in the log.
+              '';
+            };
+
+            decoder-events = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                Add decode events to stats
+              '';
+            };
+
+            decoder-events-prefix = mkOption {
+              type = types.str;
+              default = "decoder.event";
+              description = ''
+                Decoder event prefix in stats. Has been 'decoder' before, but that leads
+                to missing events in the eve.stats records.
+              '';
+            };
+
+            stream-events = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Add stream events as stats.
+              '';
+            };
+          };
+        });
+      default = null; # do not add to config unless specified
+    };
+
+    plugins = mkOption {
+      type = with types; nullOr (listOf path);
+      default = null;
+      description = ''
+        Plugins -- Experimental -- specify the filename for each plugin shared object
+      '';
+    };
+
+    outputs = mkOption {
+      type =
+        with types;
+        nullOr (
+          listOf (
+            attrsOf (submodule {
+              freeformType = yaml.type;
+              options = {
+                enabled = mkEnableOption "<NAME>";
+              };
+            })
+          )
+        );
+      default = null;
+      example = literalExpression ''
+        [
+          {
+            fast = {
+              enabled = "yes";
+              filename = "fast.log";
+              append = "yes";
+            };
+          }
+          {
+            eve-log = {
+              enabled = "yes";
+              filetype = "regular";
+              filename = "eve.json";
+              community-id = true;
+              types = [
+                {
+                  alert.tagged-packets = "yes";
+                }
+              ];
+            };
+          }
+        ];
+      '';
+      description = ''
+        Configure the type of alert (and other) logging you would like.
+
+        Valid values for <NAME> are e. g. `fast`, `eve-log`, `syslog`, `file-store`, ...
+        - `fast`: a line based alerts log similar to Snort's fast.log
+        - `eve-log`: Extensible Event Format (nicknamed EVE) event log in JSON format
+
+        For more details regarding the configuration, checkout the shipped suricata.yaml
+        ```shell
+        nix-shell -p suricata yq coreutils-full --command 'yq < $(dirname $(which suricata))/../etc/suricata/suricata.yaml'
+        ```
+        and the [suricata documentation](https://docs.suricata.io/en/latest/output/index.html).
+      '';
+    };
+
+    "default-log-dir" = mkOption {
+      type = types.str;
+      default = "/var/log/suricata";
+      description = ''
+        The default logging directory. Any log or output file will be placed here if it's
+        not specified with a full path name. This can be overridden with the -l command
+        line parameter.
+      '';
+    };
+
+    logging = {
+      "default-log-level" = mkOption {
+        type = types.enum [
+          "error"
+          "warning"
+          "notice"
+          "info"
+          "perf"
+          "config"
+          "debug"
+        ];
+        default = "notice";
+        description = ''
+          The default log level: can be overridden in an output section.
+          Note that debug level logging will only be emitted if Suricata was
+          compiled with the --enable-debug configure option.
+        '';
+      };
+
+      "default-log-format" = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The default output format. Optional parameter, should default to
+          something reasonable if not provided. Can be overridden in an
+          output section.  You can leave this out to get the default.
+        '';
+      };
+
+      "default-output-filter" = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          A regex to filter output.  Can be overridden in an output section.
+          Defaults to empty (no filter).
+        '';
+      };
+
+      "stacktrace-on-signal" = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Requires libunwind to be available when Suricata is configured and built.
+          If a signal unexpectedly terminates Suricata, displays a brief diagnostic
+          message with the offending stacktrace if enabled.
+        '';
+      };
+
+      outputs = {
+        console = {
+          enable = mkDisableOption "logging to console";
+        };
+        file = {
+          enable = mkDisableOption "logging to file";
+
+          level = mkOption {
+            type = types.enum [
+              "error"
+              "warning"
+              "notice"
+              "info"
+              "perf"
+              "config"
+              "debug"
+            ];
+            default = "info";
+            description = ''
+              Loglevel for logs written to the logfile
+            '';
+          };
+
+          filename = mkOption {
+            type = types.str;
+            default = "suricata.log";
+            description = ''
+              Filename of the logfile
+            '';
+          };
+
+          format = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              Logformat for logs written to the logfile
+            '';
+          };
+
+          type = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              Type of logfile
+            '';
+          };
+        };
+        syslog = {
+          enable = mkEnableOption "logging to syslog";
+
+          facility = mkOption {
+            type = types.str;
+            default = "local5";
+            description = ''
+              Facility to log to
+            '';
+          };
+
+          format = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              Logformat for logs send to syslog
+            '';
+          };
+
+          type = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              Type of logs send to syslog
+            '';
+          };
+        };
+      };
+    };
+
+    "af-packet" = mkOption {
+      type =
+        with types;
+        nullOr (
+          listOf (submodule {
+            freeformType = yaml.type;
+            options = {
+              interface = mkOption {
+                type = types.str;
+                default = null;
+              };
+            };
+          })
+        );
+      default = null;
+      description = ''
+        Linux high speed capture support
+      '';
+    };
+
+    "af-xdp" = mkOption {
+      type =
+        with types;
+        nullOr (
+          listOf (submodule {
+            freeformType = yaml.type;
+            options = {
+              interface = mkOption {
+                type = types.str;
+                default = null;
+              };
+            };
+          })
+        );
+      default = null;
+      description = ''
+        Linux high speed af-xdp capture support, see
+        [docs/capture-hardware/af-xdp](https://docs.suricata.io/en/suricata-7.0.3/capture-hardware/af-xdp.html)
+      '';
+    };
+
+    "dpdk" = mkOption {
+      type =
+        with types;
+        nullOr (submodule {
+          options = {
+            eal-params.proc-type = mkOption {
+              type = with types; nullOr str;
+              default = null;
+            };
+            interfaces = mkOption {
+              type =
+                with types;
+                nullOr (
+                  listOf (submodule {
+                    freeformType = yaml.type;
+                    options = {
+                      interface = mkOption {
+                        type = types.str;
+                        default = null;
+                      };
+                    };
+                  })
+                );
+              default = null;
+            };
+          };
+        });
+      default = null;
+      description = ''
+        DPDK capture support, see
+        [docs/capture-hardware/dpdk](https://docs.suricata.io/en/suricata-7.0.3/capture-hardware/dpdk.html)
+      '';
+    };
+
+    "pcap" = mkOption {
+      type =
+        with types;
+        nullOr (
+          listOf (submodule {
+            freeformType = yaml.type;
+            options = {
+              interface = mkOption {
+                type = types.str;
+                default = null;
+              };
+            };
+          })
+        );
+      default = null;
+      description = ''
+        Cross platform libpcap capture support
+      '';
+    };
+
+    "pcap-file".checksum-checks = mkOption {
+      type = types.enum [
+        "yes"
+        "no"
+        "auto"
+      ];
+      default = "auto";
+      description = ''
+        Possible values are:
+        - yes: checksum validation is forced
+        - no: checksum validation is disabled
+        - auto: Suricata uses a statistical approach to detect when
+        checksum off-loading is used. (default)
+        Warning: 'checksum-validation' must be set to yes to have checksum tested
+      '';
+    };
+
+    "app-layer" = mkOption {
+      type =
+        with types;
+        nullOr (submodule {
+          options = {
+            "error-policy" = mkOption {
+              type = types.enum [
+                "drop-flow"
+                "pass-flow"
+                "bypass"
+                "drop-packet"
+                "pass-packet"
+                "reject"
+                "ignore"
+              ];
+              default = "ignore";
+              description = ''
+                The error-policy setting applies to all app-layer parsers. Values can be
+                "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet", "reject" or
+                "ignore" (the default).
+              '';
+            };
+            protocols = mkOption {
+              type =
+                with types;
+                nullOr (
+                  attrsOf (submodule {
+                    freeformType = yaml.type;
+                    options = {
+                      enabled = mkOption {
+                        type = types.enum [
+                          "yes"
+                          "no"
+                          "detection-only"
+                        ];
+                        default = "no";
+                        description = ''
+                          The option "enabled" takes 3 values - "yes", "no", "detection-only".
+                          "yes" enables both detection and the parser, "no" disables both, and
+                          "detection-only" enables protocol detection only (parser disabled).
+                        '';
+                      };
+                    };
+                  })
+                );
+              default = null;
+            };
+          };
+        });
+      default = null; # do not add to config unless specified
+    };
+
+    "run-as" = {
+      user = mkOption {
+        type = types.str;
+        default = "suricata";
+        description = "Run Suricata with a specific user-id";
+      };
+      group = mkOption {
+        type = types.str;
+        default = "suricata";
+        description = "Run Suricata with a specific group-id";
+      };
+    };
+
+    "host-mode" = mkOption {
+      type = types.enum [
+        "router"
+        "sniffer-only"
+        "auto"
+      ];
+      default = "auto";
+      description = ''
+        If the Suricata box is a router for the sniffed networks, set it to 'router'. If
+        it is a pure sniffing setup, set it to 'sniffer-only'. If set to auto, the variable
+        is internally switched to 'router' in IPS mode and 'sniffer-only' in IDS mode.
+        This feature is currently only used by the reject* keywords.
+      '';
+    };
+
+    "unix-command" = mkOption {
+      type =
+        with types;
+        nullOr (submodule {
+          options = {
+            enabled = mkOption {
+              type = types.either types.bool (types.enum [ "auto" ]);
+              default = "auto";
+            };
+            filename = mkOption {
+              type = types.path;
+              default = "/run/suricata/suricata-command.socket";
+            };
+          };
+        });
+      default = { };
+      description = ''
+        Unix command socket that can be used to pass commands to Suricata.
+        An external tool can then connect to get information from Suricata
+        or trigger some modifications of the engine. Set enabled to yes
+        to activate the feature. In auto mode, the feature will only be
+        activated in live capture mode. You can use the filename variable to set
+        the file name of the socket.
+      '';
+    };
+
+    "exception-policy" = mkOption {
+      type = types.enum [
+        "auto"
+        "drop-packet"
+        "drop-flow"
+        "reject"
+        "bypass"
+        "pass-packet"
+        "pass-flow"
+        "ignore"
+      ];
+      default = "auto";
+      description = ''
+        Define a common behavior for all exception policies.
+        In IPS mode, the default is drop-flow. For cases when that's not possible, the
+        engine will fall to drop-packet. To fallback to old behavior (setting each of
+        them individually, or ignoring all), set this to ignore.
+        All values available for exception policies can be used, and there is one
+        extra option: auto - which means drop-flow or drop-packet (as explained above)
+        in IPS mode, and ignore in IDS mode. Exception policy values are: drop-packet,
+        drop-flow, reject, bypass, pass-packet, pass-flow, ignore (disable).
+      '';
+    };
+
+    "default-rule-path" = mkOption {
+      type = types.path;
+      default = "/var/lib/suricata/rules";
+      description = "Path in which suricata-update managed rules are stored by default";
+    };
+
+    "rule-files" = mkOption {
+      type = types.listOf types.str;
+      default = [ "suricata.rules" ];
+      description = "Files to load suricata-update managed rules, relative to 'default-rule-path'";
+    };
+
+    "classification-file" = mkOption {
+      type = types.str;
+      default = "/var/lib/suricata/rules/classification.config";
+      description = "Suricata classification configuration file";
+    };
+
+    "reference-config-file" = mkOption {
+      type = types.str;
+      default = "${cfg.package}/etc/suricata/reference.config";
+      description = "Suricata reference configuration file";
+    };
+
+    "threshold-file" = mkOption {
+      type = types.str;
+      default = "${cfg.package}/etc/suricata/threshold.config";
+      description = "Suricata threshold configuration file";
+    };
+
+    includes = mkOption {
+      type = with types; nullOr (listOf path);
+      default = null;
+      description = ''
+        Files to include in the suricata configuration. See
+        [docs/configuration/suricata-yaml](https://docs.suricata.io/en/suricata-7.0.3/configuration/suricata-yaml.html)
+        for available options.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 8d58470c51f5..fcaca9244c76 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1020,7 +1020,7 @@ in {
           '';
           serviceConfig.Type = "oneshot";
           serviceConfig.User = "nextcloud";
-          # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
+          # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
           # an automatic creation of the database user.
           environment.NC_setup_create_db_user = lib.mkIf (nextcloudGreaterOrEqualThan "26") "false";
         };
diff --git a/nixos/modules/services/web-apps/pixelfed.nix b/nixos/modules/services/web-apps/pixelfed.nix
index 46d671f8504b..62db479da3d4 100644
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@@ -406,7 +406,7 @@ in {
         # is unnecessary as it's part of the installPhase of pixelfed.
 
         # Install Horizon
-        # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish
+        # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish
 
         # Perform the first migration.
         [[ ! -f ${cfg.dataDir}/.initial-migration ]] && pixelfed-manage migrate --force && touch ${cfg.dataDir}/.initial-migration
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index a4f00be887be..710a5cb72910 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -407,7 +407,6 @@ in {
     ''
       import time
 
-
       TOTAL_RETRIES = 20
 
 
@@ -428,6 +427,16 @@ in {
 
               return retries + 1
 
+          def protect(self, func):
+              def wrapper(*args, retries: int = 0, **kwargs):
+                  try:
+                      return func(*args, **kwargs)
+                  except Exception as err:
+                      retries = self.handle_fail(retries, err.args)
+                      return wrapper(*args, retries=retries, **kwargs)
+
+              return wrapper
+
 
       backoff = BackoffTracker()
 
@@ -437,11 +446,13 @@ in {
           # quickly switch between derivations
           root_specs = "/tmp/specialisation"
           node.execute(
-            f"test -e {root_specs}"
-            f" || ln -s $(readlink /run/current-system)/specialisation {root_specs}"
+              f"test -e {root_specs}"
+              f" || ln -s $(readlink /run/current-system)/specialisation {root_specs}"
           )
 
-          switcher_path = f"/run/current-system/specialisation/{name}/bin/switch-to-configuration"
+          switcher_path = (
+              f"/run/current-system/specialisation/{name}/bin/switch-to-configuration"
+          )
           rc, _ = node.execute(f"test -e '{switcher_path}'")
           if rc > 0:
               switcher_path = f"/tmp/specialisation/{name}/bin/switch-to-configuration"
@@ -465,38 +476,45 @@ in {
               actual_issuer = node.succeed(
                   f"openssl x509 -noout -issuer -in /var/lib/acme/{cert_name}/{fname}"
               ).partition("=")[2]
-              print(f"{fname} issuer: {actual_issuer}")
-              assert issuer.lower() in actual_issuer.lower()
+              assert (
+                  issuer.lower() in actual_issuer.lower()
+              ), f"{fname} issuer mismatch. Expected {issuer} got {actual_issuer}"
 
 
       # Ensure cert comes before chain in fullchain.pem
       def check_fullchain(node, cert_name):
-          subject_data = node.succeed(
-              f"openssl crl2pkcs7 -nocrl -certfile /var/lib/acme/{cert_name}/fullchain.pem"
-              " | openssl pkcs7 -print_certs -noout"
+          cert_file = f"/var/lib/acme/{cert_name}/fullchain.pem"
+          num_certs = node.succeed(f"grep -o 'END CERTIFICATE' {cert_file}")
+          assert len(num_certs.strip().split("\n")) > 1, "Insufficient certs in fullchain.pem"
+
+          first_cert_data = node.succeed(
+              f"grep -m1 -B50 'END CERTIFICATE' {cert_file}"
+              " | openssl x509 -noout -text"
           )
-          for line in subject_data.lower().split("\n"):
-              if "subject" in line:
-                  print(f"First subject in fullchain.pem: {line}")
-                  assert cert_name.lower() in line
+          for line in first_cert_data.lower().split("\n"):
+              if "dns:" in line:
+                  print(f"First DNSName in fullchain.pem: {line}")
+                  assert cert_name.lower() in line, f"{cert_name} not found in {line}"
                   return
 
           assert False
 
 
-      def check_connection(node, domain, retries=0):
+      @backoff.protect
+      def check_connection(node, domain):
           result = node.succeed(
               "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"
               f" -servername {domain} -connect {domain}:443 < /dev/null 2>&1"
           )
 
           for line in result.lower().split("\n"):
-              if "verification" in line and "error" in line:
-                  retries = backoff.handle_fail(retries, f"Failed to connect to https://{domain}")
-                  return check_connection(node, domain, retries)
+              assert not (
+                  "verification" in line and "error" in line
+              ), f"Failed to connect to https://{domain}"
 
 
-      def check_connection_key_bits(node, domain, bits, retries=0):
+      @backoff.protect
+      def check_connection_key_bits(node, domain, bits):
           result = node.succeed(
               "openssl s_client -CAfile /tmp/ca.crt"
               f" -servername {domain} -connect {domain}:443 < /dev/null"
@@ -504,12 +522,11 @@ in {
           )
           print("Key type:", result)
 
-          if bits not in result:
-              retries = backoff.handle_fail(retries, f"Did not find expected number of bits ({bits}) in key")
-              return check_connection_key_bits(node, domain, bits, retries)
+          assert bits in result, f"Did not find expected number of bits ({bits}) in key"
 
 
-      def check_stapling(node, domain, retries=0):
+      @backoff.protect
+      def check_stapling(node, domain):
           # Pebble doesn't provide a full OCSP responder, so just check the URL
           result = node.succeed(
               "openssl s_client -CAfile /tmp/ca.crt"
@@ -518,30 +535,28 @@ in {
           )
           print("OCSP Responder URL:", result)
 
-          if "${caDomain}:4002" not in result.lower():
-              retries = backoff.handle_fail(retries, "OCSP Stapling check failed")
-              return check_stapling(node, domain, retries)
+          assert "${caDomain}:4002" in result.lower(), "OCSP Stapling check failed"
 
 
-      def download_ca_certs(node, retries=0):
-          exit_code, _ = node.execute("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
-          exit_code_2, _ = node.execute(
-              "curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt"
+      @backoff.protect
+      def download_ca_certs(node):
+          node.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
+          node.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")
+
+
+      @backoff.protect
+      def set_a_record(node):
+          node.succeed(
+              'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
           )
 
-          if exit_code + exit_code_2 > 0:
-              retries = backoff.handle_fail(retries, "Failed to connect to pebble to download root CA certs")
-              return download_ca_certs(node, retries)
-
 
       start_all()
 
       dnsserver.wait_for_unit("pebble-challtestsrv.service")
       client.wait_for_unit("default.target")
 
-      client.succeed(
-          'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
-      )
+      set_a_record(client)
 
       acme.systemctl("start network-online.target")
       acme.wait_for_unit("network-online.target")
@@ -638,7 +653,7 @@ in {
           webserver.wait_for_unit("acme-finished-lego.example.test.target")
           webserver.wait_for_unit("nginx.service")
           webserver.succeed("echo HENLO && systemctl cat nginx.service")
-          webserver.succeed("test \"$(stat -c '%U' /var/lib/acme/* | uniq)\" = \"root\"")
+          webserver.succeed('test "$(stat -c \'%U\' /var/lib/acme/* | uniq)" = "root"')
           check_connection(client, "a.example.test")
           check_connection(client, "lego.example.test")
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index af9d79f649bd..7bab420e874d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -322,6 +322,7 @@ in {
   fancontrol = handleTest ./fancontrol.nix {};
   fanout = handleTest ./fanout.nix {};
   fcitx5 = handleTest ./fcitx5 {};
+  fedimintd = runTest ./fedimintd.nix;
   fenics = handleTest ./fenics.nix {};
   ferm = handleTest ./ferm.nix {};
   ferretdb = handleTest ./ferretdb.nix {};
@@ -942,6 +943,7 @@ in {
   sudo = handleTest ./sudo.nix {};
   sudo-rs = handleTest ./sudo-rs.nix {};
   sunshine = handleTest ./sunshine.nix {};
+  suricata = handleTest ./suricata.nix {};
   suwayomi-server = handleTest ./suwayomi-server.nix {};
   swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
   swap-partition = handleTest ./swap-partition.nix {};
diff --git a/nixos/tests/fedimintd.nix b/nixos/tests/fedimintd.nix
new file mode 100644
index 000000000000..19e92b43da65
--- /dev/null
+++ b/nixos/tests/fedimintd.nix
@@ -0,0 +1,37 @@
+# This test runs the fedimintd and verifies that it starts
+
+{ pkgs, ... }:
+
+{
+  name = "fedimintd";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ dpc ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.fedimintd."mainnet" = {
+        enable = true;
+        p2p = {
+          url = "fedimint://example.com";
+        };
+        api = {
+          url = "wss://example.com";
+        };
+        environment = {
+          "FM_REL_NOTES_ACK" = "0_4_xyz";
+        };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      machine.wait_for_unit("fedimintd-mainnet.service")
+      machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api.port})
+    '';
+}
diff --git a/nixos/tests/scrutiny.nix b/nixos/tests/scrutiny.nix
index 33160a6b3088..4ac1b47952e0 100644
--- a/nixos/tests/scrutiny.nix
+++ b/nixos/tests/scrutiny.nix
@@ -49,10 +49,6 @@ import ./make-test-python.nix ({ lib, ... }:
   testScript = ''
     start_all()
 
-    # Wait for InfluxDB to be available
-    machine.wait_for_unit("influxdb2")
-    machine.wait_for_open_port(8086)
-
     # Wait for Scrutiny to be available
     machine.wait_for_unit("scrutiny")
     machine.wait_for_open_port(8080)
diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index ad516b6e8d2b..f35eaf9c8e78 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -154,7 +154,7 @@ in {
 
   with subtest("run_distributed_command"):
       # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
-      # The output must contain the 3 different names
+      # The output must contain the 3 different names
       submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
 
       with subtest("check_slurm_dbd"):
diff --git a/nixos/tests/suricata.nix b/nixos/tests/suricata.nix
new file mode 100644
index 000000000000..e1cdd91aaaa2
--- /dev/null
+++ b/nixos/tests/suricata.nix
@@ -0,0 +1,86 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+  {
+    name = "suricata";
+    meta.maintainers = with lib.maintainers; [ felbinger ];
+
+    nodes = {
+      ids = {
+        imports = [
+          ../modules/profiles/minimal.nix
+          ../modules/services/networking/suricata/default.nix
+        ];
+
+        networking.interfaces.eth1 = {
+          useDHCP = false;
+          ipv4.addresses = [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
+        };
+
+        # disable suricata-update because this requires an Internet connection
+        systemd.services.suricata-update.enable = false;
+
+        # install suricata package to make suricatasc program available
+        environment.systemPackages = with pkgs; [ suricata ];
+
+        services.suricata = {
+          enable = true;
+          settings = {
+            vars.address-groups.HOME_NET = "192.168.1.0/24";
+            unix-command.enabled = true;
+            outputs = [ { fast.enabled = true; } ];
+            af-packet = [ { interface = "eth1"; } ];
+            classification-file = "${pkgs.suricata}/etc/suricata/classification.config";
+          };
+        };
+
+        # create suricata.rules with the rule to detect the output of the id command
+        systemd.tmpfiles.rules = [
+          ''f /var/lib/suricata/rules/suricata.rules 644 suricata suricata 0 alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)''
+        ];
+      };
+      helper = {
+        imports = [ ../modules/profiles/minimal.nix ];
+
+        networking.interfaces.eth1 = {
+          useDHCP = false;
+          ipv4.addresses = [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."localhost".locations = {
+            "/id/".return = "200 'uid=0(root) gid=0(root) groups=0(root)'";
+          };
+        };
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      # check that configuration has been applied correctly with suricatasc
+      with subtest("suricata configuration test"):
+          ids.wait_for_unit("suricata.service")
+          assert '1' in ids.succeed("suricatasc -c 'iface-list' | ${pkgs.jq}/bin/jq .message.count")
+
+      # test detection of events based on a static ruleset (output of id command)
+      with subtest("suricata rule test"):
+          helper.wait_for_unit("nginx.service")
+          ids.wait_for_unit("suricata.service")
+
+          ids.succeed("curl http://192.168.1.1/id/")
+          assert "id check returned root [**] [Classification: Potentially Bad Traffic]" in ids.succeed("tail -n 1 /var/log/suricata/fast.log"), "Suricata didn't detect the output of id comment"
+    '';
+  }
+)
diff --git a/nixos/tests/wstunnel.nix b/nixos/tests/wstunnel.nix
index 7a0a8ce3496a..753f78061e7b 100644
--- a/nixos/tests/wstunnel.nix
+++ b/nixos/tests/wstunnel.nix
@@ -1,3 +1,5 @@
+{ lib, ... }:
+
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
@@ -6,6 +8,8 @@ in
 {
   name = "wstunnel";
 
+  meta.platforms = lib.platforms.linux;
+
   nodes = {
     server = {
       virtualisation.vlans = [ 1 ];
diff --git a/pkgs/applications/audio/songrec/default.nix b/pkgs/applications/audio/songrec/default.nix
index 37d69bcd48a1..a682c2b0df3c 100644
--- a/pkgs/applications/audio/songrec/default.nix
+++ b/pkgs/applications/audio/songrec/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "songrec";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "marin-m";
     repo = pname;
     rev = version;
-    hash = "sha256-S44gtyz6L6uaLm3q75y8S4NJb77Vfy+Sd+J06IroHIM=";
+    hash = "sha256-pTonrxlYvfuLRKMXW0Lao4KCoNFlMzE9rH+hwpa60JY=";
   };
 
-  cargoHash = "sha256-f2xAWh+y0Jw7QVLZBkajMLN3ocCyRsR480ai7+07LM4=";
+  cargoHash = "sha256-2BXUZD63xzHpUi8lk2fV5qBmeq6Gzpq0uEcKfbReANI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index cbf552106b3c..dc8151306bcd 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -587,19 +587,19 @@ in
 
   cord-nvim =
     let
-      version = "2024-07-19";
+      version = "0-unstable-2024-09-26";
       src = fetchFromGitHub {
         owner = "vyfor";
         repo = "cord.nvim";
-        rev = "cd97c25320fb0a672b11bcd95d8332bb3088ecce";
-        hash = "sha256-66NtKteM1mvHP5wAU4e9JbsF+bq91lmCDcTh/6RPhoo=";
+        rev = "a26b00d58c42174aadf975917b49cec67650545f";
+        hash = "sha256-jUxBvWnj0+axuw2SZ2zLzlhZS0tu+Bk8+wHtXENofkw=";
       };
       extension = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
       rustPackage = rustPlatform.buildRustPackage {
         pname = "cord.nvim-rust";
         inherit version src;
 
-        cargoHash = "sha256-6FYf4pHEPxvhKHHPmkjQ40zPxaiypnpDxF8kNH+h+tg=";
+        cargoHash = "sha256-M5mTdBACTaUVZhPpMOf1KQ3BcQpEoD2isAKRn+iAWjc=";
 
         installPhase = let
           cargoTarget = stdenv.hostPlatform.rust.cargoShortTarget;
diff --git a/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
index c85d7c271280..79d080cb13e8 100644
--- a/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
@@ -4,22 +4,16 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vsc-material-theme";
     publisher = "Equinusocio";
-    version = "34.3.1";
-    hash = "sha256-3yxFTMtjJR1b4EzBDfm55HF9chrya5OUF5wN+KHEduE=";
+    version = "34.7.5";
+    hash = "sha256-6YMr64MTtJrmMMMPW/s6hMh/IilDqLMrspKRPT4uSpM=";
   };
 
-  # extensions wants to write at the /nix/store path, so we patch it to use the globalStorageUri instead.
-  prePatch = ''
-    substituteInPlace ./build/core/extension-manager.js \
-      --replace-fail "path_1.posix.join(extensionFolderUri.path, env_1.USER_CONFIG_FILE_NAME)" "path_1.posix.join(ExtensionContext.globalStorageUri.fsPath, env_1.USER_CONFIG_FILE_NAME)"
-  '';
-
   meta = with lib; {
     changelog = "https://marketplace.visualstudio.com/items/Equinusocio.vsc-material-theme/changelog";
     description = "Most epic theme now for Visual Studio Code";
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=Equinusocio.vsc-material-theme";
-    homepage = "https://github.com/material-theme/vsc-material-theme";
-    license = licenses.asl20;
+    homepage = "https://www.material-theme.dev/";
+    license = licenses.unfree;
     maintainers = with maintainers; [ stunkymonkey ];
   };
 }
diff --git a/pkgs/applications/file-managers/clifm/default.nix b/pkgs/applications/file-managers/clifm/default.nix
index f24445f2a6d2..83fbaf6fd213 100644
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.20";
+  version = "1.21";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-TKQxNl+RTPQAE7mMALugm3rg8mPZq3eD/uW23DLws8I=";
+    hash = "sha256-x7Mdt8XcTtqxaHo28jrpyYPHZ/X1g9h4aulrW3YIXGQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/dosage/default.nix b/pkgs/applications/graphics/dosage/default.nix
index e943bf4f3181..56a128f2246c 100644
--- a/pkgs/applications/graphics/dosage/default.nix
+++ b/pkgs/applications/graphics/dosage/default.nix
@@ -1,22 +1,43 @@
-{ lib, python3Packages, fetchPypi }:
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "dosage";
-  version = "2.17";
+  version = "3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0vmxgn9wd3j80hp4gr5iq06jrl4gryz5zgfdd2ah30d12sfcfig0";
+    sha256 = "sha256-mHV/U9Vqv7fSsLYNrCXckkJ1YpsccLd8HsJ78IwLX0Y=";
   };
 
+  pyproject = true;
+
   nativeCheckInputs = with python3Packages; [
-    pytestCheckHook pytest-xdist responses
+    pytestCheckHook
+    pytest-xdist
+    responses
   ];
 
-  nativeBuildInputs = with python3Packages; [ setuptools-scm ];
+  build-system = [ python3Packages.setuptools-scm ];
 
-  propagatedBuildInputs = with python3Packages; [
-    colorama imagesize lxml requests setuptools six
+  dependencies = with python3Packages; [
+    colorama
+    imagesize
+    lxml
+    requests
+    six
+    platformdirs
+  ];
+
+  disabledTests = [
+    # need network connect to api.github.com
+    "test_update_available"
+    "test_no_update_available"
+    "test_update_broken"
+    "test_current"
   ];
 
   meta = {
diff --git a/pkgs/applications/misc/lscolors/default.nix b/pkgs/applications/misc/lscolors/default.nix
index 263ac29eaed2..3d31ece64694 100644
--- a/pkgs/applications/misc/lscolors/default.nix
+++ b/pkgs/applications/misc/lscolors/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lscolors";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-9xYWjpeXg646JEW7faRLE1Au6LRVU6QQ7zfAwmYffT0=";
+    hash = "sha256-EUUPVSpHc9tN1Hi7917hJ2psTZq5nnGw6PBeApvlVtw=";
   };
 
-  cargoHash = "sha256-gtcznStbuYWcBPKZ/hdH15cwRQL0+Q0fZHe+YW5Rek0=";
+  cargoHash = "sha256-1wAHd0WrJfjxDyGRAJjXGFY9ZBFlBOQFr2+cxoTufW0=";
 
   buildFeatures = [ "nu-ansi-term" ];
 
diff --git a/pkgs/applications/misc/slweb/default.nix b/pkgs/applications/misc/slweb/default.nix
deleted file mode 100644
index f71a0d61c2a5..000000000000
--- a/pkgs/applications/misc/slweb/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, stdenv
-, fetchFromSourcehut
-, redo-apenwarr
-, testers
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "slweb";
-  version = "0.9.0";
-
-  src = fetchFromSourcehut {
-    owner = "~strahinja";
-    repo = "slweb";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-QDHcp5pCmapgOlJpDDyyC12JOfh/biDyF6O+iKGbOGg=";
-  };
-
-  nativeBuildInputs = [ redo-apenwarr ];
-
-  installPhase = ''
-    runHook preInstall
-    export FALLBACKVER=${finalAttrs.version}
-    PREFIX=$out redo install
-    runHook postInstall
-  '';
-
-  enableParallelBuilding = true;
-
-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
-  };
-
-  meta = with lib; {
-    description = "Static website generator which aims at being simplistic";
-    homepage = "https://strahinja.srht.site/slweb/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ GaetanLepage ];
-    mainProgram = "slweb";
-  };
-})
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index f1c25264abca..0582866e48b1 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-m5kuSeaK4v8GtjlqJOP3isN/o+9uOxPuSEegi0nYaOM=";
+      hash_darwin = "sha256-cWY8P3D+PrIlbEdMYPp+4cFQZfOLbGeebC1Glg53Sx4=";
       hash_darwin_aarch64 =
-        "sha256-9WQH8Z7v3PtFKHA6bsrXgCJDWevh1YPjPyDp7M/xhlI=";
-      hash_linux = "sha256-dp060EKhFI4aRTBGLB8PyqeOj25Ov5Bd29KyESUDcwQ=";
-      version = "129.0.6668.70";
+        "sha256-Tu11SCTlB+8/ao0uS7AbknB5WuvN+cw/gHiyL6xKH1o=";
+      hash_linux = "sha256-Da+xaXNNP8eRccq87LBxMb+2oXJ4WRGLdWoCAhG2yAQ=";
+      version = "129.0.6668.89";
     };
     deps = {
       gn = {
@@ -15,8 +15,8 @@
         version = "2024-08-19";
       };
     };
-    hash = "sha256-L9h9jbwEMcUi/cu7FP2O/6wD0Br/3SzWCazu7m9ua+o=";
-    version = "129.0.6668.70";
+    hash = "sha256-+n9LjRLFvVB/pYkSrRCxln/Xn2paFyoY+mJGD73NtII=";
+    version = "129.0.6668.89";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index a484da72b6fb..2d9e23b7cc99 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.26";
+  version = "0.11.27";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-p3rLQQwuJ/5AUzsQfGA9JSoifYaG4vAE2NaNfTf6/uk=";
+    hash = "sha256-5/QAtaAAiIzpvOl43A4OqnIcKlfdxehGjmCREFRKXTs=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/opentofu/default.nix b/pkgs/applications/networking/cluster/opentofu/default.nix
index d37167b37c60..3619742d8a90 100644
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@@ -14,13 +14,13 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.8.2";
+    version = "1.8.3";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-kBI3Jgi4fDOx5bknTMlcI2K3LxKj6Q4dunbG9N33Ps0=";
+      hash = "sha256-+1ctvUz1Prhon+w5fGO+IQCYl7uEMZwAYMfQut7fmO4=";
     };
 
     vendorHash = "sha256-cM2DSP2ss3vleUhPBIdyxKeWJxtHpdjL5b5HVS/iC6o=";
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index d7b73979dfb8..583aa3bf063a 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.7.6";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-uyPnln1Cj4j1oPVERBIHMJXJWR+jPUq6AE7rZXr2yQo=";
+    hash = "sha256-Ezie6RQsigmJgdvnSVk6awuUu2kODSio9DNg4bow76M=";
   };
 
-  vendorHash = "sha256-ZJGhPT2KYYIMKmRWqdOppvXSD2W8kYtxK/900TdVdUg=";
+  vendorHash = "sha256-9qkealjjdBO659fdWdgFii3ThPRwKpYasB03L3Bktqs=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/tf-summarize/default.nix b/pkgs/applications/networking/cluster/tf-summarize/default.nix
index 09c6ee5ae0d7..9912edb0acdf 100644
--- a/pkgs/applications/networking/cluster/tf-summarize/default.nix
+++ b/pkgs/applications/networking/cluster/tf-summarize/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "tf-summarize";
-  version = "0.3.10";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "dineshba";
     repo = "tf-summarize";
     rev = "v${version}";
-    hash = "sha256-OmGJgy36Jv7/kyGg2y1cNS1r6n1C/plfC0s6q08Wox4=";
+    hash = "sha256-HXmFxbYfzEp6hxdmvNcSI+8zM3wh7pVpFjquwP/t4PU=";
   };
 
   vendorHash = "sha256-nfontEgMj2qPbrM35iR7b65qrkWHCMY1v944iYdNLG8=";
diff --git a/pkgs/applications/networking/cluster/zarf/default.nix b/pkgs/applications/networking/cluster/zarf/default.nix
index 5f030b872f69..ffc69b514713 100644
--- a/pkgs/applications/networking/cluster/zarf/default.nix
+++ b/pkgs/applications/networking/cluster/zarf/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "zarf";
-  version = "0.39.0";
+  version = "0.40.1";
 
   src = fetchFromGitHub {
     owner = "defenseunicorns";
     repo = "zarf";
     rev = "v${version}";
-    hash = "sha256-ATC+eoM3B21iG/ih31vlxBjnJ6zwmuxOLiw4nHKTp4o=";
+    hash = "sha256-tSMaDb8lflkedDa5ICXthqMpWBkHg+UQ20aTrF4+hUQ=";
   };
 
   vendorHash = "sha256-7G+gROPw8Ab6iGMr7vnmC7jAm7jLPd5pbLOkKqDKIDc=";
diff --git a/pkgs/applications/science/logic/btor2tools/default.nix b/pkgs/applications/science/logic/btor2tools/default.nix
index 2b547eeb9221..19bb53fb766b 100644
--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@@ -21,11 +21,24 @@ stdenv.mkDerivation rec {
     cp -v  lib/libbtor2parser.* $lib/lib
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # make sure shared libraries are present and program can be executed
+    $out/bin/btorsim -h > /dev/null
+
+    runHook postInstallCheck
+  '';
+
   outputs = [ "out" "dev" "lib" ];
 
   cmakeFlags = [
     # RPATH of binary /nix/store/.../bin/btorsim contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/science/logic/easycrypt/default.nix b/pkgs/applications/science/logic/easycrypt/default.nix
index 782d15d61559..faf3dc75167f 100644
--- a/pkgs/applications/science/logic/easycrypt/default.nix
+++ b/pkgs/applications/science/logic/easycrypt/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, ocamlPackages, why3, python3 }:
+{ lib, stdenv, darwin, fetchFromGitHub, ocamlPackages, why3, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "easycrypt";
-  version = "2024.01";
+  version = "2024.09";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "r${version}";
-    hash = "sha256-UYDoVMi5TtYxgPq5nkp/oRtcMcHl2p7KAG8ptvuOL5U=";
+    hash = "sha256-ZGYklG1eXfytRKzFvRSB6jFrOCm1gjyG8W78eMve5Ng=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
@@ -17,10 +17,12 @@ stdenv.mkDerivation rec {
     menhir
     ocaml
     python3.pkgs.wrapPython
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.sigtool;
+
   buildInputs = with ocamlPackages; [
     batteries
     dune-build-info
+    dune-site
     inifiles
     why3
     yojson
@@ -32,7 +34,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   postPatch = ''
-    substituteInPlace dune-project --replace '(name easycrypt)' '(name easycrypt)(version ${version})'
+    substituteInPlace dune-project --replace-fail '(name easycrypt)' '(name easycrypt)(version ${version})'
   '';
 
   pythonPath = with python3.pkgs; [ pyyaml ];
diff --git a/pkgs/applications/terminal-emulators/contour/default.nix b/pkgs/applications/terminal-emulators/contour/default.nix
index f01c47afdd36..78a1b7243cdc 100644
--- a/pkgs/applications/terminal-emulators/contour/default.nix
+++ b/pkgs/applications/terminal-emulators/contour/default.nix
@@ -99,5 +99,8 @@ stdenv.mkDerivation (final: {
     maintainers = with maintainers; [ moni ];
     platforms = platforms.unix;
     mainProgram = "contour";
+    # This was caused by boxed-cpp 1.4.2 -> 1.4.3
+    # More details in issue #345752
+    broken = true;
   };
 })
diff --git a/pkgs/applications/version-management/git-town/default.nix b/pkgs/applications/version-management/git-town/default.nix
index 9f70f7594472..00d2722bcdbe 100644
--- a/pkgs/applications/version-management/git-town/default.nix
+++ b/pkgs/applications/version-management/git-town/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "16.2.1";
+  version = "16.3.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     rev = "v${version}";
-    hash = "sha256-/60n/JvT7XRfEVic6Jmi05WpsAy4mRsE/GAnetTMC1I=";
+    hash = "sha256-q4bRUz6ZI6y0AYEDMUBMN1YJxmHkIDDkUiMd4rQbDHk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/version-management/gql/default.nix b/pkgs/applications/version-management/gql/default.nix
index d92e38f13f78..4e8cfbfd43fc 100644
--- a/pkgs/applications/version-management/gql/default.nix
+++ b/pkgs/applications/version-management/gql/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-/cL/Ts5RbClGqs5D93RTC7A5fr6Ca1c1sNbVZE4zK+E=";
+    hash = "sha256-BA94Q8nRf4NptVBHSMYLMEklB9vHaXRU1+o7shXhkZQ=";
   };
 
-  cargoHash = "sha256-o9eTOauQF5sf8UPyG0os2NQLsNkAIUOGhmMsZo6Kncw=";
+  cargoHash = "sha256-L+o0ZhTI7x01DpGuhWrvzvSZDYHc++31svWTJ41qx90=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/video/kodi/addons/iagl/default.nix b/pkgs/applications/video/kodi/addons/iagl/default.nix
index 1665a613bc08..90698a10cf9f 100644
--- a/pkgs/applications/video/kodi/addons/iagl/default.nix
+++ b/pkgs/applications/video/kodi/addons/iagl/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildKodiAddon, fetchFromGitHub, dateutil, requests, routing, vfs-libarchive, archive_tool, youtube }:
+{ lib, buildKodiAddon, fetchFromGitHub, dateutil, requests, routing, vfs-libarchive, archive_tool, youtube, infotagger }:
 
 buildKodiAddon rec {
   pname = "iagl";
@@ -19,6 +19,7 @@ buildKodiAddon rec {
     vfs-libarchive
     archive_tool
     youtube
+    infotagger
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/video/kodi/addons/radioparadise/default.nix b/pkgs/applications/video/kodi/addons/radioparadise/default.nix
index 45e0e845acb7..9d18cfb6a60a 100644
--- a/pkgs/applications/video/kodi/addons/radioparadise/default.nix
+++ b/pkgs/applications/video/kodi/addons/radioparadise/default.nix
@@ -3,11 +3,11 @@
 buildKodiAddon rec {
   pname = "radioparadise";
   namespace = "script.radioparadise";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/script.radioparadise/script.radioparadise-${version}.zip";
-    sha256 = "sha256-eRCP0XMQHmyDrZ8Y6RGFfxQ1r26/bWbE/PJz4PET7D8=";
+    sha256 = "sha256-osQoOFr1vyTgZdlq1gNmhhDY37e+4SFqN3uX3yT8NQE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index 8c007ec4b83e..faa623f37e29 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.0.9.2";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-42BBvXIrPAAhNgrGyPTK5dgg2DACPTT6/jRUoYcihFA=";
+    hash = "sha256-I3dSGcPQVVhn4RO8CHtn3FG2dheSv4XiDO7w+MtTjRU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
index 426d9a3521f2..4d36bdc4a892 100644
--- a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
@@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
   pname = "modernx-zydezu";
-  version = "0.3.6.6";
+  version = "0.3.7";
 
   scriptPath = "modernx.lua";
   src = fetchFromGitHub {
     owner = "zydezu";
     repo = "ModernX";
     rev = finalAttrs.version;
-    hash = "sha256-Jt3Y/4no3dUOopjvbS/dBGU0vw9Lq4o5inb4efuyYBM=";
+    hash = "sha256-slJYbhjNrzwq5rl83HV0Uy7BUK/bbltWSyH0198kSqw=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
index c4e2dc43d246..9dc1c4f04835 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "3.0.2";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-Vwm0Eyb8MevZtS3PTqnFQAbCj7JuTw9Ju0lS9CZ6rf8=";
+    sha256 = "sha256-ZmxopTv6YuAZ/GykvMRcP2PQwQk08ObmqZ9kBcR0UH4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ac/actionlint/package.nix b/pkgs/by-name/ac/actionlint/package.nix
index 0d45166ffd3d..4619367ddf7e 100644
--- a/pkgs/by-name/ac/actionlint/package.nix
+++ b/pkgs/by-name/ac/actionlint/package.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "1.7.2";
+  version = "1.7.3";
 in
 buildGoModule {
   pname = "actionlint";
@@ -22,7 +22,7 @@ buildGoModule {
     owner = "rhysd";
     repo = "actionlint";
     rev = "v${version}";
-    hash = "sha256-/VhSmNwAhgAM/506MjI07KBFbkBTLpQfod49ysju+uU=";
+    hash = "sha256-IwkTiuQ3eTZMn1y0NG1jo9UrX7AmEUBRSGQ/vq/0YL8=";
   };
 
   vendorHash = "sha256-SIY79SjYYXW2slUQr2Bm9dLH8K2wE3l/TL3QP0m8GLs=";
diff --git a/pkgs/by-name/ai/aiken/package.nix b/pkgs/by-name/ai/aiken/package.nix
index 61c66fda313a..272adcfb401e 100644
--- a/pkgs/by-name/ai/aiken/package.nix
+++ b/pkgs/by-name/ai/aiken/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     rev = "v${version}";
-    hash = "sha256-n373MgPjJzP+yRSQLA07RijFBjbRItK/nX8k7SJ6ITE=";
+    hash = "sha256-PTC7qn8Z1PGcBTNK5MtMvThIEhmAqTj23B/cHHhiDFE=";
   };
 
-  cargoHash = "sha256-gQ7DfYyVF6Gk8N+spBd97BWxTwydq+lDbnCsVPPzWLU=";
+  cargoHash = "sha256-p//1TZJ6sJUUDPPpxRBKL7w7MBTUQppbQedj2x4T17w=";
 
   buildInputs =
     [ openssl ]
diff --git a/pkgs/by-name/al/almo/package.nix b/pkgs/by-name/al/almo/package.nix
new file mode 100644
index 000000000000..00764f5301a7
--- /dev/null
+++ b/pkgs/by-name/al/almo/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  gcc,
+  python312Packages,
+}:
+let
+  version = "0.9.5-alpha";
+in
+stdenv.mkDerivation {
+  pname = "almo";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "abap34";
+    repo = "almo";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Cz+XDJmdp+utzwm1c7ThTNS6kfNF6r4B16tnGQSCVMc=";
+  };
+
+  buildInputs = [
+    gcc
+    python312Packages.pybind11
+  ];
+
+  makeFlags = [ "all" ];
+
+  # remove darwin-only linker flag on linux
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace scripts/pybind.sh \
+      --replace-fail " -undefined dynamic_lookup" ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin $out/lib
+    cp build/almo $out/bin
+    cp almo.so $out/lib
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "ALMO is markdown parser and static site generator";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    homepage = "https://github.com/abap34/almo";
+    maintainers = with lib.maintainers; [ momeemt ];
+    mainProgram = "almo";
+  };
+}
diff --git a/pkgs/by-name/an/ansible-navigator/package.nix b/pkgs/by-name/an/ansible-navigator/package.nix
index fd5615178524..96b19ebef6c0 100644
--- a/pkgs/by-name/an/ansible-navigator/package.nix
+++ b/pkgs/by-name/an/ansible-navigator/package.nix
@@ -7,7 +7,7 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "ansible-navigator";
-  version = "24.7.0";
+  version = "24.9.0";
   pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchPypi {
     inherit version;
     pname = "ansible_navigator";
-    hash = "sha256-XMwJzDxo/VZ+0qy5MLg/Kw/7j3V594qfV+T6jeVEWzg=";
+    hash = "sha256-eW38/n3vh2l2hKrh1xpW2fiB5yOkTnK77AnevDStD7s=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/at/atlas/package.nix b/pkgs/by-name/at/atlas/package.nix
index f026836039fa..d19454e84ce5 100644
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "atlas";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${version}";
-    hash = "sha256-av2WKuEzDhjvqGHIAlNR/Tt8AhqkjLhgcZIpJEKgEVA=";
+    hash = "sha256-D6dHHTxD2eObmXwYntIOtcPsU1vP+K289n+XVoaGUVc=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-wu2WONeL5LNGjn/xaRDPtBBVcvLOxSeelj7a6xxMHTY=";
+  vendorHash = "sha256-SFG//hc5vLQXC3SeEn4YRcc82PItYZy+TNqzq19sRnI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/bibletime/default.nix b/pkgs/by-name/bi/bibletime/package.nix
similarity index 50%
rename from pkgs/applications/misc/bibletime/default.nix
rename to pkgs/by-name/bi/bibletime/package.nix
index 1b7fde5d7de8..2c95eb11b25b 100644
--- a/pkgs/applications/misc/bibletime/default.nix
+++ b/pkgs/by-name/bi/bibletime/package.nix
@@ -1,20 +1,26 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, docbook_xml_dtd_45
-, pkg-config
-, wrapQtAppsHook
-, boost
-, clucene_core_2
-, docbook_xsl_ns
-, perlPackages
-, qtbase
-, qtsvg
-, qttools
-, sword
+{
+  lib,
+  boost,
+  clucene_core_2,
+  cmake,
+  docbook_xml_dtd_45,
+  docbook_xsl_ns,
+  fetchFromGitHub,
+  perlPackages,
+  pkg-config,
+  qt5,
+  stdenv,
+  sword,
 }:
 
+let
+  inherit (qt5)
+    qtbase
+    qtsvg
+    qttools
+    wrapQtAppsHook
+    ;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bibletime";
   version = "3.0.3";
@@ -31,12 +37,12 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_45
     pkg-config
     wrapQtAppsHook
+    perlPackages.Po4a
   ];
 
   buildInputs = [
     boost
     clucene_core_2
-    perlPackages.Po4a
     qtbase
     qtsvg
     qttools
@@ -49,18 +55,20 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DBUILD_HOWTO_PDF=OFF"
-    "-DBUILD_HANDBOOK_PDF=OFF"
-    "-DBT_DOCBOOK_XSL_HTML_CHUNK_XSL=${docbook_xsl_ns}/share/xml/docbook-xsl-ns/html/chunk.xsl"
-    "-DBT_DOCBOOK_XSL_PDF_DOCBOOK_XSL=${docbook_xsl_ns}/share/xml/docbook-xsl-ns/html/chunk.xsl"
+    (lib.cmakeBool "BUILD_HOWTO_PDF" false)
+    (lib.cmakeBool "BUILD_HANDBOOK_PDF" false)
+    (lib.cmakeFeature "BT_DOCBOOK_XSL_HTML_CHUNK_XSL" "${docbook_xsl_ns}/share/xml/docbook-xsl-ns/html/chunk.xsl")
+    (lib.cmakeFeature "BT_DOCBOOK_XSL_PDF_DOCBOOK_XSL" "${docbook_xsl_ns}/share/xml/docbook-xsl-ns/html/chunk.xsl")
   ];
 
-  meta = with lib; {
+  strictDeps = true;
+
+  meta = {
     homepage = "http://www.bibletime.info/";
     description = "Powerful cross platform Bible study tool";
+    license = lib.licenses.gpl2Plus;
     mainProgram = "bibletime";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ca/cairosvg/package.nix b/pkgs/by-name/ca/cairosvg/package.nix
new file mode 100644
index 000000000000..c000927312c4
--- /dev/null
+++ b/pkgs/by-name/ca/cairosvg/package.nix
@@ -0,0 +1,3 @@
+{ python3Packages }:
+
+python3Packages.toPythonApplication python3Packages.cairosvg
diff --git a/pkgs/by-name/cf/cfn-nag/Gemfile b/pkgs/by-name/cf/cfn-nag/Gemfile
new file mode 100644
index 000000000000..7f4f5e950d15
--- /dev/null
+++ b/pkgs/by-name/cf/cfn-nag/Gemfile
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gemspec
diff --git a/pkgs/by-name/cf/cfn-nag/Gemfile.lock b/pkgs/by-name/cf/cfn-nag/Gemfile.lock
new file mode 100644
index 000000000000..7892e62b052c
--- /dev/null
+++ b/pkgs/by-name/cf/cfn-nag/Gemfile.lock
@@ -0,0 +1,106 @@
+PATH
+  remote: .
+  specs:
+    cfn-nag (0.8.10)
+      aws-sdk-s3 (~> 1.76)
+      cfn-model (= 0.6.6)
+      lightly (~> 0.3.2)
+      logging (~> 2.2.2)
+      netaddr (~> 2.0.4)
+      optimist (~> 3.0.0)
+      rexml
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.4.2)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.982.0)
+    aws-sdk-core (3.209.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.651.0)
+      aws-sigv4 (~> 1.9)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-kms (1.94.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.166.0)
+      aws-sdk-core (~> 3, >= 3.207.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.10.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    cfn-model (0.6.6)
+      kwalify (= 0.7.2)
+      psych (~> 3)
+    diff-lcs (1.5.1)
+    docile (1.4.1)
+    jmespath (1.6.2)
+    json (2.7.2)
+    kwalify (0.7.2)
+    language_server-protocol (3.17.0.3)
+    lightly (0.3.3)
+    little-plugger (1.1.4)
+    logging (2.2.2)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    multi_json (1.15.0)
+    netaddr (2.0.6)
+    optimist (3.0.1)
+    parallel (1.26.3)
+    parser (3.3.5.0)
+      ast (~> 2.4.1)
+      racc
+    psych (3.3.4)
+    racc (1.8.1)
+    rainbow (3.1.1)
+    rake (13.2.1)
+    regexp_parser (2.9.2)
+    rexml (3.3.8)
+    rspec (3.13.0)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.1)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.3)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.1)
+    rubocop (1.66.1)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.4, < 3.0)
+      rubocop-ast (>= 1.32.2, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.32.3)
+      parser (>= 3.3.1.0)
+    ruby-progressbar (1.13.0)
+    simplecov (0.22.0)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.13.1)
+    simplecov_json_formatter (0.1.4)
+    unicode-display_width (2.6.0)
+
+PLATFORMS
+  arm64-darwin-23
+  ruby
+
+DEPENDENCIES
+  cfn-nag!
+  rake
+  rspec (~> 3.4)
+  rubocop
+  simplecov (~> 0.21)
+
+BUNDLED WITH
+   2.5.11
diff --git a/pkgs/by-name/cf/cfn-nag/gemset.nix b/pkgs/by-name/cf/cfn-nag/gemset.nix
new file mode 100644
index 000000000000..c8d2cd75d6cf
--- /dev/null
+++ b/pkgs/by-name/cf/cfn-nag/gemset.nix
@@ -0,0 +1,536 @@
+{
+  ast = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04nc8x27hlzlrr5c2gn7mar4vdr0apw5xg22wp6m8dx3wqr04a0y";
+      type = "gem";
+    };
+    version = "2.4.2";
+  };
+  aws-eventstream = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gvdg4yx4p9av2glmp7vsxhs0n8fj1ga9kq2xdb8f95j7b04qhzi";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  aws-partitions = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "075y2zwfqwg7qb7w34bfvp8dkjcmiz6hx5a3rbhpqglnlkav7ir4";
+      type = "gem";
+    };
+    version = "1.982.0";
+  };
+  aws-sdk-core = {
+    dependencies = [
+      "aws-eventstream"
+      "aws-partitions"
+      "aws-sigv4"
+      "jmespath"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "06mrp7g24ndg55w85ndyrvxfx2v6hnkh5fj32w9s6w3xsc8v5kqq";
+      type = "gem";
+    };
+    version = "3.209.1";
+  };
+  aws-sdk-kms = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1acx3bhqkhni3kbl7xnjdgy8raq5y7p0zyniq61bsihzkwcj7imh";
+      type = "gem";
+    };
+    version = "1.94.0";
+  };
+  aws-sdk-s3 = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sdk-kms"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0zpww3lxpjg8smmznz2nbx5hrpnkzflbasllxjwprkqr56rrrjap";
+      type = "gem";
+    };
+    version = "1.166.0";
+  };
+  aws-sigv4 = {
+    dependencies = [ "aws-eventstream" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "176zh13m1vhwgys0drlqiw79ljmmx84vva036shsb7rzr4yi36qm";
+      type = "gem";
+    };
+    version = "1.10.0";
+  };
+  cfn-model = {
+    dependencies = [
+      "kwalify"
+      "psych"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b3ix36yfnfwyxb4w9ss8a7nc6w15m1wbj3q8rarsqjrs3xj6wjs";
+      type = "gem";
+    };
+    version = "0.6.6";
+  };
+  cfn-nag = {
+    dependencies = [
+      "aws-sdk-s3"
+      "cfn-model"
+      "lightly"
+      "logging"
+      "netaddr"
+      "optimist"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      path = ./.;
+      type = "path";
+    };
+    version = "0.8.10";
+  };
+  diff-lcs = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1znxccz83m4xgpd239nyqxlifdb7m8rlfayk6s259186nkgj6ci7";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
+  docile = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07pj4z3h8wk4fgdn6s62vw1lwvhj0ac0x10vfbdkr9xzk7krn5cn";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  jmespath = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cdw9vw2qly7q7r41s7phnac264rbsdqgj4l0h4nqgbjb157g393";
+      type = "gem";
+    };
+    version = "1.6.2";
+  };
+  json = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
+      type = "gem";
+    };
+    version = "2.7.2";
+  };
+  kwalify = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ngxg3ysq5vip9dn3d32ajc7ly61kdin86hfycm1hkrcvkkn1vjf";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  language_server-protocol = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gvb1j8xsqxms9mww01rmdl78zkd72zgxaap56bhv8j45z05hp1x";
+      type = "gem";
+    };
+    version = "3.17.0.3";
+  };
+  lightly = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sgj2r6j7qxb9vqzkx5isjbphi38rplk4h8838am0cjcpq5h3jb3";
+      type = "gem";
+    };
+    version = "0.3.3";
+  };
+  little-plugger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  logging = {
+    dependencies = [
+      "little-plugger"
+      "multi_json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  multi_json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  netaddr = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1d7iccg9cjcsfl0fd0iiqfc5s7yh2602dgscbji5lrn2q879ghz7";
+      type = "gem";
+    };
+    version = "2.0.6";
+  };
+  optimist = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vg2chy1cfmdj6c1gryl8zvjhhmb3plwgyh1jfnpq4fnfqv7asrk";
+      type = "gem";
+    };
+    version = "3.0.1";
+  };
+  parallel = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vy7sjs2pgz4i96v5yk9b7aafbffnvq7nn419fgvw55qlavsnsyq";
+      type = "gem";
+    };
+    version = "1.26.3";
+  };
+  parser = {
+    dependencies = [
+      "ast"
+      "racc"
+    ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cqs31cyg2zp8yx2zzm3zkih0j93q870wasbviy2w343nxqvn3pk";
+      type = "gem";
+    };
+    version = "3.3.5.0";
+  };
+  psych = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "186i2hc6sfvg4skhqf82kxaf4mb60g65fsif8w8vg1hc9mbyiaph";
+      type = "gem";
+    };
+    version = "3.3.4";
+  };
+  racc = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  rainbow = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  rake = {
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
+      type = "gem";
+    };
+    version = "13.2.1";
+  };
+  regexp_parser = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ik40vcv7mqigsfpqpca36hpmnx0536xa825ai5qlkv3mmkyf9ss";
+      type = "gem";
+    };
+    version = "2.9.2";
+  };
+  rexml = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0rr145mvjgc4n28lfy0gw87aw3ab680h83bdi5i102ik8mixk3zn";
+      type = "gem";
+    };
+    version = "3.3.8";
+  };
+  rspec = {
+    dependencies = [
+      "rspec-core"
+      "rspec-expectations"
+      "rspec-mocks"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14xrp8vq6i9zx37vh0yp4h9m0anx9paw200l1r5ad9fmq559346l";
+      type = "gem";
+    };
+    version = "3.13.0";
+  };
+  rspec-core = {
+    dependencies = [ "rspec-support" ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0s688wfw77fjldzayvczg8bgwcgh6bh552dw7qcj1rhjk3r4zalx";
+      type = "gem";
+    };
+    version = "3.13.1";
+  };
+  rspec-expectations = {
+    dependencies = [
+      "diff-lcs"
+      "rspec-support"
+    ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0n3cyrhsa75x5wwvskrrqk56jbjgdi2q1zx0irllf0chkgsmlsqf";
+      type = "gem";
+    };
+    version = "3.13.3";
+  };
+  rspec-mocks = {
+    dependencies = [
+      "diff-lcs"
+      "rspec-support"
+    ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0f3vgp43hajw716vmgjv6f4ar6f97zf50snny6y3fy9kkj4qjw88";
+      type = "gem";
+    };
+    version = "3.13.1";
+  };
+  rspec-support = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03z7gpqz5xkw9rf53835pa8a9vgj4lic54rnix9vfwmp2m7pv1s8";
+      type = "gem";
+    };
+    version = "3.13.1";
+  };
+  rubocop = {
+    dependencies = [
+      "json"
+      "language_server-protocol"
+      "parallel"
+      "parser"
+      "rainbow"
+      "regexp_parser"
+      "rubocop-ast"
+      "ruby-progressbar"
+      "unicode-display_width"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rsyxrl647bz49gpa4flh8igg6wy7qxyh2jrp01x0kqnn5iw4y86";
+      type = "gem";
+    };
+    version = "1.66.1";
+  };
+  rubocop-ast = {
+    dependencies = [ "parser" ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03zywfpm4540q6hw8srhi8pzp0gg51w65ir8jkaw58vk3j31w820";
+      type = "gem";
+    };
+    version = "1.32.3";
+  };
+  ruby-progressbar = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
+      type = "gem";
+    };
+    version = "1.13.0";
+  };
+  simplecov = {
+    dependencies = [
+      "docile"
+      "simplecov-html"
+      "simplecov_json_formatter"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "198kcbrjxhhzca19yrdcd6jjj9sb51aaic3b0sc3pwjghg3j49py";
+      type = "gem";
+    };
+    version = "0.22.0";
+  };
+  simplecov-html = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02zi3rwihp7rlnp9x18c9idnkx7x68w6jmxdhyc0xrhjwrz0pasx";
+      type = "gem";
+    };
+    version = "0.13.1";
+  };
+  simplecov_json_formatter = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0a5l0733hj7sk51j81ykfmlk2vd5vaijlq9d5fn165yyx3xii52j";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  unicode-display_width = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0nkz7fadlrdbkf37m0x7sw8bnz8r355q3vwcfb9f9md6pds9h9qj";
+      type = "gem";
+    };
+    version = "2.6.0";
+  };
+}
diff --git a/pkgs/development/tools/cfn-nag/default.nix b/pkgs/by-name/cf/cfn-nag/package.nix
similarity index 54%
rename from pkgs/development/tools/cfn-nag/default.nix
rename to pkgs/by-name/cf/cfn-nag/package.nix
index 8438607102c3..4ec8f7848cbc 100644
--- a/pkgs/development/tools/cfn-nag/default.nix
+++ b/pkgs/by-name/cf/cfn-nag/package.nix
@@ -1,19 +1,24 @@
-{ lib, bundlerEnv, bundlerUpdateScript, ruby }:
+{
+  lib,
+  bundlerEnv,
+  bundlerUpdateScript,
+  ruby,
+}:
 
 bundlerEnv {
   pname = "cfn-nag";
-  version = "0.8.9";
+  version = "0.8.10";
 
   inherit ruby;
   gemdir = ./.;
 
   passthru.updateScript = bundlerUpdateScript "cfn-nag";
 
-  meta = with lib; {
+  meta = {
     description = "Linting tool for CloudFormation templates";
     homepage = "https://github.com/stelligent/cfn_nag";
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ momeemt ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/co/cope/package.nix b/pkgs/by-name/co/cope/package.nix
new file mode 100644
index 000000000000..d1aed0b02c5b
--- /dev/null
+++ b/pkgs/by-name/co/cope/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  perl,
+  perlPackages,
+}:
+
+perlPackages.buildPerlPackage {
+  pname = "cope";
+  version = "0-unstable-2024-03-27";
+
+  src = fetchFromGitHub {
+    owner = "deftdawg";
+    repo = "cope";
+    rev = "ad0c1ebec5684f5ec3e8becf348414292c489175";
+    hash = "sha256-LMAir7tUkjHtKz+KME/Raa9QHGN1g0bzr56fNxfURQY=";
+  };
+
+  buildInputs = with perlPackages; [
+    EnvPath
+    FileShareDir
+    IOPty
+    IOStty
+    ListMoreUtils
+    RegexpCommon
+    RegexpIPv6
+  ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    mv $out/${perlPackages.perl.libPrefix}/${perlPackages.perl.version}/auto/share/dist/Cope/* $out/bin/
+    rm -r $out/${perlPackages.perl.libPrefix}/${perlPackages.perl.version}/auto
+  '';
+
+  meta = {
+    description = "A colourful wrapper for terminal programs";
+    homepage = "https://github.com/deftdawg/cope";
+    license = with lib.licenses; [
+      artistic1
+      gpl1Plus
+    ];
+    maintainers = with lib.maintainers; [ deftdawg ];
+  };
+}
diff --git a/pkgs/by-name/cp/cpuinfo/package.nix b/pkgs/by-name/cp/cpuinfo/package.nix
index 9eca8f7f7022..8989bf8e1689 100644
--- a/pkgs/by-name/cp/cpuinfo/package.nix
+++ b/pkgs/by-name/cp/cpuinfo/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpuinfo";
-  version = "0-unstable-2024-09-11";
+  version = "0-unstable-2024-09-26";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "a5ff6df40ce528721cfc310c7ed43946d77404d5";
-    hash = "sha256-JbIEQ6jFprbMpeH8IBhuRo3VXxo8a32lmT4yfxSIEj0=";
+    rev = "1e83a2fdd3102f65c6f1fb602c1b320486218a99";
+    hash = "sha256-28cFACca+NYE8oKlP5aWXNCLeEjhWqJ6gRnFI+VxDvg=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
diff --git a/pkgs/by-name/cr/cryptpad/package.nix b/pkgs/by-name/cr/cryptpad/package.nix
index 5362a96cda03..146e9cf7bc1a 100644
--- a/pkgs/by-name/cr/cryptpad/package.nix
+++ b/pkgs/by-name/cr/cryptpad/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "2024.6.1";
+  version = "2024.9.0";
   # nix version of install-onlyoffice.sh
   # a later version could rebuild from sdkjs/web-apps as per
   # https://github.com/cryptpad/onlyoffice-builds/blob/main/build.sh
@@ -68,10 +68,10 @@ buildNpmPackage {
     owner = "cryptpad";
     repo = "cryptpad";
     rev = version;
-    hash = "sha256-qwyXpTY8Ds7R5687PVGZa/rlEyrAZjNzJ4+VQZpF8v0=";
+    hash = "sha256-OUtWaDVLRUbKS0apwY0aNq4MalGFv+fH9VA7LvWWYRs=";
   };
 
-  npmDepsHash = "sha256-GSTPsXqe/rxiDh5OW2t+ZY1YRNgRSDxkJ0pvcLIFtFw=";
+  npmDepsHash = "sha256-pK0b7q1kJja9l8ANwudbfo3jpldwuO56kuulS8X9A5s=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/ex/exo/package.nix b/pkgs/by-name/ex/exo/package.nix
new file mode 100644
index 000000000000..ead32ff3b121
--- /dev/null
+++ b/pkgs/by-name/ex/exo/package.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+}:
+python3Packages.buildPythonApplication {
+  pname = "exo";
+  version = "0-unstable-2024-10-02";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "exo-explore";
+    repo = "exo";
+    rev = "2654f290c3179aa143960e336e8985a8b6f6b72b";
+    hash = "sha256-jaIeK3sn6Swi20DNnvDtSAIt3DXIN0OQDiozNUHqtjs=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  pythonRelaxDeps = [
+    "aiohttp"
+    "aiofiles"
+    "blobfile"
+    "grpcio-tools"
+    "huggingface-hub"
+    "numpy"
+    "protobuf"
+    "pynvml"
+    "safetensors"
+    "tenacity"
+    "tokenizers"
+    "transformers"
+  ];
+
+  pythonRemoveDeps = [ "uuid" ];
+
+  dependencies = with python3Packages; [
+    aiohttp
+    aiohttp-cors
+    aiofiles
+    blobfile
+    grpcio
+    grpcio-tools
+    hf-transfer
+    huggingface-hub
+    jinja2
+    netifaces
+    numpy
+    pillow
+    prometheus-client
+    protobuf
+    psutil
+    pynvml
+    requests
+    rich
+    safetensors
+    tailscale
+    tenacity
+    tiktoken
+    tokenizers
+    tqdm
+    transformers
+    tinygrad
+  ];
+
+  pythonImportsCheck = [
+    "exo"
+    "exo.inference.tinygrad.models"
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    mlx
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    "test/test_tokenizers.py"
+  ];
+
+  # Tests require `mlx` which is not supported on linux.
+  doCheck = stdenv.isDarwin;
+
+  meta = {
+    description = "Run your own AI cluster at home with everyday devices";
+    homepage = "https://github.com/exo-explore/exo";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "exo";
+  };
+}
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 35abe9d6aefd..c24a7eea85a9 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-lQEQLINjXGbg9KnqJCQXR/wG50dBTnmWp06wKJi0NE8=";
+    hash = "sha256-dJrGPxqFfveb7lyCmDU0hnx5TkaDsdJgpKPtWyjj5ls=";
   };
 
-  cargoHash = "sha256-WT5jwG+c3cSKjAgzlOX3kbtOF3E6NICgGT2BGxcWzDA=";
+  cargoHash = "sha256-LM+ikA0aiSZmTH5cUcSQ0ikVd9kcADyCOR5qdCD1UJ4=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/gh/gh-dash/package.nix b/pkgs/by-name/gh/gh-dash/package.nix
index c9043495bc4c..674fa06bd62b 100644
--- a/pkgs/by-name/gh/gh-dash/package.nix
+++ b/pkgs/by-name/gh/gh-dash/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "4.5.4";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-RGl947fWoifw6+YHykL/k7uie5WqZqEAKWK7NZT+Upo=";
+    hash = "sha256-+tUG+ReP8y6wI4XZsR2Look4LAwK79CZf9fWUgkx4O0=";
   };
 
-  vendorHash = "sha256-zrHDxMqIzMQ2En8/sZ0BZjKM8JZrDjrRq9eWisSY3N0=";
+  vendorHash = "sha256-lqmz+6Cr9U5IBoJ5OeSN6HKY/nKSAmszfvifzbxG7NE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gm/gmic-qt/package.nix b/pkgs/by-name/gm/gmic-qt/package.nix
index dec42a99a488..539b766464e6 100644
--- a/pkgs/by-name/gm/gmic-qt/package.nix
+++ b/pkgs/by-name/gm/gmic-qt/package.nix
@@ -12,6 +12,7 @@
 , libpng
 , libsForQt5
 , libtiff
+, llvmPackages
 , ninja
 , nix-update-script
 , openexr
@@ -79,7 +80,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ (with libsForQt5; [
     qtbase
     qttools
-  ]) ++ variants.${variant}.extraDeps;
+  ]) ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ] ++ variants.${variant}.extraDeps;
 
   postPatch = ''
     patchShebangs \
diff --git a/pkgs/by-name/gm/gmic/package.nix b/pkgs/by-name/gm/gmic/package.nix
index 71402ab7e89a..38f3f8ba2261 100644
--- a/pkgs/by-name/gm/gmic/package.nix
+++ b/pkgs/by-name/gm/gmic/package.nix
@@ -13,9 +13,12 @@
 , gnused
 , graphicsmagick
 , jq
+, libX11
+, libXext
 , libjpeg
 , libpng
 , libtiff
+, llvmPackages
 , ninja
 , opencv
 , openexr
@@ -55,18 +58,24 @@ stdenv.mkDerivation (finalAttrs: {
     cimg
     fftw
     graphicsmagick
+    libX11
+    libXext
     libjpeg
     libpng
     libtiff
     opencv
     openexr
     zlib
+  ] ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
   ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_LIB_STATIC" false)
     (lib.cmakeBool "ENABLE_CURL" false)
     (lib.cmakeBool "ENABLE_DYNAMIC_LINKING" true)
+    (lib.cmakeBool "ENABLE_OPENCV" true)
+    (lib.cmakeBool "ENABLE_XSHM" true)
     (lib.cmakeBool "USE_SYSTEM_CIMG" true)
   ];
 
diff --git a/pkgs/by-name/go/goldwarden/package.nix b/pkgs/by-name/go/goldwarden/package.nix
index e6938d3be694..21852f3d647e 100644
--- a/pkgs/by-name/go/goldwarden/package.nix
+++ b/pkgs/by-name/go/goldwarden/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule rec {
   pname = "goldwarden";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "quexten";
     repo = "goldwarden";
     rev = "v${version}";
-    hash = "sha256-s00ZgRmp+0UTp4gpoQgZZqSJMRGsGuUxoX2DEryG+XM=";
+    hash = "sha256-LAnhCQmyubWeZtTVaW8IoNmfipvMIlAnY4pKwrURPDs=";
   };
 
   postPatch = ''
@@ -38,7 +38,7 @@ buildGoModule rec {
       --replace-fail "@PATH@" "$out/bin/goldwarden"
   '';
 
-  vendorHash = "sha256-TSmYqLMeS/G1rYNxVfh3uIK9bQJhsd7mos50yIXQoT4=";
+  vendorHash = "sha256-rMs7FP515aClzt9sjgIQHiYo5SYa2tDHrVRhtT+I8aM=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 4698f9c9a416..d0fa310bcfa1 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -44,6 +44,7 @@
   nss,
   pango,
   pipewire,
+  vulkan-loader,
   wayland, # ozone/wayland
 
   # Command line programs
@@ -152,6 +153,7 @@ let
       speechd-minimal
       systemd
       util-linux
+      vulkan-loader
       wayland
       wget
     ]
@@ -164,11 +166,11 @@ let
 
   linux = stdenv.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "129.0.6668.58";
+    version = "129.0.6668.89";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-lFYGwpdicvp+E4S+sw4+3uFQSwGKvhyFenBZMVgVnMo=";
+      hash = "sha256-7siTsIW29x4XZ+Zut9b5BFSTtc5tuhxusxnkJPouG1w=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -209,9 +211,12 @@ let
       exe=$out/bin/google-chrome-$dist
 
       mkdir -p $out/bin $out/share
+      cp -v -a opt/* $out/share
+      cp -v -a usr/share/* $out/share
 
-      cp -a opt/* $out/share
-      cp -a usr/share/* $out/share
+      # replace bundled vulkan-loader
+      rm -v $out/share/google/$appname/libvulkan.so.1
+      ln -v -s -t "$out/share/google/$appname" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
 
       substituteInPlace $out/share/google/$appname/google-$appname \
         --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
@@ -247,6 +252,9 @@ let
         --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
 
+      # Make sure that libGL and libvulkan are found by ANGLE libGLESv2.so
+      patchelf --set-rpath $rpath $out/share/google/$appname/lib*GL*
+
       for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
         patchelf --set-rpath $rpath $elf
         patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
@@ -258,11 +266,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "129.0.6668.59";
+    version = "129.0.6668.90";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/acinjqjzbtmzhvrebvzymzvzfaoq_129.0.6668.59/GoogleChrome-129.0.6668.59.dmg";
-      hash = "sha256-02J3TpcAsCvsB71C8/bfgIxiqcGIxjKiTWR32On66+g=";
+      url = "http://dl.google.com/release2/chrome/n4gcpoygckhm4y53qwq7lkpnqu_129.0.6668.90/GoogleChrome-129.0.6668.90.dmg";
+      hash = "sha256-viQSX8ogY5ywPqgVmMToHdZysxLuC8U78UJ9fIUrGCs=";
     };
 
     dontPatch = true;
diff --git a/pkgs/development/tools/gotools/default.nix b/pkgs/by-name/go/gotools/package.nix
similarity index 76%
rename from pkgs/development/tools/gotools/default.nix
rename to pkgs/by-name/go/gotools/package.nix
index ef4a608fcbc4..486aede88b9a 100644
--- a/pkgs/development/tools/gotools/default.nix
+++ b/pkgs/by-name/go/gotools/package.nix
@@ -1,15 +1,19 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
 
 buildGoModule rec {
   pname = "gotools";
-  version = "0.22.0";
+  version = "0.25.0";
 
   # using GitHub instead of https://go.googlesource.com/tools because Gitiles UI is to basic to browse
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     rev = "v${version}";
-    hash = "sha256-qqzvbHFbm6RlqztBnuj7HvMa9Wff1+YUA0fxiM0cx8o=";
+    hash = "sha256-iM6mGIQF+TOo1iV8hH9/4iOPdNiS9ymPmhslhDVnIIs=";
   };
 
   postPatch = ''
@@ -18,7 +22,7 @@ buildGoModule rec {
     rm -r gopls
   '';
 
-  vendorHash = "sha256-eQ/T/Zxmzn6KF0ewjvt9TDd48RSsSbQ3LgVcKgdeVbU=";
+  vendorHash = "sha256-9NSgtranuyRqtBq1oEnHCPIDFOIUJdVh5W/JufqN2Ko=";
 
   doCheck = false;
 
@@ -36,6 +40,9 @@ buildGoModule rec {
     '';
     homepage = "https://go.googlesource.com/tools";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [
+      SuperSandro2000
+      techknowlogick
+    ];
   };
 }
diff --git a/pkgs/development/tools/gotools/setup-hook.sh b/pkgs/by-name/go/gotools/setup-hook.sh
similarity index 100%
rename from pkgs/development/tools/gotools/setup-hook.sh
rename to pkgs/by-name/go/gotools/setup-hook.sh
diff --git a/pkgs/by-name/he/hercules/package.nix b/pkgs/by-name/he/hercules/package.nix
index 8a7e4a16dbaf..c5635d960fbb 100644
--- a/pkgs/by-name/he/hercules/package.nix
+++ b/pkgs/by-name/he/hercules/package.nix
@@ -105,13 +105,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hercules";
-  version = "4.6";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "SDL-Hercules-390";
     repo = "hyperion";
     rev = "Release_${version}";
-    hash = "sha256-ZhMTun6tmTsmIiFPTRFudwRXzWydrih61RsLyv0p24U=";
+    hash = "sha256-5Kvs2OWQrlsRZpmx7vet8GCky5xAISBNAqn+NHgicOM";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/hu/hugo/package.nix b/pkgs/by-name/hu/hugo/package.nix
index 11e9680d17d9..ffc22665098e 100644
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.134.3";
+  version = "0.135.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rdXiuFWMB+cTK5mhtpabWq8Uf9ihDnkHNG1JnD3rLKE=";
+    hash = "sha256-WCWaEVD2HON6feOev9HBfpqBWYIFmfevu6LH0OMtv2Q=";
   };
 
-  vendorHash = "sha256-oDa5uWQ/vFSmTNwZ3zsYtsuLCzddV9DeaEGx5krwWRE=";
+  vendorHash = "sha256-XIFgmT0VyhRrUNfwy85Ac7YIO9fij0KqVmqb/s3IDVg=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/im/immersed-vr/package.nix b/pkgs/by-name/im/immersed-vr/package.nix
index 7bf1f14574d4..874cac3bf5d6 100644
--- a/pkgs/by-name/im/immersed-vr/package.nix
+++ b/pkgs/by-name/im/immersed-vr/package.nix
@@ -6,16 +6,16 @@
 }:
 let
   pname = "immersed-vr";
-  version = "9.10";
+  version = "10.5.0";
 
   sources = rec {
     x86_64-linux = {
-      url = "https://web.archive.org/web/20240210075929/https://static.immersed.com/dl/Immersed-x86_64.AppImage";
-      hash = "sha256-Mx8UnV4fZSebj9ah650ZqsL/EIJpM6jl8tYmXJZiJpA=";
+      url = "https://web.archive.org/web/20240909144905if_/https://static.immersed.com/dl/Immersed-x86_64.AppImage";
+      hash = "sha256-/fc/URYJZftZPyVicmZjyvcGPLaHrnlsrERlQFN5E98=";
     };
     x86_64-darwin = {
-      url = "https://web.archive.org/web/20240210075929/https://static.immersed.com/dl/Immersed.dmg";
-      hash = "sha256-CR2KylovlS7zerZIEScnadm4+ENNhib5QnS6z5Ihv1Y=";
+      url = "https://web.archive.org/web/20240910022037if_/https://static.immersed.com/dl/Immersed.dmg";
+      hash = "sha256-UkfB151bX0D5k0IBZczh36TWOOYJbBe5e6LIErON214=";
     };
     aarch64-darwin = x86_64-darwin;
   };
diff --git a/pkgs/by-name/in/invidious-router/package.nix b/pkgs/by-name/in/invidious-router/package.nix
index d61e0076f957..5ac25de4e2a2 100644
--- a/pkgs/by-name/in/invidious-router/package.nix
+++ b/pkgs/by-name/in/invidious-router/package.nix
@@ -2,29 +2,33 @@
   lib,
   buildGoModule,
   fetchFromGitLab,
-}: let
-  version = "1.1";
+  nix-update-script,
+}:
+let
+  version = "1.2";
 in
-  buildGoModule {
-    pname = "invidious-router";
-    inherit version;
+buildGoModule {
+  pname = "invidious-router";
+  inherit version;
 
-    src = fetchFromGitLab {
-      owner = "gaincoder";
-      repo = "invidious-router";
-      rev = version;
-      hash = "sha256-t8KQqMPkBbVis1odDcSu+H0uvyvoFqCmtWoHqVRxmfc=";
-    };
+  src = fetchFromGitLab {
+    owner = "gaincoder";
+    repo = "invidious-router";
+    rev = "refs/tags/${version}";
+    hash = "sha256-YcMtZq4VMHr6XqHcsAAEmMF6jF1j1wb7Lq4EK42QAEo=";
+  };
 
-    vendorHash = "sha256-c03vYidm8SkoesRVQZdg/bCp9LIpdTmpXdfwInlHBKk=";
+  vendorHash = "sha256-c03vYidm8SkoesRVQZdg/bCp9LIpdTmpXdfwInlHBKk=";
 
-    doCheck = true;
+  passthru.updateScript = nix-update-script { };
 
-    meta = {
-      homepage = "https://gitlab.com/gaincoder/invidious-router";
-      description = "Go application that routes requests to different Invidious instances based on their health status and (optional) response time";
-      license = with lib.licenses; [mit];
-      maintainers = with lib.maintainers; [sils];
-      mainProgram = "invidious-router";
-    };
-  }
+  doCheck = true;
+
+  meta = {
+    homepage = "https://gitlab.com/gaincoder/invidious-router";
+    description = "Go application that routes requests to different Invidious instances based on their health status and (optional) response time";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ sils ];
+    mainProgram = "invidious-router";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
similarity index 53%
rename from pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
rename to pkgs/by-name/ku/kubelogin-oidc/package.nix
index e7d879a83aac..efc658aae6a8 100644
--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -1,31 +1,48 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  buildGo123Module,
+  fetchFromGitHub,
+}:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "kubelogin";
-  version = "1.30.0";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = "int128";
-    repo = pname;
+    repo = "kubelogin";
     rev = "v${version}";
-    sha256 = "sha256-DHg46t0gMypK6Nj428gpOMtPuA+XcW4IJU39CHTVGPw=";
+    hash = "sha256-aoLPT3lX+q426QlxAPsjeQyTZMnmqMGh85jJPU7lQVU=";
   };
 
-  subPackages = ["."];
+  subPackages = [ "." ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
 
   vendorHash = "sha256-gr+SsC7MiLj/MZ8kca5Hcfge+7Pm4y963TfwyKHEhBY=";
 
+  # test all packages
+  preCheck = ''
+    unset subPackages
+  '';
+
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin
   postInstall = ''
     mv $out/bin/kubelogin $out/bin/kubectl-oidc_login
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Kubernetes credential plugin implementing OpenID Connect (OIDC) authentication";
     mainProgram = "kubectl-oidc_login";
     inherit (src.meta) homepage;
-    license = licenses.asl20;
-    maintainers = with maintainers; [ benley ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      benley
+      nevivurn
+    ];
   };
 }
diff --git a/pkgs/by-name/li/libtorrent/package.nix b/pkgs/by-name/li/libtorrent/package.nix
index f034d405aa28..2867124b5814 100644
--- a/pkgs/by-name/li/libtorrent/package.nix
+++ b/pkgs/by-name/li/libtorrent/package.nix
@@ -10,18 +10,18 @@
 , openssl
 , pkg-config
 , zlib
-, unstableGitUpdater
+, gitUpdater
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rakshasa-libtorrent";
-  version = "0.13.8-unstable-2024-09-01";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "ca6eed1c7e7985016689004eaeed2fb2a119e5f8";
-    hash = "sha256-Hu0/T5NG7h+COLoOsfi2Uy0BVUPiEhkMhUhFo/JqZq0=";
+    rev = "v${version}";
+    hash = "sha256-MDLAp7KFmVvHL+haWVYwWG8gnLkTh6g19ydRkbu9cIs=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
     zlib
   ];
 
-  passthru.updateScript = unstableGitUpdater { tagPrefix = "v"; };
+  passthru.updateScript = gitUpdater { tagPrefix = "v"; };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/lo/local-ai/lib.nix b/pkgs/by-name/lo/local-ai/lib.nix
index 46f3ba88e5db..bd0cc36d90be 100644
--- a/pkgs/by-name/lo/local-ai/lib.nix
+++ b/pkgs/by-name/lo/local-ai/lib.nix
@@ -1,30 +1,39 @@
-{ lib
-, writers
-, writeText
-, linkFarmFromDrvs
-}: {
-  genModels = configs:
+{
+  lib,
+  writers,
+  writeText,
+  linkFarmFromDrvs,
+}:
+{
+  genModels =
+    configs:
     let
-      name = lib.strings.sanitizeDerivationName
-        (builtins.concatStringsSep "_" ([ "local-ai-models" ] ++ (builtins.attrNames configs)));
+      name = lib.strings.sanitizeDerivationName (
+        builtins.concatStringsSep "_" ([ "local-ai-models" ] ++ (builtins.attrNames configs))
+      );
 
-      genModelFiles = name: config:
+      genModelFiles =
+        name: config:
         let
           templateName = type: name + "_" + type;
 
-          config' = lib.recursiveUpdate config ({
-            inherit name;
-          } // lib.optionalAttrs (lib.isDerivation config.parameters.model) {
-            parameters.model = config.parameters.model.name;
-          } // lib.optionalAttrs (config ? template) {
-            template = builtins.mapAttrs (n: _: templateName n) config.template;
-          });
+          config' = lib.recursiveUpdate config (
+            {
+              inherit name;
+            }
+            // lib.optionalAttrs (lib.isDerivation config.parameters.model) {
+              parameters.model = config.parameters.model.name;
+            }
+            // lib.optionalAttrs (config ? template) {
+              template = builtins.mapAttrs (n: _: templateName n) config.template;
+            }
+          );
         in
         [ (writers.writeYAML "${name}.yaml" config') ]
-        ++ lib.optional (lib.isDerivation config.parameters.model)
-          config.parameters.model
-        ++ lib.optionals (config ? template)
-          (lib.mapAttrsToList (n: writeText "${templateName n}.tmpl") config.template);
+        ++ lib.optional (lib.isDerivation config.parameters.model) config.parameters.model
+        ++ lib.optionals (config ? template) (
+          lib.mapAttrsToList (n: writeText "${templateName n}.tmpl") config.template
+        );
     in
     linkFarmFromDrvs name (lib.flatten (lib.mapAttrsToList genModelFiles configs));
 }
diff --git a/pkgs/by-name/lo/local-ai/module.nix b/pkgs/by-name/lo/local-ai/module.nix
index e26a3637820f..12e8265d0f4d 100644
--- a/pkgs/by-name/lo/local-ai/module.nix
+++ b/pkgs/by-name/lo/local-ai/module.nix
@@ -1,4 +1,9 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.services.local-ai;
   inherit (lib) mkOption types;
@@ -35,7 +40,13 @@ in
     };
 
     logLevel = mkOption {
-      type = types.enum [ "error" "warn" "info" "debug" "trace" ];
+      type = types.enum [
+        "error"
+        "warn"
+        "info"
+        "debug"
+        "trace"
+      ];
       default = "warn";
     };
   };
@@ -46,16 +57,18 @@ in
       environment.LLAMACPP_PARALLEL = toString cfg.parallelRequests;
       serviceConfig = {
         DynamicUser = true;
-        ExecStart = lib.escapeShellArgs ([
-          "${cfg.package}/bin/local-ai"
-          "--address=:${toString cfg.port}"
-          "--threads=${toString cfg.threads}"
-          "--localai-config-dir=."
-          "--models-path=${cfg.models}"
-          "--log-level=${cfg.logLevel}"
-        ]
-        ++ lib.optional (cfg.parallelRequests > 1) "--parallel-requests"
-        ++ cfg.extraArgs);
+        ExecStart = lib.escapeShellArgs (
+          [
+            "${cfg.package}/bin/local-ai"
+            "--address=:${toString cfg.port}"
+            "--threads=${toString cfg.threads}"
+            "--localai-config-dir=."
+            "--models-path=${cfg.models}"
+            "--log-level=${cfg.logLevel}"
+          ]
+          ++ lib.optional (cfg.parallelRequests > 1) "--parallel-requests"
+          ++ cfg.extraArgs
+        );
         RuntimeDirectory = "local-ai";
         WorkingDirectory = "%t/local-ai";
       };
diff --git a/pkgs/by-name/lo/local-ai/package.nix b/pkgs/by-name/lo/local-ai/package.nix
index 84cb788ead4c..8a1b4394d76a 100644
--- a/pkgs/by-name/lo/local-ai/package.nix
+++ b/pkgs/by-name/lo/local-ai/package.nix
@@ -1,71 +1,87 @@
-{ config
-, callPackages
-, stdenv
-, lib
-, addDriverRunpath
-, fetchFromGitHub
-, protobuf
-, protoc-gen-go
-, protoc-gen-go-grpc
-, grpc
-, openssl
-, llama-cpp
+{
+  config,
+  callPackages,
+  stdenv,
+  lib,
+  addDriverRunpath,
+  fetchFromGitHub,
+  protobuf,
+  protoc-gen-go,
+  protoc-gen-go-grpc,
+  grpc,
+  openssl,
+  llama-cpp,
   # needed for audio-to-text
-, ffmpeg
-, cmake
-, pkg-config
-, buildGoModule
-, makeWrapper
-, ncurses
-, which
+  ffmpeg,
+  cmake,
+  pkg-config,
+  buildGoModule,
+  makeWrapper,
+  ncurses,
+  which,
 
-, enable_upx ? true
-, upx
+  enable_upx ? true,
+  upx,
 
   # apply feature parameter names according to
   # https://github.com/NixOS/rfcs/pull/169
 
   # CPU extensions
-, enable_avx ? true
-, enable_avx2 ? true
-, enable_avx512 ? stdenv.hostPlatform.avx512Support
-, enable_f16c ? true
-, enable_fma ? true
+  enable_avx ? true,
+  enable_avx2 ? true,
+  enable_avx512 ? stdenv.hostPlatform.avx512Support,
+  enable_f16c ? true,
+  enable_fma ? true,
 
-, with_openblas ? false
-, openblas
+  with_openblas ? false,
+  openblas,
 
-, with_cublas ? config.cudaSupport
-, cudaPackages
+  with_cublas ? config.cudaSupport,
+  cudaPackages,
 
-, with_clblas ? false
-, clblast
-, ocl-icd
-, opencl-headers
+  with_clblas ? false,
+  clblast,
+  ocl-icd,
+  opencl-headers,
 
-, with_tinydream ? false # do not compile with cublas
-, ncnn
+  with_tinydream ? false, # do not compile with cublas
+  ncnn,
 
-, with_stablediffusion ? true
-, opencv
+  with_stablediffusion ? true,
+  opencv,
 
-, with_tts ? true
-, onnxruntime
-, sonic
-, spdlog
-, fmt
-, espeak-ng
-, piper-tts
+  with_tts ? true,
+  onnxruntime,
+  sonic,
+  spdlog,
+  fmt,
+  espeak-ng,
+  piper-tts,
 }:
 let
   BUILD_TYPE =
-    assert (lib.count lib.id [ with_openblas with_cublas with_clblas ]) <= 1;
-    if with_openblas then "openblas"
-    else if with_cublas then "cublas"
-    else if with_clblas then "clblas"
-    else "";
+    assert
+      (lib.count lib.id [
+        with_openblas
+        with_cublas
+        with_clblas
+      ]) <= 1;
+    if with_openblas then
+      "openblas"
+    else if with_cublas then
+      "cublas"
+    else if with_clblas then
+      "clblas"
+    else
+      "";
 
-  inherit (cudaPackages) libcublas cuda_nvcc cuda_cccl cuda_cudart libcufft;
+  inherit (cudaPackages)
+    libcublas
+    cuda_nvcc
+    cuda_cccl
+    cuda_cudart
+    libcufft
+    ;
 
   go-llama = effectiveStdenv.mkDerivation {
     name = "go-llama";
@@ -81,13 +97,21 @@ let
       "BUILD_TYPE=${BUILD_TYPE}"
     ];
 
-    buildInputs = [ ]
-      ++ lib.optionals with_cublas [ cuda_cccl cuda_cudart libcublas ]
-      ++ lib.optionals with_clblas [ clblast ocl-icd opencl-headers ]
+    buildInputs =
+      [ ]
+      ++ lib.optionals with_cublas [
+        cuda_cccl
+        cuda_cudart
+        libcublas
+      ]
+      ++ lib.optionals with_clblas [
+        clblast
+        ocl-icd
+        opencl-headers
+      ]
       ++ lib.optionals with_openblas [ openblas.dev ];
 
-    nativeBuildInputs = [ cmake ]
-      ++ lib.optionals with_cublas [ cuda_nvcc ];
+    nativeBuildInputs = [ cmake ] ++ lib.optionals with_cublas [ cuda_nvcc ];
 
     dontUseCmakeConfigure = true;
 
@@ -98,82 +122,70 @@ let
     '';
   };
 
-  llama-cpp-rpc = (llama-cpp-grpc.overrideAttrs (prev: {
-    name = "llama-cpp-rpc";
-    cmakeFlags = prev.cmakeFlags ++ [
-      (lib.cmakeBool "GGML_AVX" false)
-      (lib.cmakeBool "GGML_AVX2" false)
-      (lib.cmakeBool "GGML_AVX512" false)
-      (lib.cmakeBool "GGML_FMA" false)
-      (lib.cmakeBool "GGML_F16C" false)
-    ];
-  })).override {
-    cudaSupport = false;
-    openclSupport = false;
-    blasSupport = false;
-    rpcSupport = true;
-  };
+  llama-cpp-rpc =
+    (llama-cpp-grpc.overrideAttrs (prev: {
+      name = "llama-cpp-rpc";
+      cmakeFlags = prev.cmakeFlags ++ [
+        (lib.cmakeBool "GGML_AVX" false)
+        (lib.cmakeBool "GGML_AVX2" false)
+        (lib.cmakeBool "GGML_AVX512" false)
+        (lib.cmakeBool "GGML_FMA" false)
+        (lib.cmakeBool "GGML_F16C" false)
+      ];
+    })).override
+      {
+        cudaSupport = false;
+        openclSupport = false;
+        blasSupport = false;
+        rpcSupport = true;
+      };
 
-  llama-cpp-grpc = (llama-cpp.overrideAttrs (final: prev: {
-    name = "llama-cpp-grpc";
-    src = fetchFromGitHub {
-      owner = "ggerganov";
-      repo = "llama.cpp";
-      rev = "ed9d2854c9de4ae1f448334294e61167b04bec2a";
-      hash = "sha256-Xu2h9Zu+Q9utfFFmDWBOEu/EXth4xWRNoTMvPF5Fo/A=";
-      fetchSubmodules = true;
-    };
-    postPatch = prev.postPatch + ''
-      cd examples
-      cp -r --no-preserve=mode ${src}/backend/cpp/llama grpc-server
-      cp llava/clip.* llava/llava.* grpc-server
-      printf "\nadd_subdirectory(grpc-server)" >> CMakeLists.txt
+  llama-cpp-grpc =
+    (llama-cpp.overrideAttrs (
+      final: prev: {
+        name = "llama-cpp-grpc";
+        src = fetchFromGitHub {
+          owner = "ggerganov";
+          repo = "llama.cpp";
+          rev = "fc54ef0d1c138133a01933296d50a36a1ab64735";
+          hash = "sha256-o87EhrA2Oa98pwyb6GSUgwERY0/GWJiX7kvlxDv4zb4=";
+          fetchSubmodules = true;
+        };
+        postPatch =
+          prev.postPatch
+          + ''
+            cd examples
+            cp -r --no-preserve=mode ${src}/backend/cpp/llama grpc-server
+            cp llava/clip.* llava/llava.* grpc-server
+            printf "\nadd_subdirectory(grpc-server)" >> CMakeLists.txt
 
-      cp ${src}/backend/backend.proto grpc-server
-      sed -i grpc-server/CMakeLists.txt \
-        -e '/get_filename_component/ s;[.\/]*backend/;;' \
-        -e '$a\install(TARGETS ''${TARGET} RUNTIME)'
-      cd ..
-    '';
-    cmakeFlags = prev.cmakeFlags ++ [
-      (lib.cmakeBool "BUILD_SHARED_LIBS" false)
-      (lib.cmakeBool "GGML_AVX" enable_avx)
-      (lib.cmakeBool "GGML_AVX2" enable_avx2)
-      (lib.cmakeBool "GGML_AVX512" enable_avx512)
-      (lib.cmakeBool "GGML_FMA" enable_fma)
-      (lib.cmakeBool "GGML_F16C" enable_f16c)
-    ];
-    buildInputs = prev.buildInputs ++ [
-      protobuf # provides also abseil_cpp as propagated build input
-      grpc
-      openssl
-    ];
-  })).override {
-    cudaSupport = with_cublas;
-    rocmSupport = false;
-    openclSupport = with_clblas;
-    blasSupport = with_openblas;
-  };
-
-  gpt4all = stdenv.mkDerivation {
-    name = "gpt4all";
-    src = fetchFromGitHub {
-      owner = "nomic-ai";
-      repo = "gpt4all";
-      rev = "27a8b020c36b0df8f8b82a252d261cda47cf44b8";
-      hash = "sha256-djq1eK6ncvhkO3MNDgasDBUY/7WWcmZt/GJsHAulLdI=";
-      fetchSubmodules = true;
-    };
-    makeFlags = [ "-C gpt4all-bindings/golang" ];
-    buildFlags = [ "libgpt4all.a" ];
-    dontUseCmakeConfigure = true;
-    nativeBuildInputs = [ cmake ];
-    installPhase = ''
-      mkdir $out
-      tar cf - --exclude=CMakeFiles . \
-        | tar xf - -C $out
-    '';
-  };
+            cp ${src}/backend/backend.proto grpc-server
+            sed -i grpc-server/CMakeLists.txt \
+              -e '/get_filename_component/ s;[.\/]*backend/;;' \
+              -e '$a\install(TARGETS ''${TARGET} RUNTIME)'
+            cd ..
+          '';
+        cmakeFlags = prev.cmakeFlags ++ [
+          (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+          (lib.cmakeBool "GGML_AVX" enable_avx)
+          (lib.cmakeBool "GGML_AVX2" enable_avx2)
+          (lib.cmakeBool "GGML_AVX512" enable_avx512)
+          (lib.cmakeBool "GGML_FMA" enable_fma)
+          (lib.cmakeBool "GGML_F16C" enable_f16c)
+        ];
+        buildInputs = prev.buildInputs ++ [
+          protobuf # provides also abseil_cpp as propagated build input
+          grpc
+          openssl
+        ];
+      }
+    )).override
+      {
+        cudaSupport = with_cublas;
+        rocmSupport = false;
+        openclSupport = with_clblas;
+        blasSupport = with_openblas;
+      };
 
   espeak-ng' = espeak-ng.overrideAttrs (self: {
     name = "espeak-ng'";
@@ -199,8 +211,14 @@ let
     name = "piper-phonemize";
     inherit (go-piper) src;
     sourceRoot = "${go-piper.src.name}/piper-phonemize";
-    buildInputs = [ espeak-ng' onnxruntime ];
-    nativeBuildInputs = [ cmake pkg-config ];
+    buildInputs = [
+      espeak-ng'
+      onnxruntime
+    ];
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
     cmakeFlags = [
       (lib.cmakeFeature "ONNXRUNTIME_DIR" "${onnxruntime.dev}")
       (lib.cmakeFeature "ESPEAK_NG_DIR" "${espeak-ng'}")
@@ -240,7 +258,15 @@ let
         -e '/CXXFLAGS *= / s;$; -DSPDLOG_FMT_EXTERNAL=1;'
     '';
     buildFlags = [ "libpiper_binding.a" ];
-    buildInputs = [ piper-tts' espeak-ng' piper-phonemize sonic fmt spdlog onnxruntime ];
+    buildInputs = [
+      piper-tts'
+      espeak-ng'
+      piper-phonemize
+      sonic
+      fmt
+      spdlog
+      onnxruntime
+    ];
     installPhase = ''
       cp -r --no-preserve=mode $src $out
       mkdir -p $out/piper-phonemize/pi
@@ -273,16 +299,28 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "whisper.cpp";
-      rev = "6739eb83c3ca5cf40d24c6fe8442a761a1eb6248";
-      hash = "sha256-1yDdJVjIwYDJKn93zn4xOJXMoDTqaG2TvakjdHIMCxk=";
+      rev = "9e3c5345cd46ea718209db53464e426c3fe7a25e";
+      hash = "sha256-JOptyveuaKRLzeZ6GuB3A70IM7dk4we95g5o25XVXJI=";
     };
 
-    nativeBuildInputs = [ cmake pkg-config ]
-      ++ lib.optionals with_cublas [ cuda_nvcc ];
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ] ++ lib.optionals with_cublas [ cuda_nvcc ];
 
-    buildInputs = [ ]
-      ++ lib.optionals with_cublas [ cuda_cccl cuda_cudart libcublas libcufft ]
-      ++ lib.optionals with_clblas [ clblast ocl-icd opencl-headers ]
+    buildInputs =
+      [ ]
+      ++ lib.optionals with_cublas [
+        cuda_cccl
+        cuda_cudart
+        libcublas
+        libcufft
+      ]
+      ++ lib.optionals with_clblas [
+        clblast
+        ocl-icd
+        opencl-headers
+      ]
       ++ lib.optionals with_openblas [ openblas.dev ];
 
     cmakeFlags = [
@@ -379,25 +417,26 @@ let
     meta.broken = lib.versionOlder go-tiny-dream.stdenv.cc.version "13";
   };
 
-  GO_TAGS = lib.optional with_tinydream "tinydream"
+  GO_TAGS =
+    lib.optional with_tinydream "tinydream"
     ++ lib.optional with_tts "tts"
     ++ lib.optional with_stablediffusion "stablediffusion";
 
   effectiveStdenv =
     if with_cublas then
-    # It's necessary to consistently use backendStdenv when building with CUDA support,
-    # otherwise we get libstdc++ errors downstream.
+      # It's necessary to consistently use backendStdenv when building with CUDA support,
+      # otherwise we get libstdc++ errors downstream.
       cudaPackages.backendStdenv
     else
       stdenv;
 
   pname = "local-ai";
-  version = "2.19.4";
+  version = "2.20.1";
   src = fetchFromGitHub {
     owner = "go-skynet";
     repo = "LocalAI";
     rev = "v${version}";
-    hash = "sha256-aKq6/DI+4+BvIEw6eONqPr3mZXuz7rMFN+FBypVj0Gc=";
+    hash = "sha256-FeZZC0Tg9JT9Yj0e27GOLSdHEtWl17AHK3j7epwPyY8=";
   };
 
   prepare-sources =
@@ -407,53 +446,67 @@ let
     ''
       mkdir sources
       ${cp} ${go-llama} sources/go-llama.cpp
-      ${cp} ${gpt4all} sources/gpt4all
       ${cp} ${if with_tts then go-piper else go-piper.src} sources/go-piper
       ${cp} ${go-rwkv} sources/go-rwkv.cpp
       ${cp} ${whisper-cpp.src} sources/whisper.cpp
       cp ${whisper-cpp}/lib/lib*.a sources/whisper.cpp
       ${cp} ${go-bert} sources/go-bert.cpp
-      ${cp} ${if with_stablediffusion then go-stable-diffusion else go-stable-diffusion.src} sources/go-stable-diffusion
+      ${cp} ${
+        if with_stablediffusion then go-stable-diffusion else go-stable-diffusion.src
+      } sources/go-stable-diffusion
       ${cp} ${if with_tinydream then go-tiny-dream else go-tiny-dream.src} sources/go-tiny-dream
     '';
 
   self = buildGoModule.override { stdenv = effectiveStdenv; } {
     inherit pname version src;
 
-    vendorHash = "sha256-HEKE75+ixuNbM+KEuhbQQ/NYYEzVlGYOttPavftWKhk=";
+    vendorHash = "sha256-mDxp5frUIECSHKjxaJVqIP7mnIusvdT45Xlxc9+P5tE=";
 
     env.NIX_CFLAGS_COMPILE = lib.optionalString with_stablediffusion " -isystem ${opencv}/include/opencv4";
 
-    postPatch = ''
-      sed -i Makefile \
-        -e '/mod download/ d' \
-        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-fallback/ d' \
-        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-avx/ d' \
-        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-cuda/ d' \
+    postPatch =
+      ''
+        sed -i Makefile \
+          -e '/mod download/ d' \
+          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-fallback/ d' \
+          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-avx/ d' \
+          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-cuda/ d' \
 
-    '' + lib.optionalString with_cublas ''
-      sed -i Makefile \
-        -e '/^CGO_LDFLAGS_WHISPER?=/ s;$;-L${libcufft}/lib -L${cuda_cudart}/lib;'
-    '';
+      ''
+      + lib.optionalString with_cublas ''
+        sed -i Makefile \
+          -e '/^CGO_LDFLAGS_WHISPER?=/ s;$;-L${libcufft}/lib -L${cuda_cudart}/lib;'
+      '';
 
-    postConfigure = prepare-sources + ''
-      shopt -s extglob
-      mkdir -p backend-assets/grpc
-      cp ${llama-cpp-grpc}/bin/grpc-server backend-assets/grpc/llama-cpp-avx2
-      cp ${llama-cpp-rpc}/bin/grpc-server backend-assets/grpc/llama-cpp-grpc
+    postConfigure =
+      prepare-sources
+      + ''
+        shopt -s extglob
+        mkdir -p backend-assets/grpc
+        cp ${llama-cpp-grpc}/bin/grpc-server backend-assets/grpc/llama-cpp-avx2
+        cp ${llama-cpp-rpc}/bin/grpc-server backend-assets/grpc/llama-cpp-grpc
 
-      mkdir -p backend/cpp/llama/llama.cpp
+        mkdir -p backend/cpp/llama/llama.cpp
 
-      mkdir -p backend-assets/util
-      cp ${llama-cpp-rpc}/bin/llama-rpc-server backend-assets/util/llama-cpp-rpc-server
+        mkdir -p backend-assets/util
+        cp ${llama-cpp-rpc}/bin/llama-rpc-server backend-assets/util/llama-cpp-rpc-server
 
-      # avoid rebuild of prebuilt make targets
-      touch backend-assets/grpc/* backend-assets/util/* sources/**/lib*.a
-    '';
+        # avoid rebuild of prebuilt make targets
+        touch backend-assets/grpc/* backend-assets/util/* sources/**/lib*.a
+      '';
 
-    buildInputs = [ ]
-      ++ lib.optionals with_cublas [ cuda_cudart libcublas libcufft ]
-      ++ lib.optionals with_clblas [ clblast ocl-icd opencl-headers ]
+    buildInputs =
+      [ ]
+      ++ lib.optionals with_cublas [
+        cuda_cudart
+        libcublas
+        libcufft
+      ]
+      ++ lib.optionals with_clblas [
+        clblast
+        ocl-icd
+        opencl-headers
+      ]
       ++ lib.optionals with_openblas [ openblas.dev ]
       ++ lib.optionals with_stablediffusion go-stable-diffusion.buildInputs
       ++ lib.optionals with_tts go-piper.buildInputs;
@@ -465,16 +518,16 @@ let
       makeWrapper
       ncurses # tput
       which
-    ]
-    ++ lib.optional enable_upx upx
-    ++ lib.optionals with_cublas [ cuda_nvcc ];
+    ] ++ lib.optional enable_upx upx ++ lib.optionals with_cublas [ cuda_nvcc ];
 
     enableParallelBuilding = false;
 
-    modBuildPhase = prepare-sources + ''
-      make protogen-go
-      go mod tidy -v
-    '';
+    modBuildPhase =
+      prepare-sources
+      + ''
+        make protogen-go
+        go mod tidy -v
+      '';
 
     proxyVendor = true;
 
@@ -482,12 +535,13 @@ let
     # containing spaces
     env.GO_TAGS = builtins.concatStringsSep " " GO_TAGS;
 
-    makeFlags = [
-      "VERSION=v${version}"
-      "BUILD_TYPE=${BUILD_TYPE}"
-    ]
-    ++ lib.optional with_cublas "CUDA_LIBPATH=${cuda_cudart}/lib"
-    ++ lib.optional with_tts "PIPER_CGO_CXXFLAGS=-DSPDLOG_FMT_EXTERNAL=1";
+    makeFlags =
+      [
+        "VERSION=v${version}"
+        "BUILD_TYPE=${BUILD_TYPE}"
+      ]
+      ++ lib.optional with_cublas "CUDA_LIBPATH=${cuda_cudart}/lib"
+      ++ lib.optional with_tts "PIPER_CGO_CXXFLAGS=-DSPDLOG_FMT_EXTERNAL=1";
 
     buildPhase = ''
       runHook preBuild
@@ -516,18 +570,25 @@ let
     # raises an segmentation fault
     postFixup =
       let
-        LD_LIBRARY_PATH = [ ]
+        LD_LIBRARY_PATH =
+          [ ]
           ++ lib.optionals with_cublas [
-          # driverLink has to be first to avoid loading the stub version of libcuda.so
-          # https://github.com/NixOS/nixpkgs/issues/320145#issuecomment-2190319327
-          addDriverRunpath.driverLink
-          (lib.getLib libcublas)
-          cuda_cudart
-        ]
-          ++ lib.optionals with_clblas [ clblast ocl-icd ]
+            # driverLink has to be first to avoid loading the stub version of libcuda.so
+            # https://github.com/NixOS/nixpkgs/issues/320145#issuecomment-2190319327
+            addDriverRunpath.driverLink
+            (lib.getLib libcublas)
+            cuda_cudart
+          ]
+          ++ lib.optionals with_clblas [
+            clblast
+            ocl-icd
+          ]
           ++ lib.optionals with_openblas [ openblas ]
           ++ lib.optionals with_tts [ piper-phonemize ]
-          ++ lib.optionals (with_tts && enable_upx) [ fmt spdlog ];
+          ++ lib.optionals (with_tts && enable_upx) [
+            fmt
+            spdlog
+          ];
       in
       ''
         wrapProgram $out/bin/${pname} \
@@ -537,15 +598,30 @@ let
 
     passthru.local-packages = {
       inherit
-        go-tiny-dream go-rwkv go-bert go-llama gpt4all go-piper
-        llama-cpp-grpc whisper-cpp go-tiny-dream-ncnn espeak-ng' piper-phonemize
-        piper-tts' llama-cpp-rpc;
+        go-tiny-dream
+        go-rwkv
+        go-bert
+        go-llama
+        go-piper
+        llama-cpp-grpc
+        whisper-cpp
+        go-tiny-dream-ncnn
+        espeak-ng'
+        piper-phonemize
+        piper-tts'
+        llama-cpp-rpc
+        ;
     };
 
     passthru.features = {
       inherit
-        with_cublas with_openblas with_tts with_stablediffusion
-        with_tinydream with_clblas;
+        with_cublas
+        with_openblas
+        with_tts
+        with_stablediffusion
+        with_tinydream
+        with_clblas
+        ;
     };
 
     passthru.tests = callPackages ./tests.nix { inherit self; };
@@ -555,7 +631,10 @@ let
       description = "OpenAI alternative to run local LLMs, image and audio generation";
       homepage = "https://localai.io";
       license = licenses.mit;
-      maintainers = with maintainers; [ onny ck3d ];
+      maintainers = with maintainers; [
+        onny
+        ck3d
+      ];
       platforms = platforms.linux;
     };
   };
diff --git a/pkgs/by-name/lo/local-ai/tests.nix b/pkgs/by-name/lo/local-ai/tests.nix
index 60baeb085ee9..eebc357489c7 100644
--- a/pkgs/by-name/lo/local-ai/tests.nix
+++ b/pkgs/by-name/lo/local-ai/tests.nix
@@ -1,23 +1,26 @@
-{ self
-, lib
-, testers
-, fetchzip
-, fetchurl
-, writers
-, symlinkJoin
-, jq
-, prom2json
+{
+  self,
+  lib,
+  testers,
+  fetchzip,
+  fetchurl,
+  writers,
+  symlinkJoin,
+  jq,
+  prom2json,
 }:
 let
-  common-config = { config, ... }: {
-    imports = [ ./module.nix ];
-    services.local-ai = {
-      enable = true;
-      package = self;
-      threads = config.virtualisation.cores;
-      logLevel = "debug";
+  common-config =
+    { config, ... }:
+    {
+      imports = [ ./module.nix ];
+      services.local-ai = {
+        enable = true;
+        package = self;
+        threads = config.virtualisation.cores;
+        logLevel = "debug";
+      };
     };
-  };
 
   inherit (self.lib) genModels;
 in
@@ -73,7 +76,9 @@ in
         virtualisation.memorySize = 2048;
         services.local-ai.models = models;
       };
-      passthru = { inherit models requests; };
+      passthru = {
+        inherit models requests;
+      };
       testScript =
         let
           port = "8080";
@@ -93,7 +98,8 @@ in
         '';
     };
 
-} // lib.optionalAttrs (!self.features.with_cublas && !self.features.with_clblas) {
+}
+// lib.optionalAttrs (!self.features.with_cublas && !self.features.with_clblas) {
   # https://localai.io/docs/getting-started/manual/
   llama =
     let
@@ -146,7 +152,12 @@ in
         # https://localai.io/features/text-generation/#chat-completions
         chat-completions = {
           inherit model;
-          messages = [{ role = "user"; content = "1 + 2 = ?"; }];
+          messages = [
+            {
+              role = "user";
+              content = "1 + 2 = ?";
+            }
+          ];
         };
         # https://localai.io/features/text-generation/#edit-completions
         edit-completions = {
@@ -172,7 +183,9 @@ in
         # TODO: Add test case parallel requests
         services.local-ai.parallelRequests = 2;
       };
-      passthru = { inherit models requests; };
+      passthru = {
+        inherit models requests;
+      };
       testScript =
         let
           port = "8080";
@@ -196,80 +209,88 @@ in
           machine.succeed("curl -f http://localhost:${port}/v1/completions --json @${writers.writeJSON "request-completions.json" requests.completions} --output completions.json")
           machine.copy_from_vm("completions.json")
           machine.succeed("${jq}/bin/jq --exit-status 'debug | .object ==\"text_completion\"' completions.json")
-          machine.succeed("${jq}/bin/jq --exit-status '.usage.completion_tokens | debug == ${toString model-configs.${model}.parameters.max_tokens}' completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status '.usage.completion_tokens | debug == ${
+            toString model-configs.${model}.parameters.max_tokens
+          }' completions.json")
 
           machine.succeed("${prom2json}/bin/prom2json http://localhost:${port}/metrics > metrics.json")
           machine.copy_from_vm("metrics.json")
         '';
     };
 
-} // lib.optionalAttrs (self.features.with_tts && !self.features.with_cublas && !self.features.with_clblas) {
-  # https://localai.io/features/text-to-audio/#piper
-  tts =
-    let
-      model-stt = "whisper-en";
-      model-configs.${model-stt} = {
-        backend = "whisper";
-        parameters.model = fetchurl {
-          url = "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en-q5_1.bin";
-          hash = "sha256-x3xXZvHO8JtrfUfyG1Rsvd1BV4hrO11tT3CekeZsfCs=";
-        };
-      };
-
-      model-tts = "piper-en";
-      model-configs.${model-tts} = {
-        backend = "piper";
-        parameters.model = "en-us-danny-low.onnx";
-      };
-
-      models =
-        let
-          models = genModels model-configs;
-        in
-        symlinkJoin {
-          inherit (models) name;
-          paths = [
-            models
-            (fetchzip {
-              url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-danny-low.tar.gz";
-              hash = "sha256-5wf+6H5HeQY0qgdqnAG1vSqtjIFM9lXH53OgouuPm0M=";
-              stripRoot = false;
-            })
-          ];
-        };
-
-      requests.request = {
-        model = model-tts;
-        input = "Hello, how are you?";
-      };
-    in
-    testers.runNixOSTest {
-      name = self.name + "-tts";
-      nodes.machine = {
-        imports = [ common-config ];
-        virtualisation.cores = 2;
-        services.local-ai.models = models;
-      };
-      passthru = { inherit models requests; };
-      testScript =
-        let
-          port = "8080";
-        in
-        ''
-          machine.wait_for_open_port(${port})
-          machine.succeed("curl -f http://localhost:${port}/readyz")
-          machine.succeed("curl -f http://localhost:${port}/v1/models --output models.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug' models.json")
-
-          machine.succeed("curl -f http://localhost:${port}/tts --json @${writers.writeJSON "request.json" requests.request} --output out.wav")
-          machine.copy_from_vm("out.wav")
-
-          machine.succeed("curl -f http://localhost:${port}/v1/audio/transcriptions --header 'Content-Type: multipart/form-data' --form file=@out.wav --form model=${model-stt} --output transcription.json")
-          machine.copy_from_vm("transcription.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .segments | first.text == \"${requests.request.input}\"' transcription.json")
-
-          machine.succeed("${prom2json}/bin/prom2json http://localhost:${port}/metrics > metrics.json")
-          machine.copy_from_vm("metrics.json")
-        '';
-    };
 }
+//
+  lib.optionalAttrs
+    (self.features.with_tts && !self.features.with_cublas && !self.features.with_clblas)
+    {
+      # https://localai.io/features/text-to-audio/#piper
+      tts =
+        let
+          model-stt = "whisper-en";
+          model-configs.${model-stt} = {
+            backend = "whisper";
+            parameters.model = fetchurl {
+              url = "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en-q5_1.bin";
+              hash = "sha256-x3xXZvHO8JtrfUfyG1Rsvd1BV4hrO11tT3CekeZsfCs=";
+            };
+          };
+
+          model-tts = "piper-en";
+          model-configs.${model-tts} = {
+            backend = "piper";
+            parameters.model = "en-us-danny-low.onnx";
+          };
+
+          models =
+            let
+              models = genModels model-configs;
+            in
+            symlinkJoin {
+              inherit (models) name;
+              paths = [
+                models
+                (fetchzip {
+                  url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-danny-low.tar.gz";
+                  hash = "sha256-5wf+6H5HeQY0qgdqnAG1vSqtjIFM9lXH53OgouuPm0M=";
+                  stripRoot = false;
+                })
+              ];
+            };
+
+          requests.request = {
+            model = model-tts;
+            input = "Hello, how are you?";
+          };
+        in
+        testers.runNixOSTest {
+          name = self.name + "-tts";
+          nodes.machine = {
+            imports = [ common-config ];
+            virtualisation.cores = 2;
+            services.local-ai.models = models;
+          };
+          passthru = {
+            inherit models requests;
+          };
+          testScript =
+            let
+              port = "8080";
+            in
+            ''
+              machine.wait_for_open_port(${port})
+              machine.succeed("curl -f http://localhost:${port}/readyz")
+              machine.succeed("curl -f http://localhost:${port}/v1/models --output models.json")
+              machine.succeed("${jq}/bin/jq --exit-status 'debug' models.json")
+
+              machine.succeed("curl -f http://localhost:${port}/tts --json @${writers.writeJSON "request.json" requests.request} --output out.wav")
+              machine.copy_from_vm("out.wav")
+
+              machine.succeed("curl -f http://localhost:${port}/v1/audio/transcriptions --header 'Content-Type: multipart/form-data' --form file=@out.wav --form model=${model-stt} --output transcription.json")
+              machine.copy_from_vm("transcription.json")
+              machine.succeed("${jq}/bin/jq --exit-status 'debug | .segments | first.text == \"${requests.request.input}\"' transcription.json")
+
+              machine.succeed("${prom2json}/bin/prom2json http://localhost:${port}/metrics > metrics.json")
+              machine.copy_from_vm("metrics.json")
+            '';
+        };
+    }
diff --git a/pkgs/by-name/lo/logiops/package.nix b/pkgs/by-name/lo/logiops/package.nix
index 283f09eae41a..3ffaf371d4bf 100644
--- a/pkgs/by-name/lo/logiops/package.nix
+++ b/pkgs/by-name/lo/logiops/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (oldAttrs: {
   pname = "logiops";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "PixlOne";
     repo = "logiops";
     rev = "v${oldAttrs.version}";
-    hash = "sha256-IL7jQA3lGhxVLYCFRgeXdadaBlQr+Op9cedHBlLUCWY=";
+    hash = "sha256-GAnlPqjIFGyOWwYFs7gth2m9ITc1jyiaW0sWwQ2zFOs=";
     # In v0.3.0, the `ipcgull` submodule was added as a dependency
     # https://github.com/PixlOne/logiops/releases/tag/v0.3.0
     fetchSubmodules = true;
diff --git a/pkgs/by-name/lu/luckybackup/package.nix b/pkgs/by-name/lu/luckybackup/package.nix
new file mode 100644
index 000000000000..7fe889178cf7
--- /dev/null
+++ b/pkgs/by-name/lu/luckybackup/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchurl,
+  libtool,
+  openssh,
+  pkg-config,
+  qt5,
+  rsync,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "luckybackup";
+  version = "0.5.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/luckybackup/${finalAttrs.version}/source/luckybackup-${finalAttrs.version}.tar.gz";
+    hash = "sha256-6AGvJIPL3WK8mvji3tJSxRrbrYFILikQQvWOIcPUkls=";
+  };
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    libtool
+    pkg-config
+    qt5.qmake
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    rsync
+    openssh
+  ];
+
+  strictDeps = true;
+
+  prePatch = ''
+    for File in \
+      luckybackup.pro \
+      menu/luckybackup-pkexec \
+      menu/luckybackup-su.desktop \
+      menu/luckybackup.desktop \
+      menu/net.luckybackup.su.policy \
+      src/functions.cpp \
+      src/global.cpp \
+      src/scheduleDialog.cpp; do
+        substituteInPlace $File --replace "/usr" "$out"
+    done
+  '';
+
+  meta = {
+    homepage = "https://luckybackup.sourceforge.net/";
+    description = "Powerful, fast and reliable backup & sync tool";
+    longDescription = ''
+      luckyBackup is an application for data back-up and synchronization
+      powered by the rsync tool.
+
+      It is simple to use, fast (transfers over only changes made and not
+      all data), safe (keeps your data safe by checking all declared directories
+      before proceeding in any data manipulation), reliable and fully
+      customizable.
+    '';
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "luckybackup";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/lu/lumafly/package.nix b/pkgs/by-name/lu/lumafly/package.nix
index c15e290b465c..24e45cb08708 100644
--- a/pkgs/by-name/lu/lumafly/package.nix
+++ b/pkgs/by-name/lu/lumafly/package.nix
@@ -12,13 +12,13 @@
 }:
 buildDotnetModule rec {
   pname = "lumafly";
-  version = "3.2.0.0";
+  version = "3.3.0.0";
 
   src = fetchFromGitHub {
     owner = "TheMulhima";
     repo = "lumafly";
     rev = "v${version}";
-    hash = "sha256-oDSM5Ev9SCjbvCgDZcpzm2bVnzG04yy/WaSwJyh0b18=";
+    hash = "sha256-GVPMAwxbq9XlKjMKd9G5yUol42f+6lSyHukN7NMCVDA=";
   };
 
   projectFile = "Lumafly/Lumafly.csproj";
diff --git a/pkgs/by-name/lx/lxgw-wenkai-tc/package.nix b/pkgs/by-name/lx/lxgw-wenkai-tc/package.nix
index fc8bb799930f..113d1c17b933 100644
--- a/pkgs/by-name/lx/lxgw-wenkai-tc/package.nix
+++ b/pkgs/by-name/lx/lxgw-wenkai-tc/package.nix
@@ -5,10 +5,10 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-wenkai-tc";
-  version = "1.330";
+  version = "1.500";
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwWenKaiTC/releases/download/v${version}/lxgw-wenkai-tc-v${version}.tar.gz";
-    hash = "sha256-qpX5shH1HbGMa287u/R1rMFgQeAUC0wwKFVD+QSTyho=";
+    hash = "sha256-GuGIRgBQTmlKmarEVFmZ2RgYtlw6mz3nfFdWbjlm934=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ma/marble-shell-theme/package.nix b/pkgs/by-name/ma/marble-shell-theme/package.nix
new file mode 100644
index 000000000000..35374f8c1ee3
--- /dev/null
+++ b/pkgs/by-name/ma/marble-shell-theme/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  python3,
+  colors ? [ "all" ], # Default to install all available colors
+  additionalInstallationTweaks ? [ ], # Additional installation tweaks
+}:
+assert lib.assertMsg (colors != [ ]) "The `colors` list can not be empty";
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "marble-shell-theme";
+  version = "46.2.3";
+
+  src = fetchFromGitHub {
+    owner = "imarkoff";
+    repo = "Marble-shell-theme";
+    rev = "5971b15d8115c60c3a16b1d219ecffd2cfcdb323";
+    hash = "sha256-TX6BSS29EAi2PjL1fMvEKD12RjB9xrfqPSQsJJrUcJg=";
+  };
+
+  nativeBuildInputs = [ python3 ];
+
+  patchPhase = ''
+    runHook prePatch
+    substituteInPlace scripts/config.py \
+      --replace-fail "~/.themes" ".themes"
+    runHook postPatch
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/themes
+    python install.py ${
+      lib.escapeShellArgs (map (color: "--${color}") colors)
+    } ${lib.escapeShellArgs additionalInstallationTweaks}
+    cp -r .themes/* $out/share/themes/
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Shell theme for GNOME DE";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    homepage = "https://github.com/imarkoff/Marble-shell-theme";
+    changelog = "https://github.com/imarkoff/Marble-shell-theme/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ aucub ];
+  };
+})
diff --git a/pkgs/by-name/ma/marwaita-red/package.nix b/pkgs/by-name/ma/marwaita-red/package.nix
index 4e65a2d83614..685d0df7d8ad 100644
--- a/pkgs/by-name/ma/marwaita-red/package.nix
+++ b/pkgs/by-name/ma/marwaita-red/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-red";
-  version = "21";
+  version = "22";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    hash = "sha256-VCNwWtAzMORF+gXjcLhJCsmllGD2xGgRSS3WxaVoRfU=";
+    hash = "sha256-oUJ74MNAFbbM123v7i+b29UEFFumswPI3DmqeeahMd4=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ma/marwaita-teal/package.nix b/pkgs/by-name/ma/marwaita-teal/package.nix
index 0c5784c3f71a..b9d2b3f15a6b 100644
--- a/pkgs/by-name/ma/marwaita-teal/package.nix
+++ b/pkgs/by-name/ma/marwaita-teal/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-teal";
-  version = "21";
+  version = "22";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    hash = "sha256-9WH/mbnLLLAf8B5Fwd7PMRAX2psWVJn7gGO4C5KkLjM=";
+    hash = "sha256-aSzeF4winpea21gADa/HT+a+FZ4Ykrpue/ePmveJU8E=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/science/math/mathmod/fix-paths.patch b/pkgs/by-name/ma/mathmod/fix-paths.patch
similarity index 100%
rename from pkgs/applications/science/math/mathmod/fix-paths.patch
rename to pkgs/by-name/ma/mathmod/fix-paths.patch
diff --git a/pkgs/applications/science/math/mathmod/default.nix b/pkgs/by-name/ma/mathmod/package.nix
similarity index 56%
rename from pkgs/applications/science/math/mathmod/default.nix
rename to pkgs/by-name/ma/mathmod/package.nix
index dd85d0678492..df64cf723125 100644
--- a/pkgs/applications/science/math/mathmod/default.nix
+++ b/pkgs/by-name/ma/mathmod/package.nix
@@ -1,18 +1,19 @@
-{ lib
-, mkDerivation
-, fetchFromGitHub
-, qmake
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsForQt5,
 }:
 
-mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mathmod";
-  version = "11.1-unstable-2024-01-26";
+  version = "12.0";
 
   src = fetchFromGitHub {
     owner = "parisolab";
     repo = "mathmod";
-    rev = "24d03a04c17363520ae7cf077e72a7b8684eb6fd";
-    hash = "sha256-HiqHssPGqYEVZWchZRj4rFPc+xNVZk1ryl5qvFC2BmQ=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-h1iI7bheJVfE2+0m6Yk7QNCkl9Vye97tqb/WkQExVcQ=";
   };
 
   patches = [ ./fix-paths.patch ];
@@ -21,9 +22,13 @@ mkDerivation {
     substituteInPlace MathMod.pro --subst-var out
   '';
 
-  nativeBuildInputs = [ qmake ];
+  nativeBuildInputs = with libsForQt5; [
+    qmake
+    wrapQtAppsHook
+  ];
 
   meta = {
+    changelog = "https://github.com/parisolab/mathmod/releases/tag/${finalAttrs.version}";
     description = "Mathematical modelling software";
     homepage = "https://github.com/parisolab/mathmod";
     license = lib.licenses.gpl2Plus;
@@ -31,4 +36,4 @@ mkDerivation {
     maintainers = with lib.maintainers; [ tomasajt ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/servers/geospatial/mbtileserver/default.nix b/pkgs/by-name/mb/mbtileserver/package.nix
similarity index 78%
rename from pkgs/servers/geospatial/mbtileserver/default.nix
rename to pkgs/by-name/mb/mbtileserver/package.nix
index 853aad3e18aa..6c1b248a4af8 100644
--- a/pkgs/servers/geospatial/mbtileserver/default.nix
+++ b/pkgs/by-name/mb/mbtileserver/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mbtileserver";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "consbio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hKDgKiy3tmZ7gxmxZlflJHcxatrSqE1d1uhSLJh8XLo=";
+    sha256 = "sha256-RLaAhc24zdCFvpSN2LZXNyS1ygg9zCi4jEj8owdreWU=";
   };
 
-  vendorHash = "sha256-QcyFnzRdGdrVqgKEMbhaD7C7dkGKKhTesMMZKrrLx70=";
+  vendorHash = "sha256-yn7LcR/DvHDSRicUnWLrFZKqZti+YQoLSk3mZkDIj10=";
 
   meta = with lib; {
     description = "Simple Go-based server for map tiles stored in mbtiles format";
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 665b0d5cd889..ef5dac3d58fe 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -38,13 +38,13 @@ let
 in
 php.buildComposerProject (finalAttrs: {
   pname = "movim";
-  version = "0.27.1";
+  version = "0.28";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-7/8d+GU/hLaiFqo4Rl0ardhOwEpSeJ3GfJMNpGbNlnU=";
+    hash = "sha256-mjBeBu1seH5XMls+e4ON13ayVeugKogbNTzbjp1pUjE=";
   };
 
   php = php.buildEnv ({
@@ -67,7 +67,7 @@ php.buildComposerProject (finalAttrs: {
   # pinned commonmark
   composerStrictValidation = false;
 
-  vendorHash = "sha256-wDnOh1CdJOovqmr4k45ksycuylYwL0Dm/UTl4EETf1k=";
+  vendorHash = "sha256-ZfMUpkIRCAsiQf6PEVPrMpljZWjP9JXf+nEFA/LunsQ=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;
diff --git a/pkgs/by-name/mo/mozillavpn/package.nix b/pkgs/by-name/mo/mozillavpn/package.nix
index 0d480d4eefa4..828300f4e5ff 100644
--- a/pkgs/by-name/mo/mozillavpn/package.nix
+++ b/pkgs/by-name/mo/mozillavpn/package.nix
@@ -1,4 +1,5 @@
 {
+  _experimental-update-script-combinators,
   buildGoModule,
   cargo,
   cmake,
@@ -9,6 +10,7 @@
   libgcrypt,
   libgpg-error,
   libsecret,
+  nix-update-script,
   pkg-config,
   python3,
   qt6,
@@ -20,27 +22,26 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mozillavpn";
-  version = "2.24.0";
+  version = "2.24.1";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-iTnwx+KPZ5b8qT0fEMUCGQx1UyGVM4VCzooZqslGWtw=";
+    hash = "sha256-X2rtHAZ9vbWjuOmD3B/uPasUQ1Q+b4SkNqk4MqGMaYo=";
   };
   patches = [ ];
 
-  netfilterGoModules =
-    (buildGoModule {
-      inherit (finalAttrs)
-        pname
-        version
-        src
-        patches
-        ;
-      modRoot = "linux/netfilter";
-      vendorHash = "sha256-Cmo0wnl0z5r1paaEf1MhCPbInWeoMhGjnxCxGh0cyO8=";
-    }).goModules;
+  netfilter = buildGoModule {
+    pname = "${finalAttrs.pname}-netfilter";
+    inherit (finalAttrs)
+      version
+      src
+      patches
+      ;
+    modRoot = "linux/netfilter";
+    vendorHash = "sha256-Cmo0wnl0z5r1paaEf1MhCPbInWeoMhGjnxCxGh0cyO8=";
+  };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src patches;
@@ -83,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace extension/CMakeLists.txt \
       --replace '/etc' "$out/etc"
 
-    ln -s '${finalAttrs.netfilterGoModules}' linux/netfilter/vendor
+    ln -s '${finalAttrs.netfilter.goModules}' linux/netfilter/vendor
   '';
 
   cmakeFlags = [
@@ -100,6 +101,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.makeBinPath [ wireguard-tools ])
   ];
 
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (nix-update-script { })
+    (nix-update-script {
+      attrPath = "mozillavpn.netfilter";
+      extraArgs = [ "--version=skip" ];
+    })
+  ];
+
   meta = {
     description = "Client for the Mozilla VPN service";
     mainProgram = "mozillavpn";
diff --git a/pkgs/by-name/no/notcurses/package.nix b/pkgs/by-name/no/notcurses/package.nix
index 67c640ddb265..4fca583a6264 100644
--- a/pkgs/by-name/no/notcurses/package.nix
+++ b/pkgs/by-name/no/notcurses/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "notcurses";
-  version = "3.0.9";
+  version = "3.0.11";
 
   src = fetchFromGitHub {
     owner = "dankamongmen";
     repo = "notcurses";
     rev = "v${version}";
-    sha256 = "sha256-8SJeqLcV4xp968YgGsJccsgpB5wwaJDaoWsaYxf8upM=";
+    sha256 = "sha256-3ddiHzPZ74GN2Hu+6Oe1DaNFn6S9gegGwXSX8fbtPp8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index 46eec0465ebd..db143bf1a513 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
-  version = "7.6.0";
+  version = "7.7.0";
 
   src = fetchzip {
     url = "https://github.com/theotherp/nzbhydra2/releases/download/v${version}/nzbhydra2-${version}-generic.zip";
-    hash = "sha256-EMp7bR3VCFWgg32ddUzAIEVINIeGXq8qBiIp3G/YI0I=";
+    hash = "sha256-8Q/aTMwHFy7OG+VyoSRYlXp4l247nUSPP0YCMkv9Cec=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/op/opencomposite/package.nix b/pkgs/by-name/op/opencomposite/package.nix
index af7d7f0e3ec7..50877ded84ca 100644
--- a/pkgs/by-name/op/opencomposite/package.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation {
   pname = "opencomposite";
-  version = "0-unstable-2024-09-13";
+  version = "0-unstable-2024-10-02";
 
   src = fetchFromGitLab {
     owner = "znixian";
     repo = "OpenOVR";
-    rev = "f8db7aa35831753f00215a2d9ba7197a80d7bacd";
-    hash = "sha256-3fqh7Kth5XFcDsJUMmR2af+r5QPW3/mAsEauGUXaWq8=";
+    rev = "f969a972e9a151de776fa8d1bd6e67056f0a5d5d";
+    hash = "sha256-CE+ushwNv8kQSXtrQ6K5veBmpQvQaMKk6P9G1wV2uvM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/os/ossia-score/package.nix b/pkgs/by-name/os/ossia-score/package.nix
index 8eb6df45db9a..ee8e0a99a948 100644
--- a/pkgs/by-name/os/ossia-score/package.nix
+++ b/pkgs/by-name/os/ossia-score/package.nix
@@ -111,7 +111,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     "-DSuil_INCLUDE_DIR=${suil}/include/suil-0"
   ];
 
-  # Needed for libraries that get dlopen'd
+  # Needed for libraries that get dlopen'd
   env.NIX_LDFLAGS = toString [
     "-lasound"
     "-llilv-0"
diff --git a/pkgs/by-name/pi/pietrasanta-traceroute/package.nix b/pkgs/by-name/pi/pietrasanta-traceroute/package.nix
index 2c2b824f8616..78ec9b537289 100644
--- a/pkgs/by-name/pi/pietrasanta-traceroute/package.nix
+++ b/pkgs/by-name/pi/pietrasanta-traceroute/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pietrasanta-traceroute";
-  version = "0.0.5-unstable-2024-06-11";
+  version = "0.0.5-unstable-2024-09-06";
 
   src = fetchFromGitHub {
     owner = "catchpoint";
     repo = "Networking.traceroute";
-    rev = "5b9f9cd2cbd5b8d90442d4ddb71ab788297e2153";
-    hash = "sha256-/WsBh42brVCRP31LnCPS34kRaQKMvP+XEENyD5MjCfw=";
+    rev = "e4a5cf94dccd646e03b9b75a762e9b014e3a3128";
+    hash = "sha256-5FbuITewgSh6UFUU1vttkokk8uZ2IrzkDwsCuWJPKlM=";
   };
   passthru.updateScript = unstableGitUpdater { };
 
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index ef25d0a3eba9..04618f14d5e9 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.41.1";
+  version = "0.41.3";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${version}";
-    hash = "sha256-IQKFQvWEPB5yssvdHl6gGmgxkbXzpRhU6hqaTLsQizE=";
+    hash = "sha256-FkuHKfrMH+l/k9lfFhbG619KoDIxmEYwoaniHSPF8hQ=";
   };
 
-  cargoHash = "sha256-SvdfTiyJhJ4w9aBiElh9zgug8hNwiX7xUjtYFjykJqc=";
+  cargoHash = "sha256-vll9ckegcECmzoOkTCe2q2M1r4s5JlUnv2DtzJEQ7bY=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index 3541b7466af2..81262e2cf051 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-13";
+  version = "GE-Proton9-15";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-/KaFYCLvojxH3coiJaArXMPIIwW5qzK+I0bGyt7oBNY=";
+    hash = "sha256-WeqntQxez6XPRZxpPNUAQ8/7sw6TzOKU1yrtPHmQNh0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index afcd0483eb60..be85c54ffc17 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-pass";
-  version = "1.22.1";
+  version = "1.23.0";
 
   src = fetchurl {
-    url = "https://proton.me/download/PassDesktop/linux/x64/ProtonPass_${finalAttrs.version}.deb";
-    hash = "sha256-DIA54xxJ8Nhh8wb4p13yjdenqgTgenAH4Tmbqk3IXwo=";
+    url = "https://proton.me/download/pass/linux/x64/proton-pass_${finalAttrs.version}_amd64.deb";
+    hash = "sha256-ewrPk3v1jgF87uY+7P8oQdWARcuFKdfiM1BzulMPBpg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
new file mode 100644
index 000000000000..17d161aa707b
--- /dev/null
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -0,0 +1,143 @@
+{
+  lib,
+  addDriverRunpath,
+  autoconf,
+  automake,
+  bison,
+  cmake,
+  fetchFromGitHub,
+  libXdmcp,
+  libglvnd,
+  libpthreadstubs,
+  makeWrapper,
+  nix-update-script,
+  pcre,
+  pkg-config,
+  python311Packages,
+  qt5,
+  stdenv,
+  vulkan-loader,
+  wayland,
+  # Boolean flags
+  waylandSupport ? true,
+}:
+
+let
+  custom_swig = fetchFromGitHub {
+    owner = "baldurk";
+    repo = "swig";
+    rev = "renderdoc-modified-7";
+    hash = "sha256-RsdvxBBQvwuE5wSwL8OBXg5KMSpcO6EuMS0CzWapIpc=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "renderdoc";
+  version = "1.35";
+
+  src = fetchFromGitHub {
+    owner = "baldurk";
+    repo = "renderdoc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-iBe3JNtG9P1IAd00s/fL2RcImMrTwruld98OFHrIhp4=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  buildInputs =
+    [
+      libXdmcp
+      libpthreadstubs
+      python311Packages.pyside2
+      python311Packages.pyside2-tools
+      python311Packages.shiboken2
+      qt5.qtbase
+      qt5.qtsvg
+      vulkan-loader
+    ]
+    ++ lib.optionals waylandSupport [
+      wayland
+    ];
+
+  nativeBuildInputs = [
+    addDriverRunpath
+    autoconf
+    automake
+    bison
+    cmake
+    makeWrapper
+    pcre
+    pkg-config
+    python311Packages.python
+    qt5.qtx11extras
+    qt5.wrapQtAppsHook
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "BUILD_VERSION_HASH" finalAttrs.src.rev)
+    (lib.cmakeFeature "BUILD_VERSION_DIST_NAME" "NixOS")
+    (lib.cmakeFeature "BUILD_VERSION_DIST_VER" finalAttrs.version)
+    (lib.cmakeFeature "BUILD_VERSION_DIST_CONTACT" "https://github.com/NixOS/nixpkgs/")
+    (lib.cmakeBool "BUILD_VERSION_STABLE" true)
+    (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
+  ];
+
+  dontWrapQtApps = true;
+
+  strictDeps = true;
+
+  postUnpack = ''
+    cp -r ${custom_swig} swig
+    chmod -R +w swig
+    patchShebangs swig/autogen.sh
+  '';
+
+  # TODO: define these in the above array via placeholders, once those are
+  # widely supported
+  preConfigure = ''
+    cmakeFlagsArray+=(
+      "-DRENDERDOC_SWIG_PACKAGE=$PWD/../swig"
+      "-DVULKAN_LAYER_FOLDER=$out/share/vulkan/implicit_layer.d/"
+     )
+  '';
+
+  preFixup =
+    let
+      libPath = lib.makeLibraryPath [
+        libglvnd
+        vulkan-loader
+      ];
+    in
+    ''
+      wrapQtApp $out/bin/qrenderdoc \
+        --suffix LD_LIBRARY_PATH : "$out/lib:${libPath}"
+      wrapProgram $out/bin/renderdoccmd \
+        --suffix LD_LIBRARY_PATH : "$out/lib:${libPath}"
+    '';
+
+  # The only documentation for this so far is in the setup-hook.sh script from
+  # add-opengl-runpath
+  postFixup = ''
+    addDriverRunpath $out/lib/librenderdoc.so
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://renderdoc.org/";
+    description = "Single-frame graphics debugger";
+    longDescription = ''
+      RenderDoc is a free MIT licensed stand-alone graphics debugger that
+      allows quick and easy single-frame capture and detailed introspection
+      of any application using Vulkan, D3D11, OpenGL or D3D12 across
+      Windows 7 - 10, Linux or Android.
+    '';
+    license = lib.licenses.mit;
+    mainProgram = "renderdoccmd";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.i686);
+  };
+})
diff --git a/pkgs/by-name/rt/rtorrent/package.nix b/pkgs/by-name/rt/rtorrent/package.nix
index 2a0d94a412a8..53acbd8ea9f4 100644
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@@ -15,18 +15,18 @@
 , xmlrpc_c
 , zlib
 , nixosTests
-, unstableGitUpdater
+, gitUpdater
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rakshasa-rtorrent";
-  version = "0.9.8-unstable-2024-09-07";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "9a93281ded3f6c6bb40593f9bbd3597683cff263";
-    hash = "sha256-dbZ0Q6v6vu8rlr7p1rPc3Cx/9R53OelkoTNsdAVQAxE=";
+    rev = "v${version}";
+    hash = "sha256-G/30Enycpqg/pWC95CzT9LY99kN4tI+S8aSQhnQO+M8=";
   };
 
   outputs = [ "out" "man" ];
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
   ];
 
   passthru = {
-    updateScript = unstableGitUpdater { tagPrefix = "v"; };
+    updateScript = gitUpdater { tagPrefix = "v"; };
     tests = {
       inherit (nixosTests) rtorrent;
     };
diff --git a/pkgs/by-name/se/sendme/package.nix b/pkgs/by-name/se/sendme/package.nix
index ea5d670af8a2..f277c2a007c3 100644
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sendme";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nDYsNaR3NQ6ut6gtHwEoiwhj4B4Bac5+NOOq3H2NCYY=";
+    hash = "sha256-YnabQ8YHDsFYu5RX3E2NvPARsl+qn4688q9KxZ5Fegc=";
   };
 
-  cargoHash = "sha256-U2/GUpWtpTX+RCBojh3N6DsWB0gjFkH1mGA+AS+fH+o=";
+  cargoHash = "sha256-yD40QKceLjtq80K6I98bT27sCAkCnkRkfE3m4eGjueU=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/by-name/sl/slweb/package.nix b/pkgs/by-name/sl/slweb/package.nix
new file mode 100644
index 000000000000..ceabcd001d1b
--- /dev/null
+++ b/pkgs/by-name/sl/slweb/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromSourcehut,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "slweb";
+  version = "0.10.1";
+
+  src = fetchFromSourcehut {
+    owner = "~strahinja";
+    repo = "slweb";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AJg8qgbNUKizU0uyTnq9EviIXOUuaGvQowLAyTWhGTY=";
+  };
+
+  postPatch = ''
+    substituteInPlace config.mk \
+      --replace-fail "/usr/local" "$out"
+  '';
+
+  env = {
+    FALLBACKVER = finalAttrs.version;
+  };
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Static website generator which aims at being simplistic";
+    homepage = "https://strahinja.srht.site/slweb/";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "slweb";
+  };
+})
diff --git a/pkgs/by-name/te/tetrio-plus/package.nix b/pkgs/by-name/te/tetrio-plus/package.nix
index 460741366612..86ee4bda8d70 100644
--- a/pkgs/by-name/te/tetrio-plus/package.nix
+++ b/pkgs/by-name/te/tetrio-plus/package.nix
@@ -18,14 +18,14 @@
 }:
 
 let
-  version = "0.27.2";
+  version = "0.27.4";
   rev = "electron-v${version}-tetrio-v${tetrio-desktop.version}";
 
   src = fetchFromGitLab {
     owner = "UniQMG";
     repo = "tetrio-plus";
     inherit rev;
-    hash = "sha256-pcT8/YsfHeimSkeNziW9ha63hEgCg2vnvJSZAY1c7P0=";
+    hash = "sha256-HwGFg8dxqtqghdP+PXWXr6Fi5vfgopThs+QNa3N1awk=";
     fetchSubmodules = true;
   };
 
@@ -41,7 +41,7 @@ let
 
     sourceRoot = "${src.name}/tpsecore";
 
-    cargoHash = "sha256-K9l8wQOtjf3l8gZMMdVnaNrgzVWGl62iBBcpA+ulJbw=";
+    cargoHash = "sha256-zqeoPeGZvSz7W3c7MXnvvq73hvavg1RGzPc3iTqAjBo=";
 
     nativeBuildInputs = [
       wasm-pack
diff --git a/pkgs/by-name/te/tex-fmt/package.nix b/pkgs/by-name/te/tex-fmt/package.nix
index 13a7195668d1..2a13821d7297 100644
--- a/pkgs/by-name/te/tex-fmt/package.nix
+++ b/pkgs/by-name/te/tex-fmt/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tex-fmt";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "WGUNDERWOOD";
     repo = "tex-fmt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Atq/eyvdAuaUEeYDIC5D9icD44mcvuhsyuctYAPrBSU=";
+    hash = "sha256-o8TlD0qxz/0sS45tnBNXYNDzp+VAhH3Ym1odSleD/uw=";
   };
 
-  cargoHash = "sha256-ShF2Z5Od/pgsNRM6WmxxFeE67pYZin1q4RR6nVmbrsA=";
+  cargoHash = "sha256-N3kCeBisjeOAG45QPQhplGRAvj5kebEX4U9pisM/GUQ=";
 
   meta = {
     description = "LaTeX formatter written in Rust";
diff --git a/pkgs/by-name/wa/waagent/package.nix b/pkgs/by-name/wa/waagent/package.nix
index f313cb68ea70..0f643690921f 100644
--- a/pkgs/by-name/wa/waagent/package.nix
+++ b/pkgs/by-name/wa/waagent/package.nix
@@ -13,12 +13,12 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "waagent";
-  version = "2.11.1.4";
+  version = "2.11.1.12";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "WALinuxAgent";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5V9js9gGkIsdGYrQQK/V6tPfL9lh2Cht4llOKBVTyOM=";
+    hash = "sha256-1MaPjz9hWb/kJxuyJAUWPk065vpSyx2jq1ZSlDB4yFo=";
   };
   patches = [
     # Suppress the following error when waagent tries to configure sshd:
diff --git a/pkgs/by-name/wa/waveterm/package.nix b/pkgs/by-name/wa/waveterm/package.nix
index 450614b5cc25..cc1053d58fe2 100644
--- a/pkgs/by-name/wa/waveterm/package.nix
+++ b/pkgs/by-name/wa/waveterm/package.nix
@@ -36,7 +36,7 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   pname = "waveterm";
-  version = "0.8.7";
+  version = "0.8.8";
 
   suffix =
     {
@@ -51,10 +51,10 @@ let
     url = "https://github.com/wavetermdev/waveterm/releases/download/v${version}/${suffix}";
     hash =
       {
-        x86_64-linux = "sha256-pWBKZid8sumi/EP3DA5KcLnZsHsuKYK6E6NHXdWKh8s=";
-        aarch64-linux = "sha256-2paRX+OGPSEktV4S+V43ZE9UgltLYZ+Nyba5/miBQkA=";
-        x86_64-darwin = "sha256-tsqw597gQIMnQ/OPZhrWwaRliF94KyS+ryajttDLqBA=";
-        aarch64-darwin = "sha256-PD38UBSNKuv836P/py/CtrLOlddHa0+w7R20YVY4Ybc=";
+        x86_64-linux = "sha256-hRpJTFVoBQZyJD06FTRbBPj/1DlYlDWPRjJ1IKeK7Cs=";
+        aarch64-linux = "sha256-T3VqsoHhPYYrAe/dEd0SUH+G4jpHjKpJTrFy8/AgoKI=";
+        x86_64-darwin = "sha256-UlyNl2Qu59L4hnK8rTeUV30YVD45L7ub5SP8f97aJrw=";
+        aarch64-darwin = "sha256-cP+z8DQsNBJc3p57xQdGqqq7jvYcRQRIa+P+6kD3eCc=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/by-name/wi/winbox4/package.nix b/pkgs/by-name/wi/winbox4/package.nix
new file mode 100644
index 000000000000..a3c9a7b83a9a
--- /dev/null
+++ b/pkgs/by-name/wi/winbox4/package.nix
@@ -0,0 +1,126 @@
+{
+  autoPatchelfHook,
+  copyDesktopItems,
+  fetchurl,
+  fontconfig,
+  freetype,
+  lib,
+  libGL,
+  libxkbcommon,
+  makeDesktopItem,
+  makeWrapper,
+  stdenvNoCC,
+  unzip,
+  writeShellApplication,
+  xorg,
+  zlib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "winbox";
+  version = "4.0beta9";
+
+  src = fetchurl {
+    name = "WinBox_Linux-${finalAttrs.version}.zip";
+    url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/WinBox_Linux.zip";
+    hash = "sha256-129ejj3WxYx5kQTy6EOLtBolhx076yMVb5ymkAoXrwc=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    # makeBinaryWrapper does not support --run
+    makeWrapper
+    unzip
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libGL
+    libxkbcommon
+    xorg.libxcb
+    xorg.xcbutilimage
+    xorg.xcbutilkeysyms
+    xorg.xcbutilrenderutil
+    xorg.xcbutilwm
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 "assets/img/winbox.png" "$out/share/pixmaps/winbox.png"
+    install -Dm755 "WinBox" "$out/bin/WinBox"
+
+    wrapProgram "$out/bin/WinBox" --run "${lib.getExe finalAttrs.migrationScript}"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "winbox";
+      desktopName = "Winbox";
+      comment = "GUI administration for Mikrotik RouterOS";
+      exec = "WinBox";
+      icon = "winbox";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  migrationScript = writeShellApplication {
+    name = "winbox-migrate";
+    text = ''
+      XDG_DATA_HOME=''${XDG_DATA_HOME:-$HOME/.local/share}
+      targetFile="$XDG_DATA_HOME/MikroTik/WinBox/Addresses.cdb"
+
+      if [ -f "$targetFile" ]; then
+        echo "NixOS: WinBox 4 data already present at $(dirname "$targetFile"). Skipping automatic migration."
+        exit 0
+      fi
+
+      # cover both wine prefix variants
+      # latter was used until https://github.com/NixOS/nixpkgs/pull/329626 was merged on 2024/07/24
+      winePrefixes=(
+        "''${WINEPREFIX:-$HOME/.wine}"
+        "''${WINBOX_HOME:-$XDG_DATA_HOME/winbox}/wine"
+      )
+      sourceFilePathSuffix="drive_c/users/$USER/AppData/Roaming/Mikrotik/Winbox/Addresses.cdb"
+      selectedSourceFile=""
+
+      for prefix in "''${winePrefixes[@]}"
+      do
+        echo "NixOS: Probing WinBox 3 data path at $prefix..."
+        if [ -f "$prefix/$sourceFilePathSuffix" ]; then
+          selectedSourceFile="$prefix/$sourceFilePathSuffix"
+          break
+        fi
+      done
+
+      if [ -z "$selectedSourceFile" ]; then
+        echo "NixOS: WinBox 3 data not found. Skipping automatic migration."
+        exit 0
+      fi
+
+      echo "NixOS: Automatically migrating WinBox 3 data..."
+      install -Dvm644 "$selectedSourceFile" "$targetFile"
+    '';
+  };
+
+  meta = {
+    description = "Graphical configuration utility for RouterOS-based devices";
+    homepage = "https://mikrotik.com";
+    downloadPage = "https://mikrotik.com/download";
+    changelog = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/CHANGELOG";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    mainProgram = "WinBox";
+    maintainers = with lib.maintainers; [
+      Scrumplex
+      yrd
+    ];
+  };
+})
diff --git a/pkgs/by-name/wl/wlink/package.nix b/pkgs/by-name/wl/wlink/package.nix
new file mode 100644
index 000000000000..2b8e2c4a377f
--- /dev/null
+++ b/pkgs/by-name/wl/wlink/package.nix
@@ -0,0 +1,52 @@
+{
+  stdenv,
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  libusb1,
+  udev,
+  nix-update-script,
+  testers,
+  wlink,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wlink";
+  version = "0.0.9";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-Jr494jsw9nStU88j1rHc3gyQR1jcMfDIyQ2u0SwkXt0=";
+  };
+
+  cargoHash = "sha256-rPiSEfRFESYxFOat92oMUABvmz0idZu/I1S7I3g5BgY=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libusb1
+    udev
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = wlink;
+    };
+  };
+
+  meta = with lib; {
+    description = "WCH-Link flash tool for WCH's RISC-V MCUs(CH32V, CH56X, CH57X, CH58X, CH59X, CH32L103, CH32X035, CH641, CH643)";
+    homepage = "https://github.com/ch32-rs/wlink";
+    changelog = "https://github.com/ch32-rs/wlink/releases/tag/v${version}";
+    license = with licenses; [
+      mit # or
+      asl20
+    ];
+    platforms = with platforms; linux ++ darwin ++ windows;
+    broken = !stdenv.hostPlatform.isLinux;
+    maintainers = with maintainers; [ jwillikers ];
+    mainProgram = "wlink";
+  };
+}
diff --git a/pkgs/by-name/ws/wstunnel/Cargo.lock b/pkgs/by-name/ws/wstunnel/Cargo.lock
new file mode 100644
index 000000000000..23168aeacee7
--- /dev/null
+++ b/pkgs/by-name/ws/wstunnel/Cargo.lock
@@ -0,0 +1,3231 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5fb1d8e4442bd405fdfd1dacb42792696b0cf9cb15882e5d097b742a676d375"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64e15c1ab1f89faffbf04a634d5e1962e9074f2741eef6d97f3c4e322426d526"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb47de1e80c2b463c735db5b217a0ddc39d612e7ac9e2e96a5aed1f57616c1cb"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d36fc52c7f6c869915e99412912f22093507da8d9e942ceaf66fe4b7c14422a"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86fdf8605db99b54d3cd748a44c6d04df638eb5dafb219b135d0149bd0db01f6"
+
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f95446d919226d587817a7d21379e6eb099b97b45110a7f272a444ca5c54070"
+dependencies = [
+ "aws-lc-sys",
+ "mirai-annotations",
+ "paste",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3ddc4a5b231dd6958b140ff3151b6412b3f4321fab354f399eec8f14b06df62"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "libc",
+ "paste",
+]
+
+[[package]]
+name = "backtrace"
+version = "0.3.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bb8"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b10cf871f3ff2ce56432fddc2615ac7acc3aa22ca321f8fea800846fbb32f188"
+dependencies = [
+ "async-trait",
+ "futures-util",
+ "parking_lot",
+ "tokio",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+dependencies = [
+ "bitflags 2.6.0",
+ "cexpr",
+ "clang-sys",
+ "itertools",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn",
+ "which",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bollard"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d41711ad46fda47cd701f6908e59d1bd6b9a2b7464c0d0aeab95c6d37096ff8a"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "pin-project-lite",
+ "rustls 0.23.13",
+ "rustls-native-certs 0.7.3",
+ "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.45.0-rc.26.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d7c5415e3a6bc6d3e99eff6268e488fd4ee25e7b28c10f08fa6760bd9de16e4"
+dependencies = [
+ "serde",
+ "serde_repr",
+ "serde_with",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "428d9aa8fbc0670b7b8d6030a7fadd0f86151cae55e4dbbece15f3780a3dfaf3"
+
+[[package]]
+name = "cc"
+version = "1.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812acba72f0a070b003d3697490d2b55b837230ae7c6c6497f05cc2ddbb8d938"
+dependencies = [
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7be5744db7978a28d9df86a214130d106a89ce49644cbc4e3f0c22c3fba30615"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5fbc17d3ef8278f55b282b2a2e75ae6f6c7d4bb70ed3d0382375104bfafdb4b"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97"
+
+[[package]]
+name = "cmake"
+version = "0.1.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1e43aa7fd152b1f968787f7dbcdeb306d1867ff373c69955211876c053f91a"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608697df725056feaccfa42cffdaeeec3fccc4ffc38358ecd19b243e716a78e0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "crossterm"
+version = "0.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
+dependencies = [
+ "bitflags 2.6.0",
+ "crossterm_winapi",
+ "mio 1.0.2",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31951f49556e34d90ed28342e1df7e1cb7a229c4cab0aecc627b5d91edd41d07"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "either"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f214dc438f977e6d4e3500aaa277f5ad94ca83fbbd9b1a15713ce2344ccc5a1"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fast-socks5"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f89f36d4ee12370d30d57b16c7e190950a1a916e7dbbb5fd5a412f5ef913fe84"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "log",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+]
+
+[[package]]
+name = "fastwebsockets"
+version = "0.8.0"
+source = "git+https://github.com/erebe/fastwebsockets.git#ef904598ec168d7748b28d77ec1803ba721932d8"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project",
+ "rand",
+ "sha1",
+ "simdutf8",
+ "thiserror",
+ "tokio",
+ "utf-8",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "fsevent-sys"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+
+[[package]]
+name = "futures-task"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+
+[[package]]
+name = "futures-util"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gimli"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32085ea23f3234fc7846555e85283ba4de91e21016dc0455a16286d87a292d64"
+
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
+[[package]]
+name = "h2"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 0.2.12",
+ "indexmap 2.6.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.1.0",
+ "indexmap 2.6.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hickory-proto"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07698b8420e2f0d6447a436ba999ec85d8fbf2a398bbd737b82cac4a2e96e512"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "h2 0.3.26",
+ "http 0.2.12",
+ "idna 0.4.0",
+ "ipnet",
+ "once_cell",
+ "rand",
+ "rustls 0.21.12",
+ "rustls-native-certs 0.6.3",
+ "rustls-pemfile 1.0.4",
+ "thiserror",
+ "tinyvec",
+ "tokio",
+ "tokio-rustls 0.24.1",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28757f23aa75c98f254cf0405e6d8c25b831b32921b050a66692427679b1f243"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "lru-cache",
+ "once_cell",
+ "parking_lot",
+ "rand",
+ "resolv-conf",
+ "rustls 0.21.12",
+ "rustls-native-certs 0.6.3",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-rustls 0.24.1",
+ "tracing",
+]
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "hostname"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
+dependencies = [
+ "libc",
+ "match_cfg",
+ "winapi",
+]
+
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http 1.1.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "h2 0.4.6",
+ "http 1.1.0",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
+dependencies = [
+ "futures-util",
+ "http 1.1.0",
+ "hyper",
+ "hyper-util",
+ "rustls 0.23.13",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.26.0",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.1.0",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "idna"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.0",
+ "serde",
+]
+
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "ipconfig"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+dependencies = [
+ "socket2",
+ "widestring",
+ "windows-sys 0.48.0",
+ "winreg",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "187674a687eed5fe42285b40c6291f9a01517d415fad1c3cbc6a9f778af7fcd4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
+[[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.70"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "9.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ae10193d25051e74945f1ea2d0b42e03cc3b890f7e4cc5faa44997d808193f"
+dependencies = [
+ "base64 0.21.7",
+ "js-sys",
+ "ring",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "kqueue"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.159"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+
+[[package]]
+name = "libloading"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "libredox"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+dependencies = [
+ "bitflags 2.6.0",
+ "libc",
+ "redox_syscall 0.5.7",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "lru-cache"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
+dependencies = [
+ "linked-hash-map",
+]
+
+[[package]]
+name = "match_cfg"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
+
+[[package]]
+name = "matchers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+dependencies = [
+ "regex-automata 0.1.10",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "mio"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "mirai-annotations"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.6.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.6.0",
+ "crossbeam-channel",
+ "filetime",
+ "fsevent-sys",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio 0.8.11",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.36.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82881c4be219ab5faaf2ad5e5e5ecdff8c66bd7402ca3160975c93b24961afd1"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.7",
+ "smallvec",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax 0.8.5",
+ "structmeta",
+ "syn",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "portable-atomic"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppp"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d901d7dd743c478e14af9518bdbc33e53e50be56429233f812537f29dbf0d1"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479cf940fbbb3426c32c5d5176f62ad57549a0bb84773423ba8be9d089f5faba"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54077e1872c46788540de1ea3d7f4ccb1983d12f9aa909b234468676c1a36779"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+dependencies = [
+ "bitflags 2.6.0",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.8",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "resolv-conf"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52e44394d2086d010551b14b53b1f24e31647570cd1deb0379e2c21b329aba00"
+dependencies = [
+ "hostname",
+ "quick-error",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "spin",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2dabaac7466917e566adb06783a81ca48944c6898a1b08b9374106dd671f4c8"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 1.0.4",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcaf18a4f2be7326cd874a5fa579fae794320a0f388d365dca7e480e55f83f8a"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e696e35370c65c9c541198af4543ccd580cf17fc25d8e05c5a242b202488c55"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9aaafd5a2b6e3d657ff009d82fbd630b6bd54dd4eb06f21693925cdf80f9b8b"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.6.0",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea4a292869320c0272d7bc55a5a6aafaff59b4f63404a003887b679a2e05b4b6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.210"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.210"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_regex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8136f1a4ea815d7eac4101cfd0b16dc0cb5e1fe1b8609dfd728058656b7badf"
+dependencies = [
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9720086b3357bcb44fce40117d769a4d068c70ecfa190850a980a71755f66fcc"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.6.0",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f1abbfe725f27678f4663bcacb75a83e829fd464c25d78dd038a3a29e307cec"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap 2.6.0",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8621587d4798caf8eb44879d42e56b9a93ea5dcd315a6487c357130095b62801"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34db1a06d485c9142248b7a054f034b349b212551f3dfd19c94d45a754a217cd"
+dependencies = [
+ "libc",
+ "mio 1.0.2",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "socket2"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f40cc2bd72e17f328faf8ca7687fe337e61bccd8acf9674fa78dd3792b045e1"
+dependencies = [
+ "async-trait",
+ "bollard",
+ "bollard-stubs",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "futures",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-tar",
+ "tokio-util",
+ "url",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "time"
+version = "0.3.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+dependencies = [
+ "deranged",
+ "itoa",
+ "libc",
+ "num-conv",
+ "num_threads",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio 1.0.2",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "tokio-fd"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cedf0b897610a4baff98bf6116c060c5cfe7574d4339c50e9d23fe09377641d"
+dependencies = [
+ "libc",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
+dependencies = [
+ "rustls 0.23.13",
+ "rustls-pki-types",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tar"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d5714c010ca3e5c27114c1cdeb9d14641ace49874aa5626d7149e47aedace75"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "redox_syscall 0.3.5",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61e7c3654c13bcd040d4a03abee2c75b1d14a37b423cf5a813ceae1cc903ec6a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "time",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ab17db44d7388991a428b2ee655ce0c212e862eff1768a455c58f9aad6e7893"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+dependencies = [
+ "form_urlencoded",
+ "idna 0.5.0",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
+dependencies = [
+ "getrandom",
+ "serde",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "widestring"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "wstunnel"
+version = "10.1.3"
+dependencies = [
+ "ahash",
+ "anyhow",
+ "async-channel",
+ "async-trait",
+ "base64 0.22.1",
+ "bb8",
+ "bytes",
+ "clap",
+ "crossterm",
+ "fast-socks5",
+ "fastwebsockets",
+ "futures-util",
+ "hickory-resolver",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "ipnet",
+ "jsonwebtoken",
+ "log",
+ "nix",
+ "notify",
+ "parking_lot",
+ "pin-project",
+ "ppp",
+ "rcgen",
+ "regex",
+ "rustls-native-certs 0.8.0",
+ "rustls-pemfile 2.2.0",
+ "scopeguard",
+ "serde",
+ "serde_regex",
+ "serde_yaml",
+ "socket2",
+ "testcontainers",
+ "tokio",
+ "tokio-fd",
+ "tokio-rustls 0.26.0",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "urlencoding",
+ "uuid",
+ "x509-parser",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "xattr"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da84f1a25939b27f6820d92aed108f83ff920fdf11a7b19366c27c4cda81d4f"
+dependencies = [
+ "libc",
+ "linux-raw-sys",
+ "rustix",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index ba3800abcd51..1ea48259ebce 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "10.1.1";
+  version = "10.1.3";
 in
 
 rustPlatform.buildRustPackage {
@@ -21,10 +21,15 @@ rustPlatform.buildRustPackage {
     owner = "erebe";
     repo = "wstunnel";
     rev = "v${version}";
-    hash = "sha256-qEWIyQkLRrmTH40S96hj8JXFz/VJChIbg8qEQc938nI=";
+    hash = "sha256-mrCDx9f+EeA6McRc1s9YwYL4RHKSla10fxXZc1WYPio=";
   };
 
-  cargoHash = "sha256-3b+pX/qQuhOY1OYr+CfT5wtiJcEJ8CJJsQZ4QOcYv74=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "fastwebsockets-0.8.0" = "sha256-eqtCh9fMOG2uvL/GLUVXNiSB+ovYLc/Apuq9zssn8hU=";
+    };
+  };
 
   nativeBuildInputs = [ versionCheckHook ];
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index b018fb9da1d6..97ada31736f7 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -21,11 +21,11 @@ dependencies = [
 
 [[package]]
 name = "addr2line"
-version = "0.22.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
+checksum = "f5fb1d8e4442bd405fdfd1dacb42792696b0cf9cb15882e5d097b742a676d375"
 dependencies = [
- "gimli",
+ "gimli 0.31.0",
 ]
 
 [[package]]
@@ -404,6 +404,7 @@ dependencies = [
  "language_model",
  "languages",
  "log",
+ "lsp",
  "markdown",
  "menu",
  "multi_buffer",
@@ -894,9 +895,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.81"
+version = "0.1.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e0c28dcc82d7c8ead5cb13beb15405b57b8546e93215673ff8ca0349a028107"
+checksum = "a27b8a3a6e1a44fa4c8baf1f653e4172e81486d4941f2237e20dc2d0cf4ddff1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1493,17 +1494,17 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.73"
+version = "0.3.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
 dependencies = [
  "addr2line",
- "cc",
  "cfg-if",
  "libc",
- "miniz_oxide 0.7.4",
+ "miniz_oxide 0.8.0",
  "object",
  "rustc-demangle",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -2282,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.16"
+version = "4.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed6719fffa43d0d87e5fd8caeab59be1554fb028cd30edc88fc4369b17971019"
+checksum = "3e5a21b8495e732f1b3c364c9949b201ca7bae518c502c80256c96ad79eaf6ac"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2292,9 +2293,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.15"
+version = "4.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216aec2b177652e3846684cbfe25c9964d18ec45234f0f5da5157b207ed1aab6"
+checksum = "8cf2dd12af7a047ad9d6da2b6b249759a22a7abc0f474c1dae1777afa4b21a73"
 dependencies = [
  "anstream",
  "anstyle",
@@ -3082,7 +3083,7 @@ dependencies = [
  "cranelift-control",
  "cranelift-entity",
  "cranelift-isle",
- "gimli",
+ "gimli 0.29.0",
  "hashbrown 0.14.5",
  "log",
  "regalloc2",
@@ -4325,6 +4326,7 @@ dependencies = [
  "ctor",
  "editor",
  "env_logger",
+ "file_icons",
  "futures 0.3.30",
  "fuzzy",
  "gpui",
@@ -4332,7 +4334,9 @@ dependencies = [
  "menu",
  "picker",
  "project",
+ "schemars",
  "serde",
+ "serde_derive",
  "serde_json",
  "settings",
  "text",
@@ -4872,6 +4876,12 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "gimli"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32085ea23f3234fc7846555e85283ba4de91e21016dc0455a16286d87a292d64"
+
 [[package]]
 name = "git"
 version = "0.1.0"
@@ -4939,9 +4949,9 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "globset"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57da3b9b5b85bd66f31093f8c408b90a74431672542466497dcbdfdc02034be1"
+checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -5681,9 +5691,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.22"
+version = "0.4.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b46810df39e66e925525d6e38ce1e7f6e1d208f72dc39757880fcb66e2c58af1"
+checksum = "6d89fd380afde86567dfba715db065673989d6253f42b88179abd3eae47bda4b"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -6278,6 +6288,7 @@ dependencies = [
  "http_client",
  "image",
  "inline_completion_button",
+ "isahc",
  "language",
  "log",
  "menu",
@@ -6467,7 +6478,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -7044,7 +7055,6 @@ dependencies = [
  "ctor",
  "env_logger",
  "futures 0.3.30",
- "git",
  "gpui",
  "itertools 0.13.0",
  "language",
@@ -7179,6 +7189,7 @@ dependencies = [
  "async-std",
  "async-tar",
  "async-trait",
+ "async-watch",
  "async_zip",
  "futures 0.3.30",
  "http_client",
@@ -7191,6 +7202,7 @@ dependencies = [
  "tempfile",
  "util",
  "walkdir",
+ "which 6.0.3",
  "windows 0.58.0",
 ]
 
@@ -7511,6 +7523,7 @@ dependencies = [
  "anyhow",
  "futures 0.3.30",
  "http_client",
+ "isahc",
  "schemars",
  "serde",
  "serde_json",
@@ -13108,7 +13121,7 @@ dependencies = [
  "cranelift-frontend",
  "cranelift-native",
  "cranelift-wasm",
- "gimli",
+ "gimli 0.29.0",
  "log",
  "object",
  "target-lexicon",
@@ -13128,7 +13141,7 @@ dependencies = [
  "cpp_demangle",
  "cranelift-bitset",
  "cranelift-entity",
- "gimli",
+ "gimli 0.29.0",
  "indexmap 2.4.0",
  "log",
  "object",
@@ -13242,7 +13255,7 @@ checksum = "2a25199625effa4c13dd790d64bd56884b014c69829431bfe43991c740bd5bc1"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
- "gimli",
+ "gimli 0.29.0",
  "object",
  "target-lexicon",
  "wasmparser 0.215.0",
@@ -13522,7 +13535,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -13539,7 +13552,7 @@ checksum = "073efe897d9ead7fc609874f94580afc831114af5149b6a90ee0a3a39b497fe0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
- "gimli",
+ "gimli 0.29.0",
  "regalloc2",
  "smallvec",
  "target-lexicon",
@@ -14096,6 +14109,7 @@ dependencies = [
  "parking_lot",
  "postage",
  "project",
+ "remote",
  "schemars",
  "serde",
  "serde_json",
@@ -14375,13 +14389,14 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.154.4"
+version = "0.155.2"
 dependencies = [
  "activity_indicator",
  "anyhow",
  "ashpd",
  "assets",
  "assistant",
+ "async-watch",
  "audio",
  "auto_update",
  "backtrace",
@@ -14455,6 +14470,7 @@ dependencies = [
  "session",
  "settings",
  "settings_ui",
+ "shellexpand 2.1.2",
  "simplelog",
  "smol",
  "snippet_provider",
@@ -14606,7 +14622,7 @@ dependencies = [
 
 [[package]]
 name = "zed_lua"
-version = "0.0.3"
+version = "0.1.0"
 dependencies = [
  "zed_extension_api 0.1.0",
 ]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 98468e4cc593..7df7e9f55e83 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -86,13 +86,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "zed-editor";
-  version = "0.154.4";
+  version = "0.155.2";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/sL5SVRNVJBMPPZek9zBiek3nXHI1czNwbkGtlk9CzU=";
+    hash = "sha256-QiZZsy96WoWBFFKzVt6k4ZhxhvdBsy2iaF5TnYyb4v8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/data/fonts/league-spartan/default.nix b/pkgs/data/fonts/league-spartan/default.nix
index 10691f10c8e0..022346c5abca 100644
--- a/pkgs/data/fonts/league-spartan/default.nix
+++ b/pkgs/data/fonts/league-spartan/default.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       Taking a strong influence from ATF's classic Spartan family, we're
       starting our own family out with a single strong weight. We've put a few
       unique touches into a beautiful, historical typeface, and made sure to
-      include an extensive characterset – currently totaling over 300 glyphs.
+      include an extensive characterset – currently totaling over 300 glyphs.
 
       Over time, the open-source license will allow us expand League Spartan
       into a full family, with multiple weights and styles, and we're starting
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index 62bb148ca989..0f9c89140a9a 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -43,6 +43,13 @@ in
     (addToBuildInputsWithPkgConfig pkgs.cairo old)
     // (addToPropagatedBuildInputs (with chickenEggs; [ srfi-1 srfi-13 ]) old);
   cmark = addToBuildInputs pkgs.cmark;
+  comparse = old: {
+    # For some reason lazy-seq 2 gets interpreted as lazy-seq 0.0.0??
+    postPatch = ''
+      substituteInPlace comparse.egg \
+        --replace-fail 'lazy-seq "0.1.0"' 'lazy-seq "0.0.0"'
+    '';
+  };
   epoxy = old:
     (addToPropagatedBuildInputsWithPkgConfig pkgs.libepoxy old)
     // lib.optionalAttrs stdenv.cc.isClang {
@@ -210,7 +217,6 @@ in
   begin-syntax = broken;
   canvas-draw = broken;
   chicken-doc-admin = broken;
-  comparse = broken;
   coops-utils = broken;
   crypt = broken;
   hypergiant = broken;
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
index 04f45c1ccddf..d360da5dfa6c 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@@ -124,6 +124,12 @@ let
       # jni.h expects jni_md.h to be in the header search path.
       ln -sf $out/include/linux/*_md.h $out/include/
 
+      mkdir -p $out/share
+      # move files in $out like LICENSE.txt
+      find $out/ -maxdepth 1 -type f -exec mv {} $out/share \;
+      # symbolic link to $out/lib/svm/LICENSE_NATIVEIMAGE.txt
+      rm -f $out/LICENSE_NATIVEIMAGE.txt
+
       # copy-paste openjdk's preFixup
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 3f8338845d63..f8e886c803d6 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -93,9 +93,9 @@ in {
       major = "3";
       minor = "13";
       patch = "0";
-      suffix = "rc2";
+      suffix = "rc3";
     };
-    hash = "sha256-1g6LfBDeT3HS3/r3x76O+lTcHlMv6THbuE5fYlcJ4jc=";
+    hash = "sha256-yLx5AYWvHLd7dcAcvBqmQt/c+Xo3DS0QCQvHuqcNpX4=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index e8caeadcd32d..2bc678e8b4af 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
     # Disable any integration tests, which need to contact the internet.
     # Also disable the `storage_benchmark_*` tests.
     # With Protobuf < 23.x they require -DGOOGLE_CLOUD_CPP_ENABLE_CTYPE_WORKAROUND=ON.
-    # With Protobuf >= 23.x they require They require setting -DGOOGLE_CLOUD_CPP_ENABLE_CTYPE_WORKAROUND=OFF
+    # With Protobuf >= 23.x they require They require setting -DGOOGLE_CLOUD_CPP_ENABLE_CTYPE_WORKAROUND=OFF
     ctest --label-exclude integration-test --exclude-regex storage_benchmarks_
 
     runHook postInstallCheck
diff --git a/pkgs/development/libraries/jbigkit/default.nix b/pkgs/development/libraries/jbigkit/default.nix
index 8678cde4370a..00c284c8bc9e 100644
--- a/pkgs/development/libraries/jbigkit/default.nix
+++ b/pkgs/development/libraries/jbigkit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "jbigkit";
@@ -9,6 +9,19 @@ stdenv.mkDerivation rec {
     sha256 = "0cnrcdr1dwp7h7m0a56qw09bv08krb37mpf7cml5sjdgpyv0cwfy";
   };
 
+  patches = [
+    # Archlinux patch: this helps users to reduce denial-of-service risks, as in CVE-2017-9937
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jbigkit/-/raw/main/0013-new-jbig.c-limit-s-maxmem-maximum-decoded-image-size.patch";
+      hash = "sha256-Yq5qCTF7KZTrm4oeWbpctb+QLt3shJUGEReZvd0ey9k=";
+    })
+    # Archlinux patch: fix heap overflow
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jbigkit/-/raw/main/0015-jbg_newlen-check-for-end-of-file-within-MARKER_NEWLE.patch";
+      hash = "sha256-F3qA/btR9D9NfzrNY76X4Z6vG6NrisI36SjCDjS+F5s=";
+    })
+  ];
+
   makeFlags = [
     "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
diff --git a/pkgs/development/ocaml-modules/augeas/default.nix b/pkgs/development/ocaml-modules/augeas/default.nix
new file mode 100644
index 000000000000..b06471a495d1
--- /dev/null
+++ b/pkgs/development/ocaml-modules/augeas/default.nix
@@ -0,0 +1,60 @@
+{
+  stdenv,
+  fetchurl,
+  fetchDebianPatch,
+  autoreconfHook,
+  makeWrapper,
+  pkg-config,
+  ocaml,
+  findlib,
+  libxml2,
+  augeas,
+  lib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ocaml-augeas";
+  version = "0.6";
+
+  src = fetchurl {
+    url = "https://people.redhat.com/~rjones/augeas/files/ocaml-augeas-0.6.tar.gz";
+    sha256 = "04bn62hqdka0658fgz0p0fil2fyic61i78plxvmni1yhmkfrkfla";
+  };
+
+  patches = [
+    (fetchDebianPatch {
+      inherit pname version;
+      debianRevision = "1";
+      patch = "0001-Use-ocamlopt-g-option.patch";
+      hash = "sha256-EMd/EfWO2ni0AMonfS7G5FENpVVq0+q3gUPd4My+Upg=";
+    })
+    (fetchDebianPatch {
+      inherit pname version;
+      debianRevision = "1";
+      patch = "0002-caml_named_value-returns-const-value-pointer-in-OCam.patch";
+      hash = "sha256-Y53UHwrTVeV3hnsvABmWxlPi2Fanm0Iy1OR8Zql5Ub8=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    ocaml
+    findlib
+    augeas
+    libxml2
+  ];
+
+  createFindlibDestdir = true;
+
+  meta = with lib; {
+    homepage = "https://people.redhat.com/~rjones/augeas/";
+    description = "OCaml bindings for Augeas";
+    license = with licenses; lgpl21Plus;
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index dadc828e5fe1..8ce92a6781f1 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.1.0beta2";
+  version = "1.1.0";
 in
 buildPecl rec {
   inherit version;
@@ -15,7 +15,7 @@ buildPecl rec {
     owner = "open-telemetry";
     repo = "opentelemetry-php-instrumentation";
     rev = version;
-    hash = "sha256-gZby9wr5FN5mNG9YNVqQFYloxd4ws91Mz6IPn5OAGjs=";
+    hash = "sha256-X3rGzKDI16W21O9BaCuvVCreuce6is+URFSa1FNcznM=";
   };
 
   sourceRoot = "${src.name}/ext";
diff --git a/pkgs/development/php-packages/pcov/default.nix b/pkgs/development/php-packages/pcov/default.nix
index 1ee88135b3b1..02af71c12e6e 100644
--- a/pkgs/development/php-packages/pcov/default.nix
+++ b/pkgs/development/php-packages/pcov/default.nix
@@ -4,6 +4,7 @@
   php,
   pcre2,
   fetchFromGitHub,
+  fetchpatch,
 }:
 
 let
@@ -22,6 +23,14 @@ buildPecl {
 
   buildInputs = [ pcre2 ];
 
+  patches = [
+    # Allow building for PHP 8.4
+    (fetchpatch {
+      url = "https://github.com/krakjoe/pcov/commit/7d764c7c2555e8287351961d72be3ebec4d8743f.patch";
+      sha256 = "sha256-5wIHrrCwUXQpPdUg+3Kwyop5yvOzQQ3qc4pQXU8q2OM=";
+    })
+  ];
+
   meta = with lib; {
     changelog = "https://github.com/krakjoe/pcov/releases/tag/v${version}";
     description = "Self contained php-code-coverage compatible driver for PHP";
diff --git a/pkgs/development/python-modules/aiohttp-basicauth/default.nix b/pkgs/development/python-modules/aiohttp-basicauth/default.nix
index ee3e5483a1e4..eede039d4854 100644
--- a/pkgs/development/python-modules/aiohttp-basicauth/default.nix
+++ b/pkgs/development/python-modules/aiohttp-basicauth/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiohttp-basicauth";
-  version = "1.0.0";
+  version = "1.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "romis2012";
     repo = "aiohttp-basicauth";
-    rev = "v${version}";
-    hash = "sha256-UaRzauHmBHYwXFqRwDn1py79BScqq5j5SWALM4dQBP4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DjwrMlkVVceA5kDzm0c/on0VMOxyMMA3Hu4Y2Tiu0lI=";
   };
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/aiomealie/default.nix b/pkgs/development/python-modules/aiomealie/default.nix
index e6ea538d2453..ee4ad62a1baf 100644
--- a/pkgs/development/python-modules/aiomealie/default.nix
+++ b/pkgs/development/python-modules/aiomealie/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "aiomealie";
-  version = "0.9.2";
+  version = "0.9.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "joostlek";
     repo = "python-mealie";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rvizMeV1+tsBQiZl2Am4SjLrFkyhR/SvvLFwOTVP6wI=";
+    hash = "sha256-FJhmipWE3DE4PRWkEq8/j9iz9HQ7G7J5I9hwjU6e3FA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/array-api-compat/default.nix b/pkgs/development/python-modules/array-api-compat/default.nix
index 6de3c073b43a..258e69f44bda 100644
--- a/pkgs/development/python-modules/array-api-compat/default.nix
+++ b/pkgs/development/python-modules/array-api-compat/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "array-api-compat";
-  version = "1.8";
+  version = "1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "data-apis";
     repo = "array-api-compat";
     rev = "refs/tags/${version}";
-    hash = "sha256-DZs51yWgeMX7lmzR6jily0S3MRD4AVlk7BP8aU99Zp8=";
+    hash = "sha256-azd98kJtW8QKizfOr670pyr44BHNkWCO7BMFg3zr23g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cairosvg/default.nix b/pkgs/development/python-modules/cairosvg/default.nix
index a2f64cb79c99..0d81670d4493 100644
--- a/pkgs/development/python-modules/cairosvg/default.nix
+++ b/pkgs/development/python-modules/cairosvg/default.nix
@@ -50,12 +50,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "cairosvg" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://cairosvg.org";
     changelog = "https://github.com/Kozea/CairoSVG/releases/tag/${version}";
-    license = licenses.lgpl3Plus;
+    license = lib.licenses.lgpl3Plus;
     description = "SVG converter based on Cairo";
     mainProgram = "cairosvg";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.sarahec ];
   };
 }
diff --git a/pkgs/development/python-modules/compressai/default.nix b/pkgs/development/python-modules/compressai/default.nix
index 517a33d8aa66..66fa915ebef6 100644
--- a/pkgs/development/python-modules/compressai/default.nix
+++ b/pkgs/development/python-modules/compressai/default.nix
@@ -1,50 +1,59 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
+
+  # build-system
   pybind11,
   setuptools,
-  wheel,
+
+  # dependencies
+  einops,
   numpy,
   matplotlib,
+  pandas,
   pytorch-msssim,
   scipy,
   torch,
+  torch-geometric,
   torchvision,
+
+  # optional-dependencies
   ipywidgets,
   jupyter,
+
+  # tests
   plotly,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "compressai";
-  version = "1.2.4";
+  version = "1.2.6";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "InterDigitalInc";
     repo = "CompressAI";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nT2vd7t67agIWobJalORbRuns0UJGRGGbTX2/8vbTiY=";
+    hash = "sha256-xvzhhLn0iBzq3h1nro8/83QWEQe9K4zRa3RSZk+hy3Y=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [
+  build-system = [
     pybind11
     setuptools
-    wheel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
+    einops
     numpy
     matplotlib
+    pandas
     pytorch-msssim
     scipy
     torch
+    torch-geometric
     torchvision
   ];
 
@@ -81,10 +90,10 @@ buildPythonPackage rec {
     "test_pretrained"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "PyTorch library and evaluation platform for end-to-end compression research";
     homepage = "https://github.com/InterDigitalInc/CompressAI";
-    license = licenses.bsd3Clear;
-    maintainers = with maintainers; [ GaetanLepage ];
+    license = lib.licenses.bsd3Clear;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/fsspec/default.nix b/pkgs/development/python-modules/fsspec/default.nix
index 741755247223..8f6e77800b56 100644
--- a/pkgs/development/python-modules/fsspec/default.nix
+++ b/pkgs/development/python-modules/fsspec/default.nix
@@ -113,7 +113,7 @@ buildPythonPackage rec {
     ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
       # works locally on APFS, fails on hydra with AssertionError comparing timestamps
       # darwin hydra builder uses HFS+ and has only one second timestamp resolution
-      # this two tests however, assume nanosecond resolution
+      # this two tests however, assume nanosecond resolution
       "test_modified"
       "test_touch"
       # tries to access /home, ignores $HOME
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index ac5d47623a8a..6ac92f94406d 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -19,7 +19,8 @@
   packaging,
   rich,
   tensorflow,
-  tf-keras,
+  pythonAtLeast,
+  distutils,
 }:
 
 buildPythonPackage rec {
@@ -52,8 +53,7 @@ buildPythonPackage rec {
     packaging
     rich
     tensorflow
-    tf-keras
-  ];
+  ] ++ lib.optionals (pythonAtLeast "3.12") [ distutils ];
 
   pythonImportsCheck = [
     "keras"
diff --git a/pkgs/development/python-modules/langchain-chroma/default.nix b/pkgs/development/python-modules/langchain-chroma/default.nix
index 817676cbb189..1ec6ce71ed5d 100644
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@@ -43,6 +43,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Bad integration test, not used or vetted by the langchain team
+    "test_chroma_update_document"
+  ];
+
   passthru = {
     inherit (langchain-core) updateScript;
   };
diff --git a/pkgs/development/python-modules/layoutparser/default.nix b/pkgs/development/python-modules/layoutparser/default.nix
index 6e3e795de0ab..4a6c983e75ab 100644
--- a/pkgs/development/python-modules/layoutparser/default.nix
+++ b/pkgs/development/python-modules/layoutparser/default.nix
@@ -40,7 +40,7 @@ let
       torchvision
       effdet
     ];
-    # paddledetection = [ paddlepaddle ]
+    # paddledetection = [ paddlepaddle ]
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/pathos/default.nix b/pkgs/development/python-modules/pathos/default.nix
index b548dd3c6f0b..b82f3319426c 100644
--- a/pkgs/development/python-modules/pathos/default.nix
+++ b/pkgs/development/python-modules/pathos/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pathos";
-  version = "0.3.2";
+  version = "0.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "uqfoundation";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-b4HCiAvBGkFMxWh2PHC2kZ9G4PsQqVhKeIxLBKj09jU=";
+    hash = "sha256-J3rwnsn/3DXmChydwNC5yvsdSk1mzvPSnSo21BwkhSE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index f14248b781b0..df5007d93828 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pychromecast";
-  version = "14.0.1";
+  version = "14.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyChromecast";
     inherit version;
-    hash = "sha256-4W4Kf5SIMZGRuLT6IcoL60vxLu2lyb9kAkEYjyvqCj4=";
+    hash = "sha256-CSxl9CGZG8pWUzi8YaDBSGHEfg9cCmWRml6T8C39Bxo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index a2182a11dc06..11e2f832d14c 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -21,9 +21,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.82"
+version = "0.1.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a27b8a3a6e1a44fa4c8baf1f653e4172e81486d4941f2237e20dc2d0cf4ddff1"
+checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -32,9 +32,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "bitflags"
@@ -71,9 +71,9 @@ checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
 
 [[package]]
 name = "dashmap"
-version = "6.0.1"
+version = "6.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "804c8821570c3f8b70230c2ba75ffa5c0f9a4189b9a432b6656c536712acae28"
+checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -161,9 +161,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.158"
+version = "0.2.159"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8adc4bb1803a324070e64a98ae98f38934d91957a99cfb3a43dcbc01bc56439"
+checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
 
 [[package]]
 name = "lock_api"
@@ -198,15 +198,18 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "82881c4be219ab5faaf2ad5e5e5ecdff8c66bd7402ca3160975c93b24961afd1"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "parking"
-version = "2.2.0"
+version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
 [[package]]
 name = "parking_lot_core"
@@ -229,9 +232,9 @@ checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "portable-atomic"
-version = "1.7.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da544ee218f0d287a911e9c99a39a8c9bc8fcad3cb8db5959940044ecfc67265"
+checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
 
 [[package]]
 name = "proc-macro2"
@@ -244,7 +247,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.9.11"
+version = "0.9.15"
 dependencies = [
  "pyo3",
  "yrs",
@@ -252,9 +255,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.22.2"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831e8e819a138c36e212f3af3fd9eeffed6bf1510a805af35b0edee5ffa59433"
+checksum = "15ee168e30649f7f234c3d49ef5a7a6cbf5134289bc46c29ff3155fa3221c225"
 dependencies = [
  "cfg-if",
  "indoc",
@@ -270,9 +273,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.22.2"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8730e591b14492a8945cdff32f089250b05f5accecf74aeddf9e8272ce1fa8"
+checksum = "e61cef80755fe9e46bb8a0b8f20752ca7676dcc07a5277d8b7768c6172e529b3"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -280,9 +283,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.22.2"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e97e919d2df92eb88ca80a037969f44e5e70356559654962cbb3316d00300c6"
+checksum = "67ce096073ec5405f5ee2b8b31f03a68e02aa10d5d4f565eca04acc41931fa1c"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -290,9 +293,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.22.2"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb57983022ad41f9e683a599f2fd13c3664d7063a3ac5714cae4b7bee7d3f206"
+checksum = "2440c6d12bc8f3ae39f1e775266fa5122fd0c8891ce7520fa6048e683ad3de28"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -302,9 +305,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.22.2"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec480c0c51ddec81019531705acac51bcdbeae563557c982aa8263bb96880372"
+checksum = "1be962f0e06da8f8465729ea2cb71a416d2257dff56cbe40a70d3e62a93ae5d1"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -324,9 +327,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.3"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
+checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
 dependencies = [
  "bitflags",
 ]
@@ -345,18 +348,18 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.209"
+version = "1.0.210"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99fce0ffe7310761ca6bf9faf5115afbc19688edd00171d81b1bb1b116c63e09"
+checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.209"
+version = "1.0.210"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170"
+checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -365,9 +368,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.127"
+version = "1.0.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8043c06d9f82bd7271361ed64f415fe5e12a77fdb52e573e7f06a516dea329ad"
+checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
 dependencies = [
  "itoa",
  "memchr",
@@ -392,9 +395,9 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "syn"
-version = "2.0.77"
+version = "2.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
+checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -409,18 +412,18 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "thiserror"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -429,9 +432,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
 
 [[package]]
 name = "unindent"
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index c09682e63612..56fef5666e9e 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -3,27 +3,34 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # buildInputs
   libiconv,
+
+  # nativeBuildInputs
   rustPlatform,
+
+  # tests
   anyio,
   objsize,
   pydantic,
   pytestCheckHook,
   trio,
   y-py,
+
   nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "pycrdt";
-  version = "0.9.11";
+  version = "0.9.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pycrdt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-62r3AO+x9du6UjIdtqDPmwJ30/YmQxbPcCXgOaGNtL0=";
+    hash = "sha256-iaFpBD07l1WlC5FNzFxxF5gJS59yAyPmEn/NZg5U0AQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index 85f2dc69592b..b4978a83621d 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pymc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JaMN+M416oRzErzHWlnp4GsvxXWOuZPfXW/LsZjx+fY=";
+    hash = "sha256-vElS6f46xVvK+p5/IvjgCI4wMZlBe3Q5ZaQUie1yLJw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
index b062ff435606..9ecc23541ce6 100644
--- a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-insightidr";
-  version = "0.2.3";
+  version = "0.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-insightidr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wQMnnJ0KU+53MS3PIBkwIhUiyUdCrDbdUT6upk2Pp/8=";
+    hash = "sha256-dc25zDYQeU9W9qwrRz7zsM2wOl8kMapDvwFhB6VOwhY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 328d21ebe8d2..8d227fe1103e 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -22,7 +22,6 @@
   numba,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   tensorflow-probability,
 
   nix-update-script,
@@ -30,16 +29,14 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.25.4";
+  version = "2.25.6";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pytensor";
     rev = "refs/tags/rel-${version}";
-    hash = "sha256-NPMUfSbujT1qHsdpCazDX2xF54HvFJkOaxHSUG/FQwM=";
+    hash = "sha256-6emtX0tNqVqKyKXnwxvAwCyM3TRJ2MNClPNg0tVxBU8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix
new file mode 100644
index 000000000000..2ae837fa6e40
--- /dev/null
+++ b/pkgs/development/python-modules/sagemaker-core/default.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  boto3,
+  importlib-metadata,
+  jsonschema,
+  mock,
+  platformdirs,
+  pydantic,
+  pyyaml,
+  rich,
+
+  # optional-dependencies
+  black,
+  pandas,
+  pylint,
+  pytest,
+}:
+
+buildPythonPackage rec {
+  pname = "sagemaker-core";
+  version = "1.0.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "sagemaker-core";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UloQJ5B10XXPbwsktVZzjcW7BLW8wCAw3wGmAkSl6wc=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "importlib-metadata"
+    "mock"
+  ];
+
+  dependencies = [
+    boto3
+    importlib-metadata
+    jsonschema
+    mock
+    platformdirs
+    pydantic
+    pyyaml
+    rich
+  ];
+
+  optional-dependencies = {
+    codegen = [
+      black
+      pandas
+      pylint
+      pytest
+    ];
+  };
+
+  pythonImportsCheck = [
+    "sagemaker_core"
+  ];
+
+  # Only a single test which fails with:
+  # ValueError: Must setup local AWS configuration with a region supported by SageMaker.
+  doCheck = false;
+
+  meta = {
+    description = "Python SDK designed to provide an object-oriented interface for interacting with Amazon SageMaker resources";
+    homepage = "https://github.com/aws/sagemaker-core";
+    changelog = "https://github.com/aws/sagemaker-core/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 7dfe98f36a55..7c3b26cbb25c 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -1,47 +1,51 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   fetchpatch,
-  setuptools,
+
+  # build-system
+  hatchling,
+
+  # dependencies
   attrs,
   boto3,
   cloudpickle,
+  docker,
   google-pasta,
-  numpy,
-  protobuf,
-  smdebug-rulesconfig,
   importlib-metadata,
+  jsonschema,
+  numpy,
   packaging,
   pandas,
   pathos,
-  schema,
-  pyyaml,
-  jsonschema,
   platformdirs,
-  tblib,
-  urllib3,
-  requests,
-  docker,
-  tqdm,
+  protobuf,
   psutil,
+  pyyaml,
+  requests,
+  sagemaker-core,
+  schema,
+  smdebug-rulesconfig,
+  tblib,
+  tqdm,
+  urllib3,
+
+  # optional-dependencies
   scipy,
   accelerate,
 }:
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.224.1";
+  version = "2.232.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Kc66sygHGFqMvSY7rACb62wJEJesnN4KDmtYZLIOsqc=";
+    hash = "sha256-I+iZKx1CnZIGYgYuYhhs8BnY84KPyKOGw8M0He26DGU=";
   };
 
   patches = [
@@ -58,10 +62,11 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    setuptools
+    hatchling
   ];
 
   pythonRelaxDeps = [
+    "boto3"
     "cloudpickle"
     "importlib-metadata"
   ];
@@ -70,24 +75,25 @@ buildPythonPackage rec {
     attrs
     boto3
     cloudpickle
+    docker
     google-pasta
-    numpy
-    protobuf
-    smdebug-rulesconfig
     importlib-metadata
+    jsonschema
+    numpy
     packaging
     pandas
     pathos
-    schema
-    pyyaml
-    jsonschema
     platformdirs
-    tblib
-    urllib3
-    requests
-    docker
-    tqdm
+    protobuf
     psutil
+    pyyaml
+    requests
+    sagemaker-core
+    schema
+    smdebug-rulesconfig
+    tblib
+    tqdm
+    urllib3
   ];
 
   doCheck = false; # many test dependencies are not available in nixpkgs
@@ -108,11 +114,11 @@ buildPythonPackage rec {
     # feature-processor = [ pyspark sagemaker-feature-store-pyspark ]; # not available in nixpkgs
   };
 
-  meta = with lib; {
+  meta = {
     description = "Library for training and deploying machine learning models on Amazon SageMaker";
     homepage = "https://github.com/aws/sagemaker-python-sdk/";
     changelog = "https://github.com/aws/sagemaker-python-sdk/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ nequissimus ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nequissimus ];
   };
 }
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index 92aa341dd6ce..14fd91a1bb12 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -67,6 +67,11 @@ buildPythonPackage rec {
       substituteInPlace tinygrad/runtime/autogen/opencl.py \
         --replace-fail "ctypes.util.find_library('OpenCL')" "'${ocl-icd}/lib/libOpenCL.so'"
     ''
+    # Patch `clang` directly in the source file
+    + ''
+      substituteInPlace tinygrad/runtime/ops_clang.py \
+        --replace-fail "'clang'" "'${lib.getExe clang}'"
+    ''
     + lib.optionalString rocmSupport ''
       substituteInPlace tinygrad/runtime/autogen/hip.py \
         --replace-fail "/opt/rocm/lib/libamdhip64.so" "${rocmPackages.clr}/lib/libamdhip64.so" \
diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
new file mode 100644
index 000000000000..ed3bbdc73569
--- /dev/null
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -0,0 +1,179 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  flit-core,
+
+  # dependencies
+  aiohttp,
+  fsspec,
+  jinja2,
+  numpy,
+  psutil,
+  pyparsing,
+  requests,
+  torch,
+  tqdm,
+
+  # optional-dependencies
+  matplotlib,
+  networkx,
+  pandas,
+  protobuf,
+  wandb,
+  ipython,
+  matplotlib-inline,
+  pre-commit,
+  torch-geometric,
+  ase,
+  # captum,
+  graphviz,
+  h5py,
+  numba,
+  opt-einsum,
+  pgmpy,
+  pynndescent,
+  # pytorch-memlab,
+  rdflib,
+  rdkit,
+  scikit-image,
+  scikit-learn,
+  scipy,
+  statsmodels,
+  sympy,
+  tabulate,
+  torchmetrics,
+  trimesh,
+  pytorch-lightning,
+  yacs,
+  huggingface-hub,
+  onnx,
+  onnxruntime,
+  pytest,
+  pytest-cov,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "torch-geometric";
+  version = "2.6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pyg-team";
+    repo = "pytorch_geometric";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Zw9YqPQw2N0ZKn5i5Kl4Cjk9JDTmvZmyO/VvIVr6fTU=";
+  };
+
+  build-system = [
+    flit-core
+  ];
+
+  dependencies = [
+    aiohttp
+    fsspec
+    jinja2
+    numpy
+    psutil
+    pyparsing
+    requests
+    torch
+    tqdm
+  ];
+
+  optional-dependencies = {
+    benchmark = [
+      matplotlib
+      networkx
+      pandas
+      protobuf
+      wandb
+    ];
+    dev = [
+      ipython
+      matplotlib-inline
+      pre-commit
+      torch-geometric
+    ];
+    full = [
+      ase
+      # captum
+      graphviz
+      h5py
+      matplotlib
+      networkx
+      numba
+      opt-einsum
+      pandas
+      pgmpy
+      pynndescent
+      # pytorch-memlab
+      rdflib
+      rdkit
+      scikit-image
+      scikit-learn
+      scipy
+      statsmodels
+      sympy
+      tabulate
+      torch-geometric
+      torchmetrics
+      trimesh
+    ];
+    graphgym = [
+      protobuf
+      pytorch-lightning
+      yacs
+    ];
+    modelhub = [
+      huggingface-hub
+    ];
+    test = [
+      onnx
+      onnxruntime
+      pytest
+      pytest-cov
+    ];
+  };
+
+  pythonImportsCheck = [
+    "torch_geometric"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # TODO: try to re-enable when triton will have been updated to 3.0
+    # torch._dynamo.exc.BackendCompilerFailed: backend='inductor' raised:
+    # LoweringException: ImportError: cannot import name 'triton_key' from 'triton.compiler.compiler'
+    "test_compile_hetero_conv_graph_breaks"
+    "test_compile_multi_aggr_sage_conv"
+
+    # RuntimeError: addmm: computation on CPU is not implemented for SparseCsr + SparseCsr @ SparseCsr without MKL.
+    # PyTorch built with MKL has better support for addmm with sparse CPU tensors.
+    "test_asap"
+    "test_graph_unet"
+
+    # AttributeError: type object 'Any' has no attribute '_name'
+    "test_type_repr"
+  ];
+
+  meta = {
+    description = "Graph Neural Network Library for PyTorch";
+    homepage = "https://github.com/pyg-team/pytorch_geometric";
+    changelog = "https://github.com/pyg-team/pytorch_geometric/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/ikos/default.nix b/pkgs/development/tools/analysis/ikos/default.nix
index e135b4f79a26..f7fb222b4b84 100644
--- a/pkgs/development/tools/analysis/ikos/default.nix
+++ b/pkgs/development/tools/analysis/ikos/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ikos";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "NASA-SW-VnV";
     repo = "ikos";
     rev = "v${version}";
-    hash = "sha256-4/M0fyqvzdr0aBPCUuLiBgqMOrHEmikkIjQMB9KSrdo=";
+    hash = "sha256-xJuSpQHShggDqLVQaj0a0fEPOWUFIrbGmxazu4FKISs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index e0faacc5e5d5..1c149e72190c 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-p5K0VYPAjorlwJx7GB2r7M/KGUzD3jyOp4dLkw11/tc=";
+    sha256 = "sha256-KD8lh3N9GFlht+HtcuE3i20noVha0lT21a5pSS3zbTw=";
   };
 
-  vendorHash = "sha256-wMCJnbu9pKBujTvZ4rvxgJdB7l7Z6vB6eyem35Ghz0Q=";
+  vendorHash = "sha256-zoiQ69y0EicH9Jq2XYn+fttKHZY64GD4m/Edk+kle9M=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/cfn-nag/Gemfile b/pkgs/development/tools/cfn-nag/Gemfile
deleted file mode 100644
index 5ccc66872d41..000000000000
--- a/pkgs/development/tools/cfn-nag/Gemfile
+++ /dev/null
@@ -1,2 +0,0 @@
-source 'https://rubygems.org'
-gem 'cfn-nag'
diff --git a/pkgs/development/tools/cfn-nag/Gemfile.lock b/pkgs/development/tools/cfn-nag/Gemfile.lock
deleted file mode 100644
index 86bfdad86108..000000000000
--- a/pkgs/development/tools/cfn-nag/Gemfile.lock
+++ /dev/null
@@ -1,51 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    aws-eventstream (1.2.0)
-    aws-partitions (1.568.0)
-    aws-sdk-core (3.130.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.525.0)
-      aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-kms (1.55.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.113.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
-      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
-    aws-sigv4 (1.4.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-    cfn-model (0.6.6)
-      kwalify (= 0.7.2)
-      psych (~> 3)
-    cfn-nag (0.8.9)
-      aws-sdk-s3 (~> 1.76)
-      cfn-model (= 0.6.6)
-      lightly (~> 0.3.2)
-      logging (~> 2.2.2)
-      netaddr (~> 2.0.4)
-      optimist (~> 3.0.0)
-      rexml
-    jmespath (1.6.1)
-    kwalify (0.7.2)
-    lightly (0.3.3)
-    little-plugger (1.1.4)
-    logging (2.2.2)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    multi_json (1.15.0)
-    netaddr (2.0.5)
-    optimist (3.0.1)
-    psych (3.3.2)
-    rexml (3.2.5)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  cfn-nag
-
-BUNDLED WITH
-   2.2.28
diff --git a/pkgs/development/tools/cfn-nag/gemset.nix b/pkgs/development/tools/cfn-nag/gemset.nix
deleted file mode 100644
index e2e39f7a8137..000000000000
--- a/pkgs/development/tools/cfn-nag/gemset.nix
+++ /dev/null
@@ -1,189 +0,0 @@
-{
-  aws-eventstream = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1pyis1nvnbjxk12a43xvgj2gv0mvp4cnkc1gzw0v1018r61399gz";
-      type = "gem";
-    };
-    version = "1.2.0";
-  };
-  aws-partitions = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ap27g6hxcczpb5dj7v0wzxrvywfa2kf3zx69xnjz1qvxf3plw54";
-      type = "gem";
-    };
-    version = "1.568.0";
-  };
-  aws-sdk-core = {
-    dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "14ymvp06k46gvkpvz5zaqvbvr6wd8vdka5iq25q0wd0fzdx7aivm";
-      type = "gem";
-    };
-    version = "3.130.0";
-  };
-  aws-sdk-kms = {
-    dependencies = ["aws-sdk-core" "aws-sigv4"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0fmpdll52ng1kfn4r5ndcyppn5553qvvxw87w58m9n70ga3avasi";
-      type = "gem";
-    };
-    version = "1.55.0";
-  };
-  aws-sdk-s3 = {
-    dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0iafjly868kdzmpxkv1ndmqm524ik36ibs15mqh145vw32gz7bax";
-      type = "gem";
-    };
-    version = "1.113.0";
-  };
-  aws-sigv4 = {
-    dependencies = ["aws-eventstream"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1wh1y79v0s4zgby2m79bnifk65hwf5pvk2yyrxzn2jkjjq8f8fqa";
-      type = "gem";
-    };
-    version = "1.4.0";
-  };
-  cfn-model = {
-    dependencies = ["kwalify" "psych"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1b3ix36yfnfwyxb4w9ss8a7nc6w15m1wbj3q8rarsqjrs3xj6wjs";
-      type = "gem";
-    };
-    version = "0.6.6";
-  };
-  cfn-nag = {
-    dependencies = ["aws-sdk-s3" "cfn-model" "lightly" "logging" "netaddr" "optimist" "rexml"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "14qlnflxx5chjvda9n2ka2axcfcjbmn9h00cija8k7kvpy1dgqga";
-      type = "gem";
-    };
-    version = "0.8.9";
-  };
-  jmespath = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1mnvb80cdg7fzdcs3xscv21p28w4igk5sj5m7m81xp8v2ks87jj0";
-      type = "gem";
-    };
-    version = "1.6.1";
-  };
-  kwalify = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ngxg3ysq5vip9dn3d32ajc7ly61kdin86hfycm1hkrcvkkn1vjf";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
-  lightly = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sgj2r6j7qxb9vqzkx5isjbphi38rplk4h8838am0cjcpq5h3jb3";
-      type = "gem";
-    };
-    version = "0.3.3";
-  };
-  little-plugger = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
-      type = "gem";
-    };
-    version = "1.1.4";
-  };
-  logging = {
-    dependencies = ["little-plugger" "multi_json"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
-      type = "gem";
-    };
-    version = "2.2.2";
-  };
-  multi_json = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
-      type = "gem";
-    };
-    version = "1.15.0";
-  };
-  netaddr = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0r7nln9xvrralwwhd5s1q4sghp0k9y7g9z5pinzpqkx715xcpdxm";
-      type = "gem";
-    };
-    version = "2.0.5";
-  };
-  optimist = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1vg2chy1cfmdj6c1gryl8zvjhhmb3plwgyh1jfnpq4fnfqv7asrk";
-      type = "gem";
-    };
-    version = "3.0.1";
-  };
-  psych = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "10iawnkpa44hcfrapy7yw6zmjn4g1g0y09lw244qiv424f7jasn5";
-      type = "gem";
-    };
-    version = "3.3.2";
-  };
-  rexml = {
-    groups = ["default" "development"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
-      type = "gem";
-    };
-    version = "3.2.5";
-  };
-}
diff --git a/pkgs/development/tools/gotemplate/default.nix b/pkgs/development/tools/gotemplate/default.nix
index 57dbba5db01e..b950f5865ce6 100644
--- a/pkgs/development/tools/gotemplate/default.nix
+++ b/pkgs/development/tools/gotemplate/default.nix
@@ -1,17 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGo123Module, fetchFromGitHub }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "gotemplate";
-  version = "3.7.5";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BMZyq7fa57WaE0cSkGjHWxtEnbC7vEy+kLaHDoI/KZU=";
+    hash = "sha256-sRCyOQmj4ti+1Qdap0Q5MLoJZLwjZtw1cYjZMGksvuA=";
   };
 
-  vendorHash = "sha256-uRB3atrJ+A1/xXvgmkyM/AKN+9VKSIDvsnPIdtsc3vc=";
+  vendorHash = "sha256-xtvexOmzTXjP3QsGp0aL3FdJe3mdBSCnTeM6hLq/tIo=";
 
   meta = with lib; {
     description = "CLI for go text/template";
diff --git a/pkgs/development/tools/heroku/default.nix b/pkgs/development/tools/heroku/default.nix
index 638d046aa675..0314c3b90b04 100644
--- a/pkgs/development/tools/heroku/default.nix
+++ b/pkgs/development/tools/heroku/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation {
   pname = "heroku";
-  version = "9.2.1";
+  version = "9.3.0";
 
   src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/9.2.1/6e4f307/heroku-v9.2.1-6e4f307-linux-x64.tar.xz";
-    hash = "sha256-9MeZx4LmKyh3DSIz+ZZVY/qpFDqk5oE4P/MIUQPmRb8=";
+    url = "https://cli-assets.heroku.com/versions/9.3.0/65eb66a/heroku-v9.3.0-65eb66a-linux-x64.tar.xz";
+    hash = "sha256-4k/HLSB4o1BnzG7dPW20ejSFYmJ8o9eVrJWCdXrqC/Q=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/language-servers/ccls/default.nix b/pkgs/development/tools/language-servers/ccls/default.nix
index 175d2800e4c7..122ebea7c0f3 100644
--- a/pkgs/development/tools/language-servers/ccls/default.nix
+++ b/pkgs/development/tools/language-servers/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20240202";
+  version = "0.20240505";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "sha256-xVx3+cnmIdoA7R1S31EaiPj+DOTqkINoQeMgauW61Ys=";
+    sha256 = "sha256-YZeP6sHYLNvlf49mvtymxHuH1lmIkqcanpqVMzeLeFQ=";
   };
 
   nativeBuildInputs = [ cmake llvmPackages.llvm.dev ];
diff --git a/pkgs/development/tools/misc/planus/default.nix b/pkgs/development/tools/misc/planus/default.nix
index 22cc165a93a5..b92906e18265 100644
--- a/pkgs/development/tools/misc/planus/default.nix
+++ b/pkgs/development/tools/misc/planus/default.nix
@@ -7,15 +7,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "planus";
-  version = "0.4.0";
+  version = "1.0.0";
 
   src = fetchCrate {
     pname = "planus-cli";
     inherit version;
-    hash = "sha256-KpX4KSA2MjfRS8M0WVYpY4hoSvOOB7MUz7YKZwEGqj8=";
+    hash = "sha256-HbnuLu1yCpwouDVBH/vcFVLDMZWeqHH6qHFJoTbaS9Y=";
   };
 
-  cargoHash = "sha256-yT/ZK5GG0rXpiaCQlQclK2iY8BXhhmiW/UDX9aL8wBQ=";
+  cargoHash = "sha256-AJtQrImQlxnp1RbbOZHAJsvlhm39OlC5WyvD5jybMAY=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index 9f7c7d6415b3..467e5dced1b9 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "3.0.2";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-a+7Gff3Z1V17uaywoUE+nLVeVprB50Gslarcle/NPB8=";
+    hash = "sha256-b1HP5JCtQFA0+GIkMswb8o3k9zbD5sLrLR7yz8UivLk=";
   };
 
-  vendorHash = "sha256-QoZzEq1aC7cjY/RVp5Z5HhSuTFf2BSYQnfg0jSaeTJU=";
+  vendorHash = "sha256-qOM66jiSjAU5e6eGrM8kgJxWJzxwgHpLadx5pTjNFOs=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -39,17 +39,21 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/stateful/runme/internal/version.BuildDate=1970-01-01T00:00:00Z"
-    "-X=github.com/stateful/runme/internal/version.BuildVersion=${version}"
-    "-X=github.com/stateful/runme/internal/version.Commit=${src.rev}"
+    "-X=github.com/stateful/runme/v3/internal/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X=github.com/stateful/runme/v3/internal/version.BuildVersion=${version}"
+    "-X=github.com/stateful/runme/v3/internal/version.Commit=${src.rev}"
   ];
 
+  # checkFlags = [
+  #   "-ldflags=-X=github.com/stateful/runme/v3/internal/version.BuildVersion=${version}"
+  # ];
+
   # tests fail to access /etc/bashrc on darwin
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   postPatch = ''
     substituteInPlace testdata/{categories/basic,runall/basic,script/basic}.txtar \
-      --replace /bin/bash "${runtimeShell}"
+      --replace-fail /bin/bash "${runtimeShell}"
   '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/development/tools/opcr-policy/default.nix b/pkgs/development/tools/opcr-policy/default.nix
index 4c947f3e1aab..8eb77449342a 100644
--- a/pkgs/development/tools/opcr-policy/default.nix
+++ b/pkgs/development/tools/opcr-policy/default.nix
@@ -5,15 +5,15 @@
 
 buildGoModule rec {
   pname = "opcr-policy";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "opcr-io";
     repo = "policy";
     rev = "v${version}";
-    sha256 = "sha256-Q/2r8mqz820mEQD7o9qzC1TPMrRH0f6nr1jgRQAEj/Y=";
+    sha256 = "sha256-A5dqKbQhdJlSOU7qxC8xrCCSXK5yGmDsoVWfgWKl2TE=";
   };
-  vendorHash = "sha256-C6Y+R2q1ZRbeFN1qY109fikkzvcUsBfDn4CYCrKrLKI=";
+  vendorHash = "sha256-ASR8Y/L8ub0w36fO+UpJ5ZpijP+YCLVbRtnhzvMNj9U=";
 
   ldflags = [ "-s" "-w" "-X github.com/opcr-io/policy/pkg/version.ver=${version}" ];
 
diff --git a/pkgs/development/tools/renderdoc/default.nix b/pkgs/development/tools/renderdoc/default.nix
deleted file mode 100644
index beeeddeb70c5..000000000000
--- a/pkgs/development/tools/renderdoc/default.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{ lib
-, fetchFromGitHub
-, nix-update-script
-, cmake
-, pkg-config
-, mkDerivation
-, qtbase
-, qtx11extras
-, qtsvg
-, makeWrapper
-, vulkan-loader
-, libglvnd
-, xorg
-, python311
-, python311Packages
-, bison
-, pcre
-, automake
-, autoconf
-, addDriverRunpath
-, waylandSupport ? false
-, wayland
-}:
-let
-  custom_swig = fetchFromGitHub {
-    owner = "baldurk";
-    repo = "swig";
-    rev = "renderdoc-modified-7";
-    sha256 = "15r2m5kcs0id64pa2fsw58qll3jyh71jzc04wy20pgsh2326zis6";
-  };
-in
-mkDerivation rec {
-  pname = "renderdoc";
-  version = "1.34";
-
-  src = fetchFromGitHub {
-    owner = "baldurk";
-    repo = "renderdoc";
-    rev = "v${version}";
-    sha256 = "sha256-obRCILzMR7tCni0YoT3/oesTSADGI2sXqY3G6RS1h1o=";
-  };
-
-  buildInputs = [
-    qtbase qtsvg xorg.libpthreadstubs xorg.libXdmcp qtx11extras vulkan-loader python311
-  ] ++ (with python311Packages; [
-    pyside2 pyside2-tools shiboken2
-  ])
-  ++ lib.optional waylandSupport wayland;
-
-  nativeBuildInputs = [ cmake makeWrapper pkg-config bison pcre automake autoconf addDriverRunpath ];
-
-  postUnpack = ''
-    cp -r ${custom_swig} swig
-    chmod -R +w swig
-    patchShebangs swig/autogen.sh
-  '';
-
-  cmakeFlags = [
-    (lib.cmakeFeature "BUILD_VERSION_HASH" src.rev)
-    (lib.cmakeFeature "BUILD_VERSION_DIST_NAME" "NixOS")
-    (lib.cmakeFeature "BUILD_VERSION_DIST_VER" version)
-    (lib.cmakeFeature "BUILD_VERSION_DIST_CONTACT" "https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/graphics/renderdoc")
-    (lib.cmakeBool "BUILD_VERSION_STABLE" true)
-    (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
-  ];
-
-  # TODO: define these in the above array via placeholders, once those are widely supported
-  preConfigure = ''
-    cmakeFlags+=" -DVULKAN_LAYER_FOLDER=$out/share/vulkan/implicit_layer.d/"
-    cmakeFlags+=" -DRENDERDOC_SWIG_PACKAGE=$PWD/../swig"
-  '';
-
-  dontWrapQtApps = true;
-  preFixup = ''
-    wrapQtApp $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib:${libglvnd}/lib"
-    wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib:${libglvnd}/lib"
-  '';
-
-  # The only documentation for this so far is in pkgs/build-support/add-opengl-runpath/setup-hook.sh
-  postFixup = ''
-    addDriverRunpath $out/lib/librenderdoc.so
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = with lib; {
-    description = "Single-frame graphics debugger";
-    homepage = "https://renderdoc.org/";
-    license = licenses.mit;
-    longDescription = ''
-      RenderDoc is a free MIT licensed stand-alone graphics debugger that
-      allows quick and easy single-frame capture and detailed introspection
-      of any application using Vulkan, D3D11, OpenGL or D3D12 across
-      Windows 7 - 10, Linux or Android.
-    '';
-    maintainers = [ ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/development/tools/rust/cargo-mutants/default.nix b/pkgs/development/tools/rust/cargo-mutants/default.nix
index e5e7fcde55cb..2c415009cdff 100644
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "24.7.1";
+  version = "24.9.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-56IIMifv5epThXeWtQbNLwee1IQ52SPKik4hsHlnv6w=";
+    hash = "sha256-fMw3Whyl+zTPpDTdYpwvzMQtSdr42ueEvkdmRI0N2aA=";
   };
 
-  cargoHash = "sha256-VRkhDgKunSUOz2/U4oC2t0YrDh5l48z4luevMazfj6o=";
+  cargoHash = "sha256-+vI/HPw0oe9K0kWpJXGBM0r7oVBh3+RJzSwklaywa54=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 3a6a509bda09..d2ef93622786 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O3Sg7wVNqTH8uhBSlVpmPNmFv+JC9/tw3G0LcOYUzKc=";
+    hash = "sha256-fVsYQjv+DjGCWv/dAk8S8GcEtDIdaxb1yXAqCpTm0sQ=";
   };
 
-  cargoHash = "sha256-C0TpZZ/CJgNx0sB920/0yJW3iY4tPF6M70bveS1Ux24=";
+  cargoHash = "sha256-R5jv8hFHdhS6MoU5oHleN5B7k2RPX7GhJMwym8kYAYY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/unityhub/default.nix b/pkgs/development/tools/unityhub/default.nix
index 893f476df63e..c18c8b60f6d0 100644
--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@@ -97,6 +97,9 @@ stdenv.mkDerivation rec {
       xorg.libXrender
       gnome2.GConf
       libcap
+
+      # Unity Editor 6000 specific dependencies
+      harfbuzz
     ] ++ extraLibs pkgs;
   };
 
diff --git a/pkgs/games/classicube/default.nix b/pkgs/games/classicube/default.nix
index d0c7fd79475a..e17c8bffd336 100644
--- a/pkgs/games/classicube/default.nix
+++ b/pkgs/games/classicube/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ClassiCube";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "UnknownShadow200";
     repo = "ClassiCube";
     rev = version;
-    sha256 = "sha256-7VPn5YXNoAR3ftYMDQuQRqeMCrbyB56ir1sQWBiPWAI=";
+    sha256 = "sha256-ZITyfxkQB4Jpm2ZsQyM+ouPLqCVmGB7UZRXDSU/BX0k=";
   };
 
   nativeBuildInputs = [ dos2unix makeWrapper copyDesktopItems ];
diff --git a/pkgs/games/classicube/fix-linking.patch b/pkgs/games/classicube/fix-linking.patch
index 4fc0e826cb4a..a35d19caaca4 100644
--- a/pkgs/games/classicube/fix-linking.patch
+++ b/pkgs/games/classicube/fix-linking.patch
@@ -1,13 +1,14 @@
 diff --git a/Makefile b/Makefile
-index 83188ce..3439cdb 100644
+index a10eb5214..70e2f720e 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -40,7 +40,7 @@ LIBS=-mwindows -lws2_32 -lwininet -lwinmm -limagehlp -lcrypt32 -ld3d9
- endif
+@@ -55,7 +55,7 @@ endif
  
  ifeq ($(PLAT),linux)
--LIBS=-lX11 -lXi -lpthread -lGL -lm -ldl
-+LIBS=-lX11 -lXi -lpthread -lGL -lm -ldl -lcurl -lopenal
+ 	CFLAGS  += -DCC_BUILD_ICON
+-	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl
++	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl -lcurl -lopenal
+ 	BUILD_DIR = build-linux
  endif
  
- ifeq ($(PLAT),sunos)
+
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 0b3da3f22f71..ee3862052135 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -562,7 +562,7 @@ let
 
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
-      USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
+      USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
 
       # default to dual role mode
       USB_DWC2_DUAL_ROLE = yes;
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index e77647ffe4b1..a0bd7bbceee1 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -8,12 +8,12 @@
 }@args:
 
 callPackage ../nginx/generic.nix args rec {
-  version = "1.6.2";
+  version = "1.7.0";
   pname = if withQuic then "angieQuic" else "angie";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-5+7FFnf3WHzFf9EyYMAyL6dozaqEkhWzFdrU4OcfXFk=";
+    hash = "sha256-B5fm4BgV/bMLvJ9wOAA4fJyLLGARManDlQmjPXPyHAE=";
   };
 
   configureFlags = lib.optionals withAcme [
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index 4f653a50a972..11ffcbcd3b6b 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.29.0";
+  version = "3.30.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mTg3eN5ZmzQxItPq8ghPpFafr6zF+nliofGEKShnH88=";
+    hash = "sha256-UB3LYXRr6GnqVCRwAxnwqBCkOtor3mC4k73kPesZs0g=";
   };
 
-  vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
+  vendorHash = "sha256-FYLH1Ej8Bm0+tS5Ikj1CPF+1t5opmzee8iHRZSW94Yk=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index ad9d880b8540..82f9eca8d88d 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "6.0";
+  version = "6.1";
   outputs = [ "out" "tools" ];
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-tT8m4X2OgANreTljqAYcCN0HTu++boFBmzyha7XGo8Y=";
+    sha256 = "sha256-XQpbQ7NXVGVbm99d1ZEh1ckR5fd81xwZw8HorXHaeBk=";
   };
 
   preConfigure = "cd src";
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 1f97fad7468f..0fa88aa91a5e 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1455";
+  version = "2.0-1462";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-R555u33S5jmqIKdDtRhMbfCMe5sG3x94naPX+qgrwHY=";
+    hash = "sha256-irTDjT9oN0CdxFKAgcHbL2grJ702E6H+WtifGh0pf0E=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/web-apps/sogo/default.nix b/pkgs/servers/web-apps/sogo/default.nix
index a6740f742290..b24910f4bb05 100644
--- a/pkgs/servers/web-apps/sogo/default.nix
+++ b/pkgs/servers/web-apps/sogo/default.nix
@@ -5,14 +5,14 @@
 , libwbxml }:
 gnustep.stdenv.mkDerivation rec {
   pname = "sogo";
-  version = "5.10.0";
+  version = "5.11.0";
 
   # always update the sope package as well, when updating sogo
   src = fetchFromGitHub {
     owner = "Alinto";
     repo = pname;
     rev = "SOGo-${version}";
-    hash = "sha256-ZmpOI1zk/TkRNFmwTXugVb9IvxYSP4LgNrApSytdI7s=";
+    hash = "sha256-2/0OaCAQkdnDPGOVERZs2Oz+bCpQN3MTLzp2pz0WB08=";
   };
 
   nativeBuildInputs = [ gnustep.make makeWrapper python3 pkg-config ];
@@ -77,7 +77,7 @@ gnustep.stdenv.mkDerivation rec {
     license = with licenses; [ gpl2Only lgpl21Only ];
     homepage = "https://sogo.nu/";
     platforms = platforms.linux;
-    maintainers = [ ];
+    maintainers = with maintainers; [ jceb ];
   };
 }
 
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index ecca983c5d7d..db6d8c3259e3 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -49,11 +49,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xwayland";
-  version = "24.1.2";
+  version = "24.1.3";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    hash = "sha256-FB63bn5CKjZhwIeCxwvkCTEIR1UELARQbg2X3UY+99I=";
+    hash = "sha256-3NtXpmzJsSTI+TZ2BZJiisTnRKfXsxeaqGGJrX6kyxA=";
   };
 
   postPatch = ''
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index 3c1811d57dbe..014c2a0dc1fd 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -2,13 +2,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "24.09.0";
+  version = "24.10.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-8QgnEu41BHeX6heP2slQT+X+Dti+7Ij+J2zqmU4dm3I=";
+    hash = "sha256-g1uedR9BLG0DuGdM/9xqFv6yhBHHnqjQMt1n0z9I29I=";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index fe3f4ba0f4fb..cd37f57b369a 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, substituteAll
 , pkg-config
 , runCommand
 , writeText
@@ -38,6 +37,7 @@
 , xdg-utils
 , xorg
 , xorgserver
+, xxHash
 }:
 
 let
@@ -70,20 +70,16 @@ let
   '';
 in buildPythonApplication rec {
   pname = "xpra";
-  version = "5.0.9";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "Xpra-org";
     repo = "xpra";
     rev = "v${version}";
-    hash = "sha256-gwo5plCAryGC8/BKVEqyMkgB+3FM8HXG6sESomDOtNM=";
+    hash = "sha256-SmX0zwScyosiidBdW18vP3tV7BJfYfOmXwuRUbb+gX8=";
   };
 
   patches = [
-    (substituteAll {  # correct hardcoded paths
-      src = ./fix-paths.patch;
-      inherit libfakeXinerama;
-    })
     ./fix-41106.patch  # https://github.com/NixOS/nixpkgs/issues/41106
     ./fix-122159.patch # https://github.com/NixOS/nixpkgs/issues/122159
   ];
@@ -137,6 +133,7 @@ in buildPythonApplication rec {
     pango
     x264
     x265
+    xxHash
   ] ++ lib.optional withNvenc nvencHeaders;
 
   propagatedBuildInputs = with python3.pkgs; ([
diff --git a/pkgs/tools/X11/xpra/fix-122159.patch b/pkgs/tools/X11/xpra/fix-122159.patch
index 5fe2ce3892fd..58efa07e790d 100644
--- a/pkgs/tools/X11/xpra/fix-122159.patch
+++ b/pkgs/tools/X11/xpra/fix-122159.patch
@@ -1,16 +1,18 @@
 diff --git a/xpra/scripts/main.py b/xpra/scripts/main.py
-index 58c8bf6464..36f4b3cd3d 100755
+index 7806612e05..4c7a0ec2dd 100755
 --- a/xpra/scripts/main.py
 +++ b/xpra/scripts/main.py
-@@ -389,11 +389,7 @@ def run_mode(script_file:str, cmdline, error_cb, options, args, mode:str, defaul
-         "seamless", "desktop", "shadow", "shadow-screen", "expand",
-         "upgrade", "upgrade-seamless", "upgrade-desktop",
-         ) and not display_is_remote and use_systemd_run(options.systemd_run):
--        #make sure we run via the same interpreter,
--        #inject it into the command line if we have to:
+@@ -444,13 +444,7 @@ def run_mode(script_file: str, cmdline, error_cb, options, args, full_mode: str,
+             "seamless", "desktop", "shadow", "shadow-screen", "expand",
+             "upgrade", "upgrade-seamless", "upgrade-desktop",
+     ) and not display_is_remote and options.daemon and use_systemd_run(options.systemd_run):
+-        # make sure we run via the same interpreter,
+-        # inject it into the command line if we have to:
          argv = list(cmdline)
--        if argv[0].find("python")<0:
--            argv.insert(0, "python%i.%i" % (sys.version_info.major, sys.version_info.minor))
-         return systemd_run_wrap(mode, argv, options.systemd_run_args, user=getuid()!=0)
+-        if argv[0].find("python") < 0:
+-            major, minor = sys.version_info.major, sys.version_info.minor
+-            python = which("python%i.%i" % (major, minor)) or which("python%i" % major) or which("python") or "python"
+-            argv.insert(0, python)
+         return systemd_run_wrap(mode, argv, options.systemd_run_args, user=getuid() != 0)
      configure_env(options.env)
      configure_logging(options, mode)
diff --git a/pkgs/tools/X11/xpra/fix-41106.patch b/pkgs/tools/X11/xpra/fix-41106.patch
index a1a74a01c3fe..84061106323c 100644
--- a/pkgs/tools/X11/xpra/fix-41106.patch
+++ b/pkgs/tools/X11/xpra/fix-41106.patch
@@ -1,11 +1,11 @@
-diff --git a/xpra/server/server_util.py b/xpra/server/server_util.py
-index 2e83712bb8..2dd0bf73d2 100644
---- a/xpra/server/server_util.py
-+++ b/xpra/server/server_util.py
-@@ -166,6 +166,10 @@ def xpra_env_shell_script(socket_dir, env : Dict[str,str]) -> str:
-     return "\n".join(script)
+diff --git a/xpra/server/util.py b/xpra/server/util.py
+index 401a9fb959..678e2ce745 100644
+--- a/xpra/server/util.py
++++ b/xpra/server/util.py
+@@ -175,6 +175,10 @@ def xpra_env_shell_script(socket_dir: str, env: dict[str, str]) -> str:
  
- def xpra_runner_shell_script(xpra_file:str, starting_dir:str) -> str:
+ 
+ def xpra_runner_shell_script(xpra_file: str, starting_dir: str) -> str:
 +    # Nixpkgs contortion:
 +    # xpra_file points to a shell wrapper, not to the python script.
 +    dirname, basename = os.path.split(xpra_file)
diff --git a/pkgs/tools/X11/xpra/fix-paths.patch b/pkgs/tools/X11/xpra/fix-paths.patch
deleted file mode 100644
index 43210f4f15d6..000000000000
--- a/pkgs/tools/X11/xpra/fix-paths.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff --git a/xpra/x11/fakeXinerama.py b/xpra/x11/fakeXinerama.py
-index a5289e0e43..527cdf90c9 100755
---- a/xpra/x11/fakeXinerama.py
-+++ b/xpra/x11/fakeXinerama.py
-@@ -23,31 +23,7 @@ fakeXinerama_config_files = [
-            ]
- 
- def find_libfakeXinerama():
--    libname = "fakeXinerama"
--    try:
--        from ctypes.util import find_library
--        flibname = find_library("fakeXinerama")
--        if flibname:
--            libname = flibname
--    except Exception:
--        pass
--    if POSIX:
--        for lib_dir in os.environ.get("LD_LIBRARY_PATH", "/usr/lib").split(os.pathsep):
--            lib_path = os.path.join(lib_dir, libname)
--            if not os.path.exists(lib_dir):
--                continue
--            if os.path.exists(lib_path) and os.path.isfile(lib_path):
--                return lib_path
--    if LINUX:
--        try:
--            libpath = find_lib_ldconfig("fakeXinerama")
--            if libpath:
--                return libpath
--        except Exception as e:
--            log("find_libfakeXinerama()", exc_info=True)
--            log.error("Error: cannot launch ldconfig -p to locate libfakeXinerama:")
--            log.estr(e)
--    return find_lib("libfakeXinerama.so.1")
-+    return "@libfakeXinerama@/lib/libfakeXinerama.so.1.0"
- 
- current_xinerama_config = None
- 
diff --git a/pkgs/tools/admin/scalr-cli/default.nix b/pkgs/tools/admin/scalr-cli/default.nix
index 6dacaba03e76..4672e5e0bb57 100644
--- a/pkgs/tools/admin/scalr-cli/default.nix
+++ b/pkgs/tools/admin/scalr-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "scalr-cli";
-  version = "0.15.5";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "Scalr";
     repo = "scalr-cli";
     rev = "v${version}";
-    hash = "sha256-RXfUlpwlDNAZRJTbbE+n8mReVyrWxUsWkOGaaALz0Q4=";
+    hash = "sha256-9osB3bsc8IvH1ishG9uiIUnAwC1yZd0rFhiZdzYucI8=";
   };
 
   vendorHash = "sha256-0p4f+KKD04IFAUQG8F3b+2sx9suYemt3wbgSNNOOIlk=";
diff --git a/pkgs/tools/backup/luckybackup/default.nix b/pkgs/tools/backup/luckybackup/default.nix
deleted file mode 100644
index 6fd32a2ceb44..000000000000
--- a/pkgs/tools/backup/luckybackup/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ mkDerivation, lib, fetchurl
-, pkg-config, libtool, qmake
-, rsync, ssh
-}:
-
-mkDerivation rec {
-  pname = "luckybackup";
-  version = "0.5.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/luckybackup/${version}/source/${pname}-${version}.tar.gz";
-    sha256 = "0nwjsk1j33pm8882jbj8h6nxn6n5ab9dxqpqkay65pfbhcjay0g8";
-  };
-
-  buildInputs = [ rsync ssh ];
-
-  nativeBuildInputs = [ pkg-config libtool qmake ];
-
-  prePatch = ''
-    for File in luckybackup.pro menu/luckybackup-pkexec \
-        menu/luckybackup-su.desktop menu/luckybackup.desktop \
-        menu/net.luckybackup.su.policy src/functions.cpp \
-        src/global.cpp src/scheduleDialog.cpp; do
-      substituteInPlace $File --replace "/usr" "$out"
-    done
-  '';
-
-  meta = with lib; {
-    description = "Powerful, fast and reliable backup & sync tool";
-    longDescription = ''
-      luckyBackup is an application for data back-up and synchronization
-      powered by the rsync tool.
-
-      It is simple to use, fast (transfers over only changes made and not
-      all data), safe (keeps your data safe by checking all declared directories
-      before proceeding in any data manipulation), reliable and fully
-      customizable.
-    '';
-    homepage = "https://luckybackup.sourceforge.net/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index 92a55f510f2d..ae0c653f0a17 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -1,11 +1,13 @@
-{ lib, stdenv
-, fetchFromGitHub
-, python3
-, fuse
-, pkg-config
-, libpcap
-, zlib
-, nixosTests
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+  fuse,
+  pkg-config,
+  libpcap,
+  zlib,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
@@ -23,12 +25,18 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [ fuse libpcap zlib python3 ];
+  buildInputs = [
+    fuse
+    libpcap
+    zlib
+    python3
+  ];
 
   strictDeps = true;
 
-  buildFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "CPPFLAGS=-UHAVE_STRUCT_STAT_ST_BIRTHTIME" ];
+  buildFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "CPPFLAGS=-UHAVE_STRUCT_STAT_ST_BIRTHTIME"
+  ];
 
   # Fix the build on macOS with macFUSE installed
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -48,13 +56,18 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests = { inherit (nixosTests) moosefs; };
+  passthru.tests = {
+    inherit (nixosTests) moosefs;
+  };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://moosefs.com";
     description = "Open Source, Petabyte, Fault-Tolerant, Highly Performing, Scalable Network Distributed File System";
-    platforms = platforms.unix;
-    license = licenses.gpl2Only;
-    maintainers = [ maintainers.mfossen ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
+      mfossen
+      markuskowa
+    ];
   };
 }
diff --git a/pkgs/tools/games/scarab/default.nix b/pkgs/tools/games/scarab/default.nix
index 25ac92691e89..617f8f0e87b2 100644
--- a/pkgs/tools/games/scarab/default.nix
+++ b/pkgs/tools/games/scarab/default.nix
@@ -1,13 +1,14 @@
-{ lib
-, buildDotnetModule
-, fetchFromGitHub
-, glibc
-, zlib
-, gtk3
-, copyDesktopItems
-, icoutils
-, wrapGAppsHook3
-, makeDesktopItem
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  glibc,
+  zlib,
+  gtk3,
+  copyDesktopItems,
+  icoutils,
+  wrapGAppsHook3,
+  makeDesktopItem,
 }:
 
 buildDotnetModule rec {
@@ -22,7 +23,8 @@ buildDotnetModule rec {
   };
 
   nugetDeps = ./deps.nix;
-  projectFile = "Scarab.sln";
+  projectFile = "Scarab/Scarab.csproj";
+  testProjectFile = "Scarab.Tests/Scarab.Tests.csproj";
   executables = [ "Scarab" ];
 
   preConfigureNuGet = ''
@@ -47,6 +49,8 @@ buildDotnetModule rec {
     wrapGAppsHook3
   ];
 
+  doCheck = true;
+
   postFixup = ''
     # Icons for the desktop file
     icotool -x $src/Scarab/Assets/omegamaggotprime.ico
@@ -58,26 +62,28 @@ buildDotnetModule rec {
     done
   '';
 
-  desktopItems = [(makeDesktopItem {
-    desktopName = "Scarab";
-    name = "scarab";
-    exec = "Scarab";
-    icon = "scarab";
-    comment = meta.description;
-    type = "Application";
-    categories = [ "Game" ];
-  })];
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "Scarab";
+      name = "scarab";
+      exec = "Scarab";
+      icon = "scarab";
+      comment = meta.description;
+      type = "Application";
+      categories = [ "Game" ];
+    })
+  ];
 
   passthru.updateScript = ./update.sh;
 
-  meta = with lib; {
+  meta = {
     description = "Hollow Knight mod installer and manager";
     homepage = "https://github.com/fifty-six/Scarab";
     downloadPage = "https://github.com/fifty-six/Scarab/releases";
     changelog = "https://github.com/fifty-six/Scarab/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ huantian ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ huantian ];
     mainProgram = "Scarab";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index c7226904af62..7740cbb32f56 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.10.2";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "sha256-SuagtYfLD8yXFpLHNl1J0m5/iapYU+Si6tJl0paStTY=";
+    sha256 = "sha256-XdWEvIM+gNQVmNPwtcka+lZwmNIWpxAIMGBjY0b9QNM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index e4a7bcdc423c..4585e420b437 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "3.29.0";
+  version = "3.30.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-mTg3eN5ZmzQxItPq8ghPpFafr6zF+nliofGEKShnH88=";
+    sha256 = "sha256-UB3LYXRr6GnqVCRwAxnwqBCkOtor3mC4k73kPesZs0g=";
   };
 
-  vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
+  vendorHash = "sha256-FYLH1Ej8Bm0+tS5Ikj1CPF+1t5opmzee8iHRZSW94Yk=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/tools/networking/pritunl-ssh/default.nix b/pkgs/tools/networking/pritunl-ssh/default.nix
index 4cae94e26ece..75440cc5e06c 100644
--- a/pkgs/tools/networking/pritunl-ssh/default.nix
+++ b/pkgs/tools/networking/pritunl-ssh/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "pritunl-ssh";
-  version = "1.0.3219.78";
+  version = "1.0.3231.6";
 
   src = fetchFromGitHub {
     owner = "pritunl";
     repo = "pritunl-zero-client";
     rev = version;
-    sha256 = "sha256-ksTfgt1AWs8hgUR9w6aWv5MDXeORgYNWYZgAFUqj++s=";
+    sha256 = "sha256-kccc8ZDh3S/Ko/MaBd5u0UxMNIbg5dhvRuecJuE3D6c=";
   };
 
   buildInputs = [ python3 ];
diff --git a/pkgs/tools/security/certinfo/default.nix b/pkgs/tools/security/certinfo/default.nix
index 3d48985d78a5..f8ec56585c4f 100644
--- a/pkgs/tools/security/certinfo/default.nix
+++ b/pkgs/tools/security/certinfo/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub, libX11, darwin }:
+{ stdenv, lib, buildGo123Module, fetchFromGitHub, libX11, darwin }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "certinfo";
-  version = "1.0.23";
+  version = "1.0.24";
 
   src = fetchFromGitHub {
     owner = "pete911";
     repo = "certinfo";
     rev = "v${version}";
-    sha256 = "sha256-el7qL2d8z50S+0vyy8zH1W1uNix9PXmDGS5y8P9fIVA=";
+    sha256 = "sha256-BI5gYWKGMU0wLvnArG41bLWj+9ipe/GARKRX0fwz4ag=";
   };
 
   # clipboard functionality not working on Darwin
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 8a5f7a44118b..68c8aab57a42 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-08-29";
+  version = "2024-10-02";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-QZO7wJiqVVt9vpocC2X4Vrj8s02kh/E3j96JKbYoJJo=";
+    hash = "sha256-uNFBMZ6pk/xT6OZMb8EKax141lc+uumQl3xbihFMYAI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/gowitness/default.nix b/pkgs/tools/security/gowitness/default.nix
index d4b893d9f870..57a82168bdb9 100644
--- a/pkgs/tools/security/gowitness/default.nix
+++ b/pkgs/tools/security/gowitness/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gowitness";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "sensepost";
     repo = "gowitness";
     rev = "refs/tags/${version}";
-    hash = "sha256-yKG4qLjeZThFEMqMnUv4ryvM2e3uH5GLuVP3oa6XHtE=";
+    hash = "sha256-ygnYqX8il0nDvF5+jd52CypmHH8iiLMlOZWdoTsR0ig=";
   };
 
-  vendorHash = "sha256-PjbC10Dh3tDF0mP2k4ei6ZSS3ND2wAaB1+Llmj37TR8=";
+  vendorHash = "sha256-2hG+93LzJ+kUVCOXFGk83Asvn7zLWq2BSqrq+eOJhQ0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 8693d35dfa99..e5979a0f7084 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , gobject-introspection
 , intltool
 , python3
@@ -10,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "onioncircuits";
-  version = "0.7";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.tails.boum.org";
     owner = "tails";
     repo = "onioncircuits";
     rev = version;
-    sha256 = "sha256-O4tSbKBTmve4u8bXVg128RLyuxvTbU224JV8tQ+aDAQ=";
+    sha256 = "sha256-5VGOuvngZvUFQ+bubdt4YV3/IflOhBB1i+oEQaV4kr0=";
   };
 
   nativeBuildInputs = [
@@ -32,15 +31,6 @@ python3.pkgs.buildPythonApplication rec {
     stem
   ];
 
-  patches = [
-    # Fix https://gitlab.tails.boum.org/tails/onioncircuits/-/merge_requests/4
-    (fetchpatch {
-      name = "fix-setuptool-package-discovery.patch";
-      url = "https://gitlab.tails.boum.org/tails/onioncircuits/-/commit/4c620c77f36f540fa27041fcbdeaf05c9f57826c.patch";
-      sha256 = "sha256-WXqyDa2meRMMHkHLO5Xl7x43KUGtlsai+eOVzUGUPpo=";
-    })
-  ];
-
   postInstall = ''
     mkdir -p $out/etc/apparmor.d
 
@@ -48,7 +38,6 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://tails.boum.org";
     description = "GTK application to display Tor circuits and streams";
     mainProgram = "onioncircuits";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c614524a9eb1..972743705c9f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -258,7 +258,6 @@ mapAliases {
   CoinMP = coinmp; # Added 2024-06-12
   collada-dom = opencollada; # added 2024-02-21
   composable_kernel = throw "'composable_kernel' has been replaced with 'rocmPackages.composable_kernel'"; # Added 2023-10-08
-  cope = throw "'cope' has been removed, as it is broken in nixpkgs since it was added, and fixing it is not trivial"; # Added 2024-04-12
   coriander = throw "'coriander' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
   corretto19 = throw "Corretto 19 was removed as it has reached its end of life"; # Added 2024-08-01
   cosmic-tasks = tasks; # Added 2024-07-04
@@ -1563,7 +1562,7 @@ mapAliases {
   invalidateFetcherByDrvHash = testers.invalidateFetcherByDrvHash; # Added 2022-05-05
   timescale-prometheus = promscale; # Added 2020-09-29
   tinygltf = throw "TinyglTF has been embedded in draco due to lack of other users and compatibility breaks."; # Added 2023-06-25
-  tightvnc = throw "'tightvnc' has been removed as the version 1.3 is not maintained upstream anymore and is insecure"; # Added 2024-08-22
+  tightvnc = throw "'tightvnc' has been removed as the version 1.3 is not maintained upstream anymore and is insecure"; # Added 2024-08-22
   tixati = throw "'tixati' has been removed from nixpkgs as it is unfree and unmaintained"; # Added 2023-03-17
   tkcvs = tkrev; # Added 2022-03-07
   toil = throw "toil was removed as it was broken and requires obsolete versions of libraries"; # Added 2024-09-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 119a484eaadb..c77d940eb55a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -355,8 +355,6 @@ with pkgs;
 
   cbfmt = callPackage ../development/tools/cbfmt { };
 
-  cfn-nag = callPackage ../development/tools/cfn-nag { };
-
   circumflex = callPackage ../applications/networking/circumflex { };
 
   citron = callPackage ../tools/misc/citron { };
@@ -2021,7 +2019,8 @@ with pkgs;
 
   vrrtest = callPackage ../tools/video/vrrtest { };
 
-  winbox = callPackage ../tools/admin/winbox {
+  winbox = winbox3;
+  winbox3 = callPackage ../tools/admin/winbox {
     wine = wineWowPackages.stable;
   };
 
@@ -7177,10 +7176,6 @@ with pkgs;
 
   evtx = callPackage ../tools/security/evtx { };
 
-  luckybackup = libsForQt5.callPackage ../tools/backup/luckybackup {
-    ssh = openssh;
-  };
-
   kics = callPackage ../tools/admin/kics { };
 
   kramdown-asciidoc = callPackage ../tools/typesetting/kramdown-asciidoc { };
@@ -11842,8 +11837,6 @@ with pkgs;
 
   renameutils = callPackage ../tools/misc/renameutils { };
 
-  renderdoc = libsForQt5.callPackage ../development/tools/renderdoc { };
-
   repgrep = callPackage ../tools/text/repgrep { };
 
   replace = callPackage ../tools/text/replace { };
@@ -25548,8 +25541,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
-  mbtileserver = callPackage ../servers/geospatial/mbtileserver { };
-
   pg_featureserv = callPackage ../servers/geospatial/pg_featureserv { };
 
   pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
@@ -26359,8 +26350,6 @@ with pkgs;
 
   gotestfmt = callPackage ../development/tools/gotestfmt { };
 
-  gotools = callPackage ../development/tools/gotools { };
-
   gotop = callPackage ../tools/system/gotop {
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
@@ -28499,8 +28488,6 @@ with pkgs;
 
   bfcal = libsForQt5.callPackage ../applications/misc/bfcal { };
 
-  bibletime = libsForQt5.callPackage ../applications/misc/bibletime { };
-
   bino3d = qt6Packages.callPackage ../applications/video/bino3d { };
 
   bitlbee = callPackage ../applications/networking/instant-messengers/bitlbee { };
@@ -30220,8 +30207,6 @@ with pkgs;
 
   sleep-on-lan = callPackage ../tools/networking/sleep-on-lan { };
 
-  slweb = callPackage ../applications/misc/slweb { };
-
   sonixd = callPackage ../applications/audio/sonixd { };
 
   sonobus = callPackage ../applications/audio/sonobus { };
@@ -30755,8 +30740,6 @@ with pkgs;
 
   kubelogin = callPackage ../applications/networking/cluster/kubelogin { };
 
-  kubelogin-oidc = callPackage ../applications/networking/cluster/kubelogin-oidc { };
-
   kubevpn = callPackage ../applications/networking/cluster/kubevpn { };
 
   k8sgpt = callPackage ../applications/networking/cluster/k8sgpt { };
@@ -36425,8 +36408,6 @@ with pkgs;
     cudaSupport = true;
   };
 
-  mathmod = libsForQt5.callPackage ../applications/science/math/mathmod { };
-
   metis = callPackage ../development/libraries/science/math/metis { };
 
   nauty = callPackage ../applications/science/math/nauty { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index b2a23363707e..a8146d374c82 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -164,4 +164,10 @@ let
     fixedPoints.extends composedExtension passthruFunction
   );
 in
-cudaPackages
+# We want to warn users about the upcoming deprecation of old CUDA
+# versions, without breaking Nixpkgs CI with evaluation warnings. This
+# gross hack ensures that the warning only triggers if aliases are
+# enabled, which is true by default, but not for ofborg.
+lib.warnIf (cudaPackages.cudaOlder "12.0" && config.allowAliases)
+  "CUDA versions older than 12.0 will be removed in Nixpkgs 25.05; see the 24.11 release notes for more information"
+  cudaPackages
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 3cbb1dc8a4bc..31a17e4c260a 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -56,6 +56,10 @@ let
 
     atdgen-runtime = callPackage ../development/ocaml-modules/atdgen/runtime.nix { };
 
+    augeas = callPackage ../development/ocaml-modules/augeas {
+      inherit (pkgs) augeas;
+    };
+
     awa = callPackage ../development/ocaml-modules/awa { };
 
     awa-mirage = callPackage ../development/ocaml-modules/awa/mirage.nix { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 56bfd093fdd4..6d2fb6f0484c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18770,7 +18770,7 @@ with self; {
     buildInputs = [ TestNoWarnings ];
     perlPreHook = "export LD=$CC";
     meta = {
-      description = "Internationalizing Domain Names in Applications (UTS #46)";
+      description = "Internationalizing Domain Names in Applications (UTS #46)";
       homepage = "https://metacpan.org/release/Net-IDN-Encode";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
     };
diff --git a/pkgs/top-level/pkg-config/tests.nix b/pkgs/top-level/pkg-config/tests.nix
index 786e2ecc534b..dbf766a0cf26 100644
--- a/pkgs/top-level/pkg-config/tests.nix
+++ b/pkgs/top-level/pkg-config/tests.nix
@@ -1,6 +1,6 @@
 # cd nixpkgs
 # nix-build -A tests.pkg-config
-{ lib, stdenv, ... }:
+{ lib, config, stdenv, ... }:
 
 let
   # defaultPkgConfigPackages test needs a Nixpkgs with allowUnsupportedPlatform
@@ -10,7 +10,7 @@ let
   allPkgs = import ../default.nix {
     system = stdenv.hostPlatform.system;
     localSystem = stdenv.buildPlatform.system;
-    config = {
+    config = config // {
       allowUnsupportedSystem = true;
     };
     overlays = [];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c1800dfbba93..e26247c259f2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13907,6 +13907,8 @@ self: super: with self; {
 
   sagemaker = callPackage ../development/python-modules/sagemaker { };
 
+  sagemaker-core = callPackage ../development/python-modules/sagemaker-core { };
+
   salib = callPackage ../development/python-modules/salib { };
 
   salmon-mail = callPackage ../development/python-modules/salmon-mail { };
@@ -15692,6 +15694,8 @@ self: super: with self; {
 
   torch-audiomentations = callPackage ../development/python-modules/torch-audiomentations { };
 
+  torch-geometric = callPackage ../development/python-modules/torch-geometric { };
+
   torch-pitch-shift = callPackage ../development/python-modules/torch-pitch-shift { };
 
   torch-bin = callPackage ../development/python-modules/torch/bin.nix {