diff --git a/doc/module-system/module-system.chapter.md b/doc/module-system/module-system.chapter.md
index 927f66073748..d24faa255259 100644
--- a/doc/module-system/module-system.chapter.md
+++ b/doc/module-system/module-system.chapter.md
@@ -7,9 +7,12 @@ The module system is a language for handling configuration, implemented as a Nix
 Compared to plain Nix, it adds documentation, type checking and composition or extensibility.
 
 ::: {.note}
-This chapter is new and not complete yet. For a gentle introduction to the module system, in the context of NixOS, see [Writing NixOS Modules](https://nixos.org/manual/nixos/unstable/index.html#sec-writing-modules) in the NixOS manual.
-:::
+This chapter is new and not complete yet.
 
+See also:
+- Introduction to the module system, in the context of NixOS, see [Writing NixOS Modules](https://nixos.org/manual/nixos/unstable/index.html#sec-writing-modules) in the NixOS manual.
+- Generic guide to the module system on [nix.dev](https://nix.dev/tutorials/module-system/index.html).
+:::
 
 ## `lib.evalModules` {#module-system-lib-evalModules}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0bfdecca67fb..acce9baf2a8d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5988,6 +5988,12 @@
     githubId = 57304299;
     keys = [ { fingerprint = "33CD 5C0A 673C C54D 661E  5E4C 0DB5 361B EEE5 30AB"; } ];
   };
+  dopplerian = {
+    name = "Dopplerian";
+    github = "Dopplerian";
+    githubId = 53937537;
+    keys = [ { fingerprint = "BBC4 C071 516B A147 8D07  F9DC D2FD E6EC 2E8C 2BF4"; } ];
+  };
   doriath = {
     email = "tomasz.zurkowski@gmail.com";
     github = "doriath";
@@ -22308,6 +22314,12 @@
     github = "teatwig";
     githubId = 18734648;
   };
+  tebriel = {
+    email = "tebriel@frodux.in";
+    name = "tebriel";
+    github = "tebriel";
+    githubId = 821688;
+  };
   techknowlogick = {
     email = "techknowlogick@gitea.com";
     github = "techknowlogick";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 2d108ac7ce00..1dd9eb1cae47 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -51,6 +51,8 @@
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
+- [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
+
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
 
 - [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable).
@@ -306,6 +308,8 @@
 
 - For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.
 
+- `services.kmonad` now creates a determinate symlink (in `/dev/input/by-id/`) to each of KMonad virtual devices.
+
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
 - Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 06979a4df508..7dc6e6f0489a 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1160,6 +1160,7 @@
   ./services/networking/nats.nix
   ./services/networking/nbd.nix
   ./services/networking/ncdns.nix
+  ./services/networking/ncps.nix
   ./services/networking/ndppd.nix
   ./services/networking/nebula.nix
   ./services/networking/netbird.nix
diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index 9e50e38acc92..abbcfa9055eb 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -75,7 +75,7 @@ let
     {
       freeformType = attrsOf (either scalarType (listOf scalarType));
       # Client system-options file directives are explained here:
-      # https://www.ibm.com/docs/en/storage-protect/8.1.24?topic=commands-processing-options
+      # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=commands-processing-options
       options.servername = mkOption {
         type = servernameType;
         default = name;
diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix
index 8dd27ccd2342..697f798b7fcf 100644
--- a/nixos/modules/services/backup/tsm.nix
+++ b/nixos/modules/services/backup/tsm.nix
@@ -89,7 +89,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.24?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 98f601d8886e..aa759e20f49f 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -205,9 +205,14 @@ in
     };
 
     extraConfig = mkOption {
-      description = "Kubernetes kubelet extra configuration file entries.";
+      description = ''
+        Kubernetes kubelet extra configuration file entries.
+
+        See also [Set Kubelet Parameters Via A Configuration File](https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/)
+        and [Kubelet Configuration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/).
+      '';
       default = { };
-      type = attrsOf attrs;
+      type = attrsOf ((pkgs.formats.json { }).type);
     };
 
     featureGates = mkOption {
diff --git a/nixos/modules/services/hardware/kmonad.nix b/nixos/modules/services/hardware/kmonad.nix
index 687224fae2e9..fa9b8fbb610f 100644
--- a/nixos/modules/services/hardware/kmonad.nix
+++ b/nixos/modules/services/hardware/kmonad.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 
@@ -118,19 +119,8 @@ let
   # Build a systemd service that starts KMonad:
   mkService =
     keyboard:
-    let
-      cmd =
-        [
-          (lib.getExe cfg.package)
-          "--input"
-          ''device-file "${keyboard.device}"''
-        ]
-        ++ cfg.extraArgs
-        ++ [ "${mkCfg keyboard}" ];
-    in
     lib.nameValuePair (mkName keyboard.name) {
       description = "KMonad for ${keyboard.device}";
-      script = lib.escapeShellArgs cmd;
       unitConfig = {
         # Control rate limiting.
         # Stop the restart logic if we restart more than
@@ -139,6 +129,10 @@ let
         StartLimitBurst = 5;
       };
       serviceConfig = {
+        ExecStart = ''
+          ${lib.getExe cfg.package} ${mkCfg keyboard} \
+            ${utils.escapeSystemdExecArgs cfg.extraArgs}
+        '';
         Restart = "always";
         # Restart at increasing intervals from 2s to 1m
         RestartSec = 2;
@@ -195,6 +189,17 @@ in
   config = lib.mkIf cfg.enable {
     hardware.uinput.enable = true;
 
+    services.udev.extraRules =
+      let
+        mkRule = name: ''
+          ACTION=="add", KERNEL=="event*", SUBSYSTEM=="input", ATTRS{name}=="${name}", ATTRS{id/product}=="5679", ATTRS{id/vendor}=="1235", SYMLINK+="input/by-id/${name}"
+        '';
+      in
+      lib.foldlAttrs (
+        rules: _: keyboard:
+        rules + "\n" + mkRule (mkName keyboard.name)
+      ) "" cfg.keyboards;
+
     systemd = {
       paths = lib.mapAttrs' (_: mkPath) cfg.keyboards;
       services = lib.mapAttrs' (_: mkService) cfg.keyboards;
diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
new file mode 100644
index 000000000000..12b51bf05217
--- /dev/null
+++ b/nixos/modules/services/networking/ncps.nix
@@ -0,0 +1,326 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.ncps;
+
+  logLevels = [
+    "trace"
+    "debug"
+    "info"
+    "warn"
+    "error"
+    "fatal"
+    "panic"
+  ];
+
+  globalFlags = lib.concatStringsSep " " (
+    [ "--log-level='${cfg.logLevel}'" ]
+    ++ (lib.optionals cfg.openTelemetry.enable (
+      [
+        "--otel-enabled"
+      ]
+      ++ (lib.optional (
+        cfg.openTelemetry.grpcURL != null
+      ) "--otel-grpc-url='${cfg.openTelemetry.grpcURL}'")
+    ))
+  );
+
+  serveFlags = lib.concatStringsSep " " (
+    [
+      "--cache-hostname='${cfg.cache.hostName}'"
+      "--cache-data-path='${cfg.cache.dataPath}'"
+      "--cache-database-url='${cfg.cache.databaseURL}'"
+      "--server-addr='${cfg.server.addr}'"
+    ]
+    ++ (lib.optional cfg.cache.allowDeleteVerb "--cache-allow-delete-verb")
+    ++ (lib.optional cfg.cache.allowPutVerb "--cache-allow-put-verb")
+    ++ (lib.optional (cfg.cache.maxSize != null) "--cache-max-size='${cfg.cache.maxSize}'")
+    ++ (lib.optionals (cfg.cache.lru.schedule != null) [
+      "--cache-lru-schedule='${cfg.cache.lru.schedule}'"
+      "--cache-lru-schedule-timezone='${cfg.cache.lru.scheduleTimeZone}'"
+    ])
+    ++ (lib.optional (cfg.cache.secretKeyPath != null) "--cache-secret-key-path='%d/secretKey'")
+    ++ (lib.forEach cfg.upstream.caches (url: "--upstream-cache='${url}'"))
+    ++ (lib.forEach cfg.upstream.publicKeys (pk: "--upstream-public-key='${pk}'"))
+  );
+
+  isSqlite = lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
+
+  dbPath = lib.removePrefix "sqlite:" cfg.cache.databaseURL;
+  dbDir = dirOf dbPath;
+in
+{
+  options = {
+    services.ncps = {
+      enable = lib.mkEnableOption "ncps: Nix binary cache proxy service implemented in Go";
+
+      package = lib.mkPackageOption pkgs "ncps" { };
+
+      dbmatePackage = lib.mkPackageOption pkgs "dbmate" { };
+
+      openTelemetry = {
+        enable = lib.mkEnableOption "Enable OpenTelemetry logs, metrics, and tracing";
+
+        grpcURL = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = ''
+            Configure OpenTelemetry gRPC URL. Missing or "https" scheme enables
+            secure gRPC, "insecure" otherwise. Omit to emit telemetry to
+            stdout.
+          '';
+        };
+      };
+
+      logLevel = lib.mkOption {
+        type = lib.types.enum logLevels;
+        default = "info";
+        description = ''
+          Set the level for logging. Refer to
+          <https://pkg.go.dev/github.com/rs/zerolog#readme-leveled-logging> for
+          more information.
+        '';
+      };
+
+      cache = {
+        allowDeleteVerb = lib.mkEnableOption ''
+          Whether to allow the DELETE verb to delete narinfo and nar files from
+          the cache.
+        '';
+
+        allowPutVerb = lib.mkEnableOption ''
+          Whether to allow the PUT verb to push narinfo and nar files directly
+          to the cache.
+        '';
+
+        hostName = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            The hostname of the cache server. **This is used to generate the
+            private key used for signing store paths (.narinfo)**
+          '';
+        };
+
+        dataPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/var/lib/ncps";
+          description = ''
+            The local directory for storing configuration and cached store paths
+          '';
+        };
+
+        databaseURL = lib.mkOption {
+          type = lib.types.str;
+          default = "sqlite:${cfg.cache.dataPath}/db/db.sqlite";
+          defaultText = "sqlite:/var/lib/ncps/db/db.sqlite";
+          description = ''
+            The URL of the database (currently only SQLite is supported)
+          '';
+        };
+
+        lru = {
+          schedule = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "0 2 * * *";
+            description = ''
+              The cron spec for cleaning the store to keep it under
+              config.ncps.cache.maxSize. Refer to
+              https://pkg.go.dev/github.com/robfig/cron/v3#hdr-Usage for
+              documentation.
+            '';
+          };
+
+          scheduleTimeZone = lib.mkOption {
+            type = lib.types.str;
+            default = "Local";
+            example = "America/Los_Angeles";
+            description = ''
+              The name of the timezone to use for the cron schedule. See
+              <https://en.wikipedia.org/wiki/List_of_tz_database_time_zones>
+              for a comprehensive list of possible values for this setting.
+            '';
+          };
+        };
+
+        maxSize = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "100G";
+          description = ''
+            The maximum size of the store. It can be given with units such as
+            5K, 10G etc. Supported units: B, K, M, G, T.
+          '';
+        };
+
+        secretKeyPath = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = ''
+            The path to load the secretKey for signing narinfos. Leave this
+            empty to automatically generate a private/public key.
+          '';
+        };
+      };
+
+      server = {
+        addr = lib.mkOption {
+          type = lib.types.str;
+          default = ":8501";
+          description = ''
+            The address and port the server listens on.
+          '';
+        };
+      };
+
+      upstream = {
+        caches = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          example = [ "https://cache.nixos.org" ];
+          description = ''
+            A list of URLs of upstream binary caches.
+          '';
+        };
+
+        publicKeys = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          example = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+          description = ''
+            A list of public keys of upstream caches in the format
+            `host[-[0-9]*]:public-key`. This flag is used to verify the
+            signatures of store paths downloaded from upstream caches.
+          '';
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.cache.lru.schedule == null || cfg.cache.maxSize != null;
+        message = "You must specify config.ncps.cache.lru.schedule when config.ncps.cache.maxSize is set";
+      }
+
+      {
+        assertion = cfg.cache.secretKeyPath == null || (builtins.pathExists cfg.cache.secretKeyPath);
+        message = "config.ncps.cache.secresecretKeyPath=${cfg.cache.secretKeyPath} must exist but does not";
+      }
+    ];
+
+    users.users.ncps = {
+      isSystemUser = true;
+      group = "ncps";
+    };
+    users.groups.ncps = { };
+
+    systemd.services.ncps-create-datadirs = {
+      description = "Created required directories by ncps";
+      serviceConfig = {
+        Type = "oneshot";
+        UMask = "0066";
+      };
+      script =
+        (lib.optionalString (cfg.cache.dataPath != "/var/lib/ncps") ''
+          if ! test -d ${cfg.cache.dataPath}; then
+            mkdir -p ${cfg.cache.dataPath}
+            chown ncps:ncps ${cfg.cache.dataPath}
+          fi
+        '')
+        + (lib.optionalString isSqlite ''
+          if ! test -d ${dbDir}; then
+            mkdir -p ${dbDir}
+            chown ncps:ncps ${dbDir}
+          fi
+        '');
+      wantedBy = [ "ncps.service" ];
+      before = [ "ncps.service" ];
+    };
+
+    systemd.services.ncps = {
+      description = "ncps binary cache proxy service";
+
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up
+      '';
+
+      serviceConfig = lib.mkMerge [
+        {
+          ExecStart = "${lib.getExe cfg.package} ${globalFlags} serve ${serveFlags}";
+          User = "ncps";
+          Group = "ncps";
+          Restart = "on-failure";
+          RuntimeDirectory = "ncps";
+        }
+
+        # credentials
+        (lib.mkIf (cfg.cache.secretKeyPath != null) {
+          LoadCredential = "secretKey:${cfg.cache.secretKeyPath}";
+        })
+
+        # ensure permissions on required directories
+        (lib.mkIf (cfg.cache.dataPath != "/var/lib/ncps") {
+          ReadWritePaths = [ cfg.cache.dataPath ];
+        })
+        (lib.mkIf (cfg.cache.dataPath == "/var/lib/ncps") {
+          StateDirectory = "ncps";
+          StateDirectoryMode = "0700";
+        })
+        (lib.mkIf (isSqlite && !lib.strings.hasPrefix "/var/lib/ncps" dbDir) {
+          ReadWritePaths = [ dbDir ];
+        })
+
+        # Hardening
+        {
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+            "~@resources"
+          ];
+          CapabilityBoundingSet = "";
+          PrivateUsers = true;
+          DevicePolicy = "closed";
+          DeviceAllow = [ "" ];
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          ProtectKernelLogs = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+          MemoryDenyWriteExecute = true;
+          ProcSubset = "pid";
+          RestrictNamespaces = true;
+          SystemCallArchitectures = "native";
+          PrivateNetwork = false;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          NoNewPrivileges = true;
+          LockPersonality = true;
+          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+          LimitNOFILE = 65536;
+          UMask = "0066";
+        }
+      ];
+
+      unitConfig.RequiresMountsFor = lib.concatStringsSep " " (
+        [ "${cfg.cache.dataPath}" ] ++ lib.optional (isSqlite) dbDir
+      );
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ kalbasit ];
+}
diff --git a/nixos/modules/services/web-apps/komga.nix b/nixos/modules/services/web-apps/komga.nix
index d7ab2a9e612e..5245552b2130 100644
--- a/nixos/modules/services/web-apps/komga.nix
+++ b/nixos/modules/services/web-apps/komga.nix
@@ -9,18 +9,31 @@ let
   cfg = config.services.komga;
   inherit (lib) mkOption mkEnableOption maintainers;
   inherit (lib.types) port str bool;
+
+  settingsFormat = pkgs.formats.yaml { };
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [
+        "services"
+        "komga"
+        "port"
+      ]
+      [
+        "services"
+        "komga"
+        "settings"
+        "server"
+        "port"
+      ]
+    )
+  ];
+
   options = {
     services.komga = {
       enable = mkEnableOption "Komga, a free and open source comics/mangas media server";
 
-      port = mkOption {
-        type = port;
-        default = 8080;
-        description = "The port that Komga will listen on.";
-      };
-
       user = mkOption {
         type = str;
         default = "komga";
@@ -39,10 +52,25 @@ in
         description = "State and configuration directory Komga will use.";
       };
 
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = { };
+        defaultText = lib.literalExpression ''
+          {
+            server.port = 8080;
+          }
+        '';
+        description = ''
+          Komga configuration.
+
+          See [documentation](https://komga.org/docs/installation/configuration).
+        '';
+      };
+
       openFirewall = mkOption {
         type = bool;
         default = false;
-        description = "Whether to open the firewall for the port in {option}`services.komga.port`.";
+        description = "Whether to open the firewall for the port in {option}`services.komga.settings.server.port`.";
       };
     };
   };
@@ -52,6 +80,16 @@ in
       inherit (lib) mkIf getExe;
     in
     mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = (cfg.settings.komga.config-dir or cfg.stateDir) == cfg.stateDir;
+          message = "You must use the `services.komga.stateDir` option to properly configure `komga.config-dir`.";
+        }
+      ];
+
+      services.komga.settings = {
+        server.port = lib.mkDefault 8080;
+      };
 
       networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
 
@@ -66,9 +104,17 @@ in
         };
       };
 
+      systemd.tmpfiles.settings."10-komga" = {
+        ${cfg.stateDir}.d = {
+          inherit (cfg) user group;
+        };
+        "${cfg.stateDir}/application.yml"."L+" = {
+          argument = builtins.toString (settingsFormat.generate "application.yml" cfg.settings);
+        };
+      };
+
       systemd.services.komga = {
         environment = {
-          SERVER_PORT = builtins.toString cfg.port;
           KOMGA_CONFIGDIR = cfg.stateDir;
         };
 
diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index 8bdbd75783a4..98190e7e2276 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -88,9 +88,13 @@ in
           ]
         }
         pushd $out
-        tar -Sc $diskImage | gzip -${toString cfg.compressionLevel} > \
+        # RTFM:
+        # https://cloud.google.com/compute/docs/images/create-custom
+        # https://cloud.google.com/compute/docs/import/import-existing-image
+        mv $diskImage disk.raw
+        tar -Sc disk.raw | gzip -${toString cfg.compressionLevel} > \
           ${config.image.fileName}
-        rm $diskImage
+        rm disk.raw
         popd
       '';
       format = "raw";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index cf0616886301..e655d0fad342 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -660,6 +660,11 @@ in {
   navidrome = handleTest ./navidrome.nix {};
   nbd = handleTest ./nbd.nix {};
   ncdns = handleTest ./ncdns.nix {};
+  ncps = runTest ./ncps.nix;
+  ncps-custom-cache-datapath = runTest {
+    imports = [ ./ncps.nix ];
+    defaults.services.ncps.cache.dataPath =  "/path/to/ncps";
+  };
   ndppd = handleTest ./ndppd.nix {};
   nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
   nebula = handleTest ./nebula.nix {};
diff --git a/nixos/tests/kmonad.nix b/nixos/tests/kmonad.nix
index e0150cb99f18..0c880a99787e 100644
--- a/nixos/tests/kmonad.nix
+++ b/nixos/tests/kmonad.nix
@@ -11,6 +11,9 @@
     machine = {
       services.kmonad = {
         enable = true;
+        extraArgs = [
+          "--log-level=debug"
+        ];
         keyboards = {
           defaultKbd = {
             device = "/dev/input/by-id/vm-default-kbd";
@@ -43,5 +46,7 @@
 
     with subtest("kmonad is running"):
          machine.succeed(f"systemctl status {service_name}")
+    with subtest("kmonad symlink is created"):
+         machine.wait_for_file(f"/dev/input/by-id/{service_name}", timeout=5)
   '';
 }
diff --git a/nixos/tests/komga.nix b/nixos/tests/komga.nix
index d48d19bbbdd3..e5eee346350d 100644
--- a/nixos/tests/komga.nix
+++ b/nixos/tests/komga.nix
@@ -8,7 +8,7 @@ import ./make-test-python.nix ({ lib, ... }:
     { pkgs, ... }:
     { services.komga = {
         enable = true;
-        port = 1234;
+        settings.server.port = 1234;
       };
     };
 
diff --git a/nixos/tests/ncps.nix b/nixos/tests/ncps.nix
new file mode 100644
index 000000000000..ce637246ff44
--- /dev/null
+++ b/nixos/tests/ncps.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  name = "ncps";
+
+  nodes = {
+    harmonia = {
+      services.harmonia = {
+        enable = true;
+        signKeyPaths = [
+          (pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==")
+        ];
+        settings.priority = 35;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 5000 ];
+      system.extraDependencies = [ pkgs.emptyFile ];
+    };
+
+    ncps = {
+      services.ncps = {
+        enable = true;
+
+        cache = {
+          hostName = "ncps";
+          secretKeyPath = builtins.toString (
+            pkgs.writeText "ncps-cache-key" "ncps:dcrGsrku0KvltFhrR5lVIMqyloAdo0y8vYZOeIFUSLJS2IToL7dPHSSCk/fi+PJf8EorpBn8PU7MNhfvZoI8mA=="
+          );
+        };
+
+        upstream = {
+          caches = [ "http://harmonia:5000" ];
+          publicKeys = [
+            "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
+          ];
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 8501 ];
+    };
+
+    client01 = {
+      nix.settings = {
+        substituters = lib.mkForce [ "http://ncps:8501" ];
+        trusted-public-keys = lib.mkForce [
+          "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
+        ];
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      narinfoName =
+        (lib.strings.removePrefix "/nix/store/" (
+          lib.strings.removeSuffix "-empty-file" pkgs.emptyFile.outPath
+        ))
+        + ".narinfo";
+
+      narinfoNameChars = lib.strings.stringToCharacters narinfoName;
+
+      narinfoPath = lib.concatStringsSep "/" [
+        nodes.ncps.services.ncps.cache.dataPath
+        "store/narinfo"
+        (lib.lists.elemAt narinfoNameChars 0)
+        ((lib.lists.elemAt narinfoNameChars 0) + (lib.lists.elemAt narinfoNameChars 1))
+        narinfoName
+      ];
+    in
+    ''
+      start_all()
+
+      harmonia.wait_for_unit("harmonia.service")
+
+      ncps.wait_for_unit("ncps.service")
+
+      client01.wait_until_succeeds("curl -f http://ncps:8501/ | grep '\"hostname\":\"${toString nodes.ncps.services.ncps.cache.hostName}\"' >&2")
+
+      client01.succeed("cat /etc/nix/nix.conf >&2")
+      client01.succeed("nix-store --realise ${pkgs.emptyFile}")
+
+      ncps.succeed("cat ${narinfoPath} >&2")
+    '';
+}
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 02932d6a8ee7..317ed3f73f28 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -761,6 +761,9 @@ let
         # Optimizer error: too much on the stack
         ack-menu = ignoreCompilationError super.ack-menu;
 
+        # https://github.com/skeeto/emacs-aio/issues/31
+        aio = ignoreCompilationError super.aio;
+
         # https://github.com/gongo/airplay-el/issues/2
         airplay = addPackageRequires super.airplay [ self.request-deferred ];
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 5a9bd0328c25..5ffbeb90305a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -9785,6 +9785,18 @@ final: prev:
     meta.homepage = "https://github.com/RRethy/nvim-treesitter-textsubjects/";
   };
 
+  nvim-trevJ-lua = buildVimPlugin {
+    pname = "nvim-trevJ.lua";
+    version = "2024-12-23";
+    src = fetchFromGitHub {
+      owner = "AckslD";
+      repo = "nvim-trevJ.lua";
+      rev = "86445d0143d47aede944b6daa5c0a463e9d3e730";
+      sha256 = "0wrmzk7wyr4mk8y0c7hq0qqk19ngdwvvd80690vqs3vby89a5zkj";
+    };
+    meta.homepage = "https://github.com/AckslD/nvim-trevJ.lua/";
+  };
+
   nvim-ts-autotag = buildVimPlugin {
     pname = "nvim-ts-autotag";
     version = "2024-12-02";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index f9f3f0dff68a..0fd5010f7d51 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2308,6 +2308,11 @@ in
     dependencies = [ self.nvim-treesitter ];
   };
 
+  nvim-trevJ-lua = super.nvim-trevJ-lua.overrideAttrs {
+    dependencies = [ self.nvim-treesitter ];
+    nvimRequireCheck = "trevj";
+  };
+
   nvim-ufo = super.nvim-ufo.overrideAttrs {
     dependencies = [ self.promise-async ];
     nvimRequireCheck = "ufo";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 46f11e2e3b4c..26579292c051 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -812,6 +812,7 @@ https://github.com/nvim-treesitter/nvim-treesitter-refactor/,,
 https://github.com/PaterJason/nvim-treesitter-sexp/,HEAD,
 https://github.com/nvim-treesitter/nvim-treesitter-textobjects/,,
 https://github.com/RRethy/nvim-treesitter-textsubjects/,HEAD,
+https://github.com/AckslD/nvim-trevJ.lua/,HEAD,
 https://github.com/windwp/nvim-ts-autotag/,,
 https://github.com/joosepalviste/nvim-ts-context-commentstring/,,
 https://github.com/kevinhwang91/nvim-ufo/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index 20b81c3c70cd..a4dec529aba6 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -199,7 +199,7 @@ stdenv.mkDerivation {
     description = "Native debugger extension for VSCode based on LLDB";
     homepage = "https://github.com/vadimcn/vscode-lldb";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.nigelgbanks ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/applications/science/electronics/openroad/default.nix b/pkgs/applications/science/electronics/openroad/default.nix
index 4558a9f69b4b..e6278d57f160 100644
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@@ -9,7 +9,7 @@
   git,
   python3,
   swig,
-  boost180,
+  boost,
   cbc, # for clp
   cimg,
   clp, # for or-tools
@@ -70,7 +70,7 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    boost180
+    boost
     cbc
     cimg
     clp
diff --git a/pkgs/by-name/ab/abracadabra/package.nix b/pkgs/by-name/ab/abracadabra/package.nix
index c5d1d649fdb6..30f14f074c94 100644
--- a/pkgs/by-name/ab/abracadabra/package.nix
+++ b/pkgs/by-name/ab/abracadabra/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abracadabra";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     rev = "v${version}";
-    hash = "sha256-bzRXGxSWoiBqvx8r2coNVPQKilOAKFoqBcB4F0uAV8g=";
+    hash = "sha256-PPG71W5HeLr4R8je88K4VXPiSbJn5T7dP3M05C+bkv0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ae/aerogramme/package.nix b/pkgs/by-name/ae/aerogramme/package.nix
index a8643ba1b6cf..b28ebe1eb61c 100644
--- a/pkgs/by-name/ae/aerogramme/package.nix
+++ b/pkgs/by-name/ae/aerogramme/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchgit {
     url = "https://git.deuxfleurs.fr/Deuxfleurs/aerogramme/";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-ER+P/XGqNzTLwDLK5EBZq/Dl29ZZKl2FdxDb+oLEJ8Y=";
   };
 
@@ -20,16 +20,8 @@ rustPlatform.buildRustPackage rec {
     ./0001-update-time-rs.patch
   ];
 
-  # must use our own Cargo.lock due to git dependencies
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "imap-codec-2.0.0" = "sha256-o64Q74Q84xLRfU4K4JtcjyS0J8mfoApvUs9siscd0RA=";
-      "imap-flow-0.1.0" = "sha256-IopxybuVt5OW6vFiw/4MxojzaNZrKu2xyfaX6F8IYlA=";
-      "k2v-client-0.0.4" = "sha256-V71FCIsgK3VStFOzVntm8P0vXRobF5rQ74qar+cKyik=";
-      "smtp-message-0.1.0" = "sha256-FoSakm3D1xg1vefLf/zkyvzsij1G0QstK3CRo+LbByE=";
-    };
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-GPj8qhfKgfAadQD9DJafN4ec8L6oY62PS/w/ljkPHpw=";
 
   # disable network tests as Nix sandbox breaks them
   doCheck = false;
@@ -50,6 +42,5 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ supinie ];
     mainProgram = "aerogramme";
     platforms = lib.platforms.linux;
-    broken = true; # https://github.com/rust-lang/rust/issues/129811
   };
 }
diff --git a/pkgs/by-name/ba/bashrun2/package.nix b/pkgs/by-name/ba/bashrun2/package.nix
new file mode 100644
index 000000000000..057d1e3894a4
--- /dev/null
+++ b/pkgs/by-name/ba/bashrun2/package.nix
@@ -0,0 +1,90 @@
+{
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  makeWrapper,
+  xorg,
+  ncurses,
+  coreutils,
+  bashInteractive,
+  gnused,
+  gnugrep,
+  glibc,
+  xterm,
+  util-linux,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bashrun2";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "hbekel";
+    repo = "bashrun2";
+    tag = "v${version}";
+    hash = "sha256-U2ntplhyv8KAkaMd2D6wRsUIYkhJzxdgHo2xsbNRfqM=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    xorg.libX11
+  ];
+
+  patches = [
+    ./remote-permissions.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace \
+      man/bashrun2.1 \
+      --replace-fail '/usr/bin/brwctl' "$out/bin/brwctl"
+
+    substituteInPlace \
+      src/bindings \
+      src/registry \
+      src/utils \
+      src/bashrun2 \
+      src/frontend \
+      src/remote \
+      src/plugin \
+      src/engine \
+      src/bookmarks \
+      --replace-fail '/bin/rm' '${coreutils}/bin/rm'
+
+    substituteInPlace \
+      src/bashrun2 \
+      --replace-fail '#!/usr/bin/env bash' '#!${lib.getExe bashInteractive}'
+
+    substituteInPlace \
+      src/remote \
+      --replace-fail '/bin/cp' '${coreutils}/bin/cp'
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/bashrun2 \
+      --prefix PATH : "$out/bin:${
+        lib.makeBinPath [
+          ncurses
+          coreutils
+          gnused
+          gnugrep
+          glibc
+          bashInteractive
+          xterm
+          util-linux
+        ]
+      }" \
+      --prefix XDG_CONFIG_DIRS : "$out/etc/xdg"
+  '';
+
+  meta = {
+    maintainers = with lib.maintainers; [ dopplerian ];
+    mainProgram = "bashrun2";
+    homepage = "http://henning-liebenau.de/bashrun2/";
+    license = lib.licenses.gpl2Plus;
+    description = "Application launcher based on a modified bash session in a small terminal window";
+  };
+}
diff --git a/pkgs/by-name/ba/bashrun2/remote-permissions.patch b/pkgs/by-name/ba/bashrun2/remote-permissions.patch
new file mode 100644
index 000000000000..888280feaa2d
--- /dev/null
+++ b/pkgs/by-name/ba/bashrun2/remote-permissions.patch
@@ -0,0 +1,12 @@
+diff --git a/src/remote b/src/remote
+index 07674ca..07a6b25 100644
+--- a/src/remote
++++ b/src/remote
+@@ -97,6 +97,7 @@ function §remote.interface.create {
+     local bookmarks="$bashrun_cache_home/remote-bookmarks.bash"
+ 
+     /bin/cp "$bashrun_site/interface" "$interface"
++    chmod +w "$interface"
+     printf '%s\n' "$bashrun_remote_interface" >> "$interface"
+ 
+     printf '%s\n' "source $bindings" >> "$interface"
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 984d459ec3f0..092ce48b52dc 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2024-12-17";
+  version = "0.4.0-unstable-2024-12-26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "605037deb68994bbb3114c2a35db7a7a7e4755a6";
-    hash = "sha256-5AwoXX5Qa4ROjt5wSdcElLJ7ZVguKK3urn0ygVDJiGQ=";
+    rev = "43449629fb3c2ae0b71e8b7cb7d49e8e97a00c64";
+    hash = "sha256-zn9pInfJ/QbwgvBqkqzdW7txVGZVU1EPDo4I4ZQDdLY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cv/cve-prioritizer/package.nix b/pkgs/by-name/cv/cve-prioritizer/package.nix
new file mode 100644
index 000000000000..705951a13d3c
--- /dev/null
+++ b/pkgs/by-name/cv/cve-prioritizer/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "cve-prioritizer";
+  version = "1.8.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "TURROKS";
+    repo = "CVE_Prioritizer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ade/gcRrdvVsp5F61ZndsNL3s3gq8TDk/dZvPc55S/8=";
+  };
+
+  patches = [
+    # Add script, https://github.com/TURROKS/CVE_Prioritizer/pull/33
+    (fetchpatch {
+      name = "add-script.patch";
+      url = "https://github.com/TURROKS/CVE_Prioritizer/commit/c29f2332cde7d79e0c9f34c0a1811611a8fb73c9.patch";
+      hash = "sha256-/hnS+YKO4zNGVGTG+KsugJH7Bt2OE8Q2F+7ZX+uhFlU=";
+    })
+  ];
+
+  postPatch = ''
+    # https://github.com/TURROKS/CVE_Prioritizer/pull/32
+    substituteInPlace pyproject.toml \
+      --replace-fail "CVE Prioritizer" "cve-prioritizer"
+  '';
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
+    click
+    pandas
+    python-dotenv
+    requests
+    termcolor
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "cve_prioritizer" ];
+
+  meta = {
+    description = "Vulnerability patching with CVSS, EPSS, and CISA's Known Exploited Vulnerabilities";
+    homepage = "https://github.com/TURROKS/CVE_Prioritizer";
+    changelog = "https://github.com/TURROKS/CVE_Prioritizer/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "cve-prioritizer";
+  };
+}
diff --git a/pkgs/by-name/fa/fairymax/package.nix b/pkgs/by-name/fa/fairymax/package.nix
index 5950e0b3591f..572d5505c20d 100644
--- a/pkgs/by-name/fa/fairymax/package.nix
+++ b/pkgs/by-name/fa/fairymax/package.nix
@@ -29,6 +29,9 @@ stdenv.mkDerivation rec {
       -DINI_FILE='"'"$out/share/fairymax/fmax.ini"'"'
   '';
 
+  # errors by default in GCC 14
+  NIX_CFLAGS_COMPILE = "-Wno-error=return-mismatch -Wno-error=implicit-int";
+
   installPhase = ''
     mkdir -p "$out"/{bin,share/fairymax}
     cp fairymax "$out/bin"
diff --git a/pkgs/by-name/fr/freeplane/package.nix b/pkgs/by-name/fr/freeplane/package.nix
index a92d25976e3f..6ba59f984aa4 100644
--- a/pkgs/by-name/fr/freeplane/package.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@@ -7,6 +7,7 @@
   jdk17,
   gradle_8,
   which,
+  copyDesktopItems,
 }:
 
 let
@@ -31,6 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     makeBinaryWrapper
     jdk
     gradle
+    copyDesktopItems
   ];
 
   mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/fs/fsg/package.nix b/pkgs/by-name/fs/fsg/package.nix
index 5f7340f9f039..0a8048d5e6f8 100644
--- a/pkgs/by-name/fs/fsg/package.nix
+++ b/pkgs/by-name/fs/fsg/package.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
 
   patches = [ ./wxgtk-3.2.patch ];
 
+  # use correct wx-config for cross-compiling
+  postPatch = ''
+    substituteInPlace makefile \
+      --replace-fail 'wx-config' "${lib.getExe' wxGTK32 "wx-config"}"
+  '';
+
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [ pkg-config ];
@@ -45,6 +51,10 @@ stdenv.mkDerivation rec {
     sed -re '/ctrans_prob/s/energy\[center][+]energy\[other]/(int)(fmin(energy[center]+energy[other],99))/g' -i Canvas.cpp
   '';
 
+  makeFlags = [
+    "CPP=${stdenv.cc.targetPrefix}c++"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin $out/libexec
     cp sand $out/libexec
diff --git a/pkgs/by-name/gi/git-delete-merged-branches/package.nix b/pkgs/by-name/gi/git-delete-merged-branches/package.nix
index 0287e5ed5903..945cdb11f85c 100644
--- a/pkgs/by-name/gi/git-delete-merged-branches/package.nix
+++ b/pkgs/by-name/gi/git-delete-merged-branches/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-delete-merged-branches";
-  version = "7.4.1";
+  version = "7.4.2";
 
   src = fetchFromGitHub {
     owner = "hartwork";
     repo = pname;
-    rev = "refs/tags/${version}";
-    sha256 = "sha256-1CUwac2TPU5s1uLS1zPvtXZEGCWYwm1y935jqbI173Q=";
+    tag = version;
+    sha256 = "sha256-l+R4gINZJ8bJdhcK+U9jOuIoAm2/bd5P+w9AbwPZMrk=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/gr/gradm/package.nix b/pkgs/by-name/gr/gradm/package.nix
index 0197e3ded81c..d92f7c90119c 100644
--- a/pkgs/by-name/gr/gradm/package.nix
+++ b/pkgs/by-name/gr/gradm/package.nix
@@ -7,25 +7,26 @@
   pam,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gradm";
-  version = "3.1-202102241600";
+  version = "3.1-202111052217";
 
   src = fetchurl {
-    url = "https://grsecurity.net/stable/${pname}-${version}.tar.gz";
-    sha256 = "02ni34hpggv00140p9gvh0lqi173zdddd2qhfi96hyr1axd5pl50";
+    url = "https://grsecurity.net/stable/gradm-${finalAttrs.version}.tar.gz";
+    hash = "sha256-JFkpDzZ6R8ihzk6i7Ag1l5nqM9wV7UQ2Q5WWzogoT7k=";
   };
 
   nativeBuildInputs = [
     bison
     flex
   ];
+
   buildInputs = [ pam ];
 
   enableParallelBuilding = true;
 
   makeFlags = [
-    "DESTDIR=$(out)"
+    "DESTDIR=${placeholder "out"}"
     "LEX=${flex}/bin/flex"
     "MANDIR=/share/man"
     "MKNOD=true"
@@ -48,14 +49,14 @@ stdenv.mkDerivation rec {
 
   postInstall = "rmdir $out/dev";
 
-  meta = with lib; {
+  meta = {
     description = "grsecurity RBAC administration and policy analysis utility";
     homepage = "https://grsecurity.net";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       thoughtpolice
       joachifm
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ko/komga/package.nix b/pkgs/by-name/ko/komga/package.nix
index 467af02ffc6e..38764f7e8612 100644
--- a/pkgs/by-name/ko/komga/package.nix
+++ b/pkgs/by-name/ko/komga/package.nix
@@ -3,17 +3,17 @@
   stdenvNoCC,
   fetchurl,
   makeWrapper,
-  jdk17_headless,
+  jdk23_headless,
   nixosTests,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-mgPGhBdZ7FyxkVNPJkfFjQ6mJDbQ049PKzacTN6cajk=";
+    sha256 = "sha256-Gv0AaW3aTjLjNAzC5FJMVfvZyIN23ezPpRk15OYyKKs=";
   };
 
   nativeBuildInputs = [
@@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation rec {
   ];
 
   buildCommand = ''
-    makeWrapper ${jdk17_headless}/bin/java $out/bin/komga --add-flags "-jar $src"
+    makeWrapper ${jdk23_headless}/bin/java $out/bin/komga --add-flags "-jar $src"
   '';
 
   passthru.tests = {
@@ -32,9 +32,12 @@ stdenvNoCC.mkDerivation rec {
     description = "Free and open source comics/mangas server";
     homepage = "https://komga.org/";
     license = lib.licenses.mit;
-    platforms = jdk17_headless.meta.platforms;
-    maintainers = with lib.maintainers; [ govanify ];
+    platforms = jdk23_headless.meta.platforms;
+    maintainers = with lib.maintainers; [
+      tebriel
+      govanify
+    ];
     mainProgram = "komga";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
-
 }
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index df4b73bacb21..ae70d077a298 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "legcord";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "Legcord";
     repo = "Legcord";
     rev = "v${version}";
-    hash = "sha256-9CicqDZDetxElD36OLizyVNxkqz3rQOjAtUNTGWVwss=";
+    hash = "sha256-0dVuSqViMqhWBMEY36ZcXM1FYnMcDH5brp5gsMWg3Rc=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-5GE/I2xLmu2Wu9mjzZMk1YZvtS5PgpwgXnxuY+4nimQ=";
+    hash = "sha256-QTePf/QE85OzXIcnwLJsCJJyRxwoV+FNef2Z9nAt35E=";
   };
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/li/libpoly/package.nix b/pkgs/by-name/li/libpoly/package.nix
index f11ce14ce59d..2ffc34ba5a55 100644
--- a/pkgs/by-name/li/libpoly/package.nix
+++ b/pkgs/by-name/li/libpoly/package.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-7aFz+6XJOVEA/Fmi0ywd6rZdTW8sHq8MoHqXR0Hc2o4=";
   };
 
+  postPatch = ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace-warn " -Werror " " "
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
diff --git a/pkgs/by-name/li/livebook/package.nix b/pkgs/by-name/li/livebook/package.nix
index c346aa664be0..8dfe7a9cf5cc 100644
--- a/pkgs/by-name/li/livebook/package.nix
+++ b/pkgs/by-name/li/livebook/package.nix
@@ -7,10 +7,11 @@
   erlang,
   fetchFromGitHub,
   nixosTests,
+  nix-update-script,
 }:
 beamPackages.mixRelease rec {
   pname = "livebook";
-  version = "0.14.4";
+  version = "0.14.5";
 
   inherit elixir;
 
@@ -21,14 +22,14 @@ beamPackages.mixRelease rec {
   src = fetchFromGitHub {
     owner = "livebook-dev";
     repo = "livebook";
-    rev = "v${version}";
-    hash = "sha256-XpBJlPLr7E3OqTnLxnSmKCgDyiU1hT8WfOhWeRGYROA=";
+    tag = "v${version}";
+    hash = "sha256-VSxW+X5zt6npV4tVVgTEvQhjA+jTramSX5h92BWWaQM=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-jB6IOBX3LwdrEtaWY3gglo1HO2OhdiK8j3BgzfZ1nAU=";
+    hash = "sha256-FrkM82LO7GIFpKQfhlEUrAuKu33BzPBs6OrWW4C6pI0=";
   };
 
   postInstall = ''
@@ -42,18 +43,21 @@ beamPackages.mixRelease rec {
       --set MIX_REBAR3 ${rebar3}/bin/rebar3
   '';
 
-  passthru.tests = {
-    livebook-service = nixosTests.livebook-service;
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      livebook-service = nixosTests.livebook-service;
+    };
   };
 
-  meta = with lib; {
-    license = licenses.asl20;
+  meta = {
+    license = lib.licenses.asl20;
     homepage = "https://livebook.dev/";
     description = "Automate code & data workflows with interactive Elixir notebooks";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       munksgaard
       scvalex
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/lo/lock/package.nix b/pkgs/by-name/lo/lock/package.nix
index ecc6bc7b2313..6cea78ab8252 100644
--- a/pkgs/by-name/lo/lock/package.nix
+++ b/pkgs/by-name/lo/lock/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lock";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "konstantintutsch";
     repo = "Lock";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-Zd0fVCeE/QTvptoxbyDxcPiBrZ/qZMx/A0tB1wZbX6A=";
+    hash = "sha256-UZt8SlkwhtVRLUMf1uYNLchzkWnL+6e7xLYZ81+YQsw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/mo/mosml/package.nix b/pkgs/by-name/mo/mosml/package.nix
index 755a002ebff5..2bd5a6b1c0a0 100644
--- a/pkgs/by-name/mo/mosml/package.nix
+++ b/pkgs/by-name/mo/mosml/package.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+
   src = fetchFromGitHub {
     owner = "kfl";
     repo = "mosml";
diff --git a/pkgs/by-name/pm/pmbootstrap/package.nix b/pkgs/by-name/pm/pmbootstrap/package.nix
index 8cff6df159f2..35f1299c39ba 100644
--- a/pkgs/by-name/pm/pmbootstrap/package.nix
+++ b/pkgs/by-name/pm/pmbootstrap/package.nix
@@ -9,18 +9,20 @@
   sudo,
   python3Packages,
   gitUpdater,
+  util-linux,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = pname;
-    rev = version;
-    hash = "sha256-hUrWMU4V7tf/qVR4geR5FsCQ+BZA+zCPTdCZGN1PMKk=";
+    tag = version;
+    hash = "sha256-ijXyX+VJqiS0z5IOXGjeL2SGZ/4ledhnq/Zr1ZLW/Io=";
     domain = "gitlab.postmarketos.org";
   };
 
@@ -34,103 +36,46 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeCheckInputs = [
-    python3Packages.pytestCheckHook
     git
+    multipath-tools
     openssl
     ps
+    python3Packages.pytestCheckHook
     sudo
+    util-linux
+    versionCheckHook
   ];
 
   # Add test dependency in PATH
-  preCheck = "export PYTHONPATH=$PYTHONPATH:${pmb_test}";
+  preCheck = ''
+    export PYTHONPATH=$PYTHONPATH:${pmb_test}
+  '';
 
   # skip impure tests
   disabledTests = [
-    "test_apk_static"
-    "test_aportgen"
-    "test_aportgen_device_wizard"
-    "test_bootimg"
-    "test_build_abuild_leftovers"
-    "test_build_depends_binary_outdated"
-    "test_build_depends_high_level"
-    "test_build_depends_no_binary_error"
-    "test_build_is_necessary"
-    "test_build_local_source_high_level"
-    "test_build_src_invalid_path"
-    "test_check"
-    "test_can_fast_forward"
-    "test_check_build_for_arch"
-    "test_check_config"
-    "test_chroot_arguments"
-    "test_chroot_interactive_shell"
-    "test_chroot_interactive_shell_user"
-    "test_chroot_mount"
-    "test_clean_worktree"
-    "test_config_user"
-    "test_cross_compile_distcc"
-    "test_crossdirect"
-    "test_extract_arch"
-    "test_extract_version"
-    "test_file"
-    "test_filter_aport_packages"
-    "test_filter_missing_packages_binary_exists"
-    "test_filter_missing_packages_invalid"
-    "test_filter_missing_packages_pmaports"
-    "test_finish"
-    "test_folder_size"
-    "test_get_all_component_names"
-    "test_get_apkbuild"
-    "test_get_depends"
-    "test_get_upstream_remote"
-    "test_helpers_lint"
-    "test_helpers_package_get_apkindex"
-    "test_helpers_repo"
-    "test_helpers_ui"
-    "test_init_buildenv"
-    "test_kconfig_check"
-    "test_keys"
-    "test_newapkbuild"
-    "test_package"
-    "test_package_from_aports"
     "test_pkgrepo_pmaports"
-    "test_pkgrel_bump"
-    "test_pmbootstrap_status"
-    "test_print_checks_git_repo"
-    "test_proxy"
-    "test_pull"
-    "test_qemu_running_processes"
-    "test_questions_additional_options"
-    "test_questions_bootimg"
-    "test_questions_channel"
-    "test_questions_keymaps"
-    "test_questions_work_path"
-    "test_read_config_channel"
-    "test_recurse_invalid"
-    "test_run_abuild"
-    "test_run_core"
-    "test_shell_escape"
-    "test_skip_already_built"
-    "test_switch_to_channel_branch"
-    "test_version"
   ];
 
+  versionCheckProgramArg = "--version";
+
   makeWrapperArgs = [
     "--prefix PATH : ${
       lib.makeBinPath [
         git
         openssl
         multipath-tools
+        util-linux
       ]
     }"
   ];
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Sophisticated chroot/build/flash tool to develop and install postmarketOS";
     homepage = "https://gitlab.com/postmarketOS/pmbootstrap";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       onny
       lucasew
     ];
diff --git a/pkgs/by-name/re/regripper/package.nix b/pkgs/by-name/re/regripper/package.nix
index ac5405d72fda..82f615ea1dd6 100644
--- a/pkgs/by-name/re/regripper/package.nix
+++ b/pkgs/by-name/re/regripper/package.nix
@@ -2,42 +2,45 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  makeWrapper,
   perl,
   perlPackages,
-  runtimeShell,
 }:
 
-stdenv.mkDerivation rec {
+let
+  perlDeps = [
+    perlPackages.ParseWin32Registry
+  ];
+in
+stdenv.mkDerivation {
   pname = "regripper";
-  version = "0-unstable-2024-11-02";
+  version = "0-unstable-2024-12-12";
 
   src = fetchFromGitHub {
     owner = "keydet89";
     repo = "RegRipper3.0";
-    rev = "89f3cac57e10bce1a79627e6038353e8e8a0c378";
-    hash = "sha256-dW3Gr4HQH484i47Bg+CEnBYoGQQRMBJr88+YeuU+iV4=";
+    rev = "bdf7ac2500a41319479846fe07202b7e8a61ca1f";
+    hash = "sha256-JEBwTpDck0w85l0q5WjF1d20NyU+GJ89yAzbkUVOsu0=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   propagatedBuildInputs = [
     perl
-    perlPackages.ParseWin32Registry
-  ];
+  ] ++ perlDeps;
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/{bin,share}
 
-    rm -r *.md *.exe *.bat *.dll
+    rm -r *.md *.exe *.bat *.dll *.zip
 
     cp -aR . "$out/share/regripper/"
 
-    cat > "$out/bin/regripper" << EOF
-    #!${runtimeShell}
-    exec ${perl}/bin/perl $out/share/regripper/rip.pl "\$@"
-    EOF
-
-    chmod u+x  "$out/bin/regripper"
+    makeWrapper ${perl}/bin/perl $out/bin/regripper \
+      --add-flags "$out/share/regripper/rip.pl" \
+      --set PERL5LIB ${perlPackages.makeFullPerlPath perlDeps}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 822855445785..146b685ffbc6 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2024.12.16.00";
+  version = "2024.12.30.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yM+iVX+5caiSW6K45EbkHgHEhceIvauCIYwlLTYpzbQ=";
+    hash = "sha256-o8PHtGG3Ndz6Ei9ZBoAdeNmBb70m4c+jCvHCGOjaA+w=";
   };
 
-  cargoHash = "sha256-TWu2p6d/jec7zZpFP8Gly4RdgkL18yU2VWsFHVZLDJY=";
+  cargoHash = "sha256-guRi+kYLjPHFLm4eN3kJ2kHYIBZ5JXMb3ii8416e+IA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sa/sarasa-gothic/package.nix b/pkgs/by-name/sa/sarasa-gothic/package.nix
index 2113f014e93d..66b69ce36ae0 100644
--- a/pkgs/by-name/sa/sarasa-gothic/package.nix
+++ b/pkgs/by-name/sa/sarasa-gothic/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sarasa-gothic";
-  version = "1.0.26";
+  version = "1.0.27";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${finalAttrs.version}/Sarasa-TTC-${finalAttrs.version}.zip";
-    hash = "sha256-Z2J8yW9yLnkGh+nNb57+xyz8uZFwePpuSlBdRxfPABA=";
+    hash = "sha256-/pN3NIwkJZ4a5g87Z3kr71Xvef0TIbN2UzsfvXJryNk=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/sb/sby/package.nix b/pkgs/by-name/sb/sby/package.nix
index ca9687a2e70d..922056fc94fb 100644
--- a/pkgs/by-name/sb/sby/package.nix
+++ b/pkgs/by-name/sb/sby/package.nix
@@ -19,18 +19,18 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sby";
-  version = "0.47";
+  version = "0.48";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "sby";
-    rev = "yosys-${version}";
-    hash = "sha256-Il2pXw2doaoZrVme2p0dSUUa8dCQtJJrmYitn1MkTD4=";
+    tag = "v${version}";
+    hash = "sha256-icOlWutvajHMCi2YUIGU4v5S63YobXw4fYYUvPoSzo4=";
   };
 
-  nativeBuildInputs = [ bash ];
-  buildInputs = [
-    pythonEnv
+  nativeCheckInputs = [
+    python3
+    python3.pkgs.xmlschema
     yosys
     boolector
     yices
@@ -40,7 +40,8 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs docs/source/conf.py \
+    patchShebangs --build \
+      docs/source/conf.py \
       docs/source/conf.diff \
       tests/autotune/*.sh \
       tests/keepgoing/*.sh \
@@ -64,8 +65,6 @@ stdenv.mkDerivation rec {
       --replace-fail '/usr/bin/env python3' '${pythonEnv}/bin/python'
     substituteInPlace sbysrc/sby_autotune.py \
       --replace-fail '["btorsim", "--vcd"]' '["${btor2tools}/bin/btorsim", "--vcd"]'
-    substituteInPlace tests/make/required_tools.py \
-      --replace-fail '["btorsim", "--vcd"]' '["${btor2tools}/bin/btorsim", "--vcd"]'
   '';
 
   dontBuild = true;
@@ -89,12 +88,7 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "yosys-([0-9].*)"
-    ];
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "SymbiYosys, a front-end for Yosys-based formal verification flows";
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 1b7ace038950..e86b092545bd 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -35,20 +35,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.1.16";
+  version = "3.1.18";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8+Gz9AuxmK2hOApRZ2b1+rROOG94EBJR3pyp8YwtgiA=";
+    hash = "sha256-hUPHWVULyHQgGNTpLZKDk6hUlBIK1ouYAYecr0oUe/M=";
   };
 
   kernel = buildGo123Module {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-B2pGXs0IN5WhNHoFgTufd46q60RNvWzNdwoCxpayYC8=";
+    vendorHash = "sha256-1JwUQ/WhR1O3LTevI2kWk+FNpH4FBVgF46d+W6M7UBg=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-LlQdfRGsBn3IZWKSUqH5tAljXnWanuFXO2x+Wi3on7E=";
+    hash = "sha256-357iBgxevtXus0Dpa8+LHKsO42HoHibkhRSy+tpD8jo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/td/tdlib/package.nix b/pkgs/by-name/td/tdlib/package.nix
index 7c308bec9098..e096cab47e7f 100644
--- a/pkgs/by-name/td/tdlib/package.nix
+++ b/pkgs/by-name/td/tdlib/package.nix
@@ -35,7 +35,7 @@ in
 
 stdenv.mkDerivation {
   pname = "tdlib";
-  version = "1.8.41";
+  version = "1.8.42";
 
   src = fetchFromGitHub {
     owner = "tdlib";
@@ -44,8 +44,8 @@ stdenv.mkDerivation {
     # The tdlib authors do not set tags for minor versions, but
     # external programs depending on tdlib constrain the minor
     # version, hence we set a specific commit with a known version.
-    rev = "5b974c298d4ed551d3ad2c061ad7b8280d137c7e";
-    hash = "sha256-1TyGv2yMjX75+ccZSox/2m6SMmwEZAkShIhLfCeNmZg=";
+    rev = "ef580cd3dd0e5223c2be503342dc29e128be866e";
+    hash = "sha256-k1YQpQXYmEdoiyWeAcj2KRU+BcWuWbHpd4etxLspEoo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index eb5265268b1a..c537e95b3988 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.2.793";
+  version = "0.3.819";
 
   src = fetchFromGitHub {
     owner = "a-h";
     repo = "templ";
     rev = "v${version}";
-    hash = "sha256-0KGht5IMbJV8KkXgT5qJxA9bcmWevzXXAVPMQTm0ccw=";
+    hash = "sha256-kTP/DLnou3KETZRtvHdeiMmRW6xldgZBAn9O9p9s/MA=";
   };
 
-  vendorHash = "sha256-ZWY19f11+UI18jeHYIEZjdb9Ii74mD6w+dYRLPkdfBU=";
+  vendorHash = "sha256-ipLn52MsgX7KQOJixYcwMR9TCeHz55kQQ7fgkIgnu7w=";
 
   subPackages = [ "cmd/templ" ];
 
diff --git a/pkgs/by-name/ts/tsm-client/package.nix b/pkgs/by-name/ts/tsm-client/package.nix
index 4faf16f63af3..4a0c20b02e3d 100644
--- a/pkgs/by-name/ts/tsm-client/package.nix
+++ b/pkgs/by-name/ts/tsm-client/package.nix
@@ -23,7 +23,7 @@
 
 # For an explanation of optional packages
 # (features provided by them, version limits), see
-# https://www.ibm.com/support/pages/node/660813#Version%208.1
+# https://web.archive.org/web/20240118051918/https://www.ibm.com/support/pages/node/660813#Version%208.1
 
 # IBM Tivoli Storage Manager Client uses a system-wide
 # client system-options file `dsm.sys` and expects it
@@ -44,26 +44,13 @@
 # point to this derivations `/dsmi_dir` directory symlink.
 # Other environment variables might be necessary,
 # depending on local configuration or usage; see:
-# https://www.ibm.com/docs/en/storage-protect/8.1.24?topic=solaris-set-api-environment-variables
-
-# The newest version of TSM client should be discoverable by
-# going to the `downloadPage` (see `meta` below).
-# Find the "Backup-archive client" table on that page.
-# Look for "Download Documents" of the latest release.
-# Follow the "Download Information" link.
-# Look for the "Linux x86_64 ..." rows in the table at
-# the bottom of the page and follow their "HTTPS" links (one
-# link per row -- each link might point to the latest release).
-# In the directory listings to show up,
-# check the big `.tar` file.
-#
-# (as of 2023-07-01)
+# https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=solaris-set-api-environment-variables
 
 let
 
   meta = {
     homepage = "https://www.ibm.com/products/storage-protect";
-    downloadPage = "https://www.ibm.com/support/pages/ibm-storage-protect-downloads-latest-fix-packs-and-interim-fixes";
+    downloadPage = "https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/StorageSoftware/IBM+Spectrum+Protect";
     platforms = [ "x86_64-linux" ];
     mainProgram = "dsmc";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -104,10 +91,10 @@ let
 
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     name = "tsm-client-${finalAttrs.version}-unwrapped";
-    version = "8.1.24.0";
+    version = "8.1.25.0";
     src = fetchurl {
       url = mkSrcUrl finalAttrs.version;
-      hash = "sha512-TqTDE2oJK/Wu/MNYUCqxmOE6asAqDLz4GtdcFZuKqvfT8pJUCYKz9yjRPIrM3u2XfLH0wDq+Q8ER4ui680mswA==";
+      hash = "sha512-OPNjSMnWJ/8Ogy9O0wG0H4cEbYiOwyCVzkWhpG00v/Vm0LDxLzPteMnMOyH8L1egIDhy7lmQYSzI/EC4WWUDDA==";
     };
     inherit meta passthru;
 
diff --git a/pkgs/by-name/ur/urlfinder/package.nix b/pkgs/by-name/ur/urlfinder/package.nix
new file mode 100644
index 000000000000..8ffd59e9e326
--- /dev/null
+++ b/pkgs/by-name/ur/urlfinder/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "urlfinder";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "urlfinder";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hORZzeGNcRTcFsvY8pfs8f1JNpdTJjMdO/lJHR83DfY=";
+  };
+
+  vendorHash = "sha256-Wu9itQfcrwWuzRHtTKk+lF7n6eIzSfATWtI+8xLQQsI=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Tool for passively gathering URLs without active scanning";
+    homepage = "https://github.com/projectdiscovery/urlfinder";
+    changelog = "https://github.com/projectdiscovery/urlfinder/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "urlfinder";
+  };
+}
diff --git a/pkgs/by-name/vo/voicevox-core/package.nix b/pkgs/by-name/vo/voicevox-core/package.nix
index 0283b9cbfb4c..556eb756424d 100644
--- a/pkgs/by-name/vo/voicevox-core/package.nix
+++ b/pkgs/by-name/vo/voicevox-core/package.nix
@@ -1,45 +1,18 @@
 {
   lib,
   stdenv,
-  fetchzip,
+  fetchurl,
+  unzip,
   autoPatchelfHook,
 }:
 
-let
-  platformInfoTable = {
-    "x86_64-linux" = {
-      id = "linux-x64";
-      hash = "sha256-/PD5e0bWgnIsIrvyOypoJw30VkgbOFWV1NJpPS2G0WM=";
-    };
-    "aarch64-linux" = {
-      id = "linux-arm64";
-      hash = "sha256-zfiorXZyIISZPXPwmcdYeHceDmQXkUhsvTkNZScg648=";
-    };
-    "x86_64-darwin" = {
-      id = "osx-x64";
-      hash = "sha256-cdNdV1fVPkz6B7vtKZiPsLQGqnIiDtYa9KTcwSkjdJg=";
-    };
-    "aarch64-darwin" = {
-      id = "osx-arm64";
-      hash = "sha256-Z1dq2t/HBQulbPF23ZCihOrcZHMpTXEQ6yXKORZaFPk=";
-    };
-  };
-
-  platformInfo =
-    platformInfoTable.${stdenv.hostPlatform.system}
-      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "voicevox-core";
-  version = "0.15.4";
+  version = "0.15.7";
 
-  # Note: Only the prebuilt binaries are able to decrypt the encrypted voice models
-  src = fetchzip {
-    url = "https://github.com/VOICEVOX/voicevox_core/releases/download/${finalAttrs.version}/voicevox_core-${platformInfo.id}-cpu-${finalAttrs.version}.zip";
-    inherit (platformInfo) hash;
-  };
+  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
-  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = [ unzip ] ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   buildInputs = [ stdenv.cc.cc.lib ];
 
@@ -54,6 +27,37 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  # When updating, run the following command to fetch all FODs:
+  # nix-build -A voicevox-core.sources --keep-going
+  passthru.sources =
+    let
+      # Note: Only the prebuilt binaries are able to decrypt the encrypted voice models
+      fetchCoreArtifact =
+        { id, hash }:
+        fetchurl {
+          url = "https://github.com/VOICEVOX/voicevox_core/releases/download/${finalAttrs.version}/voicevox_core-${id}-cpu-${finalAttrs.version}.zip";
+          inherit hash;
+        };
+    in
+    {
+      "x86_64-linux" = fetchCoreArtifact {
+        id = "linux-x64";
+        hash = "sha256-7FgrJ1HlB8l5MHd2KM4lYRx2bYdxrD2+su1G33/ugUA=";
+      };
+      "aarch64-linux" = fetchCoreArtifact {
+        id = "linux-arm64";
+        hash = "sha256-fD7YMTo9jeB4vJibnVwX8VrukCUeAwS6VXGOr3VXG+c=";
+      };
+      "x86_64-darwin" = fetchCoreArtifact {
+        id = "osx-x64";
+        hash = "sha256-5h9qEKbdcvip50TLs3vf6lXkSv24VEjOrx6CTUo7Q4Q=";
+      };
+      "aarch64-darwin" = fetchCoreArtifact {
+        id = "osx-arm64";
+        hash = "sha256-0bFLhvP7LqDzuk3pyM9QZfc8eLMW0IgqVkaXsuS3qlY=";
+      };
+    };
+
   meta = {
     changelog = "https://github.com/VOICEVOX/voicevox_core/releases/tag/${finalAttrs.version}";
     description = "Core library for the VOICEVOX speech synthesis software";
@@ -67,8 +71,11 @@ stdenv.mkDerivation (finalAttrs: {
         redistributable = true;
       })
     ];
-    maintainers = with lib.maintainers; [ tomasajt ];
-    platforms = lib.attrNames platformInfoTable;
+    maintainers = with lib.maintainers; [
+      tomasajt
+      eljamm
+    ];
+    platforms = lib.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/by-name/vo/voicevox-engine/package.nix b/pkgs/by-name/vo/voicevox-engine/package.nix
index bc9a67617e9f..e9f3e56a73f7 100644
--- a/pkgs/by-name/vo/voicevox-engine/package.nix
+++ b/pkgs/by-name/vo/voicevox-engine/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "voicevox-engine";
-  version = "0.20.0";
+  version = "0.22.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox_engine";
-    rev = "refs/tags/${version}";
-    hash = "sha256-Gib5R7oleg+XXyu2V65EqrflQ1oiAR7a09a0MFhSITc=";
+    tag = version;
+    hash = "sha256-TZycd3xX5d4dNk4ze2JozyO7zDpGAuO+O7xHAx7QXUI=";
   };
 
   patches = [
@@ -95,6 +95,10 @@ python3Packages.buildPythonApplication rec {
     # this test checks the behaviour of openapi
     # one of the functions returns a slightly different output due to openapi version differences
     "test_OpenAPIの形が変わっていないことを確認"
+
+    # these tests fail due to some tiny floating point discrepancies
+    "test_upspeak_voiced_last_mora"
+    "test_upspeak_voiced_N_last_mora"
   ];
 
   nativeCheckInputs = with python3Packages; [
@@ -105,22 +109,26 @@ python3Packages.buildPythonApplication rec {
 
   passthru = {
     resources = fetchFromGitHub {
+      name = "voicevox-resource-${version}"; # this contains ${version} to invalidate the hash upon updating the package
       owner = "VOICEVOX";
       repo = "voicevox_resource";
-      rev = "refs/tags/${version}";
-      hash = "sha256-m888DF9qgGbK30RSwNnAoT9D0tRJk6cD5QY72FRkatM=";
+      tag = version;
+      hash = "sha256-oeWJESm1v0wicAXXFAyZT8z4QRVv9c+3vsWksmuY5wY=";
     };
 
     pyopenjtalk = python3Packages.callPackage ./pyopenjtalk.nix { };
   };
 
   meta = {
-    changelog = "https://github.com/VOICEVOX/voicevox_engine/releases/tag/${version}";
+    changelog = "https://github.com/VOICEVOX/voicevox_engine/releases/tag/${src.tag}";
     description = "Engine for the VOICEVOX speech synthesis software";
     homepage = "https://github.com/VOICEVOX/voicevox_engine";
     license = lib.licenses.lgpl3Only;
     mainProgram = "voicevox-engine";
-    maintainers = with lib.maintainers; [ tomasajt ];
+    maintainers = with lib.maintainers; [
+      tomasajt
+      eljamm
+    ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/vo/voicevox/hardcode-paths.patch b/pkgs/by-name/vo/voicevox/hardcode-paths.patch
index 844a3e5884c4..91d862602bff 100644
--- a/pkgs/by-name/vo/voicevox/hardcode-paths.patch
+++ b/pkgs/by-name/vo/voicevox/hardcode-paths.patch
@@ -12,30 +12,29 @@ index 5b0dcb0..5848ccd 100644
          "host": "http://127.0.0.1:50021"
      }
 diff --git a/electron-builder.config.js b/electron-builder.config.js
-index 462e6f2..10a9bff 100644
+index 196a0d7..7e313c2 100644
 --- a/electron-builder.config.js
 +++ b/electron-builder.config.js
-@@ -35,19 +35,6 @@ const isMac = process.platform === "darwin";
+@@ -37,18 +37,7 @@ const isArm64 = process.arch === "arm64";
  // cf: https://k-hyoda.hatenablog.com/entry/2021/10/23/000349#%E8%BF%BD%E5%8A%A0%E5%B1%95%E9%96%8B%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E5%85%88%E3%81%AE%E8%A8%AD%E5%AE%9A
  const extraFilePrefix = isMac ? "MacOS/" : "";
  
 -const sevenZipFile = fs
--  .readdirSync(path.resolve(__dirname, "build", "vendored", "7z"))
+-  .readdirSync(path.resolve(__dirname, "vendored", "7z"))
 -  .find(
 -    // Windows: 7za.exe, Linux: 7zzs, macOS: 7zz
 -    (fileName) => ["7za.exe", "7zzs", "7zz"].includes(fileName),
 -  );
--
+ 
 -if (!sevenZipFile) {
 -  throw new Error(
--    "7z binary file not found. Run `node ./build/download7z.js` first.",
+-    "7z binary file not found. Run `node ./tools/download7z.js` first.",
 -  );
 -}
--
+ 
  /** @type {import("electron-builder").Configuration} */
  const builderOptions = {
-   beforeBuild: async () => {
-@@ -88,14 +75,6 @@ const builderOptions = {
+@@ -90,14 +79,6 @@ const builderOptions = {
        from: "build/README.txt",
        to: extraFilePrefix + "README.txt",
      },
@@ -44,17 +43,17 @@ index 462e6f2..10a9bff 100644
 -      to: path.join(extraFilePrefix, "vv-engine"),
 -    },
 -    {
--      from: path.resolve(__dirname, "build", "vendored", "7z", sevenZipFile),
+-      from: path.resolve(__dirname, "vendored", "7z", sevenZipFile),
 -      to: extraFilePrefix + sevenZipFile,
 -    },
    ],
    // electron-builder installer
    productName: "VOICEVOX",
 diff --git a/src/backend/electron/manager/vvppManager.ts b/src/backend/electron/manager/vvppManager.ts
-index 6aa17b6..b8b52b7 100644
+index edd3177..22d0114 100644
 --- a/src/backend/electron/manager/vvppManager.ts
 +++ b/src/backend/electron/manager/vvppManager.ts
-@@ -196,16 +196,8 @@ export class VvppManager {
+@@ -184,16 +184,8 @@ export class VvppManager {
  
          const args = ["x", "-o" + outputDir, archiveFile, "-t" + format];
  
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index e4935091c87b..a12fcef8e1c0 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -10,17 +10,18 @@
   electron,
   _7zz,
   voicevox-engine,
+  dart-sass,
 }:
 
 buildNpmPackage rec {
   pname = "voicevox";
-  version = "0.20.0";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox";
-    rev = "refs/tags/${version}";
-    hash = "sha256-05WTecNc1xxe7SGDPZbLtRELNghFkMTqI4pkX4PsVWI=";
+    tag = version;
+    hash = "sha256-6z+A4bJIDfN/K8IjEdt2TqEa/EDt4uQpGh+zSWfP74I=";
   };
 
   patches = [
@@ -36,7 +37,10 @@ buildNpmPackage rec {
         --replace-fail "postinstall" "_postinstall"
   '';
 
-  npmDepsHash = "sha256-g3avCj3S96qYPAyGXn4yvrZ4gteJld+g4eV4aRtv/3g=";
+  npmDepsHash = "sha256-NuKFhDb/J6G3pFYHZedKnY2hDC5GCp70DpqrST4bJMA=";
+
+  # unlock very specific node version bounds specified by upstream
+  npmInstallFlags = [ "--engine-strict=false" ];
 
   nativeBuildInputs =
     [
@@ -54,6 +58,10 @@ buildNpmPackage rec {
   buildPhase = ''
     runHook preBuild
 
+    # force sass-embedded to use our own sass instead of the bundled one
+    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+        --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
+
     # build command taken from the definition of the `electron:build` npm script
     VITE_TARGET=electron npm exec vite build
 
@@ -105,12 +113,15 @@ buildNpmPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/VOICEVOX/voicevox/releases/tag/${version}";
+    changelog = "https://github.com/VOICEVOX/voicevox/releases/tag/${src.tag}";
     description = "Editor for the VOICEVOX speech synthesis software";
     homepage = "https://github.com/VOICEVOX/voicevox";
     license = lib.licenses.lgpl3Only;
     mainProgram = "voicevox";
-    maintainers = with lib.maintainers; [ tomasajt ];
+    maintainers = with lib.maintainers; [
+      tomasajt
+      eljamm
+    ];
     platforms = electron.meta.platforms;
   };
 }
diff --git a/pkgs/by-name/zs/zsync/package.nix b/pkgs/by-name/zs/zsync/package.nix
index d4f57f0a750c..359707c0731f 100644
--- a/pkgs/by-name/zs/zsync/package.nix
+++ b/pkgs/by-name/zs/zsync/package.nix
@@ -1,31 +1,54 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoreconfHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "zsync";
-  version = "0.6.2";
+  version = "0.6.2-unstable-2017-04-25";
 
-  src = fetchurl {
-    url = "http://zsync.moria.org.uk/download/zsync-${version}.tar.bz2";
-    hash = "sha256-C51TQzOHqk8EY0psY6XvqCAwcPIpivcqcF+b492mWvI=";
+  src = fetchFromGitHub {
+    owner = "cph6";
+    repo = "zsync";
+    rev = "6cfe374f8f2310cbd624664ca98e5bb28244ba7a";
+    hash = "sha256-SnCzNDMyhMx+2JmgsrjtYDa31Ki1EWix9iBfaduDnro=";
   };
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    # Suppress error "call to undeclared library function 'strcasecmp'" during compilation.
-    # The function is found by the linker correctly, so this doesn't introduce any issues.
-    NIX_CFLAGS_COMPILE = " -Wno-implicit-function-declaration";
-  };
+  sourceRoot = "${src.name}/c";
+
+  patches = [
+    ./remove-inexisting-rsumtest.patch
+    ./read-blocksums-declaration-fix.patch
+  ];
 
   makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
 
-  meta = with lib; {
-    homepage = "http://zsync.moria.org.uk/";
+  # Suppress error "call to undeclared library function 'strcasecmp'" during compilation.
+  # The function is found by the linker correctly, so this doesn't introduce any issues.
+  # Also supress errors that come from incompatible pointer types due to GCC 14 changes.
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-implicit-function-declaration"
+    ]
+    ++ lib.optionals stdenv.cc.isGNU [
+      "-Wno-error=incompatible-pointer-types"
+    ]
+  );
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/cph6/zsync";
     description = "File distribution system using the rsync algorithm";
-    license = licenses.artistic2;
-    maintainers = with maintainers; [ viric ];
-    platforms = with platforms; all;
+    license = lib.licenses.artistic2;
+    maintainers = with lib.maintainers; [
+      viric
+      ryand56
+    ];
+    platforms = with lib.platforms; all;
   };
 }
diff --git a/pkgs/by-name/zs/zsync/read-blocksums-declaration-fix.patch b/pkgs/by-name/zs/zsync/read-blocksums-declaration-fix.patch
new file mode 100644
index 000000000000..d4e8e638af49
--- /dev/null
+++ b/pkgs/by-name/zs/zsync/read-blocksums-declaration-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/libzsync/zsync.c b/libzsync/zsync.c
+index 793a426..783c349 100644
+--- a/libzsync/zsync.c
++++ b/libzsync/zsync.c
+@@ -116,7 +116,7 @@ struct zsync_state {
+ };
+ 
+ static int zsync_read_blocksums(struct zsync_state *zs, FILE * f,
+-                                int rsum_bytes, int checksum_bytes,
++                                int rsum_bytes, unsigned int checksum_bytes,
+                                 int seq_matches);
+ static int zsync_sha1(struct zsync_state *zs, int fh);
+ static int zsync_recompress(struct zsync_state *zs);
diff --git a/pkgs/by-name/zs/zsync/remove-inexisting-rsumtest.patch b/pkgs/by-name/zs/zsync/remove-inexisting-rsumtest.patch
new file mode 100644
index 000000000000..2e16b58d1f8a
--- /dev/null
+++ b/pkgs/by-name/zs/zsync/remove-inexisting-rsumtest.patch
@@ -0,0 +1,17 @@
+diff --git a/c/librcksum/Makefile.am b/c/librcksum/Makefile.am
+index 0216e49..f4fce72 100644
+--- a/librcksum/Makefile.am
++++ b/librcksum/Makefile.am
+@@ -2,9 +2,8 @@
+ 
+ noinst_LIBRARIES = librcksum.a
+ 
+-TESTS = md4test rsumtest
+-noinst_PROGRAMS = md4test rsumtest
++TESTS = md4test
++noinst_PROGRAMS = md4test
+ 
+ md4test_SOURCES = md4test.c md4.h md4.c
+-rsumtest_SOURCES = rsum.c rsumtest.c hash.c range.c state.c md4.c ../progress.c
+ librcksum_a_SOURCES = internal.h rcksum.h md4.h rsum.c hash.c state.c range.c md4.c
+
diff --git a/pkgs/development/compilers/dotnet/fix-clang19-build.patch b/pkgs/development/compilers/dotnet/fix-clang19-build.patch
new file mode 100644
index 000000000000..40964acb24dd
--- /dev/null
+++ b/pkgs/development/compilers/dotnet/fix-clang19-build.patch
@@ -0,0 +1,48 @@
+From 36354a7aca58753893148d62a889ca9e27381ac0 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Thu, 2 Jan 2025 15:30:16 -0400
+Subject: [PATCH] fix clang19 build
+
+---
+ src/runtime/src/coreclr/vm/comreflectioncache.hpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/runtime/src/coreclr/vm/comreflectioncache.hpp b/src/runtime/src/coreclr/vm/comreflectioncache.hpp
+index 08d173e616..12db55251d 100644
+--- a/src/runtime/src/coreclr/vm/comreflectioncache.hpp
++++ b/src/runtime/src/coreclr/vm/comreflectioncache.hpp
+@@ -26,6 +26,7 @@ public:
+ 
+     void Init();
+ 
++#ifndef DACCESS_COMPILE
+     BOOL GetFromCache(Element *pElement, CacheType& rv)
+     {
+         CONTRACTL
+@@ -102,6 +103,7 @@ public:
+         AdjustStamp(TRUE);
+         this->LeaveWrite();
+     }
++#endif // !DACCESS_COMPILE
+ 
+ private:
+     // Lock must have been taken before calling this.
+@@ -141,6 +143,7 @@ private:
+         return CacheSize;
+     }
+ 
++#ifndef DACCESS_COMPILE
+     void AdjustStamp(BOOL hasWriterLock)
+     {
+         CONTRACTL
+@@ -170,6 +173,7 @@ private:
+         if (!hasWriterLock)
+             this->LeaveWrite();
+     }
++#endif // !DACCESS_COMPILE
+ 
+     void UpdateHashTable(SIZE_T hash, int slot)
+     {
+-- 
+2.47.0
+
diff --git a/pkgs/development/compilers/dotnet/vmr.nix b/pkgs/development/compilers/dotnet/vmr.nix
index 45c10ebd3b39..1e71d0bd6509 100644
--- a/pkgs/development/compilers/dotnet/vmr.nix
+++ b/pkgs/development/compilers/dotnet/vmr.nix
@@ -148,6 +148,7 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals (lib.versionOlder version "9") [
       ./fix-aspnetcore-portable-build.patch
+      ./fix-clang19-build.patch
     ];
 
   postPatch =
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 2437785db5b2..5492e118943f 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "3.0.3";
+  version = "6.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NBF+wXQfEKe9DsOtfY8OuPpFei/rm+MuaiJQ4ViVdmg=";
+    hash = "sha256-N8UEsxOVYRSpg+ziwrB3kLHxCU/p2BzJRzkhR0glVXc=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/gotenberg-client/default.nix b/pkgs/development/python-modules/gotenberg-client/default.nix
index 10d29ac87177..7d5785eb90bd 100644
--- a/pkgs/development/python-modules/gotenberg-client/default.nix
+++ b/pkgs/development/python-modules/gotenberg-client/default.nix
@@ -9,16 +9,16 @@
 }:
 buildPythonPackage rec {
   pname = "gotenberg-client";
-  version = "0.7.0";
+  version = "0.8.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "gotenberg-client";
-    rev = "refs/tags/${version}";
-    hash = "sha256-pkxu9WIsyHW2iTepv5B2naKkK+yw8lT+i3EwobE+u1M=";
+    tag = version;
+    hash = "sha256-EMukzSY8nfm1L1metGhiEc9VqnI/vaLz7ITgbZi0fBw=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index aed63cf3ef41..524e77f9ea72 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "1.5.1";
+  version = "1.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "griffe";
-    rev = "refs/tags/${version}";
-    hash = "sha256-DeXmKswapXPYGTiJLq2yvCwJywCNl79XYHSau0VCCIY=";
+    tag = version;
+    hash = "sha256-F1/SjWy32d/CU86ZR/PK0QPiRMEbUNNeomZOBP/3K/k=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/ipympl/default.nix b/pkgs/development/python-modules/ipympl/default.nix
index f9905bdfc446..aff2fe112b47 100644
--- a/pkgs/development/python-modules/ipympl/default.nix
+++ b/pkgs/development/python-modules/ipympl/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ipympl";
-  version = "0.9.4";
+  version = "0.9.5";
   format = "wheel";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-WwwIxvT26mVbpYI5NjRXwQ+5IVV/UDjBpG20RX1taw4=";
+    hash = "sha256-/xSjV/Q1UuySWC64svdrhEtGmqL6doM/FerX+lhMGfw=";
     dist = "py3";
     python = "py3";
   };
diff --git a/pkgs/development/python-modules/minio/default.nix b/pkgs/development/python-modules/minio/default.nix
index 4c086580a467..f78839c9b84b 100644
--- a/pkgs/development/python-modules/minio/default.nix
+++ b/pkgs/development/python-modules/minio/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "minio";
-  version = "7.2.12";
+  version = "7.2.13";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,8 +30,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio-py";
-    rev = "refs/tags/${version}";
-    hash = "sha256-8CthbR62TZ7MFC3OCwtbHtGwmlQeFLgBtkyRX1P5SYU=";
+    tag = version;
+    hash = "sha256-RauPMoqVp4xnS4CXLH0HVTjA8o/BstoEWKWFHvjVllA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/safetensors/default.nix b/pkgs/development/python-modules/safetensors/default.nix
index 584cc1e7d6af..ceb01938be6c 100644
--- a/pkgs/development/python-modules/safetensors/default.nix
+++ b/pkgs/development/python-modules/safetensors/default.nix
@@ -10,9 +10,6 @@
   rustc,
   setuptools-rust,
 
-  # buildInputs
-  libiconv,
-
   # tests
   h5py,
   numpy,
@@ -22,20 +19,20 @@
 
 buildPythonPackage rec {
   pname = "safetensors";
-  version = "0.4.5";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "safetensors";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-gr4hBbecaGHaoNhRQQXWfLfNB0/wQPKftSiTnGgngog=";
+    tag = "v${version}";
+    hash = "sha256-rs9mYl/2KNdV9e+L/kZr59kLw7ckW9UQPZwkaGyl1Iw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/bindings/python";
-    hash = "sha256-zDXzEVvmJF1dEVUFGBc3losr9U1q/qJCjNFkdJ/pCd4=";
+    hash = "sha256-bQkLBiuhVm2dzrf6hq+S04+zoXUszA7be8iS0WJSoOU=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
@@ -48,8 +45,6 @@ buildPythonPackage rec {
     setuptools-rust
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-
   nativeCheckInputs = [
     h5py
     numpy
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index e487f91d05a7..02070116ebda 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "slixmpp";
-  version = "1.8.5";
+  version = "1.8.6";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dePwrUhVX39ckijnBmwdQ1izPWQLT753PsNLA7f66aM=";
+    hash = "sha256-YK/Kp8laD7nn8RWctwRkpVWIBterrinNMeP8iD+biws=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ff12a6001792..7b2d029eab50 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1293";
+  version = "3.0.1294";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-ho1RneF7xRO6Lc7i4BxAVjHA9UZiEZA2+olnasv4RSw=";
+    hash = "sha256-6Xuih0E+i5dxTlkYzYa0J3T0aNpCoGnnBo1tpfuzWQM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tika-client/default.nix b/pkgs/development/python-modules/tika-client/default.nix
index 7b1614e9c256..4b01da1d5551 100644
--- a/pkgs/development/python-modules/tika-client/default.nix
+++ b/pkgs/development/python-modules/tika-client/default.nix
@@ -9,16 +9,16 @@
 
 buildPythonPackage rec {
   pname = "tika-client";
-  version = "0.7.0";
+  version = "0.8.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "tika-client";
-    rev = "refs/tags/${version}";
-    hash = "sha256-0cv2HaquIUQOb5CPkCxSYvXDzu3OV7WKIT80jI+pjpY=";
+    tag = version;
+    hash = "sha256-UXd6GnwwFVUbBXhskBXDQaYlURQyrhgvMsncOwaLT1o=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index f85ccc9e85f4..961bccd18389 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -454,59 +454,11 @@ buildPythonPackage rec {
 
   env =
     {
-      # Suppress a weird warning in mkl-dnn, part of ideep in pytorch
-      # (upstream seems to have fixed this in the wrong place?)
-      # https://github.com/intel/mkl-dnn/commit/8134d346cdb7fe1695a2aa55771071d455fae0bc
-      # https://github.com/pytorch/pytorch/issues/22346
-      #
+      # disable warnings as errors as they break the build on every compiler
+      # bump, among other things.
       # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
       # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-      NIX_CFLAGS_COMPILE = toString (
-        (
-          lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
-          # Suppress gcc regression: avx512 math function raises uninitialized variable warning
-          # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105593
-          # See also: Fails to compile with GCC 12.1.0 https://github.com/pytorch/pytorch/issues/77939
-          ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12.0.0") [
-            "-Wno-error=maybe-uninitialized"
-            "-Wno-error=uninitialized"
-          ]
-          # Since pytorch 2.0:
-          # gcc-12.2.0/include/c++/12.2.0/bits/new_allocator.h:158:33: error: ‘void operator delete(void*, std::size_t)’
-          # ... called on pointer ‘<unknown>’ with nonzero offset [1, 9223372036854775800] [-Werror=free-nonheap-object]
-          ++ lib.optionals (stdenv.cc.isGNU && lib.versions.major stdenv.cc.version == "12") [
-            "-Wno-error=free-nonheap-object"
-          ]
-          # .../source/torch/csrc/autograd/generated/python_functions_0.cpp:85:3:
-          # error: cast from ... to ... converts to incompatible function type [-Werror,-Wcast-function-type-strict]
-          ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "16") [
-            "-Wno-error=cast-function-type-strict"
-            # Suppresses the most spammy warnings.
-            # This is mainly to fix https://github.com/NixOS/nixpkgs/issues/266895.
-          ]
-          ++ lib.optionals rocmSupport [
-            "-Wno-#warnings"
-            "-Wno-cpp"
-            "-Wno-unknown-warning-option"
-            "-Wno-ignored-attributes"
-            "-Wno-deprecated-declarations"
-            "-Wno-defaulted-function-deleted"
-            "-Wno-pass-failed"
-          ]
-          ++ [
-            "-Wno-unused-command-line-argument"
-            "-Wno-uninitialized"
-            "-Wno-array-bounds"
-            "-Wno-free-nonheap-object"
-            "-Wno-unused-result"
-          ]
-          ++ lib.optionals stdenv.cc.isGNU [
-            "-Wno-maybe-uninitialized"
-            "-Wno-stringop-overflow"
-          ]
-        )
-      );
-
+      NIX_CFLAGS_COMPILE = "-Wno-error";
       USE_VULKAN = setBool vulkanSupport;
     }
     // lib.optionalAttrs vulkanSupport {
diff --git a/pkgs/development/python-modules/wagtail-localize/default.nix b/pkgs/development/python-modules/wagtail-localize/default.nix
index 43aa722abdaa..bd492a5171b8 100644
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "wagtail-localize";
-  version = "1.10";
+  version = "1.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     repo = "wagtail-localize";
     owner = "wagtail";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-khGzJj7LBxz5WPU8l20CmQjC9p5umk6spSyMMHBBguc=";
+    tag = "v${version}";
+    hash = "sha256-HBc5t74zA7kUE8pvaYRZtslVInWrTw0UkmrGd+xaW0Q=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index 78218a379fef..45df43e2e4d0 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.8.2";
+  version = "1.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "sigma67";
     repo = "ytmusicapi";
-    rev = "refs/tags/${version}";
-    hash = "sha256-SZ5YsQNrE91ycSXy/NjtjXp0E6msVKlV0f+Td0AwYpQ=";
+    tag = version;
+    hash = "sha256-yg8wjJTbx6LaVrln+Qdfn7XKnnI2n4W56YQZRYXrtLI=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/zabbix-utils/default.nix b/pkgs/development/python-modules/zabbix-utils/default.nix
new file mode 100644
index 000000000000..6b8d71d2cf1d
--- /dev/null
+++ b/pkgs/development/python-modules/zabbix-utils/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "zabbix-utils";
+  version = "2.0.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "zabbix";
+    repo = "python-zabbix-utils";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rRPen/FzWT0cCnXWiSdoybtXeP1pxYqnjq5b0QPVs1I=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "zabbix_utils" ];
+
+  meta = {
+    description = "Library for zabbix";
+    homepage = "https://github.com/zabbix/python-zabbix-utils";
+    changelog = "https://github.com/zabbix/python-zabbix-utils/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/ruby-modules/with-packages/Gemfile b/pkgs/development/ruby-modules/with-packages/Gemfile
index b668a9b8862a..99d59f734563 100644
--- a/pkgs/development/ruby-modules/with-packages/Gemfile
+++ b/pkgs/development/ruby-modules/with-packages/Gemfile
@@ -58,6 +58,7 @@ gem 'ffi'
 gem 'ffi-rzmq-core'
 gem 'fog-dnsimple'
 gem 'gdk_pixbuf2'
+gem 'gettext'
 gem 'gio2'
 gem 'git'
 gem 'github-pages'
diff --git a/pkgs/servers/mobilizon/0001-fix-version.patch b/pkgs/servers/mobilizon/0001-fix-version.patch
new file mode 100644
index 000000000000..da4d8f436a52
--- /dev/null
+++ b/pkgs/servers/mobilizon/0001-fix-version.patch
@@ -0,0 +1,13 @@
+diff --git a/mix.exs b/mix.exs
+index 8338abf8..883e6987 100644
+--- a/mix.exs
++++ b/mix.exs
+@@ -1,7 +1,7 @@
+ defmodule Mobilizon.Mixfile do
+   use Mix.Project
+ 
+-  @version "5.1.0"
++  @version "5.1.1"
+ 
+   def project do
+     [
diff --git a/pkgs/servers/mobilizon/default.nix b/pkgs/servers/mobilizon/default.nix
index a007a30f6f26..efd40acbfeef 100644
--- a/pkgs/servers/mobilizon/default.nix
+++ b/pkgs/servers/mobilizon/default.nix
@@ -19,6 +19,11 @@ in
 mixRelease rec {
   inherit (common) pname version src;
 
+  # Version 5.1.1 failed to bump their internal package version,
+  # which causes issues with static file serving in the NixOS module.
+  # See https://github.com/NixOS/nixpkgs/pull/370277
+  patches = [ ./0001-fix-version.patch ];
+
   nativeBuildInputs = [
     git
     cmake
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 10cf487ad4a3..2effd687e8e4 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -146,29 +146,51 @@ let
         "lib"
         "man"
       ];
-      outputChecks.out = {
-        disallowedReferences = [
-          "dev"
-          "doc"
-          "man"
-        ];
-        disallowedRequisites = [
-          stdenv'.cc
-          llvmPackages.llvm.out
-        ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-      };
-      outputChecks.lib = {
-        disallowedReferences = [
-          "out"
-          "dev"
-          "doc"
-          "man"
-        ];
-        disallowedRequisites = [
-          stdenv'.cc
-          llvmPackages.llvm.out
-        ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-      };
+      outputChecks =
+        {
+          out = {
+            disallowedReferences = [
+              "dev"
+              "doc"
+              "man"
+            ];
+            disallowedRequisites = [
+              stdenv'.cc
+              llvmPackages.llvm.out
+            ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+          };
+
+          lib = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "doc"
+              "man"
+            ];
+            disallowedRequisites = [
+              stdenv'.cc
+              llvmPackages.llvm.out
+            ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+          };
+        }
+        // lib.optionalAttrs (atLeast "14" && olderThan "15") {
+          # TODO: Make this unconditional via staging because of number of rebuilds.
+          doc = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "man"
+            ];
+          };
+
+          man = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "doc"
+            ];
+          };
+        };
 
       strictDeps = true;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 31cb30a84481..a3a1b9c2b4ee 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18367,6 +18367,8 @@ self: super: with self; {
     pname = "z3-solver";
   }))).python;
 
+  zabbix-utils = callPackage ../development/python-modules/zabbix-utils { };
+
   zadnegoale = callPackage ../development/python-modules/zadnegoale { };
 
   zamg = callPackage ../development/python-modules/zamg { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 13ad49b50b2e..49fd9c7ece37 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1113,6 +1113,16 @@
     };
     version = "1.1.0";
   };
+  forwardable = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b5g1i3xdvmxxpq4qp0z4v78ivqnazz26w110fh4cvzsdayz8zgi";
+      type = "gem";
+    };
+    version = "1.3.3";
+  };
   forwardable-extended = {
     groups = ["default"];
     platforms = [];
@@ -1155,6 +1165,17 @@
     };
     version = "3.0.1";
   };
+  gettext = {
+    dependencies = ["erubi" "locale" "prime" "racc" "text"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "16h0kda5z4s4zqygyk0f52xzs9mlz9r4lnhjwk729hhmdbz68a19";
+      type = "gem";
+    };
+    version = "3.4.9";
+  };
   gio2 = {
     dependencies = ["fiddle" "gobject-introspection"];
     groups = ["default"];
@@ -2141,6 +2162,16 @@
     };
     version = "0.5.0";
   };
+  locale = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "107pm4ccmla23z963kyjldgngfigvchnv85wr6m69viyxxrrjbsj";
+      type = "gem";
+    };
+    version = "2.1.4";
+  };
   loofah = {
     dependencies = ["crass" "nokogiri"];
     groups = ["default"];
@@ -2748,6 +2779,17 @@
     };
     version = "1.2.1";
   };
+  prime = {
+    dependencies = ["forwardable" "singleton"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qsk9q2n4yb80f5mwslxzfzm2ckar25grghk95cj7sbc1p2k3w5s";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
   prism = {
     groups = ["default"];
     platforms = [];
@@ -3600,6 +3642,16 @@
     };
     version = "4.0.0";
   };
+  singleton = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0y2pc7lr979pab5n5lvk3jhsi99fhskl5f2s6004v8sabz51psl3";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
   slather = {
     dependencies = ["clamp" "xcodeproj"];
     groups = ["default"];
@@ -3779,6 +3831,16 @@
     };
     version = "1.6.0";
   };
+  text = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1x6kkmsr49y3rnrin91rv8mpc3dhrf3ql08kbccw8yffq61brfrg";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
   thor = {
     groups = ["default"];
     platforms = [];