diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index f4b309fbe4b6..d51f5d56c302 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -911,6 +911,12 @@ in
 
       # Wait for PostgreSQL to be ready to accept connections.
       script = ''
+        # If we're in standby mode, don't perform any setup
+        if [[ -f "${cfg.dataDir}/standby.signal" ]]; then
+          echo "Skipping setup because PostgreSQL is in standby mode"
+          exit 0
+        fi
+
         check-connection() {
           psql -d postgres -v ON_ERROR_STOP=1 <<-'  EOF'
             SELECT pg_is_in_recovery() \gset
diff --git a/nixos/tests/postgresql/default.nix b/nixos/tests/postgresql/default.nix
index f7266c2e9db2..a8b03a29280b 100644
--- a/nixos/tests/postgresql/default.nix
+++ b/nixos/tests/postgresql/default.nix
@@ -31,6 +31,7 @@ in
   # postgresql
   postgresql = importWithArgs ./postgresql.nix;
   postgresql-jit = importWithArgs ./postgresql-jit.nix;
+  postgresql-replication = importWithArgs ./postgresql-replication.nix;
   postgresql-wal-receiver = importWithArgs ./postgresql-wal-receiver.nix;
   postgresql-tls-client-cert = importWithArgs ./postgresql-tls-client-cert.nix;
 
diff --git a/nixos/tests/postgresql/postgresql-replication.nix b/nixos/tests/postgresql/postgresql-replication.nix
new file mode 100644
index 000000000000..b828c2d7bb49
--- /dev/null
+++ b/nixos/tests/postgresql/postgresql-replication.nix
@@ -0,0 +1,125 @@
+{
+  pkgs,
+  makeTest,
+  genTests,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "postgresql-replication-${package.name}";
+      meta.maintainers = with lib.maintainers; [ bouk ];
+
+      nodes = {
+        primary =
+          { ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              enableTCPIP = true;
+              settings = {
+                wal_level = "replica";
+                max_wal_senders = 10;
+                max_replication_slots = 10;
+              };
+              authentication = ''
+                local replication postgres peer
+                host replication replication all trust
+              '';
+              ensureUsers = [
+                {
+                  name = "replication";
+                  ensureClauses.replication = true;
+                }
+              ];
+            };
+            networking.firewall.allowedTCPPorts = [ 5432 ];
+          };
+
+        replica =
+          { nodes, ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              settings = {
+                hot_standby = "on";
+                primary_conninfo = "host=${nodes.primary.networking.primaryIPAddress} user=replication";
+                primary_slot_name = "replica_slot";
+              };
+            };
+          };
+      };
+
+      testScript = ''
+        start_all()
+        primary.wait_for_unit("postgresql.target")
+
+        primary.succeed(
+            "sudo -u postgres psql -c \"SELECT * FROM pg_create_physical_replication_slot('replica_slot');\""
+        )
+
+        primary.succeed(
+            "sudo -u postgres pg_basebackup -D /tmp/basebackup -S replica_slot -X stream"
+        )
+        primary.succeed("tar -C /tmp -cf /tmp/shared/basebackup.tar basebackup")
+
+        replica.wait_for_unit("postgresql.target")
+        replica.succeed("systemctl stop postgresql")
+
+        replica_data_dir = "/var/lib/postgresql/${package.psqlSchema}"
+        replica.succeed(f"rm -rf {replica_data_dir}")
+        replica.succeed(f"mkdir -p {replica_data_dir}")
+        replica.succeed(f"tar -C {replica_data_dir} --strip-components=1 -xf /tmp/shared/basebackup.tar")
+        replica.succeed(f"touch {replica_data_dir}/standby.signal")
+        replica.succeed(f"chown -R postgres:postgres {replica_data_dir}")
+        replica.succeed(f"chmod 700 {replica_data_dir}")
+
+        replica.succeed("systemctl start postgresql")
+        replica.wait_for_unit("postgresql.target")
+
+        replica.wait_until_succeeds(
+            "sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();' | grep t"
+        )
+
+        primary.succeed(
+            "sudo -u postgres psql -c 'CREATE TABLE test_replication (id serial PRIMARY KEY, data text);'"
+        )
+        primary.succeed(
+            "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('hello');\""
+        )
+
+        replica.wait_until_succeeds(
+            "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep hello",
+            timeout=30
+        )
+
+        with subtest("Verify replica is in recovery mode"):
+            result = replica.succeed("sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();'")
+            t.assertEqual(result.strip(), "t")
+
+        with subtest("Verify replication slot is active"):
+            result = primary.succeed(
+                "sudo -u postgres psql -tAc \"SELECT active FROM pg_replication_slots WHERE slot_name = 'replica_slot';\""
+            )
+            t.assertEqual(result.strip(), "t")
+
+        with subtest("Insert more data and verify replication"):
+            primary.succeed(
+                "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('world');\""
+            )
+            replica.wait_until_succeeds(
+                "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep world",
+                timeout=30
+            )
+
+        primary.shutdown()
+        replica.shutdown()
+      '';
+    };
+in
+genTests { inherit makeTestFor; }
diff --git a/nixos/tests/temporal.nix b/nixos/tests/temporal.nix
index 80ad0540a673..9373e5ad3e7e 100644
--- a/nixos/tests/temporal.nix
+++ b/nixos/tests/temporal.nix
@@ -9,6 +9,9 @@
       temporal =
         { config, pkgs, ... }:
         {
+          virtualisation.cores = 2;
+
+          networking.useDHCP = false;
           networking.firewall.allowedTCPPorts = [ 7233 ];
 
           environment.systemPackages = [
@@ -93,6 +96,7 @@
                     asyncio.run(main())
               ''
             )
+            pkgs.grpc-health-probe
             pkgs.temporal-cli
           ];
 
@@ -265,6 +269,18 @@
       temporal.wait_for_open_port(7234)
       temporal.wait_for_open_port(7235)
 
+      temporal.wait_until_succeeds(
+        "grpc-health-probe -addr=localhost:7233 -service=temporal.api.workflowservice.v1.WorkflowService"
+      )
+
+      temporal.wait_until_succeeds(
+        "grpc-health-probe -addr=localhost:7234 -service=temporal.api.workflowservice.v1.HistoryService"
+      )
+
+      temporal.wait_until_succeeds(
+        "grpc-health-probe -addr=localhost:7235 -service=temporal.api.workflowservice.v1.MatchingService"
+      )
+
       temporal.wait_until_succeeds(
         "journalctl -o cat -u temporal.service | grep 'server-version' | grep '${pkgs.temporal.version}'"
       )
@@ -274,32 +290,32 @@
       )
 
       import json
-      cluster_list_json = json.loads(temporal.wait_until_succeeds("temporal operator cluster list --output json"))
+      cluster_list_json = json.loads(temporal.wait_until_succeeds("temporal operator cluster list --output json", timeout=60))
       assert cluster_list_json[0]['clusterName'] == "active"
 
-      cluster_describe_json = json.loads(temporal.wait_until_succeeds("temporal operator cluster describe --output json"))
+      cluster_describe_json = json.loads(temporal.wait_until_succeeds("temporal operator cluster describe --output json", timeout=60))
       assert cluster_describe_json['serverVersion'] in "${pkgs.temporal.version}"
 
-      temporal.log(temporal.wait_until_succeeds("temporal operator namespace create --namespace default"))
+      temporal.log(temporal.wait_until_succeeds("temporal operator namespace create --namespace default", timeout=60))
 
       temporal.wait_until_succeeds(
         "journalctl -o cat -u temporal.service | grep 'Register namespace succeeded'"
       )
 
-      namespace_list_json = json.loads(temporal.wait_until_succeeds("temporal operator namespace list --output json"))
+      namespace_list_json = json.loads(temporal.wait_until_succeeds("temporal operator namespace list --output json", timeout=60))
       assert len(namespace_list_json) == 2
 
-      namespace_describe_json = json.loads(temporal.wait_until_succeeds("temporal operator namespace describe --output json --namespace default"))
+      namespace_describe_json = json.loads(temporal.wait_until_succeeds("temporal operator namespace describe --output json --namespace default", timeout=60))
       assert namespace_describe_json['namespaceInfo']['name'] == "default"
       assert namespace_describe_json['namespaceInfo']['state'] == "NAMESPACE_STATE_REGISTERED"
 
-      workflow_json = json.loads(temporal.wait_until_succeeds("temporal workflow list --output json"))
+      workflow_json = json.loads(temporal.wait_until_succeeds("temporal workflow list --output json", timeout=60))
       assert len(workflow_json) == 0
 
-      out = temporal.wait_until_succeeds("temporal-hello-workflow.py")
+      out = temporal.wait_until_succeeds("temporal-hello-workflow.py", timeout=60)
       assert "Result: Hello, World!" in out
 
-      workflow_json = json.loads(temporal.wait_until_succeeds("temporal workflow list --output json"))
+      workflow_json = json.loads(temporal.wait_until_succeeds("temporal workflow list --output json", timeout=60))
       assert workflow_json[0]['execution']['workflowId'] == "hello-activity-workflow-id"
       assert workflow_json[0]['status'] == "WORKFLOW_EXECUTION_STATUS_COMPLETED"
 
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix
index 3b349ed571e7..aa1931869d6b 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix
@@ -11,14 +11,14 @@ let
     path = "${drv}/parser";
   };
 
+  grammarPackage = grammars: pkgs.linkFarm "emacs-treesit-grammars" (map grammarToAttrSet grammars);
+
   # Usage:
   # treesit-grammars.with-grammars (p: [ p.tree-sitter-bash p.tree-sitter-c ... ])
-  with-grammars =
-    fn:
-    pkgs.linkFarm "emacs-treesit-grammars" (map grammarToAttrSet (fn pkgs.tree-sitter.builtGrammars));
+  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter.builtGrammars);
+
+  with-all-grammars = grammarPackage pkgs.tree-sitter.allGrammars;
 in
 {
-  inherit with-grammars;
-
-  with-all-grammars = with-grammars (ps: lib.filter (p: !p.meta.broken) (lib.attrValues ps));
+  inherit with-grammars with-all-grammars;
 }
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index bd20ef145db2..6b6eb8ff58f3 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -8,8 +8,8 @@ makeScopeWithSplicing' {
   extra = self: {
     mkLinphoneDerivation = self.mk-linphone-derivation;
 
-    linphoneSdkVersion = "5.4.67";
-    linphoneSdkHash = "sha256-YG+GF6En1r8AYoIj7E5hqPcmXidMmO0ZKVx/YC5w55I=";
+    linphoneSdkVersion = "5.4.48";
+    linphoneSdkHash = "sha256-sOkq73YWbhpKJOk1dVc4tkg2+RuGyRK8/t4ckMIVVG8=";
   };
   f =
     self:
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
index c8acc809ae15..efa510c3aad5 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
@@ -39,7 +39,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linphone-desktop";
-  version = "5.3.2";
+  version = "5.3.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.linphone.org";
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     group = "BC";
     repo = "linphone-desktop";
     rev = finalAttrs.version;
-    hash = "sha256-YBwN2d8Bhr876xDzzge1CutJEtWkoGJWwkybSKUDiM0=";
+    hash = "sha256-TO9JNsOnx4sTJEkai0nDKNyZWcLuGoWfuKLBM79tQvs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index 11930e228c08..426e63a318cc 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "23.2.10";
+  version = "23.2.11";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-pmzXrywlNU8/jevBo/cyym6vA6/XrNc5vz66BwkLd5o=";
+    hash = "sha256-+tTZRDDYHZqZBsH+RVX2pdOJPlRZqD4fFzir4VsdB3o=";
   };
 
-  npmDepsHash = "sha256-a3AU4UIlXRswBPya+e2AY3Yv21A2AQoWfGAJ7iDz740=";
+  npmDepsHash = "sha256-y/DNm4TiPx515UgpiCX1U9fHLPk19/8LlfqTGZHDmAA=";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/ca/cargo-audit/package.nix b/pkgs/by-name/ca/cargo-audit/package.nix
index 4dd7a3a2dae4..87efa3ecb51c 100644
--- a/pkgs/by-name/ca/cargo-audit/package.nix
+++ b/pkgs/by-name/ca/cargo-audit/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-audit";
-  version = "0.21.2";
+  version = "0.22.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-bRBQpZ0YoKDh959a1a7+qEs2vh+dbP8vYcwbkNZQ5cQ=";
+    hash = "sha256-Ha2yVyu9331NaqiW91NEwCTIeW+3XPiqZzmatN5KOws=";
   };
 
-  cargoHash = "sha256-MIwKgQM3LoNV9vcs8FfxTzqXhIhLkYd91dMEgPH++zk=";
+  cargoHash = "sha256-f8nrW1l7UA8sixwqXBD1jCJi9qyKC5tNl/dWwCt41Lk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-features-manager/package.nix b/pkgs/by-name/ca/cargo-features-manager/package.nix
index 83c44c0c7562..9ec898dd9365 100644
--- a/pkgs/by-name/ca/cargo-features-manager/package.nix
+++ b/pkgs/by-name/ca/cargo-features-manager/package.nix
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-1/bCyScvWQYeGZRitvksww4uvrzhifRBYcYPgGY2GRo=";
 
   meta = {
-    description = "Command-line tool for managing Architectural Decision Records";
+    description = "TUI-like cli tool to manage the features of your rust-projects dependencies";
     homepage = "https://github.com/ToBinio/cargo-features-manager";
     changelog = "https://github.com/ToBinio/cargo-features-manager/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
-    mainProgram = "cargo-features-manager";
+    mainProgram = "cargo-features";
   };
 }
diff --git a/pkgs/by-name/cf/cfspeedtest/package.nix b/pkgs/by-name/cf/cfspeedtest/package.nix
index 8d81b7e4f8ad..1b6a2c7cea40 100644
--- a/pkgs/by-name/cf/cfspeedtest/package.nix
+++ b/pkgs/by-name/cf/cfspeedtest/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cfspeedtest";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "code-inflation";
     repo = "cfspeedtest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q69ti2bEJBO7Evz8X2EQGbMP3n27fesSO1z8HaEhKJM=";
+    hash = "sha256-MWVWYA++gxcKcCvBynVmm+l3qoSb6JKUtGUbRWEGrP8=";
   };
 
-  cargoHash = "sha256-AvcbA4V9Ht9yWNOPPVQvAGULiTh7cY92NaZJbOAOk1U=";
+  cargoHash = "sha256-Oa+k+iBkKFdDcMAxrDdLNWhy2CakbX1G+AMlwGQFBsk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index c187385c2384..6772eed9dcd9 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "12.13.2";
+  version = "12.14.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-i/vHKFvlHjTRPo2btOuc6vql7D5FSP7PvAsnIf7zEe0=";
+    hash = "sha256-e/C3DPiHkjj8FVxO9CPVbPoP5+3ASFoqUOl0ui8zXPo=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-JIG+KV+5na6QdfT4lxUEzvE6HejzxthBRtmYAnsV+ko=";
+  vendorHash = "sha256-CPSje0LdbWKCTq0hqo2FFF9r3rIwUUkEocC4LO0lG6g=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index ca5daef5dcfb..b9fcc520ddc5 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.405.0";
+  version = "1.406.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-aeSiaK0loCN7IAAALlK2x4RBViYgplXRsiNMVLXlxws=";
+    hash = "sha256-GGTERNSfg/XgM+5URVin05ocNe3JuH6+8JB7hBOqPrE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/cr/cryfs/package.nix b/pkgs/by-name/cr/cryfs/package.nix
index 6329a679b585..d6192f2a6661 100644
--- a/pkgs/by-name/cr/cryfs/package.nix
+++ b/pkgs/by-name/cr/cryfs/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryfs";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "cryfs";
     repo = "cryfs";
     rev = version;
-    hash = "sha256-QzxJUh6nD6243x443b0tIb1v2Zs8jRUk8IVarNqs47M=";
+    hash = "sha256-WVHCZEUca/Snij1EO1etfyvF0UGGUXMQpI3fsQ0eNkA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ea/easyeasm/package.nix b/pkgs/by-name/ea/easyeasm/package.nix
index d172ece3e536..add0ce949088 100644
--- a/pkgs/by-name/ea/easyeasm/package.nix
+++ b/pkgs/by-name/ea/easyeasm/package.nix
@@ -5,8 +5,9 @@
   makeWrapper,
   amass,
   alterx,
-  oam-tools,
   subfinder,
+  dnsx,
+  httpx,
 }:
 
 buildGoModule rec {
@@ -37,8 +38,9 @@ buildGoModule rec {
         lib.makeBinPath [
           amass
           alterx
-          oam-tools
           subfinder
+          dnsx
+          httpx
         ]
       }"
   '';
diff --git a/pkgs/by-name/gt/gtdialog/package.nix b/pkgs/by-name/gt/gtdialog/package.nix
index 55ed478ceb4e..bcfe50d7324b 100644
--- a/pkgs/by-name/gt/gtdialog/package.nix
+++ b/pkgs/by-name/gt/gtdialog/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtdialog";
-  version = "1.4";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "orbitalquark";
     repo = "gtdialog";
     rev = "gtdialog_${finalAttrs.version}";
-    hash = "sha256-BJZP91HzGBm/G5sbKi3jyKQ2LD7l/PC1AoljthNxWtU=";
+    hash = "sha256-TdYwT4bC+crTSNGJIr1Nno+/h1YgxNp0BR5MQtxdrVg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gu/guile-sdl2/package.nix b/pkgs/by-name/gu/guile-sdl2/package.nix
index 350872063c8c..b8500ecdda84 100644
--- a/pkgs/by-name/gu/guile-sdl2/package.nix
+++ b/pkgs/by-name/gu/guile-sdl2/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   version = "0.8.0";
 
   src = fetchurl {
-    url = "https://files.dthompson.us/${pname}/${pname}-${version}.tar.gz";
+    url = "https://files.dthompson.us/releases/guile-sdl2/guile-sdl2-${version}.tar.gz";
     hash = "sha256-V/XrpFrqOxS5mAphtIt2e3ewflK+HdLFEqOmix98p+w=";
   };
 
diff --git a/pkgs/by-name/ha/hashpump/package.nix b/pkgs/by-name/ha/hashpump/package.nix
index e894380898b9..d5f861b4b43d 100644
--- a/pkgs/by-name/ha/hashpump/package.nix
+++ b/pkgs/by-name/ha/hashpump/package.nix
@@ -1,6 +1,6 @@
 {
   stdenv,
-  fetchFromGitHub,
+  fetchzip,
   openssl,
   lib,
 }:
@@ -9,10 +9,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "hashpump";
   version = "1.2.0";
 
-  src = fetchFromGitHub {
-    owner = "bwall";
-    repo = "HashPump";
-    rev = "v${finalAttrs.version}";
+  # Github repository got removed
+  src = fetchzip {
+    url = "https://web.archive.org/web/20201018005212/https://github.com/bwall/HashPump/archive/v1.20.tar.gz";
     hash = "sha256-xL/1os17agwFtdq0snS3ZJzwJhk22ujxfWLH65IMMEM=";
   };
 
diff --git a/pkgs/by-name/kh/khd/org.nixos.khd.plist b/pkgs/by-name/kh/khd/org.nixos.khd.plist
deleted file mode 100644
index 3c0aaa81eb61..000000000000
--- a/pkgs/by-name/kh/khd/org.nixos.khd.plist
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>org.nixos.khd</string>
-  <key>ProgramArguments</key>
-  <array>
-  <string>@out@/bin/khd</string>
-  </array>
-  <key>KeepAlive</key>
-  <true/>
-  <key>ProcessType</key>
-  <string>Interactive</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>@out@/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-  </dict>
-  <key>Sockets</key>
-  <dict>
-    <key>Listeners</key>
-    <dict>
-      <key>SockServiceName</key>
-      <string>3021</string>
-      <key>SockType</key>
-      <string>dgram</string>
-      <key>SockFamily</key>
-      <string>IPv4</string>
-    </dict>
-  </dict>
-</dict>
-</plist>
diff --git a/pkgs/by-name/kh/khd/package.nix b/pkgs/by-name/kh/khd/package.nix
deleted file mode 100644
index 2877355808f2..000000000000
--- a/pkgs/by-name/kh/khd/package.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "khd";
-  version = "3.0.0";
-
-  src = fetchFromGitHub {
-    owner = "koekeishiya";
-    repo = "khd";
-    rev = "v${version}";
-    sha256 = "0nzfhknv1s71870w2dk9dy56a3g5zsbjphmfrz0vsvi438g099r4";
-  };
-
-  patches = [
-    # Fixes build issues, remove with >3.0.0
-    (fetchpatch {
-      url = "https://github.com/koekeishiya/khd/commit/4765ae0b4c7d4ca56319dc92ff54393cd9e03fbc.patch";
-      sha256 = "0kvf5hxi5bf6pf125qib7wn7hys0ag66zzpp4srj1qa87lxyf7np";
-    })
-  ];
-
-  buildPhase = ''
-    make install
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp bin/khd $out/bin/khd
-
-    mkdir -p $out/Library/LaunchDaemons
-    cp ${./org.nixos.khd.plist} $out/Library/LaunchDaemons/org.nixos.khd.plist
-    substituteInPlace $out/Library/LaunchDaemons/org.nixos.khd.plist --subst-var out
-  '';
-
-  meta = {
-    description = "Simple modal hotkey daemon for OSX";
-    homepage = "https://github.com/koekeishiya/khd";
-    downloadPage = "https://github.com/koekeishiya/khd/releases";
-    platforms = lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ lnl7 ];
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/by-name/ko/ko/package.nix b/pkgs/by-name/ko/ko/package.nix
index a435e95b1f43..c98fffa5acc7 100644
--- a/pkgs/by-name/ko/ko/package.nix
+++ b/pkgs/by-name/ko/ko/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "ko";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "ko-build";
     repo = "ko";
     tag = "v${version}";
-    hash = "sha256-fAdogzNCuz8vHWF1UOFmDKSRXbNvY5knKIhfJzXNGzw=";
+    hash = "sha256-o/Hin6GDFki1ynZ/rDQOhcNUTtQVvXZTAApxAaerRCU=";
   };
 
-  vendorHash = "sha256-R+vGG2u/unXffD/9Aq065zR7Xq9KEWZl4llYFxR0HLU=";
+  vendorHash = "sha256-gYDYKNLTmJT0JvQ4wi/5p/3YmaaS4Re/wFqZxRbRVpg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mk/mkcal/package.nix b/pkgs/by-name/mk/mkcal/package.nix
index 75c728dc95ae..5b2c64e378c5 100644
--- a/pkgs/by-name/mk/mkcal/package.nix
+++ b/pkgs/by-name/mk/mkcal/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mkcal";
-  version = "0.7.29";
+  version = "0.7.30";
 
   src = fetchFromGitHub {
     owner = "sailfishos";
     repo = "mkcal";
     tag = finalAttrs.version;
-    hash = "sha256-H7TWu6tTh1vBmFx7kRpyijLCg0xs+dYIEJAERBEGh8g=";
+    hash = "sha256-Sr4THufulhpTOXvMEUG1BA41Lcky34AGALxJojR7sac=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/mu/musescore/package.nix b/pkgs/by-name/mu/musescore/package.nix
index a52420595dff..225878b43fea 100644
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.6.4";
+  version = "4.6.5";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fBkokokyCJcwYRgdrtWQEqW1rcdlmVQu1OrMJeKA8Sc=";
+    hash = "sha256-lfgf09gLeoiXc0xsJvvKAnSJUjy/L2Fdis/9SNjb1KM=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ne/netbird/package.nix b/pkgs/by-name/ne/netbird/package.nix
index cc77e4565147..e78450e959e1 100644
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -68,16 +68,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird-${componentName}";
-  version = "0.60.3";
+  version = "0.60.8";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+sfa9gZQltX9BsA0QUDDR3W9JGERUEzjahogIE2aq0=";
+    hash = "sha256-XM4pUYimxbO3ZCmTPbg7dwDB3x2TnL9PUgbMfjHjxmo=";
   };
 
-  vendorHash = "sha256-vtyzl1fIl3vsj61X+l6Fc8BKqwM68iwkX5+WgcQRlME=";
+  vendorHash = "sha256-b3Wl9jsAdYC91JM/kDo4yIF05hqbivtrcn1aRuZzP3s=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional (componentName == "ui") pkg-config;
 
diff --git a/pkgs/by-name/np/npins/package.nix b/pkgs/by-name/np/npins/package.nix
index b08ac3037cd7..c9ebd5a887e7 100644
--- a/pkgs/by-name/np/npins/package.nix
+++ b/pkgs/by-name/np/npins/package.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "npins";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "andir";
     repo = "npins";
     tag = version;
-    sha256 = "sha256-PPk9Ve1pM3X7NfGeGb8Jiq4YDEwAjErP4xzGwLaakTU=";
+    sha256 = "sha256-ksOXi7u4bpHyWNHwkUR62fdwKowPW5GqBS7MA7Apwh4=";
   };
 
-  cargoHash = "sha256-YRW2TqbctuGC2M6euR4bb0m9a19m8WQVvWucRMpzkQE=";
+  cargoHash = "sha256-A93cFkBt+gHCuLAE7Zk8DRmsGoMwJkqtgHZd4lbpFs0=";
   buildNoDefaultFeatures = true;
   buildFeatures = [
     "clap"
diff --git a/pkgs/by-name/oa/oam-tools/package.nix b/pkgs/by-name/oa/oam-tools/package.nix
deleted file mode 100644
index 709f93a9ecb9..000000000000
--- a/pkgs/by-name/oa/oam-tools/package.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule rec {
-  pname = "oam-tools";
-  version = "0.1.2";
-
-  src = fetchFromGitHub {
-    owner = "owasp-amass";
-    repo = "oam-tools";
-    tag = "v${version}";
-    hash = "sha256-vt4V8em8Iaz3BVKIqlcAv+VIpJtD58xb3QrkIr4tYuU=";
-  };
-
-  vendorHash = "sha256-yFKYZlA06yE48Wiz0cKgD57JEREwYyYkLM1NZPV8+Xc=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  meta = {
-    description = "Analysis and management tools for an Open Asset Model database";
-    homepage = "https://github.com/owasp-amass/oam-tools";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/by-name/pc/pcapc/package.nix b/pkgs/by-name/pc/pcapc/package.nix
index ee22b19609cf..8cb80bfef0c2 100644
--- a/pkgs/by-name/pc/pcapc/package.nix
+++ b/pkgs/by-name/pc/pcapc/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
+  fetchFromGitea,
   libpcap,
 }:
 
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
   pname = "pcapc";
   version = "1.0.1";
 
-  src = fetchFromGitLab {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "post-factum";
     repo = "pcapc";
     rev = "v${version}";
diff --git a/pkgs/by-name/so/soco-cli/package.nix b/pkgs/by-name/so/soco-cli/package.nix
index 04083f01188f..80d9f25b0856 100644
--- a/pkgs/by-name/so/soco-cli/package.nix
+++ b/pkgs/by-name/so/soco-cli/package.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "soco-cli";
-  version = "0.4.80";
+  version = "0.4.81";
   pyproject = true;
 
   disabled = python3.pythonOlder "3.6";
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "avantrec";
     repo = "soco-cli";
     rev = "v${version}";
-    hash = "sha256-w4F1N1ULGH7mbxtI8FpZ54ixa9o7N2A9OEiE2FOf73g=";
+    hash = "sha256-Be/NzaO6EmpJC5NjNXhcp1K2ObXUduheqPWhsXI/Jc8=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 6949878a5fee..298ac71f86d6 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -14,14 +14,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "splayer";
-  version = "3.0.0-beta.6";
+  version = "3.0.0-beta.7";
 
   src = fetchFromGitHub {
     owner = "imsyy";
     repo = "SPlayer";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-7guh5KJ9RbYCiifH0ERXbIXxoJDxanUAHAf/zux7yU4=";
+    hash = "sha256-W4XvYQ0O3Qnr9kRxTxt21UkU5dw66ww1qpIY3ph3elE=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-3t9Qx+1OQwqVvzgYssP8azGG/PNSJkrG614wQh0W4WQ=";
+    hash = "sha256-lcSecyT55hFtRFPK7xtPhSbXynGIOgKIfV5T5tDQzfA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/steel/package.nix b/pkgs/by-name/st/steel/package.nix
index c32beb2b1138..f8a5eeedc06f 100644
--- a/pkgs/by-name/st/steel/package.nix
+++ b/pkgs/by-name/st/steel/package.nix
@@ -19,13 +19,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "steel";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2025-12-17";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "steel";
-    rev = "875b6739eed0b7d053a53e7b694496954f5681f6";
-    hash = "sha256-RSjIYtRlgcTUSd9pJApRsvJ+GZZI4AThQdRzFFtM9rg=";
+    rev = "b7c2306320ea05649ebcac3af7ecaa7aa0c77117";
+    hash = "sha256-TjOTfka+ieAVHMjXymVDHlu29z6VoyB/7wYUGSiV/G4=";
   };
 
   cargoHash = "sha256-bXAgp83U48GsTAuki3tsoOK7X+UepKJIlS0bL5qMc8I=";
diff --git a/pkgs/by-name/ta/taplo/package.nix b/pkgs/by-name/ta/taplo/package.nix
index 93ca61d8640e..105b0140ea67 100644
--- a/pkgs/by-name/ta/taplo/package.nix
+++ b/pkgs/by-name/ta/taplo/package.nix
@@ -11,6 +11,7 @@
   # passthru dependencies
   nix-update-script,
   runCommand,
+  makeBinaryWrapper,
   toml-test,
 
   # Optional feature
@@ -67,24 +68,46 @@ rustPlatform.buildRustPackage (finalAttrs: {
           # Some of the failures are reported issues, others may not be.
           # https://github.com/tamasfe/taplo/issues/486
           skips = [
-            "valid/comment/nonascii"
-            "valid/datetime/edge"
-            "valid/key/quoted-unicode"
-            "valid/string/quoted-unicode"
-            "invalid/control/multi-cr"
-            "invalid/control/rawmulti-cr"
+            "invalid/table/append-with-dotted-keys-04"
             "invalid/table/super-twice"
+            "valid/array/array"
+            "valid/comment/everywhere"
+            "valid/comment/nonascii"
+            "valid/datetime/datetime"
+            "valid/datetime/edge"
+            "valid/datetime/leap-year"
+            "valid/datetime/local"
+            "valid/datetime/local-date"
+            "valid/datetime/local-time"
+            "valid/datetime/milliseconds"
+            "valid/datetime/timezone"
+            "valid/example"
+            "valid/key/like-date"
+            "valid/key/numeric-04"
+            "valid/key/quoted-unicode"
+            "valid/spec-1.0.0/local-date-0"
+            "valid/spec-1.0.0/local-date-time-0"
+            "valid/spec-1.0.0/local-time-0"
+            "valid/spec-1.0.0/offset-date-time-0"
+            "valid/spec-1.0.0/offset-date-time-1"
+            "valid/spec-1.0.0/table-7"
+            "valid/spec-example-1"
+            "valid/spec-example-1-compact"
+            "valid/string/quoted-unicode"
           ];
         in
         runCommand "taplo-toml-test"
           {
             nativeBuildInputs = [
-              finalAttrs.finalPackage
+              makeBinaryWrapper
               toml-test
             ];
           }
           ''
-            toml-test taplo ${lib.concatMapStringsSep " " (a: "-skip ${a}") skips} -- toml-test
+            makeWrapper ${lib.getExe finalAttrs.finalPackage} ./taplo-toml-test --add-flag toml-test
+            toml-test test -decoder=./taplo-toml-test -toml=1.0 ${
+              lib.concatMapStringsSep " " (a: "-skip ${a}") skips
+            }
             touch "$out"
           '';
     };
diff --git a/pkgs/by-name/to/toml-test/package.nix b/pkgs/by-name/to/toml-test/package.nix
index 128822162c26..4bda2ee23bc8 100644
--- a/pkgs/by-name/to/toml-test/package.nix
+++ b/pkgs/by-name/to/toml-test/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "toml-test";
-  version = "1.6.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "toml-lang";
     repo = "toml-test";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jOFkSEDNvvx8svgyYYpAbveQsclMsQRKJ2ocA6ty1Kw=";
+    hash = "sha256-QJ7rK4zdPN8c728fR9r4vXnSk4Y9T/XQJulO7kQaYFE=";
   };
 
-  vendorHash = "sha256-yt5rwpYzO38wEUhcyG4G367Byek20Uz3u+buAazq/5A=";
+  vendorHash = "sha256-aIGcv6qAQC3URQ/WIvg/+nRyrw1N2q5uBVpRH4fwgXk=";
 
   ldflags = [
     "-s"
@@ -26,6 +26,7 @@ buildGoModule (finalAttrs: {
   ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/tu/tuios/package.nix b/pkgs/by-name/tu/tuios/package.nix
index 38c0c2ddd9fe..9592da19d55d 100644
--- a/pkgs/by-name/tu/tuios/package.nix
+++ b/pkgs/by-name/tu/tuios/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tuios";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "Gaurav-Gosain";
     repo = "tuios";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4x5Vqd81/ZFXDpPUnJeOzI2DprAD49saL+aZZMAxI3w=";
+    hash = "sha256-GptP8iw3yqXKJiYv7cJEdNCTib7HAhveFCwMKvfv+3I=";
   };
 
   vendorHash = "sha256-uhqa850dHRHNZLXUMGg9Hb8skEY/5CrGmxSmnBytW/s=";
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index cca36b5a6b22..fc7e8e8a6306 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -2,6 +2,7 @@
   abseil-cpp,
   cmake,
   cmark-gfm,
+  coreutils,
   fetchFromGitHub,
   fetchNpmDeps,
   kdePackages,
@@ -92,10 +93,15 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
     }"
   ];
 
+  postFixup = ''
+    substituteInPlace $out/share/systemd/user/vicinae.service \
+      --replace-fail "/bin/kill" "${lib.getExe' coreutils "kill"}"
+  '';
+
   passthru.updateScript = ./update.sh;
 
   meta = {
-    description = "A focused launcher for your desktop — native, fast, extensible";
+    description = "Native, fast, extensible launcher for the desktop";
     homepage = "https://github.com/vicinaehq/vicinae";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/wa/wayback-x11/package.nix b/pkgs/by-name/wa/wayback-x11/package.nix
index 620bf263357d..9c1fde197636 100644
--- a/pkgs/by-name/wa/wayback-x11/package.nix
+++ b/pkgs/by-name/wa/wayback-x11/package.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayback";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "wayback";
     repo = "wayback";
     tag = "${finalAttrs.version}";
-    hash = "sha256-8pfW1tu7OI6dLSR9iiVuJDdK76fRgpQmesW5wJUVN/0=";
+    hash = "sha256-/H0+zOAdrejHMNRcc94Wjgc4/s/M1rUegPcX+pBQcrY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ze/zed/package.nix b/pkgs/by-name/ze/zed/package.nix
index fc0e86e9647c..aafc8552a318 100644
--- a/pkgs/by-name/ze/zed/package.nix
+++ b/pkgs/by-name/ze/zed/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "brimdata";
-    repo = "zed";
+    repo = "zed-archive";
     rev = "v${version}";
     sha256 = "sha256-NCoeTeOkxkCsj/nRBhMJeEshFuwozOXNJvgp8vyCQDk=";
   };
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index 58e0d57bfb80..7ff464578ee3 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "0.22.4";
+  version = "0.22.6";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-17KYkB5TtD+JYXhLVj09gcvETlpG1yC/U2Ql04Ur57g=";
+    hash = "sha256-6kXdifgRfYWT9/bSyxTekdh2CT+Mqu13oO/cGM1b1qk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-5Yn4aaYo34NnwSnZ5kVPMe0xfkvu9fGk9OHje9q1oLw=";
+  cargoHash = "sha256-OsuHhOQJFcigd57HEinwIvOjIaXv0X7/RjJLbY0D0eA=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/by-name/zx/zxing/java-zxing.sh b/pkgs/by-name/zx/zxing/java-zxing.sh
index bee3ac9e27a6..a5660621ea5e 100644
--- a/pkgs/by-name/zx/zxing/java-zxing.sh
+++ b/pkgs/by-name/zx/zxing/java-zxing.sh
@@ -1,3 +1,3 @@
 #! /bin/sh
 
-@jre@/bin/java -cp @out@/lib/java/core-@version@.jar:@out@/lib/java/javase-@version@.jar "$@"
+@jre@/bin/java -cp @out@/lib/java/javase-@version@-jar-with-dependencies.jar "$@"
diff --git a/pkgs/by-name/zx/zxing/package.nix b/pkgs/by-name/zx/zxing/package.nix
index 937bf41036f3..3e961e814dc3 100644
--- a/pkgs/by-name/zx/zxing/package.nix
+++ b/pkgs/by-name/zx/zxing/package.nix
@@ -1,55 +1,55 @@
 {
   lib,
-  stdenv,
-  fetchurl,
+  maven,
+  fetchFromGitHub,
   jre,
 }:
 
-let
+maven.buildMavenPackage rec {
+  pname = "zxing";
   version = "3.5.4";
 
-  # Maven builds are hard to get right
-  core_jar = fetchurl {
-    url = "https://repo1.maven.org/maven2/com/google/zxing/core/${version}/core-${version}.jar";
-    hash = "sha256-cd5diTQbX89d2J2n9E6E2CXQ4ITN8+x3yaviaw8M6xM=";
+  inherit jre;
+
+  src = fetchFromGitHub {
+    owner = "zxing";
+    repo = "zxing";
+    tag = "zxing-${version}";
+    hash = "sha256-D+ZKfDa406RIaTRhH9yXxgP8EpGe0iQU9CqkOMC4UdE=";
   };
 
-  javase_jar = fetchurl {
-    url = "https://repo1.maven.org/maven2/com/google/zxing/javase/${version}/javase-${version}.jar";
-    hash = "sha256-GWaDH0c9cv93IFeEGasRP2QXqXI0oXENK8zGUPWuDBI=";
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "zxing";
-  inherit version jre;
+  mvnHash = "sha256-wVkWbhi5b/rZ0EF5zlQr2BMVOm5nZ1DhI6SGksZO5Vg=";
 
-  dontUnpack = true;
+  sourceRoot = "${src.name}/javase";
+
+  mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z compile assembly:single";
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p "$out/lib/java" "$out/bin"
-    cp "${core_jar}" "${javase_jar}" "$out/lib/java"
-    substituteAll "${./java-zxing.sh}" "$out/bin/java-zxing"
-    substituteAll "${./zxing-cmdline-runner.sh}" "$out/bin/zxing-cmdline-runner"
-    substituteAll "${./zxing-cmdline-encoder.sh}" "$out/bin/zxing-cmdline-encoder"
-    substituteAll "${./zxing.sh}" "$out/bin/zxing"
-    chmod a+x "$out/bin"/*
-    pushd "$out/lib/java"
-    for i in *.jar; do
-      mv "$i" "''${i#*-}"
+    cp "target/javase-${version}-jar-with-dependencies.jar" "$out/lib/java"
+    for source in "${./java-zxing.sh}" "${./zxing-cmdline-encoder.sh}" "${./zxing-cmdline-runner.sh}" "${./zxing-gui-runner.sh}" "${./zxing.sh}"; do
+        target="''${source#*-}"
+        target="$out/bin/''${target%.sh}"
+        substituteAll "$source" "$target"
+        chmod a+x "$target"
     done
-    popd
 
     runHook postInstall
   '';
 
   meta = {
+    changelog = "https://github.com/zxing/zxing/releases/tag/zxing-${version}";
     description = "1D and 2D code reading library";
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with lib.sourceTypes; [
+      binaryBytecode
+      fromSource
+    ];
     license = lib.licenses.asl20;
+    mainProgram = "zxing";
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
     homepage = "https://github.com/zxing/zxing";
   };
-})
+}
diff --git a/pkgs/by-name/zx/zxing/zxing-cmdline-encoder.sh b/pkgs/by-name/zx/zxing/zxing-cmdline-encoder.sh
index a17ba49cecf0..29795971029b 100644
--- a/pkgs/by-name/zx/zxing/zxing-cmdline-encoder.sh
+++ b/pkgs/by-name/zx/zxing/zxing-cmdline-encoder.sh
@@ -1,3 +1,3 @@
 #! /bin/sh
 
-java-zxing com.google.zxing.client.j2se.CommandLineEncoder "$@"
+@out@/bin/java-zxing com.google.zxing.client.j2se.CommandLineEncoder "$@"
diff --git a/pkgs/by-name/zx/zxing/zxing-cmdline-runner.sh b/pkgs/by-name/zx/zxing/zxing-cmdline-runner.sh
index cb2a25dc03f7..f2ec839e69c1 100644
--- a/pkgs/by-name/zx/zxing/zxing-cmdline-runner.sh
+++ b/pkgs/by-name/zx/zxing/zxing-cmdline-runner.sh
@@ -1,3 +1,3 @@
 #! /bin/sh
 
-java-zxing com.google.zxing.client.j2se.CommandLineRunner "$@"
+@out@/bin/java-zxing com.google.zxing.client.j2se.CommandLineRunner "$@"
diff --git a/pkgs/by-name/zx/zxing/zxing-gui-runner.sh b/pkgs/by-name/zx/zxing/zxing-gui-runner.sh
new file mode 100644
index 000000000000..69b81b5f8991
--- /dev/null
+++ b/pkgs/by-name/zx/zxing/zxing-gui-runner.sh
@@ -0,0 +1,3 @@
+#! /bin/sh
+
+@out@/bin/java-zxing com.google.zxing.client.j2se.GUIRunner "$@"
diff --git a/pkgs/by-name/zx/zxing/zxing.sh b/pkgs/by-name/zx/zxing/zxing.sh
index a38558d87026..f5891cfdd874 100644
--- a/pkgs/by-name/zx/zxing/zxing.sh
+++ b/pkgs/by-name/zx/zxing/zxing.sh
@@ -1,18 +1,21 @@
 #! /bin/sh
 choice="$1";
-shift
+[ "$#" = "0" ] || shift;
 case "$choice" in
     encode | create | write | CommandLineEncoder)
-        zxing-cmdline-encoder "$@";
+        @out@/bin/zxing-cmdline-encoder "$@";
         ;;
     decode | read | run | CommandLineRunner)
-        zxing-cmdline-runner "$@";
+        @out@/bin/zxing-cmdline-runner "$@";
+        ;;
+    gui | GUIRunner)
+        @out@/bin/zxing-gui-runner "$@";
         ;;
     help | usage | --help | --usage | -h)
-        zxing read;
-        zxing write;
+        @out@/bin/zxing read --help;
+        @out@/bin/zxing write --help;
         ;;
     *)
-        zxing read "$choice" "$@"
+        @out@/bin/zxing read "$choice" "$@";
         ;;
 esac
diff --git a/pkgs/development/ocaml-modules/pyml/default.nix b/pkgs/development/ocaml-modules/pyml/default.nix
index 2d63152d9f6b..8f5553ffa59e 100644
--- a/pkgs/development/ocaml-modules/pyml/default.nix
+++ b/pkgs/development/ocaml-modules/pyml/default.nix
@@ -12,10 +12,10 @@ buildDunePackage rec {
   version = "20231101";
 
   src = fetchFromGitHub {
-    owner = "thierry-martinez";
+    owner = "ocamllibs";
     repo = "pyml";
-    rev = version;
-    sha256 = "sha256-0Yy5T/S3Npwt0XJmEsdXGg5AXYi9vV9UG9nMSzz/CEc=";
+    tag = version;
+    hash = "sha256-WPtmj9EEs7P72OXWJg1syIrbLuh7u4V4W4nyozXmSa0=";
   };
 
   buildInputs = [
@@ -38,7 +38,7 @@ buildDunePackage rec {
 
   meta = {
     description = "OCaml bindings for Python";
-    homepage = "https://github.com/thierry-martinez/pyml";
+    homepage = "https://github.com/ocamllibs/pyml";
     license = lib.licenses.bsd2;
   };
 }
diff --git a/pkgs/development/python-modules/ddgs/default.nix b/pkgs/development/python-modules/ddgs/default.nix
index 1ea9935b25e0..8f31b08c6882 100644
--- a/pkgs/development/python-modules/ddgs/default.nix
+++ b/pkgs/development/python-modules/ddgs/default.nix
@@ -7,19 +7,20 @@
   lxml,
   httpx,
   h2,
+  fake-useragent,
   versionCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "ddgs";
-  version = "9.6.1";
+  version = "9.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deedy5";
     repo = "ddgs";
     tag = "v${version}";
-    hash = "sha256-NaOwklHea3TUDa2M23X549IiX5zP87N9qWKkr5PObLY=";
+    hash = "sha256-NNXGvDGynu6QtVqxVr74b/qehQ7qhq1NiVxyuKw2C4w=";
   };
 
   patches = [
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     lxml
     httpx
     h2
+    fake-useragent
   ]
   ++ httpx.optional-dependencies.http2
   ++ httpx.optional-dependencies.socks
diff --git a/pkgs/development/python-modules/ddgs/replace-primp.patch b/pkgs/development/python-modules/ddgs/replace-primp.patch
index b7c5ed81da6c..898ef8c4f3bc 100644
--- a/pkgs/development/python-modules/ddgs/replace-primp.patch
+++ b/pkgs/development/python-modules/ddgs/replace-primp.patch
@@ -1,8 +1,8 @@
 diff --git a/ddgs/base.py b/ddgs/base.py
-index e964511..34d1c4f 100644
+index 11111acc7a..b71ee337d9 100644
 --- a/ddgs/base.py
 +++ b/ddgs/base.py
-@@ -11,7 +11,7 @@ from typing import Any, Generic, Literal, TypeVar
+@@ -9,7 +9,7 @@
  from lxml import html
  from lxml.etree import HTMLParser as LHTMLParser
  
@@ -12,10 +12,10 @@ index e964511..34d1c4f 100644
  
  logger = logging.getLogger(__name__)
 diff --git a/ddgs/cli.py b/ddgs/cli.py
-index d295f77..38adb71 100644
+index 36cf2f373c..7cf0b2f35d 100644
 --- a/ddgs/cli.py
 +++ b/ddgs/cli.py
-@@ -12,11 +12,11 @@ from typing import Any
+@@ -9,11 +9,11 @@
  from urllib.parse import unquote
  
  import click
@@ -23,17 +23,17 @@ index d295f77..38adb71 100644
  
  from . import __version__
  from .ddgs import DDGS
- from .utils import _expand_proxy_tb_alias, json_dumps
+ from .utils import _expand_proxy_tb_alias
 +from .http_client2 import HttpClient2
  
  logger = logging.getLogger(__name__)
  
-@@ -101,7 +101,7 @@ def _sanitize_query(query: str) -> str:
+@@ -103,7 +103,7 @@
  
- def _download_file(url: str, dir_path: str, filename: str, proxy: str | None, verify: bool) -> None:
+ def _download_file(url: str, dir_path: str, filename: str, proxy: str | None, *, verify: bool) -> None:
      try:
 -        resp = primp.Client(proxy=proxy, impersonate="random", impersonate_os="random", timeout=10, verify=verify).get(
 +        resp = HttpClient2(proxy=proxy, timeout=10, verify=verify).get(
-             url
+             url,
          )
          if resp.status_code == 200:
diff --git a/pkgs/development/python-modules/pueblo/default.nix b/pkgs/development/python-modules/pueblo/default.nix
index df2733f43ea7..ced6d1bbd072 100644
--- a/pkgs/development/python-modules/pueblo/default.nix
+++ b/pkgs/development/python-modules/pueblo/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pueblo";
-  version = "0.0.12";
+  version = "0.0.13";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # should work for us as well.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oo2RNJQUVDqxhfBI6h1KCAgsMjDe7ns3F9qD4eKLVic=";
+    hash = "sha256-EewRittG90ZHRklGtXHtEJ83DWzA6f0iKfX87YlmVgY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/temporalio/default.nix b/pkgs/development/python-modules/temporalio/default.nix
index a951ca8144d9..ef363dd64248 100644
--- a/pkgs/development/python-modules/temporalio/default.nix
+++ b/pkgs/development/python-modules/temporalio/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "temporalio";
-  version = "1.20.0";
+  version = "1.21.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     repo = "sdk-python";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-JScwBcVkl5kAxO4zKmt1ab6b1KlhGmPSjr7O0PRu0p8=";
+    hash = "sha256-eOhaT5phQdHpaZB+TefJObAWgrO3vLgFkjH0XZW4rWU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
       src
       cargoRoot
       ;
-    hash = "sha256-vhoXn4Aur4/VSwM2qVxOiWEI5/zAmep9ViQMGLln9PU=";
+    hash = "sha256-d/mrBcItzKCQx27HyZ2q4f9r/XI0oXc+M7Hwfm98csc=";
   };
 
   cargoRoot = "temporalio/bridge";
diff --git a/pkgs/development/python-modules/wassima/default.nix b/pkgs/development/python-modules/wassima/default.nix
index 44e7fbb0ccf3..a4ca9ab252c2 100644
--- a/pkgs/development/python-modules/wassima/default.nix
+++ b/pkgs/development/python-modules/wassima/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "wassima";
-  version = "2.0.2";
+  version = "2.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "wassima";
     tag = version;
-    hash = "sha256-Ro0PWNJDjspEtVgA/Gj3UlqbRDCiqrk9nEqx1ljbvRI=";
+    hash = "sha256-tkA6U0SqzivR4tHPu7BKawlqoYfkBFgt5ZcV9kOMKzI=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index fb83867ce3d2..037df76d0670 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "3.2.2";
+  version = "3.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "yalexs-ble";
     tag = "v${version}";
-    hash = "sha256-p2S+OWUg4zMa3C6YXrtLMmy2O8rywuCiJsSzpf+ItsE=";
+    hash = "sha256-BijvtiMAAP2lA43HFrGCt9qd7W2QBlzjfOCC8hhcu0k=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index dccd73cc2381..fd95125e5332 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.11.3";
+  version = "1.11.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sigma67";
     repo = "ytmusicapi";
     tag = version;
-    hash = "sha256-q0VVoKj0N9dvp57Qah4Aeba/JG29Wp8ptIuHz8AvLeM=";
+    hash = "sha256-BumEdKosAe6A0K6Im8gVNMW89iljlvgbKSEo60/DpYg=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 18c60d717c25..61516c342af2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -73,7 +73,7 @@ let
   # pkgs.tree-sitter.withPlugins (p: [ p.tree-sitter-c p.tree-sitter-java ... ])
   #
   # or for all grammars:
-  # pkgs.tree-sitter.withPlugins (_: allGrammars)
+  # pkgs.tree-sitter.withPlugins (_: pkgs.tree-sitter.allGrammars)
   # which is equivalent to
   # pkgs.tree-sitter.withPlugins (p: builtins.attrValues p)
   withPlugins =
@@ -98,7 +98,7 @@ let
       ) grammars
     );
 
-  allGrammars = builtins.attrValues builtGrammars;
+  allGrammars = lib.filter (p: !(p.meta.broken or false)) (lib.attrValues builtGrammars);
 
 in
 rustPlatform.buildRustPackage (final: {
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 55627971fd80..7337a80fa284 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -612,6 +612,7 @@ let
 
           tests = {
             postgresql = nixosTests.postgresql.postgresql.passthru.override finalAttrs.finalPackage;
+            postgresql-replication = nixosTests.postgresql.postgresql-replication.passthru.override finalAttrs.finalPackage;
             postgresql-tls-client-cert = nixosTests.postgresql.postgresql-tls-client-cert.passthru.override finalAttrs.finalPackage;
             postgresql-wal-receiver = nixosTests.postgresql.postgresql-wal-receiver.passthru.override finalAttrs.finalPackage;
             pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/tools/compression/kzipmix/default.nix b/pkgs/tools/compression/kzipmix/default.nix
index b4b64fd6c412..0e3206c91715 100644
--- a/pkgs/tools/compression/kzipmix/default.nix
+++ b/pkgs/tools/compression/kzipmix/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
   version = "20200115";
 
   src = fetchurl {
-    url = "http://static.jonof.id.au/dl/kenutils/kzipmix-${version}-linux.tar.gz";
-    sha256 = "sha256-ePgye0D6/ED53zx6xffLnYhkjed7SPU4BLOZQr9E3yA=";
+    url = "https://www.jonof.id.au/files/kenutils/kzipmix-${version}-linux.tar.gz";
+    hash = "sha256-ePgye0D6/ED53zx6xffLnYhkjed7SPU4BLOZQr9E3yA=";
   };
 
   installPhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 73e4546da013..033c9e542bed 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -798,6 +798,7 @@ mapAliases {
   keepkey_agent = throw "'keepkey_agent' has been renamed to/replaced by 'keepkey-agent'"; # Converted to throw 2025-10-27
   keydb = throw "'keydb' has been removed as it was broken, vulnerable, and unmaintained upstream"; # Added 2025-11-08
   kgx = throw "'kgx' has been renamed to/replaced by 'gnome-console'"; # Converted to throw 2025-10-27
+  khd = throw "'khd' has been removed as it has been pulled upstream"; # Added 2025-12-18
   khoj = throw "khoj has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-11
   kmplayer = throw "'kmplayer' has been removed, as it is unmaintained upstream"; # Added 2025-08-30
   knot-resolver = warnAlias "'knot-resolver' is currently aliased to 'knot-resolver_5'. This will change with the knot-resolver 6 being declared as stable. Please explicitly use the 'knot-resolver_5' or 'knot-resolver_6' package until then." knot-resolver_5; # Added 2025-11-30
@@ -1205,6 +1206,7 @@ mapAliases {
   nuget-to-nix = throw "nuget-to-nix has been removed as it was deprecated in favor of nuget-to-json. Please use nuget-to-json instead"; # Added 2025-08-28
   nushellFull = throw "'nushellFull' has been renamed to/replaced by 'nushell'"; # Converted to throw 2025-10-27
   o = throw "'o' has been renamed to/replaced by 'orbiton'"; # Converted to throw 2025-10-27
+  oam-tools = throw "'oam-tools' has been become part of amass"; # Added 2025-12-21
   oathToolkit = throw "'oathToolkit' has been renamed to/replaced by 'oath-toolkit'"; # Converted to throw 2025-10-27
   obb = throw "obb has been removed because it has been marked as broken since 2023."; # Added 2025-10-11
   obliv-c = throw "obliv-c has been removed from Nixpkgs, as it has been unmaintained upstream for 4 years and does not build with supported GCC versions"; # Added 2025-08-18