diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2638cfe1ccaa..aac137019f9e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7010,7 +7010,10 @@
     github = "ethancedwards8";
     githubId = 60861925;
     name = "Ethan Carter Edwards";
-    keys = [ { fingerprint = "0E69 0F46 3457 D812 3387  C978 F93D DAFA 26EF 2458"; } ];
+    keys = [
+      { fingerprint = "0E69 0F46 3457 D812 3387  C978 F93D DAFA 26EF 2458"; }
+      { fingerprint = "2E51 F618 39D1 FA94 7A73  00C2 34C0 4305 D581 DBFE"; }
+    ];
   };
   ethercrow = {
     email = "ethercrow@gmail.com";
@@ -25192,8 +25195,8 @@
   yuka = {
     email = "yuka@yuka.dev";
     matrix = "@yuka:yuka.dev";
-    github = "yu-re-ka";
-    githubId = 86169957;
+    github = "yuyuyureka";
+    githubId = 193895068;
     name = "Yureka";
   };
   Yumasi = {
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 339c4bb38c36..cefcb14e1bbb 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -936,15 +936,16 @@ The `sound` options have been largely removed, as they are unnecessary for most
 
 If you set `sound.enable` in your configuration:
   - If you are using Pulseaudio or PipeWire, simply remove that option
-  - If you are not using an external sound server, and want volumes to be persisted across shutdowns, set `hardware.alsa.enablePersistence = true` instead
+  - If you are using ALSA as your only sound system (no sound server), set `hardware.alsa.enable = true` instead
 
 If you set `sound.enableOSSEmulation` in your configuration:
   - Make sure it is still necessary, as very few applications actually use OSS
-  - If necessary, set `boot.kernelModules = [ "snd_pcm_oss" ]`
+  - If necessary, set `hardware.alsa.enableOSSEmulation = true`
 
 If you set `sound.extraConfig` in your configuration:
-  - If you are using another sound server, like Pulseaudio, JACK or PipeWire, migrate your configuration to that
-  - If you are not using an external sound server, set `environment.etc."asound.conf".text = yourExtraConfig` instead
+  - If you are using a sound server, like Pulseaudio, JACK or PipeWire, migrate your configuration to that
+  - If you are using ALSA as your only sound system, check if you can use the new structured ALSA options `hardware.alsa.defaultDevice`, `hardware.alsa.cardAliases`, `hardware.alsa.controls`, etc.
+  - Otherwise, move your configuration directly into `hardware.alsa.config`
 
 If you set `sound.mediaKeys` in your configuration:
   - Preferably switch to handling media keys in your desktop environment/compositor
diff --git a/nixos/modules/i18n/input-method/fcitx5.nix b/nixos/modules/i18n/input-method/fcitx5.nix
index 06b1000c9959..5488b4fa89c6 100644
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@@ -117,9 +117,11 @@ in
     i18n.inputMethod.fcitx5.addons =
       lib.optionals (cfg.quickPhrase != { }) [
         (pkgs.writeTextDir "share/fcitx5/data/QuickPhrase.mb" (
-          lib.mapAttrsToList (
-            name: value: "${name} ${builtins.replaceStrings [ "\\" "\n" ] [ "\\\\" "\\n" ] value}"
-          ) cfg.quickPhrase
+          lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (
+              name: value: "${name} ${builtins.replaceStrings [ "\\" "\n" ] [ "\\\\" "\\n" ] value}"
+            ) cfg.quickPhrase
+          )
         ))
       ]
       ++ lib.optionals (cfg.quickPhraseFiles != { }) [
diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix
index fac0012b666d..a26dc493cdb0 100644
--- a/nixos/modules/services/audio/alsa.nix
+++ b/nixos/modules/services/audio/alsa.nix
@@ -1,27 +1,420 @@
-# ALSA sound support.
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.alsa;
+
+  quote = x: ''"${lib.escape [ "\"" ] x}"'';
+
+  alsactl = lib.getExe' pkgs.alsa-utils "alsactl";
+
+  # Creates a volume control
+  mkControl = name: opts: ''
+    pcm.${name} {
+      type softvol
+      slave.pcm ${quote opts.device}
+      control.name ${quote (if opts.name != null then opts.name else name)}
+      control.card ${quote opts.card}
+      max_dB ${toString opts.maxVolume}
+    }
+  '';
+
+  # modprobe.conf for naming sound cards
+  cardsConfig =
+    let
+      # Reverse the mapping from card name→driver to card driver→name
+      drivers = lib.unique (lib.mapAttrsToList (n: v: v.driver) cfg.cardAliases);
+      options = lib.forEach drivers (
+        drv:
+        let
+          byDriver = lib.filterAttrs (n: v: v.driver == drv);
+          ids = lib.mapAttrs (n: v: v.id) (byDriver cfg.cardAliases);
+        in
+        {
+          driver = drv;
+          names = lib.attrNames ids;
+          ids = lib.attrValues ids;
+        }
+      );
+      toList = x: lib.concatStringsSep "," (map toString x);
+    in
+    lib.forEach options (i: "options ${i.driver} index=${toList i.ids} id=${toList i.names}");
+
+  defaultDeviceVars = {
+    "ALSA_AUDIO_OUT" = cfg.defaultDevice.playback;
+    "ALSA_AUDIO_IN" = cfg.defaultDevice.capture;
+  };
+
+in
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "sound" ] "The option was heavily overloaded and can be removed from most configurations.")
+    (lib.mkRemovedOptionModule [ "sound" "enable" ] ''
+      The option was heavily overloaded and can be removed from most configurations.
+      To specifically configure the user space part of ALSA, see `hardware.alsa`.
+    '')
+    (lib.mkRemovedOptionModule [ "sound" "mediaKeys" ] ''
+      The media keys can be configured with any hotkey daemon (that better
+      integrates with your desktop setup). To continue using the actkbd daemon
+      (which was used up to NixOS 24.05), add these lines to your configuration:
+
+        services.actkbd.enable = true;
+        services.actkbd.bindings = [
+          # Mute
+          { keys = [ 113 ]; events = [ "key" ];
+            command = "''${pkgs.alsa-utils}/bin/amixer -q set Master toggle";
+          }
+          # Volume down
+          { keys = [ 114 ]; events = [ "key" "rep" ];
+            command = "''${pkgs.alsa-utils}/bin/amixer -q set Master 1- unmute";
+          }
+          # Volume up
+          { keys = [ 115 ]; events = [ "key" "rep" ];
+            command = "''${pkgs.alsa-utils}/bin/amixer -q set Master 1+ unmute";
+          }
+          # Mic Mute
+          { keys = [ 190 ]; events = [ "key" ];
+            command = "''${pkgs.alsa-utils}/bin/amixer -q set Capture toggle";
+          }
+        ];
+    '')
+    (lib.mkRenamedOptionModule
+      [ "sound" "enableOSSEmulation" ]
+      [ "hardware" "alsa" "enableOSSEmulation" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "sound" "extraConfig" ]
+      [ "hardware" "alsa" "config" ])
   ];
 
-  options.hardware.alsa.enablePersistence = lib.mkOption {
-    type = lib.types.bool;
-    default = false;
-    description = ''
-      Whether to enable ALSA sound card state saving on shutdown.
-      This is generally not necessary if you're using an external sound server.
-    '';
+  options.hardware.alsa = {
+
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to set up the user space part of the Advanced Linux Sound Architecture (ALSA)
+
+        ::: {.warning}
+        Enable this option only if you want to use ALSA as your main sound system,
+        not if you're using a sound server (e.g. PulseAudio or Pipewire).
+        :::
+      '';
+    };
+
+    enableOSSEmulation = lib.mkEnableOption "the OSS emulation";
+
+    enableRecorder = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to set up a loopback device that continuously records and
+        allows to play back audio from the computer.
+
+        The loopback device is named `pcm.recorder`, audio can be saved
+        by capturing from this device as with any microphone.
+
+        ::: {.note}
+        By default the output is duplicated to the recorder assuming stereo
+        audio, for a more complex layout you have to override the pcm.splitter
+        device using `hardware.alsa.config`.
+        See the generated /etc/asound.conf for its definition.
+        :::
+      '';
+    };
+
+    defaultDevice.playback = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      example = "dmix:CARD=1,DEV=0";
+      description = ''
+        The default playback device.
+        Leave empty to let ALSA pick the default automatically.
+
+        ::: {.note}
+        The device can be changed at runtime by setting the ALSA_AUDIO_OUT
+        environment variables (but only before starting a program).
+        :::
+      '';
+    };
+
+    defaultDevice.capture = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      example = "dsnoop:CARD=0,DEV=2";
+      description = ''
+        The default capture device (i.e. microphone).
+        Leave empty to let ALSA pick the default automatically.
+
+        ::: {.note}
+        The device can be changed at runtime by setting the ALSA_AUDIO_IN
+        environment variables (but only before starting a program).
+        :::
+      '';
+    };
+
+    controls = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule ({
+          options.name = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Name of the control, as it appears in `alsamixer`.
+              If null it will be the same as the softvol device name.
+            '';
+          };
+          options.device = lib.mkOption {
+            type = lib.types.str;
+            default = "default";
+            description = ''
+              Name of the PCM device to control (slave).
+            '';
+          };
+          options.card = lib.mkOption {
+            type = lib.types.str;
+            default = "default";
+            description = ''
+              Name of the PCM card to control (slave).
+            '';
+          };
+          options.maxVolume = lib.mkOption {
+            type = lib.types.float;
+            default = 0.0;
+            description = ''
+              The maximum volume in dB.
+            '';
+          };
+        })
+      );
+      default = {};
+      example = lib.literalExpression ''
+        {
+          firefox = { device = "front"; maxVolume = -25.0; };
+          mpv     = { device = "front"; maxVolume = -25.0; };
+          # and run programs with `env ALSA_AUDIO_OUT=<name>`
+        }
+      '';
+      description = ''
+        Virtual volume controls (softvols) to add to a sound card.
+        These can be used to control the volume of specific applications
+        or a digital output device (HDMI video card).
+      '';
+    };
+
+    cardAliases = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule ({
+          options.driver = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Name of the kernel module that provides the card.
+            '';
+          };
+          options.id = lib.mkOption {
+            type = lib.types.int;
+            default = "default";
+            description = ''
+              The ID of the sound card
+            '';
+          };
+        })
+      );
+      default = { };
+      example = lib.literalExpression ''
+        {
+          soundchip = { driver = "snd_intel_hda"; id = 0; };
+          videocard = { driver = "snd_intel_hda"; id = 1; };
+          usb       = { driver = "snd_usb_audio"; id = 2; };
+        }
+      '';
+      description = ''
+        Assign custom names and reorder the sound cards.
+
+        ::: {.note}
+        You can find the card ids by looking at `/proc/asound/cards`.
+        :::
+      '';
+    };
+
+    deviceAliases = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          hdmi1 = "hw:CARD=videocard,DEV=5";
+          hdmi2 = "hw:CARD=videocard,DEV=6";
+        }
+      '';
+      description = ''
+        Assign custom names to sound cards.
+      '';
+    };
+
+    config = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      example = lib.literalExpression ''
+        # Send audio to a remote host via SSH
+        pcm.remote {
+          @args [ HOSTNAME ]
+          @args.HOSTNAME { type string }
+          type file
+          format raw
+          slave.pcm pcm.null
+          file {
+            @func concat
+            strings [
+              "| ''${lib.getExec pkgs.openssh} -C "
+              $HOSTNAME
+              " aplay -f %f -c %c -r %r -"
+            ]
+          }
+        }
+      '';
+      description = ''
+        The content of the system-wide ALSA configuration (/etc/asound.conf).
+
+        Documentation of the configuration language and examples can be found
+        in the unofficial ALSA wiki: https://alsa.opensrc.org/Asoundrc
+      '';
+    };
+
   };
 
-  config = lib.mkIf config.hardware.alsa.enablePersistence {
-    # ALSA provides a udev rule for restoring volume settings.
-    services.udev.packages = [ pkgs.alsa-utils ];
+  config = lib.mkIf cfg.enable {
 
+    # Disable sound servers enabled by default and,
+    # if the user enabled one manually, cause a conflict.
+    services.pipewire.enable = false;
+    hardware.pulseaudio.enable = false;
+
+    hardware.alsa.config =
+      let
+        conf = [
+          ''
+            pcm.!default fromenv
+
+            # Read the capture and playback device from
+            # the ALSA_AUDIO_IN, ALSA_AUDIO_OUT variables
+            pcm.fromenv {
+              type asym
+              playback.pcm {
+                type plug
+                slave.pcm {
+                  @func getenv
+                  vars [ ALSA_AUDIO_OUT ]
+                  default pcm.sysdefault
+                }
+              }
+              capture.pcm {
+                type plug
+                slave.pcm {
+                  @func getenv
+                  vars [ ALSA_AUDIO_IN ]
+                  default pcm.sysdefault
+                }
+              }
+            }
+          ''
+          (lib.optional cfg.enableRecorder ''
+            pcm.!default "splitter:fromenv,recorder"
+
+            # Send audio to two stereo devices
+            pcm.splitter {
+              @args [ A B ]
+              @args.A.type string
+              @args.B.type string
+              type asym
+              playback.pcm {
+                type plug
+                route_policy "duplicate"
+                slave.pcm {
+                  type multi
+                  slaves.a.pcm $A
+                  slaves.b.pcm $B
+                  slaves.a.channels 2
+                  slaves.b.channels 2
+                  bindings [
+                   { slave a channel 0 }
+                   { slave a channel 1 }
+                   { slave b channel 0 }
+                   { slave b channel 1 }
+                  ]
+                }
+              }
+              capture.pcm $A
+            }
+
+            # Device which records and plays back audio
+            pcm.recorder {
+              type asym
+              capture.pcm {
+                type dsnoop
+                ipc_key 9165218
+                ipc_perm 0666
+                slave.pcm "hw:loopback,1,0"
+                slave.period_size 1024
+                slave.buffer_size 8192
+              }
+              playback.pcm {
+                type dmix
+                ipc_key 6181923
+                ipc_perm 0666
+                slave.pcm "hw:loopback,0,0"
+                slave.period_size 1024
+                slave.buffer_size 8192
+              }
+            }
+          '')
+          (lib.mapAttrsToList mkControl cfg.controls)
+          (lib.mapAttrsToList (n: v: "pcm.${n} ${quote v}") cfg.deviceAliases)
+        ];
+      in
+      lib.mkBefore (lib.concatStringsSep "\n" (lib.flatten conf));
+
+    hardware.alsa.cardAliases = lib.mkIf cfg.enableRecorder {
+      loopback.driver = "snd_aloop";
+      loopback.id = 2;
+    };
+
+    # Set default PCM devices
+    environment.sessionVariables = defaultDeviceVars;
+    systemd.globalEnvironment = defaultDeviceVars;
+
+    environment.etc."asound.conf".text = cfg.config;
+
+    boot.kernelModules =
+      [ ]
+      ++ lib.optionals cfg.enableOSSEmulation [ "snd_pcm_oss" "snd_mixer_oss" ]
+      ++ lib.optionals cfg.enableRecorder [ "snd_aloop" ];
+
+    # Assign names to the sound cards
+    boot.extraModprobeConfig = lib.concatStringsSep "\n" cardsConfig;
+
+    # Provide alsamixer, aplay, arecord, etc.
+    environment.systemPackages = [ pkgs.alsa-utils ];
+
+    # Install udev rules for restoring card settings on boot
+    services.udev.extraRules = ''
+      ACTION=="add", SUBSYSTEM=="sound", KERNEL=="controlC*", KERNELS!="card*", GOTO="alsa_restore_go"
+      GOTO="alsa_restore_end"
+
+      LABEL="alsa_restore_go"
+      TEST!="/etc/alsa/state-daemon.conf", RUN+="${alsactl} restore -gU $attr{device/number}"
+      TEST=="/etc/alsa/state-daemon.conf", RUN+="${alsactl} nrestore -gU $attr{device/number}"
+      LABEL="alsa_restore_end"
+    '';
+
+    # Service to store/restore the sound card settings
     systemd.services.alsa-store = {
       description = "Store Sound Card State";
       wantedBy = [ "multi-user.target" ];
+      restartIfChanged = false;
       unitConfig = {
         RequiresMountsFor = "/var/lib/alsa";
         ConditionVirtualization = "!systemd-nspawn";
@@ -29,10 +422,18 @@
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/alsa";
-        ExecStart = "${pkgs.alsa-utils}/sbin/alsactl restore --ignore";
-        ExecStop = "${pkgs.alsa-utils}/sbin/alsactl store --ignore";
+        StateDirectory = "alsa";
+        # Note: the service should never be restated, otherwise any
+        # setting changed between the last `store` and now will be lost.
+        # To prevent NixOS from starting it in case it has failed we
+        # expand the exit codes considered successful
+        SuccessExitStatus = [ 0 99 ];
+        ExecStart = "${alsactl} restore -gU";
+        ExecStop = "${alsactl} store -gU";
       };
     };
   };
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
diff --git a/nixos/tests/firefox.nix b/nixos/tests/firefox.nix
index 8243defbb9f2..9388af953a35 100644
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@@ -18,37 +18,15 @@ import ./make-test-python.nix ({ lib, pkgs, firefoxPackage, ... }:
         package = firefoxPackage;
       };
 
-      # Create a virtual sound device, with mixing
-      # and all, for recording audio.
-      boot.kernelModules = [ "snd-aloop" ];
-      environment.etc."asound.conf".text = ''
-        pcm.!default {
-          type plug
-          slave.pcm pcm.dmixer
-        }
-        pcm.dmixer {
-          type dmix
-          ipc_key 1
-          slave {
-            pcm "hw:Loopback,0,0"
-            rate 48000
-            periods 128
-            period_time 0
-            period_size 1024
-            buffer_size 8192
-          }
-        }
-        pcm.recorder {
-          type hw
-          card "Loopback"
-          device 1
-          subdevice 0
-        }
-      '';
+      hardware.alsa = {
+        enable = true;
+        enableRecorder = true;
+        defaultDevice.playback = "pcm.recorder";
+      };
 
       systemd.services.audio-recorder = {
         description = "Record NixOS test audio to /tmp/record.wav";
-        script = "${pkgs.alsa-utils}/bin/arecord -D recorder -f S16_LE -r48000 /tmp/record.wav";
+        script = "${pkgs.alsa-utils}/bin/arecord -Drecorder -fS16_LE -r48000 -c2 /tmp/record.wav";
       };
 
     };
diff --git a/pkgs/applications/misc/protonup-qt/default.nix b/pkgs/applications/misc/protonup-qt/default.nix
index 20e51b4897cc..690325519a68 100644
--- a/pkgs/applications/misc/protonup-qt/default.nix
+++ b/pkgs/applications/misc/protonup-qt/default.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "protonup-qt";
-  version = "2.10.2";
+  version = "2.11.1";
   src = fetchurl {
     url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-    hash = "sha256-WWLAA5FryvqwgEQysnE1w2k9Wq4y7yNJ4Drojg1SKYg=";
+    hash = "sha256-xHkeAqveXF8YLFvKHTZtSvINIIoiqhNbwVuKfnaHcQI=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 5f2ad1b74b96..f915812a22a2 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -28,12 +28,20 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontUseImakeConfigure = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    bison
+    imake
+    perl
+    pkg-config
+    tzdata
+    which
+  ];
   buildInputs = [
     bzip2 gfortran libX11 libXmu libXt libXt libjpeg libpng libtiff ncurses
-    pango pcre2 perl readline (texliveSmall.withPackages (ps: with ps; [ inconsolata helvetic ps.texinfo fancyvrb cm-super rsfs ])) xz zlib less texinfo graphviz icu
-    bison imake which blas lapack curl tcl tk jdk tzdata
+    pango pcre2 readline (texliveSmall.withPackages (ps: with ps; [ inconsolata helvetic ps.texinfo fancyvrb cm-super rsfs ])) xz zlib less texinfo graphviz icu
+    which blas lapack curl tcl tk jdk
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa Foundation libobjc libcxx ];
+  strictDeps = true;
 
   patches = [
     ./no-usr-local-search-paths.patch
@@ -75,6 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
       FC="${gfortran}/bin/gfortran" F77="${gfortran}/bin/gfortran"
       JAVA_HOME="${jdk}"
       RANLIB=$(type -p ranlib)
+      CURL_CONFIG="${lib.getExe' (lib.getDev curl) "curl-config"}"
       r_cv_have_curl728=yes
       R_SHELL="${stdenv.shell}"
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/ba/bant/package.nix b/pkgs/by-name/ba/bant/package.nix
index c91652b47cd1..4203ae75d5a5 100644
--- a/pkgs/by-name/ba/bant/package.nix
+++ b/pkgs/by-name/ba/bant/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bant";
-  version = "0.1.9";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-TIVbf5qZNohZAFugi/E7m1Sgekn82/qqtx8jSHo75Js=";
+    hash = "sha256-vqZGHMIs4t1TP+9r2hvtFXN5B5GXZerC18l8gQA9cmQ=";
   };
 
   bazelFlags = [
diff --git a/pkgs/by-name/cl/clangbuildanalyzer/package.nix b/pkgs/by-name/cl/clangbuildanalyzer/package.nix
index e2f3828e393d..10796b45ef8d 100644
--- a/pkgs/by-name/cl/clangbuildanalyzer/package.nix
+++ b/pkgs/by-name/cl/clangbuildanalyzer/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clangbuildanalyzer";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "aras-p";
     repo = "ClangBuildAnalyzer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kmgdk634zM0W0OoRoP/RzepArSipa5bNqdVgdZO9gxo=";
+    hash = "sha256-GIMQZGPFKDrfMqCsA8nR3O8Hzp2jcaZ+yDrPeCxTsIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index 47568f174da6..64673800373e 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -63,13 +63,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cp2k";
-  version = "2024.3";
+  version = "2025.1";
 
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "cp2k";
     rev = "v${version}";
-    hash = "sha256-TeVQ0wVUx6d4knwMi9z3LjQZ4ELE6s1TnvwfFz8jbYk=";
+    hash = "sha256-04AFiEuv+EYubZVoYErQDdr9zipKlF7Gqy8DrUaYUMk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index 8c0209c270ff..426803998623 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "0.30.3";
+  version = "0.30.5";
   executables = "dotnet-csharpier";
 
-  nugetHash = "sha256-W+O6zrHkRru/s0MT0SGa58PlPHgFE4wxtqZj2GJDRos=";
+  nugetHash = "sha256-8NuhwRhvEZtmPtgbLLNbTOLUoDAihtkKE8aw5UQ0O5A=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 7d3c6ddf0452..7fc8848217d2 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.15.2";
+  version = "4.15.3";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     rev = "v${version}";
-    hash = "sha256-/bYu/zOwWTgLx7vexp/V8+llaVoioQLiQdSHV9w5Qug=";
+    hash = "sha256-0vg3y/bUp5BTFhJbIdohvuj1DNu9bykDwMM3bWnKvNU=";
   };
 
-  vendorHash = "sha256-lfefR0NjeQEYIl1GyjzfsNJgdDGO/ULZtIhleL3CyC8=";
+  vendorHash = "sha256-JMi4FDgZT94KyqDR57xgp1vnP7Htdn/bksntbQdGyZ0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
new file mode 100644
index 000000000000..1d96209ed89d
--- /dev/null
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "filebeat";
+  version = "8.16.1";
+
+  src = fetchFromGitHub {
+    owner = "elastic";
+    repo = "beats";
+    tag = "v${version}";
+    hash = "sha256-suzubh5aILiuRe8/wb52fnSujGNhGRXBxE8jv1WDzNc=";
+  };
+
+  vendorHash = "sha256-wspQImG/cxWglwojweuH+h5abTSrtcK6F8cpBeCDH/U=";
+
+  subPackages = [ "filebeat" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = [ "version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tails and ships log files";
+    homepage = "https://github.com/elastic/beats";
+    changelog = "https://www.elastic.co/guide/en/beats/libbeat/${version}/release-notes-${version}.html";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ srhb ];
+    mainProgram = "filebeat";
+  };
+}
diff --git a/pkgs/by-name/ha/hashes/package.nix b/pkgs/by-name/ha/hashes/package.nix
index 3f2ab7034bb3..8eb8f3177509 100644
--- a/pkgs/by-name/ha/hashes/package.nix
+++ b/pkgs/by-name/ha/hashes/package.nix
@@ -21,7 +21,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hashes";
-  version = "1.1.0";
+  version = "1.1.1";
 
   pyproject = false;
 
@@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {
     owner = "zefr0x";
     repo = "hashes";
     tag = "v${version}";
-    hash = "sha256-BmfSCHs+JcpsAG8AhaYf+SDFI+LdJKMKgBIodd66qmw=";
+    hash = "sha256-4khMRtKvYQkTwhiqv7FUy/jroGboNTdG1Q6wlTD4cwA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ko/komga/package.nix b/pkgs/by-name/ko/komga/package.nix
index 38764f7e8612..af3701444243 100644
--- a/pkgs/by-name/ko/komga/package.nix
+++ b/pkgs/by-name/ko/komga/package.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-Gv0AaW3aTjLjNAzC5FJMVfvZyIN23ezPpRk15OYyKKs=";
+    sha256 = "sha256-6q7ZtTdbH2nIPIm6gNQZz2QxHlbWULsflhWJ0aDMFH4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/morewaita-icon-theme/package.nix b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
index c556fe84d0de..47c0fb73fbd4 100644
--- a/pkgs/by-name/mo/morewaita-icon-theme/package.nix
+++ b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "morewaita-icon-theme";
-  version = "47.2";
+  version = "47.3";
 
   src = fetchFromGitHub {
     owner = "somepaulo";
     repo = "MoreWaita";
     tag = "v${version}";
-    hash = "sha256-LvkYLY8PYajCb1x1p0HfpKoMq+t4XwH/w9Hvy9YXzk0=";
+    hash = "sha256-ImpBIpNs29JMAeWZTQ93BfWC9JBzu4Y/cuulyzD9Xyg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/my/mysql-workbench/dont-search-for-antlr-jar.patch b/pkgs/by-name/my/mysql-workbench/dont-search-for-antlr-jar.patch
index 80e4a7620173..2d5c3c648372 100644
--- a/pkgs/by-name/my/mysql-workbench/dont-search-for-antlr-jar.patch
+++ b/pkgs/by-name/my/mysql-workbench/dont-search-for-antlr-jar.patch
@@ -6,7 +6,7 @@ index b7320bb..d7169da 100644
  check_function_exists (strtoimax HAVE_STRTOIMAX)
  check_function_exists (strtoumax HAVE_STRTOUMAX)
  
--set(ANTLR_JAR_FILENAME "antlr-4.11.1-complete.jar")
+-set(ANTLR_JAR_FILENAME "antlr-4.13.2-complete.jar")
 -get_filename_component(SOURCE_PARENT_DIR ${CMAKE_SOURCE_DIR} DIRECTORY)
 -set(LINUX_RES_BIN_DIR ${SOURCE_PARENT_DIR}/linux-res/bin)
 -message("WITH_ANTLR_JAR: ${WITH_ANTLR_JAR}")
diff --git a/pkgs/by-name/my/mysql-workbench/package.nix b/pkgs/by-name/my/mysql-workbench/package.nix
index 9828074955f2..d59f60816cea 100644
--- a/pkgs/by-name/my/mysql-workbench/package.nix
+++ b/pkgs/by-name/my/mysql-workbench/package.nix
@@ -21,7 +21,7 @@
   libiodbc,
   proj,
 
-  antlr4_12,
+  antlr4_13,
   gtkmm3,
   libxml2,
   libmysqlconnectorcpp,
@@ -52,11 +52,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-workbench";
-  version = "8.0.38";
+  version = "8.0.40";
 
   src = fetchurl {
     url = "https://cdn.mysql.com/Downloads/MySQLGUITools/mysql-workbench-community-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-W2RsA2hIRUaNRK0Q5pN1YODbEiw6HE3cfeisPdUcYPY=";
+    hash = "sha256-/CrjHgZ3IFFvUB1IxeURme8Z6BoZx0b03MWk8QCe0Sg=";
   };
 
   patches = [
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    antlr4_12.runtime.cpp
+    antlr4_13.runtime.cpp
     gtkmm3
     (libxml2.override { enableHttp = true; })
     libmysqlconnectorcpp
@@ -141,7 +141,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeFeature "MySQL_CONFIG_PATH" (lib.getExe' mysql "mysql_config"))
     (lib.cmakeFeature "IODBC_CONFIG_PATH" (lib.getExe' libiodbc "iodbc-config"))
-    (lib.cmakeFeature "ANTLR_JAR_PATH" "${antlr4_12.jarLocation}")
+    (lib.cmakeFeature "ANTLR_JAR_PATH" "${antlr4_13.jarLocation}")
     # mysql-workbench 8.0.21 depends on libmysqlconnectorcpp 1.1.8.
     # Newer versions of connector still provide the legacy library when enabled
     # but the headers are in a different location.
diff --git a/pkgs/by-name/no/notion-app/info.json b/pkgs/by-name/no/notion-app/info.json
new file mode 100644
index 000000000000..20ea51f293f2
--- /dev/null
+++ b/pkgs/by-name/no/notion-app/info.json
@@ -0,0 +1,12 @@
+{
+  "x86_64-darwin": {
+    "version": "4.2.0",
+    "url": "https://desktop-release.notion-static.com/Notion-4.2.0.zip",
+    "hash": "sha512-FLptPNEtS9fTevSeGC00hDtpgSks+8JtEKRTtWlYPtI0vpA1KqixBdv2OaNSK1W7Krlsl25RpTOl8cJdQxcv4Q=="
+  },
+  "aarch64-darwin": {
+    "version": "4.2.0",
+    "url": "https://desktop-release.notion-static.com/Notion-arm64-4.2.0.zip",
+    "hash": "sha512-cxfO3Bm7ZzAQMi0Pdwd3nvQlRPjn4w7j0ojYUCcn660YsBtoVkpNhiuqg9pbWzY0Umh+/8Zig9CGXKjjP94Iww=="
+  }
+}
diff --git a/pkgs/by-name/no/notion-app/package.nix b/pkgs/by-name/no/notion-app/package.nix
new file mode 100644
index 000000000000..544d6454528e
--- /dev/null
+++ b/pkgs/by-name/no/notion-app/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+}:
+let
+  info =
+    (builtins.fromJSON (builtins.readFile ./info.json))."${stdenvNoCC.targetPlatform.system}"
+      or (throw "notion-app: unsupported system ${stdenvNoCC.targetPlatform.system}");
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "notion-app";
+  version = info.version;
+
+  src = fetchurl { inherit (info) url hash; };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ unzip ];
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    mv Notion.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update/update.mjs;
+
+  meta = {
+    description = "App to write, plan, collaborate, and get organised";
+    homepage = "https://www.notion.so/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    platforms = [
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/no/notion-app/update/jsconfig.json b/pkgs/by-name/no/notion-app/update/jsconfig.json
new file mode 100644
index 000000000000..347a07fb3e23
--- /dev/null
+++ b/pkgs/by-name/no/notion-app/update/jsconfig.json
@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "module": "NodeNext",
+    "noEmit": true,
+    "strict": true
+  }
+}
diff --git a/pkgs/by-name/no/notion-app/update/update.mjs b/pkgs/by-name/no/notion-app/update/update.mjs
new file mode 100755
index 000000000000..d17e5d38bf9e
--- /dev/null
+++ b/pkgs/by-name/no/notion-app/update/update.mjs
@@ -0,0 +1,88 @@
+#!/usr/bin/env nix-shell
+/*
+#!nix-shell -i node --pure --packages cacert nodejs yq-go
+*/
+import * as assert from "node:assert/strict";
+import * as child_process from "node:child_process";
+import * as fsPromises from "node:fs/promises";
+import * as path from "node:path";
+
+const __dirname = import.meta.dirname;
+
+/** @typedef {{
+  version: string;
+  path: `${string}.zip`;
+  sha512: string;
+  releaseDate: string;
+  files: Array<{ url: string; sha512: string; size: number }>;
+}} LiveCheckInfo */
+
+/** @typedef {{
+  version: string;
+  url: string;
+  hash: `sha512-${string}`;
+}} Info */
+
+/** @typedef {{
+  "x86_64-darwin": Info;
+  "aarch64-darwin": Info;
+}} InfoMap */
+
+const BASE_URL = "https://desktop-release.notion-static.com/";
+/**
+ *
+ * @param {"latest-mac.yml" | "arm64-mac.yml"} liveCheckFile
+ * @returns {Promise<Info>}
+ */
+async function getInfo(liveCheckFile) {
+  const url = /** @type {const} */ (`${BASE_URL}${liveCheckFile}`);
+  const response = await fetch(url);
+  assert.ok(response.ok, `Failed to fetch ${url}`);
+  /** @type {LiveCheckInfo} */
+  const { version, path, sha512 } = JSON.parse(
+    child_process
+      .execSync(`yq eval --output-format=json`, {
+        input: Buffer.from(await response.arrayBuffer()),
+      })
+      .toString()
+  );
+  assert.ok(version, "version is required");
+  assert.ok(path, "path is required");
+  assert.ok(sha512, "sha512 is required");
+  return {
+    version,
+    url: BASE_URL + path,
+    hash: `sha512-${sha512}`,
+  };
+}
+
+async function main() {
+  const filePath = path.join(__dirname, "../info.json");
+  /** @type {InfoMap} */
+  const oldInfo = JSON.parse(
+    await fsPromises.readFile(filePath, { encoding: "utf-8" })
+  );
+  /** @type {InfoMap} */
+  const info = {
+    "x86_64-darwin": await getInfo("latest-mac.yml"),
+    "aarch64-darwin": await getInfo("arm64-mac.yml"),
+  };
+  if (JSON.stringify(oldInfo) === JSON.stringify(info)) {
+    console.log("[update] No updates found");
+    return;
+  }
+  const platforms = /** @type {const} */ (["x86_64-darwin", "aarch64-darwin"]);
+  for (const platform of platforms) {
+    console.log(
+      `[update] Updating Notion ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`
+    );
+  }
+  await fsPromises.writeFile(
+    filePath,
+    JSON.stringify(info, null, 2) + "\n",
+    "utf-8"
+  );
+  console.log("[update] Updating Notion complete");
+}
+
+main();
diff --git a/pkgs/by-name/oq/oqs-provider/package.nix b/pkgs/by-name/oq/oqs-provider/package.nix
index a8de09f5b5b8..09fd6c0444b3 100644
--- a/pkgs/by-name/oq/oqs-provider/package.nix
+++ b/pkgs/by-name/oq/oqs-provider/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   name = "oqs-provider";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "open-quantum-safe";
     repo = "oqs-provider";
     rev = finalAttrs.version;
-    hash = "sha256-v7YIE5uzBvQHfi2hqkkRrW0F3K4haZyuoKHxAtRqQDA=";
+    hash = "sha256-P3UEiWYchHVQ5s3JXHOzaDaN09K62pMYjnrW/gS5x/I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/posy-cursors/package.nix b/pkgs/by-name/po/posy-cursors/package.nix
index 3e1e4ce8c2c7..1b1a384b71c6 100644
--- a/pkgs/by-name/po/posy-cursors/package.nix
+++ b/pkgs/by-name/po/posy-cursors/package.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation rec {
     description = "Posy's Improved Cursors for Linux";
     homepage = "https://github.com/simtrami/posy-improved-cursor-linux";
     platforms = platforms.unix;
-    license = licenses.unfree;
+    license = licenses.cc-by-nc-40;
     maintainers = with maintainers; [ mkez ];
   };
 }
diff --git a/pkgs/by-name/qu/quickemu/package.nix b/pkgs/by-name/qu/quickemu/package.nix
index cfd3838c9c51..e57c6a28dbf7 100644
--- a/pkgs/by-name/qu/quickemu/package.nix
+++ b/pkgs/by-name/qu/quickemu/package.nix
@@ -13,7 +13,7 @@
   pciutils,
   procps,
   python3,
-  qemu_full,
+  qemu,
   socat,
   spice-gtk,
   swtpm,
@@ -40,7 +40,7 @@ let
       pciutils
       procps
       python3
-      qemu_full
+      (qemu.override { smbdSupport = true; })
       socat
       swtpm
       util-linux
diff --git a/pkgs/by-name/se/senpai/package.nix b/pkgs/by-name/se/senpai/package.nix
index d11d21315d20..f85eef1eaa70 100644
--- a/pkgs/by-name/se/senpai/package.nix
+++ b/pkgs/by-name/se/senpai/package.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Your everyday IRC student";
     mainProgram = "senpai";
-    homepage = "https://sr.ht/~taiite/senpai/";
+    homepage = "https://sr.ht/~delthas/senpai/";
     changelog = "https://git.sr.ht/~delthas/senpai/refs/v${version}";
     license = licenses.isc;
     maintainers = with maintainers; [ malte-v ];
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index c0c823371cc7..d6f6b85e4361 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.63.10";
+  version = "2.63.11";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LGikCupqzUZ2CG63c8aEeJHX+8nNMUaaYzAGQC+YHqM=";
+    hash = "sha256-3Z8LML2BTHAaNEg65YqYg0HyLNG1HwHpztGfSY1VGyw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ts/tsukimi/package.nix b/pkgs/by-name/ts/tsukimi/package.nix
index 24439218b890..5934eb4d7b62 100644
--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -15,18 +15,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tsukimi";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "tsukinaha";
     repo = "tsukimi";
-    rev = "v${version}";
-    hash = "sha256-JHB1D94ymVjP3PEHZ4fTT4c6VOEkFgSdpanzs1AzJUc=";
+    tag = "v${version}";
+    hash = "sha256-S4+mhFgBNSl2h8dk0izNyCw9//u3CaLGd/shCSWmN3M=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Gh9CPQ73+EpwZTixgQpV4rSwZnedVHQwZRlLQXr8EUo=";
+  cargoHash = "sha256-zVzDpZRni/0AyGE5ahBH7hm8Ovyt+Fn6x1NOHkyI0v8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/us/usbkvm/package.nix b/pkgs/by-name/us/usbkvm/package.nix
index 19547c8fcacf..f24a2d707a04 100644
--- a/pkgs/by-name/us/usbkvm/package.nix
+++ b/pkgs/by-name/us/usbkvm/package.nix
@@ -11,15 +11,16 @@
   pkg-config,
   python3,
   stdenv,
+  udev,
   wrapGAppsHook3,
 }:
 
 let
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchzip {
     url = "https://github.com/carrotIndustries/usbkvm/releases/download/v${version}/usbkvm-v${version}.tar.gz";
-    sha256 = "sha256-OuZ7+IjsvK7/PaiTRwssaQFJDFWJ8HX+kqV13CUyTZA=";
+    sha256 = "sha256-ng6YpaN7sKEBPJcJAm0kcYtT++orweWRx6uOZFnOGG8=";
   };
 
   ms-tools-lib = buildGoModule {
@@ -51,6 +52,7 @@ stdenv.mkDerivation {
     ninja
     makeWrapper
     wrapGAppsHook3
+    udev
   ];
 
   buildInputs = [
@@ -71,6 +73,11 @@ stdenv.mkDerivation {
       --replace-fail "@MSLIB_H_PRECOMPILED@" "${ms-tools-lib}/mslib.h"
   '';
 
+  # Install udev rules in this package's out path:
+  mesonFlags = [
+    "-Dudevrulesdir=lib/udev/rules.d"
+  ];
+
   postFixup =
     let
       GST_PLUGIN_PATH = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
@@ -83,11 +90,6 @@ stdenv.mkDerivation {
         --prefix GST_PLUGIN_PATH : "${GST_PLUGIN_PATH}"
     '';
 
-  postInstall = ''
-    mkdir -p $out/lib/udev/rules.d/
-    cp ../70-usbkvm.rules $out/lib/udev/rules.d/
-  '';
-
   meta = {
     homepage = "https://github.com/carrotIndustries/usbkvm";
     description = "An open-source USB KVM (Keyboard, Video and Mouse) adapter";
diff --git a/pkgs/by-name/wa/walker/package.nix b/pkgs/by-name/wa/walker/package.nix
index c6a416788e50..a1e9087b70bf 100644
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   pkg-config,
+  vips,
   gobject-introspection,
   wrapGAppsHook4,
   gtk4,
@@ -12,16 +13,16 @@
 
 buildGoModule rec {
   pname = "walker";
-  version = "0.9.0";
+  version = "0.11.16";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${version}";
-    hash = "sha256-nYC6KoLsmMf6uJ74Y2zvDU5wdgeOU9aZb/4zGlnWOJM=";
+    hash = "sha256-9cZ+cJcBiZA0HU8YU7+DmOPmbeFtuiqmyBEosVxCADQ=";
   };
 
-  vendorHash = "sha256-nc/WKBhUxhs1aNUg/GM7vhrKd7FrUdl2uKp7MX2VCdE=";
+  vendorHash = "sha256-urAtl2aSuNw7UVnuacSACUE8PCwAsrRQbuMb7xItjao=";
   subPackages = [ "cmd/walker.go" ];
 
   passthru.updateScript = nix-update-script { };
@@ -34,6 +35,7 @@ buildGoModule rec {
 
   buildInputs = [
     gtk4
+    vips
     gtk4-layer-shell
   ];
 
diff --git a/pkgs/by-name/xr/xrizer/package.nix b/pkgs/by-name/xr/xrizer/package.nix
new file mode 100644
index 000000000000..b37e42f483fc
--- /dev/null
+++ b/pkgs/by-name/xr/xrizer/package.nix
@@ -0,0 +1,60 @@
+{
+  fetchFromGitHub,
+  lib,
+  libxkbcommon,
+  nix-update-script,
+  openxr-loader,
+  pkg-config,
+  rustPlatform,
+  shaderc,
+  vulkan-loader,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "xrizer";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "Supreeeme";
+    repo = "xrizer";
+    tag = "v${version}";
+    hash = "sha256-0szkc/EURm4N0gl+tSFhLeQTYPX7ZgBHXwpP11Ju8Ng=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-xyiEKPnko9mpEsUfl7wuAAsobRTwBHhZuKuU/HP4Ujs=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    shaderc
+  ];
+
+  buildInputs = [
+    libxkbcommon
+    vulkan-loader
+    openxr-loader
+  ];
+
+  postPatch = ''
+    substituteInPlace Cargo.toml \
+      --replace-fail 'features = ["static"]' 'features = ["linked"]'
+  '';
+
+  postInstall = ''
+    mkdir -p $out/lib/xrizer/bin/linux64
+    ln -s "$out/lib/libxrizer.so" "$out/lib/xrizer/bin/linux64/vrclient.so"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "XR-ize your favorite OpenVR games";
+    homepage = "https://github.com/Supreeeme/xrizer";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ Scrumplex ];
+    # TODO: support more systems
+    # To do so, we need to map systems to the format openvr expects.
+    # i.e. x86_64-linux -> linux64, aarch64-linux -> linuxarm64
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/compilers/scala/2.x.nix b/pkgs/development/compilers/scala/2.x.nix
index 0ed9ccb5cc01..793535c27d39 100644
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@@ -21,25 +21,25 @@ let
   versionMap = {
     "2.10" = {
       version = "2.10.7";
-      sha256 = "koMRmRb2u3cU4HaihAzPItWIGbNVIo7RWRrm92kp8RE=";
+      hash = "sha256-koMRmRb2u3cU4HaihAzPItWIGbNVIo7RWRrm92kp8RE=";
       pname = "scala_2_10";
     };
 
     "2.11" = {
       version = "2.11.12";
-      sha256 = "sR19M2mcpPYLw7K2hY/ZU+PeK4UiyUP0zaS2dDFhlqg=";
+      hash = "sha256-sR19M2mcpPYLw7K2hY/ZU+PeK4UiyUP0zaS2dDFhlqg=";
       pname = "scala_2_11";
     };
 
     "2.12" = {
       version = "2.12.18";
-      sha256 = "naIJCET+YPrbXln39F9aU3DBdnjcn7PYMmhDxETOA5g=";
+      hash = "sha256-naIJCET+YPrbXln39F9aU3DBdnjcn7PYMmhDxETOA5g=";
       pname = "scala_2_12";
     };
 
     "2.13" = {
-      version = "2.13.12";
-      sha256 = "r+fm+1njyIRX6Z9wGHMOUvuifI0V49cVT3KWggbKhxk=";
+      version = "2.13.15";
+      hash = "sha256-jXIZ0q2IHIHPdwmp5JU05s4S0Bft4Uc+r9Hpuyh8ObE=";
       pname = "scala_2_13";
     };
   };
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   name = "scala-${version}";
 
   src = fetchurl {
-    inherit sha256;
+    inherit hash;
     url = "https://www.scala-lang.org/files/archive/scala-${version}.tgz";
   };
 
diff --git a/pkgs/development/coq-modules/smtcoq/default.nix b/pkgs/development/coq-modules/smtcoq/default.nix
index a459fa19938c..10651b47a179 100644
--- a/pkgs/development/coq-modules/smtcoq/default.nix
+++ b/pkgs/development/coq-modules/smtcoq/default.nix
@@ -11,16 +11,17 @@
   version ? null,
 }:
 
-let
-  # version of veriT that works with SMTCoq
-  veriT' = veriT.overrideAttrs (oA: {
-    src = fetchurl {
-      url = "https://www.lri.fr/~keller/Documents-recherche/Smtcoq/veriT9f48a98.tar.gz";
-      sha256 = "sha256-Pe46PxQVHWwWwx5Ei4Bl95A0otCiXZuUZ2nXuZPYnhY=";
-    };
-    meta.broken = false;
-  });
-in
+# Broken since https://github.com/NixOS/nixpkgs/pull/354627, temporarily disactivated
+# let
+#   # version of veriT that works with SMTCoq
+#   veriT' = veriT.overrideAttrs (oA: {
+#     src = fetchurl {
+#       url = "https://www.lri.fr/~keller/Documents-recherche/Smtcoq/veriT9f48a98.tar.gz";
+#       sha256 = "sha256-Pe46PxQVHWwWwx5Ei4Bl95A0otCiXZuUZ2nXuZPYnhY=";
+#     };
+#     meta.broken = false;
+#   });
+# in
 
 mkCoqDerivation {
   pname = "smtcoq";
@@ -79,7 +80,7 @@ mkCoqDerivation {
   propagatedBuildInputs =
     [
       cvc5
-      veriT'
+      # veriT'  # c.f. comment above
       zchaff
       stdlib
     ]
diff --git a/pkgs/development/libraries/botan/botan3-macos.patch b/pkgs/development/libraries/botan/botan3-macos.patch
deleted file mode 100644
index 4fde08c32d3f..000000000000
--- a/pkgs/development/libraries/botan/botan3-macos.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/src/lib/prov/commoncrypto/commoncrypto_block.cpp b/src/lib/prov/commoncrypto/commoncrypto_block.cpp
-index a07fe118d..f059ee497 100644
---- a/src/lib/prov/commoncrypto/commoncrypto_block.cpp
-+++ b/src/lib/prov/commoncrypto/commoncrypto_block.cpp
-@@ -11,6 +11,7 @@
- #include <botan/hex.h>
- #include <botan/internal/commoncrypto_utils.h>
- 
-+#include <CommonCrypto/CommonCryptoError.h>
- #include <CommonCrypto/CommonCrypto.h>
- 
- namespace Botan {
-diff --git a/src/lib/prov/commoncrypto/commoncrypto_hash.cpp b/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
-index 1fb79c419..faf9575c2 100644
---- a/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
-+++ b/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
-@@ -11,6 +11,7 @@
- #include <botan/internal/stl_util.h>
- #include <unordered_map>
- 
-+#include <CommonCrypto/CommonCryptoError.h>
- #include <CommonCrypto/CommonCrypto.h>
- 
- namespace Botan {
-diff --git a/src/lib/prov/commoncrypto/commoncrypto_utils.h b/src/lib/prov/commoncrypto/commoncrypto_utils.h
-index b1c7411fd..9becab2d1 100644
---- a/src/lib/prov/commoncrypto/commoncrypto_utils.h
-+++ b/src/lib/prov/commoncrypto/commoncrypto_utils.h
-@@ -10,6 +10,7 @@
- 
- #include <botan/sym_algo.h>
- 
-+#include <CommonCrypto/CommonCryptoError.h>
- #include <CommonCrypto/CommonCrypto.h>
- 
- namespace Botan {
-diff --git a/src/lib/rng/system_rng/system_rng.cpp b/src/lib/rng/system_rng/system_rng.cpp
-index b2f7b4c45..f4933b1e3 100644
---- a/src/lib/rng/system_rng/system_rng.cpp
-+++ b/src/lib/rng/system_rng/system_rng.cpp
-@@ -20,6 +20,7 @@
-    #include <bcrypt.h>
-    #include <windows.h>
- #elif defined(BOTAN_TARGET_OS_HAS_CCRANDOM)
-+   #include <CommonCrypto/CommonCryptoError.h>
-    #include <CommonCrypto/CommonRandom.h>
- #elif defined(BOTAN_TARGET_OS_HAS_ARC4RANDOM)
-    #include <stdlib.h>
diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index a5e72e4f64f0..3de632e7b2be 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -124,8 +124,6 @@ in
   botan3 = common {
     version = "3.6.1";
     hash = "sha256-fLhXXYjSMsdxdHadf54ku0REQWBYWYbuvWbnScuakIk=";
-    # this patch fixes build errors on MacOS with SDK 10.12, recheck to remove this again
-    patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./botan3-macos.patch ];
   };
 
   botan2 = common {
diff --git a/pkgs/development/ocaml-modules/mlx/ocamlmerlin-mlx.nix b/pkgs/development/ocaml-modules/mlx/ocamlmerlin-mlx.nix
new file mode 100644
index 000000000000..18e1d5adee7e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mlx/ocamlmerlin-mlx.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  mlx,
+  buildDunePackage,
+  ppxlib,
+  merlin-lib,
+  cppo,
+  csexp,
+  menhir,
+  odoc,
+}:
+buildDunePackage {
+  pname = "ocamlmerlin-mlx";
+
+  inherit (mlx) version src;
+
+  minimalOCamlVersion = "4.14";
+
+  buildInputs = [
+    ppxlib
+    merlin-lib
+    csexp
+    menhir
+    odoc
+  ];
+
+  nativeBuildInputs = [
+    cppo
+  ];
+
+  meta = {
+    description = "Merlin support for MLX OCaml dialect";
+    homepage = "https://github.com/ocaml-mlx/mlx";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.Denommus ];
+    mainProgram = "ocamlmerlin-mlx";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/odds/default.nix b/pkgs/development/ocaml-modules/odds/default.nix
index 2c2d58978090..058afef3d8aa 100644
--- a/pkgs/development/ocaml-modules/odds/default.nix
+++ b/pkgs/development/ocaml-modules/odds/default.nix
@@ -9,7 +9,7 @@ buildDunePackage rec {
   pname = "odds";
   version = "1.2";
 
-  minimalOcamlVersion = "5.0.0";
+  minimalOCamlVersion = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "raphael-proust";
@@ -18,7 +18,7 @@ buildDunePackage rec {
     hash = "sha256-tPDowkpsJQKCoeuXOb9zPORoudUvkRBZ3OzkH2QE2zg=";
   };
 
-  propagatedBuildInputs = [
+  buildInputs = [
     cmdliner
   ];
 
diff --git a/pkgs/development/octave-modules/matgeom/default.nix b/pkgs/development/octave-modules/matgeom/default.nix
index 243c9b67e4ec..fa12b82f8979 100644
--- a/pkgs/development/octave-modules/matgeom/default.nix
+++ b/pkgs/development/octave-modules/matgeom/default.nix
@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "matgeom";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "12q66dy4ninhki3jslzcamfblcb3cdkfbbzn3a5har1s212lsfiw";
+    sha256 = "sha256-azRPhwMVvydCyojA/rXD2og1tPTL0vii15OveYQF+SA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index f457e46b88d8..04d6e5c95e7b 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.75.0";
+  version = "3.76.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "adafruit_platformdetect";
     inherit version;
-    hash = "sha256-5Awvnzw0tgZhRXVshTOuzerdORJ+5QCH3PDB7pbjCB0=";
+    hash = "sha256-xFoqymbYEs7L7bP0/psCz44SZO7yCbMArm9GfLo25Lg=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/aranet4/default.nix b/pkgs/development/python-modules/aranet4/default.nix
index eb77e983ee22..1e9c679610ff 100644
--- a/pkgs/development/python-modules/aranet4/default.nix
+++ b/pkgs/development/python-modules/aranet4/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aranet4";
-  version = "2.4.0";
+  version = "2.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Anrijs";
     repo = "Aranet4-Python";
     tag = "v${version}";
-    hash = "sha256-PdEOEVHri9bhsRFtSqZIaTJ7perD6nZcYoF2sDrWXqg=";
+    hash = "sha256-IDMWRFxasmZ5pmd36cgss8vV0eVOIzu08dfJHVT+QUQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pynmeagps/default.nix b/pkgs/development/python-modules/pynmeagps/default.nix
index 83aeedff822b..2da61ea55396 100644
--- a/pkgs/development/python-modules/pynmeagps/default.nix
+++ b/pkgs/development/python-modules/pynmeagps/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pynmeagps";
-  version = "1.0.43";
+  version = "1.0.44";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "semuconsulting";
     repo = "pynmeagps";
     tag = "v${version}";
-    hash = "sha256-U5AI6iQiMvlCfL0SMAl0PkwC/orCr57royWvHKvWpAI=";
+    hash = "sha256-AnLQJueJYhoOzTjC1hKyo4UFL//pDyKETvLNA4pKp7A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 4aef55659c6c..f783d15e9623 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1295";
+  version = "3.0.1296";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-mbrOk+aeeVCfNHCMvU9p1/P3X1Z+n8XIsNfKnOOZ0Q4=";
+    hash = "sha256-iTcI/pNCcQamVuDYIjv60KR4CBwBRVwZJ+VAJqR1keM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/haskell/ihaskell/wrapper.nix b/pkgs/development/tools/haskell/ihaskell/wrapper.nix
index 14c9ae409c22..21984b6e8da4 100644
--- a/pkgs/development/tools/haskell/ihaskell/wrapper.nix
+++ b/pkgs/development/tools/haskell/ihaskell/wrapper.nix
@@ -22,7 +22,7 @@ let
   );
   ihaskellSh = writeScriptBin "ihaskell-notebook" ''
     #! ${stdenv.shell}
-    export GHC_PACKAGE_PATH="$(echo ${ihaskellEnv}/lib/*/package.conf.d| tr ' ' ':'):$GHC_PACKAGE_PATH"
+    export GHC_PACKAGE_PATH="$(${ihaskellEnv}/bin/ghc --print-global-package-db):$GHC_PACKAGE_PATH"
     export PATH="${
       lib.makeBinPath ([
         ihaskellEnv
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index c520f9946b80..3d7cd0280b00 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -12,8 +12,8 @@ let
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
-      version = "9.15.2";
-      hash = "sha256-AiMJuzE1kUK2W/qIngQG0u69Ws//ykfmlErPKdnWpms=";
+      version = "9.15.3";
+      hash = "sha256-wdpDcnzLwe1Cr/T9a9tLHpHmWoGObv/1skD78HC6Tq8=";
     };
   };
 
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index a44aec9b2e71..74b201bc133c 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -197,12 +197,12 @@ in rec {
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "2.3.0";
+    version = "3.0.0";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
       rev = "v${version}";
-      sha256 = "IrNDBRopg9lgN5AfeXbhhh+uXiWQD2bjS1sNOgOJsu4=";
+      hash = "sha256-VY4PyaQRwTc6LWhPJg4inrQf5K8+bp0+eqRhR7+Iexk=";
     };
     meta = with lib; {
       homepage = "https://draculatheme.com/tmux";
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index e6c3e7ad0d85..f41c4d1256b9 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.6.68";
-      hash = "sha256-fuPJgbDJ2PLB74fy/WFnhGdTEKJMeNwsbWm6RVM4Jes=";
+      version = "6.6.69";
+      hash = "sha256-ZU0vVea8CCR41Sc+bbM4GOnDsFUpTvBvCEHSHLmWHds=";
     };
     main = {
-      version = "6.12.7";
-      hash = "sha256-sM9XINKBGRcO29o3kEIKM03t/XojG9nYLirQSBii8Y4=";
+      version = "6.12.8";
+      hash = "sha256-rEzSM71ACrBclunnJZ4qaEhPGIKCvyLVpeHgsiDxMu4=";
     };
   };
 
diff --git a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
index 173c3220a6fb..9cca44bf88fe 100644
--- a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
@@ -3,24 +3,27 @@
   fetchFromGitHub,
   buildHomeAssistantComponent,
   aiofiles,
+  nix-update-script,
 }:
 
 buildHomeAssistantComponent rec {
   owner = "hultenvp";
   domain = "solis";
-  version = "3.7.2";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "hultenvp";
     repo = "solis-sensor";
     rev = "v${version}";
-    hash = "sha256-8+KzZCfBYvXO73SrMXLGCUjecxKn49hz0wCXWCUBULU=";
+    hash = "sha256-lExwqJj70iNzjZyTw5udcWx6FB95aqZh7cYtXHWMHK0=";
   };
 
   dependencies = [ aiofiles ];
 
   dontCheckManifest = true; # aiofiles version constraint mismatch
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Home Assistant integration for the SolisCloud PV Monitoring portal via SolisCloud API";
     changelog = "https://github.com/hultenvp/solis-sensor/releases/tag/v${version}";
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index a03fb765df2b..4e73e39a34e5 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.42"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.43"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index f163d711fb33..0360b87c4db2 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 02397587c3a571a685c43226719c77b3194837cd
-  ref: refs/tags/6.4.42
+  revision: 726e819f87e3022dc90232087bf30edb0d149ba5
+  ref: refs/tags/6.4.43
   specs:
-    metasploit-framework (6.4.42)
+    metasploit-framework (6.4.43)
       aarch64
       abbrev
       actionpack (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 1db68949861a..1406fb4aeff0 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metasploit-framework";
-  version = "6.4.42";
+  version = "6.4.43";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     tag = finalAttrs.version;
-    hash = "sha256-PsYA29tEhb++Uo0Mh2sAeAUfy51+x7NGNWrMYkj2rrE=";
+    hash = "sha256-1zUt6nInDUIY97fBJa0dQ/hD4WZ1v5LXYdPQhnYKlYw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 24773344f787..ff54d3f154f1 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -734,12 +734,12 @@
     platforms = [ ];
     source = {
       fetchSubmodules = false;
-      rev = "02397587c3a571a685c43226719c77b3194837cd";
-      sha256 = "1cdfyr465k3a6m3b7ivykp5iy1bq01mqf34daazbz1a4vgdh1iiy";
+      rev = "726e819f87e3022dc90232087bf30edb0d149ba5";
+      sha256 = "134m19v8dl6kc7br5gvmcvhl7y233nnjbhdpywc44397fbm2sdfp";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.42";
+    version = "6.4.43";
   };
   metasploit-model = {
     groups = [ "default" ];
diff --git a/pkgs/tools/text/mdbook-mermaid/default.nix b/pkgs/tools/text/mdbook-mermaid/default.nix
index 5d4ac5ec58a2..4ddd1613df0f 100644
--- a/pkgs/tools/text/mdbook-mermaid/default.nix
+++ b/pkgs/tools/text/mdbook-mermaid/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-mermaid";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-elDKxtGMLka9Ss5CNnzw32ndxTUliNUgPXp7e4KUmBo=";
+    hash = "sha256-hqz2zUdDZjbe3nq4YpL68XJ64qpbjANag9S2uAM5nXg=";
   };
 
-  cargoHash = "sha256-BnbllOsidqDEfKs0pd6AzFjzo51PKm9uFSwmOGTW3ug=";
+  cargoHash = "sha256-KrvrmodsoAvNxjJqdKTXva32dtlKINPGHwfxcK1VDwY=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     CoreServices
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 84d0d4032c01..093a0638c8c7 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1371,6 +1371,8 @@ let
 
     ocamline = callPackage ../development/ocaml-modules/ocamline { };
 
+    ocamlmerlin-mlx = callPackage ../development/ocaml-modules/mlx/ocamlmerlin-mlx.nix { };
+
     ocamlmod = callPackage ../development/tools/ocaml/ocamlmod { };
 
     ocamlnet = callPackage ../development/ocaml-modules/ocamlnet { };