diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 3de5b90203c3..ac6fbac74b90 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml
index 687dc6eaf64e..d9687774da19 100644
--- a/.github/workflows/manual-nixos-v2.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml
index 2eb84dfd327e..d8516fb8de4f 100644
--- a/.github/workflows/manual-nixpkgs-v2.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7279952592cb..86c46e67bb40 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3016,6 +3016,14 @@
     githubId = 727571;
     keys = [ { fingerprint = "AAD4 3B70 A504 9675 CFC8  B101 BAFD 205D 5FA2 B329"; } ];
   };
+  berrij = {
+    email = "jonathan@berrisch.biz";
+    matrix = "@berrij:fairydust.space";
+    name = "Jonathan Berrisch";
+    github = "BerriJ";
+    githubId = 37799358;
+    keys = [ { fingerprint = "42 B6 CC90 6 A91 EA4F 8 A7E 315 B 30 DC 5398 152 C 5310"; } ];
+  };
   berryp = {
     email = "berryphillips@gmail.com";
     github = "berryp";
@@ -9359,6 +9367,12 @@
     githubId = 1379411;
     name = "Georg Haas";
   };
+  haylin = {
+    email = "me@haylinmoore.com";
+    github = "haylinmoore";
+    githubId = 8162992;
+    name = "Haylin Moore";
+  };
   hbjydev = {
     email = "hayden@kuraudo.io";
     github = "hbjydev";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index fbe4cd18cb41..2bc5691d527e 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -145,6 +145,8 @@
 
 - [victorialogs][https://docs.victoriametrics.com/victorialogs/], log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable)
 
+- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable)
+
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
 - [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c46cd9d4b6e4..d062381889fb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1118,6 +1118,7 @@
   ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gobgpd.nix
+  ./services/networking/gokapi.nix
   ./services/networking/gvpe.nix
   ./services/networking/hans.nix
   ./services/networking/harmonia.nix
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index 772375d8947d..73758a7bed9e 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -8,7 +8,7 @@
   services.userborn.enable = lib.mkDefault true;
 
   # Random perl remnants
-  system.disableInstallerTools = lib.mkDefault true;
+  system.tools.nixos-generate-config.enable = lib.mkDefault false;
   programs.less.lessopen = lib.mkDefault null;
   programs.command-not-found.enable = lib.mkDefault false;
   boot.enableContainers = lib.mkDefault false;
@@ -20,9 +20,4 @@
   # Check that the system does not contain a Nix store path that contains the
   # string "perl".
   system.forbiddenDependenciesRegexes = [ "perl" ];
-
-  # Re-add nixos-rebuild to the systemPackages that was removed by the
-  # `system.disableInstallerTools` option.
-  environment.systemPackages = [ pkgs.nixos-rebuild ];
-
 }
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 456bd136d1d9..065ec581ee90 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -520,7 +520,7 @@ in
             elif [[ $compression == zstd ]]; then
               compressionCmd=(zstd --rm)
             fi
-            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c -print0 | xargs -0 -r "''${compressionCmd[@]}" --force --quiet
+            find ${baseDir}/build-logs -ignore_readdir_race -type f -name "*.drv" -mtime +3 -size +0c -print0 | xargs -0 -r "''${compressionCmd[@]}" --force --quiet
           '';
         startAt = "Sun 01:45";
         serviceConfig.Slice = "system-hydra.slice";
diff --git a/nixos/modules/services/misc/jackett.nix b/nixos/modules/services/misc/jackett.nix
index 93f1868ad821..3596ff6543e4 100644
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@@ -86,7 +86,7 @@ in
         ProtectProc = "invisible";
         ProtectSystem = "strict";
         ReadWritePaths = [
-          "${config.users.users.${cfg.user}.home}"
+          cfg.dataDir
         ];
         RemoveIPC = true;
         RestrictAddressFamilies = [
diff --git a/nixos/modules/services/networking/birdwatcher.nix b/nixos/modules/services/networking/birdwatcher.nix
index 3325d454633a..a136b4d08abb 100644
--- a/nixos/modules/services/networking/birdwatcher.nix
+++ b/nixos/modules/services/networking/birdwatcher.nix
@@ -59,7 +59,7 @@ in
           [bird]
           listen = "0.0.0.0:29184"
           config = "/etc/bird/bird.conf"
-          birdc  = "''${pkgs.bird}/bin/birdc"
+          birdc  = "''${pkgs.bird2}/bin/birdc"
           ttl = 5 # time to live (in minutes) for caching of cli output
 
           [parser]
diff --git a/nixos/modules/services/networking/gokapi.nix b/nixos/modules/services/networking/gokapi.nix
new file mode 100644
index 000000000000..d90588b55ba0
--- /dev/null
+++ b/nixos/modules/services/networking/gokapi.nix
@@ -0,0 +1,143 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.gokapi;
+  settingsFormat = pkgs.formats.json { };
+  userSettingsFile = settingsFormat.generate "generated-config.json" cfg.settings;
+in
+{
+  options.services.gokapi = {
+    enable = lib.mkEnableOption "Lightweight selfhosted Firefox Send alternative without public upload";
+
+    mutableSettings = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Allow changes to the program config made by the program to persist between restarts.
+        If disabled all required values must be set using nix, and all changes to config format over application updates must be resolved by user.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "gokapi" { };
+
+    environment = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (lib.types.either lib.types.str lib.types.int);
+        options = {
+          GOKAPI_CONFIG_DIR = lib.mkOption {
+            type = lib.types.str;
+            default = "%S/gokapi/config";
+            description = "Sets the directory for the config file.";
+          };
+          GOKAPI_CONFIG_FILE = lib.mkOption {
+            type = lib.types.str;
+            default = "config.json";
+            description = "Sets the filename for the config file.";
+          };
+          GOKAPI_DATA_DIR = lib.mkOption {
+            type = lib.types.str;
+            default = "%S/gokapi/data";
+            description = "Sets the directory for the data.";
+          };
+          GOKAPI_PORT = lib.mkOption {
+            type = lib.types.port;
+            default = 53842;
+            description = "Sets the port of the service.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Environment variables to be set for the gokapi service. Can use systemd specifiers.
+        For full list see <https://gokapi.readthedocs.io/en/latest/advanced.html#environment-variables>.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = { };
+      };
+      default = { };
+      description = ''
+        Configuration settings for the generated config json file.
+        See <https://gokapi.readthedocs.io/en/latest/advanced.html#config-json> for more information
+      '';
+    };
+    settingsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = ''
+        Path to config file to parse and append to settings.
+        Largely useful for loading secrets from a file not in the nix store. Can use systemd specifiers.
+        See <https://gokapi.readthedocs.io/en/latest/advanced.html#config-json> for more information
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.gokapi = {
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = lib.mapAttrs (_: value: toString value) cfg.environment;
+      unitConfig = {
+        Description = "gokapi service";
+      };
+      serviceConfig = {
+        ExecStartPre =
+          let
+            updateScript = lib.getExe (
+              pkgs.writeShellApplication {
+                name = "merge-config";
+                runtimeInputs = with pkgs; [ jq ];
+                text = ''
+                  echo "Running merge-config"
+                  mutableSettings="$1"
+                  statefulSettingsFile="$2"
+                  settingsFile="$3"
+                  if [[ "$mutableSettings" == true ]]; then
+                    if [[ -f "$statefulSettingsFile" ]]; then
+                      echo "Updating stateful config file"
+                      merged="$(jq -s '.[0] * .[1]' "$statefulSettingsFile" ${userSettingsFile})"
+                      echo "$merged" > "$statefulSettingsFile"
+                    fi
+                  else
+                    echo "Overwriting stateful config file"
+                    mkdir -p "$(dirname "$statefulSettingsFile")"
+                    cat ${userSettingsFile} > "$statefulSettingsFile"
+                  fi
+                  if [ "$settingsFile" != "null" ]; then
+                    echo "Merging settings file into current stateful settings file"
+                    merged="$(jq -s '.[0] * .[1]' "$statefulSettingsFile" "$settingsFile")"
+                    echo "$merged" > "$statefulSettingsFile"
+                  fi
+                '';
+              }
+            );
+          in
+          lib.strings.concatStringsSep " " [
+            updateScript
+            (lib.boolToString cfg.mutableSettings)
+            "${cfg.environment.GOKAPI_CONFIG_DIR}/${cfg.environment.GOKAPI_CONFIG_FILE}"
+            (if (cfg.settingsFile == null) then "null" else cfg.settingsFile)
+          ];
+        ExecStart = lib.getExe cfg.package;
+        RestartSec = 30;
+        DynamicUser = true;
+        PrivateTmp = true;
+        StateDirectory = "gokapi";
+        CacheDirectory = "gokapi";
+        Restart = "on-failure";
+      };
+    };
+  };
+  meta.maintainers = with lib.maintainers; [
+    delliott
+  ];
+}
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 96a5b999d5fc..1db63aa271aa 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -189,7 +189,7 @@ def find_mounted_device(path: str) -> str:
     while not os.path.ismount(path):
         path = os.path.dirname(path)
 
-    devices = [x for x in psutil.disk_partitions(all=True) if x.mountpoint == path]
+    devices = [x for x in psutil.disk_partitions() if x.mountpoint == path]
 
     assert len(devices) == 1
     return devices[0].device
@@ -395,15 +395,16 @@ def main():
             limine_deploy_args = [limine_binary, 'bios-install', device]
 
         if config('partitionIndex'):
-            limine_deploy_args.append(config('partitionIndex'))
+            limine_deploy_args.append(str(config('partitionIndex')))
 
         if config('forceMbr'):
             limine_deploy_args += '--force-mbr'
-            try:
-                subprocess.run(limine_deploy_args)
-            except:
-                raise Exception(
-                    'Failed to deploy BIOS stage 1 Limine bootloader!\n' +
-                    'You might want to try enabling the `boot.loader.limine.forceMbr` option.')
+
+        try:
+            subprocess.run(limine_deploy_args)
+        except:
+            raise Exception(
+                'Failed to deploy BIOS stage 1 Limine bootloader!\n' +
+                'You might want to try enabling the `boot.loader.limine.forceMbr` option.')
 
 main()
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 55c0cbd8ce1a..94656b9fe0b0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -479,6 +479,7 @@ in {
   gobgpd = handleTest ./gobgpd.nix {};
   gocd-agent = handleTest ./gocd-agent.nix {};
   gocd-server = handleTest ./gocd-server.nix {};
+  gokapi = runTest ./gokapi.nix;
   gollum = handleTest ./gollum.nix {};
   gonic = handleTest ./gonic.nix {};
   google-oslogin = handleTest ./google-oslogin {};
@@ -1005,7 +1006,7 @@ in {
   radicle = runTest ./radicle.nix;
   ragnarwm = handleTest ./ragnarwm.nix {};
   rasdaemon = handleTest ./rasdaemon.nix {};
-  rathole = handleTest ./rathole.nix {};
+  rathole = runTest ./rathole.nix;
   readarr = handleTest ./readarr.nix {};
   realm = handleTest ./realm.nix {};
   readeck = runTest ./readeck.nix;
diff --git a/nixos/tests/birdwatcher.nix b/nixos/tests/birdwatcher.nix
index 00b3b6d77af2..f82d0823b9df 100644
--- a/nixos/tests/birdwatcher.nix
+++ b/nixos/tests/birdwatcher.nix
@@ -72,7 +72,7 @@ makeTest {
           [bird]
           listen = "0.0.0.0:29184"
           config = "/etc/bird/bird.conf"
-          birdc  = "${pkgs.bird}/bin/birdc"
+          birdc  = "${pkgs.bird2}/bin/birdc"
           ttl = 5 # time to live (in minutes) for caching of cli output
           [parser]
           filter_fields = []
diff --git a/nixos/tests/gokapi.nix b/nixos/tests/gokapi.nix
new file mode 100644
index 000000000000..585424f6b9f3
--- /dev/null
+++ b/nixos/tests/gokapi.nix
@@ -0,0 +1,22 @@
+{ lib, ... }:
+let
+  port = 6000;
+in
+{
+  name = "gokapi";
+
+  meta.maintainers = with lib.maintainers; [ delliott ];
+
+  nodes.machine = {
+    services.gokapi = {
+      enable = true;
+      environment.GOKAPI_PORT = port;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("gokapi.service")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+}
diff --git a/nixos/tests/rathole.nix b/nixos/tests/rathole.nix
index 56d7a0129f80..a6c11af62888 100644
--- a/nixos/tests/rathole.nix
+++ b/nixos/tests/rathole.nix
@@ -1,43 +1,44 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ lib, ... }:
 
-  let
-    successMessage = "Success 3333115147933743662";
-  in
-  {
-    name = "rathole";
-    meta.maintainers = with lib.maintainers; [ xokdvium ];
-    nodes = {
-      server = {
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-          firewall.enable = false;
-        };
+let
+  successMessage = "Success 3333115147933743662";
+in
+{
+  name = "rathole";
+  meta.maintainers = with lib.maintainers; [ xokdvium ];
+  nodes = {
+    server = {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+      };
 
-        systemd.network.networks."01-eth1" = {
-          name = "eth1";
-          networkConfig.Address = "10.0.0.1/24";
-        };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.1/24";
+      };
 
-        services.rathole = {
-          enable = true;
-          role = "server";
-          settings = {
-            server = {
-              bind_addr = "0.0.0.0:2333";
-              services = {
-                success-message = {
-                  bind_addr = "0.0.0.0:80";
-                  token = "hunter2";
-                };
+      services.rathole = {
+        enable = true;
+        role = "server";
+        settings = {
+          server = {
+            bind_addr = "0.0.0.0:2333";
+            services = {
+              success-message = {
+                bind_addr = "0.0.0.0:80";
+                token = "hunter2";
               };
             };
           };
         };
       };
+    };
 
-      client = {
+    client =
+      { pkgs, ... }:
+      {
         networking = {
           useNetworkd = true;
           useDHCP = false;
@@ -72,18 +73,17 @@ import ./make-test-python.nix (
           };
         };
       };
-    };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("rathole.service")
-      server.wait_for_open_port(2333)
-      client.wait_for_unit("rathole.service")
-      server.wait_for_open_port(80)
-      response = server.succeed("curl http://127.0.0.1/success-message.txt")
-      assert "${successMessage}" in response, "Got invalid response"
-      response = client.succeed("curl http://10.0.0.1/success-message.txt")
-      assert "${successMessage}" in response, "Got invalid response"
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("rathole.service")
+    server.wait_for_open_port(2333)
+    client.wait_for_unit("rathole.service")
+    server.wait_for_open_port(80)
+    response = server.succeed("curl http://127.0.0.1/success-message.txt")
+    assert "${successMessage}" in response, "Got invalid response"
+    response = client.succeed("curl http://10.0.0.1/success-message.txt")
+    assert "${successMessage}" in response, "Got invalid response"
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/default.nix b/pkgs/applications/editors/vim/plugins/default.nix
index 3063c2e696cf..eb7c70db0e5d 100644
--- a/pkgs/applications/editors/vim/plugins/default.nix
+++ b/pkgs/applications/editors/vim/plugins/default.nix
@@ -24,6 +24,11 @@ let
     inherit (neovimUtils) buildNeovimPlugin;
   };
 
+  extras = callPackage ./extras.nix {
+    inherit buildVimPlugin;
+    inherit (neovimUtils) buildNeovimPlugin;
+  };
+
   # TL;DR
   # * Add your plugin to ./vim-plugin-names
   # * run ./update.py
@@ -36,9 +41,11 @@ let
   };
 
   aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: { };
-
-  extensible-self = lib.makeExtensible (
-    extends aliases (extends overrides (extends plugins initialPackages))
-  );
 in
-extensible-self
+lib.pipe initialPackages [
+  (extends plugins)
+  (extends extras)
+  (extends overrides)
+  (extends aliases)
+  lib.makeExtensible
+]
diff --git a/pkgs/applications/editors/vim/plugins/extras.nix b/pkgs/applications/editors/vim/plugins/extras.nix
new file mode 100644
index 000000000000..a5fbf0acb77e
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/extras.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  buildVimPlugin,
+  buildNeovimPlugin,
+  nodePackages,
+  neovim-unwrapped,
+}:
+let
+  luaPackages = neovim-unwrapped.lua.pkgs;
+in
+self: super:
+(
+  let
+    nodePackageNames = [
+      "coc-cmake"
+      "coc-docker"
+      "coc-emmet"
+      "coc-eslint"
+      "coc-explorer"
+      "coc-flutter"
+      "coc-git"
+      "coc-go"
+      "coc-haxe"
+      "coc-highlight"
+      "coc-html"
+      "coc-java"
+      "coc-jest"
+      "coc-json"
+      "coc-lists"
+      "coc-ltex"
+      "coc-markdownlint"
+      "coc-pairs"
+      "coc-prettier"
+      "coc-r-lsp"
+      "coc-rls"
+      "coc-rust-analyzer"
+      "coc-sh"
+      "coc-smartf"
+      "coc-snippets"
+      "coc-solargraph"
+      "coc-spell-checker"
+      "coc-sqlfluff"
+      "coc-stylelint"
+      "coc-sumneko-lua"
+      "coc-tabnine"
+      "coc-texlab"
+      "coc-tsserver"
+      "coc-ultisnips"
+      "coc-vetur"
+      "coc-vimlsp"
+      "coc-vimtex"
+      "coc-wxml"
+      "coc-yaml"
+      "coc-yank"
+    ];
+    nodePackage2VimPackage =
+      name:
+      buildVimPlugin {
+        pname = name;
+        inherit (nodePackages.${name}) version meta;
+        src = "${nodePackages.${name}}/lib/node_modules/${name}";
+      };
+  in
+  lib.genAttrs nodePackageNames nodePackage2VimPackage
+)
+// (
+  let
+    luarocksPackageNames = [
+      "fidget-nvim"
+      "gitsigns-nvim"
+      "image-nvim"
+      "lsp-progress-nvim"
+      "lualine-nvim"
+      "luasnip"
+      "lush-nvim"
+      "lz-n"
+      "lze"
+      "lzextras"
+      "lzn-auto-require"
+      "middleclass"
+      "mini-test"
+      "neorg"
+      "neotest"
+      "nui-nvim"
+      "nvim-cmp"
+      "nvim-nio"
+      "nvim-web-devicons"
+      "oil-nvim"
+      "orgmode"
+      "papis-nvim"
+      "rest-nvim"
+      "rocks-config-nvim"
+      "rtp-nvim"
+      "telescope-manix"
+      "telescope-nvim"
+    ];
+    toVimPackage =
+      name:
+      buildNeovimPlugin {
+        luaAttr = luaPackages.${name};
+      };
+  in
+  lib.genAttrs luarocksPackageNames toVimPackage
+)
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 1a9970e79c48..e567266349b1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -1188,6 +1188,19 @@ final: prev:
     meta.hydraPlatforms = [ ];
   };
 
+  aw-watcher-nvim = buildVimPlugin {
+    pname = "aw-watcher.nvim";
+    version = "2025-03-06";
+    src = fetchFromGitHub {
+      owner = "lowitea";
+      repo = "aw-watcher.nvim";
+      rev = "9030f9b851578fce7cec5fa3d7b54556eb7e270f";
+      sha256 = "0nsmfb508x03n0hvlnhcjzgqwwg8rp8wa2a5r7wz4z1hrs03hscx";
+    };
+    meta.homepage = "https://github.com/lowitea/aw-watcher.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   aw-watcher-vim = buildVimPlugin {
     pname = "aw-watcher-vim";
     version = "2023-10-09";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 129b5c92c00f..a78d1b5c4699 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1281,6 +1281,7 @@ in
     dependencies = [ self.plenary-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   gitsigns-nvim = super.gitsigns-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -1421,6 +1422,7 @@ in
     doInstallCheck = true;
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   image-nvim = super.image-nvim.overrideAttrs {
     dependencies = with self; [
       nvim-treesitter
@@ -1683,6 +1685,7 @@ in
     dependencies = [ self.lualine-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   luasnip = super.luasnip.overrideAttrs {
     dependencies = [ luaPackages.jsregexp ];
   };
@@ -1949,6 +1952,7 @@ in
     ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   neotest = super.neotest.overrideAttrs {
     dependencies = with self; [
       nvim-nio
@@ -2838,6 +2842,7 @@ in
   };
 
   # needs  "http" and "json" treesitter grammars too
+  # NOTE: this overrides a luaPackages-based plugin
   rest-nvim = super.rest-nvim.overrideAttrs {
     dependencies = with self; [
       plenary-nvim
@@ -3225,6 +3230,7 @@ in
     dependencies = [ self.plenary-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   telescope-nvim = super.telescope-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -3988,101 +3994,6 @@ in
     '';
 
   };
-}
-// (
-  let
-    nodePackageNames = [
-      "coc-cmake"
-      "coc-docker"
-      "coc-emmet"
-      "coc-eslint"
-      "coc-explorer"
-      "coc-flutter"
-      "coc-git"
-      "coc-go"
-      "coc-haxe"
-      "coc-highlight"
-      "coc-html"
-      "coc-java"
-      "coc-jest"
-      "coc-json"
-      "coc-lists"
-      "coc-ltex"
-      "coc-markdownlint"
-      "coc-pairs"
-      "coc-prettier"
-      "coc-r-lsp"
-      "coc-rls"
-      "coc-rust-analyzer"
-      "coc-sh"
-      "coc-smartf"
-      "coc-snippets"
-      "coc-solargraph"
-      "coc-spell-checker"
-      "coc-sqlfluff"
-      "coc-stylelint"
-      "coc-sumneko-lua"
-      "coc-tabnine"
-      "coc-texlab"
-      "coc-tsserver"
-      "coc-ultisnips"
-      "coc-vetur"
-      "coc-vimlsp"
-      "coc-vimtex"
-      "coc-wxml"
-      "coc-yaml"
-      "coc-yank"
-    ];
-    nodePackage2VimPackage =
-      name:
-      buildVimPlugin {
-        pname = name;
-        inherit (nodePackages.${name}) version meta;
-        src = "${nodePackages.${name}}/lib/node_modules/${name}";
-      };
-  in
-  lib.genAttrs nodePackageNames nodePackage2VimPackage
-)
-// (
-  let
-    luarocksPackageNames = [
-      "fidget-nvim"
-      "gitsigns-nvim"
-      "image-nvim"
-      "lsp-progress-nvim"
-      "lualine-nvim"
-      "luasnip"
-      "lush-nvim"
-      "lz-n"
-      "lze"
-      "lzextras"
-      "lzn-auto-require"
-      "middleclass"
-      "mini-test"
-      "neorg"
-      "neotest"
-      "nui-nvim"
-      "nvim-cmp"
-      "nvim-nio"
-      "nvim-web-devicons"
-      "oil-nvim"
-      "orgmode"
-      "papis-nvim"
-      "rest-nvim"
-      "rocks-config-nvim"
-      "rtp-nvim"
-      "telescope-manix"
-      "telescope-nvim"
-    ];
-    toVimPackage =
-      name:
-      neovimUtils.buildNeovimPlugin {
-        luaAttr = luaPackages.${name};
-      };
-  in
-  lib.genAttrs luarocksPackageNames toVimPackage
-)
-// {
 
   rocks-nvim =
     (neovimUtils.buildNeovimPlugin {
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index d3b32a942f4a..b5ac5a364d9e 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -91,6 +91,7 @@ https://github.com/gaoDean/autolist.nvim/,,
 https://github.com/vim-scripts/autoload_cscope.vim/,,
 https://github.com/nullishamy/autosave.nvim/,HEAD,
 https://github.com/ActivityWatch/aw-watcher-vim/,HEAD,
+https://github.com/lowitea/aw-watcher.nvim/,HEAD,
 https://github.com/rafi/awesome-vim-colorschemes/,,
 https://github.com/AhmedAbdulrahman/aylin.vim/,,
 https://github.com/ayu-theme/ayu-vim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c6d88d118ab1..676abafbad2d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4407,8 +4407,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.15";
-          hash = "sha256-aW2Ri73xIl/1q/Yoi5qg25fjx7l55QfXAn+M+JuoN+A=";
+          version = "0.8.18";
+          hash = "sha256-BHLFlhcIXm3mvmjDPu3fuzpJIGHQvT/RDBEE/QFoRvU=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
index 3064a4c8978a..60ee4ebf8f62 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "debugpy";
     publisher = "ms-python";
-    version = "2025.4.0";
-    hash = "sha256-WbnR949zHuoW+jR6vugvHussScBvgRIi8PYi9HbJxjc=";
+    version = "2025.4.1";
+    hash = "sha256-PzO5CA/JaLlyMMQ0wOIIvoL116boSOpqtX9plw9IUgQ=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index 2410d8678765..53fa19ff4df0 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-03-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "cfbb0946f79de33bc615d0a079e1a92f1454c3e3";
-    hash = "sha256-47Fap6QjwFwodLaHBa78kKUap2DB8FdaEe6AEv0qyCA=";
+    rev = "9f2b7943db1fb784daf0948b0b493bc7f76919f8";
+    hash = "sha256-fwrfZ0Z/DAtDRuBqxCS11/qNoomAtUgEOf4eOLk9vO0=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
index e648472b14ff..0ba3b4e34175 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-saturn";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-03-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-saturn-libretro";
-    rev = "0a78a9a5ab0088ba19f21e028dda9f4b4d7c9e48";
-    hash = "sha256-WNQhtaYBg7JqPdxcD0cLRjr2pSda6Xmx/WWYzyu5u9c=";
+    rev = "06c9daa7ff6de42955437d29a80d8fc4ececc8d3";
+    hash = "sha256-HTOT4/NmfcVjte61FjkqL9neKVQrH7P4dZjmIC9fy0k=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/bsnes.nix b/pkgs/applications/emulators/libretro/cores/bsnes.nix
index 6c5acb4e0a24..539bcef66f52 100644
--- a/pkgs/applications/emulators/libretro/cores/bsnes.nix
+++ b/pkgs/applications/emulators/libretro/cores/bsnes.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2025-02-28";
+  version = "0-unstable-2025-03-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "cb4a0695ec4eea7298ddc5dd013bb1bb23d5a496";
-    hash = "sha256-13d2quwMBK7ocNWWmbQNJXYj2MxvfGwvpXy2bcCGfMQ=";
+    rev = "ec353ea2502be9b71f3d9830b7a7b66ee69e254c";
+    hash = "sha256-9QRKEIi1JHd503KN9+DKxLMJMJWyNu9vomPAmlbb/zw=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/freeintv.nix b/pkgs/applications/emulators/libretro/cores/freeintv.nix
index 048d09cf1240..c0f4ca005ae0 100644
--- a/pkgs/applications/emulators/libretro/cores/freeintv.nix
+++ b/pkgs/applications/emulators/libretro/cores/freeintv.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "freeintv";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-03-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "freeintv";
-    rev = "beab9af119fc117833d2d866d8d4ea0857ec0236";
-    hash = "sha256-+3hF7OZ2OD8K3OsvzJ3+Nn3DwC7PfD+Mr3Ku2/W/fDQ=";
+    rev = "6efc4b8fd4c7423ec1f5ff1913b854529135b565";
+    hash = "sha256-B5GEzI/U/F0IsppdOx5znu+4LdZOxQLcGAez+oR2PCI=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index 65a2ef73b0fb..c60d72e1d021 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-02-28";
+  version = "0-unstable-2025-03-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "041833eb4b28e349f7690e18d04a5d7f28639bd1";
-    hash = "sha256-wC5wMCd5LDrNZgGTtAvg5asyPK7wlK/+DhUOgqvZvXs=";
+    rev = "4b3edb41d33e52b6d70c4e18bf0819a070991b66";
+    hash = "sha256-8RmNDvUd64FqEgduNMHgbunu92SqMi+Pn//Ou2EQUFs=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index 7372326c2696..ea811e7eece3 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-01-17";
+  version = "0-unstable-2025-03-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "8ea39eefc76bd97331c0da9efbac6ff343704a95";
-    hash = "sha256-BZHZ5aixtivkxI+1Fpo/ziykIQFM27UtF4hLGOrQ4cQ=";
+    rev = "1024afbcd77a7bf7c87972c7c86d3a7759877fc7";
+    hash = "sha256-9Y3uzWpiYIRGTFApVGdLIONpBpPaO1sRgaGj1EVI3M4=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003.nix b/pkgs/applications/emulators/libretro/cores/mame2003.nix
index fb89c507cd04..6ca5c9440db4 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2025-01-26";
+  version = "0-unstable-2025-03-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "290027956a5bfc9e22e3e96fb4b5958968da6b70";
-    hash = "sha256-FlroIr4T5Z4tBPJ32AxDjXdSnQpU9ergDCznP5qvh3Y=";
+    rev = "9c05757528afb96278ececf71454072cd4e57946";
+    hash = "sha256-v4LG52JbekLFPotMpoZyvYYj27I1SL1DEe01GaeMRjk=";
   };
 
   # Fix build with GCC 14
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 3a81df70ff46..e3e816116831 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "Desktop application for creating diagrams";
+    description = "Desktop version of draw.io for creating diagrams";
     homepage = "https://about.draw.io/";
     license = with lib.licenses; [
       # The LICENSE file of https://github.com/jgraph/drawio claims Apache License Version 2.0 again since https://github.com/jgraph/drawio/commit/5b2e73471e4fea83d681f0cec5d1aaf7c3884996
diff --git a/pkgs/applications/graphics/drawio/headless.nix b/pkgs/applications/graphics/drawio/headless.nix
index b7880e791fa6..42dac38fe048 100644
--- a/pkgs/applications/graphics/drawio/headless.nix
+++ b/pkgs/applications/graphics/drawio/headless.nix
@@ -33,7 +33,7 @@ writeTextFile {
   meta = with lib; {
     description = "xvfb wrapper around drawio";
     longDescription = ''
-      A wrapper around drawio for running in headless environments.
+      A wrapper around drawio (draw.io) for running in headless environments.
       Runs drawio under xvfb-run, with configuration going to a temporary
       directory.
     '';
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 0be8f36274a3..75ef7b1a9bf0 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -10,46 +10,11 @@
 
 let
   pname = "1password";
-  version = if channel == "stable" then "8.10.60" else "8.10.68-12.BETA";
 
-  sources = {
-    stable = {
-      x86_64-linux = {
-        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-QCoV66LvGo6vA5fjuE3fG+LwehKVMPmgaDghh9YEvmA=";
-      };
-      aarch64-linux = {
-        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-E5TniXur9ATJ3ER/zTFc6EiBrH/kbNvIao0ADLyBZZE=";
-      };
-      x86_64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-2Nv4CHKLgCFbU1TeJQhIq8YdkJSQJXtUw2S17B8cS4s=";
-      };
-      aarch64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-drJiM8EiUM3M54+KPQdLvAmSfBH5YPqQk14yjHzoBtM=";
-      };
-    };
-    beta = {
-      x86_64-linux = {
-        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-/0Y1qnCI/gXGKTHk9EIaUVbHTwRkOvwOOiMif6sRkqw=";
-      };
-      aarch64-linux = {
-        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-4J6a10r5n8ffqC5Y2pjO/GJLXY5AQDkQWmFNLYeK/Xw=";
-      };
-      x86_64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-XvflRqqUI59ekuSiQXyACzS94VIrl8wJjemi0xAznZU=";
-      };
-      aarch64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-UErp3pcSXz/C5s3JraLoBN89tL8ghgJ3XLpg7KtU8Sc=";
-      };
-    };
-  };
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+  inherit (versions.${channel} or (throw "unknown channel ${channel}")) version;
+
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
 
   src = fetchurl {
     inherit
diff --git a/pkgs/applications/misc/1password-gui/sources.json b/pkgs/applications/misc/1password-gui/sources.json
new file mode 100644
index 000000000000..e6f70a4e3f01
--- /dev/null
+++ b/pkgs/applications/misc/1password-gui/sources.json
@@ -0,0 +1,38 @@
+{
+  "stable": {
+    "x86_64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.60.x64.tar.gz",
+      "hash": "sha256-QCoV66LvGo6vA5fjuE3fG+LwehKVMPmgaDghh9YEvmA="
+    },
+    "aarch64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.60.arm64.tar.gz",
+      "hash": "sha256-E5TniXur9ATJ3ER/zTFc6EiBrH/kbNvIao0ADLyBZZE="
+    },
+    "x86_64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.60-x86_64.zip",
+      "hash": "sha256-2Nv4CHKLgCFbU1TeJQhIq8YdkJSQJXtUw2S17B8cS4s="
+    },
+    "aarch64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.60-aarch64.zip",
+      "hash": "sha256-drJiM8EiUM3M54+KPQdLvAmSfBH5YPqQk14yjHzoBtM="
+    }
+  },
+  "beta": {
+    "x86_64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.68-12.BETA.x64.tar.gz",
+      "hash": "sha256-/0Y1qnCI/gXGKTHk9EIaUVbHTwRkOvwOOiMif6sRkqw="
+    },
+    "aarch64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.68-12.BETA.arm64.tar.gz",
+      "hash": "sha256-4J6a10r5n8ffqC5Y2pjO/GJLXY5AQDkQWmFNLYeK/Xw="
+    },
+    "x86_64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-x86_64.zip",
+      "hash": "sha256-XvflRqqUI59ekuSiQXyACzS94VIrl8wJjemi0xAznZU="
+    },
+    "aarch64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-aarch64.zip",
+      "hash": "sha256-UErp3pcSXz/C5s3JraLoBN89tL8ghgJ3XLpg7KtU8Sc="
+    }
+  }
+}
diff --git a/pkgs/applications/misc/1password-gui/update.sh b/pkgs/applications/misc/1password-gui/update.sh
index fc6d350f2330..c32076304537 100755
--- a/pkgs/applications/misc/1password-gui/update.sh
+++ b/pkgs/applications/misc/1password-gui/update.sh
@@ -1,58 +1,83 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
+#!nix-shell -i bash -p jq gnupg
 #shellcheck shell=bash
 
-CURRENT_HASH=""
+set -euo pipefail
 
-print_hash() {
-    OS="$1"
-    CHANNEL="$2"
-    ARCH="$3"
-    VERSION="$4"
+cd -- "$(dirname "${BASH_SOURCE[0]}")"
 
-    if [[ "$OS" == "linux" ]]; then
-        if [[ "$ARCH" == "x86_64" ]]; then
-            EXT="x64.tar.gz"
-        else
-            EXT="arm64.tar.gz"
-        fi
-        URL="https://downloads.1password.com/${OS}/tar/${CHANNEL}/${ARCH}/1password-${VERSION}.${EXT}"
+mk_url() {
+  local \
+    base_url="https://downloads.1password.com" \
+    os="$1" \
+    channel="$2" \
+    arch="$3" \
+    version="$4"
+
+  if [[ ${os} == "linux" ]]; then
+    if [[ ${arch} == "x86_64" ]]; then
+      ext="x64.tar.gz"
     else
-        EXT="$ARCH.zip"
-        URL="https://downloads.1password.com/${OS}/1Password-${VERSION}-${EXT}"
+      ext="arm64.tar.gz"
     fi
+    url="${base_url}/${os}/tar/${channel}/${arch}/1password-${version}.${ext}"
+  else
+    ext="${arch}.zip"
+    url="${base_url}/mac/1Password-${version}-${ext}"
+  fi
 
-    CURRENT_HASH=$(nix store prefetch-file "$URL" --json | jq -r '.hash')
-
-    echo "$CHANNEL ${ARCH}-${OS}: $CURRENT_HASH"
+  echo "${url}"
 }
 
-if [[ -z "$STABLE_VER" && -n "$1" ]]; then
-    STABLE_VER="$1"
-fi
+cleanup() {
+  if [[ -f ${GPG_KEYRING-} ]]; then
+    rm "${GPG_KEYRING}"
+  fi
 
-if [[ -z "$BETA_VER" && -n "$2" ]]; then
-    BETA_VER="$2"
-fi
+  if [[ -f ${JSON_HEAP-} ]]; then
+    rm "${JSON_HEAP}"
+  fi
+}
 
-if [[ "${BETA_VER: -4}" != "BETA" ]]; then
-    BETA_VER="$BETA_VER.BETA"
-fi
+trap cleanup EXIT
 
-if [[ -z "$STABLE_VER" ]]; then
-    echo "No 'STABLE_VER' environment variable provided, skipping"
-else
-    print_hash "linux" "stable" "x86_64" "$STABLE_VER"
-    print_hash "linux" "stable" "aarch64" "$STABLE_VER"
-    print_hash "mac" "stable" "x86_64" "$STABLE_VER"
-    print_hash "mac" "stable" "aarch64" "$STABLE_VER"
-fi
+# Get channel versions from versions.json
+declare -A version=(
+  ["stable"]=$(jq -r '.stable.version' versions.json)
+  ["beta"]=$(jq -r '.beta.version' versions.json)
+)
 
-if [[ -z "$BETA_VER" ]]; then
-    echo "No 'BETA_VER' environment variable provided, skipping"
-else
-    print_hash "linux" "beta" "x86_64" "$BETA_VER"
-    print_hash "linux" "beta" "aarch64" "$BETA_VER"
-    print_hash "mac" "beta" "x86_64" "$BETA_VER"
-    print_hash "mac" "beta" "aarch64" "$BETA_VER"
-fi
+#
+GPG_KEYRING=$(mktemp -t 1password.kbx.XXXXXX)
+gpg --no-default-keyring --keyring "${GPG_KEYRING}" \
+  --keyserver keyserver.ubuntu.com \
+  --receive-keys 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
+
+JSON_HEAP=$(mktemp -t 1password-gui.jsonheap.XXXXXX)
+for channel in stable beta; do
+  for os in linux darwin; do
+    for arch in x86_64 aarch64; do
+      url=$(mk_url ${os} ${channel} ${arch} "${version[${channel}]}")
+      nix store prefetch-file --json "${url}" | jq "
+        {
+          \"${channel}\": {
+             \"${arch}-${os}\": {
+               \"url\": \"${url}\",
+               \"hash\": .hash,
+               \"storePath\": .storePath
+             }
+           }
+        }" >> "${JSON_HEAP}"
+
+      # For some reason 1Password PGP signs only Linux binaries.
+      if [[ ${os} == "linux" ]]; then
+         gpgv --keyring "${GPG_KEYRING}" \
+           $(nix store prefetch-file --json "${url}.sig" | jq -r .storePath) \
+           $(jq -r --slurp ".[-1].[].[].storePath" "${JSON_HEAP}")
+      fi
+    done
+  done
+done
+
+# Combine heap of hash+url objects into a single JSON object.
+jq --slurp 'reduce .[] as $x ({}; . * $x) | del (.[].[].storePath)' "${JSON_HEAP}" > sources.json
diff --git a/pkgs/applications/misc/1password-gui/versions.json b/pkgs/applications/misc/1password-gui/versions.json
new file mode 100644
index 000000000000..803d5238d94c
--- /dev/null
+++ b/pkgs/applications/misc/1password-gui/versions.json
@@ -0,0 +1,9 @@
+{
+  "stable": {
+    "version": "8.10.60"
+  },
+
+  "beta": {
+    "version": "8.10.68-12.BETA"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/krane/Gemfile.lock b/pkgs/applications/networking/cluster/krane/Gemfile.lock
index 3e1c6eadb3a8..3697da2bd7f7 100644
--- a/pkgs/applications/networking/cluster/krane/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/krane/Gemfile.lock
@@ -38,7 +38,7 @@ GEM
     google-cloud-env (2.2.1)
       faraday (>= 1.0, < 3.a)
     google-logging-utils (0.1.0)
-    googleauth (1.12.2)
+    googleauth (1.13.1)
       faraday (>= 1.0, < 3.a)
       google-cloud-env (~> 2.2)
       google-logging-utils (~> 0.1)
@@ -56,14 +56,14 @@ GEM
     http-cookie (1.0.8)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
-    i18n (1.14.6)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    json (2.9.1)
+    json (2.10.1)
     jsonpath (1.1.5)
       multi_json
     jwt (2.10.1)
       base64
-    krane (3.7.0)
+    krane (3.7.1)
       activesupport (>= 5.0)
       colorize (~> 0.8)
       concurrent-ruby (~> 1.1)
@@ -82,11 +82,11 @@ GEM
     llhttp-ffi (0.5.0)
       ffi-compiler (~> 1.0)
       rake (~> 13.0)
-    logger (1.6.5)
+    logger (1.6.6)
     mime-types (3.6.0)
       logger
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2025.0107)
+    mime-types-data (3.2025.0304)
     minitest (5.25.4)
     multi_json (1.15.0)
     net-http (0.6.0)
@@ -113,7 +113,7 @@ GEM
     thor (1.3.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    uri (1.0.2)
+    uri (1.0.3)
 
 PLATFORMS
   ruby
diff --git a/pkgs/applications/networking/cluster/krane/gemset.nix b/pkgs/applications/networking/cluster/krane/gemset.nix
index 7544db57537a..f51087e1f07f 100644
--- a/pkgs/applications/networking/cluster/krane/gemset.nix
+++ b/pkgs/applications/networking/cluster/krane/gemset.nix
@@ -209,10 +209,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zynv2s6s6i5d8x84p1axin21bfgmgy92ai2jb7a7aaknaqpfc9x";
+      sha256 = "187c8y2arv0akkpmff0zf2qnf93ixvsbjpnvwsrzw2p4cbk8qi1k";
       type = "gem";
     };
-    version = "1.12.2";
+    version = "1.13.1";
   };
   http = {
     dependencies = [
@@ -268,20 +268,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k31wcgnvcvd14snz0pfqj976zv6drfsnq6x8acz10fiyms9l8nw";
+      sha256 = "03sx3ahz1v5kbqjwxj48msw3maplpp2iyzs22l4jrzrqh4zmgfnf";
       type = "gem";
     };
-    version = "1.14.6";
+    version = "1.14.7";
   };
   json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "048danb0x10mpch6mf88mky35zjn6wk4hpbqq68ssbq58i3fzgfj";
+      sha256 = "1p4l5ycdxfsr8b51gnvlvhq6s21vmx9z4x617003zbqv3bcqmj6x";
       type = "gem";
     };
-    version = "2.9.1";
+    version = "2.10.1";
   };
   jsonpath = {
     dependencies = [ "multi_json" ];
@@ -322,10 +322,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "032b8fk23jpmmslnhn351as9irykpa40sjz6yxibjpglj4w7wnqz";
+      sha256 = "1gkbrk08l8zdcnp62yc0r89kq9sv79v6v0ni1d6ghm4mil8apbm9";
       type = "gem";
     };
-    version = "3.7.0";
+    version = "3.7.1";
   };
   kubeclient = {
     dependencies = [
@@ -362,10 +362,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sz584vw17pwrrc5zg6yd8lqcgfpjf4qplq3s7fr0r3505nybky3";
+      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
       type = "gem";
     };
-    version = "1.6.5";
+    version = "1.6.6";
   };
   mime-types = {
     dependencies = [
@@ -386,10 +386,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jixfirdang1lx9iqkcw03mz43pi4vxlfpb8ha4sbz4cqry4jai3";
+      sha256 = "15sh43bmq39sqa1q5l5wiazyim71m6jg572fgy5p0ba3h5c3inby";
       type = "gem";
     };
-    version = "3.2025.0107";
+    version = "3.2025.0304";
   };
   minitest = {
     groups = [ "default" ];
@@ -561,9 +561,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09qyg6a29cfgd46qid8qvx4sjbv596v19ym73xvhanbyxd6500xk";
+      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.3";
   };
 }
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
index 7662ad61f8d6..e8bd4b1f95f3 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
@@ -124,3 +124,13 @@
      loadFromURL(u"private:factory/swriter"_ustr);
  
      uno::Reference<rdf::XDocumentMetadataAccess> xDocumentMetadataAccess(mxComponent,
+--- a/sw/qa/extras/odfexport/odfexport2.cxx
++++ b/sw/qa/extras/odfexport/odfexport2.cxx
+@@ -1711,6 +1711,7 @@ CPPUNIT_TEST_FIXTURE(Test, testMidnightRedlineDatetime)
+     // - Error: "2001-01-01" does not satisfy the "dateTime" type
+     // because "2001-01-01T00:00:00" became "2001-01-01" on roundtrip.
+     loadAndReload("midnight_redline.fodt");
++    return; // fails on aarch64
+ 
+     xmlDocUniquePtr pXmlDoc = parseExport(u"content.xml"_ustr);
+     assertXPathContent(pXmlDoc,
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests.patch b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
index 1c522dda5794..959510958a7e 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
@@ -121,13 +121,3 @@
      createSwDoc();
      SwDoc* pDoc = getSwDoc();
      CPPUNIT_ASSERT(pDoc);
---- a/sw/qa/extras/odfexport/odfexport2.cxx
-+++ b/sw/qa/extras/odfexport/odfexport2.cxx
-@@ -1711,6 +1711,7 @@ CPPUNIT_TEST_FIXTURE(Test, testMidnightRedlineDatetime)
-     // - Error: "2001-01-01" does not satisfy the "dateTime" type
-     // because "2001-01-01T00:00:00" became "2001-01-01" on roundtrip.
-     loadAndReload("midnight_redline.fodt");
-+    return; // fails on aarch64
- 
-     xmlDocUniquePtr pXmlDoc = parseExport(u"content.xml"_ustr);
-     assertXPathContent(pXmlDoc,
diff --git a/pkgs/applications/office/libreoffice/src-fresh/deps.nix b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
index a4bd62b5b8c1..0d1db330eec7 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/deps.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
@@ -105,11 +105,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.11.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.11.1.tar.xz";
-    sha256 = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56";
+    name = "curl-8.12.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.12.1.tar.xz";
+    sha256 = "0341f1ed97a26c811abaebd37d62b833956792b7607ea3f15d001613c76de202";
     md5 = "";
-    md5name = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56-curl-8.11.1.tar.xz";
+    md5name = "0341f1ed97a26c811abaebd37d62b833956792b7607ea3f15d001613c76de202-curl-8.12.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -161,11 +161,11 @@
     md5name = "acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76-Firebird-3.0.7.33374-0.tar.bz2";
   }
   {
-    name = "fontconfig-2.15.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/fontconfig-2.15.0.tar.xz";
-    sha256 = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e";
+    name = "fontconfig-2.16.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/fontconfig-2.16.0.tar.xz";
+    sha256 = "6a33dc555cc9ba8b10caf7695878ef134eeb36d0af366041f639b1da9b6ed220";
     md5 = "";
-    md5name = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e-fontconfig-2.15.0.tar.xz";
+    md5name = "6a33dc555cc9ba8b10caf7695878ef134eeb36d0af366041f639b1da9b6ed220-fontconfig-2.16.0.tar.xz";
   }
   {
     name = "crosextrafonts-20130214.tar.gz";
@@ -434,11 +434,11 @@
     md5name = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5-glm-1.0.1.zip";
   }
   {
-    name = "gpgme-1.24.1.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/gpgme-1.24.1.tar.bz2";
-    sha256 = "ea05d0258e71061d61716584ec34cef59330a91340571edc46b78374973ba85f";
+    name = "gpgme-1.24.2.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/gpgme-1.24.2.tar.bz2";
+    sha256 = "e11b1a0e361777e9e55f48a03d89096e2abf08c63d84b7017cfe1dce06639581";
     md5 = "";
-    md5name = "ea05d0258e71061d61716584ec34cef59330a91340571edc46b78374973ba85f-gpgme-1.24.1.tar.bz2";
+    md5name = "e11b1a0e361777e9e55f48a03d89096e2abf08c63d84b7017cfe1dce06639581-gpgme-1.24.2.tar.bz2";
   }
   {
     name = "graphite2-minimal-1.3.14.tgz";
@@ -588,11 +588,11 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2025-01-21.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2025-01-21.tar.bz2";
-    sha256 = "06b37484c2736816e84b8bdd2075011d5961c2316865bc2795831230b925608d";
+    name = "language-subtag-registry-2025-02-06.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2025-02-06.tar.bz2";
+    sha256 = "e5fffcbd640e743fa9b699087d63ccf8ab5b52eed521da68f8c894f350856662";
     md5 = "";
-    md5name = "06b37484c2736816e84b8bdd2075011d5961c2316865bc2795831230b925608d-language-subtag-registry-2025-01-21.tar.bz2";
+    md5name = "e5fffcbd640e743fa9b699087d63ccf8ab5b52eed521da68f8c894f350856662-language-subtag-registry-2025-02-06.tar.bz2";
   }
   {
     name = "lcms2-2.16.tar.gz";
@@ -602,11 +602,11 @@
     md5name = "d873d34ad8b9b4cea010631f1a6228d2087475e4dc5e763eb81acc23d9d45a51-lcms2-2.16.tar.gz";
   }
   {
-    name = "libassuan-3.0.1.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libassuan-3.0.1.tar.bz2";
-    sha256 = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1";
+    name = "libassuan-3.0.2.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libassuan-3.0.2.tar.bz2";
+    sha256 = "d2931cdad266e633510f9970e1a2f346055e351bb19f9b78912475b8074c36f6";
     md5 = "";
-    md5name = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1-libassuan-3.0.1.tar.bz2";
+    md5name = "d2931cdad266e633510f9970e1a2f346055e351bb19f9b78912475b8074c36f6-libassuan-3.0.2.tar.bz2";
   }
   {
     name = "libatomic_ops-7.8.2.tar.gz";
@@ -679,11 +679,11 @@
     md5name = "952b626ad3f3be1a4598622dab52fdab2a8604d0837c1b00589f3637535af92f-xmlsec1-1.3.6.tar.gz";
   }
   {
-    name = "libxml2-2.13.5.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.13.5.tar.xz";
-    sha256 = "74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6";
+    name = "libxml2-2.13.6.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.13.6.tar.xz";
+    sha256 = "f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96";
     md5 = "";
-    md5name = "74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6-libxml2-2.13.5.tar.xz";
+    md5name = "f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96-libxml2-2.13.6.tar.xz";
   }
   {
     name = "libxslt-1.1.42.tar.xz";
@@ -707,11 +707,11 @@
     md5name = "4e109ca30d1edec1ac60cdbe341905dc3b8f55b16855e03a54aaf59e51ec8c6f-lxml-5.3.0.tar.gz";
   }
   {
-    name = "mariadb-connector-c-3.3.13-src.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.13-src.tar.gz";
-    sha256 = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef";
+    name = "mariadb-connector-c-3.3.14-src.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.14-src.tar.gz";
+    sha256 = "497c324ed9ebce1dd8a940c1d308574f0d4db41c8209f19bfb3ded25e733ed49";
     md5 = "";
-    md5name = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef-mariadb-connector-c-3.3.13-src.tar.gz";
+    md5name = "497c324ed9ebce1dd8a940c1d308574f0d4db41c8209f19bfb3ded25e733ed49-mariadb-connector-c-3.3.14-src.tar.gz";
   }
   {
     name = "mdds-2.1.1.tar.xz";
@@ -791,11 +791,11 @@
     md5name = "2cb7dc73e9c8340dff0d99357fbaa578abf30cc6619f0521972c555681e6b2ff-openldap-2.6.9.tgz";
   }
   {
-    name = "openssl-3.0.15.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/openssl-3.0.15.tar.gz";
-    sha256 = "23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533";
+    name = "openssl-3.0.16.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/openssl-3.0.16.tar.gz";
+    sha256 = "57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86";
     md5 = "";
-    md5name = "23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533-openssl-3.0.15.tar.gz";
+    md5name = "57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86-openssl-3.0.16.tar.gz";
   }
   {
     name = "liborcus-0.19.2.tar.xz";
@@ -826,11 +826,11 @@
     md5name = "ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e-pixman-0.42.2.tar.gz";
   }
   {
-    name = "libpng-1.6.45.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libpng-1.6.45.tar.xz";
-    sha256 = "926485350139ffb51ef69760db35f78846c805fef3d59bfdcb2fba704663f370";
+    name = "libpng-1.6.47.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libpng-1.6.47.tar.xz";
+    sha256 = "b213cb381fbb1175327bd708a77aab708a05adde7b471bc267bd15ac99893631";
     md5 = "";
-    md5name = "926485350139ffb51ef69760db35f78846c805fef3d59bfdcb2fba704663f370-libpng-1.6.45.tar.xz";
+    md5name = "b213cb381fbb1175327bd708a77aab708a05adde7b471bc267bd15ac99893631-libpng-1.6.47.tar.xz";
   }
   {
     name = "tiff-4.7.0.tar.xz";
@@ -854,11 +854,11 @@
     md5name = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74-poppler-data-0.4.12.tar.gz";
   }
   {
-    name = "postgresql-14.15.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-14.15.tar.bz2";
-    sha256 = "02e891e314b4e9ee24cbd78028dab7c73f9c1ba3e30835bcbef71fe220401fc5";
+    name = "postgresql-14.17.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-14.17.tar.bz2";
+    sha256 = "6ce0ccd6403bf7f0f2eddd333e2ee9ba02edfa977c66660ed9b4b1057e7630a1";
     md5 = "";
-    md5name = "02e891e314b4e9ee24cbd78028dab7c73f9c1ba3e30835bcbef71fe220401fc5-postgresql-14.15.tar.bz2";
+    md5name = "6ce0ccd6403bf7f0f2eddd333e2ee9ba02edfa977c66660ed9b4b1057e7630a1-postgresql-14.17.tar.bz2";
   }
   {
     name = "Python-3.10.16.tar.xz";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/help.nix b/pkgs/applications/office/libreoffice/src-fresh/help.nix
index 47ce1f1ad9b0..34b2679b8400 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/help.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/help.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1pfkmv9ad9n4w0yic0l3kqx9qs7v6vjakslrqr7laa2pxyl04zsz";
-  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-help-25.2.0.3.tar.xz";
+  sha256 = "0r6hbhi8zxnsjk2lmyqxdyfs7vdg30d40753qnwkwk3avq8hywdf";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.1/libreoffice-help-25.2.1.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/main.nix b/pkgs/applications/office/libreoffice/src-fresh/main.nix
index 8158b2236efd..15c5531bd614 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/main.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/main.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1d15sn9zq40qfjxwm9cqgj7big8mk4mviz6i825qbfzq6vblh94q";
-  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-25.2.0.3.tar.xz";
+  sha256 = "0pdpslpzrwkxxv775v563xw78wgsk8air8sf35cca165fwjaw0c0";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.1/libreoffice-25.2.1.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/translations.nix b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
index 9df9c51efc87..a459874601f8 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/translations.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1sxcmkclwbzbq34mjxwkjj58qj8xf4vgnlzpyfxnmawwhnsq9x9f";
-  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-translations-25.2.0.3.tar.xz";
+  sha256 = "0jyc212vdjwixrm7fllnchai8jpxqk7kk4a4wsyfbx96ap5c1gc9";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.1/libreoffice-translations-25.2.1.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/version.nix b/pkgs/applications/office/libreoffice/src-fresh/version.nix
index 5e70b4c8f84e..11bfd520bcdc 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/version.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/version.nix
@@ -1 +1 @@
-"25.2.0.3"
+"25.2.1.2"
diff --git a/pkgs/applications/office/libreoffice/update.sh b/pkgs/applications/office/libreoffice/update.sh
index 9f7a580ad56e..a6f5536972b7 100755
--- a/pkgs/applications/office/libreoffice/update.sh
+++ b/pkgs/applications/office/libreoffice/update.sh
@@ -100,10 +100,10 @@ case $variant in
         echo "  url = \"$(jq -r '.url' <<< "$prefetch_output")\";" >> $t.nix
         echo "  rev = \"$rev\";" >> $t.nix
         echo "  hash = \"$(jq -r '.hash' <<< "$prefetch_output")\";" >> $t.nix
-        echo "}"
+        echo "}" >> "$t.nix"
     done
 
-    local prefetch_output=$(nix-prefetch-git "https://gerrit.libreoffice.org/core" --rev "$rev")
+    prefetch_output=$(nix-prefetch-git "https://gerrit.libreoffice.org/core" --rev "$rev")
     echo "{ fetchgit, ... }:" > main.nix
     echo "fetchgit {" >> main.nix
     echo "  url = \"$(jq -r '.url' <<< "$prefetch_output")\";" >> main.nix
diff --git a/pkgs/applications/radio/soapybladerf/default.nix b/pkgs/applications/radio/soapybladerf/default.nix
index 1def3e822fe1..31747781cbda 100644
--- a/pkgs/applications/radio/soapybladerf/default.nix
+++ b/pkgs/applications/radio/soapybladerf/default.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "0.4.1";
+  version = "0.4.2";
 
 in
 stdenv.mkDerivation {
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     owner = "pothosware";
     repo = "SoapyBladeRF";
     rev = "soapy-bladerf-${version}";
-    sha256 = "02wh09850vinqg248fw4lxmx7y857cqmnnb8jm9zhyrsggal0hki";
+    sha256 = "sha256-lhTiu+iCdlLTY5ceND+F8HzKf2K9afuTi3cme6nGEMo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index fe8e77b1f1c3..4b8e9eab7abb 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -61,7 +61,7 @@ let
    "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
    "8.20.0".sha256   = "sha256-WFpZlA6CzFVAruPhWcHQI7VOBVhrGLdFzWrHW0DTSl0=";
    "8.20.1".sha256   = "sha256-nRaLODPG4E3gUDzGrCK40vhl4+VhPyd+/fXFK/HC3Ig=";
-   "9.0+rc1".sha256  = "sha256-TLq925HFdizxyHjKRMeHBH9rLRpLNUiVIfA1JSMgYXA=";
+   "9.0.0".sha256    = "sha256-GRwYSvrJGiPD+I82gLOgotb+8Ra5xHZUJGcNwxWqZkU=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/applications/science/logic/rocq-core/default.nix b/pkgs/applications/science/logic/rocq-core/default.nix
index 88d8dcf26616..ec6a132f340f 100644
--- a/pkgs/applications/science/logic/rocq-core/default.nix
+++ b/pkgs/applications/science/logic/rocq-core/default.nix
@@ -15,7 +15,7 @@ let
   lib = import ../../../../build-support/coq/extra-lib.nix { inherit (args) lib; };
 
   release = {
-   "9.0+rc1".sha256 = "sha256-TLq925HFdizxyHjKRMeHBH9rLRpLNUiVIfA1JSMgYXA=";
+   "9.0.0".sha256 = "sha256-GRwYSvrJGiPD+I82gLOgotb+8Ra5xHZUJGcNwxWqZkU=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index f9e70d712b27..b1423b30a846 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -53,8 +53,8 @@ let
       }
     else
       {
-        version = "2025.0";
-        hash = "sha256-onrTWmRilbvsEpq+aE2dA9Hi4L12sNYl6QVXRqrvroI=";
+        version = "2025.1";
+        hash = "sha256-Ct9iGoD9gEP43v7ITOAoEcDN9CoFIjKJCTLYHyXE0oo=";
       };
 
 in
diff --git a/pkgs/by-name/al/albedo/package.nix b/pkgs/by-name/al/albedo/package.nix
index da0c2ffb7648..55645a6dc6ce 100644
--- a/pkgs/by-name/al/albedo/package.nix
+++ b/pkgs/by-name/al/albedo/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "albedo";
-  version = "0.0.16";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "coreruleset";
     repo = "albedo";
     tag = "v${version}";
-    hash = "sha256-HMW0SIcPDCy2QNfxpMke+/d1XCNpyx6RL6RCZAmU+WE=";
+    hash = "sha256-Yx8C44/Dy4hlmCxpuTjhqwwvEZq6HOdvq1AeNRd17MM=";
   };
 
-  vendorHash = "sha256-3YBcu/GEonEoORbB7x6YGpIl7kEzUQ9PAZNFB8NKb+c=";
+  vendorHash = "sha256-qZga699UjBsPmOUSN66BFInl8Bmk42HiVn0MfPlxRE4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/al/altus/package.nix b/pkgs/by-name/al/altus/package.nix
new file mode 100644
index 000000000000..59eb2e510921
--- /dev/null
+++ b/pkgs/by-name/al/altus/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchurl,
+  appimageTools,
+  makeWrapper,
+}:
+
+let
+  pname = "altus";
+  version = "5.6.0";
+
+  src = fetchurl {
+    name = "altus-${version}.AppImage";
+    url = "https://github.com/amanharwara/altus/releases/download/${version}/Altus-${version}.AppImage";
+    hash = "sha512-u4eBTboFJaU5qLFURXFchOmFV7GzlDbUokrBpxx8QeAJO6B0IwX1gJU0C69BKinIdO4Q93SAcjsvUkvSI+blrw==";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  extraInstallCommands = ''
+    install -m 444 -D ${appimageContents}/Altus.desktop $out/share/applications/altus.desktop
+    install -m 444 -D ${appimageContents}/Altus.png \
+      $out/share/icons/hicolor/scalable/apps/altus.png
+    substituteInPlace $out/share/applications/altus.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=altus'
+    wrapProgram "$out/bin/altus" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+  '';
+
+  meta = {
+    description = "Client for WhatsApp Web with themes, notifications and multiple accounts support";
+    homepage = "https://github.com/amanharwara/altus";
+    changelog = "https://github.com/amanharwara/altus/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ johnrtitor ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 4dca811e4eba..b1d471582f74 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -56,13 +56,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.4.1";
+  version = "4.8.4.4";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-iZKmwbSvyLTW9xWi/6WIwB1BeZai326e0Ut7x1RmKFw=";
+    hash = "sha256-uWO38eK4pJ7pkViyBh3QSVWPIMXn1tcMSS4Bt1M1bpk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/an/angular-language-server/package.nix b/pkgs/by-name/an/angular-language-server/package.nix
index 5e36dc977099..95acc02577b0 100644
--- a/pkgs/by-name/an/angular-language-server/package.nix
+++ b/pkgs/by-name/an/angular-language-server/package.nix
@@ -15,11 +15,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "19.2.0";
+  version = "19.2.1";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-Xf2ziPU3JWbmjoNy4ufaJHgnbxAw1fwuw+nH6r/8oTA=";
+    hash = "sha256-3piEpVwcRiL3lqu67y81var3N0sxKMCm1TQg77CUSmQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/autoprefixer/package.nix b/pkgs/by-name/au/autoprefixer/package.nix
index f3efe088f21f..3713dd359c3d 100644
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "autoprefixer";
-  version = "10.4.20";
+  version = "10.4.21";
 
   src = fetchFromGitHub {
     owner = "postcss";
     repo = "autoprefixer";
     rev = finalAttrs.version;
-    hash = "sha256-CGAUv6qzpcjDPcW7Vsak0iYC6GOJAkKLciVnxYcOeus=";
+    hash = "sha256-25FVNUXMEuzPJtpld/GHEppspa2ns7fAuniBCltSync=";
   };
 
   nativeBuildInputs = [
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Gu2DRDx0YRlSb+EInOfmAOYKvOba6Lq1wkOW9t9fnbA=";
+    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ba/bark/package.nix b/pkgs/by-name/ba/bark/package.nix
index 67dadd7660d7..ff30f59217d6 100644
--- a/pkgs/by-name/ba/bark/package.nix
+++ b/pkgs/by-name/ba/bark/package.nix
@@ -1,23 +1,55 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, alsa-lib
-, speexdsp
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  alsa-lib,
+  libopus,
+  soxr,
+  cmake,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (final: {
   pname = "bark";
-  version = "unstable-2023-08-22";
+  version = "0.6.0";
   src = fetchFromGitHub {
     owner = "haileys";
     repo = "bark";
-    rev = "2586b9fb58b496f8ef06f516c9cd3aace77521f7";
-    hash = "sha256-sGroae6uJhB9UIpFmvt520Zs9k0ir7H8pGkhKJmVWek=";
+    tag = "v${final.version}";
+    hash = "sha256-JaUIWGCYhasM0DgqL+DiG2rE1OWVg/N66my/4RWDN1E=";
   };
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WqJZoYpOQQGJGvND2R1o2nvK5P24z7YeJ9i26mai45M=";
-  buildInputs = [ alsa-lib speexdsp ];
-  nativeBuildInputs = [ pkg-config ];
+  cargoHash = "sha256-LcmX8LbK8UHDDeqwLTFEUuRBv9GgDiCpXP4bmIR3gME=";
+
+  # Broken rustdoc comment
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/haileys/bark/pull/13.patch";
+      hash = "sha256-cA1bqc7XhJ2cxOYvjIJ9oopzBZ9I4rGERkiwDAUh3V4";
+    })
+  ];
+
+  buildInputs = [
+    alsa-lib
+    libopus
+    soxr
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Live sync audio streaming for local networks";
@@ -27,5 +59,4 @@ rustPlatform.buildRustPackage {
     platforms = lib.platforms.linux;
     mainProgram = "bark";
   };
-}
-
+})
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index 01be0da24a3a..ca6dc376ee14 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -1,20 +1,20 @@
 {
-  buildGo124Module,
+  buildGoModule,
   lib,
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
 }:
 
-buildGo124Module rec {
+buildGoModule rec {
   pname = "beszel";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     tag = "v${version}";
-    hash = "sha256-4RuYZcBR7X9Ug6l91N/FtyfT38HlW2guputzo4kF8YU=";
+    hash = "sha256-yYSX58qA4vE7Bp3ADc6rIMf9yaeU7Zw7D5rmES6x6oA=";
   };
 
   webui = buildNpmPackage {
@@ -48,7 +48,7 @@ buildGo124Module rec {
 
     sourceRoot = "${src.name}/beszel/site";
 
-    npmDepsHash = "sha256-UKOS7QyGsdKosjhxVhZErFkXhnfrFxdX0ozBUJGsNII=";
+    npmDepsHash = "sha256-27NUV23dNHFSwOHiB/wGSAWkp6eZMnw/6Pd3Fwn98+s=";
   };
 
   sourceRoot = "${src.name}/beszel";
diff --git a/pkgs/by-name/br/brightnessctl/package.nix b/pkgs/by-name/br/brightnessctl/package.nix
index 35c5935f4f4d..843af6877465 100644
--- a/pkgs/by-name/br/brightnessctl/package.nix
+++ b/pkgs/by-name/br/brightnessctl/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   pkg-config,
   systemd,
+  coreutils,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +20,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace "pkg-config" "$PKG_CONFIG"
+      --replace-fail "pkg-config" "$PKG_CONFIG"
+
+    substituteInPlace 90-brightnessctl.rules \
+      --replace-fail /bin/ ${coreutils}/bin/
   '';
 
   makeFlags = [
@@ -28,6 +32,11 @@ stdenv.mkDerivation rec {
     "ENABLE_SYSTEMD=1"
   ];
 
+  installTargets = [
+    "install"
+    "install_udev_rules"
+  ];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ systemd ];
 
diff --git a/pkgs/by-name/ca/cadvisor/package.nix b/pkgs/by-name/ca/cadvisor/package.nix
index 7168aa1fee73..d6af1ccb9e57 100644
--- a/pkgs/by-name/ca/cadvisor/package.nix
+++ b/pkgs/by-name/ca/cadvisor/package.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "cadvisor";
-  version = "0.52.0";
+  version = "0.52.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "cadvisor";
     rev = "v${version}";
-    hash = "sha256-LNnL3vxt5ZEstyriRggVyLGOFim0eMT0XH4SgBaZLx0=";
+    hash = "sha256-EXhKX4Za+fdJcSrrbH1te533jyEVLmhgd3I9LcOCz2Q=";
   };
 
   modRoot = "./cmd";
 
-  vendorHash = "sha256-ttfLCPG5DFJbh0v5BUUDwdEaw7itu8qTIqxeYEowB44=";
+  vendorHash = "sha256-DkJLWFhYElN7BYb5Jn6PDYzgndJKbEI5U08WbRqSMdw=";
 
   ldflags = [ "-s" "-w" "-X github.com/google/cadvisor/version.Version=${version}" ];
 
diff --git a/pkgs/by-name/ca/canaille/package.nix b/pkgs/by-name/ca/canaille/package.nix
index 76a433cb7e95..7703ec0b7a4c 100644
--- a/pkgs/by-name/ca/canaille/package.nix
+++ b/pkgs/by-name/ca/canaille/package.nix
@@ -120,6 +120,16 @@ python.pkgs.buildPythonApplication rec {
     };
   };
 
+  disabledTests = [
+    # cause by authlib being too up-to-date for this version of canaille
+    # see: https://github.com/NixOS/nixpkgs/issues/389861#issuecomment-2726361949
+    # FIX: update and see if this is fixed
+    "test_invalid_client[ldap_backend]"
+    "test_invalid_client[memory_backend]"
+    "test_invalid_client[sql_backend]"
+    "test_password_reset[sql_backend]"
+  ];
+
   meta = with lib; {
     description = "Lightweight Identity and Authorization Management";
     homepage = "https://canaille.readthedocs.io/en/latest/index.html";
diff --git a/pkgs/by-name/ca/cannelloni/package.nix b/pkgs/by-name/ca/cannelloni/package.nix
index d86ea862d935..ad67a463313a 100644
--- a/pkgs/by-name/ca/cannelloni/package.nix
+++ b/pkgs/by-name/ca/cannelloni/package.nix
@@ -5,16 +5,18 @@
   cmake,
   lksctp-tools,
   sctpSupport ? true,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cannelloni";
-  version = "1.1.0";
+  version = "1.2.1";
   src = fetchFromGitHub {
     owner = "mguentner";
     repo = "cannelloni";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-pAXHo9NCXMFKYcIJogytBiPkQE0nK6chU5TKiDNCKA8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dhrB3qg/ljAP7nX+WpX+g7HaUEGj5pTPdDhY2Mi7pUo=";
   };
 
   nativeBuildInputs = [
@@ -27,12 +29,19 @@ stdenv.mkDerivation (finalAttrs: {
     "-DSCTP_SUPPORT=${lib.boolToString sctpSupport}"
   ];
 
-  meta = with lib; {
+  nativeInstallInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "SocketCAN over Ethernet tunnel";
     mainProgram = "cannelloni";
     homepage = "https://github.com/mguentner/cannelloni";
-    platforms = platforms.linux;
-    license = licenses.gpl2Only;
-    maintainers = [ maintainers.samw ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.samw ];
   };
 })
diff --git a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
index 1213cb16ec1c..d56c65f42581 100644
--- a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
+++ b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bundle-licenses";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "sstadick";
     repo = "cargo-bundle-licenses";
     rev = "v${version}";
-    hash = "sha256-leSHjl/B76Z4JM1wO9IBKbdfMgHtY/pGut1hnDd8/L0=";
+    hash = "sha256-pTxZ9s8ZccylMfEiifYmJuBB+riZ37QJSAMpVuSgLzs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I5zIrMZ9GnlAUfWaaFP6yr+pv8wWtxguxSL0zho3BRs=";
+  cargoHash = "sha256-4zolwQzK6dnFIcS2NwuxYZRS2AGcUGHh+KQzDkI0J6c=";
 
   meta = with lib; {
     description = "Generate a THIRDPARTY file with all licenses in a cargo project";
diff --git a/pkgs/by-name/ca/cargo-lambda/package.nix b/pkgs/by-name/ca/cargo-lambda/package.nix
index c9a9bddfb301..d40fa01b1036 100644
--- a/pkgs/by-name/ca/cargo-lambda/package.nix
+++ b/pkgs/by-name/ca/cargo-lambda/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-lambda";
-  version = "1.6.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "cargo-lambda";
     repo = "cargo-lambda";
     tag = "v${version}";
-    hash = "sha256-GiV5yjlzU4iU4BJ8Fq8I9uOchVCF2UGb+WLMMr7n8pc=";
+    hash = "sha256-mgGmqenCizrP3KHOE6t0Yk6ARuMH4tLo4FyyRzDe7dQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JMYGcIli72pH5O8DXQb7++bvnIgBpyYykqRbddObaAI=";
+  cargoHash = "sha256-XfznyrSc1J31hZf0lUJCnqFlmiTl+lD2XCX/aabPhHc=";
 
   nativeCheckInputs = [ cacert ];
 
diff --git a/pkgs/by-name/ch/chatgpt/source.nix b/pkgs/by-name/ch/chatgpt/source.nix
index fd12c3680b26..d39eb64fc21f 100644
--- a/pkgs/by-name/ch/chatgpt/source.nix
+++ b/pkgs/by-name/ch/chatgpt/source.nix
@@ -1,7 +1,7 @@
 {
-  version = "1.2025.057";
+  version = "1.2025.063";
   src = {
-    url = "https://persistent.oaistatic.com/sidekick/public/ChatGPT_Desktop_public_1.2025.057_1741115522.dmg";
-    hash = "sha256-aVPBYPr1tMRBEvKgooVIzgiqClCIN8tWERjIcgP0UUk=";
+    url = "https://persistent.oaistatic.com/sidekick/public/ChatGPT_Desktop_public_1.2025.063_1741403068.dmg";
+    hash = "sha256-ZqQZtrN+t6C5BRCHh8iqA/e11EA2GCvVTcxAAjK7Vq0=";
   };
 }
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index 2da3f64befa5..a271353a349d 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.108.0";
+  version = "1.109.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-uffGyfSTAZUHBkg3Tr25S7SagYTqrcuiDzKqPwlYfkc=";
+    hash = "sha256-FFMmS5S382Dy8Ut01pY0eq1bI1uSn8I3evMS6hftSss=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cl/cloudlog/package.nix b/pkgs/by-name/cl/cloudlog/package.nix
index e4f573221a5a..9ad4f6940528 100644
--- a/pkgs/by-name/cl/cloudlog/package.nix
+++ b/pkgs/by-name/cl/cloudlog/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cloudlog";
-  version = "2.6.16";
+  version = "2.6.17";
 
   src = fetchFromGitHub {
     owner = "magicbug";
     repo = "Cloudlog";
     rev = version;
-    hash = "sha256-1GdIC1vC/SG9duQkrOXIe24OyIwdLgeEiG7i+KYP8Cs=";
+    hash = "sha256-SW9ZW6IcxG+KonfgRHnCRo7P9KqfDCrS5MjnRKHvN1k=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/code-nautilus/package.nix b/pkgs/by-name/co/code-nautilus/package.nix
new file mode 100644
index 000000000000..91925d5d9d40
--- /dev/null
+++ b/pkgs/by-name/co/code-nautilus/package.nix
@@ -0,0 +1,38 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nautilus-python,
+  python3,
+}:
+stdenv.mkDerivation rec {
+  pname = "code-nautilus";
+  version = "0-unstable-2024-09-11";
+
+  src = fetchFromGitHub {
+    owner = "harry-cpp";
+    repo = "code-nautilus";
+    rev = "8ea0ce78f3f1f7a6af5f9e9cf93fc3e70015f61e";
+    sha256 = "u10laS3BwUVCJYlQ6WivU7o/sFFv6cTeV+uxBEdD7oA=";
+  };
+
+  buildInputs = [
+    nautilus-python
+    python3.pkgs.pygobject3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 ./code-nautilus.py -t $out/share/nautilus-python/extensions
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "VSCode extension for Nautilus: 'Open in Code'";
+    homepage = "https://github.com/harry-cpp/code-nautilus";
+    license = licenses.unlicense;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ berrij ];
+  };
+
+}
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index 1f44d2542749..89ba5a817b3b 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.20.4";
+  version = "1.20.5";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-pvTHrFrnRSprsbIPenVPVnnmU59OQCZc9DF+8wcWJ3A=";
+    hash = "sha256-dBx/WHi+qFrOyA0lIjvARcAZ96WvHCjVs94XicSL5L0=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-hAnIKuFtS6l4nhq8bTcHkvW43FT6K8+0FglRRNfDtPg=";
+  vendorHash = "sha256-rQDVXMLXI2/D4SNLfs3CT4chDnzhh1aU5xuMMBDMhLI=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/co/countryguess/package.nix b/pkgs/by-name/co/countryguess/package.nix
new file mode 100644
index 000000000000..22cf4135f4db
--- /dev/null
+++ b/pkgs/by-name/co/countryguess/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  makeWrapper,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "countryguess";
+  version = "0-unstable-2025-03-04";
+  # upstream pyproject.toml is nonsense. Copied from another project
+  # without customizing it for this project.
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "swarbler";
+    repo = "countryguess";
+    rev = "28f45231bc3d8bedeb7d1b51d56ca1b56796ff8c";
+    hash = "sha256-S/fy94aRoVI2CvICrviQ2ZgVESWYLuREb5mwsfXL6Hc=";
+  };
+
+  dependencies = with python3Packages; [
+    art
+    colorama
+  ];
+
+  # upstream python file lacks shebang
+  postPatch = ''
+    echo '#!/usr/bin/env python3' | cat - countryguess.py > temp && mv temp countryguess.py
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm744 countryguess.py $out/bin/countryguess
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Guess the 193 U.N. recognised countries";
+    homepage = "https://github.com/swarbler/countryguess";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "countryguess";
+  };
+}
diff --git a/pkgs/by-name/cr/credhub-cli/package.nix b/pkgs/by-name/cr/credhub-cli/package.nix
index 755570e007ba..38c4eec63b5b 100644
--- a/pkgs/by-name/cr/credhub-cli/package.nix
+++ b/pkgs/by-name/cr/credhub-cli/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.43";
+  version = "2.9.44";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-w3TGXv5Lz5yQiyYQZHGEncljDd54f8GfkKQoC51hQVU=";
+    sha256 = "sha256-5963iZ7fDNs+J96+GSoGcjKLCqu8u3obAWE9+9oEBGU=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 185393564477..2d11c6c897dd 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.16.0";
+  version = "4.17.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${version}";
-    hash = "sha256-yFBKDb4XdCw5en/VN5IP8iCTdSRMqATVR8vV3G1gHJQ=";
+    hash = "sha256-4h911E5iAfqfuF66PsW0+amKw9hneaV3LS5UFsPR690=";
   };
 
-  vendorHash = "sha256-4LDH1mJE0SJFvHYT14uCcgzy5CQ61V2gj1SfyHLEQXY=";
+  vendorHash = "sha256-158Rzie6fECkjDK18KE6WVSPlgTZAS++pSkv7KmdByk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/dp/dpms-off/package.nix b/pkgs/by-name/dp/dpms-off/package.nix
new file mode 100644
index 000000000000..cdc64f0b3282
--- /dev/null
+++ b/pkgs/by-name/dp/dpms-off/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dpms-off";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "lilydjwg";
+    repo = "dpms-off";
+    rev = "17c5600fdfcf3f5aeb7c85b649dc53e18565b21f";
+    hash = "sha256-fADydBO4XISt2n7vrkCuca8db9jtMVsUUvqYAqeVy60=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-wpX14e+J+n1it+1D6OD/AyDn+bOuSoJCEEWlmuZ7c0Y=";
+
+  meta = {
+    description = "Turn off monitors to save power (for Wayland)";
+    homepage = "https://github.com/lilydjwg/dpms-off";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.philiptaron ];
+    mainProgram = "dpms-off";
+  };
+}
diff --git a/pkgs/by-name/du/dune3d/package.nix b/pkgs/by-name/du/dune3d/package.nix
index db8f7de1b0f1..dfe2bd16293a 100644
--- a/pkgs/by-name/du/dune3d/package.nix
+++ b/pkgs/by-name/du/dune3d/package.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dune3d";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "dune3d";
     repo = "dune3d";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oS10xek4IyRrjZTBvDsjqCA9NE93vzB0W9iQEm2IMf4=";
+    hash = "sha256-9lBaenBxMoJgG5tMM+EZ87xcJ4HhFTA9RUNZt2Jx34Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index 34b22d9936ed..1056a7faf2a7 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "erigon";
-  version = "2.61.2";
+  version = "2.61.3";
 in
 buildGoModule {
   inherit pname version;
@@ -16,7 +16,7 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-r9BAhoQn51IUPAWDxcc19LHWNyxf5aj/uoDzpdy2GUA=";
+    hash = "sha256-VGLuPaGYx/DQc3Oc9wAbELXAtkuxr8cbePVBExlZikk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/fc/fcitx5-pinyin-minecraft/package.nix b/pkgs/by-name/fc/fcitx5-pinyin-minecraft/package.nix
index 3abca1915695..ecd8fd7dddf9 100644
--- a/pkgs/by-name/fc/fcitx5-pinyin-minecraft/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-minecraft/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-pinyin-minecraft";
-  version = "0.1.20240629";
+  version = "0.1.20250315";
 
   src = fetchurl {
     url = "https://github.com/oldherl/fcitx5-pinyin-minecraft/releases/download/${finalAttrs.version}/minecraft-cn.dict";
-    hash = "sha256-uD/ADL+JGdSYiNz6XIqJB0Y0IU6Jf56q5g7xG2o3a+E=";
+    hash = "sha256-7BKNsxlIxEch4cTEcp4jFnIdyv7ifbtJ8HCIMX5G2U8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
index 5b7cfb599ce1..e809565a6179 100644
--- a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-pinyin-moegirl";
-  version = "20250209";
+  version = "20250309";
 
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-+EIXBIu3OE59VpnAWalmiNqD4FsvuSgRr79OQCqrgMA=";
+    hash = "sha256-0ZXlPpeaxXK3dI2uGBmISpCGM9isQdPxJRTcoIa75fg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/fi/filen-cli/package.nix b/pkgs/by-name/fi/filen-cli/package.nix
new file mode 100644
index 000000000000..164fb7459200
--- /dev/null
+++ b/pkgs/by-name/fi/filen-cli/package.nix
@@ -0,0 +1,59 @@
+{
+  stdenv,
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "filen-cli";
+  version = "0.0.29";
+
+  src = fetchFromGitHub {
+    owner = "FilenCloudDienste";
+    repo = "filen-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ftbRv75x6o1HgElY4oLBBe5SRuLtxdrjpjZznSCyroI=";
+  };
+
+  npmDepsHash = "sha256-a+sq0vFsk4c7bl0Nn2KfBFxyq3ZF2HPvt8d1vxegnHg=";
+
+  postPatch = ''
+    # The filen-cli repository does not contain the correct version string;
+    # it is replaced during publishing in the same way:
+    # https://github.com/FilenCloudDienste/filen-cli/blob/c7d5eb2a2cd6d514321992815f16475f6909af36/.github/workflows/build-and-publish.yml#L24
+    substituteInPlace package.json \
+      --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"'
+  '';
+
+  # A special random 256-bit string called CRYPTO_BASE_KEY has to be injected
+  # during build. It can be randomly generated using the generateKey.mjs
+  # script, however, generating a key here will invalidate the session on every
+  # rebuild, and hence we need to provide a constant key. The key below is
+  # extracted from the official filen-cli releases. Example:
+  # $ strings filen-cli-v0.0.29-linux-x64 | grep checkInjectedBuildInfo -A 6
+  # That also makes the session data compatible with the official distribution.
+  env.FILEN_CLI_CRYPTO_BASE_KEY = "f47fb2011c90d8aad21f7415d19989cea2c1ac8bc674daf36af48de8697a83e0";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/filen";
+  versionCheckProgramArg = [ "--version" ];
+
+  # Writes $HOME/Library/Application Support on darwin
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=^v([0-9.]+)$" ];
+  };
+
+  meta = {
+    description = "CLI tool for interacting with the Filen cloud";
+    homepage = "https://github.com/FilenCloudDienste/filen-cli";
+    changelog = "https://github.com/FilenCloudDienste/filen-cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ eilvelia ];
+    mainProgram = "filen";
+  };
+})
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index a34dbc051771..3faa728d4f82 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -19,11 +19,18 @@ buildGoModule rec {
 
   vendorHash = "sha256-I/umXgVm9a+0Ay3ARuaa4Dua4Zhc5p2TONHvhCt3Qtk=";
 
-  checkFlags = [
-    # TestHTTPChecker requires internet
-    # TestS3DriverPathStyle requires s3 credentials/urls
-    "-skip TestHTTPChecker|TestS3DriverPathStyle"
-  ];
+  checkFlags =
+    let
+      skippedTests = [
+        # requires internet
+        "TestHTTPChecker"
+        # requires s3 credentials/urls
+        "TestS3DriverPathStyle"
+        # flaky
+        "TestPurgeAll"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   meta = with lib; {
     description = "GitLab Docker toolset to pack, ship, store, and deliver content";
diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
index df958bd10155..8b396f77343f 100644
--- a/pkgs/by-name/gl/glance/package.nix
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -6,15 +6,15 @@
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "glance";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "glanceapp";
     repo = "glance";
-    tag = "v${version}";
-    hash = "sha256-1DIngje7UT86eI3ZJWd71BkbAvHJ2JC0LUHAQXz0rfc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HFF1qiruz1SM9+g3xOKawuGmLzdYUUt3DnMRwjobVN4=";
   };
 
   vendorHash = "sha256-lURRHlZoxbuW1SXxrxy2BkMndcEllGFmVCB4pXBad8Q=";
@@ -22,7 +22,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/glanceapp/glance/internal/glance.buildVersion=${version}"
+    "-X github.com/glanceapp/glance/internal/glance.buildVersion=${finalAttrs.version}"
   ];
 
   excludedPackages = [ "scripts/build-and-ship" ];
@@ -36,7 +36,7 @@ buildGoModule rec {
 
   meta = {
     homepage = "https://github.com/glanceapp/glance";
-    changelog = "https://github.com/glanceapp/glance/releases/tag/v${version}";
+    changelog = "https://github.com/glanceapp/glance/releases/tag/v${finalAttrs.version}";
     description = "Self-hosted dashboard that puts all your feeds in one place";
     mainProgram = "glance";
     license = lib.licenses.agpl3Only;
@@ -45,4 +45,4 @@ buildGoModule rec {
       defelo
     ];
   };
-}
+})
diff --git a/pkgs/by-name/go/goda/package.nix b/pkgs/by-name/go/goda/package.nix
index 7aabe29df5db..64249f441c92 100644
--- a/pkgs/by-name/go/goda/package.nix
+++ b/pkgs/by-name/go/goda/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.5.11";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    hash = "sha256-UeXn+JAR4TExZahwFozjbwXHF3QEcJvh5SzU/8VAmLg=";
+    hash = "sha256-g/sScj5VDQjpWmZN+1YqKJHixGwSBJi6v6YiGklSsjw=";
   };
 
-  vendorHash = "sha256-FYjlOYB0L4l6gF8hYtJroV1qMQD0ZmKWXBarjyConRs=";
+  vendorHash = "sha256-Tkt01WSKMyShcw+/2iCh1ziHHhj24LnmfKY8KTDa+L8=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/go/gokapi/package.nix b/pkgs/by-name/go/gokapi/package.nix
new file mode 100644
index 000000000000..4788ad771657
--- /dev/null
+++ b/pkgs/by-name/go/gokapi/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "gokapi";
+  version = "1.9.6";
+
+  src = fetchFromGitHub {
+    owner = "Forceu";
+    repo = "Gokapi";
+    tag = "v${version}";
+    hash = "sha256-RDEvKh3tUun7wt1nhtCim95wEN9V9RlztZ9zcw9nS1o=";
+  };
+
+  vendorHash = "sha256-9GRAlgng+yq7q0VQz374jIOCjeDIIDD631BglM/FsQQ=";
+
+  # This is the go generate is ran in the upstream builder, but we have to run the components separately for things to work.
+  preBuild = ''
+    cd ./cmd/gokapi/
+    go run ../../build/go-generate/updateVersionNumbers.go
+    # Tries to download "golang.org/x/exp/slices"
+    # go run ../../build/go-generate/updateProtectedUrls.go
+    go run ../../build/go-generate/buildWasm.go
+    # Must be specify go root to import wasm_exec.js
+    GOROOT="$(go env GOROOT)" go run "../../build/go-generate/copyStaticFiles.go"
+    cd ../..
+  '';
+
+  subPackages = [
+    "cmd/gokapi"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) gokapi;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Lightweight selfhosted Firefox Send alternative without public upload";
+    homepage = "https://github.com/Forceu/Gokapi";
+    changelog = "https://github.com/Forceu/Gokapi/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      delliott
+    ];
+    mainProgram = "gokapi";
+  };
+}
diff --git a/pkgs/by-name/gr/graphql-language-service-cli/package.nix b/pkgs/by-name/gr/graphql-language-service-cli/package.nix
new file mode 100644
index 000000000000..8ba974f2543c
--- /dev/null
+++ b/pkgs/by-name/gr/graphql-language-service-cli/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeWrapper,
+  nodejs,
+  stdenv,
+  yarnBuildHook,
+  yarnConfigHook,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graphql-language-service-cli";
+  version = "3.5.0";
+
+  src = fetchFromGitHub {
+    owner = "graphql";
+    repo = "graphiql";
+    tag = "graphql-language-service-cli@${finalAttrs.version}";
+    hash = "sha256-NJTggaMNMjOP5oN+gHxFTwEdNipPNzTFfA6f975HDgM=";
+  };
+
+  patches = [
+    ./patches/0001-repurpose-vscode-graphql-build-script.patch
+  ];
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-ae6KP2sFgw8/8YaTJSPscBlVQ5/bzbvHRZygcMgFAlU=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib}
+
+    pushd packages/graphql-language-service-cli
+
+    node esbuild.js --minify
+
+    # copy package.json for --version command
+    mv {out/graphql.js,package.json} $out/lib
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/graphql-lsp \
+      --add-flags $out/lib/graphql.js \
+
+    popd
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+
+  passthru = {
+    updateScript = ./updater.sh;
+  };
+
+  meta = {
+    description = "Official, runtime independent Language Service for GraphQL";
+    homepage = "https://github.com/graphql/graphiql";
+    changelog = "https://github.com/graphql/graphiql/blob/${finalAttrs.src.tag}/packages/graphql-language-service-cli/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nathanregner ];
+    mainProgram = "graphql-lsp";
+  };
+})
diff --git a/pkgs/by-name/gr/graphql-language-service-cli/patches/0001-repurpose-vscode-graphql-build-script.patch b/pkgs/by-name/gr/graphql-language-service-cli/patches/0001-repurpose-vscode-graphql-build-script.patch
new file mode 100644
index 000000000000..57617b37dcd7
--- /dev/null
+++ b/pkgs/by-name/gr/graphql-language-service-cli/patches/0001-repurpose-vscode-graphql-build-script.patch
@@ -0,0 +1,63 @@
+From ceeca9463380ab11483ec22f9e46fdc3f83162b0 Mon Sep 17 00:00:00 2001
+From: Nathan Regner <nathanregner@gmail.com>
+Date: Sat, 15 Mar 2025 15:50:13 -0600
+Subject: [PATCH] Repurpose vscode-graphql build script
+
+Bundling the output script means we don't have to ship 1GB of
+`node_modules` (there are lots of unrelated dependencies used by other
+packages in the monorepo).
+---
+ .../esbuild.js                                | 28 ++-----------------
+ 1 file changed, 2 insertions(+), 26 deletions(-)
+ rename packages/{vscode-graphql => graphql-language-service-cli}/esbuild.js (59%)
+
+diff --git a/packages/vscode-graphql/esbuild.js b/packages/graphql-language-service-cli/esbuild.js
+similarity index 59%
+rename from packages/vscode-graphql/esbuild.js
+rename to packages/graphql-language-service-cli/esbuild.js
+index 744f4e60..4b9147fa 100644
+--- a/packages/vscode-graphql/esbuild.js
++++ b/packages/graphql-language-service-cli/esbuild.js
+@@ -1,12 +1,8 @@
+ const { build } = require('esbuild');
+ const [, , arg] = process.argv;
+ 
+-const logger = console;
+-
+-const isWatchMode = arg === '--watch';
+-
+ build({
+-  entryPoints: ['src/extension.ts', 'src/server/index.ts'],
++  entryPoints: ['bin/graphql.js'],
+   bundle: true,
+   minify: arg === '--minify',
+   platform: 'node',
+@@ -50,24 +46,4 @@ build({
+     'liquor',
+     'twig',
+   ],
+-})
+-  .then(({ errors, warnings }) => {
+-    if (warnings.length) {
+-      logger.warn(...warnings);
+-    }
+-    if (errors.length) {
+-      logger.error(...errors);
+-    }
+-
+-    logger.log('successfully bundled vscode-graphql 🚀');
+-
+-    if (isWatchMode) {
+-      logger.log('watching... 🕰');
+-    } else {
+-      process.exit();
+-    }
+-  })
+-  .catch(err => {
+-    logger.error(err);
+-    process.exit(1);
+-  });
++});
+-- 
+2.48.1
+
diff --git a/pkgs/by-name/gr/graphql-language-service-cli/updater.sh b/pkgs/by-name/gr/graphql-language-service-cli/updater.sh
new file mode 100755
index 000000000000..2d3fd58b1f28
--- /dev/null
+++ b/pkgs/by-name/gr/graphql-language-service-cli/updater.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq nix-update
+
+set -euo pipefail
+
+# this package is part of a monorepo with many tags; nix-update only seems to
+# fetch the 10 most recent
+# https://github.com/Mic92/nix-update/issues/231
+owner="graphql"
+repo="graphiql"
+version=$(
+    curl -s ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/graphql/graphiql/git/refs/tags/graphql-language-service-cli" |
+        jq 'map(.ref | capture("refs/tags/graphql-language-service-cli@(?<version>[0-9.]+)").version) | .[]' -r |
+        sort --reverse --version-sort | head -n1
+)
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+nix-update graphql-language-service-cli --version $version
diff --git a/pkgs/by-name/ht/httping/package.nix b/pkgs/by-name/ht/httping/package.nix
index ae1bbbcc0d59..b1624175d465 100644
--- a/pkgs/by-name/ht/httping/package.nix
+++ b/pkgs/by-name/ht/httping/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "httping";
-  version = "4.2.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "folkertvanheusden";
     repo = "HTTPing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6PXus8lg+2L9RoRe4nPI1+2iYDKKEhVfJJZMoKWSCb0=";
+    hash = "sha256-qvi+8HwEipI8vkhPgFSN+q+3BsUCQTOqPVUUzzDn3Uo=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests.version = testers.testVersion {
       command = "${lib.getExe finalAttrs.finalPackage} --version";
       package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
     };
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index 66896bf076d1..a818df4cdef6 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h8HOCZ/rw2Buzku+GKF77VXxrGjCSOQkLhptiEKMYg0=";
+    hash = "sha256-EV3945SnjOCuRVbGRghsWx/9D89FyshnSO1Q6/TuQ14=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index 7189fa8215c6..22e540f1182c 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "icloudpd";
-  version = "1.27.0";
+  version = "1.27.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "icloud-photos-downloader";
     repo = "icloud_photos_downloader";
     tag = "v${version}";
-    hash = "sha256-lYCUdDUGaUsRrL0Wpjv106XVlme+vGYdnf5mUqkjnNw=";
+    hash = "sha256-gJ1Vx0p8GiJ4esJuOanojlCHvqzOz8ttgAVn6idrLPM=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/in/inori/package.nix b/pkgs/by-name/in/inori/package.nix
index 6d1ba33b652b..69547bc0f439 100644
--- a/pkgs/by-name/in/inori/package.nix
+++ b/pkgs/by-name/in/inori/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inori";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "eshrh";
     repo = "inori";
     tag = "v${version}";
-    hash = "sha256-g+OH8sjfByrVsI1KogkluvAqNyYz7Fba2aeJkFhCgPU=";
+    hash = "sha256-UKYRqiwqyYh1ZQH4yAm2ALJjxCkczHAURy/Pob4S29g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YiGAOX2zxfjpLBzS7vlUlMG6cUHEAkdbm6z6P7ar064=";
+  cargoHash = "sha256-0ITazN1eGAuuy0QR8GdnU0Z6Nz44R/8kByWyHIr0P60=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ji/jinja-lsp/package.nix b/pkgs/by-name/ji/jinja-lsp/package.nix
index 5cca9ebff4c9..a89f08013e2b 100644
--- a/pkgs/by-name/ji/jinja-lsp/package.nix
+++ b/pkgs/by-name/ji/jinja-lsp/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "jinja-lsp";
-  version = "0.1.84";
+  version = "0.1.85";
 
   src = fetchFromGitHub {
     owner = "uros-5";
     repo = "jinja-lsp";
     tag = "v${version}";
-    hash = "sha256-VgdrPpYY2RC+6JKaPYcd0wI381TPaE/NBx7uDI8Ud5g=";
+    hash = "sha256-/4A9IiSeskRKblcZIpsMgZsqYE6eBSeyHPpO/owCGD8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7h2iY6tpUoOGnLmhI8SJUSLlM9CadgtiWEFHFr1gURs=";
+  cargoHash = "sha256-14zMp2Z2GG4IC2DWzbzv07GAph4q6pHFJTyy67jisXg=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index 504339329de3..a75945415d7a 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -19,7 +19,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.39.0";
+  version = "1.40.0";
   outputs =
     [
       "out"
@@ -33,11 +33,11 @@ rustPlatform.buildRustPackage rec {
     owner = "casey";
     repo = "just";
     tag = version;
-    hash = "sha256-K2MUS6wo0qxJnnIWDdmxHRNwyzx1z7yscVwMzXKAwQA=";
+    hash = "sha256-pmuwZoBIgUsKWFTXo8HYHVxrDWPMO8cumD/UHajFS6A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nDwJgZPWw86qpaGaYWB/Qqbym0FR2EpEKAme5CKbMv0=";
+  cargoHash = "sha256-mQQGxtSgNuRbz/83eWru+dmtWiLSKdVH+3z88BNugQE=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
diff --git a/pkgs/by-name/ku/kube-bench/package.nix b/pkgs/by-name/ku/kube-bench/package.nix
index 9e68c0d72ed3..6941c8dafe24 100644
--- a/pkgs/by-name/ku/kube-bench/package.nix
+++ b/pkgs/by-name/ku/kube-bench/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "kube-bench";
-  version = "0.10.2";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-5vgAK99a0gCYAVd0f/dd6Z1qsGzAeHL+eTTb/hcFlp4=";
+    hash = "sha256-BlznHX8iUFv9knFlv80Ac6SADfGtnB2F5atG8yfKQ0E=";
   };
 
-  vendorHash = "sha256-2HUvy9O7c1j4oXdIw7VZPtkEjQj2en8YPetiGwDaeYg=";
+  vendorHash = "sha256-dO4rJ7pNVtz8ZZlO1vEHQU3sIMEy/qM30rlDvsfuuso=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index 1b0f8de5ccef..a9407d99959a 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2025-03-04";
+  version = "0-unstable-2025-03-16";
 
   src = fetchFromGitHub {
     owner = "LadybirdWebBrowser";
     repo = "ladybird";
-    rev = "12f5e9c5f87072fb1c54739d8a185e43356b5bd5";
-    hash = "sha256-AvuMJ+udk+Tk5P77WxgX2T0BdbLF4mN/SJPJoEjiWZM=";
+    rev = "7a2cc28932a7b0f85e7bde6bae273fba8155f573";
+    hash = "sha256-yJ51v30Mh9S93ZInafm9kxr0c9hg7LoBufmwyevX/FY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/la/last/package.nix b/pkgs/by-name/la/last/package.nix
index 37572805c173..db301095cb04 100644
--- a/pkgs/by-name/la/last/package.nix
+++ b/pkgs/by-name/la/last/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1611";
+  version = "1615";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-m7JmNAFKI1mVzNtDeXKnDBxdFlcNZKBvxsq+KBuQWs4=";
+    hash = "sha256-1opYdV4nszLSuHNCo0HuURuPYby8oVGXwQvDd68mDOM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libfabric/package.nix b/pkgs/by-name/li/libfabric/package.nix
index 07fa69ce6858..a9bec3b1ecc7 100644
--- a/pkgs/by-name/li/libfabric/package.nix
+++ b/pkgs/by-name/li/libfabric/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "2.0.0";
+  version = "2.1.0";
 
   enableParallelBuilding = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = "libfabric";
     rev = "v${version}";
-    sha256 = "sha256-W86hsxhbaUbB1sb0l1J0e/9IBnc5eZLQ1m4/SuyXZG0=";
+    sha256 = "sha256-TK45SCPyFIMhliBYBEMPSKX/UtHGPj075SlTNB92O0Y=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libgedit-amtk/package.nix b/pkgs/by-name/li/libgedit-amtk/package.nix
index 73d3adee7a31..141cdc97aecc 100644
--- a/pkgs/by-name/li/libgedit-amtk/package.nix
+++ b/pkgs/by-name/li/libgedit-amtk/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libgedit-amtk";
-  version = "5.9.0";
+  version = "5.9.1";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "gedit";
     repo = "libgedit-amtk";
     rev = version;
-    hash = "sha256-D6jZmadUHDtxedw/tCsKHzcWXobs6Vb7dyhbVKqu2Zc=";
+    hash = "sha256-myKpZtqtf40UByBUKVF0jv521kGAUA6KDmbDJy/Q1q8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libstrophe/package.nix b/pkgs/by-name/li/libstrophe/package.nix
index 67826119362e..25b10bf1a78e 100644
--- a/pkgs/by-name/li/libstrophe/package.nix
+++ b/pkgs/by-name/li/libstrophe/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libstrophe";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "strophe";
     repo = "libstrophe";
     rev = version;
-    hash = "sha256-JMuvWspgXs+1dVWoo6kJVaf6cVvYj8lhyyu4ZILKeOg=";
+    hash = "sha256-53O8hHyw9y0Bzs+BpGouAxuSGJxh6NSNNWZqi7RHAsY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index bef3c722f1c2..bca6030c6303 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -5,27 +5,26 @@
   llvmPackages,
   mtools,
   nasm,
+  nixosTests,
   # The following options map to configure flags.
   enableAll ? false,
   buildCDs ? false,
   targets ? [ ],
   # x86 specific flags
-  biosSupport ? false,
+  biosSupport ? true,
   pxeSupport ? false,
 }:
 
 let
   stdenv = llvmPackages.stdenv;
 
-  version = "9.0.1";
-
-  hasI686 =
+  hasX86 =
     (if targets == [ ] then stdenv.hostPlatform.isx86_32 else (builtins.elem "i686" targets))
+    || (if targets == [ ] then stdenv.hostPlatform.isx86_64 else (builtins.elem "x86_64" targets))
     || enableAll;
 
-  hasX86_64 =
-    (if targets == [ ] then stdenv.hostPlatform.isx86_64 else (builtins.elem "x86_64" targets))
-    || enableAll;
+  biosSupport' = biosSupport && hasX86;
+  pxeSupport' = pxeSupport && hasX86;
 
   uefiFlags =
     target:
@@ -37,39 +36,20 @@ let
       x86_64 = [ "--enable-uefi-x86-64" ];
     }
     .${target} or (throw "Unsupported target ${target}");
-
-  configureFlags =
-    lib.optionals enableAll [ "--enable-all" ]
-    ++ lib.optionals biosSupport [ "--enable-bios" ]
-    ++ lib.optionals (buildCDs && biosSupport) [ "--enable-bios-cd" ]
-    ++ lib.optionals buildCDs [ "--enable-uefi-cd" ]
-    ++ lib.optionals pxeSupport [ "--enable-bios-pxe" ]
-    ++ lib.concatMap uefiFlags (
-      if targets == [ ] then [ stdenv.hostPlatform.parsed.cpu.name ] else targets
-    )
-    ++ [
-      "TOOLCHAIN_FOR_TARGET=llvm"
-      # `clang` on `PATH` has to be unwrapped, but *a* wrapped clang
-      # still needs to be available
-      "CC=${lib.getExe stdenv.cc}"
-    ];
 in
 
-assert lib.assertMsg (!biosSupport || hasI686) "BIOS builds are possible only for x86";
-
-assert lib.assertMsg (!pxeSupport || hasI686) "PXE builds are possible only for x86";
-
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
-stdenv.mkDerivation {
-  inherit version configureFlags;
+stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
+  version = "9.2.0";
+
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
-    url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    hash = "sha256-c27Hn9evHt7AqzUWPFYoIHD8UQR1ToJgX+1DcVbaMBU=";
+    url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
+    hash = "sha256-tR946s/b9RcGAFa+dJk/+Bfzf5FmE2UgdygjDVkrEgw=";
   };
 
   enableParallelBuilding = true;
@@ -83,7 +63,7 @@ stdenv.mkDerivation {
     ++ lib.optionals (enableAll || buildCDs) [
       mtools
     ]
-    ++ lib.optionals (hasI686 || hasX86_64) [ nasm ];
+    ++ lib.optionals hasX86 [ nasm ];
 
   outputs = [
     "out"
@@ -92,26 +72,48 @@ stdenv.mkDerivation {
     "man"
   ];
 
-  meta = with lib; {
+  configureFlags =
+    lib.optionals enableAll [ "--enable-all" ]
+    ++ lib.optionals biosSupport' [ "--enable-bios" ]
+    ++ lib.optionals (buildCDs && biosSupport') [ "--enable-bios-cd" ]
+    ++ lib.optionals buildCDs [ "--enable-uefi-cd" ]
+    ++ lib.optionals pxeSupport' [ "--enable-bios-pxe" ]
+    ++ lib.concatMap uefiFlags (
+      if targets == [ ] then [ stdenv.hostPlatform.parsed.cpu.name ] else targets
+    )
+    ++ [
+      "TOOLCHAIN_FOR_TARGET=llvm"
+      # `clang` on `PATH` has to be unwrapped, but *a* wrapped clang
+      # still needs to be available
+      "CC=${lib.getExe stdenv.cc}"
+    ];
+
+  passthru.tests = nixosTests.limine;
+
+  meta = {
     homepage = "https://limine-bootloader.org/";
+    changelog = "https://raw.githubusercontent.com/limine-bootloader/limine/refs/tags/v${finalAttrs.version}/ChangeLog";
     description = "Limine Bootloader";
     mainProgram = "limine";
     # The platforms on that the Limine binary and helper tools can run, not
     # necessarily the platforms for that bootable images can be created.
-    platforms = platforms.unix;
-    badPlatforms = platforms.darwin;
+    platforms = lib.platforms.unix;
+    badPlatforms = lib.platforms.darwin;
     # Caution. Some submodules have different licenses.
-    license = [
-      licenses.asl20 # cc-runtime
-      licenses.bsd0 # freestanding-toolchain, freestanding-headers
-      licenses.bsd2 # limine, flanterm
-      licenses.mit # limine-efi, stb
-      licenses.zlib # tinf
+    license = with lib.licenses; [
+      asl20 # cc-runtime
+      bsd0 # freestanding-headers, freestanding-toolchain
+      bsd2 # limine, flanterm, libfdt, nyu-efi
+      bsd2Patent # nyu-efi
+      bsd3 # nyu-efi
+      bsdAxisNoDisclaimerUnmodified # nyu-efi
+      mit # nyu-efi, stb_image
+      zlib # tinf
     ];
-    maintainers = [
-      maintainers.lzcunt
-      maintainers.phip1611
-      maintainers.surfaceflinger
+    maintainers = with lib.maintainers; [
+      lzcunt
+      phip1611
+      surfaceflinger
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index a8ae69195fc9..928d67fbe8b7 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -15,7 +15,7 @@
 
 buildGoModule rec {
   pname = "mautrix-meta";
-  version = "0.4.4";
+  version = "0.4.5";
 
   subPackages = [ "cmd/mautrix-meta" ];
 
@@ -23,13 +23,13 @@ buildGoModule rec {
     owner = "mautrix";
     repo = "meta";
     rev = "v${version}";
-    hash = "sha256-S8x3TGQEs+oh/3Q1Gz00M8dOcjjuHSgzVhqlbikZ8QE=";
+    hash = "sha256-UWW5h4e6usxVkMH1TDGt62/ThlAhbeqivnYFIKPOqXE=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-sUnvwPJQOoVzxbo2lS3CRcTrWsPjgYPsKClVw1wZJdM=";
+  vendorHash = "sha256-fJuCNhbm6930zPyfXA8mbjyJmRdv0Zn0ZZ+ULImXjKU=";
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/ma/mautrix-whatsapp/package.nix b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
index ff862f38d5f6..12438c912bc9 100644
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -14,19 +14,19 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-b56WCt71A1+TUN7ug3E/F8A99vqGJLJfHN49klZzx9I=";
+    hash = "sha256-6Fnkw/lf64T0EXpWvSSnIRBuHJVt01Ft8Ks43/jvtZ0=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-8Iu5rL42TFFqlClQf01kT86Hhb46qsPObjE1snuz1So=";
+  vendorHash = "sha256-zMS6zZvJQAcnoklCi5qoM+aMMCSaeTQmQBxawgC67P8=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index fbaad66f3da0..1e972d183729 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.15.0";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    hash = "sha256-mFCeetwMaqdxFt001QUEtoiPupRAtFBkTvIABszPQbc=";
+    hash = "sha256-dqWDp8vf4OkwSKSAoF92lFZhe5rT1lqQ2oMchUFrmdM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ms/msolve/package.nix b/pkgs/by-name/ms/msolve/package.nix
index a38a81c1d6e6..96d78e97af6d 100644
--- a/pkgs/by-name/ms/msolve/package.nix
+++ b/pkgs/by-name/ms/msolve/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "msolve";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "algebraic-solving";
     repo = "msolve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9IPDaIbcVp1LLkKSKnmyCEF+g7HKnmUklnbrkglWClg=";
+    hash = "sha256-3AP3qrFZX2JZveONtmG0CLpdwSCwlrW86D8QLRTW5kI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 7814426077f1..f9692fc4647b 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.405";
+  version = "0.0.406";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-a81ToAFJAay9KpVigVNknaaGbZeKN7FKYQ6XG1tzv+s=";
+    hash = "sha256-uhLde8+5EmG+jb+Yn4F4SvDimXjH337OwR5rhdsREpM=";
   };
 
-  vendorHash = "sha256-PoJy/tpjkUkxHiJZNFzl2UXj29iojwL9g6YrAEkSvKk=";
+  vendorHash = "sha256-hLxUr99gnEz2pFM0Dc8XCGgzMuoqzTmtP4Xp7vHF69U=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index 24d7b9898c5e..bcba1d8a6ad0 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -18,23 +18,23 @@
 
 buildGo123Module rec {
   pname = "navidrome";
-  version = "0.54.5";
+  version = "0.55.1";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${version}";
-    hash = "sha256-74sN2qZVjsD5i3BkJKYcpL3vZsVIg0H5RI70oRdZpi0=";
+    hash = "sha256-BkgHUX2kQ7OMnb9vOIwsQ9eNcqCzekz2IVMtG0IMUaA=";
   };
 
-  vendorHash = "sha256-bI0iDhATvNylKnI81eeUpgsm8YqySPyinPgBbcO0y4I=";
+  vendorHash = "sha256-IF2RaEsuHADnwONrvwbL6KZVrE3bZx1sX03zpmtQZq8=";
 
   npmRoot = "ui";
 
   npmDeps = fetchNpmDeps {
     inherit src;
     sourceRoot = "${src.name}/ui";
-    hash = "sha256-PaE1xcZX9wZRcKeqQCXbdhi4cIBWBL8ZQdww6AOB7sQ=";
+    hash = "sha256-lM8637tcKc9iSPjXJPDZXFCGj7pShOXTC6X2iketg90=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/newsraft/package.nix b/pkgs/by-name/ne/newsraft/package.nix
index 5304c5e83ee9..419bb9dc16ca 100644
--- a/pkgs/by-name/ne/newsraft/package.nix
+++ b/pkgs/by-name/ne/newsraft/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsraft";
-  version = "0.28";
+  version = "0.29";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "newsraft";
     repo = "newsraft";
     rev = "newsraft-${finalAttrs.version}";
-    hash = "sha256-iRoQLGmiAPpt9ZpvHpytIWHldkvV/5qVjurypCycJYI=";
+    hash = "sha256-6rDnGVOApSURuXom+XxPPOG7lxMbHGTL+4Oqrx+Jq2w=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 2034d9aae718..d08b3773c9af 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -20,17 +20,18 @@
   libGL,
   libglvnd,
   systemd,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-talk-desktop";
-  version = "1.0.1";
+  version = "1.1.5";
 
   # Building from source would require building also building Server and Talk components
   # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
   src = fetchzip {
     url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${finalAttrs.version}/Nextcloud.Talk-linux-x64.zip";
-    hash = "sha256-ZSNeuKZ+oi6tHO61RshtJ6ndtxvUJbY4gyhDwKpHXZI=";
+    hash = "sha256-KI6EJxsiIPjk+SBdqAwQNpaMZgVQSra/tqCGufQYSPs=";
     stripRoot = false;
   };
 
@@ -102,6 +103,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Nextcloud Talk Desktop Client";
     homepage = "https://github.com/nextcloud/talk-desktop";
diff --git a/pkgs/by-name/ni/nil/package.nix b/pkgs/by-name/ni/nil/package.nix
index 295cce5eeece..2847bac37ecc 100644
--- a/pkgs/by-name/ni/nil/package.nix
+++ b/pkgs/by-name/ni/nil/package.nix
@@ -2,7 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  nixVersions,
+  nix,
   nix-update-script,
 }:
 
@@ -20,9 +20,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-7TR/xTc66WpPszJDrpisVvHXl2+FGrUOskZAkGyY04Q=";
 
-  nativeBuildInputs = [
-    (lib.getBin nixVersions.latest)
-  ];
+  nativeBuildInputs = [ nix ];
 
   env.CFG_RELEASE = version;
 
diff --git a/pkgs/by-name/nu/nu_scripts/package.nix b/pkgs/by-name/nu/nu_scripts/package.nix
index ad0a8d132839..6ad760141faa 100644
--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nu_scripts";
-  version = "0-unstable-2025-02-28";
+  version = "0-unstable-2025-03-13";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "698e24064710f9dcaca8d378181c8b954e37ac6e";
-    hash = "sha256-VcPydbV2zEhQGJajBI1DRuJYJ/XKbTWsCGecDLGeLAs=";
+    rev = "861a99779d31010ba907e4d6aaf7b1629b9eb775";
+    hash = "sha256-L/ySTOTGijpu+6Bncg+Rn7MBd/R5liSSPLlfoQvg7ps=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/oh/oh-my-zsh/package.nix b/pkgs/by-name/oh/oh-my-zsh/package.nix
index 38bec0c943c8..139982212a54 100644
--- a/pkgs/by-name/oh/oh-my-zsh/package.nix
+++ b/pkgs/by-name/oh/oh-my-zsh/package.nix
@@ -19,14 +19,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2025-02-19";
+  version = "2025-03-11";
   pname = "oh-my-zsh";
 
   src = fetchFromGitHub {
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    rev = "6e7ac0544e71c7b777746cb50f70de68c6495b86";
-    sha256 = "sha256-d4w15ja5qe4axOwNyIoXZdVcgUedAIgZQrhINmNNJFw=";
+    rev = "f97e871c33da57d20e1b0411da6b1674126192a9";
+    sha256 = "sha256-L2g9kw5mFfIz+IwTSfdHN4O48tew6D807gJvrgtkjJM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index a082b4a9be26..44e931ecfee3 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "openfga";
-  version = "1.8.6";
+  version = "1.8.7";
 in
 
 buildGoModule {
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "openfga";
     repo = "openfga";
     rev = "v${version}";
-    hash = "sha256-MeEYWgfisojMQz+Q2GYtMMjBJVPwi8C8K0qTNQADQIA=";
+    hash = "sha256-gA/lyToqKWbReFocR4QytBpCqiLZmjQIpP3C8njc1YQ=";
   };
 
-  vendorHash = "sha256-5cg9PlcXGXTiizfIrC/ZiMeMqE4yNqPchmSP8nmWj3M=";
+  vendorHash = "sha256-eKo6GK/g93dsLxGYA5aw6nuUCVPNLdr2sKq5XOaJUJs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/openvas-scanner/package.nix b/pkgs/by-name/op/openvas-scanner/package.nix
index 87e51042bd59..9f4fe9af2277 100644
--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvas-scanner";
-  version = "23.16.0";
+  version = "23.16.1";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "openvas-scanner";
     tag = "v${version}";
-    hash = "sha256-ocMtXZHqeMgGoTdMF8OU7oSyps6G1PNth3qwnAxFlc8=";
+    hash = "sha256-/5vcK6ndqdur2CceAgEkMPQpWpghS3O8GuBe1s6ZPKg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index d91d2d443381..be65fe8c6887 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 buildGoModule rec {
   pname = "opnborg";
@@ -21,6 +22,8 @@ buildGoModule rec {
     "-w"
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/paepckehh/opnborg/releases/tag/v${version}";
     homepage = "https://paepcke.de/opnborg";
diff --git a/pkgs/by-name/ph/phraze/package.nix b/pkgs/by-name/ph/phraze/package.nix
index 6dd475eb8e5b..4d955ec9fa12 100644
--- a/pkgs/by-name/ph/phraze/package.nix
+++ b/pkgs/by-name/ph/phraze/package.nix
@@ -10,19 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "phraze";
-  version = "0.3.18";
+  version = "0.3.19";
 
   src = fetchFromGitHub {
     owner = "sts10";
     repo = "phraze";
     rev = "v${version}";
-    hash = "sha256-s021GUzclmE7nbsNXAhG0Kok+bAbLZTit9a1bK9YvGc=";
+    hash = "sha256-4RdPN2l0tQbxgTVxwdl0APYD8h9DrF9f5MIQkcozt48=";
   };
 
   doCheck = true;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QljZRl+RQDL5TAAVFQ5jyHaRygjB5vfVFMF54UeSCdw=";
+  cargoHash = "sha256-hXo1pdbOZ/qNDTm3CcmOIgef7u6Imn25luJdsCVeg5I=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pixelflasher/package.nix b/pkgs/by-name/pi/pixelflasher/package.nix
new file mode 100644
index 000000000000..c946c22dbd0b
--- /dev/null
+++ b/pkgs/by-name/pi/pixelflasher/package.nix
@@ -0,0 +1,99 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  wrapGAppsHook3,
+  python3Packages,
+  makeDesktopItem,
+  copyDesktopItems,
+  nix-update-script,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "pixelflasher";
+  version = "7.11.1.0";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "badabing2005";
+    repo = "PixelFlasher";
+    tag = "v${version}";
+    hash = "sha256-1h0rHiYi3buLZjWFjJoTDWckeEBtZwFVRNscS3wsD3o=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "PixelFlasher";
+      exec = "pixelflasher";
+      icon = "pixelflasher";
+      desktopName = "PixelFlasher";
+      genericName = "Pixel™ phone flashing GUI utility with features";
+      categories = [ "Development" ];
+    })
+  ];
+
+  dependencies = with python3Packages; [
+    attrdict
+    beautifulsoup4
+    bsdiff4
+    chardet
+    cryptography
+    darkdetect
+    httplib2
+    json5
+    lz4
+    markdown
+    platformdirs
+    protobuf4
+    psutil
+    pyperclip
+    requests
+    rsa
+    six
+    wxpython
+  ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    python3Packages.pyinstaller
+    copyDesktopItems
+  ];
+
+  buildPhase =
+    let
+      specFile =
+        if stdenv.hostPlatform.isDarwin then
+          if stdenv.hostPlatform.isAarch64 then "build-on-mac" else "build-on-mac-intel-only"
+        else
+          "build-on-linux";
+    in
+    ''
+      runHook preBuild
+
+      pyinstaller --clean --noconfirm --log-level=DEBUG ${specFile}.spec
+
+      runHook postBuild
+    '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share/icons/hicolor/64x64/apps
+    cp dist/PixelFlasher $out/bin/pixelflasher
+    cp images/icon-64.png $out/share/icons/hicolor/64x64/apps/pixelflasher.png
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pixel™ phone flashing GUI utility with features";
+    homepage = "https://github.com/badabing2005/PixelFlasher";
+    changelog = "https://github.com/badabing2005/PixelFlasher/releases/tag/v${version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ cything ];
+    mainProgram = "pixelflasher";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/po/poke/package.nix b/pkgs/by-name/po/poke/package.nix
index 51b8b4e94798..18b8fa83446b 100644
--- a/pkgs/by-name/po/poke/package.nix
+++ b/pkgs/by-name/po/poke/package.nix
@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poke";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "mirror://gnu/poke/poke-${finalAttrs.version}.tar.gz";
-    hash = "sha256-iq825h42elMUDqQOJVnp7FEud5xCvuNOesJLNLoRm94=";
+    hash = "sha256-qEy5F11Q1FpBHySB/QZiuDyzLOUXMWuInPtXCBlXk3M=";
   };
 
   outputs =
@@ -97,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Interactive, extensible editor for binary data";
     homepage = "http://www.jemarch.net/poke";
-    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/ChangeLog?h=releases/poke-${finalAttrs.version}";
+    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/NEWS?h=releases/poke-${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ kira-bruneau ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/pr/prowlarr/package.nix b/pkgs/by-name/pr/prowlarr/package.nix
index 148d6baf185a..41052aba6f28 100644
--- a/pkgs/by-name/pr/prowlarr/package.nix
+++ b/pkgs/by-name/pr/prowlarr/package.nix
@@ -37,16 +37,16 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-F6q0JFiwESTenh9xAjqoqqQh911d8DMEWYm3CrYHoxI=";
-      aarch64-linux = "sha256-izh5er3uLUKFMjUCiZYBqtS9sosicSCo+qvavcnX/6s=";
-      x86_64-darwin = "sha256-BLklmXj8UbN8jjEXnHe1xsr2fF5H1enwztbKDU3IpPU=";
-      x86_64-linux = "sha256-aiH4bv47cnBzUtFwfJfmrY+2LaqgZkRXT2Jx8FkSX7M=";
+      aarch64-darwin = "sha256-ZKs6zHcwRrzwRqJWs6pAAnfn7oiu2D6HclIj2/ADEm4=";
+      aarch64-linux = "sha256-QJHJQEP5OBgMpCdOxURP98+e6mMBcNTAYSCORKnFXpw=";
+      x86_64-darwin = "sha256-k3DchyolwqszS6m0N1t1tdqFCUvBrDrhKIQ56E74bUQ=";
+      x86_64-linux = "sha256-7HKf5Pn0PUo3NPMdEcrw9dZl4EJkrchi2k9jtfqiXlg=";
     }
     .${stdenv.hostPlatform.system} or unsupported;
 in
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.30.2.4939";
+  version = "1.31.2.4975";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/by-name/ra/rabbit/fix-file-loading.patch b/pkgs/by-name/ra/rabbit/fix-file-loading.patch
new file mode 100644
index 000000000000..3b5db5527fcc
--- /dev/null
+++ b/pkgs/by-name/ra/rabbit/fix-file-loading.patch
@@ -0,0 +1,47 @@
+From 3488de815355051d2e369c7fe48a35dabf695cfc Mon Sep 17 00:00:00 2001
+From: Pol Dellaiera <pol.dellaiera@protonmail.com>
+Date: Mon, 17 Mar 2025 16:52:25 +0100
+Subject: [PATCH] fix file loading
+
+---
+ rabbit.py | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/rabbit.py b/rabbit.py
+index a1826d3..697c880 100644
+--- a/rabbit.py
++++ b/rabbit.py
+@@ -9,6 +9,7 @@ from sklearn.ensemble import GradientBoostingClassifier
+ import joblib
+ import site
+ from tqdm import tqdm
++from importlib.resources import files
+ 
+ import GenerateActivities as gat
+ import ExtractEvent as eev
+@@ -59,15 +60,13 @@ def get_model():
+     '''
+ 
+     model_file = 'bimbas.joblib'
+-    for dir in site.getsitepackages():
+-        if dir.endswith('site-packages'):
+-            target_dir = dir
+-        else:
+-            target_dir = site.getsitepackages()[0]
+-    bot_identification_model = joblib.load(f'{target_dir}/{model_file}')
+-    # bot_identification_model = joblib.load(model_file)
+-    
+-    return(bot_identification_model)
++    try:
++      resource_path = files("rabbit").joinpath(model_file)
++      bot_identification_model = joblib.load(resource_path)
++    except Exception as e:
++      raise RuntimeError(f"Failed to load the model: {e}")
++
++    return bot_identification_model
+ 
+ def compute_confidence(probability_value):
+     '''
+-- 
+2.48.1
+
diff --git a/pkgs/by-name/ra/rabbit/package.nix b/pkgs/by-name/ra/rabbit/package.nix
index e13cc97328a0..d243b98b845b 100644
--- a/pkgs/by-name/ra/rabbit/package.nix
+++ b/pkgs/by-name/ra/rabbit/package.nix
@@ -2,10 +2,39 @@
   lib,
   python3,
   fetchFromGitHub,
+  fetchPypi,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python3' =
+    let
+      packageOverrides = self: super: {
+        scikit-learn = super.scikit-learn.overridePythonAttrs (old: {
+          version = "1.5.2";
+
+          src = fetchPypi {
+            pname = "scikit_learn";
+            version = "1.5.2";
+            hash = "sha256-tCN+17P90KSIJ5LmjvJUXVuqUKyju0WqffRoE4rY+U0=";
+          };
+
+          # There are 2 tests that are failing, disabling the tests for now.
+          # - test_csr_polynomial_expansion_index_overflow[csr_array-False-True-2-65535]
+          # - test_csr_polynomial_expansion_index_overflow[csr_array-False-True-3-2344]
+          doCheck = false;
+        });
+      };
+    in
+    python3.override {
+      inherit packageOverrides;
+      self = python3;
+    };
+in
+python3'.pkgs.buildPythonApplication rec {
   pname = "rabbit";
+  # Make sure to check for which version of scikit-learn this project was built
+  # Currently version 2.3.1 is made with scikit-learn 1.5.2
+  # Upgrading to newer versions of scikit-learn break the project
   version = "2.3.1";
   pyproject = true;
 
@@ -16,6 +45,12 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-QmP6yfVnlYoNVa4EUtKR9xbCnQW2V6deV0+hN9IGtic=";
   };
 
+  patches = [
+    # Fix file loading, to be removed at the next bump.
+    # The author has been notified about the issue and currently working on it.
+    ./fix-file-loading.patch
+  ];
+
   pythonRelaxDeps = [
     "numpy"
     "scikit-learn"
@@ -24,11 +59,11 @@ python3.pkgs.buildPythonApplication rec {
     "urllib3"
   ];
 
-  build-system = with python3.pkgs; [
+  build-system = with python3'.pkgs; [
     setuptools
   ];
 
-  dependencies = with python3.pkgs; [
+  dependencies = with python3'.pkgs; [
     joblib
     numpy
     pandas
diff --git a/pkgs/by-name/ra/radicale/package.nix b/pkgs/by-name/ra/radicale/package.nix
index eb088074a237..c38563550262 100644
--- a/pkgs/by-name/ra/radicale/package.nix
+++ b/pkgs/by-name/ra/radicale/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.4.1";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     tag = "v${version}";
-    hash = "sha256-4GnSd1kkUbOMhUwIi8ac3dMNFAzhr7tj0RKNdZElMsw=";
+    hash = "sha256-OWOCwioW0TPVk6vIkfVuAaYJdIWJ6Do4NcYWR/b3sQs=";
   };
 
   build-system = with python3.pkgs; [
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = {
     homepage = "https://radicale.org/v3.html";
-    changelog = "https://github.com/Kozea/Radicale/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/Kozea/Radicale/blob/${src.tag}/CHANGELOG.md";
     description = "CalDAV and CardDAV server";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/re/recordbox/Cargo.lock b/pkgs/by-name/re/recordbox/Cargo.lock
index 9e17fe481bd5..32cada0f8945 100644
--- a/pkgs/by-name/re/recordbox/Cargo.lock
+++ b/pkgs/by-name/re/recordbox/Cargo.lock
@@ -17,7 +17,7 @@ dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
- "zerocopy",
+ "zerocopy 0.7.35",
 ]
 
 [[package]]
@@ -46,20 +46,20 @@ dependencies = [
 
 [[package]]
 name = "ashpd"
-version = "0.10.2"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9c39d707614dbcc6bed00015539f488d8e3fe3e66ed60961efc0c90f4b380b3"
+checksum = "de3d60bee1a1d38c2077030f4788e1b4e31058d2e79a8cfc8f2b440bd44db290"
 dependencies = [
  "async-fs",
  "async-net",
  "enumflags2",
  "futures-channel",
  "futures-util",
- "rand",
+ "rand 0.8.5",
  "serde",
  "serde_repr",
  "url",
- "zbus 5.3.0",
+ "zbus 5.5.0",
 ]
 
 [[package]]
@@ -149,7 +149,7 @@ dependencies = [
  "futures-lite",
  "parking",
  "polling",
- "rustix",
+ "rustix 0.38.44",
  "slab",
  "tracing",
  "windows-sys 0.59.0",
@@ -192,7 +192,7 @@ dependencies = [
  "cfg-if",
  "event-listener 5.4.0",
  "futures-lite",
- "rustix",
+ "rustix 0.38.44",
  "tracing",
 ]
 
@@ -219,7 +219,7 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "rustix",
+ "rustix 0.38.44",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.59.0",
@@ -227,9 +227,9 @@ dependencies = [
 
 [[package]]
 name = "async-std"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c634475f29802fde2b8f0b505b1bd00dfe4df7d4a000f0b36f7671197d5c3615"
+checksum = "730294c1c08c2e0f85759590518f6333f0d5a0a766a27d519c1b244c3dfd8a24"
 dependencies = [
  "async-channel 1.9.0",
  "async-global-executor",
@@ -260,9 +260,9 @@ checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
 
 [[package]]
 name = "async-trait"
-version = "0.1.85"
+version = "0.1.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f934833b4b7233644e5848f235df3f57ed8c80f1528a26c3dfa13d2147fa056"
+checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -301,9 +301,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.7.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1be3f42a67d6d345ecd59f675f3f012d6974981560836e938c22b424b85ce1be"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "block"
@@ -335,15 +335,15 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.16.0"
+version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
 [[package]]
 name = "bytemuck"
-version = "1.21.0"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
+checksum = "b6b1fc10dbac614ebc03540c9dbd60e83887fda27794998c6528f1782047d540"
 
 [[package]]
 name = "byteorder"
@@ -383,7 +383,7 @@ version = "0.20.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae50b5510d86cf96ac2370e66d8dc960882f3df179d6a5a1e52bd94a1416c0f7"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "cairo-sys-rs",
  "glib",
  "libc",
@@ -402,9 +402,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.9"
+version = "1.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8293772165d9345bdaaa39b45b2109591e63fe5e6fbc23c6ff930a048aa310b"
+checksum = "be714c154be609ec7f5dad223a33bf1482fff90472de28f7362806e6d4832b8c"
 dependencies = [
  "shlex",
 ]
@@ -433,14 +433,14 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.39"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
+checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -475,9 +475,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
 ]
@@ -527,9 +527,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.7.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e60eed09d8c01d3cee5b7d30acb059b76614c918fa0f992e0dd6eeb10daad6f"
+checksum = "575f75dfd25738df5b91b8e43e14d44bda14637a58fae779fd2b064f8bf3e010"
 
 [[package]]
 name = "digest"
@@ -554,9 +554,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "endi"
@@ -566,9 +566,9 @@ checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf"
 
 [[package]]
 name = "enumflags2"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d232db7f5956f3f14313dc2f87985c58bd2c695ce124c8cdd984e08e15ac133d"
+checksum = "ba2f4b465f5318854c6f8dd686ede6c0a9dc67d4b1ac241cf0eb51521a309147"
 dependencies = [
  "enumflags2_derive",
  "serde",
@@ -576,9 +576,9 @@ dependencies = [
 
 [[package]]
 name = "enumflags2_derive"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de0d48a183585823424a4ce1aa132d174a6a81bd540895822eb4c8373a8e49e8"
+checksum = "fc4caf64a58d7a6d65ab00639b046ff54399a39f5f2554728895ace4b297cd79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -587,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
@@ -679,9 +679,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.0.35"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
+checksum = "11faaf5a5236997af9848be0bef4db95824b1d534ebc64d0f0c6cf3e67bd38dc"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -697,7 +697,7 @@ dependencies = [
  "log",
  "nu-ansi-term 0.50.1",
  "regex",
- "thiserror 2.0.11",
+ "thiserror 2.0.12",
 ]
 
 [[package]]
@@ -831,9 +831,9 @@ dependencies = [
 
 [[package]]
 name = "gdk-pixbuf"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6efc7705f7863d37b12ad6974cbb310d35d054f5108cdc1e69037742f573c4c"
+checksum = "7563afd6ff0a221edfbb70a78add5075b8d9cb48e637a40a24c3ece3fea414d0"
 dependencies = [
  "gdk-pixbuf-sys",
  "gio",
@@ -856,9 +856,9 @@ dependencies = [
 
 [[package]]
 name = "gdk4"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0196720118f880f71fe7da971eff58cc43a89c9cf73f46076b7cb1e60889b15"
+checksum = "4850c9d9c1aecd1a3eb14fadc1cdb0ac0a2298037e116264c7473e1740a32d60"
 dependencies = [
  "cairo-rs",
  "gdk-pixbuf",
@@ -871,9 +871,9 @@ dependencies = [
 
 [[package]]
 name = "gdk4-sys"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b0e1340bd15e7a78810cf39fed9e5d85f0a8f80b1d999d384ca17dcc452b60"
+checksum = "6f6eb95798e2b46f279cf59005daf297d5b69555428f185650d71974a910473a"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -917,7 +917,19 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a49c392881ce6d5c3b8cb70f98717b7c07aabbdff06687b9030dbfbe2725f8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.13.3+wasi-0.2.2",
+ "windows-targets",
 ]
 
 [[package]]
@@ -942,9 +954,9 @@ dependencies = [
 
 [[package]]
 name = "gio"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a517657589a174be9f60c667f1fec8b7ac82ed5db4ebf56cf073a3b5955d8e2e"
+checksum = "a4f00c70f8029d84ea7572dd0e1aaa79e5329667b4c17f329d79ffb1e6277487"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -959,9 +971,9 @@ dependencies = [
 
 [[package]]
 name = "gio-sys"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8446d9b475730ebef81802c1738d972db42fde1c5a36a627ebc4d665fc87db04"
+checksum = "160eb5250a26998c3e1b54e6a3d4ea15c6c7762a6062a19a7b63eff6e2b33f9e"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -972,11 +984,11 @@ dependencies = [
 
 [[package]]
 name = "glib"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f969edf089188d821a30cde713b6f9eb08b20c63fc2e584aba2892a7984a8cc0"
+checksum = "707b819af8059ee5395a2de9f2317d87a53dbad8846a2f089f0bb44703f37686"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -1006,9 +1018,9 @@ dependencies = [
 
 [[package]]
 name = "glib-sys"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b360ff0f90d71de99095f79c526a5888c9c92fc9ee1b19da06c6f5e75f0c2a53"
+checksum = "a8928869a44cfdd1fccb17d6746e4ff82c8f82e41ce705aa026a52ca8dc3aefb"
 dependencies = [
  "libc",
  "system-deps",
@@ -1028,9 +1040,9 @@ dependencies = [
 
 [[package]]
 name = "gobject-sys"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a56235e971a63bfd75abb13ef70064e1346388723422a68580d8a6fbac6423"
+checksum = "c773a3cb38a419ad9c26c81d177d96b4b08980e8bdbbf32dace883e96e96e7e3"
 dependencies = [
  "glib-sys",
  "libc",
@@ -1039,9 +1051,9 @@ dependencies = [
 
 [[package]]
 name = "graphene-rs"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f39d3bcd2e24fd9c2874a56f277b72c03e728de9bdc95a8d4ef4c962f10ced98"
+checksum = "3cbc5911bfb32d68dcfa92c9510c462696c2f715548fcd7f3f1be424c739de19"
 dependencies = [
  "glib",
  "graphene-sys",
@@ -1062,9 +1074,9 @@ dependencies = [
 
 [[package]]
 name = "gsk4"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b9188db0a6219e708b6b6e7225718e459def664023dbddb8395ca1486d8102"
+checksum = "61f5e72f931c8c9f65fbfc89fe0ddc7746f147f822f127a53a9854666ac1f855"
 dependencies = [
  "cairo-rs",
  "gdk4",
@@ -1077,9 +1089,9 @@ dependencies = [
 
 [[package]]
 name = "gsk4-sys"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bca10fc65d68528a548efa3d8747934adcbe7058b73695c9a7f43a25352fce14"
+checksum = "755059de55fa6f85a46bde8caf03e2184c96bfda1f6206163c72fb0ea12436dc"
 dependencies = [
  "cairo-sys-rs",
  "gdk4-sys",
@@ -1093,9 +1105,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "700cb1b2e86dda424f85eb728102a111602317e40b4dd71cf1c0dc04e0cc5d95"
+checksum = "2188fe829b0ebe12e4cf2bbcf6658470a936269daba7afae92847a2af32c9105"
 dependencies = [
  "cfg-if",
  "futures-channel",
@@ -1113,14 +1125,14 @@ dependencies = [
  "paste",
  "pin-project-lite",
  "smallvec",
- "thiserror 2.0.11",
+ "thiserror 2.0.12",
 ]
 
 [[package]]
 name = "gstreamer-audio"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52a6009b5c9c942cab1089956a501bd63778e65a3e69310949d173e90e2cdda2"
+checksum = "49118ca684e2fc42207509fcac8497d91079c2ffe8ff2b4ae99e71dbafef1ede"
 dependencies = [
  "cfg-if",
  "glib",
@@ -1134,9 +1146,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-audio-sys"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef70a3d80e51ef9a45749a844cb8579d4cabe5ff59cb43a65d6f3a377943262f"
+checksum = "7d469526ecf30811b50a6460fd285ee40d189c46048b3d0c69b67a04b414fb51"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1148,9 +1160,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-base"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d152db7983f98d5950cf64e53805286548063475fb61a5e5450fba4cec05899b"
+checksum = "ad33dd444db0d215ac363164f900f800ffb93361ad8a60840e95e14b7de985e8"
 dependencies = [
  "atomic_refcell",
  "cfg-if",
@@ -1162,9 +1174,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-base-sys"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d47cc2d15f2a3d5eb129e5dacbbeec9600432b706805c15dff57b6aa11b2791c"
+checksum = "114b2a704f19a70f20c54b00e54f5d5376bbf78bd2791e6beb0776c997d8bf24"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1175,9 +1187,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-play"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d7a815750a28ac838bfd745d6da07cfd142bb2fa471397cd9992c8b6f235665"
+checksum = "6ef455584b832e9fdc76f7952b9432eaee2fd287157b03cf2bc0e83f1b41619c"
 dependencies = [
  "glib",
  "gstreamer",
@@ -1188,9 +1200,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-play-sys"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8ef790b8a697c759a9bbbaa7b0c061f529c4581e0cc72839ae753af533591"
+checksum = "b01c1c4f09cb6709c7da2532b3fcbc14da9006d508baee606328080e46f491f5"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1202,9 +1214,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-sys"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16cf1ae0a869aa7066ce3c685b76053b4b4f48f364a5b18c4b1f36ef57469719"
+checksum = "fe159238834058725808cf6604a7c5d9e4a50e1eacd7b0c63bce2fe3a067dbd1"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1214,9 +1226,9 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-video"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fa41e40319e923236e96f0b691711d1504746ab9c89607d77d22aa84777f33f"
+checksum = "ad242d388b63c91652c8157de3b0c1f709e49c941a0aae1952455f6ee326ca2d"
 dependencies = [
  "cfg-if",
  "futures-channel",
@@ -1226,14 +1238,14 @@ dependencies = [
  "gstreamer-video-sys",
  "libc",
  "once_cell",
- "thiserror 2.0.11",
+ "thiserror 2.0.12",
 ]
 
 [[package]]
 name = "gstreamer-video-sys"
-version = "0.23.4"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31dc0f49c117f4867b0f98c712aa55ebf25580151d794be8f9179ec2d877fd14"
+checksum = "465ff496889fb38be47f5e821163c2e83414d87c4aa55f5aae62dc7200971d4d"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1245,9 +1257,9 @@ dependencies = [
 
 [[package]]
 name = "gtk4"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b697ff938136625f6acf75f01951220f47a45adcf0060ee55b4671cf734dac44"
+checksum = "af1c491051f030994fd0cde6f3c44f3f5640210308cff1298c7673c47408091d"
 dependencies = [
  "cairo-rs",
  "field-offset",
@@ -1278,9 +1290,9 @@ dependencies = [
 
 [[package]]
 name = "gtk4-sys"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3af4b680cee5d2f786a2f91f1c77e95ecf2254522f0ca4edf3a2dce6cb35cecf"
+checksum = "41e03b01e54d77c310e1d98647d73f996d04b2f29b9121fe493ea525a7ec03d6"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -1501,9 +1513,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.7.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
+checksum = "3954d50fe15b02142bf25d3b8bdadb634ec3948f103d04ffe3031bc8fe9d7058"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
@@ -1515,7 +1527,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f37dccff2791ab604f9babef0ba14fbe0be30bd368dc541e2b08d07c8aa908f3"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "inotify-sys",
  "libc",
 ]
@@ -1540,9 +1552,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "js-sys"
@@ -1628,9 +1640,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.171"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
 
 [[package]]
 name = "libredox"
@@ -1638,7 +1650,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "libc",
  "redox_syscall",
 ]
@@ -1660,10 +1672,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
 [[package]]
-name = "litemap"
-version = "0.7.4"
+name = "linux-raw-sys"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+checksum = "fe7db12097d22ec582439daf8618b8fdd1a7bef6270e9af3b1ebcd30893cf413"
+
+[[package]]
+name = "litemap"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
 
 [[package]]
 name = "locale_config"
@@ -1690,9 +1708,9 @@ dependencies = [
 
 [[package]]
 name = "lofty"
-version = "0.22.1"
+version = "0.22.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c45b1baaa65506d6f6fe3a7dce7efae02d7d7fbe89907731686a39ab247a49"
+checksum = "781de624f162b1a8cbfbd577103ee9b8e5f62854b053ff48f4e31e68a0a7df6f"
 dependencies = [
  "byteorder",
  "data-encoding",
@@ -1705,9 +1723,9 @@ dependencies = [
 
 [[package]]
 name = "lofty_attr"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28bd4b9d8a5af74808932492521cdd272019b056f75fcc70056bd2c09fceb550"
+checksum = "ed9983e64b2358522f745c1251924e3ab7252d55637e80f6a0a3de642d6a9efc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1716,9 +1734,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.25"
+version = "0.4.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
+checksum = "30bde2b3dc3671ae49d8e2e9f044c7c005836e7a023ee57cffa25ab82764bb9e"
 dependencies = [
  "value-bag",
 ]
@@ -1819,9 +1837,9 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8402cab7aefae129c6977bb0ff1b8fd9a04eb5b51efc50a70bea51cda0c7924"
+checksum = "8e3e04debbb59698c15bacbb6d93584a8c0ca9cc3213cb423d31f760d8843ce5"
 dependencies = [
  "adler2",
 ]
@@ -1834,7 +1852,7 @@ checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
  "libc",
  "log",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.52.0",
 ]
 
@@ -1885,7 +1903,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1898,7 +1916,7 @@ version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2fee8403b3d66ac7b26aee6e40a897d85dc5ce26f44da36b8b73e987cc52e943"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "filetime",
  "fsevent-sys",
  "inotify",
@@ -2017,9 +2035,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.2"
+version = "1.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+checksum = "d75b0bedcc4fe52caa0e03d9f1151a323e4aa5e2d78ba3580400cd3c9e2bc4bc"
 
 [[package]]
 name = "option-operations"
@@ -2048,9 +2066,9 @@ checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "pango"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e89bd74250a03a05cec047b43465469102af803be2bf5e5a1088f8b8455e087"
+checksum = "6b1f5dc1b8cf9bc08bfc0843a04ee0fa2e78f1e1fa4b126844a383af4f25f0ec"
 dependencies = [
  "gio",
  "glib",
@@ -2060,9 +2078,9 @@ dependencies = [
 
 [[package]]
 name = "pango-sys"
-version = "0.20.7"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71787e0019b499a5eda889279e4adb455a4f3fdd6870cd5ab7f4a5aa25df6699"
+checksum = "0dbb9b751673bd8fe49eb78620547973a1e719ed431372122b20abd12445bab5"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -2096,7 +2114,7 @@ dependencies = [
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -2136,9 +2154,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
 name = "polling"
@@ -2150,49 +2168,49 @@ dependencies = [
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
- "rustix",
+ "rustix 0.38.44",
  "tracing",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "portable-atomic"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.8.23",
 ]
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.2.0"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecf48c7ca261d60b74ab1a7b20da18bede46776b2e55535cb958eb595c5fa7b"
+checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
 dependencies = [
  "toml_edit",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.93"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -2226,8 +2244,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+ "zerocopy 0.8.23",
 ]
 
 [[package]]
@@ -2237,7 +2266,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
@@ -2246,12 +2285,21 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.1",
 ]
 
 [[package]]
 name = "recordbox"
-version = "0.9.2"
+version = "0.9.3"
 dependencies = [
  "ashpd",
  "async-channel 2.3.1",
@@ -2279,7 +2327,7 @@ dependencies = [
  "notify-debouncer-full",
  "r2d2",
  "r2d2_sqlite",
- "rand",
+ "rand 0.8.5",
  "rusqlite",
  "rusqlite_migration",
  "search-provider",
@@ -2293,22 +2341,23 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.8"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
 name = "reflink-copy"
-version = "0.1.22"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7aea22fc8204e0f291719120cbcdae4f25f0807d7b00f5b6b27d95a8f1a2ad"
+checksum = "4b86038e146b9a61557e1a2e58cdf2eddc0b46ce141b55541b1c1b9f3189d618"
 dependencies = [
  "cfg-if",
- "rustix",
- "windows 0.59.0",
+ "libc",
+ "rustix 1.0.2",
+ "windows 0.60.0",
 ]
 
 [[package]]
@@ -2370,7 +2419,7 @@ version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -2399,28 +2448,41 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.43"
+version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a78891ee6bf2340288408954ac787aa063d8e8817e9f53abb37c695c6d834ef6"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.9.0",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7178faa4b75a30e269c71e61c353ce2748cf3d76f0c44c393f4e60abf49b825"
+dependencies = [
+ "bitflags 2.9.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.3",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "same-file"
@@ -2466,24 +2528,24 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 
 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2492,9 +2554,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.135"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b0d7ba2887406110130a978386c4e1befb98c674b4fba677954e4db976630d9"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -2504,9 +2566,9 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2590,9 +2652,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
 
 [[package]]
 name = "ssri"
@@ -2644,9 +2706,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.96"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2697,15 +2759,14 @@ checksum = "bc1ee6eef34f12f765cb94725905c6312b6610ab2b0940889cfe58dae7bc3c72"
 
 [[package]]
 name = "tempfile"
-version = "3.15.0"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8a559c81686f576e8cd0290cd2a24a2a9ad80c98b3478856500fcbd7acd704"
+checksum = "488960f40a3fd53d72c2a29a58722561dee8afdd175bd88e3db4677d7b2ba600"
 dependencies = [
- "cfg-if",
  "fastrand",
- "getrandom",
+ "getrandom 0.3.1",
  "once_cell",
- "rustix",
+ "rustix 1.0.2",
  "windows-sys 0.59.0",
 ]
 
@@ -2720,11 +2781,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.11"
+version = "2.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d452f284b73e6d76dd36758a0c8684b1d5be31f92b89d07fd5822175732206fc"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
 dependencies = [
- "thiserror-impl 2.0.11",
+ "thiserror-impl 2.0.12",
 ]
 
 [[package]]
@@ -2740,9 +2801,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.11"
+version = "2.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26afc1baea8a989337eeb52b6e72a039780ce45c3edfcc9c5b9d112feeb173c2"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2771,9 +2832,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.19"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -2792,9 +2853,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.22"
+version = "0.22.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
 dependencies = [
  "indexmap",
  "serde",
@@ -2887,9 +2948,9 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
 name = "uds_windows"
@@ -2910,9 +2971,9 @@ checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.14"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unicode-width"
@@ -2952,19 +3013,19 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.12.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "744018581f9a3454a9e15beb8a33b017183f1e7c0cd170232a2d1453b23a51c4"
+checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
 dependencies = [
- "getrandom",
- "rand",
+ "getrandom 0.3.1",
+ "rand 0.9.0",
 ]
 
 [[package]]
 name = "valuable"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "value-bag"
@@ -3006,6 +3067,15 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
+[[package]]
+name = "wasi"
+version = "0.13.3+wasi-0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -3125,17 +3195,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
 dependencies = [
  "windows-core 0.58.0",
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows"
-version = "0.59.0"
+version = "0.60.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f919aee0a93304be7f62e8e5027811bbba96bcb1de84d6618be56e43f8a32a1"
+checksum = "ddf874e74c7a99773e62b1c671427abf01a425e77c3d3fb9fb1e4883ea934529"
 dependencies = [
- "windows-core 0.59.0",
- "windows-targets 0.53.0",
+ "windows-collections",
+ "windows-core 0.60.1",
+ "windows-future",
+ "windows-link",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5467f79cc1ba3f52ebb2ed41dbb459b8e7db636cc3429458d9a852e15bc24dec"
+dependencies = [
+ "windows-core 0.60.1",
 ]
 
 [[package]]
@@ -3144,7 +3226,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3157,20 +3239,30 @@ dependencies = [
  "windows-interface 0.58.0",
  "windows-result 0.2.0",
  "windows-strings 0.1.0",
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-core"
-version = "0.59.0"
+version = "0.60.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "810ce18ed2112484b0d4e15d022e5f598113e220c53e373fb31e67e21670c1ce"
+checksum = "ca21a92a9cae9bf4ccae5cf8368dce0837100ddf6e6d57936749e85f152f6247"
 dependencies = [
  "windows-implement 0.59.0",
  "windows-interface 0.59.0",
- "windows-result 0.3.0",
- "windows-strings 0.3.0",
- "windows-targets 0.53.0",
+ "windows-link",
+ "windows-result 0.3.1",
+ "windows-strings 0.3.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a787db4595e7eb80239b74ce8babfb1363d8e343ab072f2ffe901400c03349f0"
+dependencies = [
+ "windows-core 0.60.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -3217,22 +3309,38 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dccfd733ce2b1753b03b6d3c65edf020262ea35e20ccdf3e288043e6dd620e3"
+
+[[package]]
+name = "windows-numerics"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005dea54e2f6499f2cee279b8f703b3cf3b5734a2d8d21867c8f44003182eeed"
+dependencies = [
+ "windows-core 0.60.1",
+ "windows-link",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-result"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d08106ce80268c4067c0571ca55a9b4e9516518eaa1a1fe9b37ca403ae1d1a34"
+checksum = "06374efe858fab7e4f881500e6e86ec8bc28f9462c47e5a9941a0142ad86b189"
 dependencies = [
- "windows-targets 0.53.0",
+ "windows-link",
 ]
 
 [[package]]
@@ -3242,16 +3350,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
 dependencies = [
  "windows-result 0.2.0",
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b888f919960b42ea4e11c2f408fadb55f78a9f236d5eef084103c8ce52893491"
+checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
 dependencies = [
- "windows-targets 0.53.0",
+ "windows-link",
 ]
 
 [[package]]
@@ -3260,7 +3368,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3269,7 +3377,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3278,30 +3386,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
-dependencies = [
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -3310,105 +3402,66 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
-
 [[package]]
 name = "winnow"
-version = "0.6.24"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d71a593cc5c42ad7876e2c1fda56f314f3754c084128833e64f1345ff8a03a"
+checksum = "0e97b544156e9bebe1a0ffbc03484fc1ffe3100cbce3ffb17eac35f7cdd7ab36"
 dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+dependencies = [
+ "bitflags 2.9.0",
+]
+
 [[package]]
 name = "write16"
 version = "1.0.0"
@@ -3485,7 +3538,7 @@ dependencies = [
  "hex",
  "nix",
  "ordered-stream",
- "rand",
+ "rand 0.8.5",
  "serde",
  "serde_repr",
  "sha1",
@@ -3501,9 +3554,9 @@ dependencies = [
 
 [[package]]
 name = "zbus"
-version = "5.3.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "192a0d989036cd60a1e91a54c9851fb9ad5bd96125d41803eed79d2e2ef74bd7"
+checksum = "59c333f648ea1b647bc95dc1d34807c8e25ed7a6feff3394034dc4776054b236"
 dependencies = [
  "async-broadcast",
  "async-executor",
@@ -3518,7 +3571,7 @@ dependencies = [
  "enumflags2",
  "event-listener 5.4.0",
  "futures-core",
- "futures-util",
+ "futures-lite",
  "hex",
  "nix",
  "ordered-stream",
@@ -3530,9 +3583,9 @@ dependencies = [
  "windows-sys 0.59.0",
  "winnow",
  "xdg-home",
- "zbus_macros 5.3.0",
- "zbus_names 4.1.1",
- "zvariant 5.2.0",
+ "zbus_macros 5.5.0",
+ "zbus_names 4.2.0",
+ "zvariant 5.4.0",
 ]
 
 [[package]]
@@ -3550,17 +3603,17 @@ dependencies = [
 
 [[package]]
 name = "zbus_macros"
-version = "5.3.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3685b5c81fce630efc3e143a4ded235b107f1b1cdf186c3f115529e5e5ae4265"
+checksum = "f325ad10eb0d0a3eb060203494c3b7ec3162a01a59db75d2deee100339709fc0"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
  "syn",
- "zbus_names 4.1.1",
- "zvariant 5.2.0",
- "zvariant_utils 3.1.0",
+ "zbus_names 4.2.0",
+ "zvariant 5.4.0",
+ "zvariant_utils 3.2.0",
 ]
 
 [[package]]
@@ -3576,14 +3629,14 @@ dependencies = [
 
 [[package]]
 name = "zbus_names"
-version = "4.1.1"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "519629a3f80976d89c575895b05677cbc45eaf9f70d62a364d819ba646409cc8"
+checksum = "7be68e64bf6ce8db94f63e72f0c7eb9a60d733f7e0499e628dfab0f84d6bcb97"
 dependencies = [
  "serde",
  "static_assertions",
  "winnow",
- "zvariant 5.2.0",
+ "zvariant 5.4.0",
 ]
 
 [[package]]
@@ -3592,8 +3645,16 @@ version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
- "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd97444d05a4328b90e75e503a34bad781f14e28a823ad3557f0750df1ebcbc6"
+dependencies = [
+ "zerocopy-derive 0.8.23",
 ]
 
 [[package]]
@@ -3608,19 +3669,30 @@ dependencies = [
 ]
 
 [[package]]
-name = "zerofrom"
-version = "0.1.5"
+name = "zerocopy-derive"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+checksum = "6352c01d0edd5db859a63e2605f4ea3183ddbd15e2c4a9e7d32184df75e4f154"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3665,9 +3737,9 @@ dependencies = [
 
 [[package]]
 name = "zvariant"
-version = "5.2.0"
+version = "5.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55e6b9b5f1361de2d5e7d9fd1ee5f6f7fcb6060618a1f82f3472f58f2b8d4be9"
+checksum = "b2df9ee044893fcffbdc25de30546edef3e32341466811ca18421e3cd6c5a3ac"
 dependencies = [
  "endi",
  "enumflags2",
@@ -3675,8 +3747,8 @@ dependencies = [
  "static_assertions",
  "url",
  "winnow",
- "zvariant_derive 5.2.0",
- "zvariant_utils 3.1.0",
+ "zvariant_derive 5.4.0",
+ "zvariant_utils 3.2.0",
 ]
 
 [[package]]
@@ -3694,15 +3766,15 @@ dependencies = [
 
 [[package]]
 name = "zvariant_derive"
-version = "5.2.0"
+version = "5.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573a8dd76961957108b10f7a45bac6ab1ea3e9b7fe01aff88325dc57bb8f5c8b"
+checksum = "74170caa85b8b84cc4935f2d56a57c7a15ea6185ccdd7eadb57e6edd90f94b2f"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
  "syn",
- "zvariant_utils 3.1.0",
+ "zvariant_utils 3.2.0",
 ]
 
 [[package]]
@@ -3718,9 +3790,9 @@ dependencies = [
 
 [[package]]
 name = "zvariant_utils"
-version = "3.1.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd46446ea2a1f353bfda53e35f17633afa79f4fe290a611c94645c69fe96a50"
+checksum = "e16edfee43e5d7b553b77872d99bc36afdda75c223ca7ad5e3fbecd82ca5fc34"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/pkgs/by-name/re/recordbox/package.nix b/pkgs/by-name/re/recordbox/package.nix
index d747c407719e..d5631143f6da 100644
--- a/pkgs/by-name/re/recordbox/package.nix
+++ b/pkgs/by-name/re/recordbox/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "recordbox";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "edestcroix";
     repo = "Recordbox";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-Vt/uOueDKBjCVgFg6gMnOvbvR37udJ6J3BjE0LaL4Gw=";
+    hash = "sha256-168L5i6mXeEqv7EKPMq4zHP5JRVxC7MNrUE9yj1zI60=";
   };
 
   # Patch in our Cargo.lock and ensure AppStream tests don't use the network
diff --git a/pkgs/by-name/se/sequoia-sqv/package.nix b/pkgs/by-name/se/sequoia-sqv/package.nix
index a1c492d03587..85a94c70ded2 100644
--- a/pkgs/by-name/se/sequoia-sqv/package.nix
+++ b/pkgs/by-name/se/sequoia-sqv/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia-sqv";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia-sqv";
     rev = "v${version}";
-    hash = "sha256-frGukJDsxq+BWLPC/4imfc42lDKVF8BPIQQDazaLaQ0=";
+    hash = "sha256-xkvCEHVyRf1tQ/oo6Hg4Nri2WxdmH0fZFX24CPwJpZQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WaLRBf+Umaa8LTQ97TsJJ7pUlmficIwuFV6d5QDT6SA=";
+  cargoHash = "sha256-ZynvC4t9NBri5gc9lt2tHd/45V6QsKHbZb7HjHUQQUI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/si/signal-desktop/generic.nix b/pkgs/by-name/si/signal-desktop/generic.nix
index de6134797b93..9478ac430f02 100644
--- a/pkgs/by-name/si/signal-desktop/generic.nix
+++ b/pkgs/by-name/si/signal-desktop/generic.nix
@@ -5,6 +5,7 @@
   autoPatchelfHook,
   noto-fonts-color-emoji,
   dpkg,
+  libarchive,
   asar,
   rsync,
   python3,
@@ -53,7 +54,9 @@
 
 {
   pname,
-  dir,
+  libdir,
+  bindir,
+  extractPkg,
   version,
   hash,
   url,
@@ -100,7 +103,7 @@ stdenv.mkDerivation rec {
     recursiveHash = true;
     downloadToTemp = true;
     nativeBuildInputs = [
-      dpkg
+      (if ARCH == "x64" then dpkg else libarchive)
       asar
     ];
     # Signal ships the Apple emoji set without a licence via an npm
@@ -117,10 +120,10 @@ stdenv.mkDerivation rec {
     # unlicensed emoji files, but the rest of the work is done in the
     # main derivation.
     postFetch = ''
-      dpkg-deb -x $downloadedFile $out
-      asar extract "$out/opt/${dir}/resources/app.asar" $out/asar-contents
+      ${extractPkg}
+      asar extract "$out/${libdir}/resources/app.asar" $out/asar-contents
       rm -r \
-        "$out/opt/${dir}/resources/app.asar"{,.unpacked} \
+        "$out/${libdir}/resources/app.asar"{,.unpacked} \
         $out/asar-contents/node_modules/emoji-datasource-apple
     '';
   };
@@ -196,14 +199,14 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
 
     mv usr/share $out/share
-    mv "opt/${dir}" "$out/lib/${dir}"
+    mv "${libdir}" "$out/lib/signal-desktop"
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s "$out/lib/${dir}/${pname}" $out/bin/${pname}
+    ln -s "$out/lib/signal-desktop/signal-desktop" $out/bin/${meta.mainProgram}
 
     # Create required symlinks:
-    ln -s libGLESv2.so "$out/lib/${dir}/libGLESv2.so.2"
+    ln -s libGLESv2.so "$out/lib/signal-desktop/libGLESv2.so.2"
 
     # Copy the Noto Color Emoji PNGs into the ASAR contents. See `src`
     # for the motivation, and the script for the technical details.
@@ -218,7 +221,7 @@ stdenv.mkDerivation rec {
     substituteInPlace asar-contents/preload.bundle.js \
       --replace-fail \
         'emoji://jumbo?emoji=' \
-        "file://$out/lib/${lib.escapeURL dir}/resources/app.asar/$emojiPrefix/"
+        "file://$out/lib/signal-desktop/resources/app.asar/$emojiPrefix/"
 
     # `asar(1)` copies files from the corresponding `.unpacked`
     # directory when extracting, and will put them back in the modified
@@ -227,7 +230,7 @@ stdenv.mkDerivation rec {
     asar pack \
       --unpack '*.node' \
       asar-contents \
-      "$out/lib/${dir}/resources/app.asar"
+      "$out/lib/signal-desktop/resources/app.asar"
 
     runHook postInstall
   '';
@@ -239,13 +242,13 @@ stdenv.mkDerivation rec {
     )
 
     # Fix the desktop link
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace-fail "/opt/${dir}/${pname}" ${meta.mainProgram} \
+    substituteInPlace $out/share/applications/signal-desktop.desktop \
+      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
       --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"
 
     # Note: The following path contains bundled libraries:
-    # $out/lib/${dir}/resources/app.asar.unpacked/node_modules/
-    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/${dir}/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
+    # $out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/
+    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
index b12cb4b80540..f0065972a000 100644
--- a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
@@ -1,8 +1,15 @@
 { callPackage }:
-callPackage ./generic.nix { } rec {
+callPackage ./generic.nix { } {
   pname = "signal-desktop";
-  dir = "Signal";
-  version = "7.36.0";
-  url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-nmAqFDw35pdZg5tiq9MUlqXnbRLRkSOX9SWhccnE2Xw=";
+  version = "7.46.0-1";
+
+  libdir = "usr/lib64/signal-desktop";
+  bindir = "usr/bin";
+  extractPkg = ''
+    mkdir -p $out
+    bsdtar -xf $downloadedFile -C "$out"
+  '';
+
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/08759579-signal-desktop/signal-desktop-7.46.0-1.fc42.aarch64.rpm";
+  hash = "sha256-kiNwaB+jNOgkfkJ4V5Fj23RNILP3IOZfKWKAehMmtZ0=";
 }
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop.nix b/pkgs/by-name/si/signal-desktop/signal-desktop.nix
index e4d12ceed09a..fd069778673c 100644
--- a/pkgs/by-name/si/signal-desktop/signal-desktop.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-desktop.nix
@@ -1,8 +1,12 @@
 { callPackage }:
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
-  dir = "Signal";
   version = "7.46.0";
+
+  libdir = "opt/Signal";
+  bindir = libdir;
+  extractPkg = "dpkg-deb -x $downloadedFile $out";
+
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
   hash = "sha256-HbmyivfhvZfXdtcL/Cjzl4v0Ck/fJCD517iTjIeidgc=";
 }
diff --git a/pkgs/by-name/si/signal-desktop/update.sh b/pkgs/by-name/si/signal-desktop/update.sh
index a2d0e2aae340..dc2c6864cec6 100755
--- a/pkgs/by-name/si/signal-desktop/update.sh
+++ b/pkgs/by-name/si/signal-desktop/update.sh
@@ -1,39 +1,33 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update curl coreutils jq
+#!nix-shell -i bash -p bash common-updater-scripts curl coreutils jq
 
 set -ex
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
-curl_github() {
-  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
-}
+latestTag=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} \
+  "https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest" \
+  | jq -r ".tag_name")
+latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
 
-case "$UPDATE_NIX_ATTR_PATH" in
-signal-desktop)
-  latestTag=$(curl_github https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest | jq -r ".tag_name")
-  latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-  latestVersionAarch64=$(curl_github "https://api.github.com/repos/0mniteck/Signal-Desktop-Mobian/releases/latest" | jq -r ".tag_name")
+latestBuildInfoAarch64=$(curl \
+  "https://copr.fedorainfracloud.org/api_3/package/?ownername=useidel&projectname=signal-desktop&packagename=signal-desktop&with_latest_succeeded_build=true" \
+  | jq '.builds.latest_succeeded')
+latestBuildAarch64=$(jq '.id' <<< $latestBuildInfoAarch64)
+latestVersionAarch64=$(jq -r '.source_package.version' <<< $latestBuildInfoAarch64)
 
-  echo "Updating signal-desktop for x86_64-linux"
-  nix-update --version "$latestVersion" \
-    --system x86_64-linux \
-    --override-filename "$SCRIPT_DIR/signal-desktop.nix" \
-  signal-desktop
+echo "Updating signal-desktop for x86_64-linux"
+update-source-version signal-desktop "$latestVersion" \
+  --system=x86_64-linux \
+  --file="$SCRIPT_DIR/signal-desktop.nix"
 
-  echo "Updating signal-desktop for aarch64-linux"
-  nix-update --version "$latestVersionAarch64" \
-    --system aarch64-linux \
-    --override-filename "$SCRIPT_DIR/signal-desktop-aarch64.nix" \
-    signal-desktop
+echo "Updating signal-desktop for aarch64-linux"
+update-source-version signal-desktop "$latestVersionAarch64" "" \
+  "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/$(printf "%08d" $latestBuildAarch64)-signal-desktop/signal-desktop-$latestVersionAarch64.fc42.aarch64.rpm" \
+  --system=aarch64-linux \
+  --file="$SCRIPT_DIR/signal-desktop-aarch64.nix"
 
-  echo "Updating signal-desktop for darwin"
-  nix-update --version "$latestVersion" \
-    --system aarch64-darwin \
-    --override-filename "$SCRIPT_DIR/signal-desktop-darwin.nix" \
-    signal-desktop
-  ;;
-*)
-  echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
-  ;;
-esac
+echo "Updating signal-desktop for darwin"
+update-source-version signal-desktop "$latestVersion" \
+  --system=aarch64-darwin \
+  --file="$SCRIPT_DIR/signal-desktop-darwin.nix"
diff --git a/pkgs/by-name/si/silice/package.nix b/pkgs/by-name/si/silice/package.nix
index 247f9b8f3eaa..551e9613b388 100644
--- a/pkgs/by-name/si/silice/package.nix
+++ b/pkgs/by-name/si/silice/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "silice";
-  version = "0-unstable-2024-12-02";
+  version = "0-unstable-2025-03-05";
 
   src = fetchFromGitHub {
     owner = "sylefeb";
     repo = "silice";
-    rev = "90d55d277a53bbbfa38d775ca3340845ca906e9e";
-    hash = "sha256-KmrX/9/SlylDnCgErJJJbmMqfTdpG6nR93simIFaQpI=";
+    rev = "2d3ce939443e42b383ba1cd0392bec61e2381c99";
+    hash = "sha256-o6NbJlJzhU3CmJPk1ibz2Fos2RWrxNuqv0jEHZj4tVg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index b657df3504fe..df4a5a6af8a8 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -46,13 +46,13 @@ assert enablePython -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
   pname = "SIRIUS";
-  version = "7.6.1";
+  version = "7.6.2";
 
   src = fetchFromGitHub {
     owner = "electronic-structure";
     repo = "SIRIUS";
     rev = "v${version}";
-    hash = "sha256-JvI75AbthNThXep2jcriLTPC8GGiPgrg5nYCCbCi+EI=";
+    hash = "sha256-A3WiEzo2ianxdF9HMZN9cT0lFosToGEHh0o6uBSAYqU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sk/skim/package.nix b/pkgs/by-name/sk/skim/package.nix
index e6a9cc6f63cc..044abb9c98c0 100644
--- a/pkgs/by-name/sk/skim/package.nix
+++ b/pkgs/by-name/sk/skim/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "skim";
-  version = "0.16.0";
+  version = "0.16.1";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${version}";
-    hash = "sha256-6enC7LjhYuHQ2XyjcsuEDM0r3qMWE9MUuDvYGMswmOc=";
+    hash = "sha256-lIVOML7UNR778RkmYvMvj4ynoOdMnb5lcsxFiO9BZAI=";
   };
 
   postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RtEV+33WFtLcdW/tAB6swyrnavUU99voT7p2/T9Rd0I=";
+  cargoHash = "sha256-llvVss7P9Bl9/6A4EtntXtmnFc5XbMvKms1lYNtaZaw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sk/skypeforlinux/package.nix b/pkgs/by-name/sk/skypeforlinux/package.nix
index 4a06398ebb52..418e8bfda342 100644
--- a/pkgs/by-name/sk/skypeforlinux/package.nix
+++ b/pkgs/by-name/sk/skypeforlinux/package.nix
@@ -42,8 +42,8 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.137.0.425";
-  revision = "384";
+  version = "8.138.0.203";
+  revision = "386";
 
   rpath =
     lib.makeLibraryPath [
@@ -103,7 +103,7 @@ let
       fetchurl {
         name = "skypeforlinux-${version}-${revision}.snap";
         url = "https://api.snapcraft.io/api/v1/snaps/download/QRDEfjn4WJYnm0FzDKwqqRZZI77awQEV_${revision}.snap";
-        hash = "sha512-JU6CtIJWwqP4CHsLXA1imYfx21ZYSbgbJ9iUsDQC67TRbgliI8TTJHPDHjOYbhVELvu/fAzbENVxCmKDwsQX6g==";
+        hash = "sha512-JTzZdCCyqGeEugFb3w37Mes0S4DlJuqw/ptSMegrppjQwq0mqOTQCOmnaCPA8pgBfCsPoZ3dnaaKt19YbyJWSg==";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/by-name/so/sonarlint-ls/package.nix b/pkgs/by-name/so/sonarlint-ls/package.nix
index 50319f1d8e78..eb3699fa50d6 100644
--- a/pkgs/by-name/so/sonarlint-ls/package.nix
+++ b/pkgs/by-name/so/sonarlint-ls/package.nix
@@ -6,34 +6,27 @@
   jdk17,
   makeWrapper,
   writeShellApplication,
-  runCommand,
-  sonarlint-ls,
   curl,
   pcre,
   common-updater-scripts,
   jq,
   gnused,
+  versionCheckHook,
 }:
 
 maven.buildMavenPackage rec {
   pname = "sonarlint-ls";
-  version = "3.14.1.75775";
+  version = "3.17.0.75948";
 
   src = fetchFromGitHub {
     owner = "SonarSource";
     repo = "sonarlint-language-server";
     rev = version;
-    hash = "sha256-QXBSdXpkhqcvfjihcWwy4oCjTMmbAJRZG1T66sa8T4U=";
+    hash = "sha256-9ZZPAkfYnHYaPFGo/WfOhUIZ+Aq7SNsVmyXgDwe68gk=";
   };
 
-  # Replaces unavailable versions with available ones in maven central. Can be
-  # removed again if
-  # https://github.com/SonarSource/sonarlint-language-server/pull/427 is
-  # merged.
-  patches = [ ./sonar-analyzers-versions.patch ];
-
   mvnJdk = jdk17;
-  mvnHash = "sha256-SKkOf3f9Ze3Rm6i2uYbFkvSnnEySARvaoiAS1e2kFi0=";
+  mvnHash = "sha256-tsYkp6Zr9gCgb0l6vQViSB7zcbf6JX+JwO4ZYqeG52c=";
 
   # Disables failing tests which either need network access or are flaky.
   mvnParameters = lib.escapeShellArgs [
@@ -56,7 +49,6 @@ maven.buildMavenPackage rec {
 
     makeWrapper ${jre_headless}/bin/java $out/bin/sonarlint-ls \
       --add-flags "-jar $out/share/sonarlint-ls.jar" \
-      --add-flags "-stdio" \
       --add-flags "-analyzers $(ls -1 $out/share/plugins | tr '\n' ' ')"
 
     runHook postInstall
@@ -64,51 +56,47 @@ maven.buildMavenPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  passthru = {
-    tests = {
-      sonarlint-ls-starts-successfully = runCommand "${pname}-test" { } ''
-        ${sonarlint-ls}/bin/sonarlint-ls > $out
-        cat $out | grep "SonarLint backend started"
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  preVersionCheck = "export version=${lib.versions.majorMinor version}";
+  versionCheckProgramArg = "-V";
+
+  passthru.updateScript =
+    let
+      pkgFile = builtins.toString ./package.nix;
+    in
+    lib.getExe (writeShellApplication {
+      name = "update-${pname}";
+      runtimeInputs = [
+        curl
+        pcre
+        common-updater-scripts
+        jq
+        gnused
+      ];
+      text = ''
+        if [ -z "''${GITHUB_TOKEN:-}" ]; then
+            echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
+        fi
+
+        LATEST_TAG=$(curl -H "Accept: application/vnd.github+json" \
+          ''${GITHUB_TOKEN:+-H "Authorization: bearer $GITHUB_TOKEN"} \
+          -Lsf https://api.github.com/repos/${src.owner}/${src.repo}/tags | \
+          jq -r '[.[] | select(.name | test("^[0-9]"))] | sort_by(.name | split(".") |
+          map(tonumber)) | reverse | .[0].name')
+        update-source-version ${pname} "$LATEST_TAG"
+        sed -i '0,/mvnHash *= *"[^"]*"/{s/mvnHash = "[^"]*"/mvnHash = ""/}' ${pkgFile}
+
+        echo -e "\nFetching all mvn dependencies to calculate the mvnHash. This may take a while ..."
+        nix-build -A ${pname}.fetchedMavenDeps 2> ${pname}-stderr.log || true
+
+        NEW_MVN_HASH=$(grep "got:" ${pname}-stderr.log | awk '{print ''$2}')
+        rm ${pname}-stderr.log
+        # escaping double quotes looks ugly but is needed for variable substitution
+        # use # instead of / as separator because the sha256 might contain the / character
+        sed -i "0,/mvnHash *= *\"[^\"]*\"/{s#mvnHash = \"[^\"]*\"#mvnHash = \"$NEW_MVN_HASH\"#}" ${pkgFile}
       '';
-    };
-
-    updateScript =
-      let
-        pkgFile = builtins.toString ./package.nix;
-      in
-      lib.getExe (writeShellApplication {
-        name = "update-${pname}";
-        runtimeInputs = [
-          curl
-          pcre
-          common-updater-scripts
-          jq
-          gnused
-        ];
-        text = ''
-          if [ -z "''${GITHUB_TOKEN:-}" ]; then
-              echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
-          fi
-
-          LATEST_TAG=$(curl -H "Accept: application/vnd.github+json" \
-            ''${GITHUB_TOKEN:+-H "Authorization: bearer $GITHUB_TOKEN"} \
-            -Lsf https://api.github.com/repos/${src.owner}/${src.repo}/tags | \
-            jq -r '[.[] | select(.name | test("^[0-9]"))] | sort_by(.name | split(".") |
-            map(tonumber)) | reverse | .[0].name')
-          update-source-version ${pname} "$LATEST_TAG"
-          sed -i '0,/mvnHash *= *"[^"]*"/{s/mvnHash = "[^"]*"/mvnHash = ""/}' ${pkgFile}
-
-          echo -e "\nFetching all mvn dependencies to calculate the mvnHash. This may take a while ..."
-          nix-build -A ${pname}.fetchedMavenDeps 2> ${pname}-stderr.log || true
-
-          NEW_MVN_HASH=$(grep "got:" ${pname}-stderr.log | awk '{print ''$2}')
-          rm ${pname}-stderr.log
-          # escaping double quotes looks ugly but is needed for variable substitution
-          # use # instead of / as separator because the sha256 might contain the / character
-          sed -i "0,/mvnHash *= *\"[^\"]*\"/{s#mvnHash = \"[^\"]*\"#mvnHash = \"$NEW_MVN_HASH\"#}" ${pkgFile}
-        '';
-      });
-  };
+    });
 
   meta = {
     description = "Sonarlint language server";
diff --git a/pkgs/by-name/so/sonarlint-ls/sonar-analyzers-versions.patch b/pkgs/by-name/so/sonarlint-ls/sonar-analyzers-versions.patch
deleted file mode 100644
index 75eb412f44d6..000000000000
--- a/pkgs/by-name/so/sonarlint-ls/sonar-analyzers-versions.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/pom.xml b/pom.xml
-index c020fd1..fd4146b 100644
---- a/pom.xml
-+++ b/pom.xml
-@@ -34,10 +34,10 @@
-     <sonar.python.version>4.17.0.14845</sonar.python.version>
-     <sonar.html.version>3.16.0.5274</sonar.html.version>
-     <sonar.xml.version>2.10.0.4108</sonar.xml.version>
--    <sonar.text.version>2.18.0.4812</sonar.text.version>
-+    <sonar.text.version>2.18.0.4866</sonar.text.version>
-     <sonar.go.version>1.15.0.4655</sonar.go.version>
-     <sonar.iac.version>1.27.0.9518</sonar.iac.version>
--    <sonar.csharp.version>10.2.0.103721</sonar.csharp.version>
-+    <sonar.csharp.version>10.2.0.105762</sonar.csharp.version>
-     <sonarlint.omnisharp.version>1.25.0.100242</sonarlint.omnisharp.version>
-     <gitRepositoryName>sonarlint-language-server</gitRepositoryName>
-     <!-- Release: enable publication to Bintray -->
diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix
new file mode 100644
index 000000000000..b3e5a69fe68d
--- /dev/null
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  perl,
+  git,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "spacetimedb";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "clockworklabs";
+    repo = "spacetimedb";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L3D7DfMQNuoZ/twAsrK20royIGp6PXCAFZKnb0PgSu0=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-eOZRp3LRbQzHfT+evKY55ifevX+ki9oT5B7vZs3ym+c=";
+
+  nativeBuildInputs = [
+    pkg-config
+    perl
+  ];
+
+  # Replace hardcoded git binary
+  postPatch = ''
+    substituteInPlace crates/cli/build.rs --replace-fail 'Command::new("git")' 'Command::new("${lib.getExe git}")'
+  '';
+
+  cargoBuildFlags = [ "-p spacetimedb-standalone -p spacetimedb-cli" ];
+
+  checkFlags = [
+    # requires wasm32-unknown-unknown target
+    "--skip=codegen"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/spacetime";
+  versionCheckProgramArg = "--version";
+
+  postInstall = ''
+    mv $out/bin/spacetimedb-cli $out/bin/spacetime
+  '';
+
+  meta = {
+    description = "Full-featured relational database system that lets you run your application logic inside the database";
+    homepage = "https://github.com/clockworklabs/SpacetimeDB";
+    license = lib.licenses.bsl11;
+    mainProgram = "spacetime";
+    maintainers = with lib.maintainers; [ akotro ];
+  };
+})
diff --git a/pkgs/by-name/sp/spotifyd/package.nix b/pkgs/by-name/sp/spotifyd/package.nix
index 04568ad8ca3c..5dcf83303bfd 100644
--- a/pkgs/by-name/sp/spotifyd/package.nix
+++ b/pkgs/by-name/sp/spotifyd/package.nix
@@ -23,17 +23,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotifyd";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YBh5lcHXqYjyo/MjNNxnycY5AXjvlu+2gAzG6gM4Gjc=";
+    hash = "sha256-IqJlqcau0AZAqQjlaEKzinqTdVUA48/m2Y3ioFP/4Zw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-waZ9XNYZ/scyMsNT7bZYqN4Ch4GbuQtwxAYaWTjNZwg=";
+  cargoHash = "sha256-wZ/JJZDo+Iz5vg4XawcZFvjOEqpD5I0jTfg1JyH3+MA=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/st/star-history/package.nix b/pkgs/by-name/st/star-history/package.nix
index ee2bee6d503e..36ab4759a274 100644
--- a/pkgs/by-name/st/star-history/package.nix
+++ b/pkgs/by-name/st/star-history/package.nix
@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "star-history";
-  version = "1.0.27";
+  version = "1.0.28";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-IpMhCI6XS6h7kHaohCdS0YAUUR6PeC9mbMRCiS3p29c=";
+    hash = "sha256-OtXNJtpTyR3qEz9D/3WjvLjY5Taa4rcLmTaxJMhuSUY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bu7YUwrLKHdDL+rxw++8mrWH2hBhEF4jNqZls/9F+aM=";
+  cargoHash = "sha256-yJ0w5+qQn1Kys5MPTG3Z+vdT8bQUmD77I+0VkEKIlyc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/st/storj-uplink/package.nix b/pkgs/by-name/st/storj-uplink/package.nix
index 354b9fff7983..7e329edb21b2 100644
--- a/pkgs/by-name/st/storj-uplink/package.nix
+++ b/pkgs/by-name/st/storj-uplink/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.123.4";
+  version = "1.124.4";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-H62QB/lS3rDUPDJMckRVhChgevyXfQzPBT+XI4/uDNE=";
+    hash = "sha256-3VrmFSE5YdZYxcEoWtEgonQz7ZERLfF12zcPExNToVs=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-s6UrM7Kj/w09EXLHeyzcE6YLzucUz/qEpXsghFETRig=";
+  vendorHash = "sha256-d/ddvixerg30JZtQGNWycUR93Qeaha89W8unKUFPkDg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/su/sus-compiler/Cargo.lock b/pkgs/by-name/su/sus-compiler/Cargo.lock
index 6f70ec513dab..803be416ee86 100644
--- a/pkgs/by-name/su/sus-compiler/Cargo.lock
+++ b/pkgs/by-name/su/sus-compiler/Cargo.lock
@@ -11,6 +11,56 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "anstream"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
+dependencies = [
+ "anstyle",
+ "once_cell",
+ "windows-sys",
+]
+
 [[package]]
 name = "ariadne"
 version = "0.4.1"
@@ -21,23 +71,6 @@ dependencies = [
  "yansi",
 ]
 
-[[package]]
-name = "arrayvec"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.4.0"
@@ -52,15 +85,15 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.6.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "cc"
-version = "1.1.36"
+version = "1.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baee610e9452a8f6f0a1b6194ec09ff9e2d85dea54432acdae41aa0761c95d70"
+checksum = "be714c154be609ec7f5dad223a33bf1482fff90472de28f7362806e6d4832b8c"
 dependencies = [
  "shlex",
 ]
@@ -73,42 +106,65 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "3.2.25"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+checksum = "6088f3ae8c3608d19260cd7445411865a485688711b78b5be70d78cd96136f83"
 dependencies = [
- "atty",
- "bitflags 1.3.2",
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22a7ef7f676155edfb82daa97f99441f3ebf4a58d5e32f295a56259f1b6facc8"
+dependencies = [
+ "anstream",
+ "anstyle",
  "clap_lex",
- "indexmap",
  "strsim",
- "termcolor",
- "textwrap",
+ "terminal_size",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.2.4"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
-]
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "dirs-next"
@@ -139,7 +195,17 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
+dependencies = [
+ "libc",
+ "windows-sys",
 ]
 
 [[package]]
@@ -163,19 +229,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.12.3"
+name = "heck"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "icu_collections"
@@ -292,7 +349,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -317,26 +374,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "indexmap"
-version = "1.9.3"
+name = "is_terminal_polyfill"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown",
-]
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "libc"
-version = "0.2.162"
+version = "0.2.170"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
+checksum = "875b3680cb2f8f71bdcf9a30f38d48282f5d3c95cbf9b3fa57269bb5d5c06828"
 
 [[package]]
 name = "libredox"
@@ -344,31 +397,38 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.9.0",
  "libc",
 ]
 
 [[package]]
-name = "litemap"
-version = "0.7.3"
+name = "linux-raw-sys"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+checksum = "6db9c683daf087dc577b7506e9695b3d556a9f3849903fa28186283afd6809e9"
+
+[[package]]
+name = "litemap"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "30bde2b3dc3671ae49d8e2e9f044c7c005836e7a023ee57cffa25ab82764bb9e"
 
 [[package]]
 name = "lsp-server"
-version = "0.7.7"
+version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "550446e84739dcaf6d48a4a093973850669e13e8a34d8f8d64851041be267cd9"
+checksum = "9462c4dc73e17f971ec1f171d44bfffb72e65a130117233388a0ebc7ec5656f9"
 dependencies = [
  "crossbeam-channel",
  "log",
  "serde",
+ "serde_derive",
  "serde_json",
 ]
 
@@ -465,10 +525,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "os_str_bytes"
-version = "6.6.1"
+name = "once_cell"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+checksum = "cde51589ab56b20a6f686b2c68f7a0bd6add753d697abf720d63f8db3ab7b1ad"
 
 [[package]]
 name = "percent-encoding"
@@ -478,18 +538,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.89"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "c1f1914ce909e1658d9907913b4b91947430c7d9be598b15a1912935b8c04801"
 dependencies = [
  "proc-macro2",
 ]
@@ -519,9 +579,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -535,36 +595,49 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
-name = "ryu"
-version = "1.0.18"
+name = "rustix"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "f7178faa4b75a30e269c71e61c353ce2748cf3d76f0c44c393f4e60abf49b825"
+dependencies = [
+ "bitflags 2.9.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "serde"
-version = "1.0.214"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f55c3193aca71c12ad7890f1785d2b73e1b9f63a0bbc353c08ef26fe03fc56b5"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.214"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.132"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -574,13 +647,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -591,9 +664,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
 
 [[package]]
 name = "stable_deref_trait"
@@ -602,16 +675,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
 
 [[package]]
-name = "strsim"
-version = "0.10.0"
+name = "streaming-iterator"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+checksum = "2b2231b7c3057d5e4ad0156fb3dc807d900806020c5ffa3ee6ff2c8c76fb8520"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "sus-proc-macro"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "quote",
+ "regex",
  "syn 1.0.109",
  "tree-sitter",
  "tree-sitter-sus",
@@ -619,10 +699,9 @@ dependencies = [
 
 [[package]]
 name = "sus_compiler"
-version = "0.1.1"
+version = "0.2.0"
 dependencies = [
  "ariadne",
- "arrayvec",
  "clap",
  "dirs-next",
  "lsp-server",
@@ -648,9 +727,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.87"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -665,42 +744,37 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
 
 [[package]]
-name = "termcolor"
-version = "1.4.1"
+name = "terminal_size"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
 dependencies = [
- "winapi-util",
+ "rustix",
+ "windows-sys",
 ]
 
-[[package]]
-name = "textwrap"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
-
 [[package]]
 name = "thiserror"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02dd99dc800bbb97186339685293e1cc5d9df1f8fae2d0aecd9ff1c77efea892"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -715,17 +789,26 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter"
-version = "0.22.6"
+version = "0.24.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df7cc499ceadd4dcdf7ec6d4cbc34ece92c3fa07821e287aedecd4416c516dca"
+checksum = "a5387dffa7ffc7d2dae12b50c6f7aab8ff79d6210147c6613561fc3d474c6f75"
 dependencies = [
  "cc",
  "regex",
+ "regex-syntax",
+ "streaming-iterator",
+ "tree-sitter-language",
 ]
 
+[[package]]
+name = "tree-sitter-language"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4013970217383f67b18aef68f6fb2e8d409bc5755227092d32efb0422ba24b8"
+
 [[package]]
 name = "tree-sitter-sus"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "cc",
  "tree-sitter",
@@ -733,9 +816,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.13"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unicode-width"
@@ -745,9 +828,9 @@ checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
 name = "url"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d157f1b96d14500ffdc1f10ba712e780825526c03d9a49b4d0324b0d9113ada"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -767,6 +850,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -789,15 +878,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
-[[package]]
-name = "winapi-util"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
-dependencies = [
- "windows-sys",
-]
-
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@@ -897,9 +977,9 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yoke"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
 dependencies = [
  "serde",
  "stable_deref_trait",
@@ -909,34 +989,34 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
  "synstructure",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.4"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.4"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
  "synstructure",
 ]
 
@@ -959,5 +1039,5 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.100",
 ]
diff --git a/pkgs/by-name/su/sus-compiler/package.nix b/pkgs/by-name/su/sus-compiler/package.nix
index c7f38a8fe4f3..1a2857c8e657 100644
--- a/pkgs/by-name/su/sus-compiler/package.nix
+++ b/pkgs/by-name/su/sus-compiler/package.nix
@@ -3,17 +3,18 @@
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sus-compiler";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "pc2";
     repo = "sus-compiler";
-    rev = "v${version}";
-    hash = "sha256-VSoroUultjBn2KxfvyhS923RQ/1v9AXb15k4/MoR+oM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0OZPBdilNknGCjWzXjyUAW57cpyyyV80EEo6pDlpG3g=";
     fetchSubmodules = true;
   };
 
@@ -32,6 +33,8 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/sus_compiler";
 
+  updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+
   meta = {
     description = "A new Hardware Design Language that keeps you in the driver's seat";
     homepage = "https://github.com/pc2/sus-compiler";
@@ -39,4 +42,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ pbsds ];
     mainProgram = "sus_compiler";
   };
-}
+})
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index 774866a05fb6..7251eb8e03c7 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.31.2";
+  version = "0.31.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bgVFUBSb/vs+oEVUeF/PniqEkUAl3qRiuFWR4U+iHXo=";
+    sha256 = "sha256-MaWO9I2+xHA+55tUSQ91yJ7suubnWP4V7JxZTruN1A0=";
   };
 
-  vendorHash = "sha256-C1GpLDb4YWL0dXG/mUR+UVy17rnh0zgaICAU0C1bfq0=";
+  vendorHash = "sha256-jTvKNl0L+Dl3u5qHQg0R/rtNtLljLoIvciXYKRe/zNg=";
 
   doCheck = false;
   # Required for versions >= 0.28 as they introduce a gowork.sum file. This is only used for tests so we can safely disable GOWORK
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
index 7567d205173a..b9265b199a65 100644
--- a/pkgs/by-name/ta/taskwarrior3/package.nix
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -12,7 +12,6 @@
 
   # buildInputs
   libuuid,
-  xdg-utils,
 
   # passthru.tests
   nixosTests,
@@ -25,24 +24,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "taskwarrior";
-  version = "3.3.0";
+  version = "3.4.1";
   src = fetchFromGitHub {
     owner = "GothenburgBitFactory";
     repo = "taskwarrior";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-aKDwRCJ1yopRdsPxnHhgOpSho1i8/dcAurI+XhpSbn4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-00HiGju4pIswx8Z+M+ATdBSupiMS2xIm2ZnE52k/RwA=";
     fetchSubmodules = true;
   };
   cargoDeps = rustPlatform.fetchCargoVendor {
     name = "${finalAttrs.pname}-${finalAttrs.version}-cargo-deps";
     inherit (finalAttrs) src;
-    hash = "sha256-UbJodQBCrmXbw5+ahusBnEcoCYGFHRA6bg5hf9/prmA=";
+    hash = "sha256-trc5DIWf68XRBSMjeG/ZchuwFA56wJnLbqm17gE+jYQ=";
   };
 
-  postPatch = ''
-    substituteInPlace src/commands/CmdNews.cpp \
-      --replace-fail "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
-  '';
   # The CMakeLists files used by upstream issue a `cargo install` command to
   # install a rust tool (cxxbridge-cmd) that is supposed to be included in the Cargo.toml's and
   # `Cargo.lock` files of upstream. Setting CARGO_HOME like that helps `cargo
@@ -119,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.nixos = nixosTests.taskchampion-sync-server;
 
   meta = {
-    changelog = "https://github.com/GothenburgBitFactory/taskwarrior/releases/tag/v${finalAttrs.src.rev}";
+    changelog = "https://github.com/GothenburgBitFactory/taskwarrior/releases/tag/${finalAttrs.src.tag}";
     description = "Highly flexible command-line tool to manage TODO lists";
     homepage = "https://taskwarrior.org";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 4657f53cf80b..37a0307f7ad2 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.10.7";
+  version = "0.10.9";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
     tag = version;
-    hash = "sha256-M3n644064cmg7PHmJqQpPZHl4SjshERh2gkKCWvOzcw=";
+    hash = "sha256-R46r3S7zaogyVpdLGFIU1l6UDnRQ1lMZvd4RA6iq+qI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TtLPH6k1oXAJRgbUXTvcOMOWmYCOCuhM+82yLBkwPXo=";
+  cargoHash = "sha256-teUJyLTUiSIbsMVOTj8/wBIimZOMDPQ/h6OryRsTJQ0=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ti/tilt/binary.nix b/pkgs/by-name/ti/tilt/binary.nix
index 4c5e70520927..5035423def89 100644
--- a/pkgs/by-name/ti/tilt/binary.nix
+++ b/pkgs/by-name/ti/tilt/binary.nix
@@ -4,6 +4,8 @@
   src,
   version,
   tilt-assets,
+  stdenv,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -21,6 +23,15 @@ buildGoModule rec {
 
   ldflags = [ "-X main.version=${version}" ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd tilt \
+      --bash <($out/bin/tilt completion bash) \
+      --fish <($out/bin/tilt completion fish) \
+      --zsh <($out/bin/tilt completion zsh)
+  '';
+
   preBuild = ''
     mkdir -p pkg/assets/build
     cp -r ${tilt-assets}/* pkg/assets/build/
diff --git a/pkgs/by-name/tl/tlrc/package.nix b/pkgs/by-name/tl/tlrc/package.nix
index a91102cafe1d..a1ff5926d464 100644
--- a/pkgs/by-name/tl/tlrc/package.nix
+++ b/pkgs/by-name/tl/tlrc/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tlrc";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "tldr-pages";
     repo = "tlrc";
     rev = "v${version}";
-    hash = "sha256-th7igqDnLB+Lib2NxYNIGtUTK6IfSQo+72ohO5Ki7Ok=";
+    hash = "sha256-LXuURq+MSSkd8+VzhltX2VqKsU3PWcQLMQTqqS5oLMg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+EWF21hag2kQ+YT8e+2NtdtOgyGrJL0BR2YMOxQfoDE=";
+  cargoHash = "sha256-nA24qjxo1C0t4twTv2/Uu05ELiSzYLrnsRgAIFKsIxg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/tr/trunk/package.nix b/pkgs/by-name/tr/trunk/package.nix
index afe7c5883d97..a264e838e575 100644
--- a/pkgs/by-name/tr/trunk/package.nix
+++ b/pkgs/by-name/tr/trunk/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.21.8";
+  version = "0.21.9";
 
   src = fetchFromGitHub {
     owner = "trunk-rs";
     repo = "trunk";
     rev = "v${version}";
-    hash = "sha256-iuJpxLNdJCPFr5v0bXipOr9KzQM/JeUBQQ7qyMaQsoA=";
+    hash = "sha256-+HKEaXdGW3F5DCvyvQalr65+BZv+NA2r34MSvPwlhac=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fTKzfsmWX8AS3GPOfkRAfdVIj2q1orI1j2tfo8AAsXU=";
+  cargoHash = "sha256-xaL7gF9gWRn0geKIUwksDovaIHMqfl57O9GvHOjgsic=";
 
   meta = with lib; {
     homepage = "https://github.com/trunk-rs/trunk";
diff --git a/pkgs/by-name/ts/tsukimi/package.nix b/pkgs/by-name/ts/tsukimi/package.nix
index 633a790ed00f..09cb809c7fc4 100644
--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -11,25 +11,39 @@
   libepoxy,
   wrapGAppsHook4,
   nix-update-script,
+  stdenv,
+  meson,
+  ninja,
+  rustc,
+  cargo,
+  dbus,
+  desktop-file-utils,
 }:
-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation rec {
   pname = "tsukimi";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "tsukinaha";
     repo = "tsukimi";
     tag = "v${version}";
-    hash = "sha256-MNPg3qg9wRRWKofH4NSRIa76+nA3IFoMfOt6s5+4y8A=";
-    fetchSubmodules = true;
+    hash = "sha256-7Us+mz0FHetka4uVDCWkAGyGMZRhQDotRsySljYZgCo=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-mS5qKEm3oCHiFP5i/XHnIOBmXzvlgfE2i/f0lLl4TN4=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    hash = "sha256-JaBFL7XHVjf4NP41n9qtb5oQyaP1bYQETPYMCR9XEvQ=";
+  };
 
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook4
+    meson
+    ninja
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    desktop-file-utils
   ];
 
   buildInputs =
@@ -39,6 +53,7 @@ rustPlatform.buildRustPackage rec {
       libadwaita
       openssl
       libepoxy
+      dbus
     ]
     ++ (with gst_all_1; [
       gstreamer
@@ -51,23 +66,6 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false; # tests require networking
 
-  postPatch = ''
-    substituteInPlace build.rs \
-      --replace-fail 'i18n/locale' "$out/share/locale"
-
-    substituteInPlace src/lib.rs \
-      --replace-fail '/usr/share/locale' "$out/share/locale"
-  '';
-
-  postInstall = ''
-    install -Dm644 resources/moe.tsuna.tsukimi.gschema.xml -t $out/share/glib-2.0/schemas
-    glib-compile-schemas $out/share/glib-2.0/schemas
-
-    install -Dm644 resources/icons/tsukimi.png -t $out/share/pixmaps
-
-    install -Dm644 resources/moe.tsuna.tsukimi.desktop.in $out/share/applications/moe.tsuna.tsukimi.desktop
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/tu/turso-cli/package.nix b/pkgs/by-name/tu/turso-cli/package.nix
index 6c36b45dcf13..d55c946ae60c 100644
--- a/pkgs/by-name/tu/turso-cli/package.nix
+++ b/pkgs/by-name/tu/turso-cli/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.98.1";
+  version = "0.99.1";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-UNh4MYWzu8LJQOYwW6ZWotE+FLAOYlNxDIgzii27qoU=";
+    hash = "sha256-4gcG23Tdkl+UO4MQ7A9s8GweOlwVSDHAY+WNVyBvNqE=";
   };
 
   vendorHash = "sha256-tBO21IgUczwMgrEyV7scV3YTY898lYHASaLeXqvBopU=";
diff --git a/pkgs/by-name/un/uniex/package.nix b/pkgs/by-name/un/uniex/package.nix
index 4d28d984eb69..b1bd45ed1d96 100644
--- a/pkgs/by-name/un/uniex/package.nix
+++ b/pkgs/by-name/un/uniex/package.nix
@@ -1,8 +1,8 @@
 {
   lib,
   buildGoModule,
-  gitUpdater,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule rec {
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     changelog = "https://github.com/paepckehh/uniex/releases/tag/v${version}";
diff --git a/pkgs/by-name/un/universal-android-debloater/package.nix b/pkgs/by-name/un/universal-android-debloater/package.nix
index f004c1aa9318..5e1fb737aa74 100644
--- a/pkgs/by-name/un/universal-android-debloater/package.nix
+++ b/pkgs/by-name/un/universal-android-debloater/package.nix
@@ -8,27 +8,29 @@
   lib,
   libglvnd,
   libxkbcommon,
-  wayland,
   makeWrapper,
   mold,
+  nix-update-script,
   pkg-config,
   rustPlatform,
+  wayland,
+  writableTmpDirAsHomeHook,
   xorg,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "universal-android-debloater";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "Universal-Debloater-Alliance";
     repo = "universal-android-debloater-next-generation";
-    rev = "v${version}";
-    hash = "sha256-o54gwFl2x0/nE1hiE5F8D18vQSNCKU9Oxiq8RA+yOoE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DapPUvkI4y159gYbSGJQbbDfW+C0Ggvaxo45Qj3mLrQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eiaDqhWuoYybtlhFuM8/Cic4jUEnqOsfNZ+p7tBVL2c=";
+  cargoHash = "sha256-eXbReRi/0h4UyJwIMI3GfHcQzX1E5Spoa4moMXtrBng=";
 
   buildInputs = [
     expat
@@ -44,37 +46,34 @@ rustPlatform.buildRustPackage rec {
 
   nativeCheckInputs = [
     clang
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME="$(mktemp -d)"
+  postInstall = ''
+    wrapProgram $out/bin/uad-ng --prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        fontconfig
+        freetype
+        libglvnd
+        libxkbcommon
+        wayland
+        xorg.libX11
+        xorg.libXcursor
+        xorg.libXi
+        xorg.libXrandr
+      ]
+    } --suffix PATH : ${lib.makeBinPath [ android-tools ]}
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/uad-ng \
-      --prefix LD_LIBRARY_PATH : ${
-        lib.makeLibraryPath [
-          fontconfig
-          freetype
-          libglvnd
-          libxkbcommon
-          wayland
-          xorg.libX11
-          xorg.libXcursor
-          xorg.libXi
-          xorg.libXrandr
-        ]
-      } \
-      --suffix PATH : ${lib.makeBinPath [ android-tools ]}
-  '';
+  passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/releases/tag/v${finalAttrs.version}";
     description = "Tool to debloat non-rooted Android devices";
-    changelog = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/blob/${src.rev}/CHANGELOG.md";
     homepage = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation";
     license = lib.licenses.gpl3Only;
     mainProgram = "uad-ng";
     maintainers = with lib.maintainers; [ lavafroth ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/vr/vrcadvert/package.nix b/pkgs/by-name/vr/vrcadvert/package.nix
index 90d9f0bf2ba4..5e814c114d90 100644
--- a/pkgs/by-name/vr/vrcadvert/package.nix
+++ b/pkgs/by-name/vr/vrcadvert/package.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "vrcadvert";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "galister";
     repo = "VrcAdvert";
     tag = "v${version}";
-    hash = "sha256-noIu5LV0yva94Kmdr39zb0kKXDaIrQ8DIplCj3aTIbQ=";
+    hash = "sha256-lrRH+BBeVpYVAdFdlsYVxsBOENZseBVoAxb5v9+E7g8=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
@@ -26,13 +26,6 @@ buildDotnetModule rec {
 
   executables = [ "VrcAdvert" ];
 
-  postPatch = ''
-    substituteInPlace VrcAdvert.csproj \
-      --replace-fail 'net6.0' 'net8.0'
-    substituteInPlace global.json \
-      --replace-fail '6.0.0' '8.0.0'
-  '';
-
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/vv/vvvvvv/package.nix b/pkgs/by-name/vv/vvvvvv/package.nix
index 9b6cf47c8fdf..94d1fcb6d377 100644
--- a/pkgs/by-name/vv/vvvvvv/package.nix
+++ b/pkgs/by-name/vv/vvvvvv/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vvvvvv";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "TerryCavanagh";
     repo = "VVVVVV";
     rev = version;
-    hash = "sha256-HosrYBzx1Kh7rQIH7IAoOTPgpm4lgYOVR3MWtWX3usQ=";
+    hash = "sha256-SYXuA7RJ0x4d1Lyvmk/R2nofEt5k7OJ91X6w3sGQOhg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/yn/ynetd/package.nix b/pkgs/by-name/yn/ynetd/package.nix
new file mode 100644
index 000000000000..ce4cc7fa2c30
--- /dev/null
+++ b/pkgs/by-name/yn/ynetd/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ynetd";
+  version = "2024.02.17";
+
+  src = fetchurl {
+    url = "https://yx7.cc/code/ynetd/ynetd-2024.02.17.tar.xz";
+    hash = "sha256-7gioQ0r0LlUftIWKRwTqeZQl0GtskcRKaEE5z6A0S24=";
+  };
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace-fail "-Wl,-z,relro,-z,now" ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 ynetd $out/bin/ynetd
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Small server for binding programs to TCP ports";
+    homepage = "https://yx7.cc/code/";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.haylin ];
+    mainProgram = "ynetd";
+  };
+})
diff --git a/pkgs/by-name/ze/zellij/package.nix b/pkgs/by-name/ze/zellij/package.nix
index 1f3f447ab691..3ba274737a82 100644
--- a/pkgs/by-name/ze/zellij/package.nix
+++ b/pkgs/by-name/ze/zellij/package.nix
@@ -8,19 +8,20 @@
   pkg-config,
   curl,
   openssl,
+  writableTmpDirAsHomeHook,
   versionCheckHook,
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zellij";
-  version = "0.41.2";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
-    tag = "v${version}";
-    hash = "sha256-xdWfaXWmqFJuquE7n3moUjGuFqKB90OE6lqPuC3onOg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qvm8mRm/YYcuNX2Rv0tYjcIXjaF9dkwd7wpL++ho3t0=";
   };
 
   # Remove the `vendored_curl` feature in order to link against the libcurl from nixpkgs instead of
@@ -31,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nfk+4vf9toPwWcAgNtK9uy263g+j/Km1v8SJexlHhNg=";
+  cargoHash = "sha256-cAO8A/e6tkUY7pm/T4Riz4UPIc22oj5FFC6sQL1QIuc=";
 
   env.OPENSSL_NO_VENDOR = 1;
 
@@ -47,9 +48,9 @@ rustPlatform.buildRustPackage rec {
     openssl
   ];
 
-  preCheck = ''
-    HOME=$(mktemp -d)
-  '';
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -83,7 +84,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Terminal workspace with batteries included";
     homepage = "https://zellij.dev/";
-    changelog = "https://github.com/zellij-org/zellij/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/zellij-org/zellij/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [
       therealansh
@@ -94,4 +95,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "zellij";
   };
-}
+})
diff --git a/pkgs/by-name/zt/ztools/package.nix b/pkgs/by-name/zt/ztools/package.nix
new file mode 100644
index 000000000000..52477e2c9874
--- /dev/null
+++ b/pkgs/by-name/zt/ztools/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  unixtools,
+  groff,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ztools";
+  version = "7/3.1";
+
+  src = fetchurl {
+    url = "http://mirror.ifarchive.org/if-archive/infocom/tools/ztools/ztools731.tar.gz";
+    hash = "sha256-vlQX0/fCAr88KJwMnYUSROFOg9tfVK5Hz58AUDuhNXg=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    groff
+    unixtools.col
+  ];
+
+  # compiler flags as defaults have changed
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin/
+    cp {check,infodump,pix2gif,txd} $out/bin/
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An essential set of Z-machine tools for interpreter authors, experienced Inform programmers, and Z-code hackers.";
+    homepage = "http://inform-fiction.org/zmachine/ztools.html";
+    license = lib.licenses.cc-by-sa-40;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.haylin ];
+    mainProgram = "txd";
+  };
+})
diff --git a/pkgs/development/coq-modules/stdlib/default.nix b/pkgs/development/coq-modules/stdlib/default.nix
index 033fc30330f2..8b3563253c55 100644
--- a/pkgs/development/coq-modules/stdlib/default.nix
+++ b/pkgs/development/coq-modules/stdlib/default.nix
@@ -16,16 +16,20 @@
   defaultVersion =
     with lib.versions;
     lib.switch coq.version [
-      { case = isEq "9.0"; out = "9.0+rc1"; }
-      { case = isLt "8.21"; out = "8.20"; }
+      { case = isEq "9.0"; out = "9.0.0"; }
+      # the one below is artificial as stdlib was included in Coq before
+      { case = isLt "9.0"; out = "9.0.0"; }
     ] null;
   releaseRev = v: "V${v}";
 
-  release."9.0+rc1".sha256 = "sha256-raHwniQdpAX1HGlMofM8zVeXcmlUs+VJZZg5VF43k/M=";
-  release."8.20".sha256 = "sha256-AcoS4edUYCfJME1wx8UbuSQRF3jmxhArcZyPIoXcfu0=";
-
-  useDune = true;
+  release."9.0.0".sha256 = "sha256-2l7ak5Q/NbiNvUzIVXOniEneDXouBMNSSVFbD1Pf8cQ=";
 
+  configurePhase = ''
+    echo no configuration
+  '';
+  buildPhase = ''
+    echo building nothing
+  '';
   installPhase = ''
     echo installing nothing
   '';
@@ -40,12 +44,6 @@
     o:
     # stdlib is already included in Coq <= 8.20
     if coq.version != null && coq.version != "dev" && lib.versions.isLt "8.21" coq.version then {
-      configurePhase = ''
-        echo no configuration
-      '';
-      buildPhase = ''
-        echo building nothing
-      '';
       installPhase = ''
         touch $out
       '';
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 2f6db3d5b77d..f66eee8c953e 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.12.0.1517";
+  version = "1.12.0.1530";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-OGlOh2x6U2DBb0t9LDmTtyMgHFgibQk4zQIXZeM6Ue8=";
+    hash = "sha256-D/JLioEmujnTLeeEoIdnxd8lk4TLdsbuPbTWECcF7Uk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 3cf861d4b09b..42581f08a706 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -161,6 +161,65 @@ qtModule (
       # Fix race condition exposed by missing dependency
       # https://bugs.gentoo.org/933368
       ./qtwebengine-fix_build_pdf_extension_util.patch
+
+      # The latest version of Clang changed what macros it predefines on Apple
+      # targets, causing errors about predefined macros in zlib.
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/2f39ac8d0a414dd65c0e1d5aae38c8f97aa06ae9.patch";
+        hash = "sha256-3kA2os0IntxIiJwzS5nPd7QWYlOWOpoLKYsOQFYv0Sk=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # The latest version of Clang changed what macros it predefines on Apple
+      # targets, causing errors about predefined macros in libpng.
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/66defc14abe47c0494da9faebebfa0a5b6efcf38.patch";
+        hash = "sha256-ErS5Eycls5+xQLGYKz1r/tQC6IcRJWb/WoGsUyzO9WY=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # https://trac.macports.org/ticket/71563
+      # src/3rdparty/chromium/third_party/freetype/src/src/gzip/ftzconf.h:228:12: error: unknown type name 'Byte'
+      (fetchpatch2 {
+        url = "https://github.com/macports/macports-ports/raw/f9a4136c48020b01ecc6dffa99b88333c360f056/aqua/qt5/files/patch-qtwebengine-chromium-freetype-gzip.diff";
+        hash = "sha256-NeLmMfYMo80u3h+5GTenMANWfWLPeS35cKg+h3vzW4g=";
+        extraPrefix = "";
+      })
+
+      # src/3rdparty/chromium/base/process/process_metrics_mac.cc:303:17: error: static assertion expression is not an integral constant expression
+      (fetchpatch2 {
+        url = "https://github.com/macports/macports-ports/raw/f9a4136c48020b01ecc6dffa99b88333c360f056/aqua/qt5/files/patch-qtwebengine_chromium_static_page_size.diff";
+        hash = "sha256-8TFN5XU0SUvPJCFU6wvcKP5a8HCd0ygUnLT8BF4MZ/E=";
+        extraPrefix = "";
+      })
+
+      # Add "-target-feature +aes" to the arm crc32c build flags
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/9f43d823b6b4cdea62f0cc7563ff01f9239b8970.patch";
+        hash = "sha256-2WCx+ZOWA8ZyV2yiSQLx9uFZOoeWQHxLqwLEZsV41QU=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # Fix build with clang and libc++ 19
+      # https://github.com/freebsd/freebsd-ports/commit/0ddd6468fb3cb9ba390973520517cb1ca2cd690d
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-libc++19";
+        hash = "sha256-pSVPnuEpjFHW60dbId5sZ3zHP709EWG4LSWoS+TkgcQ=";
+        extraPrefix = "";
+      })
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-src_3rdparty_chromium_third__party_blink_renderer_platform_wtf_hash__table.h";
+        hash = "sha256-+vyWC7Indd1oBhvL5fMTlIH4mM4INgISZFAbHsq32Lg=";
+        extraPrefix = "";
+      })
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-src_3rdparty_chromium_third__party_perfetto_include_perfetto_tracing_internal_track__event__data__source.h";
+        hash = "sha256-DcAYOV9b30ogPCiedvQimEmiZpUJquk5j6WLjJxR54U=";
+        extraPrefix = "";
+      })
     ];
 
     postPatch =
@@ -248,6 +307,8 @@ qtModule (
             # https://trac.macports.org/ticket/70850
             "-Wno-enum-constexpr-conversion"
             "-Wno-unused-but-set-variable"
+            # Clang 19
+            "-Wno-error=missing-template-arg-list-after-template-kw"
           ]
         );
       }
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 7fbfe3333a13..3944cd89e7f6 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -117,6 +117,7 @@ mapAliases {
   inherit (pkgs) gramma; # added 2024-06-26
   grammarly-languageserver = throw "grammarly-languageserver was removed because it requires EOL Node.js 16"; # added 2024-07-15
   inherit (pkgs) graphite-cli; # added 2024-01-25
+  inherit (pkgs) graphql-language-service-cli; # added 2025-03-17
   inherit (pkgs) graphqurl; # added 2023-08-19
   gtop = pkgs.gtop; # added 2023-07-31
   hs-client = pkgs.hsd; # added 2023-08-20
diff --git a/pkgs/development/python-modules/array-api-compat/default.nix b/pkgs/development/python-modules/array-api-compat/default.nix
index 1325fbd4c645..708179feb46e 100644
--- a/pkgs/development/python-modules/array-api-compat/default.nix
+++ b/pkgs/development/python-modules/array-api-compat/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "array-api-compat";
-  version = "1.11";
+  version = "1.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "data-apis";
     repo = "array-api-compat";
     tag = version;
-    hash = "sha256-sQgNHYjLqTP7tTAuYSjsIJCtrzLIlms1ayeeTWGpaQk=";
+    hash = "sha256-TB1aBad6Pl687nGblSraHmWl/tnnkoo1g6DDZHKhOaM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index 8463e1ea8c7b..298f59292134 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -26,12 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-WzkhmCk8C5Il1Fm+i6cQz4JI8e4zAGves9kvsAElkrQ=";
   };
 
-  postPatch = ''
-    # only a small portion of the listed packages are actually needed for running the tests
-    # so instead of removing them one by one remove everything
-    rm test-requirements.txt
-  '';
-
   build-system = [
     openstackdocstheme
     setuptools
diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index 4a55f9e97948..1e27430f6aaf 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.9.3";
+  version = "3.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-BJkpQhQuKm/yI3p8zspojYzUcpgMz1LAQwTx4Ppf06U=";
+    hash = "sha256-rwoyuo1xJNwtu/ox5SzfWNXjPFKGGpFJ8Htk4kSLKvs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/deepl/default.nix b/pkgs/development/python-modules/deepl/default.nix
index a5b691df269c..31540f31fcb0 100644
--- a/pkgs/development/python-modules/deepl/default.nix
+++ b/pkgs/development/python-modules/deepl/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "deepl";
-  version = "1.21.0";
+  version = "1.21.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+udougyvv8x94/zsWOLq/UXQyRffk4X5veISaWjDWp4=";
+    hash = "sha256-unGvE6BU1aPNj3TTRsHA67XpVriTT+uTRZ7qwN8Ie1Q=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/dissect-archive/default.nix b/pkgs/development/python-modules/dissect-archive/default.nix
index 011e09350085..118de52c0e0f 100644
--- a/pkgs/development/python-modules/dissect-archive/default.nix
+++ b/pkgs/development/python-modules/dissect-archive/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-archive";
-  version = "1.4";
+  version = "1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.archive";
     tag = version;
-    hash = "sha256-DhOpNllDL10Oh4CgmwHHgkU/lJbdV2vs4wCzAyLiDGU=";
+    hash = "sha256-WqzZmt95NJPX0+wGyvJZzoOJTR5qH0YYOTFsYIihE1Y=";
   };
 
   build-system = [
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing parsers for various archive and backup formats";
     homepage = "https://github.com/fox-it/dissect.archive";
-    changelog = "https://github.com/fox-it/dissect.archive/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.archive/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index aeec6cf5d066..44d613d00324 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-extfs";
-  version = "3.12";
+  version = "3.13";
   format = "pyproject";
 
   disabled = pythonOlder "3.12";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.extfs";
     tag = version;
-    hash = "sha256-i6lFqtDsqPyB0FQ5DKuYTuSenZFI0+GeOQdedov+2Nw=";
+    hash = "sha256-MAe3AJlDn8CX9xO0XU369EXnvJXTBGYZ2xD+BjG2vk4=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the ExtFS file system";
     homepage = "https://github.com/fox-it/dissect.extfs";
-    changelog = "https://github.com/fox-it/dissect.extfs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.extfs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index 25864ac92ee7..b6913627e584 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-fat";
-  version = "3.11";
+  version = "3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.fat";
     tag = version;
-    hash = "sha256-LGSIuRclytD4RHHzq2Zj1DG01RAFINj4+5ErbQ3M57E=";
+    hash = "sha256-z4pUJrJ2w0P+QytrhFExGLD0RdFR/ccGeD6DrYbOrx8=";
   };
 
   build-system = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the FAT file system";
     homepage = "https://github.com/fox-it/dissect.fat";
-    changelog = "https://github.com/fox-it/dissect.fat/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.fat/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-ffs/default.nix b/pkgs/development/python-modules/dissect-ffs/default.nix
index ac930809369f..9f7a1b2b9349 100644
--- a/pkgs/development/python-modules/dissect-ffs/default.nix
+++ b/pkgs/development/python-modules/dissect-ffs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ffs";
-  version = "3.10";
+  version = "3.11";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ffs";
     tag = version;
-    hash = "sha256-sOMakwJyKgeRXbc37D5j7GVldl3gO7yYMnNq217J7QM=";
+    hash = "sha256-rfoSUhTB++cei7X8jaSp9ek8+pAAyaNkYC0M5cCDBtk=";
   };
 
   build-system = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the FFS file system";
     homepage = "https://github.com/fox-it/dissect.ffs";
-    changelog = "https://github.com/fox-it/dissect.ffs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.ffs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index b9816645e0ab..9d5e0df92593 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-hypervisor";
-  version = "3.16";
+  version = "3.17";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.hypervisor";
     tag = version;
-    hash = "sha256-9Ev7/W/+gfljBPCu4OGXzg2cWkUNFijcaRtKGkTck5k=";
+    hash = "sha256-3seluZDN5rfJ2XQPblNpEXZQwjxTZB10IwYNZirb7J0=";
   };
 
   build-system = [
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing parsers for various hypervisor disk, backup and configuration files";
     homepage = "https://github.com/fox-it/dissect.hypervisor";
-    changelog = "https://github.com/fox-it/dissect.hypervisor/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.hypervisor/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index d7bdfab7a3d4..dbceefc817c0 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ntfs";
-  version = "3.13";
+  version = "3.14";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ntfs";
     tag = version;
-    hash = "sha256-DOxyPlHBv4PEbHeGC/pj2QzbGhKFjw6QOAJmhq6Fc3k=";
+    hash = "sha256-C2tve1RVR8Q7t1Xz7Of1xRZH6IuLP9nL2l1cHbycFQ4=";
   };
 
   build-system = [
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the NTFS file system";
     homepage = "https://github.com/fox-it/dissect.ntfs";
-    changelog = "https://github.com/fox-it/dissect.ntfs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.ntfs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
index 15328e611a67..63408a044e28 100644
--- a/pkgs/development/python-modules/dissect-squashfs/default.nix
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-squashfs";
-  version = "1.8";
+  version = "1.9";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.squashfs";
     tag = version;
-    hash = "sha256-C5Rp7MNuJjAk+DcjhNQfzZR47E/A2cJawhS6OFGU5xo=";
+    hash = "sha256-8u+pWUTUr4Warhb28XTxVU/jzOkXW+O6V8gDoAAlAbc=";
   };
 
   build-system = [
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the SquashFS file system";
     homepage = "https://github.com/fox-it/dissect.squashfs";
-    changelog = "https://github.com/fox-it/dissect.squashfs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.squashfs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index 5ab0ee81e5ab..8f91f46dcecc 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-vmfs";
-  version = "3.10";
+  version = "3.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.vmfs";
     tag = version;
-    hash = "sha256-/D5EaTNLxdzTMF/9S9esFXAxIwesEp0tdAMUAyeNtSI=";
+    hash = "sha256-jGPHZ26DDIcblgx4hP6L2BLHYY8YeIBcbxNR7bN/49g=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the VMFS file system";
     homepage = "https://github.com/fox-it/dissect.vmfs";
-    changelog = "https://github.com/fox-it/dissect.vmfs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.vmfs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-xfs/default.nix b/pkgs/development/python-modules/dissect-xfs/default.nix
index 56ebf890053e..98d7c457b06e 100644
--- a/pkgs/development/python-modules/dissect-xfs/default.nix
+++ b/pkgs/development/python-modules/dissect-xfs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-xfs";
-  version = "3.11";
+  version = "3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.xfs";
     tag = version;
-    hash = "sha256-+dt47Wo5IMkMgd5lUWgpbB6n/tkWc+d1jnKD46Cq1Lc=";
+    hash = "sha256-DKM6z5lasvy2Is64W2lvClgpXslTgNehrfBpa/KtkT0=";
   };
 
   build-system = [
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the XFS file system";
     homepage = "https://github.com/fox-it/dissect.xfs";
-    changelog = "https://github.com/fox-it/dissect.xfs/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.xfs/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/docling/default.nix b/pkgs/development/python-modules/docling/default.nix
index b98043ed23f2..21df13d97842 100644
--- a/pkgs/development/python-modules/docling/default.nix
+++ b/pkgs/development/python-modules/docling/default.nix
@@ -48,14 +48,14 @@
 
 buildPythonPackage rec {
   pname = "docling";
-  version = "2.25.2";
+  version = "2.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DS4SD";
     repo = "docling";
     tag = "v${version}";
-    hash = "sha256-QHjcyHxfpmz65EfzNNEmjonGs3YOyMY43J2pIi65LNo=";
+    hash = "sha256-MFMOxNXA/QwQJt/WZmtmmD+OxYxY2LCnutPT4PkZzkw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index ad9a0e437947..78c95944f5e6 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.22.6";
+  version = "0.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-f0VPc8Bc/sbZZTkp1NO2sORCl2Si4UYOKbzK8olzQWA=";
+    hash = "sha256-S1+ZEkLsKJJ3fMWDNkg4uxqLLY4kWXBB7GljUAj5Z7Y=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fastai/default.nix b/pkgs/development/python-modules/fastai/default.nix
index a8ba3206a8e1..ce6300fbb101 100644
--- a/pkgs/development/python-modules/fastai/default.nix
+++ b/pkgs/development/python-modules/fastai/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fastai";
-  version = "2.7.18";
+  version = "2.7.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sgWT28rnUi8dd6j1Fj0f1gMU8pJkBJaATcNW5ByzZFQ=";
+    hash = "sha256-CoBABtO2NkrNVUTzQ58vBdRe2rr4ji26iJOzema4Nsg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/functions-framework/default.nix b/pkgs/development/python-modules/functions-framework/default.nix
new file mode 100644
index 000000000000..b9df27a48b5f
--- /dev/null
+++ b/pkgs/development/python-modules/functions-framework/default.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPythonPackage,
+  click,
+  cloudevents,
+  deprecation,
+  docker,
+  fetchFromGitHub,
+  flask,
+  gunicorn,
+  pretend,
+  pytest-asyncio,
+  pytestCheckHook,
+  requests,
+  setuptools,
+  watchdog,
+  werkzeug,
+}:
+
+buildPythonPackage rec {
+  pname = "functions-framework";
+  version = "3.8.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "GoogleCloudPlatform";
+    repo = "functions-framework-python";
+    rev = "v${version}";
+    hash = "sha256-wLL8VWhRb3AEa41DO/mwx3G0AwmLACiXeDvo+LEq1xM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    cloudevents
+    deprecation
+    flask
+    gunicorn
+    watchdog
+    werkzeug
+  ];
+
+  nativeCheckInputs = [
+    docker
+    pretend
+    pytest-asyncio
+    pytestCheckHook
+    requests
+  ];
+
+  disabledTests = [
+    # Test requires a running Docker instance
+    "test_cloud_run_http"
+  ];
+
+  pythonImportsCheck = [ "functions_framework" ];
+
+  meta = {
+    description = "FaaS (Function as a service) framework for writing portable Python functions";
+    homepage = "https://github.com/GoogleCloudPlatform/functions-framework-python";
+    changelog = "https://github.com/GoogleCloudPlatform/functions-framework-python/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 1b2d87d166a3..4458b38abb85 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2025.1.30.194235";
+  version = "2025.3.8.214559";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-P3KUpmltw7xX/6xq9RMFlP8UMDp2/ynvVCkK3rvwzk0=";
+    hash = "sha256-ExAQPrvK6lQ+tmsgNNAvbsVWGuZyqjRecL/5fW0dLgY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index e7139259acfb..50623673355a 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lightning-utilities";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "utilities";
     tag = "v${version}";
-    hash = "sha256-lRH1ZQQHnn18NxmLDHy/uSgzgXpLuDD5/08OIErEs7g=";
+    hash = "sha256-QHE2ksoINQ0sfTSxXxM9ZVEIhEOncaq1i8ZNqznISJw=";
   };
 
   postPatch = ''
@@ -49,9 +49,13 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    "lightning_utilities.core.enums.StrEnum"
+    # DocTestFailure
     "lightning_utilities.core.imports.RequirementCache"
+
+    # NameError: name 'operator' is not defined. Did you forget to import 'operator'
     "lightning_utilities.core.imports.compare_version"
+
+    # importlib.metadata.PackageNotFoundError: No package metadata was found for pytorch-lightning==1.8.0
     "lightning_utilities.core.imports.get_dependency_min_version_spec"
 
     # weird doctests fail on imports, but providing the dependency
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 8cb19f3fd81b..c4c0ab1d8aba 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.6.2";
+  version = "0.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     tag = version;
-    hash = "sha256-QUWQlU2S1tBKXYOODXP7x8p8lIlWJVIvF0bRrEFYJMY=";
+    hash = "sha256-HkWl0fHb+nmcH4uczUAbNyizm1nP8a7Mo3zUoN1FxTo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 70b8b5fff1d1..03be792bd42e 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20250314";
+  version = "1.0.2.20250316";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ssjLDBvX8TU7BEeA5k9VcE1TDaW7aY8A64rqdo8cxzw=";
+    hash = "sha256-NXY0nwXeRyZuY8MfJLi4bKlxgL4EplKGLHZLogZrqHs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pygobject-stubs/default.nix b/pkgs/development/python-modules/pygobject-stubs/default.nix
index a0314bc51b1c..08527f43efc6 100644
--- a/pkgs/development/python-modules/pygobject-stubs/default.nix
+++ b/pkgs/development/python-modules/pygobject-stubs/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject-stubs";
-  version = "2.12.0";
+  version = "2.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "pygobject";
     repo = "pygobject-stubs";
     tag = "v${version}";
-    hash = "sha256-Y9tqfv2DP2daxxafcQAtxH33pR3FHE8av0PkzEcs0RU=";
+    hash = "sha256-d7caFIjRRFEZYyCDUcilJ7iquUdltZ0ZQupxQ6ITUEc=";
   };
 
   build-system = [ setuptools ];
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "PEP 561 Typing Stubs for PyGObject";
     homepage = "https://github.com/pygobject/pygobject-stubs";
-    changelog = "https://github.com/pygobject/pygobject-stubs/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pygobject/pygobject-stubs/blob/${src.tag}/CHANGELOG.md";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ hacker1024 ];
   };
diff --git a/pkgs/development/python-modules/pyoxigraph/default.nix b/pkgs/development/python-modules/pyoxigraph/default.nix
new file mode 100644
index 000000000000..29115fa8573a
--- /dev/null
+++ b/pkgs/development/python-modules/pyoxigraph/default.nix
@@ -0,0 +1,70 @@
+{
+  stdenv,
+  apple-sdk_15,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  pythonOlder,
+  pytestCheckHook,
+  rustPlatform,
+}:
+buildPythonPackage rec {
+  pname = "pyoxigraph";
+  pyproject = true;
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "oxigraph";
+    repo = "oxigraph";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-yMXNt7pGiwYDXjmHxKUQpqNrAmnFpg21Vc5R1DmwsHc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-qOGpM3SOAOMO5W3wj4ruXlymp9bV4sqOU75gMVSEyfk=";
+  };
+
+  buildAndTestSubdir = "python";
+
+  dependencies = lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
+  disabled = pythonOlder "3.8";
+
+  disabledTests = [
+    "test_update_load"
+  ];
+
+  disabledTestPaths = [
+    # These require network access
+    "lints/test_spec_links.py"
+    "lints/test_debian_compatibility.py"
+    "oxrocksdb-sys/rocksdb/tools/block_cache_analyzer/block_cache_pysim_test.py"
+    "oxrocksdb-sys/rocksdb/tools"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "pyoxigraph" ];
+
+  meta = {
+    homepage = "https://github.com/oxigraph/oxigraph";
+    description = "SPARQL graph database";
+    maintainers = with lib.maintainers; [ dadada ];
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/pyqt/sip.nix b/pkgs/development/python-modules/pyqt/sip.nix
index 4a4ceebf66a6..d5195eac8466 100644
--- a/pkgs/development/python-modules/pyqt/sip.nix
+++ b/pkgs/development/python-modules/pyqt/sip.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyqt5-sip";
-  version = "12.15.0";
+  version = "12.17.0";
 
   src = fetchPypi {
-    pname = "PyQt5_sip";
+    pname = "pyqt5_sip";
     inherit version;
-    hash = "sha256-0j/fzzY7XO3Z05+KnFcQ59UoBPWwiljpHGOLNur8twI=";
+    hash = "sha256-aC2tzb0iOa+f3AwGKOJ3a4IOEovsiLSbjWkv5oL5C08=";
   };
 
   # There is no test code and the check phase fails with:
diff --git a/pkgs/development/python-modules/python-ironicclient/default.nix b/pkgs/development/python-modules/python-ironicclient/default.nix
index c1b31bfb091a..33a6f644051a 100644
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@@ -65,7 +65,16 @@ buildPythonPackage rec {
 
   checkPhase = ''
     runHook preCheck
-    stestr run
+    stestr run -e <(echo "
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_no_options
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_description
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_extra
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_uuid
+      ironicclient.tests.unit.osc.v1.test_baremetal_conductor.TestBaremetalConductorShow.test_conductor_show
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestBaremetalCreate
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestBaremetalShow.test_baremetal_show
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestNodeHistoryEventGet.test_baremetal_node_history_list
+    ")
     runHook postCheck
   '';
 
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index 9da9db72da9b..14861be515de 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "15.4.0";
+  version = "15.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     tag = version;
-    hash = "sha256-IAsa/GjTydKZq9Nh9MSVRb2DujICVQT38hMPTjzQyBw=";
+    hash = "sha256-s/ocJi7NidebFkd724p/k7njOzELsdh7n9nQXaeVXV8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/smolagents/default.nix b/pkgs/development/python-modules/smolagents/default.nix
new file mode 100644
index 000000000000..678f2e9fb46a
--- /dev/null
+++ b/pkgs/development/python-modules/smolagents/default.nix
@@ -0,0 +1,130 @@
+{
+  lib,
+  accelerate,
+  buildPythonPackage,
+  docker,
+  duckduckgo-search,
+  fetchFromGitHub,
+  gradio,
+  huggingface-hub,
+  jinja2,
+  ipython,
+  litellm,
+  markdownify,
+  mcp,
+  openai,
+  pandas,
+  pillow,
+  pytestCheckHook,
+  python-dotenv,
+  rank-bm25,
+  requests,
+  rich,
+  setuptools,
+  soundfile,
+  torch,
+  torchvision,
+  transformers,
+  websocket-client,
+}:
+
+buildPythonPackage rec {
+  pname = "smolagents";
+  version = "1.11.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = "smolagents";
+    tag = "v${version}";
+    hash = "sha256-6+fI5Zp2UyDgcCUXYT34zumDBqkIeW+TXnRNA+SFoxI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    duckduckgo-search
+    huggingface-hub
+    jinja2
+    markdownify
+    pandas
+    pillow
+    python-dotenv
+    requests
+    rich
+  ];
+
+  optional-dependencies = {
+    audio = [ soundfile ];
+    docker = [
+      docker
+      websocket-client
+    ];
+    # e2b = [
+    #   e2b-code-interpreter
+    #   python-dotenv
+    # ];
+    gradio = [ gradio ];
+    litellm = [ litellm ];
+    mcp = [
+      mcp
+      # mcpadapt
+    ];
+    # mlx-lm = [ mlx-lm ];
+    openai = [ openai ];
+    # telemetry = [
+    #   arize-phoenix
+    #   openinference-instrumentation-smolagents
+    #   opentelemetry-exporter-otlp
+    #   opentelemetry-sdk
+    # ];
+    torch = [
+      torch
+      torchvision
+    ];
+    transformers = [
+      accelerate
+      transformers
+    ];
+    # vision = [
+    #   helium
+    #   selenium
+    # ];
+    # vllm = [
+    #   torch
+    #   vllm
+    # ];
+  };
+
+  nativeCheckInputs = [
+    ipython
+    pytestCheckHook
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "smolagents" ];
+
+  disabledTests = [
+    # Missing dependencies
+    "test_ddgs_with_kwargs"
+    "test_e2b_executor_instantiation"
+    "test_flatten_messages_as_text_for_all_models"
+    "test_from_mcp"
+    "test_import_smolagents_without_extras"
+    "test_vision_web_browser_main"
+    # Tests require network access
+    "test_agent_type_output"
+    "test_can_import_sklearn_if_explicitly_authorized"
+    "test_transformers_message_no_tool"
+    "test_transformers_message_vl_no_tool"
+    "test_transformers_toolcalling_agent"
+    "test_visit_webpage"
+  ];
+
+  meta = {
+    description = "Barebones library for agents";
+    homepage = "https://github.com/huggingface/smolagents";
+    changelog = "https://github.com/huggingface/smolagents/releases/tag/v${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqliteschema/default.nix b/pkgs/development/python-modules/sqliteschema/default.nix
index f4c5c89e08e7..7e5b4c883ce1 100644
--- a/pkgs/development/python-modules/sqliteschema/default.nix
+++ b/pkgs/development/python-modules/sqliteschema/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   mbstrdecoder,
   setuptools,
+  setuptools-scm,
   simplesqlite,
   sqliteschema,
   tabledata,
@@ -13,17 +14,20 @@
 
 buildPythonPackage rec {
   pname = "sqliteschema";
-  version = "1.4.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thombashi";
     repo = "sqliteschema";
-    rev = "v${version}";
-    hash = "sha256-IzHdYBnh6udVsanWTPSsX4p4PG934YCdzs9Ow/NW86E=";
+    tag = "v${version}";
+    hash = "sha256-ZGDzGfj78v8o0GvAHcP26JiJCOWPaIr2h1Lqzh5AuSg=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     mbstrdecoder
diff --git a/pkgs/development/python-modules/stravalib/default.nix b/pkgs/development/python-modules/stravalib/default.nix
index abcf77d21f14..c639769de3b6 100644
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "stravalib";
-  version = "2.2";
+  version = "2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "stravalib";
     repo = "stravalib";
     tag = "v${version}";
-    hash = "sha256-4T5/Sqni9DCE/sIyNCZA8FzFo7lRAsrF+2JP8ydSGqw=";
+    hash = "sha256-kqR/fujspOyQ6QbWjP2n3NoLVkzzVxAMqntdhY84sl4=";
   };
 
   build-system = [
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for interacting with Strava v3 REST API";
     homepage = "https://github.com/stravalib/stravalib";
-    changelog = "https://github.com/stravalib/stravalib/releases/tag/v${version}";
+    changelog = "https://github.com/stravalib/stravalib/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sikmir ];
   };
diff --git a/pkgs/development/python-modules/sumo/default.nix b/pkgs/development/python-modules/sumo/default.nix
index 6f94f35451f3..7b0e312ac9ce 100644
--- a/pkgs/development/python-modules/sumo/default.nix
+++ b/pkgs/development/python-modules/sumo/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "sumo";
-  version = "2.3.10";
+  version = "2.3.11";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "SMTG-UCL";
     repo = "sumo";
     tag = "v${version}";
-    hash = "sha256-WoOW+JPo5x9V6LN+e8Vf3Q3ohHhQVK81s0Qk7oPn1Tk=";
+    hash = "sha256-A6lwTQsX8J+7+9jkkZjBS0MLcJHneBVpy7RsJA22Bic=";
   };
 
   build-system = [
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Toolkit for plotting and analysis of ab initio solid-state calculation data";
     homepage = "https://github.com/SMTG-UCL/sumo";
-    changelog = "https://github.com/SMTG-Bham/sumo/releases/tag/v${version}";
+    changelog = "https://github.com/SMTG-Bham/sumo/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ psyanticy ];
   };
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index 980165a6c29f..444e0b7191d2 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
   version = "42.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-nW6cSOhC56YkyUQiXcJTqaojRseIf9q8YGSe4skhTA4=";
@@ -86,6 +84,9 @@ buildPythonPackage rec {
     chmod +x bin/*
 
     stestr --test-path tempest/tests run -e <(echo "
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_load_json_resource_list
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_load_json_saved_state
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_take_action_got_exception
       tempest.tests.lib.cli.test_execute.TestExecute.test_execute_with_prefix
     ")
   '';
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index b47eb35a12d8..ae7d0cadc179 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "2024.12.21";
+  version = "2025.3.14";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZQMok8os+EIv65FJzErZkS7fjkzBf9KBPWbyWq3HO5k=";
+    hash = "sha256-zdqiUKnm+E0evo+MOEAaFK38FaWcY3LDrnatyZoX5bc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/r-modules/wrapper-rstudio.nix b/pkgs/development/r-modules/wrapper-rstudio.nix
index 35bfcbb99f7b..fdba8b6f5255 100644
--- a/pkgs/development/r-modules/wrapper-rstudio.nix
+++ b/pkgs/development/r-modules/wrapper-rstudio.nix
@@ -1,4 +1,6 @@
 {
+  lib,
+  stdenv,
   runCommand,
   R,
   rstudio,
@@ -54,7 +56,13 @@ runCommand (rstudio.name + "-wrapper")
         ''
       else
         ''
-          ln -s ${rstudio}/share $out
+          ${lib.optionalString stdenv.hostPlatform.isLinux ''
+            # symlink files from unwrapped rstudio so that the desktop file and the icons
+            # are also installed when using the wrapped version
+            # TODO: figure out how to handle darwin .app structures
+            ln -s ${rstudio}/share $out
+          ''}
+
           makeWrapper ${rstudio}/bin/rstudio $out/bin/rstudio \
             --set R_PROFILE_USER $out/$fixLibsR
         ''
diff --git a/pkgs/development/rocq-modules/stdlib/default.nix b/pkgs/development/rocq-modules/stdlib/default.nix
index 6bfce6dacf24..2686c0f8ca7c 100644
--- a/pkgs/development/rocq-modules/stdlib/default.nix
+++ b/pkgs/development/rocq-modules/stdlib/default.nix
@@ -15,29 +15,15 @@ mkRocqDerivation {
   defaultVersion =
     with lib.versions;
     lib.switch rocq-core.version [
-      { case = isEq "9.0"; out = "9.0+rc1"; }
-      { case = isLt "8.21"; out = "8.20"; }
+      { case = isEq "9.0"; out = "9.0.0"; }
+      # the one below is artificial as stdlib was included in Coq before
+      { case = isLt "9.0"; out = "9.0.0"; }
     ] null;
   releaseRev = v: "V${v}";
 
-  release."9.0+rc1".sha256 = "sha256-raHwniQdpAX1HGlMofM8zVeXcmlUs+VJZZg5VF43k/M=";
-  release."8.20".sha256 = "sha256-AcoS4edUYCfJME1wx8UbuSQRF3jmxhArcZyPIoXcfu0=";
+  release."9.0.0".sha256 = "sha256-2l7ak5Q/NbiNvUzIVXOniEneDXouBMNSSVFbD1Pf8cQ=";
 
-  useDune = true;
-
-  configurePhase = ''
-    patchShebangs dev/with-rocq-wrap.sh
-  '';
-
-  buildPhase = ''
-    dev/with-rocq-wrap.sh dune build -p rocq-stdlib @install ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-  '';
-
-  installPhase = ''
-    dev/with-rocq-wrap.sh dune install --root . rocq-stdlib --prefix=$out --libdir $OCAMLFIND_DESTDIR
-    mkdir $out/lib/coq/
-    mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${rocq-core.rocq-version}
-  '';
+  mlPlugin = true;
 
   meta = {
     description = "The Rocq Proof Assistant -- Standard Library";
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index 5b49be77b119..60ebb5c92df5 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sbt";
-  version = "1.10.9";
+  version = "1.10.10";
 
   src = fetchurl {
     url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
-    hash = "sha256-a3BLpJduUqkcTx+zmU1yXturCAfF/DrCnMVB18JSYzU=";
+    hash = "sha256-kd5PGnWpf+X9/20uXlbuWTN8d2pHYIsN/2BEUf0sUvo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/godot/default.nix b/pkgs/development/tools/godot/default.nix
index c81d2762d5f4..d434e29bc4ab 100644
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@@ -7,7 +7,7 @@ let
   mkGodotPackages =
     versionPrefix:
     let
-      attrs = import ./${versionPrefix};
+      attrs = import (./. + "/${versionPrefix}/default.nix");
       inherit (attrs)
         version
         hash
diff --git a/pkgs/development/tools/rust/cargo-outdated/default.nix b/pkgs/development/tools/rust/cargo-outdated/default.nix
index 56f6e258638a..d76f344a63a6 100644
--- a/pkgs/development/tools/rust/cargo-outdated/default.nix
+++ b/pkgs/development/tools/rust/cargo-outdated/default.nix
@@ -1,40 +1,27 @@
 {
   lib,
   rustPlatform,
-  fetchCrate,
+  fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  curl,
-  CoreFoundation,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
-
 rustPlatform.buildRustPackage rec {
   pname = "cargo-outdated";
-  version = "0.16.0";
+  version = "0.17.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-bAo3098QxepKbvBb9uF6iGNW0+RAKCCMyWfuG5WyREo=";
+  src = fetchFromGitHub {
+    owner = "kbknapp";
+    repo = "cargo-outdated";
+    rev = "v${version}";
+    hash = "sha256-ey11ANSflWGnCsn6M9GupgC4DE5mWww6vw5pK0CFdLo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-h+sxnTAJ1uhPUk5dRiYPgPoxvbpVggnCn0TQ6kRCzO4=";
+  cargoHash = "sha256-PYlVXGfitsjEGiw07L5b+L8pfxvtkHshIjTXeuPUTdk=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      curl
-      CoreFoundation
-      CoreServices
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Cargo subcommand for displaying when Rust dependencies are out of date";
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 06db8067588d..26cc76b25e66 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.14-rc6",
-        "hash": "sha256:01fzqqb32aazyg4jayiphzqy0y3q7k8545i7p940gdah8ck017vc"
+        "version": "6.14-rc7",
+        "hash": "sha256:0bw3xip9qg4zr42vx28iai954g5a1wprrrkr81zn7x7vv3ayjvya"
     },
     "6.1": {
         "version": "6.1.131",
diff --git a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
index 9212db7482fe..53913aa00d45 100644
--- a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "KartoffelToby";
   domain = "better_thermostat";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "KartoffelToby";
     repo = "better_thermostat";
     tag = version;
-    hash = "sha256-zXO2UDLhSTOemzsO9G5ZUzr50Zg8kDW/aObn6Y3j70k=";
+    hash = "sha256-rE14iKAXo3hecK3bQ9MLcOtnZviwjOpYKGlIc4+uCfw=";
   };
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index b5998456798d..bf4e95796ecc 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -2,6 +2,7 @@
 , gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
 , help2man
 , fetchzip
+, fetchpatch
 , buildPackages
 , nixosTests
 , fuse # only needed for grub-mount
@@ -76,6 +77,408 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-bash-completion.patch
     ./add-hidden-menu-entries.patch
+
+    # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
+    (fetchpatch {
+      name = "01_implement_grub_strlcpy.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f";
+      hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I=";
+    })
+    (fetchpatch {
+      name = "02_CVE-2024-45781.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba";
+      hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw=";
+    })
+    (fetchpatch {
+      name = "03_CVE-2024-45782_CVE-2024-56737.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3";
+      hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8=";
+    })
+    (fetchpatch {
+      name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d";
+      hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg=";
+    })
+    (fetchpatch {
+      name = "05_CVE-2024-45780.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3";
+      hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls=";
+    })
+    (fetchpatch {
+      name = "06_fs_f2fs_grub_errno_mount_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3";
+      hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q=";
+    })
+    (fetchpatch {
+      name = "07_CVE-2024-45783.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898";
+      hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM=";
+    })
+    (fetchpatch {
+      name = "08_fs_iso9660_grub_errno_mount_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97";
+      hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI=";
+    })
+    (fetchpatch {
+      name = "09_fs_iso9660_fix_invalid_free.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611";
+      hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI=";
+    })
+    (fetchpatch {
+      name = "10_fs_jfs_fix_oob_read_jfs_getent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb";
+      hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY=";
+    })
+    (fetchpatch {
+      name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7";
+      hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY=";
+    })
+    (fetchpatch {
+      name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef";
+      hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg=";
+    })
+    (fetchpatch {
+      name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28";
+      hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk=";
+    })
+    (fetchpatch {
+      name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c";
+      hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ=";
+    })
+    (fetchpatch {
+      name = "15_fs_ntfs_fix_out-of-bounds_read.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732";
+      hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI=";
+    })
+    (fetchpatch {
+      name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a";
+      hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM=";
+    })
+    (fetchpatch {
+      name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71";
+      hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E=";
+    })
+    (fetchpatch {
+      name = "18_fs_ntfs_implement_attribute_verification.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=067b6d225d482280abad03944f04e30abcbdafa1";
+      hash = "sha256-u1+K7WIw3uJG4OhMVP5aYsgJoXpgA5rcp3nJ0/aDU6I=";
+    })
+    (fetchpatch {
+      name = "19_fs_xfs_fix_out-of-bounds_read.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a";
+      hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE=";
+    })
+    (fetchpatch {
+      name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a";
+      hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg=";
+    })
+    (fetchpatch {
+      name = "21_kern_file_ensure_file_data_is_set.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17";
+      hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q=";
+    })
+    (fetchpatch {
+      name = "22_kern_file_implement_filesystem_reference_counting.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b";
+      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
+      hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3";
+      hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c";
+      hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173";
+      hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181";
+      hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95";
+      hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI=";
+    })
+    (fetchpatch {
+      name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc";
+      hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8=";
+    })
+    (fetchpatch {
+      name = "23_CVE-2024-49504.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e";
+      hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y=";
+    })
+    (fetchpatch {
+      name = "24_disk_loopback_reference_tracking_for_the_loopback.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae";
+      hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA=";
+    })
+    (fetchpatch {
+      name = "25_kern_disk_limit_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b";
+      hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw=";
+    })
+    (fetchpatch {
+      name = "26_kern_partition_limit_recursion_in_part_iterate.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a";
+      hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI=";
+    })
+    (fetchpatch {
+      name = "27_script_execute_limit_the_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1";
+      hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo=";
+    })
+    (fetchpatch {
+      name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d";
+      hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4=";
+    })
+    (fetchpatch {
+      name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401";
+      hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac=";
+    })
+    (fetchpatch {
+      name = "30_CVE-2025-0624.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1";
+      hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0=";
+    })
+    (fetchpatch {
+      name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367";
+      hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4=";
+    })
+    (fetchpatch {
+      name = "32_CVE-2024-45774.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f";
+      hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4=";
+    })
+    (fetchpatch {
+      name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d";
+      hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk=";
+    })
+    # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49)
+    # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12
+    (fetchpatch {
+      name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99";
+      hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg=";
+    })
+    (fetchpatch {
+      name = "36_CVE-2024-45775.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872";
+      hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY=";
+    })
+    (fetchpatch {
+      name = "37_commands_ls_fix_NULL_dereference.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56";
+      hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI=";
+    })
+    (fetchpatch {
+      name = "38_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726";
+      hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw=";
+    })
+    (fetchpatch {
+      name = "39_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67";
+      hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA=";
+    })
+    (fetchpatch {
+      name = "40_CVE-2025-0622.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637";
+      hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms=";
+    })
+    (fetchpatch {
+      name = "41_CVE-2024-45776.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91";
+      hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY=";
+    })
+    (fetchpatch {
+      name = "42_CVE-2024-45777.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515";
+      hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo=";
+    })
+    (fetchpatch {
+      name = "43_CVE-2025-0690.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc";
+      hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY=";
+    })
+    (fetchpatch {
+      name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af";
+      hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY=";
+    })
+    (fetchpatch {
+      name = "45_CVE-2025-1118.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f";
+      hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc=";
+    })
+    (fetchpatch {
+      name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c";
+      hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA=";
+    })
+    (fetchpatch {
+      name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99";
+      hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE=";
+    })
+    (fetchpatch {
+      name = "48_CVE-2024-45778_CVE-2024-45779.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630";
+      hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI=";
+    })
+    (fetchpatch {
+      name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74";
+      hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE=";
+    })
+    (fetchpatch {
+      name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa";
+      hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ=";
+    })
+    (fetchpatch {
+      name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f";
+      hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E=";
+    })
+    (fetchpatch {
+      name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464";
+      hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0=";
+    })
+    (fetchpatch {
+      name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753";
+      hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4=";
+    })
+    (fetchpatch {
+      name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7";
+      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
+      hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek=";
+    })
+    (fetchpatch {
+      name = "55_CVE-2025-0678_CVE-2025-1125.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e";
+      hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4=";
+    })
+    (fetchpatch {
+      name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31";
+      hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys=";
+    })
+    (fetchpatch {
+      name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9";
+      hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA=";
+    })
+    (fetchpatch {
+      name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c";
+      hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk=";
+    })
+    (fetchpatch {
+      name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892";
+      hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0=";
+    })
+    (fetchpatch {
+      name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4";
+      hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o=";
+    })
+    (fetchpatch {
+      name = "61_net_use_safe_math_macros_to_prevent_overflows.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391";
+      hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg=";
+    })
+    (fetchpatch {
+      name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb";
+      hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk=";
+    })
+    (fetchpatch {
+      name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8";
+      hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388=";
+    })
+    (fetchpatch {
+      name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15";
+      hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU=";
+    })
+    (fetchpatch {
+      name = "65_script_execute_fix_potential_underflow_and_NULL.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e";
+      hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8=";
+    })
+    (fetchpatch {
+      name = "66_osdep_unix_getroot_fix_potential_underflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e";
+      hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc=";
+    })
+    (fetchpatch {
+      name = "67_misc_ensure_consistent_overflow_error_messages.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3";
+      hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI=";
+    })
+    (fetchpatch {
+      name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956";
+      hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I=";
+    })
+    (fetchpatch {
+      name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb";
+      hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM=";
+    })
+    (fetchpatch {
+      name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2";
+      hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI=";
+    })
+    (fetchpatch {
+      name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7";
+      hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg=";
+    })
+    (fetchpatch {
+      name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a";
+      hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8=";
+    })
+    (fetchpatch {
+      name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c";
+      hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4=";
+    })
+    (fetchpatch {
+      # Fixes 7e2f750f0a (security patch 14/73)
+      name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
+      hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
+    })
   ];
 
   postPatch = if kbdcompSupport then ''
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index f6cb97c7d157..c5c5e4910ba7 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -201,7 +201,7 @@ in lib.makeExtensible (self: ({
     self_attribute_name = "git";
   };
 
-  latest = self.nix_2_25;
+  latest = self.nix_2_26;
 
   # The minimum Nix version supported by Nixpkgs
   # Note that some functionality *might* have been backported into this Nix version,
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 720b69b10fee..e192804ccac5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -213,7 +213,7 @@ mapAliases {
   bibata-extra-cursors = throw "bibata-cursors has been removed as it was broken"; # Added 2024-07-15
   bitcoin-unlimited = throw "bitcoin-unlimited has been removed as it was broken and unmaintained"; # Added 2024-07-15
   bitcoind-unlimited = throw "bitcoind-unlimited has been removed as it was broken and unmaintained"; # Added 2024-07-15
-  bird = bird2; # Added 2025-01-11
+  bird = throw "The bird alias was ambiguous and has been removed for the time being. Please explicitly choose bird2 or bird3."; # Added 2025-01-11
   bisq-desktop = throw "bisq-desktop has been removed because OpenJFX 11 was removed"; # Added 2024-11-17
   bitwarden = bitwarden-desktop; # Added 2024-02-25
   blender-with-packages = args:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 05477589283a..127414b954d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5644,7 +5644,7 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  inherit (coqPackages) compcert;
+  inherit (coqPackages_8_20) compcert;
 
   computecpp = wrapCCWith rec {
     cc = computecpp-unwrapped;
@@ -6582,9 +6582,7 @@ with pkgs;
   cargo-edit = callPackage ../development/tools/rust/cargo-edit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security SystemConfiguration;
-  };
+  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated { };
   inherit (callPackages ../development/tools/rust/cargo-pgrx { })
     cargo-pgrx_0_12_0_alpha_1
     cargo-pgrx_0_12_5
@@ -17053,7 +17051,8 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
-  why3 = callPackage ../applications/science/logic/why3 { };
+  why3 = callPackage ../applications/science/logic/why3
+    { coqPackages = coqPackages_8_20; };
 
   yices = callPackage ../applications/science/logic/yices {
     gmp-static = gmp.override { withStatic = true; };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index c79ab2016ce8..ad96a655d439 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -237,7 +237,7 @@ in rec {
   coq_8_18 = mkCoq "8.18";
   coq_8_19 = mkCoq "8.19";
   coq_8_20 = mkCoq "8.20";
-  coq_9_0  = mkCoq "9.0+rc1";
+  coq_9_0  = mkCoq "9.0";
 
   coqPackages_8_5 = mkCoqPackages coq_8_5;
   coqPackages_8_6 = mkCoqPackages coq_8_6;
@@ -257,6 +257,6 @@ in rec {
   coqPackages_8_20 = mkCoqPackages coq_8_20;
   coqPackages_9_0 = mkCoqPackages coq_9_0;
 
-  coqPackages = recurseIntoAttrs coqPackages_8_20;
+  coqPackages = recurseIntoAttrs coqPackages_9_0;
   coq = coqPackages.coq;
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0b97a88a7f24..208db01f62b0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5113,6 +5113,8 @@ self: super: with self; {
 
   funcsigs = callPackage ../development/python-modules/funcsigs { };
 
+  functions-framework = callPackage ../development/python-modules/functions-framework { };
+
   functiontrace = callPackage ../development/python-modules/functiontrace { };
 
   funcy = callPackage ../development/python-modules/funcy { };
@@ -12643,6 +12645,8 @@ self: super: with self; {
 
   pyowm = callPackage ../development/python-modules/pyowm { };
 
+  pyoxigraph = callPackage ../development/python-modules/pyoxigraph { };
+
   pypager = callPackage ../development/python-modules/pypager { };
 
   pypamtest = toPythonModule (pkgs.libpam-wrapper.override {
@@ -15399,6 +15403,8 @@ self: super: with self; {
 
   smoke-zephyr = callPackage ../development/python-modules/smoke-zephyr { };
 
+  smolagents = callPackage ../development/python-modules/smolagents { };
+
   smpplib = callPackage ../development/python-modules/smpplib { };
 
   smpp-pdu = callPackage ../development/python-modules/smpp-pdu { };
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index a6478bda519f..1253ebd1f4f8 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -49,7 +49,7 @@ in rec {
     let self = lib.makeScope newScope (lib.flip mkRocqPackages' rocq-core); in
     self.filterPackages (! rocq-core.dontFilter or false);
 
-  rocq-core_9_0  = mkRocq "9.0+rc1";
+  rocq-core_9_0  = mkRocq "9.0";
 
   rocqPackages_9_0 = mkRocqPackages rocq-core_9_0;