diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 4936edc3dd25..34c236dcd2a6 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -13,7 +13,7 @@ let
 
   haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != "" || cfg.extraAliases != "";
   haveCanonical = cfg.canonical != "";
-  haveTransport = cfg.transport != "" || (cfg.enableSlowDomains && cfg.slowDomains != [ ]);
+  haveTransport = cfg.transport != "";
   haveVirtual = cfg.virtual != "";
   haveLocalRecipients = cfg.localRecipients != null;
 
@@ -319,20 +319,13 @@ let
   aliasesFile = pkgs.writeText "postfix-aliases" aliases;
   canonicalFile = pkgs.writeText "postfix-canonical" cfg.canonical;
   virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
-  transportFile = pkgs.writeText "postfix-transport" (
-    lib.optionalString (cfg.enableSlowDomains && cfg.slowDomains != [ ]) (
-      lib.concatMapStrings (domain: ''
-        ${domain} slow:
-      '') cfg.slowDomains
-    )
-    + cfg.transport
-  );
   localRecipientMapFile = pkgs.writeText "postfix-local-recipient-map" (
     lib.concatMapStrings (x: x + " ACCEPT\n") cfg.localRecipients
   );
   checkClientAccessFile = pkgs.writeText "postfix-check-client-access" cfg.dnsBlacklistOverrides;
   mainCfFile = pkgs.writeText "postfix-main.cf" mainCf;
   masterCfFile = pkgs.writeText "postfix-master.cf" masterCfContent;
+  transportFile = pkgs.writeText "postfix-transport" cfg.transport;
   headerChecksFile = pkgs.writeText "postfix-header-checks" headerChecks;
 
 in
@@ -557,32 +550,6 @@ in
         '';
       };
 
-      enableSlowDomains = lib.mkEnableOption "slow domains feature for rate limiting specific domains";
-
-      slowDomains = lib.mkOption {
-        type = with lib.types; listOf str;
-        default = [ ];
-        example = [
-          "orange.fr"
-          "gmail.com"
-        ];
-        description = "List of domains to be rate-limited using the slow transport.";
-      };
-
-      slowDomainsConfig = {
-        defaultDestinationRateDelay = lib.mkOption {
-          type = lib.types.str;
-          default = "5s";
-          description = "Default rate delay for destinations.";
-        };
-
-        defaultDestinationConcurrencyLimit = lib.mkOption {
-          type = lib.types.int;
-          default = 3;
-          description = "Concurrency limit for slow destinations.";
-        };
-      };
-
       aliasMapType = lib.mkOption {
         type =
           with lib.types;
@@ -1018,10 +985,7 @@ in
             smtpd_tls_key_file = cfg.sslKey;
 
             smtpd_tls_security_level = lib.mkDefault "may";
-          }
-          // lib.optionalAttrs cfg.enableSlowDomains {
-            default_destination_rate_delay = cfg.slowDomainsConfig.defaultDestinationRateDelay;
-            default_destination_concurrency_limit = cfg.slowDomainsConfig.defaultDestinationConcurrencyLimit;
+
           };
 
         services.postfix.masterConfig =
@@ -1113,14 +1077,6 @@ in
                 lib.concatLists (lib.mapAttrsToList mkKeyVal cfg.submissionOptions);
             };
           }
-          // lib.optionalAttrs cfg.enableSlowDomains {
-            slow = {
-              command = "smtp";
-              type = "unix";
-              private = true;
-              maxproc = 2;
-            };
-          }
           // lib.optionalAttrs cfg.enableSmtp {
             smtp_inet = {
               name = "smtp";
@@ -1172,7 +1128,7 @@ in
       (lib.mkIf haveCanonical {
         services.postfix.mapFiles.canonical = canonicalFile;
       })
-      (lib.mkIf (haveTransport || (cfg.enableSlowDomains && cfg.slowDomains != [ ])) {
+      (lib.mkIf haveTransport {
         services.postfix.mapFiles.transport = transportFile;
       })
       (lib.mkIf haveVirtual {
diff --git a/nixos/modules/services/networking/tailscale-auth.nix b/nixos/modules/services/networking/tailscale-auth.nix
index 32ddbdfd155d..b9657ff4bc16 100644
--- a/nixos/modules/services/networking/tailscale-auth.nix
+++ b/nixos/modules/services/networking/tailscale-auth.nix
@@ -68,6 +68,7 @@ in
     systemd.services.tailscale-nginx-auth = {
       description = "Tailscale NGINX Authentication service";
       requires = [ "tailscale-nginx-auth.socket" ];
+      after = [ "tailscaled.service" ];
 
       serviceConfig = {
         ExecStart = getExe cfg.package;
@@ -107,6 +108,8 @@ in
           "~@privileged"
           "~@setuid"
         ];
+
+        Restart = "on-failure";
       };
     };
   };
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index 18a4b9f3ac84..d2762cdccf7a 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch2,
+  cmake,
   openssl,
   pkg-config,
   withPerl ? false,
@@ -21,24 +21,28 @@
   withDebug ? false,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "znc";
-  version = "1.8.2";
+  version = "1.9.1";
 
   src = fetchurl {
-    url = "https://znc.in/releases/archive/${pname}-${version}.tar.gz";
-    sha256 = "03fyi0j44zcanj1rsdx93hkdskwfvhbywjiwd17f9q1a7yp8l8zz";
+    url = "https://znc.in/releases/archive/znc-${finalAttrs.version}.tar.gz";
+    hash = "sha256-6KfPgOGarVELTigur2G1a8MN+I6i4PZPrc3TA8SJTzw=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "CVE-2024-39844.patch";
-      url = "https://github.com/znc/znc/commit/8cbf8d628174ddf23da680f3f117dc54da0eb06e.patch";
-      hash = "sha256-JeKirXReiCiNDUS9XodI0oHASg2mPDvQYtV6P4L0mHM=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace znc.pc.cmake.in \
+      --replace-fail 'bindir=''${exec_prefix}/@CMAKE_INSTALL_BINDIR@' "bindir=@CMAKE_INSTALL_FULL_BINDIR@" \
+      --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' "libdir=@CMAKE_INSTALL_FULL_LIBDIR@" \
+      --replace-fail 'datadir=''${prefix}/@CMAKE_INSTALL_DATADIR@' "datadir=@CMAKE_INSTALL_FULL_DATADIR@" \
+      --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' "includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@" \
+      --replace-fail 'datarootdir=''${prefix}/@CMAKE_INSTALL_DATAROOTDIR@' "datarootdir=@CMAKE_INSTALL_FULL_DATAROOTDIR@"
+  '';
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
   buildInputs =
     [ openssl ]
@@ -62,14 +66,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Advanced IRC bouncer";
     homepage = "https://wiki.znc.in/ZNC";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       schneefux
       lnl7
     ];
-    license = licenses.asl20;
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/networking/znc/modules.nix b/pkgs/applications/networking/znc/modules.nix
index cde866ff60fe..70cea47dcae3 100644
--- a/pkgs/applications/networking/znc/modules.nix
+++ b/pkgs/applications/networking/znc/modules.nix
@@ -3,6 +3,10 @@
   stdenv,
   fetchFromGitHub,
   znc,
+  cmake,
+  pkg-config,
+  python3,
+  which,
 }:
 
 let
@@ -11,22 +15,43 @@ let
       pname,
       src,
       module_name,
-      buildPhase ? "${znc}/bin/znc-buildmod ${module_name}.cpp",
-      installPhase ? "install -D ${module_name}.so $out/lib/znc/${module_name}.so",
+      buildPhase ? ''
+        runHook preBuild
+
+        ${znc}/bin/znc-buildmod ${module_name}.cpp
+
+        runHook postBuild
+      '',
+      installPhase ? ''
+        runHook preInstall
+
+        install -D ${module_name}.so $out/lib/znc/${module_name}.so
+
+        runHook postInstall
+      '',
       ...
     }:
     stdenv.mkDerivation (
       a
       // {
-        inherit buildPhase;
-        inherit installPhase;
+        inherit buildPhase installPhase;
+
+        nativeBuildInputs = [
+          python3
+          which
+          cmake
+          pkg-config
+        ];
+
+        dontUseCmakeConfigure = true;
 
         buildInputs = znc.buildInputs;
 
+        passthru.module_name = module_name;
+
         meta = a.meta // {
           platforms = lib.platforms.unix;
         };
-        passthru.module_name = module_name;
       }
     );
 
@@ -35,41 +60,41 @@ in
 
   backlog = zncDerivation {
     pname = "znc-backlog";
-    version = "unstable-2017-06-13";
+    version = "0-unstable-2018-08-24";
     module_name = "backlog";
 
     src = fetchFromGitHub {
       owner = "FruitieX";
       repo = "znc-backlog";
-      rev = "42e8f439808882d2dae60f2a161eabead14e4b0d";
-      sha256 = "1k7ifpqqzzf2j7w795q4mx1nvmics2higzjqr3mid3lp43sqg5s6";
+      rev = "44314a6aca0409ae59b0d841807261be1159fff4";
+      hash = "sha256-yhoMuwXul6zq4VPGn810PlFwiCUIvvV6wkQupE3svOQ=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "Request backlog for IRC channels";
       homepage = "https://github.com/fruitiex/znc-backlog/";
-      license = licenses.asl20;
+      license = lib.licenses.asl20;
       maintainers = [ ];
     };
   };
 
-  clientbuffer = zncDerivation rec {
+  clientbuffer = zncDerivation {
     pname = "znc-clientbuffer";
-    version = "unstable-2021-05-30";
+    version = "0-unstable-2021-05-30";
     module_name = "clientbuffer";
 
     src = fetchFromGitHub {
       owner = "CyberShadow";
       repo = "znc-clientbuffer";
       rev = "9a7465b413b53408f5d7af86e84b1d08efb6bec0";
-      sha256 = "0a3f4j6s5j7p53y42zrgpqyl2zm0jxb69lp24j6mni3licigh254";
+      hash = "sha256-pAj4Iot0RFuNJOLSZFaXoH5BPb4vf0H8KPfIoo0kbig=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "ZNC module for client specific buffers";
       homepage = "https://github.com/CyberShadow/znc-clientbuffer";
-      license = licenses.asl20;
-      maintainers = with maintainers; [
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
         hrdinka
         szlend
         cybershadow
@@ -77,29 +102,29 @@ in
     };
   };
 
-  clientaway = zncDerivation rec {
+  clientaway = zncDerivation {
     pname = "znc-clientaway";
-    version = "unstable-2017-04-28";
+    version = "0-unstable-2017-04-28";
     module_name = "clientaway";
 
     src = fetchFromGitHub {
-      owner = "kylef";
+      owner = "kylef-archive";
       repo = "znc-contrib";
       rev = "f6724a4a3b16b050088adde0cbeed74f189e5044";
-      sha256 = "0ikd3dzjjlr0gs0ikqfk50msm6mij99ln2rjzqavh58iwzr7n5r8";
+      hash = "sha256-KBd78ucRFbgV/jILS1OSsZqqKyjT4RmBfiBTKX8bbUY=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "ZNC clientaway module";
-      homepage = "https://github.com/kylef/znc-contrib";
-      license = licenses.gpl2;
+      homepage = "https://github.com/kylef-archive/znc-contrib";
+      license = lib.licenses.gpl2;
       maintainers = [ ];
     };
   };
 
-  fish = zncDerivation rec {
+  fish = zncDerivation {
     pname = "znc-fish";
-    version = "unstable-2017-06-26";
+    version = "0-unstable-2017-06-26";
     module_name = "fish";
 
     src = fetchFromGitHub {
@@ -107,32 +132,32 @@ in
       owner = "oilslump";
       repo = "znc-fish";
       rev = "7d91467dbb195f7b591567911210523c6087662e";
-      sha256 = "1ky5xg17k5f393whrv5iv8zsmdvdyk2f7z5qdsmxcwy3pdxy6vsm";
+      hash = "sha256-VW/je7vDc9arbrj848T0bbeqP9qx7Az5SMOVecLrxc8=";
     };
 
     meta = {
       description = "ZNC FiSH module";
-      homepage = "https://github.com/dctrwatson/znc-fish";
+      homepage = "https://github.com/oilslump/znc-fish";
       maintainers = [ lib.maintainers.offline ];
     };
   };
 
-  ignore = zncDerivation rec {
+  ignore = zncDerivation {
     pname = "znc-ignore";
-    version = "unstable-2017-04-28";
+    version = "0-unstable-2017-04-28";
     module_name = "ignore";
 
     src = fetchFromGitHub {
       owner = "kylef";
       repo = "znc-contrib";
       rev = "f6724a4a3b16b050088adde0cbeed74f189e5044";
-      sha256 = "0ikd3dzjjlr0gs0ikqfk50msm6mij99ln2rjzqavh58iwzr7n5r8";
+      hash = "sha256-KBd78ucRFbgV/jILS1OSsZqqKyjT4RmBfiBTKX8bbUY=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "ZNC ignore module";
       homepage = "https://github.com/kylef/znc-contrib";
-      license = licenses.gpl2;
+      license = lib.licenses.gpl2;
       maintainers = [ ];
     };
   };
@@ -145,48 +170,48 @@ in
     src = fetchFromGitHub {
       owner = "cocodelabs";
       repo = "znc-palaver";
-      rev = version;
+      tag = version;
       hash = "sha256-8W3uF1PrLQiEZm7JaFrpqmJLSFioa4F4qlM1J6Zua8U=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "Palaver ZNC module";
       homepage = "https://github.com/cocodelabs/znc-palaver";
-      license = licenses.mit;
-      maintainers = with maintainers; [ szlend ];
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ szlend ];
     };
   };
 
-  playback = zncDerivation rec {
+  playback = zncDerivation {
     pname = "znc-playback";
-    version = "unstable-2015-08-04";
+    version = "0-unstable-2020-05-10";
     module_name = "playback";
 
     src = fetchFromGitHub {
       owner = "jpnurmi";
       repo = "znc-playback";
-      rev = "8691abf75becc1f3d7b5bb5ad68dad17cd21863b";
-      sha256 = "0mgfajljy035051b2sx70i8xrb51zw9q2z64kf85zw1lynihzyh4";
+      rev = "8dd128bfe2b24b2cc6a9ea2e2d28bfaa28d2a833";
+      hash = "sha256-/hmwhrWDYGzjfmTeCB4mk+FABAJNZvREnuxzvzl6uo4=";
     };
 
-    meta = with lib; {
+    meta = {
       description = "Advanced playback module for ZNC";
       homepage = "https://github.com/jpnurmi/znc-playback";
-      license = licenses.asl20;
-      maintainers = with maintainers; [ hrdinka ];
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [ hrdinka ];
     };
   };
 
-  privmsg = zncDerivation rec {
+  privmsg = zncDerivation {
     pname = "znc-privmsg";
-    version = "unstable-2015-02-22";
+    version = "0-unstable-2017-04-28";
     module_name = "privmsg";
 
     src = fetchFromGitHub {
       owner = "kylef";
       repo = "znc-contrib";
-      rev = "9f1f98db56cbbea96d83e6628f657e0d62cd9517";
-      sha256 = "0n82z87gdxxragcaixjc80z8bw4bmfwbk0jrf9zs8kk42phlkkc2";
+      rev = "f6724a4a3b16b050088adde0cbeed74f189e5044";
+      hash = "sha256-KBd78ucRFbgV/jILS1OSsZqqKyjT4RmBfiBTKX8bbUY=";
     };
 
     meta = {
@@ -197,14 +222,14 @@ in
 
   push = zncDerivation rec {
     pname = "znc-push";
-    version = "unstable-2016-10-12";
+    version = "1.1.0";
     module_name = "push";
 
     src = fetchFromGitHub {
       owner = "jreese";
       repo = "znc-push";
-      rev = "cf08b9e0f483f03c28d72dd78df932cbef141f10";
-      sha256 = "0xpwjw8csyrg736g1jc1n8d6804x6kbdkrvldzhk9ldj4iwqz7ay";
+      tag = "v${version}";
+      hash = "sha256-OS2nIU/DlESpJT82cWhb75TizSO7LQr74CMz09ulKyQ=";
     };
 
     meta = {
@@ -217,5 +242,4 @@ in
       ];
     };
   };
-
 }
diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index a27b93c0c89a..6d0c4361ab78 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.176.0";
+  version = "1.178.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dqCjbaGDIbJyi44OFz4Xuu5fy0jJp1URidO2EV6pD4U=";
+    hash = "sha256-5rChYMwRtJt6jvgzJoU7OkgheJML2vgY/NhJsSE/KCI=";
   };
 
-  vendorHash = "sha256-fk74wLJuRVtw/mOyI2GIyXcX/cC/VX6Bx1rDRFsz95M=";
+  vendorHash = "sha256-0vHX4P33o6HMQ9k4Awd9+sDoLhbq/8YzrW7dkUeoR7Y=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 690601abe917..5a13b1dfea00 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -38,8 +38,6 @@ buildNpmPackage rec {
   nativeBuildInputs =
     [
       pkg-config
-      jq
-      moreutils
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       makeWrapper
@@ -73,8 +71,8 @@ buildNpmPackage rec {
       --replace-fail "useTelemetry({ version });" ""
 
     # fix version reported in sidebar and about page
-    jq '.version |= "${version}"' packages/bruno-electron/package.json | sponge packages/bruno-electron/package.json
-    jq '.version |= "${version}"' packages/bruno-app/package.json | sponge packages/bruno-app/package.json
+    ${jq}/bin/jq '.version |= "${version}"' packages/bruno-electron/package.json | ${moreutils}/bin/sponge packages/bruno-electron/package.json
+    ${jq}/bin/jq '.version |= "${version}"' packages/bruno-app/package.json | ${moreutils}/bin/sponge packages/bruno-app/package.json
   '';
 
   postConfigure = ''
diff --git a/pkgs/by-name/fa/fantomas/package.nix b/pkgs/by-name/fa/fantomas/package.nix
index 0872d65303a7..8c61867c601f 100644
--- a/pkgs/by-name/fa/fantomas/package.nix
+++ b/pkgs/by-name/fa/fantomas/package.nix
@@ -2,9 +2,9 @@
 
 buildDotnetGlobalTool {
   pname = "fantomas";
-  version = "7.0.1";
+  version = "7.0.2";
 
-  nugetHash = "sha256-2aGD6Kjh83gmssRqqZ/Uihi7VbNqNUelX4otIfCuhTI=";
+  nugetHash = "sha256-BAaENIm/ksTiXrUImRgKoIXTGIlgsX7ch6ayoFjhJXA=";
 
   meta = with lib; {
     description = "F# source code formatter";
diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
index 0e080d5510ea..770653eaf4ed 100644
--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii";
-  version = "6.2.10";
+  version = "6.2.16";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "firefly-iii";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T3XXUhls4Oi/0PGuunMLk6Wvla18fvHHI78qKsweFTE=";
+    hash = "sha256-SFl2uGHunF/IjhO5XoDCh1bJ5eIWRosv7HFDMXyknvI=";
   };
 
   buildInputs = [ php84 ];
@@ -38,13 +38,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     composerNoScripts = true;
     composerStrictValidation = true;
     strictDeps = true;
-    vendorHash = "sha256-pYnBiuzuTPP+7KSHUOj9mt+TTzgH85KeavXUfMN1ctI=";
+    vendorHash = "sha256-C7lsSon9y286DoAppteZ3fY0qaWVTe66nyFckyrnylk=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-BX8YYnewcnnOQa788DPSIID5Drqw7XhYGHcevPy0JrA=";
+    hash = "sha256-qymMgMXjKll3awXFL/Lo8DloPyqAaxoS2Lw8HBaar9g=";
   };
 
   preInstall = ''
diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix
index 5283408003d8..609ce18ba532 100644
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   useMinimalFeatures ? false,
   useArmadillo ? (!useMinimalFeatures),
@@ -92,6 +93,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8HcbA9Cj2i6DuqcJGiwqd6GkqbJP9oLdmA34g7kc/ng=";
   };
 
+  patches = [
+    # https://github.com/OSGeo/gdal/issues/12511
+    (fetchpatch {
+      url = "https://github.com/OSGeo/gdal/commit/1dd320b086606958fe970457a0640bdc4c4d494a.patch";
+      hash = "sha256-SXlNjgR4q7i3PrFfh/wzEFMrSGHQuB+ecXbGJgsROe0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/OSGeo/gdal/commit/6da26aec591656f97fd882b07d37c21aabd06373.patch";
+      hash = "sha256-s70j/S9YKGRqxwrabsV3ePeGSsnDh/ouGLtLEm+z0lU=";
+    })
+  ];
+
   nativeBuildInputs =
     [
       bison
diff --git a/pkgs/by-name/go/goflow2/package.nix b/pkgs/by-name/go/goflow2/package.nix
index 61ae91512caf..cd32fd4c7ce6 100644
--- a/pkgs/by-name/go/goflow2/package.nix
+++ b/pkgs/by-name/go/goflow2/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "2.2.2";
+  version = "2.2.3";
 in
 buildGoModule {
   pname = "goflow2";
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "netsampler";
     repo = "goflow2";
     rev = "v${version}";
-    hash = "sha256-H+YeW1FOx4hE8ad8sEWFQPxl8IOZ+xIaiSk1a5w+0+Y=";
+    hash = "sha256-nLsl3v4pvFa0d4AejjlUY9y92yKCU3jM5ui2Y+qZ3JY=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule {
     "-X=main.version=${version}"
   ];
 
-  vendorHash = "sha256-AR4jKNzHato9qz0fkHurGGfIyQC9BYsGQ/87y9mtJpE=";
+  vendorHash = "sha256-E7gWeh8GVFQdxLSZhpl5wAaShooKkC9EJJsulGaoBtE=";
 
   meta = {
     description = "High performance sFlow/IPFIX/NetFlow Collector";
diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index 4adca9bc59c6..bf60e0fd38f2 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -64,6 +64,7 @@ let
       install -Dm644 ${appimageContents}/joplin.desktop $out/share/applications/joplin.desktop
       install -Dm644 ${appimageContents}/joplin.png $out/share/pixmaps/joplin.png
       substituteInPlace $out/share/applications/joplin.desktop \
+        --replace-fail StartupWMClass=Joplin StartupWMClass=@joplin/app-desktop \
         --replace-fail 'Exec=AppRun' 'Exec=joplin-desktop'
     '';
 
diff --git a/pkgs/by-name/js/json-schema-catalog-rs/package.nix b/pkgs/by-name/js/json-schema-catalog-rs/package.nix
index 00c40f562221..179906351b01 100644
--- a/pkgs/by-name/js/json-schema-catalog-rs/package.nix
+++ b/pkgs/by-name/js/json-schema-catalog-rs/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "json-schema-catalog-rs";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "roberth";
     repo = "json-schema-catalog-rs";
     tag = finalAttrs.version;
-    hash = "sha256-BbEPpolv2aoKFlfZ6A+CmUlr5sySGIqRlv3rLgf1VkA=";
+    hash = "sha256-AEtE57WYmuTaU1hQUw2NyA+hj9odIktZVQ+mDE2+Sdc=";
   };
 
-  cargoHash = "sha256-YI2LN2DBzC1B5wCZOrGAZi/hkKHoAm6xLkdJ+8DDFo8=";
+  cargoHash = "sha256-fW2sODIFRXcDfzPnmYW0sH/dLe8sbRjQLtLWDlAJPxQ=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/mi/miniupnpc/package.nix b/pkgs/by-name/mi/miniupnpc/package.nix
index 2078657acda4..d49f0c77a468 100644
--- a/pkgs/by-name/mi/miniupnpc/package.nix
+++ b/pkgs/by-name/mi/miniupnpc/package.nix
@@ -7,18 +7,18 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "miniupnpc";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "miniupnp";
     repo = "miniupnp";
-    tag = "miniupnpc_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-Fjd4JPk6Uc7cPPQu9NiBv82XArd11TW+7sTL3wC9/+s=";
+    tag = "miniupnpc_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    hash = "sha256-8EWchUppW4H2kEUCGBXIk1meARJj2usKKO5gFYPoW3s=";
   };
 
-  sourceRoot = "${src.name}/miniupnpc";
+  sourceRoot = "${finalAttrs.src.name}/miniupnpc";
 
   nativeBuildInputs = [ cmake ];
 
@@ -39,6 +39,10 @@ stdenv.mkDerivation rec {
     mv $out/bin/upnpc-* $out/bin/upnpc
     mv $out/bin/upnp-listdevices-* $out/bin/upnp-listdevices
     mv $out/bin/external-ip.sh $out/bin/external-ip
+    chmod +x $out/bin/external-ip
+    patchShebangs $out/bin/external-ip
+    substituteInPlace $out/bin/external-ip \
+      --replace-fail "upnpc" $out/bin/upnpc
   '';
 
   __darwinAllowLocalNetworking = true;
@@ -54,4 +58,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.bsd3;
     mainProgram = "upnpc";
   };
-}
+})
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 1ea85e434832..d8d340c6f655 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.5.10";
+  version = "2025.6.0";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-G6bvWSjFhZRVkIZKUG+v7Ct1AtiLCQYmu5WLsVxfVgA=";
+    hash = "sha256-vlzId9SjxcSQ6DDw0H68zi7xHd2Nn3bPSG+rsR7UEBs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OVXcmlIrb+Q7B/FAayfrC/e4WdnWUgvjLn6hPDo8Ru4=";
+  cargoHash = "sha256-YVeF+2qJuOMhNQLEpH3P0ufqHU0sBFRHN5yXZGTJEQA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 9aae938e011a..34e71911f0f1 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-05-20";
+  version = "0-unstable-2025-05-27";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "707a5e8beec085376c6bc772352289ace86633d9";
-    hash = "sha256-tSn+Yymhx8rxbr81aVgoU83FESCfK4Sq01KfO88kzJQ=";
+    rev = "bf22a7786c39d3b56b87095bfd4479769b88ec1a";
+    hash = "sha256-J8h9LcZRxhTaZg7OU2m75upSoeD1i/abSCJQtX1WRsQ=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sp/spedread/package.nix b/pkgs/by-name/sp/spedread/package.nix
index 050a2461e252..d3953b306ec0 100644
--- a/pkgs/by-name/sp/spedread/package.nix
+++ b/pkgs/by-name/sp/spedread/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spedread";
-  version = "2.4.7-fixed";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "Darazaki";
     repo = "Spedread";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wbSayADL2J+GEJWreiyTWtgXjdXC1bloRq1iHRS0VFc=";
+    hash = "sha256-0VQdiosYd4HBFM1A9jvtQulvgiRwMoClXAVwLhGh6xU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/vi/viddy/package.nix b/pkgs/by-name/vi/viddy/package.nix
index de37893373a3..2678cdb37212 100644
--- a/pkgs/by-name/vi/viddy/package.nix
+++ b/pkgs/by-name/vi/viddy/package.nix
@@ -18,9 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Bp3t/fjaFeouIoKlRvQPVDlc46Ggitfx6HUXE+RZN0A=";
 
-  # requires nightly features
-  env.RUSTC_BOOTSTRAP = 1;
-
   env.VERGEN_BUILD_DATE = "2024-11-28"; # managed via the update script
   env.VERGEN_GIT_DESCRIBE = "Nixpkgs";
 
diff --git a/pkgs/by-name/wi/wizer/package.nix b/pkgs/by-name/wi/wizer/package.nix
index d3e3d359def4..ec7c66007ca5 100644
--- a/pkgs/by-name/wi/wizer/package.nix
+++ b/pkgs/by-name/wi/wizer/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wizer";
-  version = "8.0.0";
+  version = "9.0.0";
 
   # the crate does not contain files which are necessary for the tests
   # see https://github.com/bytecodealliance/wizer/commit/3a95e27ce42f1fdaef07b52988e4699eaa221e04
@@ -16,11 +16,11 @@ rustPlatform.buildRustPackage rec {
     owner = "bytecodealliance";
     repo = "wizer";
     tag = "v${version}";
-    hash = "sha256-NaYHrjm5CGPWT5Pa1EdXS9fswj5NDWQye2pBQk+PKuk=";
+    hash = "sha256-q7v5LH3dp7qtgQJ3Ovt0fPP5r82cHghX6925TLfmn3o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OI7/PLP0Au7FrQ9KUTBTSE9r8kJBA3gbcHe060KALHw=";
+  cargoHash = "sha256-5P8rkwKAVPEJnpk6M7lH6hBOPV1q4+aIghJBbjas4fE=";
 
   cargoBuildFlags = [
     "--bin"
diff --git a/pkgs/by-name/ya/yanic/package.nix b/pkgs/by-name/ya/yanic/package.nix
index ba627d664adc..b3897650a14b 100644
--- a/pkgs/by-name/ya/yanic/package.nix
+++ b/pkgs/by-name/ya/yanic/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "yanic";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "FreifunkBremen";
     repo = "yanic";
     rev = "v${version}";
-    hash = "sha256-uqmojpwGFs6inhmKIztYlGFvUS8AjQIYTHSkZcGyEUo=";
+    hash = "sha256-tKFveknZitkVFaLTZzT01SJZq1IPQfXQa7UJewjXjwU=";
   };
 
   vendorHash = "sha256-UYrQwOyWlKxDH5hHKAZCxQbO+eA6JsPuG0SbkWMF/HQ=";
diff --git a/pkgs/by-name/za/zam-plugins/package.nix b/pkgs/by-name/za/zam-plugins/package.nix
index 4dde2a42bf9e..984dd5ab902b 100644
--- a/pkgs/by-name/za/zam-plugins/package.nix
+++ b/pkgs/by-name/za/zam-plugins/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zam-plugins";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "zamaudio";
     repo = "zam-plugins";
     rev = version;
-    hash = "sha256-wT1BXQrcD+TI+trqx0ZVUmVLZMTDQgJI3dAvN54wy6Y=";
+    hash = "sha256-pjnhDavKnyQjPF4nUO+j1J+Qtw8yIYMY9A5zBMb4zFU=";
     fetchSubmodules = true;
   };
 
@@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs ./dpf/utils/generate-ttl.sh
+    for f in plugins/*/Makefile; do
+      substituteInPlace "$f" \
+        --replace-quiet 'pkg-config' '${stdenv.cc.targetPrefix}pkg-config'
+    done
   '';
 
   makeFlags = [
@@ -59,5 +63,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    # tries to run dpf/utils/lv2_ttl_generator (built for host)
+    broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
   };
 }
diff --git a/pkgs/by-name/zl/zlint/package.nix b/pkgs/by-name/zl/zlint/package.nix
index 3268ecc734c2..1368ef17f563 100644
--- a/pkgs/by-name/zl/zlint/package.nix
+++ b/pkgs/by-name/zl/zlint/package.nix
@@ -6,34 +6,33 @@
   zlint,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "zlint";
-  version = "3.6.4";
+  version = "3.6.6";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = "zlint";
-    tag = "v${version}";
-    hash = "sha256-FFgBRuNvm4Cnjls9y+L256vMGGNu10x7Vh+V9HBon70=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e17cMR2Zlhramv7RG3oriWTDR+UBjXUl+t8lZtqc34Q=";
   };
 
   modRoot = "v3";
 
-  vendorHash = "sha256-RX7B9RyNmEO9grMR9Mqn1jXDH5sgT0QDvdhXgY1HYtQ=";
+  vendorHash = "sha256-AdJxcJ/qjY6lzoK4PGNjR+7lYAypgCOk6Nt5sqP+ayA=";
 
   postPatch = ''
     # Remove a package which is not declared in go.mod.
     rm -rf v3/cmd/genTestCerts
+    rm -rf v3/cmd/gen_test_crl
   '';
 
-  excludedPackages = [
-    "lints"
-  ];
+  excludedPackages = [ "lints" ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X=main.version=${version}"
+    "-X=main.version=${finalAttrs.version}"
   ];
 
   passthru.tests.version = testers.testVersion {
@@ -41,7 +40,7 @@ buildGoModule rec {
     command = "zlint -version";
   };
 
-  meta = with lib; {
+  meta = {
     description = "X.509 Certificate Linter focused on Web PKI standards and requirements";
     longDescription = ''
       ZLint is a X.509 certificate linter written in Go that checks for
@@ -49,8 +48,8 @@ buildGoModule rec {
       requirements (e.g. CA/Browser Forum Baseline Requirements).
     '';
     homepage = "https://github.com/zmap/zlint";
-    changelog = "https://github.com/zmap/zlint/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ baloo ];
+    changelog = "https://github.com/zmap/zlint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ baloo ];
   };
-}
+})
diff --git a/pkgs/by-name/zu/zug/package.nix b/pkgs/by-name/zu/zug/package.nix
index 5b66fadc505b..e083adf1c493 100644
--- a/pkgs/by-name/zu/zug/package.nix
+++ b/pkgs/by-name/zu/zug/package.nix
@@ -5,39 +5,44 @@
   fetchpatch,
   cmake,
   boost,
+  catch2,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zug";
-  version = "0.1.0";
+  version = "0.1.1";
+
   src = fetchFromGitHub {
     owner = "arximboldi";
     repo = "zug";
-    rev = "v${version}";
-    hash = "sha256-7xTMDhPIx1I1PiYNanGUsK8pdrWuemMWM7BW+NQs2BQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ti0EurhGQgWSXzSOlH9/Zsp6kQ/+qGjWbfHGTPpfehs=";
   };
+
   patches = [
     (fetchpatch {
       url = "https://github.com/arximboldi/zug/commit/c8c74ada30d931e40636c13763b892f20d3ce1ae.patch";
       hash = "sha256-0x+ScRnziBeyHWYJowcVb2zahkcK2qKrMVVk2twhtHA=";
     })
   ];
-  nativeBuildInputs = [
-    cmake
-  ];
+
+  nativeBuildInputs = [ cmake ];
+
   buildInputs = [
     boost
+    catch2
   ];
-  cmakeFlags = [
-    "-Dzug_BUILD_EXAMPLES=OFF"
-  ];
+
+  cmakeFlags = [ "-Dzug_BUILD_EXAMPLES=OFF" ];
+
   preConfigure = ''
     rm BUILD
   '';
-  meta = with lib; {
+
+  meta = {
     homepage = "https://github.com/arximboldi/zug";
     description = "library for functional interactive c++ programs";
-    maintainers = with maintainers; [ nek0 ];
-    license = licenses.boost;
+    maintainers = with lib.maintainers; [ nek0 ];
+    license = lib.licenses.boost;
   };
-}
+})
diff --git a/pkgs/by-name/zx/zx/package.nix b/pkgs/by-name/zx/zx/package.nix
index a0dd9812b37e..72907cae3321 100644
--- a/pkgs/by-name/zx/zx/package.nix
+++ b/pkgs/by-name/zx/zx/package.nix
@@ -1,12 +1,11 @@
 {
   lib,
   buildNpmPackage,
-  fetchFromGitHub,
-  nix-update-script,
-  versionCheckHook,
-
-  esbuild,
   buildGoModule,
+  fetchFromGitHub,
+  esbuild,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 let
@@ -16,44 +15,45 @@ let
       buildGoModule (
         args
         // rec {
-          version = "0.25.0";
+          version = "0.25.3";
           src = fetchFromGitHub {
             owner = "evanw";
             repo = "esbuild";
-            rev = "v${version}";
-            hash = "sha256-L9jm94Epb22hYsU3hoq1lZXb5aFVD4FC4x2qNt0DljA=";
+            tag = "v${version}";
+            hash = "sha256-YYwvz6TCLAtVHsmXLGC+L/CQVAy5qSFU6JS1o5O5Zkg=";
           };
           vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
         }
       );
   };
 in
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "zx";
-  version = "8.4.1";
+  version = "8.5.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "zx";
-    rev = version;
-    hash = "sha256-jajkHUz+3ujKXbcsfN7y3pwHqAofTgdQHEC29srzs1M=";
+    tag = finalAttrs.version;
+    hash = "sha256-328I8SgBIeTCNFH3Ahm9Zb1OCxwGuhWE/iWmDHElbsA=";
   };
 
-  npmDepsHash = "sha256-OZuJ5akf6l+aVfoPNfYjWDLt1kUgZJv0qMpK/uiRl2Y=";
+  npmDepsHash = "sha256-R0pCoITmLQBj0T1iIXXN4clpEKDn9wkG5Ke0AedgnlQ=";
+
+  env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  ESBUILD_BINARY_PATH = lib.getExe esbuild';
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Tool for writing scripts using JavaScript";
     homepage = "https://github.com/google/zx";
-    changelog = "https://github.com/google/zx/releases/tag/${version}";
+    changelog = "https://github.com/google/zx/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jlbribeiro ];
     mainProgram = "zx";
   };
-}
+})
diff --git a/pkgs/by-name/zx/zxing/package.nix b/pkgs/by-name/zx/zxing/package.nix
index eae4b10a7be4..1c0a556bbe8a 100644
--- a/pkgs/by-name/zx/zxing/package.nix
+++ b/pkgs/by-name/zx/zxing/package.nix
@@ -4,21 +4,30 @@
   fetchurl,
   jre,
 }:
-stdenv.mkDerivation rec {
-  pname = "zxing";
-  version = "3.1.0";
+
+let
+  version = "3.5.3";
+
   # Maven builds are hard to get right
   core_jar = fetchurl {
-    url = "http://repo1.maven.org/maven2/com/google/zxing/core/${version}/core-${version}.jar";
-    sha256 = "199l4xvlcpafqn69r3k9qjpqkw9lvkl02hzpm0ackvdhl7vk42zh";
+    url = "https://repo1.maven.org/maven2/com/google/zxing/core/${version}/core-${version}.jar";
+    hash = "sha256-jYBkwWNv2u9xid2QVcfVmVColAoS8ik5VkRuw8EJ/YI=";
   };
+
   javase_jar = fetchurl {
-    url = "http://repo1.maven.org/maven2/com/google/zxing/javase/${version}/javase-${version}.jar";
-    sha256 = "0fzxvvf5dqyrs5m9rqw4ffm9h1s27bi7q3jb1dam34s80q2rp2zq";
+    url = "https://repo1.maven.org/maven2/com/google/zxing/javase/${version}/javase-${version}.jar";
+    hash = "sha256-1leVt4nvrIohVssqS2SNIOWL/gNhMWW7Xc5ocOzveY4=";
   };
-  inherit jre;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zxing";
+  inherit version jre;
+
   dontUnpack = true;
+
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/lib/java" "$out/bin"
     cp "${core_jar}" "${javase_jar}" "$out/lib/java"
     substituteAll "${./java-zxing.sh}" "$out/bin/java-zxing"
@@ -26,8 +35,15 @@ stdenv.mkDerivation rec {
     substituteAll "${./zxing-cmdline-encoder.sh}" "$out/bin/zxing-cmdline-encoder"
     substituteAll "${./zxing.sh}" "$out/bin/zxing"
     chmod a+x "$out/bin"/*
-    cd "$out/lib/java"; for i in *.jar; do mv "$i" "''${i#*-}"; done
+    pushd "$out/lib/java"
+    for i in *.jar; do
+      mv "$i" "''${i#*-}"
+    done
+    popd
+
+    runHook postInstall
   '';
+
   meta = {
     description = "1D and 2D code reading library";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
@@ -36,4 +52,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     homepage = "https://github.com/zxing/zxing";
   };
-}
+})
diff --git a/pkgs/desktops/lomiri/services/lomiri-download-manager/1001-treewide-Switch-to-glog-CMake-module.patch b/pkgs/desktops/lomiri/services/lomiri-download-manager/1001-treewide-Switch-to-glog-CMake-module.patch
deleted file mode 100644
index c3ca4f4b13b8..000000000000
--- a/pkgs/desktops/lomiri/services/lomiri-download-manager/1001-treewide-Switch-to-glog-CMake-module.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-From a487908c22fe0a37669bbe5a8bdcd945b05b2f33 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Mon, 20 Jan 2025 19:06:54 +0100
-Subject: [PATCH] treewide: Switch to glog CMake module
-
----
- CMakeLists.txt                           | 2 +-
- src/common/priv/CMakeLists.txt           | 2 +-
- src/common/public/CMakeLists.txt         | 2 +-
- src/downloads/daemon/CMakeLists.txt      | 2 +-
- src/downloads/priv/CMakeLists.txt        | 2 +-
- src/downloads/qml/CMakeLists.txt         | 2 +-
- src/downloads/test-daemon/CMakeLists.txt | 2 +-
- src/extractor/CMakeLists.txt             | 2 +-
- src/uploads/daemon/CMakeLists.txt        | 2 +-
- src/uploads/priv/CMakeLists.txt          | 2 +-
- 10 files changed, 10 insertions(+), 10 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8c4750a2..e44d09ad 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -50,10 +50,10 @@ set(CMAKE_AUTOMOC ON)
- 
- find_package(Qt5 COMPONENTS Core DBus Network Sql Test REQUIRED)
- find_package(Boost COMPONENTS log program_options REQUIRED)
-+find_package(glog REQUIRED)
- 
- find_package(PkgConfig REQUIRED)
- pkg_check_modules(DBUS REQUIRED dbus-1)
--pkg_check_modules(GLOG REQUIRED libglog)
- pkg_check_modules(LOMIRI_API REQUIRED liblomiri-api)
- 
- if(USE_SYSTEMD)
-diff --git a/src/common/priv/CMakeLists.txt b/src/common/priv/CMakeLists.txt
-index e7723f3d..105ec5d2 100644
---- a/src/common/priv/CMakeLists.txt
-+++ b/src/common/priv/CMakeLists.txt
-@@ -75,7 +75,7 @@ set_target_properties(
- 
- target_link_libraries(${TARGET}
- 	${LOMIRI_API_LDFLAGS}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::Network
- 	Qt5::Sql
- 	Qt5::Core
-diff --git a/src/common/public/CMakeLists.txt b/src/common/public/CMakeLists.txt
-index 4b1e8660..eeeeab13 100644
---- a/src/common/public/CMakeLists.txt
-+++ b/src/common/public/CMakeLists.txt
-@@ -50,7 +50,7 @@ set_target_properties(
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::DBus
- 	Qt5::Network
- )
-diff --git a/src/downloads/daemon/CMakeLists.txt b/src/downloads/daemon/CMakeLists.txt
-index cdc9f83b..24e2334c 100644
---- a/src/downloads/daemon/CMakeLists.txt
-+++ b/src/downloads/daemon/CMakeLists.txt
-@@ -16,7 +16,7 @@ add_executable(${TARGET}
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::Core
- 	ldm-common
- 	ldm-priv-common
-diff --git a/src/downloads/priv/CMakeLists.txt b/src/downloads/priv/CMakeLists.txt
-index 9eaf3092..c453a7a1 100644
---- a/src/downloads/priv/CMakeLists.txt
-+++ b/src/downloads/priv/CMakeLists.txt
-@@ -65,7 +65,7 @@ set_target_properties(
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::DBus
- 	Qt5::Sql
- 	ldm-common
-diff --git a/src/downloads/qml/CMakeLists.txt b/src/downloads/qml/CMakeLists.txt
-index 7e2d9285..49d68f1c 100644
---- a/src/downloads/qml/CMakeLists.txt
-+++ b/src/downloads/qml/CMakeLists.txt
-@@ -34,7 +34,7 @@ find_package(Qt5 COMPONENTS Core Qml Quick REQUIRED)
- target_link_libraries(${TARGET} Qt5::Core Qt5::Qml Qt5::Quick)
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	ldm-common
- 	lomiri-download-manager-common
- 	lomiri-download-manager-client
-diff --git a/src/downloads/test-daemon/CMakeLists.txt b/src/downloads/test-daemon/CMakeLists.txt
-index d12207a1..6734e65d 100644
---- a/src/downloads/test-daemon/CMakeLists.txt
-+++ b/src/downloads/test-daemon/CMakeLists.txt
-@@ -30,7 +30,7 @@ add_executable(${TARGET}
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::Core
- 	Qt5::DBus
- 	Qt5::Network
-diff --git a/src/extractor/CMakeLists.txt b/src/extractor/CMakeLists.txt
-index 8c40b9b5..3615d5c7 100644
---- a/src/extractor/CMakeLists.txt
-+++ b/src/extractor/CMakeLists.txt
-@@ -23,7 +23,7 @@ add_executable(${TARGET}
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::Core
- 	${Boost_LIBRARIES}
- 	ldm-priv-common
-diff --git a/src/uploads/daemon/CMakeLists.txt b/src/uploads/daemon/CMakeLists.txt
-index 157c6fd6..3692d3c9 100644
---- a/src/uploads/daemon/CMakeLists.txt
-+++ b/src/uploads/daemon/CMakeLists.txt
-@@ -16,7 +16,7 @@ add_executable(${TARGET}
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::Core
- 	ldm-common
- 	ldm-priv-common
-diff --git a/src/uploads/priv/CMakeLists.txt b/src/uploads/priv/CMakeLists.txt
-index dff67e35..672e49ef 100644
---- a/src/uploads/priv/CMakeLists.txt
-+++ b/src/uploads/priv/CMakeLists.txt
-@@ -47,7 +47,7 @@ set_target_properties(
- )
- 
- target_link_libraries(${TARGET}
--	${GLOG_LIBRARIES}
-+	glog::glog
- 	Qt5::DBus
- 	Qt5::Sql
- 	ldm-common
--- 
-2.47.1
-
diff --git a/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix b/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix
index 5a1db5b4dd6b..81dcef5d8914 100644
--- a/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix
@@ -15,6 +15,7 @@
   glog,
   graphviz,
   gtest,
+  libapparmor,
   lomiri-api,
   pkg-config,
   python3,
@@ -28,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-download-manager";
-  version = "0.1.3";
+  version = "0.2.1";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-download-manager";
-    rev = finalAttrs.version;
-    hash = "sha256-LhhO/zZ4wNiRd235NB2b08SQcCZt1awN/flcsLs2m8U=";
+    tag = finalAttrs.version;
+    hash = "sha256-dVyel4NL5LFORNTQzOyeTFkt9Wn23+4uwHsKcj+/0rk=";
   };
 
   outputs = [
@@ -43,31 +44,23 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals withDocumentation [ "doc" ];
 
   patches = [
-    # This change seems incomplete, potentially breaks things on systems that don't use AppArmor mediation
-    # https://gitlab.com/ubports/development/core/lomiri-download-manager/-/merge_requests/24#note_1746801673
+    # Remove when version > 0.2.1
     (fetchpatch {
-      name = "0001-lomiri-download-manager-Revert-Drop-GetConnectionAppArmorSecurityContext.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/2367f3dff852b69457b1a65a487cb032c210569f.patch";
-      revert = true;
-      hash = "sha256-xS0Wz6d+bZWj/kDGK2WhOduzyP4Rgz3n9n2XY1Zu5hE=";
+      name = "0001-lomiri-download-manager-treewide-Make-pkg-config-includedir-values-reasonable.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/230aa1965917f90d235f55477a257eca1f5eaf46.patch";
+      hash = "sha256-Kdmu4U98Yc213pHS0o4DjpG8T5p50Q5hijRgdvscA/c=";
     })
-
-    # Fix compatibility with glog 0.7.x
-    # Remove when https://gitlab.com/ubports/development/core/lomiri-download-manager/-/merge_requests/29 merged & in release (vendored patch was manually backported)
-    ./1001-treewide-Switch-to-glog-CMake-module.patch
   ];
 
   postPatch = ''
     # Substitute systemd's prefix in pkg-config call
     substituteInPlace CMakeLists.txt \
       --replace-fail 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir DEFINE_VARIABLES prefix=''${CMAKE_INSTALL_PREFIX})' \
-      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+      --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt\''${QT_VERSION_MAJOR}/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
 
-    # For our automatic pkg-config output patcher to work, prefix must be used here
-    substituteInPlace src/{common/public,downloads/client,downloads/common,uploads/common}/*.pc.in \
-      --replace-fail 'libdir=''${exec_prefix}' 'libdir=''${prefix}'
-    substituteInPlace src/downloads/client/lomiri-download-manager-client.pc.in \
-      --replace-fail 'includedir=''${exec_prefix}' 'includedir=''${prefix}'
+    # Upstream code is to work around a bug, but it only seems to cause config issues for us
+    substituteInPlace tests/common/CMakeLists.txt \
+      --replace-fail 'add_dependencies(''${TARGET} GMock)' '# add_dependencies(''${TARGET} GMock)'
   '';
 
   strictDeps = true;
@@ -89,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     cmake-extras
     glog
+    libapparmor
     lomiri-api
     qtbase
     qtdeclarative
@@ -104,10 +98,9 @@ stdenv.mkDerivation (finalAttrs: {
   checkInputs = [ gtest ];
 
   cmakeFlags = [
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
     (lib.cmakeBool "ENABLE_DOC" withDocumentation)
-    # Deprecation warnings on Qt 5.15
-    # https://gitlab.com/ubports/development/core/lomiri-download-manager/-/issues/1
-    (lib.cmakeBool "ENABLE_WERROR" false)
+    (lib.cmakeBool "ENABLE_WERROR" true)
   ];
 
   makeTargets = [ "all" ] ++ lib.optionals withDocumentation [ "doc" ];
@@ -130,7 +123,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Performs uploads and downloads from a centralized location";
     homepage = "https://gitlab.com/ubports/development/core/lomiri-download-manager";
-    changelog = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/blob/${finalAttrs.version}/ChangeLog";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = lib.licenses.lgpl3Only;
     teams = [ lib.teams.lomiri ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 0107a5872693..39e4b213e3b8 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -97,12 +97,12 @@ let
   allPkgs = pkgs;
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.1.0";
+  version = "10.2.0";
   pname = "octave";
 
   src = fetchurl {
     url = "mirror://gnu/octave/octave-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-rtRJy6N5/B4Rhuw/w8luCGB4knj7yCOuLOvmA0Q0S3g=";
+    sha256 = "sha256-B/ttkznS81BzXJFnG+jodNFgAYzGtoj579nVWNI39p8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/allegro/default.nix b/pkgs/development/libraries/allegro/default.nix
index c729bd547ab6..4363edf0a025 100644
--- a/pkgs/development/libraries/allegro/default.nix
+++ b/pkgs/development/libraries/allegro/default.nix
@@ -11,6 +11,7 @@
   libXcursor,
   alsa-lib,
   cmake,
+  pkg-config,
   zlib,
   libpng,
   libvorbis,
@@ -36,7 +37,10 @@ stdenv.mkDerivation rec {
     ./encoding.patch
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
   buildInputs = [
     texinfo6_5
     libXext
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index 4c26b6d854c8..be79b8659203 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proj";
-  version = "9.6.0";
+  version = "9.6.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
     rev = finalAttrs.version;
-    hash = "sha256-sY3AIvsQnV2zi38nJs/U6zTsIgIv4/CaZaxinCg5nEs=";
+    hash = "sha256-81wrwBB11SKhq2dTBrvbuUd97iYkTYYrYyKpk2IlHAA=";
   };
 
   patches = [
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    changelog = "https://github.com/OSGeo/PROJ/blob/${finalAttrs.src.rev}/NEWS";
+    changelog = "https://github.com/OSGeo/PROJ/blob/${finalAttrs.src.rev}/NEWS.md";
     description = "Cartographic Projections Library";
     homepage = "https://proj.org/";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/prophet/default.nix b/pkgs/development/python-modules/prophet/default.nix
index 710b3e893d72..b2c97deda3c5 100644
--- a/pkgs/development/python-modules/prophet/default.nix
+++ b/pkgs/development/python-modules/prophet/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "prophet";
-  version = "1.1.6";
+  version = "1.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,8 +29,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "prophet";
-    rev = "v${version}";
-    hash = "sha256-vvSn2sVs6KZsTAKPuq9irlHgM1BmpkG8LJbvcu8ohd0=";
+    tag = "v${version}";
+    hash = "sha256-94hxpfpZN3yvDUu+kM7Oc2Yu8+z0Gv6zqYRAwKXgHk4=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -65,7 +65,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "prophet" ];
 
   meta = {
-    changelog = "https://github.com/facebook/prophet/releases/tag/${src.rev}";
+    changelog = "https://github.com/facebook/prophet/releases/tag/${src.tag}";
     description = "Tool for producing high quality forecasts for time series data that has multiple seasonality with linear or non-linear growth";
     homepage = "https://facebook.github.io/prophet/";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index baeb6b6ccda1..968ecd84f69a 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "svg2tikz";
-  version = "3.3.1";
+  version = "3.3.2";
 
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "xyz2tex";
     repo = "svg2tikz";
     tag = "v${version}";
-    hash = "sha256-LG8u23pEovF05ApjyxA6AebEjmVtxPxpTp9f2DwkwpM=";
+    hash = "sha256-/yILTmF/N+ZJTKsyFI4vicOYlyuhkBgmFguglu3iXlc=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index 17fe8ebd50cf..7ff1bf3200e6 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -21,7 +21,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.41.1";
+  version = "0.41.7";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index b5fb3b0d21c0..cca4a588e106 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-n8QBsoU3wK/e6winVWXDzJaCxFrzoq/fQNjrX8+jGgw="
-, "x86_64-darwin": "sha256-nayjevXnmnausGLn27Di/SKhaKQnD69XakochGUsdks="
-, "aarch64-linux": "sha256-2uOiieHrajCY/YGWzr6Gwyt8DcSQ+bBgPife9LV3FlY="
-, "aarch64-darwin": "sha256-N1ddjPZlFvuuwapfQnoFwdRYK036ZdS0p/MLbnbOS0g="
+, "x86_64-linux": "sha256-S/HP4IRwwMiJAkS8ciP+dlUEvfu6/lEk/35nfjKGAO8="
+, "x86_64-darwin": "sha256-RXjch0leSexJUvLlPc6gOda27EABX0sx2YzcH23nd3k="
+, "aarch64-linux": "sha256-mQLcGicdDdNx19zSIijQY9W6bdvjgR9NOCWdV88HGuk="
+, "aarch64-darwin": "sha256-pdhKkE3c+h6tSX9J3CxTfPNOp9+PKfy53KWvVV/HU8k="
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 174be9aacc18..5182373a8dd4 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.12.30";
-      hash = "sha256-OqO41rbb3nBegL+ZjgqR0RGwrka6oLv0QOYXJ8Wdpv8=";
+      version = "6.12.31";
+      hash = "sha256-qYbwHt6j2Sh7V1PDjp1oEIKo+k2T5PcRz5MzZgYwbqg=";
     };
     main = {
-      version = "6.14.8";
-      hash = "sha256-ap3NaM/pk+TWg3RBRxFJPwnfv2n042r47bo66jhj3ck=";
+      version = "6.14.9";
+      hash = "sha256-kwMvXdqr1i3UZ3+N/qsQDjU1TvnymS54tCdOLNxL0nc=";
     };
   };
 
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 356353a99d88..13134c7a4112 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,6 +21,7 @@
 }:
 
 let
+  # include a compatible pyopenssl version: https://github.com/NixOS/nixpkgs/issues/379291
   # remove ASAP: https://github.com/googleapis/google-api-python-client/issues/2554
   pythonCustom = python3.override {
     self = pythonCustom;
@@ -29,8 +30,12 @@ let
         version = "24.2.1";
         src = old.src.override {
           tag = version;
-          hash = "sha256-otK7Y7Kb/l3QOErhAcuDHB/CKG9l1vH2BTnOieAWNc0=";
+          hash = "sha256-/TQnDWdycN4hQ7ZGvBhMJEZVafmL+0wy9eJ8hC6rfio=";
         };
+        disabledTests = old.disabledTests ++ [
+          "test_shutdown_closed"
+          "test_closed"
+        ];
       });
     };
   };