diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cf26fbeba6b4..ed5817f57801 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18996,6 +18996,12 @@
     githubId = 67710369;
     keys = [ { fingerprint = "EA88 EA07 26E9 6CBF 6365  3966 163B 16EE 76ED 24CE"; } ];
   };
+  shved = {
+    name = "Yury Shvedov";
+    email = "mestofel13@gmail.com";
+    github = "ein-shved";
+    githubId = 3513222;
+  };
   shyim = {
     email = "s.sayakci@gmail.com";
     github = "shyim";
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
index 360a832e28cb..6a04fa0ff750 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
@@ -13,11 +13,14 @@
     inherit hostPath containerPath;
     options = mountOptions;
   };
-  jqAddMountExpression = ".containerEdits.mounts[.containerEdits.mounts | length] |= . +";
-  allJqMounts = lib.concatMap
-    (mount:
-      ["${lib.getExe jq} '${jqAddMountExpression} ${builtins.toJSON (mkMount mount)}'"])
-    mounts;
+  mountToCommand = mount:
+    "additionalMount \"${mount.hostPath}\" \"${mount.containerPath}\" '${builtins.toJSON mount.mountOptions}'";
+  mountsToCommands = mounts:
+    if (builtins.length mounts) == 0 then
+      "cat"
+    else
+      (lib.strings.concatMapStringsSep " | \\\n"
+        mountToCommand mounts);
 in
 writeScriptBin "nvidia-cdi-generator"
 ''
@@ -32,6 +35,18 @@ function cdiGenerate {
     --nvidia-ctk-path ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"}
 }
 
-cdiGenerate | \
-  ${lib.concatStringsSep " | " allJqMounts} > $RUNTIME_DIRECTORY/nvidia-container-toolkit.json
+function additionalMount {
+  local hostPath="$1"
+  local containerPath="$2"
+  local mountOptions="$3"
+  if [ -e "$hostPath" ]; then
+    ${lib.getExe jq} ".containerEdits.mounts[.containerEdits.mounts | length] = { \"hostPath\": \"$hostPath\", \"containerPath\": \"$containerPath\", \"options\": $mountOptions }"
+  else
+    echo "Mount $hostPath ignored: could not find path in the host machine" >&2
+    cat
+  fi
+}
+
+cdiGenerate |
+  ${mountsToCommands mounts} > $RUNTIME_DIRECTORY/nvidia-container-toolkit.json
 ''
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
index 5c0fed35c4c9..a188c16141e1 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -71,6 +71,8 @@
           /usr/local/nvidia/lib64.
         '';
       };
+
+      package = lib.mkPackageOption pkgs "nvidia-container-toolkit" { };
     };
 
   };
@@ -129,6 +131,7 @@
           let
             script = pkgs.callPackage ./cdi-generate.nix {
               inherit (config.hardware.nvidia-container-toolkit) mounts;
+              nvidia-container-toolkit = config.hardware.nvidia-container-toolkit.package;
               nvidia-driver = config.hardware.nvidia.package;
               deviceNameStrategy = config.hardware.nvidia-container-toolkit.device-name-strategy;
             };
diff --git a/nixos/modules/services/monitoring/gitwatch.nix b/nixos/modules/services/monitoring/gitwatch.nix
new file mode 100644
index 000000000000..80b5f8f7c80a
--- /dev/null
+++ b/nixos/modules/services/monitoring/gitwatch.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  mkSystemdService =
+    name: cfg:
+    lib.nameValuePair "gitwatch-${name}" (
+      let
+        getvar = flag: var: lib.optionalString (cfg."${var}" != null) "${flag} ${cfg."${var}"}";
+        branch = getvar "-b" "branch";
+        remote = getvar "-r" "remote";
+      in
+      rec {
+        inherit (cfg) enable;
+        after = [ "network-online.target" ];
+        wants = after;
+        wantedBy = [ "multi-user.target" ];
+        description = "gitwatch for ${name}";
+        path = with pkgs; [
+          gitwatch
+          git
+          openssh
+        ];
+        script = ''
+          if [ -n "${cfg.remote}" ] && ! [ -d "${cfg.path}" ]; then
+            git clone ${branch} "${cfg.remote}" "${cfg.path}"
+          fi
+          gitwatch ${remote} ${branch} ${cfg.path}
+        '';
+        serviceConfig.User = cfg.user;
+      }
+    );
+in
+{
+  options.services.gitwatch = lib.mkOption {
+    description = ''
+      A set of git repositories to watch for. See
+      [gitwatch](https://github.com/gitwatch/gitwatch) for more.
+    '';
+    default = { };
+    example = {
+      my-repo = {
+        enable = true;
+        user = "user";
+        path = "/home/user/watched-project";
+        remote = "git@github.com:me/my-project.git";
+      };
+      disabled-repo = {
+        enable = false;
+        user = "user";
+        path = "/home/user/disabled-project";
+        remote = "git@github.com:me/my-old-project.git";
+        branch = "autobranch";
+      };
+    };
+    type =
+      with lib.types;
+      attrsOf (submodule {
+        options = {
+          enable = lib.mkEnableOption "watching for repo";
+          path = lib.mkOption {
+            description = "The path to repo in local machine";
+            type = str;
+          };
+          user = lib.mkOption {
+            description = "The name of services's user";
+            type = str;
+            default = "root";
+          };
+          remote = lib.mkOption {
+            description = "Optional url of remote repository";
+            type = nullOr str;
+            default = null;
+          };
+          branch = lib.mkOption {
+            description = "Optional branch in remote repository";
+            type = nullOr str;
+            default = null;
+          };
+        };
+      });
+  };
+  config.systemd.services = lib.mapAttrs' mkSystemdService config.services.gitwatch;
+}
diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index b8e7532b2e0a..5ba54f5a3865 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -34,10 +34,10 @@ in
 
       stateDir = mkOption {
         type = types.path;
-        default = "/var/spool/varnish/${config.networking.hostName}";
-        defaultText = literalExpression ''"/var/spool/varnish/''${config.networking.hostName}"'';
+        default = "/run/varnish/${config.networking.hostName}";
+        defaultText = literalExpression ''"/run/varnish/''${config.networking.hostName}"'';
         description = ''
-          Directory holding all state for Varnish to run.
+          Directory holding all state for Varnish to run. Note that this should be a tmpfs in order to avoid performance issues and crashes.
         '';
       };
 
@@ -68,11 +68,11 @@ in
       description = "Varnish";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      preStart = ''
+      preStart = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
         mkdir -p ${cfg.stateDir}
         chown -R varnish:varnish ${cfg.stateDir}
       '';
-      postStop = ''
+      postStop = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
         rm -rf ${cfg.stateDir}
       '';
       serviceConfig = {
@@ -83,6 +83,7 @@ in
         RestartSec = "5s";
         User = "varnish";
         Group = "varnish";
+        RuntimeDirectory = mkIf (lib.hasPrefix "/run/" cfg.stateDir) (lib.removePrefix "/run/" cfg.stateDir);
         AmbientCapabilities = "cap_net_bind_service";
         NoNewPrivileges = true;
         LimitNOFILE = 131072;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0cd52cbec9a3..ee004f3c9825 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -705,6 +705,7 @@ in {
   ntfy-sh = handleTest ./ntfy-sh.nix {};
   ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix {};
   ntpd-rs = handleTest ./ntpd-rs.nix {};
+  nvidia-container-toolkit = runTest ./nvidia-container-toolkit.nix;
   nvmetcfg = handleTest ./nvmetcfg.nix {};
   nzbget = handleTest ./nzbget.nix {};
   nzbhydra2 = handleTest ./nzbhydra2.nix {};
diff --git a/nixos/tests/nvidia-container-toolkit.nix b/nixos/tests/nvidia-container-toolkit.nix
new file mode 100644
index 000000000000..b22b989c0814
--- /dev/null
+++ b/nixos/tests/nvidia-container-toolkit.nix
@@ -0,0 +1,149 @@
+{ pkgs, lib, ... }:
+let
+  testCDIScript = pkgs.writeShellScriptBin "test-cdi" ''
+    die() {
+      echo "$1"
+      exit 1
+    }
+
+    check_file_referential_integrity() {
+      echo "checking $1 referential integrity"
+      ( ${pkgs.glibc.bin}/bin/ldd "$1" | ${lib.getExe pkgs.gnugrep} "not found" &> /dev/null ) && return 1
+      return 0
+    }
+
+    check_directory_referential_integrity() {
+      ${lib.getExe pkgs.findutils} "$1" -type f -print0 | while read -d $'\0' file; do
+        if [[ $(${lib.getExe pkgs.file} "$file" | ${lib.getExe pkgs.gnugrep} ELF) ]]; then
+          check_file_referential_integrity "$file" || exit 1
+        else
+          echo "skipping $file: not an ELF file"
+        fi
+      done
+    }
+
+    check_directory_referential_integrity "/usr/bin" || exit 1
+    check_directory_referential_integrity "${pkgs.addDriverRunpath.driverLink}" || exit 1
+    check_directory_referential_integrity "/usr/local/nvidia" || exit 1
+  '';
+  testContainerImage = pkgs.dockerTools.buildImage {
+    name = "cdi-test";
+    tag = "latest";
+    config = {
+      Cmd = [ (lib.getExe testCDIScript) ];
+    };
+    copyToRoot = with pkgs.dockerTools; [
+      usrBinEnv
+      binSh
+    ];
+  };
+  emptyCDISpec = ''
+    {
+      "cdiVersion": "0.5.0",
+      "kind": "nvidia.com/gpu",
+      "devices": [
+        {
+          "name": "all",
+          "containerEdits": {
+            "deviceNodes": [
+              {
+                "path": "/dev/urandom"
+              }
+            ],
+            "hooks": [],
+            "mounts": []
+          }
+        }
+      ],
+      "containerEdits": {
+        "deviceNodes": [],
+        "hooks": [],
+        "mounts": []
+      }
+    }
+  '';
+  nvidia-container-toolkit = {
+    enable = true;
+    package = pkgs.stdenv.mkDerivation {
+      pname = "nvidia-ctk-dummy";
+      version = "1.0.0";
+      dontUnpack = true;
+      dontBuild = true;
+
+      inherit emptyCDISpec;
+      passAsFile = [ "emptyCDISpec" ];
+
+      installPhase = ''
+        mkdir -p $out/bin $out/share/nvidia-container-toolkit
+        cp "$emptyCDISpecPath" "$out/share/nvidia-container-toolkit/spec.json"
+        echo -n "$emptyCDISpec" > "$out/bin/nvidia-ctk";
+        cat << EOF > "$out/bin/nvidia-ctk"
+        #!${pkgs.runtimeShell}
+        cat "$out/share/nvidia-container-toolkit/spec.json"
+        EOF
+        chmod +x $out/bin/nvidia-ctk
+      '';
+      meta.mainProgram = "nvidia-ctk";
+    };
+  };
+in
+{
+  name = "nvidia-container-toolkit";
+  meta = with lib.maintainers; {
+    maintainers = [ ereslibre ];
+  };
+  defaults =
+    { config, ... }:
+    {
+      environment.systemPackages = with pkgs; [ jq ];
+      virtualisation.diskSize = lib.mkDefault 10240;
+      virtualisation.containers.enable = lib.mkDefault true;
+      hardware = {
+        inherit nvidia-container-toolkit;
+        nvidia = {
+          open = true;
+          package = config.boot.kernelPackages.nvidiaPackages.stable.open;
+        };
+        graphics.enable = lib.mkDefault true;
+      };
+    };
+  nodes = {
+    no-gpus = {
+      virtualisation.containers.enable = false;
+      hardware.graphics.enable = false;
+    };
+    one-gpu =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [ podman ];
+        hardware.graphics.enable = true;
+      };
+
+    one-gpu-invalid-host-paths = {
+      hardware.nvidia-container-toolkit.mounts = [
+        {
+          hostPath = "/non-existant-path";
+          containerPath = "/some/path";
+        }
+      ];
+    };
+  };
+  testScript = ''
+    start_all()
+
+    with subtest("Generate an empty CDI spec for a machine with no Nvidia GPUs"):
+      no_gpus.wait_for_unit("nvidia-container-toolkit-cdi-generator.service")
+      no_gpus.succeed("cat /var/run/cdi/nvidia-container-toolkit.json | jq")
+
+    with subtest("Podman loads the generated CDI spec for a machine with an Nvidia GPU"):
+      one_gpu.wait_for_unit("nvidia-container-toolkit-cdi-generator.service")
+      one_gpu.succeed("cat /var/run/cdi/nvidia-container-toolkit.json | jq")
+      one_gpu.succeed("podman load < ${testContainerImage}")
+      print(one_gpu.succeed("podman run --pull=never --device=nvidia.com/gpu=all -v /run/opengl-driver:/run/opengl-driver:ro cdi-test:latest"))
+
+    # Issue: https://github.com/NixOS/nixpkgs/issues/319201
+    with subtest("The generated CDI spec skips specified non-existant paths in the host"):
+      one_gpu_invalid_host_paths.wait_for_unit("nvidia-container-toolkit-cdi-generator.service")
+      one_gpu_invalid_host_paths.fail("grep 'non-existant-path' /var/run/cdi/nvidia-container-toolkit.json")
+  '';
+}
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index f96c08577b39..f87e83f2128f 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "17.0.1";
+  version = "17.0.3";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-NkOTCvpU6MxGOvQwiTLMJ444HgNK5tpt3hUs2epFyLE=";
+    sha256 = "sha256-DtGNwxlXYCorD/c61nqtcocMqt4IG+LuTAdwbKlvp/Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index fe85fcf4b567..9a0d63d42db6 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1004,6 +1004,10 @@
     dependencies = with self; [ plenary-nvim ];
   };
 
+  lualine-nvim = super.lualine-nvim.overrideAttrs {
+    dependencies = with self; [ nvim-web-devicons ];
+  };
+
   luasnip = super.luasnip.overrideAttrs {
     dependencies = with self; [ luaPackages.jsregexp ];
   };
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/copy-noto-emoji.py b/pkgs/applications/networking/instant-messengers/signal-desktop/copy-noto-emoji.py
new file mode 100644
index 000000000000..393519e5c1f0
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/copy-noto-emoji.py
@@ -0,0 +1,118 @@
+"""Copy Noto Color Emoji PNGs into an extracted Signal ASAR archive.
+
+Signal loads small Apple emoji PNGs directly from
+`node_modules/emoji-datasource-apple/img/apple/64`, and downloads and
+caches large Apple emoji WebP files in `.proto` bundles on the fly. The
+latter are not a copyright concern for the Nixpkgs cache, but would
+result in inconsistent presentation between small and large emoji.
+
+We skip the complexity and buy some additional privacy by replacing the
+`emoji://jumbo?emoji=` URL prefix with a `file://` path to the copied
+PNGs inside the ASAR archive, and linking the `node_modules` PNG paths
+directly to them.
+"""
+
+import json
+import shutil
+import sys
+from pathlib import Path
+
+
+def signal_name_to_emoji(signal_emoji_name: str) -> str:
+    r"""Return the emoji corresponding to a Signal emoji name.
+
+    Signal emoji names are concatenations of UTF‐16 code units,
+    represented in lowercase big‐endian hex padded to four digits.
+
+    >>> signal_name_to_emoji("d83dde36200dd83cdf2bfe0f")
+    '😶‍🌫️'
+    >>> b"\xd8\x3d\xde\x36\x20\x0d\xd8\x3c\xdf\x2b\xfe\x0f".decode("utf-16-be")
+    '😶‍🌫️'
+    """
+    hex_bytes = zip(signal_emoji_name[::2], signal_emoji_name[1::2])
+    emoji_utf_16_be = bytes(
+        int("".join(hex_pair), 16) for hex_pair in hex_bytes
+    )
+    return emoji_utf_16_be.decode("utf-16-be")
+
+
+def emoji_to_noto_name(emoji: str) -> str:
+    r"""Return the Noto emoji name of an emoji.
+
+    Noto emoji names are underscore‐separated Unicode scalar values,
+    represented in lowercase big‐endian hex padded to at least four
+    digits. Any U+FE0F variant selectors are omitted.
+
+    >>> emoji_to_noto_name("😶‍🌫️")
+    '1f636_200d_1f32b'
+    >>> emoji_to_noto_name("\U0001f636\u200d\U0001f32b\ufe0f")
+    '1f636_200d_1f32b'
+    """
+    return "_".join(
+        f"{ord(scalar_value):04x}"
+        for scalar_value in emoji
+        if scalar_value != "\ufe0f"
+    )
+
+
+def emoji_to_emoji_data_name(emoji: str) -> str:
+    r"""Return the npm emoji-data emoji name of an emoji.
+
+    emoji-data emoji names are hyphen‐minus‐separated Unicode scalar
+    values, represented in lowercase big‐endian hex padded to at least
+    four digits.
+
+    >>> emoji_to_emoji_data_name("😶‍🌫️")
+    '1f636-200d-1f32b-fe0f'
+    >>> emoji_to_emoji_data_name("\U0001f636\u200d\U0001f32b\ufe0f")
+    '1f636-200d-1f32b-fe0f'
+    """
+    return "-".join(f"{ord(scalar_value):04x}" for scalar_value in emoji)
+
+
+def _main() -> None:
+    noto_png_path, asar_root = (Path(arg) for arg in sys.argv[1:])
+    asar_root = asar_root.absolute()
+
+    out_path = asar_root / "images" / "nixpkgs-emoji"
+    out_path.mkdir(parents=True)
+
+    emoji_data_out_path = (
+        asar_root
+        / "node_modules"
+        / "emoji-datasource-apple"
+        / "img"
+        / "apple"
+        / "64"
+    )
+    emoji_data_out_path.mkdir(parents=True)
+
+    jumbomoji_json_path = asar_root / "build" / "jumbomoji.json"
+    with jumbomoji_json_path.open() as jumbomoji_json_file:
+        jumbomoji_packs = json.load(jumbomoji_json_file)
+
+    for signal_emoji_names in jumbomoji_packs.values():
+        for signal_emoji_name in signal_emoji_names:
+            emoji = signal_name_to_emoji(signal_emoji_name)
+
+            try:
+                shutil.copy(
+                    noto_png_path / f"emoji_u{emoji_to_noto_name(emoji)}.png",
+                    out_path / emoji,
+                )
+            except FileNotFoundError:
+                print(
+                    f"Missing Noto emoji: {emoji} {signal_emoji_name}",
+                    file=sys.stderr,
+                )
+                continue
+
+            (
+                emoji_data_out_path / f"{emoji_to_emoji_data_name(emoji)}.png"
+            ).symlink_to(out_path / emoji)
+
+    print(out_path.relative_to(asar_root))
+
+
+if __name__ == "__main__":
+    _main()
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
index 558ace43ec16..2b60e2ae6b84 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@@ -1,8 +1,13 @@
 { stdenv
 , lib
+, callPackage
 , fetchurl
 , autoPatchelfHook
+, noto-fonts-color-emoji
 , dpkg
+, asar
+, rsync
+, python3
 , wrapGAppsHook3
 , makeWrapper
 , nixosTests
@@ -57,6 +62,27 @@
 let
   inherit (stdenv) targetPlatform;
   ARCH = if targetPlatform.isAarch64 then "arm64" else "x64";
+
+  # Noto Color Emoji PNG files for emoji replacement; see below.
+  noto-fonts-color-emoji-png = noto-fonts-color-emoji.overrideAttrs (prevAttrs: {
+    pname = "noto-fonts-color-emoji-png";
+
+    # The build produces 136×128 PNGs by default for arcane font
+    # reasons, but we want square PNGs.
+    buildFlags = prevAttrs.buildFlags or [ ] ++ [ "BODY_DIMENSIONS=128x128" ];
+
+    makeTargets = [ "compressed" ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share
+      mv build/compressed_pngs $out/share/noto-fonts-color-emoji-png
+      python3 add_aliases.py --srcdir=$out/share/noto-fonts-color-emoji-png
+
+      runHook postInstall
+    '';
+  });
 in
 stdenv.mkDerivation rec {
   inherit pname version;
@@ -71,11 +97,36 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     inherit url hash;
+    recursiveHash = true;
+    downloadToTemp = true;
+    nativeBuildInputs = [ dpkg asar ];
+    # Signal ships the Apple emoji set without a licence via an npm
+    # package and upstream does not seem terribly interested in fixing
+    # this; see:
+    #
+    # * <https://github.com/signalapp/Signal-Android/issues/5862>
+    # * <https://whispersystems.discoursehosting.net/t/signal-is-likely-violating-apple-license-terms-by-using-apple-emoji-in-the-sticker-creator-and-android-and-desktop-apps/52883>
+    #
+    # We work around this by replacing it with the Noto Color Emoji
+    # set, which is available under a FOSS licence and more likely to
+    # be used on a NixOS machine anyway. The Apple emoji are removed
+    # during `fetchurl` to ensure that the build doesn’t cache the
+    # unlicensed emoji files, but the rest of the work is done in the
+    # main derivation.
+    postFetch = ''
+      dpkg-deb -x $downloadedFile $out
+      asar extract "$out/opt/${dir}/resources/app.asar" $out/asar-contents
+      rm -r \
+        "$out/opt/${dir}/resources/app.asar"{,.unpacked} \
+        $out/asar-contents/node_modules/emoji-datasource-apple
+    '';
   };
 
   nativeBuildInputs = [
+    rsync
+    asar
+    python3
     autoPatchelfHook
-    dpkg
     (wrapGAppsHook3.override { inherit makeWrapper; })
   ];
 
@@ -127,11 +178,13 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
-  unpackPhase = "dpkg-deb -x $src .";
-
   dontBuild = true;
   dontConfigure = true;
 
+  unpackPhase = ''
+    rsync -a --chmod=+w $src/ .
+  '';
+
   installPhase = ''
     runHook preInstall
 
@@ -147,6 +200,30 @@ stdenv.mkDerivation rec {
     # Create required symlinks:
     ln -s libGLESv2.so "$out/lib/${dir}/libGLESv2.so.2"
 
+    # Copy the Noto Color Emoji PNGs into the ASAR contents. See `src`
+    # for the motivation, and the script for the technical details.
+    emojiPrefix=$(
+      python3 ${./copy-noto-emoji.py} \
+      ${noto-fonts-color-emoji-png}/share/noto-fonts-color-emoji-png \
+      asar-contents
+    )
+
+    # Replace the URL used for fetching large versions of emoji with
+    # the local path to our copied PNGs.
+    substituteInPlace asar-contents/preload.bundle.js \
+      --replace-fail \
+        'emoji://jumbo?emoji=' \
+        "file://$out/lib/${lib.escapeURL dir}/resources/app.asar/$emojiPrefix/"
+
+    # `asar(1)` copies files from the corresponding `.unpacked`
+    # directory when extracting, and will put them back in the modified
+    # archive if you don’t specify them again when repacking. Signal
+    # leaves their native `.node` libraries unpacked, so we match that.
+    asar pack \
+      --unpack '*.node' \
+      asar-contents \
+      "$out/lib/${dir}/resources/app.asar"
+
     runHook postInstall
   '';
 
@@ -180,8 +257,21 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://signal.org/";
     changelog = "https://github.com/signalapp/Signal-Desktop/releases/tag/v${version}";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ eclairevoyant mic92 equirosa urandom bkchr teutat3s ];
+    license = [
+      lib.licenses.agpl3Only
+
+      # Various npm packages
+      lib.licenses.free
+    ];
+    maintainers = with lib.maintainers; [
+      eclairevoyant
+      mic92
+      equirosa
+      urandom
+      bkchr
+      teutat3s
+      emily
+    ];
     mainProgram = pname;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/pyproject.toml b/pkgs/applications/networking/instant-messengers/signal-desktop/pyproject.toml
new file mode 100644
index 000000000000..eeee9c7287a0
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/pyproject.toml
@@ -0,0 +1,15 @@
+[tool.mypy]
+files = ["*.py"]
+strict = true
+
+[tool.ruff]
+line-length = 80
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = ["COM812", "D203", "D213", "ISC001", "T201"]
+allowed-confusables = ["‐"]
+
+[tool.ruff.format]
+docstring-code-format = true
+docstring-code-line-length = "dynamic"
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
index a06e91b08938..72cde3388e82 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
@@ -4,5 +4,5 @@ callPackage ./generic.nix { } rec {
   dir = "Signal";
   version = "7.19.0";
   url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-L5Wj1ofMR+QJezd4V6pAhkINLF6y9EB5VNFAIOZE5PU=";
+  hash = "sha256-wyXVZUuY1TDGAVq7Gx9r/cuBuoMmSk9KQttTJlIN+k8=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index ffb73d9e9150..0f3e57148987 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -4,5 +4,5 @@ callPackage ./generic.nix { } rec {
   dir = "Signal Beta";
   version = "7.19.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-kD08xke+HYhwAZG7jmU1ILo013556vNcvAFc/+9BTjg=";
+  hash = "sha256-dIZvzJ45c5kL+2HEaKrtbck5Zz572pQAj3YTenzz6Zs=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index e736d20fe4e4..de6e6620757c 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -4,5 +4,5 @@ callPackage ./generic.nix { } rec {
   dir = "Signal";
   version = "7.21.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-mjf27BISkvN9Xsi36EXtiSkvaPEc4j/Cwjlh4gkfdsA=";
+  hash = "sha256-c4INjHMqTH2B71aUJtzgLSFZSe/KFo1OW/wv7rApSxA=";
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 85ff6c8e5087..bb64529aa78b 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -60,8 +60,8 @@ in rec {
   };
 
   thunderbird-128 = common {
-    version = "128.1.0esr";
-    sha512 = "cda64afee45ae20a627116f9475cc4421262db40a7efa09eeafcb6e96f8fad97e8c96e2ecf04466ac4bce99fcebe0c3ce9953fa3fc4f5a92ab6f60e122f58c9a";
+    version = "128.1.1esr";
+    sha512 = "91e17d63383b05a7565838c61eda3b642f1bb3b4c43ae78a8810dd6d9ba2e5f10939be17598dd5e87bdf28d6f70ff9e154e54218aaf161bd89a5a6d30b504427";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-128";
diff --git a/pkgs/applications/networking/sync/wdt/default.nix b/pkgs/applications/networking/sync/wdt/default.nix
index b126a35038f9..f07734928bf9 100644
--- a/pkgs/applications/networking/sync/wdt/default.nix
+++ b/pkgs/applications/networking/sync/wdt/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "wdt";
-  version = "1.27.1612021-unstable-2024-08-14";
+  version = "1.27.1612021-unstable-2024-08-22";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "wdt";
-    rev = "3601f6dd89eea161b059c141fc40418733e82f2f";
-    sha256 = "sha256-YaSKaotN7LzlSQAIGkpTcgpgVQBH6KmH4YiebaMdz/g=";
+    rev = "4cc8a21cfa29e55aa803365ab69248d0bf8fbb82";
+    sha256 = "sha256-BEoZ662KsL6gf6hfN9ahgoPtHOFBi9k3gjRuGWs3zOw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/window-managers/wayfire/default.nix b/pkgs/applications/window-managers/wayfire/default.nix
index ca7eaa587a85..39dbac8b5289 100644
--- a/pkgs/applications/window-managers/wayfire/default.nix
+++ b/pkgs/applications/window-managers/wayfire/default.nix
@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayfire";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wayfire";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-OPGzPy0I6i3TvmA5KSWDb4Lsf66zM5X+Akckgs3wk2o=";
+    hash = "sha256-xQZ4/UE66IISZQLl702OQXAAr8XmEsA4hJwB7aXua+E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix b/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
index 62496c9f8600..e0122d287611 100644
--- a/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
+++ b/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
@@ -12,18 +12,17 @@
 , nlohmann_json
 , xcbutilwm
 , gtkmm3
-, gtk-layer-shell
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayfire-plugins-extra";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wayfire-plugins-extra";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-MF4tDzIZnnTXH2ZUxltIw1RP3pfRQFGrc/n9H47yW0g";
+    hash = "sha256-TukDomxqfrM45+C7azfO8jVaqk3E5irdphH8U5IYItg=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
     nlohmann_json
     xcbutilwm
     gtkmm3
-    gtk-layer-shell
   ];
 
   mesonFlags = [
diff --git a/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix b/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
index fd91d78285df..678fc6200f04 100644
--- a/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
+++ b/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
@@ -8,6 +8,8 @@
 , wayfire
 , libxkbcommon
 , libGL
+, libinput
+, xcbutilwm
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
     wayfire
     libxkbcommon
     libGL
+    libinput
+    xcbutilwm
   ];
 
   env = {
diff --git a/pkgs/applications/window-managers/wayfire/wf-config.nix b/pkgs/applications/window-managers/wayfire/wf-config.nix
index b16934e38a59..a61230dec2f9 100644
--- a/pkgs/applications/window-managers/wayfire/wf-config.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-config.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wf-config";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wf-config";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4QszCGlJqehnavTOdR2vZ95XuHKiNUIsA893sa9qph8=";
+    hash = "sha256-5HejuluCTsRsnHuaMCTnCPkbFvT/IcLkfNGjnXnZjJ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/wayfire/wf-shell.nix b/pkgs/applications/window-managers/wayfire/wf-shell.nix
index ce803ba2e880..e6d64bd902bc 100644
--- a/pkgs/applications/window-managers/wayfire/wf-shell.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-shell.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wf-shell";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wf-shell";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-/ajFPIk8VJnlu2DzvSyGD3bC4r/pxALTkZeLNvs9dTw=";
+    hash = "sha256-J5KmUxM/mU5I1YfkfwZgbK7VxMTKKKGGvxYS5Rnbqnc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/by-name/bu/bup/package.nix
similarity index 63%
rename from pkgs/tools/backup/bup/default.nix
rename to pkgs/by-name/bu/bup/package.nix
index 07ae258a675f..91fb2b3c3f71 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/by-name/bu/bup/package.nix
@@ -1,15 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper
-, perl, pandoc, python3, git
-, par2cmdline ? null, par2Support ? true
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  perl,
+  pandoc,
+  python3,
+  git,
+
+  par2Support ? true,
+  par2cmdline ? null,
 }:
 
 assert par2Support -> par2cmdline != null;
 
 let
-  version = "0.33.3";
+  version = "0.33.4";
 
-  pythonDeps = with python3.pkgs; [ setuptools tornado ]
-    ++ lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ];
+  pythonDeps =
+    with python3.pkgs;
+    [
+      setuptools
+      tornado
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [
+      pyxattr
+      pylibacl
+      fuse
+    ];
 in
 
 stdenv.mkDerivation {
@@ -20,11 +38,18 @@ stdenv.mkDerivation {
     repo = "bup";
     owner = "bup";
     rev = version;
-    hash = "sha256-w7yPs7hG4v0Kd9i2tYhWH7vW95MAMfI/8g61MB6bfps=";
+    hash = "sha256-9rWzHONcu4W/JcnDUGPbuGksroODbhdL6bNF+3Dd2ag=";
   };
 
-  buildInputs = [ git python3 ];
-  nativeBuildInputs = [ pandoc perl makeWrapper ];
+  buildInputs = [
+    git
+    python3
+  ];
+  nativeBuildInputs = [
+    pandoc
+    perl
+    makeWrapper
+  ];
 
   postPatch = "patchShebangs .";
 
@@ -37,7 +62,8 @@ stdenv.mkDerivation {
     "LIBDIR=$(out)/lib/bup"
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration -Wno-error=implicit-int";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
+    "-Wno-error=implicit-function-declaration -Wno-error=implicit-int";
 
   postInstall = ''
     wrapProgram $out/bin/bup \
diff --git a/pkgs/by-name/do/downonspot/package.nix b/pkgs/by-name/do/downonspot/package.nix
index 5d115404c240..aaf49a13d26a 100644
--- a/pkgs/by-name/do/downonspot/package.nix
+++ b/pkgs/by-name/do/downonspot/package.nix
@@ -10,19 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "downonspot";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "oSumAtrIX";
     repo = "DownOnSpot";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F0SW/qce7eEEDC4FQvO6eW9V4POkRK/WP8bMUBtzGIw=";
+    hash = "sha256-h/BKVFzvPq9FhX4wZzlIzoegK8nPEt+mR7oKpRC5eV0=";
   };
 
   # Use official public librespot version
   cargoPatches = [ ./Cargo.lock.patch ];
 
-  cargoHash = "sha256-kLMV8jDadb2BryOqXGkiunQvZRjzjbVTh9Z+jHSSHbU=";
+  cargoHash = "sha256-2oPpi9MgQpvvjMJ5G+OkL8Gyemx82IHLjuAz+S8tI3E=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/fo/footage/package.nix b/pkgs/by-name/fo/footage/package.nix
new file mode 100644
index 000000000000..595603530e86
--- /dev/null
+++ b/pkgs/by-name/fo/footage/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  rustPlatform,
+  cargo,
+  rustc,
+  appstream-glib,
+  blueprint-compiler,
+  desktop-file-utils,
+  gettext,
+  glib,
+  gst_all_1,
+  gtk4,
+  libadwaita,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook4,
+  a52dec,
+  fdk_aac,
+  ffmpeg,
+  x264,
+  x265,
+  vo-aacenc,
+  svt-av1,
+  libmpeg2,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "footage";
+  version = "1.3.2";
+
+  src = fetchFromGitLab {
+    owner = "adhami3310";
+    repo = "Footage";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-VEL96JrJ5eJEoX2miiB4dqGUXizNlYWCUZkkYkh09B8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-RWMNeMrctIlcA4MiRx9t7OfzKeHtw3phrYsYFZH7z4c=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    rustc
+    appstream-glib
+    blueprint-compiler
+    desktop-file-utils
+    gettext
+    gtk4 # for gtk-update-icon-cache
+    glib # for glib-compile-schemas
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      glib
+      gtk4
+      libadwaita
+      a52dec
+      fdk_aac
+      ffmpeg
+      x264
+      x265
+      vo-aacenc
+      svt-av1
+      libmpeg2
+    ]
+    ++ (with gst_all_1; [
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-rs
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+      gstreamer
+      gst-editing-services
+    ]);
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ gst_all_1.gstreamer ]}"
+    )
+  '';
+
+  meta = {
+    description = "Video editing tool that allows you to trim, flip, rotate, and crop clips";
+    homepage = "https://gitlab.com/adhami3310/Footage";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/by-name/gi/gitwatch/package.nix b/pkgs/by-name/gi/gitwatch/package.nix
new file mode 100644
index 000000000000..2bbd9a22c900
--- /dev/null
+++ b/pkgs/by-name/gi/gitwatch/package.nix
@@ -0,0 +1,49 @@
+{
+  runCommand,
+  lib,
+  makeWrapper,
+  fetchFromGitHub,
+
+  git,
+  openssh,
+  inotify-tools,
+}:
+runCommand "gitwatch"
+  rec {
+    version = "0.2";
+    src = fetchFromGitHub {
+      owner = "gitwatch";
+      repo = "gitwatch";
+      rev = "v${version}";
+      hash = "sha256-KuWD2FAMi2vZ/7e4fIg97DGuAPEV9b9iOuF8NIGFVpE=";
+    };
+    nativeBuildInputs = [ makeWrapper ];
+
+    meta = {
+      description = "Watch a filesystem and automatically stage changes to a git.";
+      mainProgram = "gitwatch";
+      longDescription = ''
+        A bash script to watch a file or folder and commit changes to a git repo.
+      '';
+      homepage = "https://github.com/gitwatch/gitwatch";
+      changelog = "https://github.com/gitwatch/gitwatch/releases/tag/v${version}";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ shved ];
+    };
+  }
+  ''
+    mkdir -p $out/bin
+    dest="$out/bin/gitwatch"
+    cp "$src/gitwatch.sh" $dest
+    chmod +x $dest
+    patchShebangs $dest
+
+    wrapProgram $dest \
+      --prefix PATH ';' ${
+        lib.makeBinPath [
+          git
+          inotify-tools
+          openssh
+        ]
+      }
+  ''
diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix
index 631605d33493..6dc8691bff71 100644
--- a/pkgs/by-name/md/md-tui/package.nix
+++ b/pkgs/by-name/md/md-tui/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "md-tui";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "henriklovhaug";
     repo = "md-tui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J1UtyxDT8+UmBwayUMtcPOtnVVkRZLg6ECXnqDSJ2Ew=";
+    hash = "sha256-HUrL/+uXQ3753Qb5FZkftGZO+u+MsocFO3L3OzarEhg=";
   };
 
-  cargoHash = "sha256-wb5XF6KdroLbQOQg9bPrJjqLOluq/EH2dJzp2icNUIc=";
+  cargoHash = "sha256-+fqp5FtZa53EkcHtTn1hvWzjYjlQWVKPbdRC1V0mYQU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ok/okteto/package.nix b/pkgs/by-name/ok/okteto/package.nix
index 1374ed07dd28..a90c465f2c5d 100644
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.30.1";
+  version = "2.30.2";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-Mu5Cl+wNCDXjFn0+1IitWEaku6Fi8ykKL6GgIKr5CHk=";
+    hash = "sha256-6t9lkn2voxE6rbBtD7AcO9aRLcLVe2JDFPIj8XR86KU=";
   };
 
   vendorHash = "sha256-7XZImCS9hv8ILYfGcoY3tMk0grswWbfpQrBKhghTfsY=";
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 376ad84fac66..e4c928ce86da 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2024-08-06";
+  version = "0-unstable-2024-08-26";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "ad60ee11ad6c43d32ef0396e340ec4e446288d69";
-    hash = "sha256-UiytwQXAgvvBp7hGpqoLMQZTrZ7uBxutML04Q343RCM=";
+    rev = "96d774a9ebae3fe61623029389d763e0c73aa362";
+    hash = "sha256-re4uiXt4No4OEeNm6hc52lkQ8lqkAoF1xy2BjIIi3A8=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sy/syndicate-server/package.nix b/pkgs/by-name/sy/syndicate-server/package.nix
new file mode 100644
index 000000000000..581ba32caf14
--- /dev/null
+++ b/pkgs/by-name/sy/syndicate-server/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  pkg-config,
+  openssl,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "syndicate-server";
+  version = "0.46.0";
+  src = fetchFromGitea {
+    domain = "git.syndicate-lang.org";
+    owner = "syndicate-lang";
+    repo = "syndicate-rs";
+    rev = "${pname}-v${version}";
+    sha256 = "sha256-bTteZIlBSoQ1o5shgd9NeKVvEhZTyG3i2zbeVojWiO8=";
+  };
+  cargoHash = "sha256-SIpdFXTk6MC/drjCLaaa49BbGsvCMNbPGCfTxAlCo9c=";
+  nativeBuildInputs = [
+    pkg-config
+    versionCheckHook
+  ];
+  buildInputs = [ openssl ];
+
+  RUSTC_BOOTSTRAP = 1;
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "Syndicate broker server";
+    homepage = "http://synit.org/";
+    license = lib.licenses.asl20;
+    mainProgram = "syndicate-server";
+    maintainers = with lib.maintainers; [ ehmry ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index c5928357f753..985b6036374d 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.2.747";
+  version = "0.2.771";
 
   src = fetchFromGitHub {
     owner = "a-h";
     repo = "templ";
     rev = "v${version}";
-    hash = "sha256-XFktmKFVN1/1Y57ZoUTVKDgEk38491N92orgejFLnMA=";
+    hash = "sha256-1S8rdq+dRVh5NulXZw70TC5NjaWb6YdIfT6NcZTvx8U=";
   };
 
-  vendorHash = "sha256-p2xuyy11N1nGjz5OhLIy04Kgzz90k3s0+09qi6hbjEc=";
+  vendorHash = "sha256-ZWY19f11+UI18jeHYIEZjdb9Ii74mD6w+dYRLPkdfBU=";
 
   subPackages = [ "cmd/templ" ];
 
diff --git a/pkgs/development/coq-modules/bbv/default.nix b/pkgs/development/coq-modules/bbv/default.nix
new file mode 100644
index 000000000000..340f32b830c4
--- /dev/null
+++ b/pkgs/development/coq-modules/bbv/default.nix
@@ -0,0 +1,20 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+mkCoqDerivation {
+  pname = "bbv";
+  owner = "mit-plv";
+  inherit version;
+  defaultVersion = let inherit (lib.versions) range; in
+    lib.switch coq.coq-version [
+      { case = range "8.16" "8.19"; out = "1.5"; }
+    ] null;
+  release = {
+    "1.5".sha256  = "sha256-8/VPsfhNpuYpLmLC/hWszDhgvS6n8m7BRxUlea8PSUw=";
+  };
+  releaseRev = v: "v${v}";
+
+  meta = {
+    description = "An implementation of bitvectors in Coq.";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix
index 50160231ac9d..bbc5ff1ca0f0 100644
--- a/pkgs/development/python-modules/aiovlc/default.nix
+++ b/pkgs/development/python-modules/aiovlc/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiovlc";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiovlc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8JDYh+Ym4UF6zjzN+xE0SzeS3BrrYv1MT6w0kn62ASQ=";
+    hash = "sha256-kiF2BRqaQLNpd+EoKrI9/9m3E1DlyJqM3Ng0qA0TfyQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index 7e9cbbe64cda..e2025204fbb7 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "asf-search";
-  version = "8.0.0";
+  version = "8.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "asfadmin";
     repo = "Discovery-asf_search";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cmKZ+pM7KDvGbO/+B6Xmm7zS69aq3MbRuyByV8ZT6hc=";
+    hash = "sha256-mOhY64Csxdc/DYS1OlbstxYEodtpXTVyPwd4B1jrDK8=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 7f973ee46dcb..3a725f625c4f 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "3.16.4";
+  version = "3.16.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-data";
     rev = "refs/tags/${version}";
-    hash = "sha256-Mdsqo0EX+tOMPibM/1bEeqF7a0od4az6FwgwmWkdQqY=";
+    hash = "sha256-QTsKjF7aVUUFi/6WtuLDVaKOOEzkbkQKpT9L2Mg6724=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 8126834a3c45..37c13fdfe1a5 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2024.8.1";
+  version = "2024.8.13";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = "hahomematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-myF10xrkq7xbov4veFiA1Jg6i+VS3khQPc/c2tx4gIc=";
+    hash = "sha256-dojgIKF3AGkJm2USspV0rm8UZnTLxYf4dgt86WwonQk=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
index 50e6ff352ce4..d28922b28662 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-json";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "kiota-serialization-json-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hGD8MhdQgF+mkoG4eOCSPyaArV8OrqAtgOwiNR8kado=";
+    hash = "sha256-V1s2MMO987ADp2nRxpIFlyx+OHNhSv8xCt3JOTzQCOM=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index e6b68e8490d2..ed8ac6f94832 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "3.1.0";
+  version = "3.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = "nextdns";
     rev = "refs/tags/${version}";
-    hash = "sha256-bBGuMfXCAqds9SMGj1I+9rk/u2QljZW60quvWODboCA=";
+    hash = "sha256-/gBNJYCkDQ5SeM4q/4rWdsSldrMeo5GdUBaG57NiEIY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydevccu/default.nix b/pkgs/development/python-modules/pydevccu/default.nix
index 9b8599a31b28..b1af673ed6fd 100644
--- a/pkgs/development/python-modules/pydevccu/default.nix
+++ b/pkgs/development/python-modules/pydevccu/default.nix
@@ -3,32 +3,35 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pydevccu";
   version = "0.1.8";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "danielperna84";
-    repo = pname;
+    repo = "pydevccu";
     rev = "refs/tags/${version}";
     hash = "sha256-WguSTtWxkiDs5nK5eiaarfD0CBxzIxQR9fxjuW3wMGc=";
   };
 
+  build-system = [ setuptools ];
+
   # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [ "pydevccu" ];
 
-  meta = with lib; {
+  meta = {
     description = "HomeMatic CCU XML-RPC Server with fake devices";
     homepage = "https://github.com/danielperna84/pydevccu";
     changelog = "https://github.com/danielperna84/pydevccu/releases/tag/${version}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/qdrant-client/default.nix b/pkgs/development/python-modules/qdrant-client/default.nix
index 969c38ddd17c..4410fcd51bda 100644
--- a/pkgs/development/python-modules/qdrant-client/default.nix
+++ b/pkgs/development/python-modules/qdrant-client/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "qdrant-client";
-  version = "1.11.0";
+  version = "1.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "qdrant";
     repo = "qdrant-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JrkBlqvMgZXSykYS1M4YOagwdF8QqMrMpxzYrk2Nfi8=";
+    hash = "sha256-NIGmQMtGvm6zifYJIMFx+d9w9IZmQUAqieBo/3JmYbM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index f64e8e68c8e2..dc72a492a20e 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "15.0.0";
+  version = "15.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-7tCLzMj5/K+7i8a1hFcilOgU+0Y5R6VdYJK5CK06LLw=";
+    hash = "sha256-PCtvDd/1eAbo1aHUPMu0XHNHMwBTbjZmdSNrY2PmxQc=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index f3a7d02a1652..bb67bacff234 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1216";
+  version = "3.0.1219";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-2/qt5Ttyvl2O1ekiICWUkKJa4Bzaqnz+8P1VrDKc4+w=";
+    hash = "sha256-EgWa4YmMLcA0z7M88vWMaNDLi5pZ+qNYvALi/MSS45s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 504bc9f396b8..7e14cc581a63 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "9.2.3";
+  version = "9.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-uPpA/FJRtmD8w5lZCmSsbZWGYRnKuvCx34aAKUWqn8o=";
+    hash = "sha256-5HHHSAvyUxR5myKucWpjkF7NQv/b1pViij606TZGzTY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 2c23fae7f49d..e0c247e38f29 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.235";
+  version = "3.2.236";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-NB3m+D+qNak0b/U1MWxj8KvADNxViv+8+oCun4m5rBk=";
+    hash = "sha256-w5ac8yerkGEOFOKNgeFtIOIjzekOd7G4Hn3J3kEzjMM=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 32d9bafdbf3e..04d1136a9386 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20240817.262f709";
+  version = "20240827.52afffa";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-57s9LB4L7DSbvkl/qf7tZuXOWmd36titEsEn/kB+Juo=";
+    hash = "sha256-G+FZnr7+XvvxDpBWyH4Dv8NEjSWTXDoVNzbzNpMTbLg=";
   };
 
   sgt-puzzles-menu = fetchurl {
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/games/vcmi/default.nix
index be91bd45dc22..a6bc05d8bbff 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-jdqhHxUJchc0d9wy5Fh/ZHJkMPffLP5aldNMg/+bRAM=";
+    hash = "sha256-Op5cnp/gO3PPv/QyrashFDBCyqwlO6wkv5Ni5jpRWd8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 589c98a23138..12239f2f10df 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.3.8";
+  version = "3.3.9";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "498de8338489a625673797f7ecc921fa4490c826afbfa42fa66922b525089e6a";
+    sha256 = "7cf2bd93bf487179aca1d2acf7b462dc269e769944c3ea73c7f9a4570dde86ab";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix
index 0d9bde930957..75778c6434c8 100644
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/default.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "danielperna84";
   domain = "homematicip_local";
-  version = "1.64.0";
+  version = "1.65.0";
 
   src = fetchFromGitHub {
     owner = "danielperna84";
     repo = "custom_homematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-uKqX7TJrqujH8C9K8VPx977GsDeAdMh94390G5omUMY=";
+    hash = "sha256-rUiesrVpGZMMo8JSboFTDE2oE0Q9hNYR4AvA/GR5+MY=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 003905fd954c..5e7a0ab48200 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.8.2";
+  version = "2024.8.3";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-ey1fglgyD7peGdBBD9fO9BWN48u+C+hYmTyh84FwYMY=";
+    hash = "sha256-cpOxBdqrbN/YmtbxTLyarYdDhdlbnLoFfsBvnAdsWks=";
   };
 
   build-system = [
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 3ffa0278d637..811c6b813361 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-08-17T01-24-54Z";
+  version = "2024-08-26T15-33-07Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-e3Zti0v+2jfRkVoXOfqW5uw9zvIfoAKhkolfNtyBNaE=";
+    hash = "sha256-ZQzHKosJfjtr++jrRvbY9w3x5uXXjw/eNrgcf3+6/2c=";
   };
 
-  vendorHash = "sha256-diRNxBmWB/aJjS8+/+7Dc/2RmI93SZpmfsqP+2i9X1Q=";
+  vendorHash = "sha256-L4mmQyXd/NQkKBHMKCLWs4A9XFKdrpcy+SYx2ExvqQE=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/vector/Cargo.lock b/pkgs/tools/misc/vector/Cargo.lock
index 717a59c9ad62..ab15a5622e15 100644
--- a/pkgs/tools/misc/vector/Cargo.lock
+++ b/pkgs/tools/misc/vector/Cargo.lock
@@ -10205,7 +10205,7 @@ dependencies = [
 
 [[package]]
 name = "vector"
-version = "0.40.0"
+version = "0.40.1"
 dependencies = [
  "apache-avro",
  "approx",
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index b5aefdec591f..9acb418e7508 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -36,7 +36,7 @@
 
 let
   pname = "vector";
-  version = "0.40.0";
+  version = "0.40.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KJqixwOc9M8xBzeyJFF3sFfybqAroEYu4OPD8q+PMRY=";
+    hash = "sha256-1vFDFdO9E5mUAUfEdg9Ec5ptq2Kp7HpqNz5+9CMn30U=";
   };
 
   cargoLock = {
@@ -67,11 +67,6 @@ rustPlatform.buildRustPackage {
     ++ lib.optionals stdenv.isLinux [ rust-jemalloc-sys-unprefixed ]
     ++ lib.optionals stdenv.isDarwin [ rust-jemalloc-sys Security libiconv coreutils CoreServices SystemConfiguration ];
 
-  # Rust 1.80.0 introduced the unexepcted_cfgs lint, which requires crates to allowlist custom cfg options that they inspect.
-  # Upstream is working on fixing this in https://github.com/vectordotdev/vector/pull/20949, but silencing the lint lets us build again until then.
-  # TODO remove when upgrading Vector
-  RUSTFLAGS = "--allow unexpected_cfgs";
-
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 76df35e780ce..93c05481c1a8 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-08-17T11-33-50Z";
+  version = "2024-08-26T10-49-58Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-sQovBnmDKf0F7dEWe5CEbxHQ/9hgkGkeut3qZX8MP6I=";
+    sha256 = "sha256-csaG54iwH0q8CHB0FFD0sY063uQ2WSlXDePo6yr5QbI=";
   };
 
-  vendorHash = "sha256-xxzdhL5WXigglDqVl5UtSO+ztw+FqjLu9d8kC6XWSzQ=";
+  vendorHash = "sha256-wjMn9Xi4wd7fa1ay3mLRGl/USWCVtk/J9KiGpfcsRM4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/ghauri/default.nix b/pkgs/tools/security/ghauri/default.nix
index a60862deadcd..9021b4102966 100644
--- a/pkgs/tools/security/ghauri/default.nix
+++ b/pkgs/tools/security/ghauri/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ghauri";
-  version = "1.3.5";
+  version = "1.3.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "r0oth3x49";
     repo = "ghauri";
     rev = "refs/tags/${version}";
-    hash = "sha256-ea0YJuHT4G6Y9AE9sZEHTa/Ljtw2fATFha/j4VmukcA=";
+    hash = "sha256-uGRhp77HmLmWMJFyhJoEjwdIR84Wcwv554g9Hi6yW4c=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f7b43fd0effd..9cd0ca8b76f8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6321,8 +6321,6 @@ with pkgs;
 
   bumpver = callPackage ../applications/version-management/bumpver { };
 
-  bup = callPackage ../tools/backup/bup { };
-
   bupstash = darwin.apple_sdk_11_0.callPackage ../tools/backup/bupstash { };
 
   burp = callPackage ../tools/backup/burp { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 418a7b6f308a..ecdbe8bd6eff 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -22,6 +22,7 @@ let
       async-test = callPackage ../development/coq-modules/async-test {};
       atbr = callPackage ../development/coq-modules/atbr {};
       autosubst = callPackage ../development/coq-modules/autosubst {};
+      bbv = callPackage ../development/coq-modules/bbv {};
       bignums = if lib.versionAtLeast coq.coq-version "8.6"
         then callPackage ../development/coq-modules/bignums {}
         else null;