diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index c86e0aeec6dc..243fbce1ecb5 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -586,6 +586,42 @@ checkConfigOutput '^38|27$' options.submoduleLine38.declarationPositions.1.line
 # nested options work
 checkConfigOutput '^34$' options.nested.nestedLine34.declarationPositions.0.line ./declaration-positions.nix
 
+# types.pathWith { inStore = true; }
+checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./pathWith.nix
+checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./pathWith.nix
+checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash"' config.pathInStore.ok3 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ""' config.pathInStore.bad1 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store"' config.pathInStore.bad2 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/"' config.pathInStore.bad3 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/.links"' config.pathInStore.bad4 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: "/foo/bar"' config.pathInStore.bad5 ./pathWith.nix
+
+# types.pathWith { inStore = false; }
+checkConfigOutput '"/foo/bar"' config.pathNotInStore.ok1 ./pathWith.nix
+checkConfigOutput '".*/store"' config.pathNotInStore.ok2 ./pathWith.nix
+checkConfigOutput '".*/store/"' config.pathNotInStore.ok3 ./pathWith.nix
+checkConfigOutput '""' config.pathNotInStore.ok4 ./pathWith.nix
+checkConfigOutput '".*/store/.links"' config.pathNotInStore.ok5 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path not in the Nix store.. Definition values:\n\s*- In .*: ".*/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathNotInStore.bad1 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path not in the Nix store.. Definition values:\n\s*- In .*: ".*/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathNotInStore.bad2 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path not in the Nix store.. Definition values:\n\s*- In .*: ".*/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash"' config.pathNotInStore.bad3 ./pathWith.nix
+checkConfigError 'A definition for option .* is not of type .path not in the Nix store.. Definition values:\n\s*- In .*: .*/pathWith.nix' config.pathNotInStore.bad4 ./pathWith.nix
+
+# types.pathWith { }
+checkConfigOutput '"/this/is/absolute"' config.anyPath.ok1 ./pathWith.nix
+checkConfigOutput '"./this/is/relative"' config.anyPath.ok2 ./pathWith.nix
+checkConfigError 'A definition for option .anyPath.bad1. is not of type .path.' config.anyPath.bad1 ./pathWith.nix
+
+# types.pathWith { absolute = true; }
+checkConfigOutput '"/this/is/absolute"' config.absolutePathNotInStore.ok1 ./pathWith.nix
+checkConfigError 'A definition for option .absolutePathNotInStore.bad1. is not of type .absolute path not in the Nix store.' config.absolutePathNotInStore.bad1 ./pathWith.nix
+checkConfigError 'A definition for option .absolutePathNotInStore.bad2. is not of type .absolute path not in the Nix store.' config.absolutePathNotInStore.bad2 ./pathWith.nix
+
+# types.pathWith failed type merge
+checkConfigError 'The option .conflictingPathOptionType. in .*/pathWith.nix. is already declared in .*/pathWith.nix' config.conflictingPathOptionType ./pathWith.nix
+
+# types.pathWith { inStore = true; absolute = false; }
+checkConfigError 'In pathWith, inStore means the path must be absolute' config.impossiblePathOptionType ./pathWith.nix
 
 cat <<EOF
 ====== module tests ======
diff --git a/lib/tests/modules/pathWith.nix b/lib/tests/modules/pathWith.nix
new file mode 100644
index 000000000000..273bc06dfc00
--- /dev/null
+++ b/lib/tests/modules/pathWith.nix
@@ -0,0 +1,88 @@
+{ lib, ... }:
+let
+  inherit (builtins)
+    storeDir
+    ;
+  inherit (lib)
+    types
+    mkOption
+    ;
+in
+{
+  imports = [
+    {
+      options = {
+        pathInStore = mkOption { type = types.lazyAttrsOf (types.pathWith { inStore = true; }); };
+        pathNotInStore = mkOption { type = types.lazyAttrsOf (types.pathWith { inStore = false; }); };
+        anyPath = mkOption { type = types.lazyAttrsOf (types.pathWith { }); };
+        absolutePathNotInStore = mkOption {
+          type = types.lazyAttrsOf (
+            types.pathWith {
+              inStore = false;
+              absolute = true;
+            }
+          );
+        };
+
+        # This conflicts with `conflictingPathOptionType` below.
+        conflictingPathOptionType = mkOption { type = types.pathWith { absolute = true; }; };
+
+        # This doesn't make sense: the only way to have something be `inStore`
+        # is to have an absolute path.
+        impossiblePathOptionType = mkOption {
+          type = types.pathWith {
+            inStore = true;
+            absolute = false;
+          };
+        };
+      };
+    }
+    {
+      options = {
+        # This should merge cleanly with `pathNotInStore` above.
+        pathNotInStore = mkOption {
+          type = types.lazyAttrsOf (
+            types.pathWith {
+              inStore = false;
+              absolute = null;
+            }
+          );
+        };
+
+        # This conflicts with `conflictingPathOptionType` above.
+        conflictingPathOptionType = mkOption { type = types.pathWith { absolute = false; }; };
+      };
+    }
+  ];
+
+  pathInStore.ok1 = "${storeDir}/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
+  pathInStore.ok2 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+  pathInStore.ok3 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+  pathInStore.bad1 = "";
+  pathInStore.bad2 = "${storeDir}";
+  pathInStore.bad3 = "${storeDir}/";
+  pathInStore.bad4 = "${storeDir}/.links"; # technically true, but not reasonable
+  pathInStore.bad5 = "/foo/bar";
+
+  pathNotInStore.ok1 = "/foo/bar";
+  pathNotInStore.ok2 = "${storeDir}"; # strange, but consistent with `pathInStore` above
+  pathNotInStore.ok3 = "${storeDir}/"; # also strange, but also consistent
+  pathNotInStore.ok4 = "";
+  pathNotInStore.ok5 = "${storeDir}/.links"; # strange, but consistent with `pathInStore` above
+  pathNotInStore.bad1 = "${storeDir}/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
+  pathNotInStore.bad2 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+  pathNotInStore.bad3 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+  pathNotInStore.bad4 = ./pathWith.nix;
+
+  anyPath.ok1 = "/this/is/absolute";
+  anyPath.ok2 = "./this/is/relative";
+  anyPath.bad1 = 42;
+
+  absolutePathNotInStore.ok1 = "/this/is/absolute";
+  absolutePathNotInStore.bad1 = "./this/is/relative";
+  absolutePathNotInStore.bad2 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+
+  conflictingPathOptionType = "/foo/bar";
+
+  impossiblePathOptionType = "/foo/bar";
+}
diff --git a/lib/types.nix b/lib/types.nix
index 5226609822f1..07d8a28d1394 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -566,21 +566,48 @@ rec {
       })
       (x: (x._type or null) == "pkgs");
 
-    path = mkOptionType {
-      name = "path";
-      descriptionClass = "noun";
-      check = x: isStringLike x && builtins.substring 0 1 (toString x) == "/";
-      merge = mergeEqualOption;
+    path = pathWith {
+      absolute = true;
     };
 
-    pathInStore = mkOptionType {
-      name = "pathInStore";
-      description = "path in the Nix store";
-      descriptionClass = "noun";
-      check = x: isStringLike x && builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
-      merge = mergeEqualOption;
+    pathInStore = pathWith {
+      inStore = true;
     };
 
+    pathWith = {
+      inStore ? null,
+      absolute ? null,
+    }:
+      throwIf (inStore != null && absolute != null && inStore && !absolute) "In pathWith, inStore means the path must be absolute" mkOptionType {
+        name = "pathWith";
+        description = (
+          (if absolute == null then "" else (if absolute then "absolute " else "relative ")) +
+          "path" +
+          (if inStore == null then "" else (if inStore then " in the Nix store" else " not in the Nix store"))
+        );
+        descriptionClass = "noun";
+
+        merge = mergeEqualOption;
+        functor = defaultFunctor "pathWith" // {
+          type = pathWith;
+          payload = {inherit inStore absolute; };
+          binOp = lhs: rhs: if lhs == rhs then lhs else null;
+        };
+
+        check = x:
+          let
+            isInStore = builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
+            isAbsolute = builtins.substring 0 1 (toString x) == "/";
+            isExpectedType = (
+              if inStore == null || inStore then
+                isStringLike x
+              else
+                isString x # Do not allow a true path, which could be copied to the store later on.
+            );
+          in
+            isExpectedType && (inStore == null || inStore == isInStore) && (absolute == null || absolute == isAbsolute);
+          };
+
     listOf = elemType: mkOptionType rec {
       name = "listOf";
       description = "list of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index 1e5c747b7340..dc16e5113fd1 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -23,15 +23,36 @@ merging is handled.
 
 `types.path`
 
-:   A filesystem path is anything that starts with a slash when
-    coerced to a string. Even if derivations can be considered as
-    paths, the more specific `types.package` should be preferred.
+:   A filesystem path that starts with a slash. Even if derivations can be
+     considered as paths, the more specific `types.package` should be preferred.
 
 `types.pathInStore`
 
 :   A path that is contained in the Nix store. This can be a top-level store
     path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`.
 
+`types.pathWith` { *`inStore`* ? `null`, *`absolute`* ? `null` }
+
+:   A filesystem path. Either a string or something that can be coerced
+    to a string.
+
+    **Parameters**
+
+    `inStore` (`Boolean` or `null`, default `null`)
+    : Whether the path must be in the store (`true`), must not be in the store
+      (`false`), or it doesn't matter (`null`)
+
+    `absolute` (`Boolean` or `null`, default `null`)
+    : Whether the path must be absolute (`true`), must not be absolute
+      (`false`), or it doesn't matter (`null`)
+
+    **Behavior**
+    - `pathWith { inStore = true; }` is equivalent to `pathInStore`
+    - `pathWith { absolute = true; }` is equivalent to `path`
+    - `pathWith { inStore = false; absolute = true; }` requires an absolute
+      path that is not in the store. Useful for password files that shouldn't be
+      leaked into the store.
+
 `types.package`
 
 :   A top-level store path. This can be an attribute set pointing
diff --git a/pkgs/applications/file-managers/mc/default.nix b/pkgs/applications/file-managers/mc/default.nix
index 80e929eb7160..0dd6b8c9418e 100644
--- a/pkgs/applications/file-managers/mc/default.nix
+++ b/pkgs/applications/file-managers/mc/default.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mc";
-  version = "4.8.32";
+  version = "4.8.33";
 
   src = fetchurl {
     url = "https://www.midnight-commander.org/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-TdyD0e3pryNjs+q5h/VLh89mGTJBEM4tOg5wlE0TWf4=";
+    hash = "sha256-yuFJ1C+ETlGF2MgdfbOROo+iFMZfhSIAqdiWtGivFkw=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/applications/misc/electrum/ltc.nix b/pkgs/applications/misc/electrum/ltc.nix
index 8e2ad76b2655..51df5b17b99d 100644
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@@ -51,7 +51,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://electrum-ltc.org/download/Electrum-LTC-${version}.tar.gz";
-    sha256 = "sha256-7F28cve+HD5JDK5igfkGD/NvTCfA33g+DmQJ5mwPM9Q=";
+    hash = "sha256-7F28cve+HD5JDK5igfkGD/NvTCfA33g+DmQJ5mwPM9Q=";
   };
 
   postUnpack = ''
@@ -85,6 +85,7 @@ python3.pkgs.buildPythonApplication {
       ckcc-protocol
       keepkey
       trezor
+      distutils
     ]
     ++ lib.optionals enableQt [
       pyqt5
diff --git a/pkgs/applications/virtualization/lima/default.nix b/pkgs/applications/virtualization/lima/default.nix
index 282fcac2395e..705aef607045 100644
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@@ -14,16 +14,16 @@
 
 buildGoModule rec {
   pname = "lima";
-  version = "1.0.3";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = "lima";
     rev = "v${version}";
-    hash = "sha256-S0Mk7h4gH5syP/ayK5g1g8HG5f23sKCQCCbM6xOj+n0=";
+    hash = "sha256-3K2RC4cPoIuDePTOYzY+ejmBFZwgYDvCtoe/ZLX66sc=";
   };
 
-  vendorHash = "sha256-1SHiz+lfG4nl1qavq/Fd73UV8LkErILk7d8XZJSbHd0=";
+  vendorHash = "sha256-tjogQUD+F/3ALlJwpdDKdXHRcYB+n0EuJ81TB1VKKDY=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -71,7 +71,7 @@ buildGoModule rec {
     '';
 
   doInstallCheck = true;
-  # Workaround for: "panic: $HOME is not defined" at https://github.com/lima-vm/lima/blob/v1.0.3/pkg/limayaml/defaults.go#L52
+  # Workaround for: "panic: $HOME is not defined" at https://github.com/lima-vm/lima/blob/cb99e9f8d01ebb82d000c7912fcadcd87ec13ad5/pkg/limayaml/defaults.go#L53
   # Don't use versionCheckHook for this package. It cannot inject environment variables.
   installCheckPhase = ''
     if [[ "$(HOME="$(mktemp -d)" "$out/bin/limactl" --version | cut -d ' ' -f 3)" == "${version}" ]]; then
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 3953e3634efc..f71e7018e9e4 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -2,21 +2,23 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.211";
+  version = "3.0.252";
 
   src = fetchFromGitHub {
-    rev = "v${version}";
     owner = "aliyun";
-    repo = pname;
+    repo = "aliyun-cli";
+    tag = "v${version}";
+    hash = "sha256-BNoNO8HQQGkUTR2MfpolF+PRo7YgT0hUbi5n+zPst6c=";
     fetchSubmodules = true;
-    hash = "sha256-6msh6bGL++nXVzwwNW6fFZbkN40ieL+SpgRownIs9aE=";
   };
 
-  vendorHash = "sha256-wHdSDBxDArVbD5+EgGcIpQ+NLg5BKXo2v3WM4ni1efc=";
+  vendorHash = "sha256-xwhq1UJ73Xxmt3NkpQMCrcl9N0F833N3/V+O+w1SVrQ=";
 
   subPackages = [ "main" ];
 
@@ -26,16 +28,20 @@ buildGoModule rec {
     "-X github.com/aliyun/aliyun-cli/cli.Version=${version}"
   ];
 
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
   postInstall = ''
     mv $out/bin/main $out/bin/aliyun
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Tool to manage and use Alibaba Cloud resources through a command line interface";
     homepage = "https://github.com/aliyun/aliyun-cli";
     changelog = "https://github.com/aliyun/aliyun-cli/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ornxka ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ornxka ];
     mainProgram = "aliyun";
   };
 }
diff --git a/pkgs/by-name/an/anydesk/package.nix b/pkgs/by-name/an/anydesk/package.nix
index 463cbd40d129..a041ff516211 100644
--- a/pkgs/by-name/an/anydesk/package.nix
+++ b/pkgs/by-name/an/anydesk/package.nix
@@ -34,14 +34,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "anydesk";
-  version = "6.4.0";
+  version = "6.4.1";
 
   src = fetchurl {
     urls = [
       "https://download.anydesk.com/linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
       "https://download.anydesk.com/linux/generic-linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
     ];
-    hash = "sha256-yGzTqbv3SQT6V/DcY8GvRDXilYrZXVsmQOnqy/5+ev8=";
+    hash = "sha256-rAdoH78e10JYLdXFIlasihztJxXNxb72HuxxSCfEzPE=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/aw/aws-sso-util/package.nix b/pkgs/by-name/aw/aws-sso-util/package.nix
index c083f6254933..093c47dded24 100644
--- a/pkgs/by-name/aw/aws-sso-util/package.nix
+++ b/pkgs/by-name/aw/aws-sso-util/package.nix
@@ -38,6 +38,6 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ cterence ];
     mainProgram = "aws-sso-util";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/co/committed/package.nix b/pkgs/by-name/co/committed/package.nix
index e8b54bb2f08f..8cde17a8e4f3 100644
--- a/pkgs/by-name/co/committed/package.nix
+++ b/pkgs/by-name/co/committed/package.nix
@@ -3,13 +3,13 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
-  testers,
+  versionCheckHook,
   nix-update-script,
-  committed,
+  git,
+  libz,
 }:
 let
-  version = "1.1.2";
+  version = "1.1.5";
 in
 rustPlatform.buildRustPackage {
   pname = "committed";
@@ -19,15 +19,37 @@ rustPlatform.buildRustPackage {
     owner = "crate-ci";
     repo = "committed";
     tag = "v${version}";
-    hash = "sha256-dBNtzKqaaqJrKMNwamUY0DO9VCVqDyf45lT82nOn8UM=";
+    hash = "sha256-puv64/btSEkxGNhGGkh2A08gI+EIHWjC+s+QQDKj/ZQ=";
   };
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-gWMS14945qa6pCe+Olg89gOaoZwRKsqJtG0jKe5/7e0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-fW3TqI26xggUKfzI11YCO8bpotd3aO6pdu1CHhtiShs=";
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Until upstream bumps the libz-sys dependency to >= 1.1.15 the build fails on unstable
+    # nixpkgs with macOS, because the following commit is not part of libz-sys < 1.1.15:
+    # https://github.com/madler/zlib/commit/4bd9a71f3539b5ce47f0c67ab5e01f3196dc8ef9
+    # Instead, use the nixpkgs libz so that libz-sys does not have to be built.
+    libz
+  ];
+
+  nativeCheckInputs = [
+    git
+  ];
+
+  # Ensure libgit2 can read user.name and user.email for `git_signature_default`.
+  # https://github.com/crate-ci/committed/blob/v1.1.5/crates/committed/tests/cmd.rs#L126
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    git config --global user.name nobody
+    git config --global user.email no@where
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
   passthru = {
-    tests.version = testers.testVersion { package = committed; };
     updateScript = nix-update-script { };
   };
 
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 005826ba40b6..0d6f6ade81c7 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -2,43 +2,53 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
-  libxkbcommon,
+  libcosmicAppHook,
   pulseaudio,
   udev,
-  wayland,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cosmic-osd";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.5.1";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
-    rev = "epoch-${version}";
-    hash = "sha256-JDdVFNTJI9O88lLKB1esJE4sk7ZZnTMilQRZSAgnTqs=";
+    tag = "epoch-${version}";
+    hash = "sha256-a5wzCHfp+dhtEkXsJOeEs2ZkmooSWIDGymeAdrXKE+U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Db1a1FusUdO7rQb0jfznaFNaJjdS9XSDGCMuzV1D79A=";
+  cargoHash = "sha256-hJC0t8R+cdPWzdpxHA+j7en4IrhZXt5LM3S2V6/bps0=";
+
+  nativeBuildInputs = [ libcosmicAppHook ];
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    libxkbcommon
     pulseaudio
-    wayland
     udev
   ];
 
   env.POLKIT_AGENT_HELPER_1 = "/run/wrappers/bin/polkit-agent-helper-1";
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
+    ];
+  };
+
+  meta = {
     homepage = "https://github.com/pop-os/cosmic-osd";
     description = "OSD for the COSMIC Desktop Environment";
     mainProgram = "cosmic-osd";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ nyabinary ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
+    ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/do/doomrunner/package.nix b/pkgs/by-name/do/doomrunner/package.nix
new file mode 100644
index 000000000000..2bb8b59e6a1a
--- /dev/null
+++ b/pkgs/by-name/do/doomrunner/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  kdePackages,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "doomrunner";
+  version = "1.9.0";
+
+  src = fetchFromGitHub {
+    owner = "Youda008";
+    repo = "DoomRunner";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rCoMTPGjIFAcNncBGg1IMdUahzjH0WlFZBZS0UmNI/g=";
+  };
+
+  buildInputs = [ kdePackages.qtbase ];
+
+  nativeBuildInputs = [
+    kdePackages.qmake
+    kdePackages.wrapQtAppsHook
+  ];
+
+  makeFlags = [
+    "INSTALL_ROOT=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/{bin,share/applications,share/icons/hicolor/128x128/apps}
+    install -Dm444 $src/Install/XDG/DoomRunner.128x128.png $out/share/icons/hicolor/128x128/apps/DoomRunner.png
+    install -Dm444 $src/Install/XDG/DoomRunner.desktop $out/share/applications/DoomRunner.desktop
+    install -Dm755 $out/usr/bin/DoomRunner $out/bin/DoomRunner
+    rm -rf $out/usr
+  '';
+
+  meta = {
+    description = "Preset-oriented graphical launcher of various ported Doom engines";
+    mainProgram = "DoomRunner";
+    homepage = "https://github.com/Youda008/DoomRunner";
+    changelog = "https://github.com/Youda008/DoomRunner/blob/${finalAttrs.src.rev}/changelog.txt";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ keenanweaver ];
+  };
+})
diff --git a/pkgs/by-name/do/dotnet-repl/package.nix b/pkgs/by-name/do/dotnet-repl/package.nix
index be1790159839..746819980117 100644
--- a/pkgs/by-name/do/dotnet-repl/package.nix
+++ b/pkgs/by-name/do/dotnet-repl/package.nix
@@ -6,12 +6,12 @@
 
 buildDotnetGlobalTool {
   pname = "dotnet-repl";
-  version = "0.1.216";
+  version = "0.3.230";
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
-  nugetHash = "sha256-JHatCW+hl2792S+HYeEbbYbCIS+N4DmOctqXB/56/HU=";
+  nugetHash = "sha256-FtITkDZ0Qbjo0XvQ8psRlIsbEZhMjIhk8mVrHmUxlIg=";
 
   meta = {
     description = "A polyglot REPL built on .NET Interactive";
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix
index 3eef32b0e3bd..c45e02804f64 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TOML code formatter.";
-  hash = "sha256-aDfo/sKfOeNpyfd/4N1LgL1bObTTnviYrA8T7M/1KNs=";
+  hash = "sha256-4g/nu8Wo7oF+8OAyXOzs9MuGpt2RFGvD58Bafnrr3ZQ=";
   initConfig = {
     configExcludes = [ ];
     configKey = "toml";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-toml";
   updateUrl = "https://plugins.dprint.dev/dprint/toml/latest.json";
-  url = "https://plugins.dprint.dev/toml-0.6.3.wasm";
-  version = "0.6.3";
+  url = "https://plugins.dprint.dev/toml-0.6.4.wasm";
+  version = "0.6.4";
 }
diff --git a/pkgs/by-name/fa/facetimehd-calibration/package.nix b/pkgs/by-name/fa/facetimehd-calibration/package.nix
index 8c843f5f564f..6a0d236e7361 100644
--- a/pkgs/by-name/fa/facetimehd-calibration/package.nix
+++ b/pkgs/by-name/fa/facetimehd-calibration/package.nix
@@ -58,7 +58,7 @@ stdenvNoCC.mkDerivation {
   dontUnpack = true;
   dontInstall = true;
 
-  buildInputs = [ unrar-wrapper ];
+  nativeBuildInputs = [ unrar-wrapper ];
 
   buildPhase =
     ''
diff --git a/pkgs/by-name/fa/fastjet-contrib/package.nix b/pkgs/by-name/fa/fastjet-contrib/package.nix
index 02f4c55d215c..caab082a4e3d 100644
--- a/pkgs/by-name/fa/fastjet-contrib/package.nix
+++ b/pkgs/by-name/fa/fastjet-contrib/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
       substituteInPlace "$f" --replace-quiet "ranlib " "${stdenv.cc.targetPrefix}ranlib "
     done
     patchShebangs --build ./utils/check.sh ./utils/install-sh
+    substituteInPlace configure \
+      --replace-warn "-Wl,-soname,fastjetcontribfragile.so.0" "-Wl,-soname,libfastjetcontribfragile.so"
   '';
 
   # Written in shell manually, does not support autoconf-style
diff --git a/pkgs/by-name/fa/fastjet/package.nix b/pkgs/by-name/fa/fastjet/package.nix
index f64e8acad983..4ca40d8af55d 100644
--- a/pkgs/by-name/fa/fastjet/package.nix
+++ b/pkgs/by-name/fa/fastjet/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   python ? null,
   withPython ? false,
 }:
@@ -15,6 +16,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-zBdUcb+rhla4xhg6jl6a0F1fdQbkbzISqagjCQW49qM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/fastjet/fastjet/-/commit/57ff0184c7cf578bbcdee3667aeaa64288cbae1a.diff";
+      hash = "sha256-uz8q7s+YAmbB4oXB+wyaSLo4gWSbEEPdATGDBrxT0vg=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs --build fastjet-config.in
   '';
diff --git a/pkgs/by-name/fe/fex/package.nix b/pkgs/by-name/fe/fex/package.nix
index cc01318bfb1f..6aea2949863f 100644
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@@ -12,13 +12,13 @@
 
 llvmPackages.stdenv.mkDerivation (finalAttrs: rec {
   pname = "fex";
-  version = "2501";
+  version = "2502";
 
   src = fetchFromGitHub {
     owner = "FEX-Emu";
     repo = "FEX";
     tag = "FEX-${version}";
-    hash = "sha256-9YOKLck4LIhTiAz+aCkOR3Eo1v02GK/YTQ98MuBSihI=";
+    hash = "sha256-w+Kqk+IQsVNbOqYDTpxDeoPyeIgqX2IfZv9zqAJEMVc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/fh/fheroes2/package.nix b/pkgs/by-name/fh/fheroes2/package.nix
index 10af267396fb..dbe215a34360 100644
--- a/pkgs/by-name/fh/fheroes2/package.nix
+++ b/pkgs/by-name/fh/fheroes2/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    hash = "sha256-Iy7aDC2IRwaNcX+hqtlKNDdOC8WCIlCxfNVeMRK6KP4=";
+    hash = "sha256-CowCP+gZuGSXWbALYBkmyn+RlDgOGho/Px34GutrBX0=";
   };
 
   nativeBuildInputs = [ imagemagick ];
diff --git a/pkgs/by-name/fi/fittrackee/package.nix b/pkgs/by-name/fi/fittrackee/package.nix
index 7cd75f7c6c99..ac28150d0c21 100644
--- a/pkgs/by-name/fi/fittrackee/package.nix
+++ b/pkgs/by-name/fi/fittrackee/package.nix
@@ -1,60 +1,39 @@
 {
   fetchFromGitHub,
-  fetchPypi,
   lib,
   stdenv,
   postgresql,
   postgresqlTestHook,
-  python3,
+  python3Packages,
 }:
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      sqlalchemy = super.sqlalchemy_1_4;
-
-      flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (oldAttrs: rec {
-        version = "3.0.5";
-
-        src = fetchPypi {
-          pname = "flask_sqlalchemy";
-          inherit version;
-          hash = "sha256-xXZeWMoUVAG1IQbA9GF4VpJDxdolVWviwjHsxghnxbE=";
-        };
-      });
-    };
-  };
-
-in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "fittrackee";
-  version = "0.8.12";
+  version = "0.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SamR1";
     repo = "FitTrackee";
     tag = "v${version}";
-    hash = "sha256-knhXFhBb11KWidw6ym8EdZJJ9CDSU4TarupegYJx94A=";
+    hash = "sha256-ZWSlJijW8vNuUtCHhEhmZPcEygcRrtHQUOQQKZdf868=";
   };
 
   build-system = [
-    python.pkgs.poetry-core
+    python3Packages.poetry-core
   ];
 
   pythonRelaxDeps = [
     "authlib"
     "flask-limiter"
-    "gunicorn"
-    "pyjwt"
+    "flask-migrate"
+    "nh3"
     "pyopenssl"
     "pytz"
     "sqlalchemy"
-    "ua-parser"
   ];
 
   dependencies =
-    with python.pkgs;
+    with python3Packages;
     [
       authlib
       babel
@@ -69,6 +48,8 @@ python.pkgs.buildPythonApplication rec {
       gpxpy
       gunicorn
       humanize
+      jsonschema
+      nh3
       psycopg2-binary
       pyjwt
       pyopenssl
@@ -83,7 +64,7 @@ python.pkgs.buildPythonApplication rec {
 
   pythonImportsCheck = [ "fittrackee" ];
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     pytestCheckHook
     freezegun
     postgresqlTestHook
@@ -103,6 +84,7 @@ python.pkgs.buildPythonApplication rec {
 
   preCheck = ''
     export TMP=$TMPDIR
+    export UI_URL=http://0.0.0.0:5000
   '';
 
   meta = {
diff --git a/pkgs/by-name/ge/geogram/package.nix b/pkgs/by-name/ge/geogram/package.nix
index 8dfff7a3d24a..eca1fd30a50e 100644
--- a/pkgs/by-name/ge/geogram/package.nix
+++ b/pkgs/by-name/ge/geogram/package.nix
@@ -1,30 +1,39 @@
 {
   lib,
   stdenv,
-  fetchurl,
   fetchFromGitHub,
-
   cmake,
   doxygen,
   zlib,
   python3Packages,
+  nix-update-script,
+  fetchpatch2,
 }:
 
 let
+  exploragram = fetchFromGitHub {
+    owner = "BrunoLevy";
+    repo = "exploragram";
+    rev = "3190f685653f8aa75b7c4604d008c59a999f1bb6";
+    hash = "sha256-9ePCOyQWSxu12PtHFSxfoDcvTtxvYR3T68sU3cAfZiE=";
+  };
   testdata = fetchFromGitHub {
     owner = "BrunoLevy";
     repo = "geogram.data";
-    rev = "43dd49054a78d9b3fb8ef729f48ab47a272c718c";
-    hash = "sha256-F2Lyt4nEOczVYLz6WLny+YrsxNwREBGPkProN8NHFN4=";
+    rev = "ceab6179189d23713b902b6f26ea2ff36aea1515";
+    hash = "sha256-zUmYI6+0IdDkglLzzWHS8ZKmc5O6aJ2X4IwRBouRIxI=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "geogram";
-  version = "1.8.6";
+  version = "1.9.2";
 
-  src = fetchurl {
-    url = "https://github.com/BrunoLevy/geogram/releases/download/v${version}/geogram_${version}.tar.gz";
-    hash = "sha256-Xqha5HVqD2Ao0z++RKcQdMZUmtMb5eZ1DMJEVrfNUzE=";
+  src = fetchFromGitHub {
+    owner = "BrunoLevy";
+    repo = "geogram";
+    tag = "v${version}";
+    hash = "sha256-v7ChuE9F/z1MD5OUMiGXZWiGqjMauIka4sNXVDe/yYU=";
+    fetchSubmodules = true;
   };
 
   outputs = [
@@ -65,11 +74,22 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
+  # exploragram library is not listed as submodule and must be copied manually
+  prePatch = ''
+    cp -r ${exploragram} ./src/lib/exploragram/ && chmod 755 ./src/lib/exploragram/
+  '';
+
   patches = [
     # This patch replaces the bundled (outdated) zlib with our zlib
     # Should be harmless, but if there are issues this patch can also be removed
     # Also check https://github.com/BrunoLevy/geogram/issues/49 for progress
     ./replace-bundled-zlib.patch
+
+    # fixes https://github.com/BrunoLevy/geogram/issues/203, remove when 1.9.3 is released
+    (fetchpatch2 {
+      url = "https://github.com/BrunoLevy/geogram/commit/2e1b6fba499ddc55b2150a1f610cf9f8d4934c39.patch";
+      hash = "sha256-t6Pocf3VT8HpKOSh1UKKa0QHpsZyFqlAng6ltiAfKA8=";
+    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isAarch64 ''
@@ -90,16 +110,12 @@ stdenv.mkDerivation rec {
   checkPhase =
     let
       skippedTests = [
-        # Failing tests as of version 1.8.3
-        "FileConvert"
-        "Reconstruct"
-        "Remesh"
-
         # Skip slow RVD test
         "RVD"
 
-        # Flaky as of 1.8.5 (SIGSEGV, possibly a use-after-free)
-        "Delaunay"
+        # Needs unfree library geogramplus with extended precision
+        # see https://github.com/BrunoLevy/geogram/wiki/GeogramPlus
+        "CSGplus"
       ];
     in
     ''
@@ -115,6 +131,8 @@ stdenv.mkDerivation rec {
       runHook postCheck
     '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Programming Library with Geometric Algorithms";
     longDescription = ''
@@ -125,10 +143,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/BrunoLevy/geogram";
     license = licenses.bsd3;
 
-    # Broken on aarch64-linux as of version 1.8.3
-    # See https://github.com/BrunoLevy/geogram/issues/74
-    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
-
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/ku/kubevpn/package.nix b/pkgs/by-name/ku/kubevpn/package.nix
index 9faec05431a4..25637f2dd3b9 100644
--- a/pkgs/by-name/ku/kubevpn/package.nix
+++ b/pkgs/by-name/ku/kubevpn/package.nix
@@ -2,27 +2,54 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  go,
 }:
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.2.10";
+  version = "2.3.9";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     rev = "v${version}";
-    hash = "sha256-2LDV2aVdGuclVmOgIIwMYRKTMVLzlmNFI6xHFpxMRJw=";
+    hash = "sha256-g/N9Ho+s2AEA4iQSK48KGoTgsEMqv8ya3ZqCAhgVInc=";
   };
 
   vendorHash = null;
 
-  # TODO investigate why some config tests are failing
-  doCheck = false;
+  tags = [
+    "noassets" # required to build synthing gui without generating assets
+  ];
+
+  ldflags = [
+    "-X github.com/wencaiwulue/kubevpn/v2/pkg/config.Version=v${version}"
+    "-X github.com/wencaiwulue/kubevpn/v2/cmd/kubevpn/cmds.OsArch=${go.GOOS}/${go.GOARCH}"
+  ];
+
+  # Resolve configuration tests, which access $HOME
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  # Disable network tests
+  checkFlags = [
+    "-skip=^Test(Route|Functions|ByDumpClusterInfo|ByCreateSvc|Elegant)$"
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/kubevpn help
+    $out/bin/kubevpn version | grep -e "Version: v${version}"
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     changelog = "https://github.com/KubeNetworks/kubevpn/releases/tag/${src.rev}";
     description = "Create a VPN and connect to Kubernetes cluster network, access resources, and more";
+    mainProgram = "kubevpn";
     homepage = "https://github.com/KubeNetworks/kubevpn";
     license = licenses.mit;
     maintainers = with maintainers; [ mig4ng ];
diff --git a/pkgs/by-name/li/libei/package.nix b/pkgs/by-name/li/libei/package.nix
index 654f9ba46255..9dc3f0df4f30 100644
--- a/pkgs/by-name/li/libei/package.nix
+++ b/pkgs/by-name/li/libei/package.nix
@@ -23,14 +23,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libei";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = version;
-    hash = "sha256-yKeMHgR3s83xwoXgLW28ewF2tvs6l0Hq0cCAroCgq0U=";
+    hash = "sha256-lSrIC93Cke90/Xc8dqd3e/TU32tflYHYqc5fE8wglBI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/li/libtas/package.nix b/pkgs/by-name/li/libtas/package.nix
index 7a3ab2e7a155..f36e9391a07d 100644
--- a/pkgs/by-name/li/libtas/package.nix
+++ b/pkgs/by-name/li/libtas/package.nix
@@ -9,6 +9,7 @@
 , lua5_3
 , qt5
 , file
+, binutils
 , makeDesktopItem
 }:
 
@@ -39,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = ''
     wrapProgram $out/bin/libTAS \
-      --suffix PATH : ${lib.makeBinPath [ file ]} \
+      --suffix PATH : ${lib.makeBinPath [ file binutils ffmpeg ]} \
       --set-default LIBTAS_SO_PATH $out/lib/libtas.so
   '';
 
diff --git a/pkgs/by-name/li/lightspark/package.nix b/pkgs/by-name/li/lightspark/package.nix
index 4f73bf561ef2..89d6900fba94 100644
--- a/pkgs/by-name/li/lightspark/package.nix
+++ b/pkgs/by-name/li/lightspark/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lightspark";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "lightspark";
     repo = "lightspark";
     rev = version;
-    hash = "sha256-qX/ft9slWTbvuSyi2jB6YC7D7QTtCybL/dTo1dJp3pQ=";
+    hash = "sha256-2+Kmwj2keCMR7UbKbY6UvrkX4CnW61elres8ltiZuUg=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index a7a5ae94d47f..1c556e1ea081 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.12.3",
-    "hash": "sha256-Rl21p+nN5KnabzzH9cRWJnLIKX/3Haex+VSY3PvZs5Q="
+    "version": "5.13.1",
+    "hash": "sha256-mXM1B54Wf1T61jfYz6ug7xPmhLeUqaB6jyBAkxIybfM="
   },
   "beta": {
-    "version": "5.13.0-beta.4",
-    "hash": "sha256-TPNS4VkbUNesT0TN2jAyTilzr5+3H6JxqOLujc7VQDA="
+    "version": "5.13.1",
+    "hash": "sha256-mXM1B54Wf1T61jfYz6ug7xPmhLeUqaB6jyBAkxIybfM="
   }
 }
diff --git a/pkgs/by-name/mo/mox/package.nix b/pkgs/by-name/mo/mox/package.nix
index 749e4d2e4515..6c4c5addeb13 100644
--- a/pkgs/by-name/mo/mox/package.nix
+++ b/pkgs/by-name/mo/mox/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "mox";
-  version = "0.0.10";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "mjl-";
     repo = "mox";
-    rev = "v${version}";
-    hash = "sha256-BigxFlMkagw82Lkz1xMMSwAJyfSdSbeQr6G6rCaomNg=";
+    tag = "v${version}";
+    hash = "sha256-cBTY4SjQxdM5jXantLws1ckGVn3/b0/iVPFunBy09YQ=";
   };
 
   # set the version during buildtime
@@ -24,6 +24,7 @@ buildGoModule rec {
     "-s"
     "-w"
     "-X github.com/mjl-/mox/moxvar.Version=${version}"
+    "-X github.com/mjl-/mox/moxvar.VersionBare=${version}"
   ];
 
   meta = {
@@ -31,6 +32,9 @@ buildGoModule rec {
     mainProgram = "mox";
     homepage = "https://github.com/mjl-/mox";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dit7ya ];
+    maintainers = with lib.maintainers; [
+      dit7ya
+      kotatsuyaki
+    ];
   };
 }
diff --git a/pkgs/by-name/mo/mox/version.patch b/pkgs/by-name/mo/mox/version.patch
index c842275ac9e4..66dc48c0e864 100644
--- a/pkgs/by-name/mo/mox/version.patch
+++ b/pkgs/by-name/mo/mox/version.patch
@@ -1,24 +1,37 @@
 diff --git a/moxvar/version.go b/moxvar/version.go
-index 8c6bac8..69b5f7c 100644
+index 0b69cd9..9a5a5da 100644
 --- a/moxvar/version.go
 +++ b/moxvar/version.go
-@@ -1,38 +1,5 @@
+@@ -1,51 +1,6 @@
  // Package moxvar provides the version number of a mox build.
  package moxvar
- 
+
 -import (
+-	"runtime"
 -	"runtime/debug"
 -)
 -
 -// Version is set at runtime based on the Go module used to build.
--var Version = "(devel)"
++// Version and VersionBare are set via a build flag.
+ var Version string
+-
+-// VersionBare does not add a "+modifications", goversion or other suffix to the version.
+-var VersionBare string
 -
 -func init() {
+-	Version = "(devel)"
+-	VersionBare = "(devel)"
+-
+-	defer func() {
+-		Version += "-" + runtime.Version()
+-	}()
+-
 -	buildInfo, ok := debug.ReadBuildInfo()
 -	if !ok {
 -		return
 -	}
 -	Version = buildInfo.Main.Version
+-	VersionBare = buildInfo.Main.Version
 -	if Version == "(devel)" {
 -		var vcsRev, vcsMod string
 -		for _, setting := range buildInfo.Settings {
@@ -32,6 +45,7 @@ index 8c6bac8..69b5f7c 100644
 -			return
 -		}
 -		Version = vcsRev
+-		VersionBare = vcsRev
 -		switch vcsMod {
 -		case "false":
 -		case "true":
@@ -41,5 +55,5 @@ index 8c6bac8..69b5f7c 100644
 -		}
 -	}
 -}
-+// Version is set via a build flag
-+var Version string;
++var VersionBare string
+\ No newline at end of file
diff --git a/pkgs/by-name/qo/qogir-icon-theme/package.nix b/pkgs/by-name/qo/qogir-icon-theme/package.nix
index 179b138e60fa..26b7c6e39bdc 100644
--- a/pkgs/by-name/qo/qogir-icon-theme/package.nix
+++ b/pkgs/by-name/qo/qogir-icon-theme/package.nix
@@ -23,13 +23,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "dark" "all" ] color
   stdenvNoCC.mkDerivation
   rec {
     inherit pname;
-    version = "2023-06-05";
+    version = "2025-02-15";
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
       rev = version;
-      sha256 = "sha256-qiHmA/K4hdXVSFzergGhgssKR+kXp3X0cqtX1X5ayM4=";
+      hash = "sha256-Eh4TWoFfArFmpM/9tkrf2sChQ0zzOZJE9pElchu8DCM=";
     };
 
     nativeBuildInputs = [
@@ -39,8 +39,6 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "dark" "all" ] color
 
     propagatedBuildInputs = [ hicolor-icon-theme ];
 
-    # FIXME: https://hydra.nixos.org/build/286997490/nixlog/5
-    dontCheckForBrokenSymlinks = true;
     dontDropIconThemeCache = true;
 
     # These fixup steps are slow and unnecessary.
diff --git a/pkgs/by-name/rq/rquickshare/package.nix b/pkgs/by-name/rq/rquickshare/package.nix
index 1cd300f6ba0a..9a2102a9affb 100644
--- a/pkgs/by-name/rq/rquickshare/package.nix
+++ b/pkgs/by-name/rq/rquickshare/package.nix
@@ -39,13 +39,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rquickshare" + (app-type-either "" "-legacy");
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "Martichou";
     repo = "rquickshare";
     tag = "v${version}";
-    hash = "sha256-6gXt1UGcjOFInsCep56s3K5Zk/KIz2ZrFlmrgXP7/e8=";
+    hash = "sha256-Gq78vxM9hJ+dAHM3RAKHtkFIsoV0XQN4vNbOO3amvTs=";
   };
 
   # from https://github.com/NixOS/nixpkgs/blob/04e40bca2a68d7ca85f1c47f00598abb062a8b12/pkgs/by-name/ca/cargo-tauri/test-app.nix#L23-L26
@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
   cargoRoot = "app/${app-type}/src-tauri";
   buildAndTestSubdir = cargoRoot;
   cargoPatches = [ ./remove-duplicate-versions-of-sys-metrics.patch ];
-  cargoHash = app-type-either "sha256-R1RDBV8lcEuFdkh9vrNxFRSPSYVOWDvafPQAmQiJV2s=" "sha256-tgnSOICA/AFASIIlxnRoSjq5nx30Z7C6293bcvnWl0k=";
+  cargoHash = app-type-either "sha256-wraCzzC7YVCXEXBTd8c1cbtCdBunENpUMQ1vZGwfGMs=" "sha256-TBsHlFwbWWa2LEZdmDyz/9vWiFOXKX39PCsjW6OqEGY=";
 
   nativeBuildInputs = [
     proper-cargo-tauri.hook
@@ -97,17 +97,16 @@ rustPlatform.buildRustPackage rec {
       libsoup_2_4
     ];
 
-  passthru.updateScript =
-    let
+  passthru =
+    # Don't set an update script for the legacy version
+    # so r-ryantm won't create two duplicate PRs
+    lib.optionalAttrs (app-type == "main") {
       updateScript = writeShellScript "update-rquickshare.sh" ''
         ${lib.getExe nix-update} rquickshare
         sed -i 's/version = "0.0.0";/' pkgs/by-name/rq/rquickshare/package.nix
         ${lib.getExe nix-update} rquickshare-legacy
       '';
-    in
-    # Don't set an update script for the legacy version
-    # so r-ryantm won't create two duplicate PRs
-    app-type-either updateScript null;
+    };
 
   meta = {
     description = "Rust implementation of NearbyShare/QuickShare from Android for Linux and macOS";
diff --git a/pkgs/by-name/rq/rquickshare/remove-duplicate-versions-of-sys-metrics.patch b/pkgs/by-name/rq/rquickshare/remove-duplicate-versions-of-sys-metrics.patch
index b5128e047838..af1f423857fd 100644
--- a/pkgs/by-name/rq/rquickshare/remove-duplicate-versions-of-sys-metrics.patch
+++ b/pkgs/by-name/rq/rquickshare/remove-duplicate-versions-of-sys-metrics.patch
@@ -1,5 +1,5 @@
 diff --git a/app/legacy/src-tauri/Cargo.lock b/app/legacy/src-tauri/Cargo.lock
-index 109db68..c3a70c6 100644
+index 1bba0ae..af24986 100644
 --- a/app/legacy/src-tauri/Cargo.lock
 +++ b/app/legacy/src-tauri/Cargo.lock
 @@ -4138,7 +4138,7 @@ dependencies = [
@@ -45,7 +45,7 @@ index 109db68..c3a70c6 100644
   "core-foundation-sys",
   "glob",
 diff --git a/app/legacy/src-tauri/Cargo.toml b/app/legacy/src-tauri/Cargo.toml
-index 5468707..68ed47b 100644
+index b971c3d..44abf29 100644
 --- a/app/legacy/src-tauri/Cargo.toml
 +++ b/app/legacy/src-tauri/Cargo.toml
 @@ -20,7 +20,7 @@ notify-rust = "4.10"
@@ -58,7 +58,7 @@ index 5468707..68ed47b 100644
  tauri-plugin-autostart = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "v1" }
  tauri-plugin-single-instance = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "v1" }
 diff --git a/app/main/src-tauri/Cargo.lock b/app/main/src-tauri/Cargo.lock
-index c1f175c..7bf1450 100644
+index bc4753a..ed4c7e8 100644
 --- a/app/main/src-tauri/Cargo.lock
 +++ b/app/main/src-tauri/Cargo.lock
 @@ -4182,7 +4182,7 @@ dependencies = [
@@ -102,7 +102,7 @@ index c1f175c..7bf1450 100644
  name = "sys_metrics"
  version = "0.2.7"
 diff --git a/app/main/src-tauri/Cargo.toml b/app/main/src-tauri/Cargo.toml
-index 90dcc88..56abae2 100644
+index 5653700..5120513 100644
 --- a/app/main/src-tauri/Cargo.toml
 +++ b/app/main/src-tauri/Cargo.toml
 @@ -20,7 +20,7 @@ notify-rust = "4.10"
@@ -111,6 +111,6 @@ index 90dcc88..56abae2 100644
  serde_json = "1.0"
 -sys_metrics = "0.2"
 +sys_metrics = { git = "https://github.com/Martichou/sys_metrics" }
- tauri = { version = "2.2", features = [ "devtools", "tray-icon", "native-tls-vendored"] }
+ tauri = { version = "2.2", features = [ "devtools", "tray-icon", "native-tls-vendored", "image-png"] }
  tauri-plugin-autostart = "2.2"
  tauri-plugin-process = "2.2"
diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index 876fc9d883a4..998c41fe33d1 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.2.4";
+  version = "6.2.5";
 
   src = fetchurl {
     url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-    hash = "sha256-Qd9qbsMLCBSs2Ow/OXUDbfl4rFdAIOwUiDmPAvhvDrs=";
+    hash = "sha256-7A/2FgB35SyBO1GZagChwNytFn2aSzPiAFBeHk316bw=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/si/sipp/package.nix b/pkgs/by-name/si/sipp/package.nix
index 7ad501f87bdb..3f715baabcee 100644
--- a/pkgs/by-name/si/sipp/package.nix
+++ b/pkgs/by-name/si/sipp/package.nix
@@ -1,30 +1,27 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   ncurses,
   libpcap,
   cmake,
   openssl,
-  git,
   lksctp-tools,
 }:
 
-stdenv.mkDerivation rec {
-  version = "3.6.1";
+stdenv.mkDerivation (finalAttrs: {
   pname = "sipp";
+  version = "3.7.3-unstable-2025-01-22";
 
-  src = fetchurl {
-    url = "https://github.com/SIPp/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-alYOg6/5gvMx3byt+zvVMMWJbNW3V91utoITPMhg7LE=";
+  src = fetchFromGitHub {
+    owner = "SIPp";
+    repo = "sipp";
+    rev = "464cf74c7321069b51c10f0c37f19ba16c2e7138";
+    hash = "sha256-mloeBKgDXmsa/WAUhlDsgNdhK8dpisGf3ti5UQQchJ8=";
+    leaveDotGit = true;
   };
 
-  postPatch = ''
-    cp version.h src/version.h
-  '';
-
   cmakeFlags = [
-    "-DUSE_GSL=1"
     "-DUSE_PCAP=1"
     "-DUSE_SSL=1"
     "-DUSE_SCTP=${if stdenv.hostPlatform.isLinux then "1" else "0"}"
@@ -32,23 +29,24 @@ stdenv.mkDerivation rec {
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
     cmake
-    git
   ];
+
   buildInputs = [
     ncurses
     libpcap
     openssl
   ] ++ lib.optional (stdenv.hostPlatform.isLinux) lksctp-tools;
 
-  meta = with lib; {
+  meta = {
     homepage = "http://sipp.sf.net";
     description = "SIPp testing tool";
     mainProgram = "sipp";
-    license = licenses.gpl3;
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/su/supergfxctl/package.nix b/pkgs/by-name/su/supergfxctl/package.nix
index 59ccbc77eeae..d0421bd1d902 100644
--- a/pkgs/by-name/su/supergfxctl/package.nix
+++ b/pkgs/by-name/su/supergfxctl/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "supergfxctl";
-  version = "5.2.4";
+  version = "5.2.7";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "supergfxctl";
     rev = version;
-    hash = "sha256-ie5JPHBvypUtPStwA/aO4GeQ/qbHTzUJF3T4QuW6JNc=";
+    hash = "sha256-d3jN4i4oHRFDgr5f6y42gahrCfXBPB61T72x6IeiskM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ef4lxuN7s5X/9I7VSub5DZVjQG8DhdMr/7CRtd2x9rs=";
+  cargoHash = "sha256-BM/fcXWyEWjAkqOdj2MItOzKknNUe9HMns30H1n5/xo=";
 
   postPatch = ''
     substituteInPlace data/supergfxd.service --replace /usr/bin/supergfxd $out/bin/supergfxd
diff --git a/pkgs/by-name/ta/tailwindcss/package.nix b/pkgs/by-name/ta/tailwindcss/package.nix
new file mode 100644
index 000000000000..e981f68a88e5
--- /dev/null
+++ b/pkgs/by-name/ta/tailwindcss/package.nix
@@ -0,0 +1 @@
+{ tailwindcss_4 }: tailwindcss_4
diff --git a/pkgs/development/tools/tailwindcss/default.nix b/pkgs/by-name/ta/tailwindcss_3/package.nix
similarity index 97%
rename from pkgs/development/tools/tailwindcss/default.nix
rename to pkgs/by-name/ta/tailwindcss_3/package.nix
index f562cabd500f..2f43e836ff9a 100644
--- a/pkgs/development/tools/tailwindcss/default.nix
+++ b/pkgs/by-name/ta/tailwindcss_3/package.nix
@@ -3,7 +3,6 @@
   fetchurl,
   stdenv,
   runCommand,
-  tailwindcss,
 }:
 let
   inherit (stdenv.hostPlatform) system;
@@ -30,7 +29,7 @@ let
     .${system} or throwSystem;
 in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "tailwindcss";
+  pname = "tailwindcss_3";
   version = "3.4.17";
 
   src = fetchurl {
diff --git a/pkgs/development/tools/tailwindcss/update.sh b/pkgs/by-name/ta/tailwindcss_3/update.sh
similarity index 67%
rename from pkgs/development/tools/tailwindcss/update.sh
rename to pkgs/by-name/ta/tailwindcss_3/update.sh
index b3a9ccf37819..1a5f68d74f07 100755
--- a/pkgs/development/tools/tailwindcss/update.sh
+++ b/pkgs/by-name/ta/tailwindcss_3/update.sh
@@ -1,27 +1,27 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused jq nix-prefetch
+#!nix-shell -i bash -p common-updater-scripts gnused jq nix-prefetch
 set -eou pipefail
 
 ROOT="$(dirname "$(readlink -f "$0")")"
 
-CURRENT_VERSION=$(nix-instantiate --eval --strict --json -A tailwindcss.version . | jq -r .)
-LATEST_VERSION=$(curl --fail --silent https://api.github.com/repos/tailwindlabs/tailwindcss/releases/latest | jq --raw-output .tag_name | sed 's/v//')
-sed -i "s/version = \".*\"/version = \"${LATEST_VERSION}\"/" "$ROOT/default.nix"
+CURRENT_VERSION=$(nix-instantiate --eval --strict --json -A tailwindcss_3.version . | jq -r .)
+LATEST_VERSION=$(list-git-tags --url=https://github.com/tailwindlabs/tailwindcss | rg 'v3[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
+sed -i "s/version = \".*\"/version = \"${LATEST_VERSION}\"/" "$ROOT/package.nix"
 
 if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then
-    echo "tailwindcss already at latest version $CURRENT_VERSION, exiting"
+    echo "tailwindcss_3 already at latest version $CURRENT_VERSION, exiting"
     exit 0
 fi
 
 function updatePlatform() {
     NIXPLAT=$1
     TAILWINDPLAT=$2
-    echo "Updating tailwindcss for $NIXPLAT"
+    echo "Updating tailwindcss_3 for $NIXPLAT"
 
     URL="https://github.com/tailwindlabs/tailwindcss/releases/download/v${LATEST_VERSION}/tailwindcss-${TAILWINDPLAT}"
     HASH=$(nix hash to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")")
 
-    sed -i "s,$NIXPLAT = \"sha256.*\",$NIXPLAT = \"${HASH}\"," "$ROOT/default.nix"
+    sed -i "s,$NIXPLAT = \"sha256.*\",$NIXPLAT = \"${HASH}\"," "$ROOT/package.nix"
 }
 
 updatePlatform aarch64-darwin macos-arm64
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index 9c4128a4df5a..388a39759bb4 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -5,7 +5,6 @@
   versionCheckHook,
   autoPatchelfHook,
   makeWrapper,
-  tailwindcss_4,
 }:
 let
   version = "4.0.6";
@@ -71,7 +70,10 @@ stdenv.mkDerivation {
     homepage = "https://tailwindcss.com/blog/tailwindcss-v4";
     license = lib.licenses.mit;
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-    maintainers = [ lib.maintainers.adamjhf ];
+    maintainers = with lib.maintainers; [
+      adamcstephens
+      adamjhf
+    ];
     mainProgram = "tailwindcss";
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ta/tailwindcss_4/update.sh b/pkgs/by-name/ta/tailwindcss_4/update.sh
old mode 100644
new mode 100755
index bcf057e6e9b9..3f50e10768e1
--- a/pkgs/by-name/ta/tailwindcss_4/update.sh
+++ b/pkgs/by-name/ta/tailwindcss_4/update.sh
@@ -1,27 +1,27 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused jq nix-prefetch
+#!nix-shell -i bash -p common-updater-scripts gnused jq nix-prefetch
 set -eou pipefail
 
 ROOT="$(dirname "$(readlink -f "$0")")"
 
 CURRENT_VERSION=$(nix-instantiate --eval --strict --json -A tailwindcss.version . | jq -r .)
-LATEST_VERSION=$(curl --fail --silent https://api.github.com/repos/tailwindlabs/tailwindcss/releases/latest | jq --raw-output .tag_name | sed 's/v//')
-sed -i "s/version = \".*\"/version = \"${LATEST_VERSION}\"/" "$ROOT/default.nix"
+LATEST_VERSION=$(list-git-tags --url=https://github.com/tailwindlabs/tailwindcss | rg 'v4[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
+sed -i "s/version = \".*\"/version = \"${LATEST_VERSION}\"/" "$ROOT/package.nix"
 
 if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then
-    echo "tailwindcss already at latest version $CURRENT_VERSION, exiting"
+    echo "tailwindcss_4 already at latest version $CURRENT_VERSION, exiting"
     exit 0
 fi
 
 function updatePlatform() {
     NIXPLAT=$1
     TAILWINDPLAT=$2
-    echo "Updating tailwindcss for $NIXPLAT"
+    echo "Updating tailwindcss_4 for $NIXPLAT"
 
     URL="https://github.com/tailwindlabs/tailwindcss/releases/download/v${LATEST_VERSION}/tailwindcss-${TAILWINDPLAT}"
     HASH=$(nix hash to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")")
 
-    sed -i "s,$NIXPLAT = \"sha256.*\",$NIXPLAT = \"${HASH}\"," "$ROOT/default.nix"
+    sed -i "s,$NIXPLAT = \"sha256.*\",$NIXPLAT = \"${HASH}\"," "$ROOT/package.nix"
 }
 
 updatePlatform aarch64-darwin macos-arm64
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index 39b11f9620de..17ddf1fd0f06 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -11,7 +11,7 @@
   libXxf86vm,
 }:
 let
-  version = "4.15.8";
+  version = "4.15.9-patch1";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-Ytov2n7XieMQtc0C0uvMzpamLHhhTEtkKSfoU88Mlaw=";
+    hash = "sha256-HozoaTAKS/pO/xFLCoXUvrvEEd85oMMxkZ6fFDgSfvQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/vc/vcpkg-tool/package.nix b/pkgs/by-name/vc/vcpkg-tool/package.nix
index d67d50871d11..5dc50afcfce6 100644
--- a/pkgs/by-name/vc/vcpkg-tool/package.nix
+++ b/pkgs/by-name/vc/vcpkg-tool/package.nix
@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2024-07-10";
+  version = "2025-01-29";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-P/ARKMfZdrfO+24rBrRm9k8tkBPSJJBqH509+iarNkw=";
+    hash = "sha256-eCeq7HKjK0aTsPqFP8jP6gIrzcF6YBEJG1MdbQse42Y=";
   };
 
   nativeBuildInputs = [
@@ -178,6 +178,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests = {
     testWrapper = runCommand "vcpkg-tool-test-wrapper" { buildInputs = [ finalAttrs.finalPackage ]; } ''
       export NIX_VCPKG_DEBUG_PRINT_ENVVARS=true
+      export VCPKG_ROOT=.
       vcpkg --x-packages-root="test" --x-install-root="test2" contact > "$out"
 
       cat "$out" | head -n 4 | diff - ${writeText "vcpkg-tool-test-wrapper-expected" ''
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index 14bc32e5cc2c..41116767cbcb 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "vcpkg";
-  version = "2024.12.16";
+  version = "2025.01.13";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg";
     rev = finalAttrs.version;
-    hash = "sha256-4Xk71JPklq7qwYXPE+EzNvD5rTfPvgyV/O7nSvgjKVo=";
+    hash = "sha256-T4ihf3PC53Ch33E/MF5VR3DWKHty4PryInnkiQdHdGM=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/by-name/vi/vinegar/package.nix b/pkgs/by-name/vi/vinegar/package.nix
index b88e26336c06..8a6bb7daf1fc 100644
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@@ -1,81 +1,167 @@
 {
   lib,
   buildGoModule,
-  fetchFromGitHub,
-  fetchurl,
-  pkg-config,
-  xorg,
-  wayland,
-  vulkan-headers,
   wine64Packages,
+  fetchpatch,
+  fetchFromGitHub,
+  glib,
+  makeBinaryWrapper,
+  pkg-config,
+  cairo,
+  gdk-pixbuf,
+  graphene,
+  gtk4,
+  libadwaita,
   libGL,
   libxkbcommon,
-  makeBinaryWrapper,
+  pango,
+  vulkan-headers,
+  vulkan-loader,
+  wayland,
+  winetricks,
+  xorg,
+  symlinkJoin,
   nix-update-script,
 }:
 let
-  wine = (wine64Packages.staging.override { embedInstallers = true; }).overrideAttrs (oldAttrs: {
-    patches = oldAttrs.patches or [ ] ++ [
-      (fetchurl {
-        name = "loader-prefer-winedllpath.patch";
-        url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/3e07606350d803fa386eb4c358836a230819380d/patches/wine/loader-prefer-winedllpath.patch";
-        hash = "sha256-89wnr2rIbyw490hHwckB9g1GKCXm6BERnplfwEUlNOg=";
-      })
-    ];
-  });
+  wine =
+    (wine64Packages.staging.override {
+      dbusSupport = true;
+      embedInstallers = true;
+      pulseaudioSupport = true;
+      x11Support = true;
+      waylandSupport = true;
+    }).overrideAttrs
+      (oldAttrs: {
+        # https://github.com/flathub/org.vinegarhq.Vinegar/blob/a3c2f1249dec9548bd870027f55edcc58343b685/wine.yml#L31-L38
+        # --with-wayland is added by waylandSupport = true;
+        configureFlags = oldAttrs.configureFlags or [ ] ++ [
+          "--disable-tests"
+          "--disable-win16"
+          "--with-dbus"
+          "--with-pulse"
+          "--with-x"
+          "--without-oss"
+        ];
+
+        patches = oldAttrs.patches or [ ] ++ [
+          (fetchpatch {
+            name = "loader-prefer-winedllpath.patch";
+            url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/3e07606350d803fa386eb4c358836a230819380d/patches/wine/loader-prefer-winedllpath.patch";
+            hash = "sha256-89wnr2rIbyw490hHwckB9g1GKCXm6BERnplfwEUlNOg=";
+          })
+        ];
+      });
 in
 buildGoModule rec {
   pname = "vinegar";
-  version = "1.7.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "vinegarhq";
     repo = "vinegar";
-    rev = "v${version}";
-    hash = "sha256-qyBYPBXQgjnGA2LnghPFOd0AO6+sQcZPzPI0rlJvGHE=";
+    tag = "v${version}";
+    hash = "sha256-7rc6LKZx0OOZDedtTpHIQT4grx1FejRiVnJnVDUddy4=";
   };
 
-  vendorHash = "sha256-SDJIoZf/Doa/NrEBRL1WXvz+fyTDGRyG0bvQ0S8A+KA=";
+  vendorHash = "sha256-TZhdwHom4DTgLs4z/eADeoKakMtyFrvVljDg4JJp7dc=";
 
   nativeBuildInputs = [
-    pkg-config
+    glib
     makeBinaryWrapper
+    pkg-config
   ];
 
   buildInputs = [
+    cairo
+    gdk-pixbuf
+    glib.out
+    graphene
+    gtk4
+    libadwaita
+    libGL
+    libxkbcommon
+    pango.out
+    vulkan-headers
+    vulkan-loader
+    wayland
+    wine
+    winetricks
     xorg.libX11
     xorg.libXcursor
     xorg.libXfixes
-    wayland
-    vulkan-headers
-    wine
-    libGL
-    libxkbcommon
   ];
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail 'gtk-update-icon-cache' '${lib.getExe' gtk4 "gtk4-update-icon-cache"}'
+  '';
 
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
+  buildPhase = ''
+    runHook preBuild
+
+    make PREFIX=$out
+
+    runHook postBuild
+  '';
+
+  # Add getGoDirs to checkPhase since it is not being provided by the buildPhase
+  preCheck = ''
+    getGoDirs() {
+      local type;
+      type="$1"
+      if [ -n "$subPackages" ]; then
+        echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+      else
+        find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
+      fi
+    }
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    make PREFIX=$out install
+
+    runHook postInstall
+  '';
 
   postInstall = ''
     wrapProgram $out/bin/vinegar \
-      --prefix PATH : ${lib.makeBinPath [ wine ]}
+      --prefix PATH : ${
+        lib.makeBinPath [
+          wine
+          winetricks
+        ]
+      } \
+      --prefix PUREGOTK_LIB_FOLDER : ${passthru.libraryPath}/lib
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    libraryPath = symlinkJoin {
+      name = "vinegar-puregotk-lib-folder";
+      paths = [
+        cairo
+        gdk-pixbuf
+        glib.out
+        graphene
+        gtk4
+        libadwaita
+        pango.out
+        vulkan-loader
+      ];
+    };
+
+    updateScript = nix-update-script { };
+  };
 
   meta = {
-    description = "Open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
-    homepage = "https://github.com/vinegarhq/vinegar";
     changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+    description = "Open-source, minimal, configurable, fast bootstrapper for running Roblox Studio on Linux";
+    homepage = "https://github.com/vinegarhq/vinegar";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
     mainProgram = "vinegar";
+    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
   };
 }
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index 8bbd6418c4c2..a5a3ae2d3837 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -1,4 +1,8 @@
-{ lib, __splicedPackages, erlang }:
+{
+  lib,
+  __splicedPackages,
+  erlang,
+}:
 
 let
   pkgs = __splicedPackages;
@@ -7,10 +11,13 @@ let
   lib' = pkgs.callPackage ./lib.nix { };
 
   # FIXME: add support for overrideScope
-  callPackageWithScope = scope: drv: args: lib.callPackageWith scope drv args;
+  callPackageWithScope =
+    scope: drv: args:
+    lib.callPackageWith scope drv args;
   mkScope = scope: pkgs // scope;
 
-  packages = self:
+  packages =
+    self:
     let
       defaultScope = mkScope self;
       callPackage = drv: args: callPackageWithScope defaultScope drv args;
@@ -75,7 +82,6 @@ let
 
       ex_doc = callPackage ./ex_doc {
         inherit fetchMixDeps mixRelease;
-        elixir = elixir_1_17;
       };
 
       elixir-ls = callPackage ./elixir-ls { inherit elixir fetchMixDeps mixRelease; };
diff --git a/pkgs/development/beam-modules/ex_doc/default.nix b/pkgs/development/beam-modules/ex_doc/default.nix
index fbc1f8a0da92..736be609e9da 100644
--- a/pkgs/development/beam-modules/ex_doc/default.nix
+++ b/pkgs/development/beam-modules/ex_doc/default.nix
@@ -1,14 +1,14 @@
-{ lib, elixir, fetchFromGitHub, fetchMixDeps, mixRelease }:
+{ lib, elixir, fetchFromGitHub, fetchMixDeps, mixRelease, nix-update-script }:
 # Based on ../elixir-ls/default.nix
 
 let
   pname = "ex_doc";
-  version = "0.34.1";
+  version = "0.37.1";
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-OXIRippEDYAKD222XzNJkkZdXbUkDUauv5amr4oAU7c=";
+    hash = "sha256-PF+4bJ1FGr7t8khorlrB7rSSmNsGpyhC4HmWjw6j0JQ=";
   };
 in
 mixRelease {
@@ -19,7 +19,7 @@ mixRelease {
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version elixir;
-    hash = "sha256-fYINsATbw3M3r+IVoYS14aVEsg9OBuH6mNUqzQJuDQo=";
+    hash = "sha256-s4b6wuBJPdN0FPn76zbLCHzqJNEZ6E4nOyB1whUM2VY=";
   };
 
   configurePhase = ''
@@ -41,6 +41,8 @@ mixRelease {
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "https://github.com/elixir-lang/ex_doc";
     description = ''
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
new file mode 100644
index 000000000000..05fb205543cc
--- /dev/null
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+
+mkDerivation {
+  version = "28.0-rc1";
+  sha256 = "sha256-fjje31F5YW5rzetb2r4fkESwKt9N+WOH3yrqETUjJzg=";
+}
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 38c8278b02a0..d1cc86697f86 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -140,6 +140,13 @@ stdenv.mkDerivation (
       libxml2
     ];
 
+    env = lib.optionalAttrs ((lib.versionAtLeast "28.0-rc1" version) && ex_docSupport) {
+      # erlang-28.0-rc> warning: jinterface.html redirects to ../lib/jinterface/doc/html/index.html, which does not exist
+      # erlang-28.0-rc>
+      # erlang-28.0-rc> warning: odbc.html redirects to ../lib/odbc/doc/html/index.html, which does not exist
+      EX_DOC_WARNINGS_AS_ERRORS = "false";
+    };
+
     buildInputs =
       [
         ncurses
diff --git a/pkgs/development/libraries/itk/5.x.nix b/pkgs/development/libraries/itk/5.x.nix
index 80a9c0123bf2..2398715a6ba3 100644
--- a/pkgs/development/libraries/itk/5.x.nix
+++ b/pkgs/development/libraries/itk/5.x.nix
@@ -1,5 +1,5 @@
 import ./generic.nix rec {
-  version = "5.4.1";
+  version = "5.4.2";
   rev = "refs/tags/v${version}";
-  sourceSha256 = "sha256-XzBmfyv7Bz7CD/RaNgL888R6rUossWLCS8QtbCLPBnY=";
+  sourceSha256 = "sha256-aQAqh0Z01JqKm78cmxkpC/+gbdx6wTJQh34c1lN+DR0=";
 }
diff --git a/pkgs/development/python-modules/crc32c/default.nix b/pkgs/development/python-modules/crc32c/default.nix
index 705a3d0654db..1aa1b5f97f97 100644
--- a/pkgs/development/python-modules/crc32c/default.nix
+++ b/pkgs/development/python-modules/crc32c/default.nix
@@ -8,8 +8,8 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.4";
   pname = "crc32c";
+  version = "2.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -18,16 +18,17 @@ buildPythonPackage rec {
     owner = "ICRAR";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-rWR2MtTLhqqvgdqEyevg/i8ZHM3OU1bJb27JkBx1J3w=";
+    hash = "sha256-WBFiAbdzV719vPdZkRGei2+Y33RroMZ7FeQmWo/OfE0=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
     description = "Python software implementation and hardware API of CRC32C checksum algorithm";
     homepage = "https://github.com/ICRAR/crc32c";
+    changelog = "https://github.com/ICRAR/crc32c/blob/master/CHANGELOG.md";
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/fastjet/default.nix b/pkgs/development/python-modules/fastjet/default.nix
index 6b57b4a8f031..54ebfea342a6 100644
--- a/pkgs/development/python-modules/fastjet/default.nix
+++ b/pkgs/development/python-modules/fastjet/default.nix
@@ -63,7 +63,10 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    awkward
     fastjet
+    numpy
+    vector
   ];
 
   buildInputs = [
@@ -73,9 +76,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    awkward
-    numpy
-    vector
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -86,7 +86,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/scikit-hep/fastjet/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ veprbl ];
-    # ImportError: fastjetcontribfragile.so.0: cannot open shared object file: No such file or directory
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/highdicom/default.nix b/pkgs/development/python-modules/highdicom/default.nix
index 55cd74fc0593..01a24c2427d9 100644
--- a/pkgs/development/python-modules/highdicom/default.nix
+++ b/pkgs/development/python-modules/highdicom/default.nix
@@ -10,7 +10,9 @@
   pydicom,
   pylibjpeg,
   pylibjpeg-libjpeg,
+  pylibjpeg-openjpeg,
   setuptools,
+  typing-extensions,
 }:
 
 let
@@ -23,7 +25,7 @@ let
 in
 buildPythonPackage rec {
   pname = "highdicom";
-  version = "0.23.1";
+  version = "0.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -32,7 +34,7 @@ buildPythonPackage rec {
     owner = "MGHComputationalPathology";
     repo = "highdicom";
     tag = "v${version}";
-    hash = "sha256-LrsG85/bpqIEP++LgvyaVyw4tMsuUTtHNwWl7apuToM=";
+    hash = "sha256-1LRXJkltRLtPJ/NrFZVyjTusXfmcEVOTFEuq0gOI+yQ=";
   };
 
   build-system = [
@@ -44,13 +46,14 @@ buildPythonPackage rec {
     pillow
     pillow-jpls
     pydicom
+    typing-extensions
   ];
 
   optional-dependencies = {
     libjpeg = [
       pylibjpeg
       pylibjpeg-libjpeg
-      #pylibjpeg-openjpeg  # broken on aarch64-linux
+      pylibjpeg-openjpeg
     ];
   };
 
@@ -77,6 +80,7 @@ buildPythonPackage rec {
     "test_rgb_jpegls"
     "test_construction_autotile"
     "test_pixel_types_fractional"
+    "test_pixel_types_labelmap"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/miss-hit-core/default.nix b/pkgs/development/python-modules/miss-hit-core/default.nix
new file mode 100644
index 000000000000..16791600d35b
--- /dev/null
+++ b/pkgs/development/python-modules/miss-hit-core/default.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  pytestCheckHook,
+  coverage,
+  python,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "miss-hit-core";
+  version = "0.9.44";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "florianschanda";
+    repo = "miss_hit";
+    tag = version;
+    hash = "sha256-dJZIleDWmdarhmxoKvQxWvI/Tmx9pSCNlgFXj5NFIUc=";
+  };
+
+  build-system = [ setuptools ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp setup_gpl.py setup.py
+    mkdir -p miss_hit_core/resources/assets
+    cp docs/style.css miss_hit_core/resources
+    cp docs/assets/* miss_hit_core/resources/assets
+
+    runHook postConfigure
+  '';
+
+  nativeCheckInputs = [
+    coverage
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cd tests
+    ${python.interpreter} ./run.py --suite=style
+    ${python.interpreter} ./run.py --suite=metrics
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "miss_hit_core"
+  ];
+
+  meta = {
+    description = "Code formatting and code metrics for programs written in the MATLAB/Simulink and Octave languages";
+    homepage = "https://misshit.org/";
+    changelog = "https://github.com/florianschanda/miss_hit/releases/tag/${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      jacobkoziej
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/miss-hit/default.nix b/pkgs/development/python-modules/miss-hit/default.nix
new file mode 100644
index 000000000000..9bd34bb606e8
--- /dev/null
+++ b/pkgs/development/python-modules/miss-hit/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  pytestCheckHook,
+  coverage,
+  miss-hit-core,
+  python,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "miss-hit";
+  version = "0.9.44";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "florianschanda";
+    repo = "miss_hit";
+    tag = version;
+    hash = "sha256-dJZIleDWmdarhmxoKvQxWvI/Tmx9pSCNlgFXj5NFIUc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    miss-hit-core
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp setup_agpl.py setup.py
+
+    runHook postConfigure
+  '';
+
+  nativeCheckInputs = [
+    coverage
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cd tests
+    ${python.interpreter} ./run.py
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "miss_hit"
+  ];
+
+  meta = {
+    description = "Static analysis and other utilities for programs written in the MATLAB/Simulink and Octave languages";
+    homepage = "https://misshit.org/";
+    changelog = "https://github.com/florianschanda/miss_hit/releases/tag/${version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [
+      jacobkoziej
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
index e6d301908db7..ddd616eb0bfe 100644
--- a/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
+++ b/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
@@ -36,6 +36,8 @@ buildPythonPackage rec {
     rmdir lib/openjpeg
     cp -r ${openjpeg.src} lib/openjpeg
     chmod +rwX -R lib/openjpeg
+
+    substituteInPlace pyproject.toml --replace-fail "poetry-core >=1.8,<2" "poetry-core"
   '';
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/pyquaternion/default.nix b/pkgs/development/python-modules/pyquaternion/default.nix
index fab1e6c4f8cc..f3e1212d9847 100644
--- a/pkgs/development/python-modules/pyquaternion/default.nix
+++ b/pkgs/development/python-modules/pyquaternion/default.nix
@@ -19,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-L0wT9DFUDRcmmN7OpmIDNvtQWQrM7iFnZt6R2xrJ+3A=";
   };
 
+  patches = [
+    ./numpy2-repr.patch
+  ];
+
   # The VERSION.txt file is required for setup.py
   # See: https://github.com/KieranWynn/pyquaternion/blob/master/setup.py#L14-L15
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyquaternion/numpy2-repr.patch b/pkgs/development/python-modules/pyquaternion/numpy2-repr.patch
new file mode 100644
index 000000000000..a420002a2303
--- /dev/null
+++ b/pkgs/development/python-modules/pyquaternion/numpy2-repr.patch
@@ -0,0 +1,68 @@
+diff --git a/pyquaternion/test/test_quaternion.py b/pyquaternion/test/test_quaternion.py
+index f56afff..7178b52 100644
+--- a/pyquaternion/test/test_quaternion.py
++++ b/pyquaternion/test/test_quaternion.py
+@@ -50,6 +50,16 @@ ALMOST_EQUAL_TOLERANCE = 13
+ def randomElements():
+     return tuple(np.random.uniform(-1, 1, 4))
+
++# In numpy 2, repr(np.float64(0.123)) becomes "np.float64(0.123)"
++# which means it's not directly a parseable float. In numpy 1 that
++# used to be the case. This hack papers over that
++def repr_np(x):
++    has_item = hasattr(x, 'item')
++    if isinstance(x, np.generic) and has_item:
++        return repr(x.item())
++    else:
++        return repr(x)
++
+ class TestQuaternionInitialisation(unittest.TestCase):
+
+     def test_init_default(self):
+@@ -77,7 +87,7 @@ class TestQuaternionInitialisation(unittest.TestCase):
+     def test_init_from_scalar(self):
+         s = random()
+         q1 = Quaternion(s)
+-        q2 = Quaternion(repr(s))
++        q2 = Quaternion(repr_np(s))
+         self.assertIsInstance(q1, Quaternion)
+         self.assertIsInstance(q2, Quaternion)
+         self.assertEqual(q1, Quaternion(s, 0.0, 0.0, 0.0))
+@@ -90,8 +100,8 @@ class TestQuaternionInitialisation(unittest.TestCase):
+     def test_init_from_elements(self):
+         a, b, c, d = randomElements()
+         q1 = Quaternion(a, b, c, d)
+-        q2 = Quaternion(repr(a), repr(b), repr(c), repr(d))
+-        q3 = Quaternion(a, repr(b), c, d)
++        q2 = Quaternion(repr_np(a), repr_np(b), repr_np(c), repr_np(d))
++        q3 = Quaternion(a, repr_np(b), c, d)
+         self.assertIsInstance(q1, Quaternion)
+         self.assertIsInstance(q2, Quaternion)
+         self.assertIsInstance(q3, Quaternion)
+@@ -154,7 +164,7 @@ class TestQuaternionInitialisation(unittest.TestCase):
+     def test_init_from_explicit_elements(self):
+         e1, e2, e3, e4 = randomElements()
+         q1 = Quaternion(w=e1, x=e2, y=e3, z=e4)
+-        q2 = Quaternion(a=e1, b=repr(e2), c=e3, d=e4)
++        q2 = Quaternion(a=e1, b=repr_np(e2), c=e3, d=e4)
+         q3 = Quaternion(a=e1, i=e2, j=e3, k=e4)
+         q4 = Quaternion(a=e1)
+         self.assertIsInstance(q1, Quaternion)
+@@ -525,7 +535,7 @@ class TestQuaternionArithmetic(unittest.TestCase):
+             q3 = q1
+             self.assertEqual(q1 * s, q2) # post-multiply by scalar
+             self.assertEqual(s * q1, q2) # pre-multiply by scalar
+-            q3 *= repr(s)
++            q3 *= repr_np(s)
+             self.assertEqual(q3, q2)
+
+     def test_multiply_incorrect_type(self):
+@@ -595,7 +605,7 @@ class TestQuaternionArithmetic(unittest.TestCase):
+                 with self.assertRaises(ZeroDivisionError):
+                     s / q1
+
+-            q3 /= repr(s)
++            q3 /= repr_np(s)
+             self.assertEqual(q3, q2)
+
+         with self.assertRaises(ZeroDivisionError):
diff --git a/pkgs/development/python-modules/python-nomad/default.nix b/pkgs/development/python-modules/python-nomad/default.nix
index e504c4c2896d..ec1fa7f51f21 100644
--- a/pkgs/development/python-modules/python-nomad/default.nix
+++ b/pkgs/development/python-modules/python-nomad/default.nix
@@ -1,10 +1,11 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   requests,
   pythonOlder,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -14,10 +15,11 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "python_nomad";
-    inherit version;
-    hash = "sha256-U+bZ7G9mtnKunW0DWRokvi2LVFDdf9vhADgxy5t3+Ec=";
+  src = fetchFromGitHub {
+    owner = "jrxfive";
+    repo = "python-nomad";
+    tag = version;
+    hash = "sha256-tLS463sYVlOr2iZSgSkd4pHUVCtiIPJ3L8+9omlX4NY=";
   };
 
   build-system = [ setuptools ];
@@ -29,11 +31,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "nomad" ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Python client library for Hashicorp Nomad";
     homepage = "https://github.com/jrxFive/python-nomad";
     changelog = "https://github.com/jrxFive/python-nomad/blob/${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ xbreak ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xbreak ];
   };
 }
diff --git a/pkgs/development/python-modules/warcio/default.nix b/pkgs/development/python-modules/warcio/default.nix
index 91ddc5ed3d3b..cb9536e18d41 100644
--- a/pkgs/development/python-modules/warcio/default.nix
+++ b/pkgs/development/python-modules/warcio/default.nix
@@ -11,6 +11,7 @@
   setuptools,
   six,
   wsgiprox,
+  pytest-cov-stub,
 }:
 
 buildPythonPackage rec {
@@ -47,13 +48,12 @@ buildPythonPackage rec {
     pytestCheckHook
     requests
     wsgiprox
+    pytest-cov-stub
   ];
 
-  pytestFlagsArray = [ "--offline" ];
-
-  disabledTests = [
-    # Tests require network access, see above
-    "test_get_cache_to_file"
+  pytestFlagsArray = [
+    "--offline"
+    "--ignore=test/test_capture_http_proxy.py"
   ];
 
   pythonImportsCheck = [ "warcio" ];
diff --git a/pkgs/development/python2-modules/pygtk/default.nix b/pkgs/development/python2-modules/pygtk/default.nix
index 9ba5ce952e17..066a00884ef0 100644
--- a/pkgs/development/python2-modules/pygtk/default.nix
+++ b/pkgs/development/python2-modules/pygtk/default.nix
@@ -58,7 +58,8 @@ buildPythonPackage rec {
 
   env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.hostPlatform.isDarwin "-ObjC"
-    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) " -lpython2.7";
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) " -lpython2.7"
+    + " -fpermissive"; # downgrade code errors to warnings
 
   installPhase = "installPhase";
 
@@ -94,5 +95,6 @@ buildPythonPackage rec {
     homepage = "https://gitlab.gnome.org/Archive/pygtk";
     platforms = platforms.all;
     license = with licenses; [ lgpl21Plus ];
+    maintainers = with lib.maintainers; [ bryango ];
   };
 }
diff --git a/pkgs/development/tools/database/dynein/default.nix b/pkgs/development/tools/database/dynein/default.nix
index 7497a7db3803..75fcbb6ffe83 100644
--- a/pkgs/development/tools/database/dynein/default.nix
+++ b/pkgs/development/tools/database/dynein/default.nix
@@ -1,6 +1,7 @@
 {
   fetchFromGitHub,
   lib,
+  cmake,
   openssl,
   pkg-config,
   rustPlatform,
@@ -8,28 +9,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dynein";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "dynein";
     rev = "v${version}";
-    hash = "sha256-QhasTFGOFOjzNKdQtA+eBhKy51O4dFt6vpeIAIOM2rQ=";
+    hash = "sha256-GU/zZ7IJPfpRbrWjrVwPDSFjFfMLoG/c8DDWlN6nZ94=";
   };
 
   # Use system openssl.
   OPENSSL_NO_VENDOR = 1;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rOfJz5G6kO1/IM6M6dZJTJmzJhx/450dIPvAVBHUp5o=";
+  cargoHash = "sha256-PA7Hvn+vYBD80thkIamwOhw4lJWAmU/TQBnwJro4r7c=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     openssl
+    cmake
   ];
 
   preBuild = ''
+    export CMAKE=${lib.getDev cmake}/bin/cmake
     export OPENSSL_DIR=${lib.getDev openssl}
     export OPENSSL_LIB_DIR=${lib.getLib openssl}/lib
   '';
diff --git a/pkgs/games/doom-ports/doomrunner/default.nix b/pkgs/games/doom-ports/doomrunner/default.nix
deleted file mode 100644
index c61055e190ab..000000000000
--- a/pkgs/games/doom-ports/doomrunner/default.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  lib,
-  stdenv,
-  qtbase,
-  qmake,
-  makeDesktopItem,
-  wrapQtAppsHook,
-  imagemagick,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "doomrunner";
-  version = "1.8.3";
-
-  src = fetchFromGitHub {
-    owner = "Youda008";
-    repo = "DoomRunner";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-NpNhl3cGXpxI8Qu4l8PjojCCXCZdGBEkBzz5XxLm/mY=";
-  };
-
-  buildInputs = [ qtbase ];
-  nativeBuildInputs = [
-    qmake
-    wrapQtAppsHook
-    imagemagick
-  ];
-
-  makeFlags = [
-    "INSTALL_ROOT=${placeholder "out"}"
-  ];
-
-  postInstall = ''
-    mkdir -p $out/{bin,share/applications}
-    install -Dm755 $out/usr/bin/DoomRunner $out/bin/DoomRunner
-
-    for size in 16 24 32 48 64 128; do
-      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-      convert -background none -resize "$size"x"$size" $PWD/Resources/DoomRunner.ico -flatten $out/share/icons/hicolor/"$size"x"$size"/apps/DoomRunner.png
-    done;
-
-    install -m 444 -D "$desktopItem/share/applications/"* -t $out/share/applications/
-    rm -rf $out/usr
-  '';
-
-  desktopItem = makeDesktopItem {
-    name = "DoomRunner";
-    desktopName = "DoomRunner";
-    comment = "Preset-oriented graphical launcher of ZDoom and derivatives";
-    categories = [ "Game" ];
-    icon = "DoomRunner";
-    type = "Application";
-    exec = "DoomRunner";
-  };
-
-  meta = with lib; {
-    description = "Graphical launcher of ZDoom and derivatives";
-    mainProgram = "DoomRunner";
-    homepage = "https://github.com/Youda008/DoomRunner/";
-    changelog = "https://github.com/Youda008/DoomRunner/blob/${finalAttrs.src.rev}/changelog.txt";
-    license = licenses.gpl3Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ keenanweaver ];
-  };
-})
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/games/vcmi/default.nix
index bb5db2ae9644..a1fc7168f0fd 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-1GNoHNPeSeVGfK9mgXiuaMVxwnAM0n26V56pk5IHEs4=";
+    hash = "sha256-VUwCo9OTTI8tsX7P1voq/1VVGrNxYM+OXkWhXWqoT60=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 2d9450274703..ea59cf1e3f1a 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -197,12 +197,12 @@ in rec {
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "3.0.0";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
       rev = "v${version}";
-      hash = "sha256-VY4PyaQRwTc6LWhPJg4inrQf5K8+bp0+eqRhR7+Iexk=";
+      hash = "sha256-WNgCa8F618JQiHDM1YxHj7oR7w+7U6SU89K90RYIUh8=";
     };
     meta = with lib; {
       homepage = "https://draculatheme.com/tmux";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4bf48665ce16..d77d35be8faa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -355,7 +355,7 @@ with pkgs;
   };
 
   vcpkg-tool = callPackage ../by-name/vc/vcpkg-tool/package.nix {
-    fmt = fmt_10;
+    fmt = fmt_11;
   };
 
   r3ctl = qt5.callPackage ../tools/misc/r3ctl { };
@@ -1081,8 +1081,6 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  tailwindcss = callPackage ../development/tools/tailwindcss { };
-
   ufolint = with python3Packages; toPythonApplication ufolint;
 
   valeronoi = qt6Packages.callPackage ../tools/misc/valeronoi { };
@@ -6950,7 +6948,7 @@ with pkgs;
   };
 
   inherit (beam.interpreters)
-    erlang erlang_27 erlang_26 erlang_25
+    erlang erlang_28 erlang_27 erlang_26 erlang_25
     elixir elixir_1_18 elixir_1_17 elixir_1_16 elixir_1_15 elixir_1_14
     elixir-ls;
 
@@ -6968,10 +6966,14 @@ with pkgs;
   beam25Packages = recurseIntoAttrs beam.packages.erlang_25;
   beam26Packages = recurseIntoAttrs beam.packages.erlang_26;
   beam27Packages = recurseIntoAttrs beam.packages.erlang_27;
+  # 28 is pre-release
+  beam28Packages = dontRecurseIntoAttrs beam.packages.erlang_28;
 
   beamMinimal25Packages = recurseIntoAttrs beam_minimal.packages.erlang_25;
   beamMinimal26Packages = recurseIntoAttrs beam_minimal.packages.erlang_26;
   beamMinimal27Packages = recurseIntoAttrs beam_minimal.packages.erlang_27;
+  # 28 is pre-release
+  beamMinimal28Packages = dontRecurseIntoAttrs beam_minimal.packages.erlang_28;
 
   erlang_language_platform = callPackage ../by-name/er/erlang-language-platform/package.nix { };
 
@@ -16005,8 +16007,6 @@ with pkgs;
 
   doomseeker = qt5.callPackage ../games/doom-ports/doomseeker { };
 
-  doomrunner = qt5.callPackage ../games/doom-ports/doomrunner { };
-
   enyo-launcher = libsForQt5.callPackage ../games/doom-ports/enyo-launcher { };
 
   slade = callPackage ../games/doom-ports/slade {
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index 1c039da6b96f..3e2fdd18d0ae 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -31,6 +31,14 @@ in
     #
     # Three versions are supported according to https://github.com/erlang/otp/security
 
+    erlang_28 = self.beamLib.callErlang ../development/interpreters/erlang/28.nix {
+      wxGTK = wxGTK32;
+      parallelBuild = true;
+      # ex_doc failing to build with erlang 28
+      inherit (beam_nodocs.packages.erlang_27) ex_doc;
+      inherit ex_docSupport wxSupport systemdSupport;
+    };
+
     erlang_27 = self.beamLib.callErlang ../development/interpreters/erlang/27.nix {
       wxGTK = wxGTK32;
       parallelBuild = true;
@@ -76,6 +84,7 @@ in
   # appropriate Erlang/OTP version.
   packages = {
     erlang = self.packages.${self.latestVersion};
+    erlang_28 = self.packagesWith self.interpreters.erlang_28;
     erlang_27 = self.packagesWith self.interpreters.erlang_27;
     erlang_26 = self.packagesWith self.interpreters.erlang_26;
     erlang_25 = self.packagesWith self.interpreters.erlang_25;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e243b4b62fbf..ebb0f241785b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8323,6 +8323,10 @@ self: super: with self; {
 
   misoc = callPackage ../development/python-modules/misoc { };
 
+  miss-hit = callPackage ../development/python-modules/miss-hit { };
+
+  miss-hit-core = callPackage ../development/python-modules/miss-hit-core { };
+
   mistletoe = callPackage ../development/python-modules/mistletoe { };
 
   mistral-common = callPackage ../development/python-modules/mistral-common { };