diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b14f78609e47..61a95b7f88f6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6644,6 +6644,14 @@
     github = "ErinvanderVeen";
     githubId = 10973664;
   };
+  erooke = {
+    email = "ethan@roo.ke";
+    name = "Ethan Rooke";
+    keys = [ { fingerprint = "B66B EB9F 6111 E44B 7588  8240 B287 4A77 049A 5923"; } ];
+    github = "erooke";
+    githubId = 46689793;
+    matrix = "@ethan:roo.ke";
+  };
   erosennin = {
     email = "ag@sologoc.com";
     github = "erosennin";
@@ -11279,6 +11287,13 @@
     github = "keenanweaver";
     githubId = 37268985;
   };
+  keksgesicht = {
+    name = "Jan Braun";
+    email = "git@keksgesicht.de";
+    github = "Keksgesicht";
+    githubId = 32649612;
+    keys = [ { fingerprint = "65DF D21C 22A9 E4CD FD1A  0804 C3D7 16E7 29B3 C86A"; } ];
+  };
   keldu = {
     email = "mail@keldu.de";
     github = "keldu";
@@ -23120,6 +23135,12 @@
     githubId = 7677567;
     name = "Victor SENE";
   };
+  vtimofeenko = {
+    email = "nixpkgs.maintain@vtimofeenko.com";
+    github = "VTimofeenko";
+    githubId = 9886026;
+    name = "Vladimir Timofeenko";
+  };
   vtuan10 = {
     email = "mail@tuan-vo.de";
     github = "vtuan10";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index e0a42ff87bab..85c880997692 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -727,6 +727,8 @@
 
 - `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
 
+- `virtualisation.docker.liveRestore` has been renamed to `virtualisation.docker.daemon.settings."live-restore"` and turned off by default for state versions of at least 24.11.
+
 - Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
   See [Registering new nodes using OAuth credentials](https://tailscale.com/kb/1215/oauth-clients#registering-new-nodes-using-oauth-credentials) for the supported options.
 
diff --git a/nixos/modules/hardware/tuxedo-drivers.nix b/nixos/modules/hardware/tuxedo-drivers.nix
new file mode 100644
index 000000000000..aa951782dbc0
--- /dev/null
+++ b/nixos/modules/hardware/tuxedo-drivers.nix
@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.hardware.tuxedo-drivers;
+  tuxedo-drivers = config.boot.kernelPackages.tuxedo-drivers;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [
+        "hardware"
+        "tuxedo-keyboard"
+      ]
+      [
+        "hardware"
+        "tuxedo-drivers"
+      ]
+    )
+  ];
+
+  options.hardware.tuxedo-drivers = {
+    enable = lib.mkEnableOption ''
+      The tuxedo-drivers driver enables access to the following on TUXEDO notebooks:
+      - Driver for Fn-keys
+      - SysFS control of brightness/color/mode for most TUXEDO keyboards
+      - Hardware I/O driver for TUXEDO Control Center
+
+      For more inforation it is best to check at the source code description: <https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers>
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelModules = [ "tuxedo_keyboard" ];
+    boot.extraModulePackages = [ tuxedo-drivers ];
+  };
+}
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
deleted file mode 100644
index 01ec486fb88f..000000000000
--- a/nixos/modules/hardware/tuxedo-keyboard.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.hardware.tuxedo-keyboard;
-  tuxedo-keyboard = config.boot.kernelPackages.tuxedo-keyboard;
-in
-  {
-    options.hardware.tuxedo-keyboard = {
-      enable = lib.mkEnableOption ''
-          the tuxedo-keyboard driver.
-
-          To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
-          There are several parameters you can change. It's best to check at the source code description which options are supported.
-          You can find all the supported parameters at: <https://github.com/tuxedocomputers/tuxedo-keyboard#kernelparam>
-
-          In order to use the `custom` lighting with the maximumg brightness and a color of `0xff0a0a` one would put pass {option}`boot.kernelParams` like this:
-
-          ```
-          boot.kernelParams = [
-           "tuxedo_keyboard.mode=0"
-           "tuxedo_keyboard.brightness=255"
-           "tuxedo_keyboard.color_left=0xff0a0a"
-          ];
-          ```
-      '';
-    };
-
-    config = lib.mkIf cfg.enable
-    {
-      boot.kernelModules = ["tuxedo_keyboard"];
-      boot.extraModulePackages = [ tuxedo-keyboard ];
-    };
-  }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 7b753937e808..5fb66a03f9f0 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -98,7 +98,7 @@
   ./hardware/sensor/iio.nix
   ./hardware/steam-hardware.nix
   ./hardware/system-76.nix
-  ./hardware/tuxedo-keyboard.nix
+  ./hardware/tuxedo-drivers.nix
   ./hardware/ubertooth.nix
   ./hardware/uinput.nix
   ./hardware/uni-sync.nix
diff --git a/nixos/modules/services/databases/victoriametrics.nix b/nixos/modules/services/databases/victoriametrics.nix
index 923163a8049e..b26ad47c9a13 100644
--- a/nixos/modules/services/databases/victoriametrics.nix
+++ b/nixos/modules/services/databases/victoriametrics.nix
@@ -1,65 +1,188 @@
-{ config, pkgs, lib, ... }:
-let cfg = config.services.victoriametrics; in
 {
-  options.services.victoriametrics = with lib; {
-    enable = mkEnableOption "VictoriaMetrics, a time series database, long-term remote storage for Prometheus";
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.services.victoriametrics;
+  settingsFormat = pkgs.formats.yaml { };
+
+  startCLIList =
+    [
+      "${cfg.package}/bin/victoria-metrics"
+      "-storageDataPath=/var/lib/${cfg.stateDir}"
+      "-httpListenAddr=${cfg.listenAddress}"
+
+    ]
+    ++ lib.optionals (cfg.retentionPeriod != null) [ "-retentionPeriod=${cfg.retentionPeriod}" ]
+    ++ cfg.extraOptions;
+  prometheusConfigYml = checkedConfig (
+    settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig
+  );
+
+  checkedConfig =
+    file:
+    pkgs.runCommand "checked-config" { nativeBuildInputs = [ cfg.package ]; } ''
+      ln -s ${file} $out
+      ${lib.escapeShellArgs startCLIList} -promscrape.config=${file} -dryRun
+    '';
+in
+{
+  options.services.victoriametrics = {
+    enable = mkEnableOption "VictoriaMetrics is a fast, cost-effective and scalable monitoring solution and time series database.";
     package = mkPackageOption pkgs "victoriametrics" { };
+
     listenAddress = mkOption {
       default = ":8428";
       type = types.str;
       description = ''
-        The listen address for the http interface.
+        TCP address to listen for incoming http requests.
       '';
     };
-    retentionPeriod = mkOption {
-      type = types.int;
-      default = 1;
+
+    stateDir = mkOption {
+      type = types.str;
+      default = "victoriametrics";
       description = ''
-        Retention period in months.
+        Directory below `/var/lib` to store VictoriaMetrics metrics data.
+        This directory will be created automatically using systemd's StateDirectory mechanism.
       '';
     };
+
+    retentionPeriod = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "15d";
+      description = ''
+        How long to retain samples in storage.
+        The minimum retentionPeriod is 24h or 1d. See also -retentionFilter
+        The following optional suffixes are supported: s (second), h (hour), d (day), w (week), y (year).
+        If suffix isn't set, then the duration is counted in months (default 1)
+      '';
+    };
+
+    prometheusConfig = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      example = literalExpression ''
+        {
+          scrape_configs = [
+            {
+              job_name = "postgres-exporter";
+              metrics_path = "/metrics";
+              static_configs = [
+                {
+                  targets = ["1.2.3.4:9187"];
+                  labels.type = "database";
+                }
+              ];
+            }
+            {
+              job_name = "node-exporter";
+              metrics_path = "/metrics";
+              static_configs = [
+                {
+                  targets = ["1.2.3.4:9100"];
+                  labels.type = "node";
+                }
+                {
+                  targets = ["5.6.7.8:9100"];
+                  labels.type = "node";
+                }
+              ];
+            }
+          ];
+        }
+      '';
+      description = ''
+        Config for prometheus style metrics.
+        See the docs: <https://docs.victoriametrics.com/vmagent/#how-to-collect-metrics-in-prometheus-format>
+        for more information.
+      '';
+    };
+
     extraOptions = mkOption {
       type = types.listOf types.str;
-      default = [];
+      default = [ ];
+      example = literalExpression ''
+        [
+          "-httpAuth.username=username"
+          "-httpAuth.password=file:///abs/path/to/file"
+          "-loggerLevel=WARN"
+        ]
+      '';
       description = ''
-        Extra options to pass to VictoriaMetrics. See the README:
-        <https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/README.md>
-        or {command}`victoriametrics -help` for more
-        information.
+        Extra options to pass to VictoriaMetrics. See the docs:
+        <https://docs.victoriametrics.com/single-server-victoriametrics/#list-of-command-line-flags>
+        or {command}`victoriametrics -help` for more information.
       '';
     };
   };
+
   config = lib.mkIf cfg.enable {
     systemd.services.victoriametrics = {
       description = "VictoriaMetrics time series database";
+      wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       startLimitBurst = 5;
+
       serviceConfig = {
-        Restart = "on-failure";
-        RestartSec = 1;
-        StateDirectory = "victoriametrics";
+        ExecStart = lib.escapeShellArgs (
+          startCLIList
+          ++ lib.optionals (cfg.prometheusConfig != null) [ "-promscrape.config=${prometheusConfigYml}" ]
+        );
+
         DynamicUser = true;
-        ExecStart = ''
-          ${cfg.package}/bin/victoria-metrics \
-              -storageDataPath=/var/lib/victoriametrics \
-              -httpListenAddr ${cfg.listenAddress} \
-              -retentionPeriod ${toString cfg.retentionPeriod} \
-              ${lib.escapeShellArgs cfg.extraOptions}
-        '';
-        # victoriametrics 1.59 with ~7GB of data seems to eventually panic when merging files and then
-        # begins restart-looping forever. Set LimitNOFILE= to a large number to work around this issue.
-        #
-        # panic: FATAL: unrecoverable error when merging small parts in the partition "/var/lib/victoriametrics/data/small/2021_08":
-        # cannot open source part for merging: cannot open values file in stream mode:
-        # cannot open file "/var/lib/victoriametrics/data/small/2021_08/[...]/values.bin":
-        # open /var/lib/victoriametrics/data/small/2021_08/[...]/values.bin: too many open files
+        RestartSec = 1;
+        Restart = "on-failure";
+        RuntimeDirectory = "victoriametrics";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
+
+        # Increase the limit to avoid errors like 'too many open files'  when merging small parts
         LimitNOFILE = 1048576;
+
+        # Hardening
+        DeviceAllow = [ "/dev/null rw" ];
+        DevicePolicy = "strict";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
       };
-      wantedBy = [ "multi-user.target" ];
 
       postStart =
         let
-          bindAddr = (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
+          bindAddr =
+            (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
         in
         lib.mkBefore ''
           until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 532c64c0f424..9431a09b9936 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -332,7 +332,7 @@ in {
       {
         # JACK intentionally not checked, as PW-on-JACK setups are a thing that some people may want
         assertion = (cfg.alsa.enable || cfg.pulse.enable) -> cfg.audio.enable;
-        message = "Using PipeWire's ALSA/PulseAudio compatibility layers requires running PipeWire as the sound server. Set `services.pipewire.audio.enable` to true.";
+        message = "Using PipeWire's ALSA/PulseAudio compatibility layers requires running PipeWire as the sound server. Either set `services.pipewire.audio.enable` to true to enable audio support, or set both `services.pipewire.pulse.enable` and `services.pipewire.alsa.enable` to false to use pipewire exclusively for the compositor.";
       }
       {
         assertion = length
diff --git a/nixos/modules/services/hardware/tuxedo-rs.nix b/nixos/modules/services/hardware/tuxedo-rs.nix
index cfdc1c64d118..4ba7825ae8a5 100644
--- a/nixos/modules/services/hardware/tuxedo-rs.nix
+++ b/nixos/modules/services/hardware/tuxedo-rs.nix
@@ -14,7 +14,7 @@ in
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
     {
-      hardware.tuxedo-keyboard.enable = true;
+      hardware.tuxedo-drivers.enable = true;
 
       systemd = {
         services.tailord = {
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 6173fca20dbb..9260bc22b13e 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -198,7 +198,7 @@ in
 
     package = mkPackageOption pkgs "systemd" {};
 
-    enableStrictShellChecks = mkEnableOption "running shellcheck on the generated scripts for systemd units.";
+    enableStrictShellChecks = mkEnableOption "" // { description = "Whether to run shellcheck on the generated scripts for systemd units."; };
 
     units = mkOption {
       description = "Definition of systemd units; see {manpage}`systemd.unit(5)`.";
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 594b9aab61b7..e8eeae03a360 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -231,13 +231,13 @@ in
       if [[ ! $IN_NIXOS_SYSTEMD_STAGE1 ]] && [[ "${config.system.build.etc}/etc" != "$(readlink -f /run/current-system/etc)" ]]; then
         echo "remounting /etc..."
 
-        tmpMetadataMount=$(mktemp --directory)
+        tmpMetadataMount=$(mktemp --directory -t nixos-etc-metadata.XXXXXXXXXX)
         mount --type erofs ${config.system.build.etcMetadataImage} $tmpMetadataMount
 
         # Mount the new /etc overlay to a temporary private mount.
         # This needs the indirection via a private bind mount because you
         # cannot move shared mounts.
-        tmpEtcMount=$(mktemp --directory)
+        tmpEtcMount=$(mktemp --directory -t nixos-etc.XXXXXXXXXX)
         mount --bind --make-private $tmpEtcMount $tmpEtcMount
         mount --type overlay overlay \
           --options lowerdir=$tmpMetadataMount::${config.system.build.etcBasedir},${etcOverlayOptions} \
@@ -276,6 +276,22 @@ in
 
         # Unmount the top /etc mount to atomically reveal the new mount.
         umount --lazy --recursive /etc
+
+        # Unmount the temporary mount
+        umount --lazy "$tmpEtcMount"
+        rmdir "$tmpEtcMount"
+
+        # Unmount old metadata mounts
+        # For some reason, `findmnt /tmp --submounts` does not show the nested
+        # mounts. So we'll just find all mounts of type erofs and filter on the
+        # name of the mountpoint.
+        findmnt --type erofs --list --kernel --output TARGET | while read -r mountPoint; do
+          if [[ "$mountPoint" =~ ^/tmp/nixos-etc-metadata\..{10}$ &&
+                "$mountPoint" != "$tmpMetadataMount" ]]; then
+            umount --lazy $mountPoint
+            rmdir "$mountPoint"
+          fi
+        done
       fi
     '' else ''
       # Set up the statically computed bits of /etc.
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 4f38bc0b94d6..741828c7468a 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -52,10 +52,26 @@ in
 
     daemon.settings =
       mkOption {
-        type = settingsFormat.type;
+        type = types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            live-restore = mkOption {
+              type = types.bool;
+              # Prior to NixOS 24.11, this was set to true by default, while upstream defaulted to false.
+              # Keep the option unset to follow upstream defaults
+              default = versionOlder config.system.stateVersion "24.11";
+              defaultText = literalExpression "lib.versionOlder config.system.stateVersion \"24.11\"";
+              description = ''
+                Allow dockerd to be restarted without affecting running container.
+                This option is incompatible with docker swarm.
+              '';
+            };
+          };
+        };
         default = { };
         example = {
           ipv6 = true;
+          "live-restore" = true;
           "fixed-cidr-v6" = "fd00::/80";
         };
         description = ''
@@ -75,16 +91,6 @@ in
         '';
       };
 
-    liveRestore =
-      mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-            Allow dockerd to be restarted without affecting running container.
-            This option is incompatible with docker swarm.
-          '';
-      };
-
     storageDriver =
       mkOption {
         type = types.nullOr (types.enum ["aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs"]);
@@ -167,6 +173,11 @@ in
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active")
+    (mkAliasOptionModule ["virtualisation" "docker" "liveRestore"] ["virtualisation" "docker" "daemon" "settings" "live-restore"])
+  ];
+
   ###### implementation
 
   config = mkIf cfg.enable (mkMerge [{
@@ -253,7 +264,6 @@ in
         hosts = [ "fd://" ];
         log-driver = mkDefault cfg.logDriver;
         storage-driver = mkIf (cfg.storageDriver != null) (mkDefault cfg.storageDriver);
-        live-restore = mkDefault cfg.liveRestore;
         runtimes = mkIf cfg.enableNvidia {
           nvidia = {
             # Use the legacy nvidia-container-runtime wrapper to allow
@@ -266,9 +276,4 @@ in
       };
     }
   ]);
-
-  imports = [
-    (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active")
-  ];
-
 }
diff --git a/nixos/tests/activation/etc-overlay-immutable.nix b/nixos/tests/activation/etc-overlay-immutable.nix
index 601ac77cbd84..882bc651841a 100644
--- a/nixos/tests/activation/etc-overlay-immutable.nix
+++ b/nixos/tests/activation/etc-overlay-immutable.nix
@@ -27,9 +27,14 @@
     specialisation.new-generation.configuration = {
       environment.etc."newgen".text = "newgen";
     };
+    specialisation.newer-generation.configuration = {
+      environment.etc."newergen".text = "newergen";
+    };
   };
 
-  testScript = ''
+  testScript = /* python */ ''
+    newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
     with subtest("/run/etc-metadata/ is mounted"):
       print(machine.succeed("mountpoint /run/etc-metadata"))
 
@@ -79,5 +84,13 @@
       print(machine.succeed("ls /etc/mountpoint"))
       print(machine.succeed("stat /etc/mountpoint/extra-file"))
       print(machine.succeed("findmnt /etc/filemount"))
+
+      machine.succeed(f"{newergen} switch")
+
+      tmpMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc\\..*' | wc -l").rstrip()
+      metaMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc-metadata\\..*' | wc -l").rstrip()
+
+      assert tmpMounts == "0", f"Found {tmpMounts} remaining tmpmounts"
+      assert metaMounts == "1", f"Found {metaMounts} remaining metamounts"
   '';
 }
diff --git a/nixos/tests/activation/etc-overlay-mutable.nix b/nixos/tests/activation/etc-overlay-mutable.nix
index fe6165212470..ef465e3616c3 100644
--- a/nixos/tests/activation/etc-overlay-mutable.nix
+++ b/nixos/tests/activation/etc-overlay-mutable.nix
@@ -15,9 +15,14 @@
     specialisation.new-generation.configuration = {
       environment.etc."newgen".text = "newgen";
     };
+    specialisation.newer-generation.configuration = {
+      environment.etc."newergen".text = "newergen";
+    };
   };
 
-  testScript = ''
+  testScript = /* python */ ''
+    newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
     with subtest("/run/etc-metadata/ is mounted"):
       print(machine.succeed("mountpoint /run/etc-metadata"))
 
@@ -55,5 +60,14 @@
       print(machine.succeed("findmnt /etc/mountpoint"))
       print(machine.succeed("stat /etc/mountpoint/extra-file"))
       print(machine.succeed("findmnt /etc/filemount"))
+
+      machine.succeed(f"{newergen} switch")
+      assert machine.succeed("cat /etc/newergen") == "newergen"
+
+      tmpMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc\\..*' | wc -l").rstrip()
+      metaMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc-metadata\\..*' | wc -l").rstrip()
+
+      assert tmpMounts == "0", f"Found {tmpMounts} remaining tmpmounts"
+      assert metaMounts == "1", f"Found {metaMounts} remaining metamounts"
   '';
 }
diff --git a/nixos/tests/victoriametrics.nix b/nixos/tests/victoriametrics.nix
index 5e364b67bf87..e45d0a30f3a6 100644
--- a/nixos/tests/victoriametrics.nix
+++ b/nixos/tests/victoriametrics.nix
@@ -1,33 +1,41 @@
-# This test runs influxdb and checks if influxdb is up and running
+# This test runs victoriametrics and checks if victoriametrics is able to write points and run simple query
 
-import ./make-test-python.nix ({ pkgs, ...} : {
-  name = "victoriametrics";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ yorickvp ];
-  };
-
-  nodes = {
-    one = { ... }: {
-      services.victoriametrics.enable = true;
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  {
+    name = "victoriametrics";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [
+        yorickvp
+        ryan4yin
+      ];
     };
-  };
 
-  testScript = ''
-    start_all()
+    nodes = {
+      one =
+        { ... }:
+        {
+          services.victoriametrics.enable = true;
+        };
+    };
 
-    one.wait_for_unit("victoriametrics.service")
+    testScript = ''
+      start_all()
 
-    # write some points and run simple query
-    out = one.succeed(
-        "curl -f -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
-    )
-    cmd = (
-        """curl -f -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
-    )
-    # data takes a while to appear
-    one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
-    out = one.succeed(cmd)
-    assert '"values":[123]' in out
-    assert '"values":[1.23]' in out
-  '';
-})
+      one.wait_for_unit("victoriametrics.service")
+
+      # write some points and run simple query
+      out = one.succeed(
+          "curl -f -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
+      )
+      cmd = (
+          """curl -f -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
+      )
+      # data takes a while to appear
+      one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
+      out = one.succeed(cmd)
+      assert '"values":[123]' in out
+      assert '"values":[1.23]' in out
+    '';
+  }
+)
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 7a9cc7038bf5..f963b626fa6e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -1385,6 +1385,13 @@ let
 
         org-trello = ignoreCompilationError super.org-trello; # elisp error
 
+        # Requires xwidgets compiled into emacs, so mark this package
+        # as broken if emacs hasn't been compiled with the flag.
+        org-xlatex =
+          if self.emacs.withXwidgets
+          then super.org-xlatex
+          else markBroken super.org-xlatex;
+
         # Optimizer error: too much on the stack
         orgnav = ignoreCompilationError super.orgnav;
 
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index e7fe2ccac658..7bae78f35e70 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -407,6 +407,7 @@ mkDerivation (finalAttrs: {
   passthru = {
     inherit withNativeCompilation;
     inherit withTreeSitter;
+    inherit withXwidgets;
     pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = { inherit (nixosTests) emacs-daemon; };
   };
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index e9c7f0418b0c..8a3c7ac09d7a 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "47.1";
+  version = "47.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5vduvPbFXMmC1EYAWdPRVtm0ESf7erZg7LqdyWBok8U=";
+    hash = "sha256-Roe5PEfNHjNmWi3FA3kLYhPugnhy/ABNl40UvL+ptJU=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 7641013f4de6..67b80ef18649 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,54 +9,54 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.72";
-        ptb = "0.0.113";
-        canary = "0.0.509";
-        development = "0.0.33";
+        stable = "0.0.73";
+        ptb = "0.0.114";
+        canary = "0.0.511";
+        development = "0.0.42";
       }
     else
       {
-        stable = "0.0.323";
-        ptb = "0.0.143";
-        canary = "0.0.618";
-        development = "0.0.55";
+        stable = "0.0.324";
+        ptb = "0.0.144";
+        canary = "0.0.620";
+        development = "0.0.63";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-IAvlxs6oEdO//qVWwH0cBJEbDxyPLG6HHwmOgqMzRRU=";
+        hash = "sha256-LZ3IgtGr94NWbykYS5Xllkl4OOHLG66+ZqQ+OrpnVzs=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-1Rhn6pH6KvuhGNTymBK01tA78it7JXekG48XvRZQOiA=";
+        hash = "sha256-fdpG9V4EJaARSJA9XmW+Zq6exPaFMJ/FWhzwgarDIpI=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-jLAeix6IQ6rqOM8NKNryEeswB5VSzc1lIEI7X7Nrc68=";
+        hash = "sha256-srjYJFVM1UVpkB+koqrZfwgRAWpa7s8Arq2DnAFuaKs=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-A87sVmaYRjRi0Q9IrXuQBr+yC+FtGgZA2L/9V4WuYbU=";
+        hash = "sha256-HZdodWwczgxaGgal5gfr6NQlquf4ZO//QMVcebxQG7s=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-9ySE75TjVDLdPSWAawsVpOgCtL/Di+J3fKUEDH5/Oog=";
+        hash = "sha256-Q/PWTBTnmdNeZV+InLQ3nSpETYF3rzTq9nxEh9HEOWY=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-ZbHz0OR7p873U7YpwsHxa3Uuf3uPsmVOQF9exARQzdI=";
+        hash = "sha256-Xv8TPzfK1gOLG57F9gtt4PvwkCqjDQjYJmKfyNIkEZY=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-UsJRw7gforZ1OAA6GNtXuTe/y95mIr7R6MRa+qe44tk=";
+        hash = "sha256-6rBDZPVYxS3q328d2T9LOs0DUirPbMg2GKDacCSsOG4=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-tZbFrb6OFEa3/IrjzHCcQultFgrMIvaNTmzNj3RHUgQ=";
+        hash = "sha256-E1qQUnwemS6SIHeO1BBifrCu706ldZH18isR7+nGNRU=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index 89688c3ecadf..305f78db06ef 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -156,11 +156,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.129.29-2";
+  version = "10.129.32-2";
 
   src = fetchurl {
     url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-HGzBvCv6ASW2wXMd0BrA6NNGAEsuN2yHwS+0WbABfWM=";
+    hash = "sha256-MaVmiD+XwQLZVVTEZTn/2Kme5pCHXpgQ9bgJRsfrlU0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index ba1ee709a4f4..ccdef5cb3df9 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.54.0";
+  version = "3.54.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-EZIOIudgpOv9s3aeZgE3He3YDA16N9TCN1i0RKo/Ftg=";
+    hash = "sha256-oeM9aED4GLdLv+iafb2jcpXdgUWn30JlrS2yQUU4kDo=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index a7dcffc7f1eb..7b948ccdddf0 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.54.0";
+  version = "3.54.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-qlLXP76wmgk/gZHHJ6ERVCkOVdBHNRJaw5eBTrWGz58=";
+    hash = "sha256-qEQzdJd6AcY70Dr9tcY+c6SOZ0XX1Fm08mgj3Vz5lxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/linuxstopmotion/default.nix b/pkgs/applications/video/linuxstopmotion/default.nix
deleted file mode 100644
index bdf361cec9fc..000000000000
--- a/pkgs/applications/video/linuxstopmotion/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ mkDerivation, lib, fetchgit, pkg-config, qmake, qtbase, qttools, qtmultimedia, libvorbis, libtar, libxml2 }:
-
-mkDerivation rec {
-  version = "0.8.5";
-  pname = "linuxstopmotion";
-
-  src = fetchgit {
-    url = "https://git.code.sf.net/p/linuxstopmotion/code";
-    rev = version;
-    sha256 = "1612lkwsfzc59wvdj2zbj5cwsyw66bwn31jrzjrxvygxdh4ab069";
-  };
-
-  nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ qtbase qttools qtmultimedia libvorbis libtar libxml2 ];
-
-  postPatch = ''
-    substituteInPlace stopmotion.pro --replace '$$[QT_INSTALL_BINS]' '${lib.getDev qttools}/bin'
-  '';
-
-  meta = with lib; {
-    description = "Create stop-motion animation movies";
-    homepage = "http://linuxstopmotion.org/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
-    mainProgram = "stopmotion";
-  };
-}
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index 52b4f5a30e2a..372124829b09 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -13,6 +13,7 @@
 , prePatch ? ""
 , patches ? [ ]
 , postPatch ? ""
+, patchFlags ? []
 , nativeBuildInputs ? [ ]
 , buildInputs ? [ ]
   # The output hash of the dependencies for this project.
@@ -45,7 +46,7 @@
 , npmWorkspace ? null
 , nodejs ? topLevelArgs.nodejs
 , npmDeps ?  fetchNpmDeps {
-  inherit forceGitDeps forceEmptyCache src srcs sourceRoot prePatch patches postPatch;
+  inherit forceGitDeps forceEmptyCache src srcs sourceRoot prePatch patches postPatch patchFlags;
   name = "${name}-npm-deps";
   hash = npmDepsHash;
 }
diff --git a/pkgs/by-name/at/atlauncher/deps.json b/pkgs/by-name/at/atlauncher/deps.json
index bd7ab048a99b..f63cf02eb6b1 100644
--- a/pkgs/by-name/at/atlauncher/deps.json
+++ b/pkgs/by-name/at/atlauncher/deps.json
@@ -475,6 +475,39 @@
    "jar": "sha256-X08MQDHkuDyzae8A9JCc229isR49JT+DphhNgMXrMVc=",
    "pom": "sha256-jcFqM2Rg2Fc4wPw+JKyUwGNwmwHZFYOOBV/PaAFgXV0="
   },
+  "com/twelvemonkeys#twelvemonkeys/3.12.0": {
+   "pom": "sha256-ttCYdPvd2bslDReBepMe+OCTvBjnQob/BrBAVBmAxzA="
+  },
+  "com/twelvemonkeys/common#common-image/3.12.0": {
+   "jar": "sha256-YqOCHHJPrf2jRsHi2DsMUGoMQHS+JppSv04xksfdkrw=",
+   "pom": "sha256-Mvxj0YSlsUAz7Z6uKPTH91cL6IUMZ+80q1DIpb3qlX8="
+  },
+  "com/twelvemonkeys/common#common-io/3.12.0": {
+   "jar": "sha256-v6z+sCrKxH2/0fqwAC6uymVUfQQklJi2VDIMng/fZkc=",
+   "pom": "sha256-X7G3pgrtAmv+FsK7u0MDlUfe3Q1OYT6AEnuTtKLFY1k="
+  },
+  "com/twelvemonkeys/common#common-lang/3.12.0": {
+   "jar": "sha256-XGXlBLW2TYBoPg+nCh3RVN2D1N59o38h6VD1qcA7xm0=",
+   "pom": "sha256-nFFSKc9KTl73IdpjR/+hm5wCetXeEHmQWUBdf6MtjVI="
+  },
+  "com/twelvemonkeys/common#common/3.12.0": {
+   "pom": "sha256-2prJlYu3TvpH0EAuhjHAw4djh0qVMDcP9X8HMTLJVv8="
+  },
+  "com/twelvemonkeys/imageio#imageio-core/3.12.0": {
+   "jar": "sha256-NMb5G/OyF+0BFbzoKDI4+9AmRWKqaCtCJqOWDQ7emBU=",
+   "pom": "sha256-N9att80pHm9n9inza8bpGiV6VFjj7lgf7BJ/aZIYG3g="
+  },
+  "com/twelvemonkeys/imageio#imageio-metadata/3.12.0": {
+   "jar": "sha256-eX0Ca2fQfm1esAoatTpVrKq2+Apxxe4yVXIJPrkMDKo=",
+   "pom": "sha256-kIUqjzz4kZBqjShwC8/EQ/EZd1iEbm7lZR1pHBNCrpw="
+  },
+  "com/twelvemonkeys/imageio#imageio-webp/3.12.0": {
+   "jar": "sha256-Q9xEfM/jTFxcb10xGQJw4fm/ZfYDddaXriqP9DNGhSY=",
+   "pom": "sha256-YciGwb7ZmY5w46JD9w11sWV7CIAgf+FdOgbEh7LhQfg="
+  },
+  "com/twelvemonkeys/imageio#imageio/3.12.0": {
+   "pom": "sha256-ZI62q9rpluXh0kjqy1Gk3LYD4uwnHK6Mjh8PnLpK+Pk="
+  },
   "commons-beanutils#commons-beanutils/1.9.4": {
    "jar": "sha256-fZOMgXiQKARcCMBl6UvnX8KAUnYg1b1itRnVg4UyNoo=",
    "pom": "sha256-w1zKe2HUZ42VeMvAuQG4cXtTmr+SVEQdp4uP5g3gZNA="
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index a276dff1c787..46bb07d4131d 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -21,13 +21,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.37.3";
+  version = "3.4.37.4";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XdTbrM7FPR0o0d+p4ko48UonMsY+nLfiXj5fP2a3/zI=";
+    hash = "sha256-3Rs6XtqhD9PKz8ekF0STaANvPQ73KSUS8GIPvn9DmbQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ep/epiphany/package.nix b/pkgs/by-name/ep/epiphany/package.nix
index db481dc4cad4..435e81e065c4 100644
--- a/pkgs/by-name/ep/epiphany/package.nix
+++ b/pkgs/by-name/ep/epiphany/package.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epiphany";
-  version = "47.1";
+  version = "47.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZC/XIEX26bGPCcPvFt92LZt4FhGauyLt1dgu9ofGoAQ=";
+    hash = "sha256-NNr9g2OgmLRNR24umCO0y+puZq+tM7uhDtehP/GpZPE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ev/evolution-data-server/package.nix b/pkgs/by-name/ev/evolution-data-server/package.nix
index a54f44fb48dd..c99f294e31d4 100644
--- a/pkgs/by-name/ev/evolution-data-server/package.nix
+++ b/pkgs/by-name/ev/evolution-data-server/package.nix
@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.54.0";
+  version = "3.54.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/evolution-data-server-${version}.tar.xz";
-    hash = "sha256-pUtHuXepcDD3OKQS9PXVsu++9eDr6JKbfM4ArFRoEIQ=";
+    hash = "sha256-JbM2xIprq8NjIdiAlLOCrq8Yq8urSpQ4s//5DCnhBa4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-terminal/package.nix b/pkgs/by-name/gn/gnome-terminal/package.nix
index 7cfde6e911ae..755df84ffd30 100644
--- a/pkgs/by-name/gn/gnome-terminal/package.nix
+++ b/pkgs/by-name/gn/gnome-terminal/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-terminal";
-  version = "3.52.2";
+  version = "3.54.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-terminal";
     rev = finalAttrs.version;
-    hash = "sha256-c6xMUyhQnJiIrFnnUEx6vGVvFghGvLjTxiAFq+nSj2A=";
+    hash = "sha256-1Lu/qaeMUL8QvZGIxq2iuI7lfZSB+jMjkI2Jg6qULI0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/gortr/default.nix b/pkgs/by-name/go/gortr/package.nix
similarity index 65%
rename from pkgs/servers/gortr/default.nix
rename to pkgs/by-name/go/gortr/package.nix
index f947e6b9bd37..4adada533575 100644
--- a/pkgs/servers/gortr/default.nix
+++ b/pkgs/by-name/go/gortr/package.nix
@@ -1,6 +1,7 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
@@ -11,7 +12,7 @@ buildGoModule rec {
     owner = "cloudflare";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-W6+zCLPcORGcRJF0F6/LRPap4SNVn/oKGs21T4nSNO0=";
+    hash = "sha256-W6+zCLPcORGcRJF0F6/LRPap4SNVn/oKGs21T4nSNO0=";
   };
 
   vendorHash = null;
@@ -22,10 +23,10 @@ buildGoModule rec {
     "-X=main.version=${version}"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "RPKI-to-Router server used at Cloudflare";
     homepage = "https://github.com/cloudflare/gortr/";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ stv0g ];
   };
 }
diff --git a/pkgs/by-name/gu/guile-sdl/package.nix b/pkgs/by-name/gu/guile-sdl/package.nix
index 83879b26f7db..b996e6d84b47 100644
--- a/pkgs/by-name/gu/guile-sdl/package.nix
+++ b/pkgs/by-name/gu/guile-sdl/package.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  configureFlags = [
+    (lib.enableFeature (!stdenv.hostPlatform.isDarwin) "sdltest")
+  ];
+
   buildInputs = [
     (lib.getDev SDL)
     (lib.getDev SDL_image)
@@ -50,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   meta = {
+    # clang-16: error: unsupported option '--visibility=hidden'; did you mean '-fvisibility=hidden'
+    broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://www.gnu.org/software/guile-sdl/";
     description = "Guile bindings for SDL";
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index 01c82469f5ed..2a66577c476b 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -6,14 +6,16 @@
 , runCommand
 , appimageTools
 , icu
+, genericUpdater
+, writeShellScript
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.4.1.32573";
+  version = "2.5.1.34629";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    hash = "sha256-6sfO9tDIdp/xuNtqZ7UXqzP1SuLd6ZAF7lMTlaF3Z80=";
+    hash = "sha256-YaMlvgktoa738grHarJX2Uh5PZ7qHuASyJBcUhMssEI=";
     stripRoot = false;
   };
 
@@ -58,6 +60,13 @@ stdenv.mkDerivation {
   # Disabling the tests, this seems to be very difficult to test this app.
   doCheck = false;
 
+  passthru.updateScript = genericUpdater {
+    versionLister = writeShellScript "jetbrains-toolbox-versionLister" ''
+      curl -Ls 'https://data.services.jetbrains.com/products?code=TBA&release.type=release' \
+        | jq -r '.[] | .releases | flatten[] | .build'
+    '';
+  };
+
   meta = with lib; {
     description = "Jetbrains Toolbox";
     homepage = "https://jetbrains.com/";
diff --git a/pkgs/by-name/ky/kyverno-chainsaw/package.nix b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
index 059997ff15bd..9dcfbeaf5787 100644
--- a/pkgs/by-name/ky/kyverno-chainsaw/package.nix
+++ b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
@@ -11,23 +11,23 @@
 
 buildGoModule rec {
   pname = "kyverno-chainsaw";
-  version = "0.2.8";
+  version = "0.2.11";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "chainsaw";
     rev = "v${version}";
-    hash = "sha256-elszVinOGL4IbMNK3RTtzJPRRqs7qgqITQqj0g/wyk8=";
+    hash = "sha256-s66TG4r3WSmEfcJzibu8uKv1Pr0aKfTEFNfJzLHjbIA=";
   };
 
-  vendorHash = "sha256-HDmnI+WVv4cUia+IXrBdFBFnrxKMSFjKD6LUZ393sqs=";
+  vendorHash = "sha256-NQJbj1lFR5947Lrw5nSsdfYlkWjTWJ5ybMq7Bpd/s3I=";
+
+  subPackages = [ "." ];
 
   ldflags = [
     "-s"
     "-w"
     "-X github.com/kyverno/chainsaw/pkg/version.BuildVersion=v${version}"
-    "-X github.com/kyverno/chainsaw/pkg/version.BuildHash=${version}"
-    "-X github.com/kyverno/chainsaw/pkg/version.BuildTime=1970-01-01_00:00:00"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
new file mode 100644
index 000000000000..87fd5a7d73de
--- /dev/null
+++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix
@@ -0,0 +1,210 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ffmpeg,
+  libglut,
+  glew,
+  glfw,
+  glm,
+  libGL,
+  libpulseaudio,
+  libX11,
+  libXau,
+  libXdmcp,
+  libXext,
+  libXpm,
+  libXrandr,
+  libXxf86vm,
+  lz4,
+  mpv,
+  pkg-config,
+  SDL2,
+  SDL2_mixer,
+  zlib,
+  fetchzip,
+  wayland,
+  wayland-protocols,
+  egl-wayland,
+  libffi,
+  wayland-scanner,
+  glib,
+  nss,
+  nspr,
+  atk,
+  at-spi2-atk,
+  libdrm,
+  expat,
+  libxcb,
+  libxkbcommon,
+  libXcomposite,
+  libXdamage,
+  libXfixes,
+  mesa,
+  gtk3,
+  pango,
+  cairo,
+  alsa-lib,
+  dbus,
+  at-spi2-core,
+  cups,
+  libxshmfence,
+  udev,
+  libdecor,
+  autoPatchelfHook,
+  makeWrapper,
+}:
+let
+  rpath = lib.makeLibraryPath [
+    glib
+    nss
+    nspr
+    atk
+    at-spi2-atk
+    libdrm
+    libGL
+    expat
+    libxcb
+    libxkbcommon
+    libX11
+    libXcomposite
+    libXdamage
+    libXext
+    libXfixes
+    libXrandr
+    mesa
+    gtk3
+    pango
+    cairo
+    alsa-lib
+    dbus
+    at-spi2-core
+    cups
+    libxshmfence
+    udev
+  ];
+  buildType = "Release";
+  platform =
+    {
+      "aarch64-linux" = "linuxarm64";
+      "x86_64-linux" = "linux64";
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  cef-bin-name = "cef_binary_120.1.10+g3ce3184+chromium-120.0.6099.129_${platform}";
+  cef-bin = stdenv.mkDerivation {
+    pname = "cef-bin";
+    version = "120.0.6099.129";
+    src =
+      let
+        hash =
+          {
+            "linuxarm64" = "sha256-iu8y2r1rd78fV2argulHoZJG+hPMPDKJ9ysnUyIgo5k=";
+            "linux64" = "sha256-FFkFMMkTSseLZIDzESFl8+h7wRhv5QGi1Uy5MViYpX8=";
+          }
+          .${platform};
+        urlName = builtins.replaceStrings [ "+" ] [ "%2B" ] cef-bin-name;
+      in
+      fetchzip {
+        url = "https://cef-builds.spotifycdn.com/${urlName}.tar.bz2";
+        inherit hash;
+      };
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r ./* $out/
+      chmod +w -R $out/
+      patchelf $out/${buildType}/libcef.so --set-rpath "${rpath}" --add-needed libudev.so
+      patchelf $out/${buildType}/libGLESv2.so --set-rpath "${rpath}" --add-needed libGL.so.1
+      patchelf $out/${buildType}/chrome-sandbox --set-interpreter $(cat $NIX_BINTOOLS/nix-support/dynamic-linker)
+      sed 's/-O0/-O2/' -i $out/cmake/cef_variables.cmake
+
+      runHook postInstall
+    '';
+    meta = {
+      description = "Simple framework for embedding Chromium-based browsers in other applications";
+      homepage = "https://cef-builds.spotifycdn.com/index.html";
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      license = lib.licenses.bsd3;
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+    };
+  };
+  buildInputs = [
+    libdecor
+    ffmpeg
+    libglut
+    glew
+    glfw
+    glm
+    libpulseaudio
+    libXau
+    SDL2_mixer
+    libXdmcp
+    libXpm
+    libXxf86vm
+    mpv
+    lz4
+    SDL2
+    zlib
+    wayland
+    wayland-protocols
+    egl-wayland
+    libffi
+    wayland-scanner
+    libXrandr
+  ];
+in
+stdenv.mkDerivation {
+  pname = "linux-wallpaperengine";
+  version = "0-unstable-2024-10-13";
+
+  src = fetchFromGitHub {
+    owner = "Almamu";
+    repo = "linux-wallpaperengine";
+    rev = "ec60a8a57153e49e3684c864a6d809fe9601336b";
+    hash = "sha256-M77Wp6tCXO2oFgfZ0+mdBT07CCYLsDDyHjeHtaDVvu8=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  inherit buildInputs;
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=${buildType}"
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/linux-wallpaperengine"
+  ];
+
+  postPatch = ''
+    patchShebangs .
+    mkdir -p third_party/cef/
+    ln -s ${cef-bin} third_party/cef/${cef-bin-name}
+  '';
+
+  preFixup = ''
+    patchelf --set-rpath "${lib.makeLibraryPath buildInputs}:${cef-bin}" $out/linux-wallpaperengine/linux-wallpaperengine
+    find $out -exec chmod 755 {} +
+    mkdir $out/bin
+    makeWrapper $out/linux-wallpaperengine/linux-wallpaperengine $out/bin/linux-wallpaperengine
+  '';
+
+  meta = {
+    description = "Wallpaper Engine backgrounds for Linux";
+    homepage = "https://github.com/Almamu/linux-wallpaperengine";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "linux-wallpaperengine";
+    maintainers = with lib.maintainers; [ aucub ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+}
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index c630d8ae1f65..d15503b2b0ee 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.0.2";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mFuY1i+AqksAvaMAJkP227eZZE+sauRxOIqV5DO8MFE=";
+    hash = "sha256-oT2W5MuXYR2UENIAkH2Pb6f/m9gC2SfTjjvEq539PRU=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/or/orca/package.nix b/pkgs/by-name/or/orca/package.nix
index 797f0c546449..4acbd6492b25 100644
--- a/pkgs/by-name/or/orca/package.nix
+++ b/pkgs/by-name/or/orca/package.nix
@@ -28,13 +28,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "orca";
-  version = "47.0";
+  version = "47.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-/B8wRN/iqfQgoCZJPoAOTGNMrIFM/UfuF/vP+GqyT/Q=";
+    hash = "sha256-0H16zehWVUaXOp8pcwcy8xcmq2vJ3Mzq0uEgTX2ARO0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pi/pizauth/package.nix b/pkgs/by-name/pi/pizauth/package.nix
index 31435c52f017..ec5ddcf36657 100644
--- a/pkgs/by-name/pi/pizauth/package.nix
+++ b/pkgs/by-name/pi/pizauth/package.nix
@@ -3,8 +3,8 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
+  apple-sdk_11,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -14,15 +14,16 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "ltratt";
     repo = "pizauth";
-    rev = "pizauth-${version}";
+    rev = "refs/tags/pizauth-${version}";
     hash = "sha256-9NezG644oCLTWHTdUaUpJbuwkJu3at/IGNH3FSxl/DI=";
   };
 
   cargoHash = "sha256-Lp5ovkQKShgT7EFvQ+5KE3eQWJEQAL68Bk1d+wUo+bc=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  # pizauth cannot be built with default apple-sdk_10 on x86_64-darwin, pin to 11
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
     installShellCompletion --cmd pizauth \
diff --git a/pkgs/by-name/si/simple64/package.nix b/pkgs/by-name/si/simple64/package.nix
index 4c00f6b806dd..3f6a46c6e15a 100644
--- a/pkgs/by-name/si/simple64/package.nix
+++ b/pkgs/by-name/si/simple64/package.nix
@@ -15,6 +15,8 @@
   hidapi,
   qt6,
   vulkan-loader,
+  makeDesktopItem,
+  copyDesktopItems,
 }:
 
 let
@@ -51,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     makeWrapper
+    copyDesktopItems
     # fake git command for version info generator
     (writeShellScriptBin "git" "echo ${finalAttrs.src.rev}")
   ];
@@ -84,6 +87,8 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/share/simple64 $out/bin
     cp -r simple64/* $out/share/simple64
 
+    install -Dm644 ./simple64-gui/icons/simple64.svg -t $out/share/icons/hicolor/scalable/apps/
+
     makeWrapper $out/share/simple64/simple64-gui $out/bin/simple64-gui \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]} \
         "''${qtWrapperArgs[@]}"
@@ -91,6 +96,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "simple64";
+      desktopName = "simple64";
+      genericName = "Nintendo 64 Emulator";
+      exec = "simple64-gui";
+      mimeTypes = [ "application/x-n64-rom" ];
+      icon = "simple64";
+      terminal = false;
+      categories = [
+        "Game"
+        "Emulator"
+      ];
+    })
+  ];
+
   meta = {
     description = "Easy to use N64 emulator";
     homepage = "https://simple64.github.io";
diff --git a/pkgs/by-name/sn/snowflake-cli/package.nix b/pkgs/by-name/sn/snowflake-cli/package.nix
new file mode 100644
index 000000000000..370e535ecca6
--- /dev/null
+++ b/pkgs/by-name/sn/snowflake-cli/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "snowflake-cli";
+  version = "3.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "snowflakedb";
+    repo = "snowflake-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/n11GbrgFwjiAuwpFNJ3T96VDhdOy2x+hesgh4oPVbo=";
+  };
+
+  build-system = with python3Packages; [
+    hatch-vcs
+    hatchling
+    pip
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  dependencies = with python3Packages; [
+    jinja2
+    pluggy
+    pyyaml
+    rich
+    requests
+    requirements-parser
+    setuptools
+    tomlkit
+    typer
+    urllib3
+    gitpython
+    pydantic
+    snowflake-connector-python
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+    syrupy
+    coverage
+    pytest-randomly
+    pytest-factoryboy
+    pytest-xdist
+  ];
+
+  pytestFlagsArray = [
+    "-n"
+    "$NIX_BUILD_CORES"
+    "--snapshot-warn-unused" # Turn unused snapshots into a warning and not a failure
+  ];
+
+  disabledTests = [
+    "integration"
+    "spcs"
+    "loaded_modules"
+    "integration_experimental"
+    "test_snow_typer_help_sanitization" # Snapshot needs update?
+    "test_help_message" # Snapshot needs update?
+    "test_executing_command_sends_telemetry_usage_data" # Fails on mocked version
+  ];
+
+  pythonRelaxDeps = true;
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+
+    # Looks like the completion generation has some sort of a race
+    # Occasionally one of the completion generations would fail with
+    #
+    # An unexpected exception occurred. Use --debug option to see the traceback. Exception message:
+    # [Errno 17] File exists: '/build/tmp.W654FVhCPT/.config/snowflake/logs'
+    #
+    # This creates a fake config that prevents logging in the build sandbox.
+    export HOME=$(mktemp -d)
+    mkdir -p $HOME/.config/snowflake
+    cat <<EOF > $HOME/.config/snowflake/config.toml
+    [cli.logs]
+    save_logs = false
+    EOF
+    # snowcli checks the config permissions upon launch and exits with an error code if it's not 0600.
+    chmod 0600 $HOME/.config/snowflake/config.toml
+
+    # Typer tries to guess the current shell by default
+    export _TYPER_COMPLETE_TEST_DISABLE_SHELL_DETECTION=1
+
+    installShellCompletion --cmd snow \
+      --bash <($out/bin/snow --show-completion bash) \
+      --fish <($out/bin/snow --show-completion fish) \
+      --zsh <($out/bin/snow --show-completion zsh)
+  '';
+
+  meta = {
+    changelog = "https://github.com/snowflakedb/snowflake-cli/blob/main/RELEASE-NOTES.md";
+    homepage = "https://docs.snowflake.com/en/developer-guide/snowflake-cli-v2/index";
+    description = "Command-line tool explicitly designed for developer-centric workloads in addition to SQL operations";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ vtimofeenko ];
+    mainProgram = "snow";
+  };
+}
diff --git a/pkgs/by-name/st/stopmotion/package.nix b/pkgs/by-name/st/stopmotion/package.nix
new file mode 100644
index 000000000000..a285c847a6fb
--- /dev/null
+++ b/pkgs/by-name/st/stopmotion/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  pkg-config,
+  qt5,
+  libvorbis,
+  libarchive,
+  libxml2,
+}:
+
+stdenv.mkDerivation rec {
+  version = "0.8.7";
+  pname = "stopmotion";
+
+  src = fetchgit {
+    url = "https://invent.kde.org/multimedia/stopmotion";
+    rev = version;
+    hash = "sha256-wqrB0mo7sI9ntWF9QlYmGiRiIoLkMzD+mQ6BzhbAKX8=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt5.wrapQtAppsHook
+  ];
+  buildInputs = [
+    qt5.qtbase
+    qt5.qttools
+    qt5.qtmultimedia
+    libvorbis
+    libarchive
+    libxml2
+  ];
+
+  meta = with lib; {
+    description = "Create stop-motion animation movies";
+    homepage = "http://linuxstopmotion.org/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bjornfor ];
+    mainProgram = "stopmotion";
+  };
+}
diff --git a/pkgs/by-name/sw/swayosd/package.nix b/pkgs/by-name/sw/swayosd/package.nix
index 8ce57143381a..6f688436395c 100644
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@@ -1,38 +1,37 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, wrapGAppsHook3
-, brightnessctl
-, cargo
-, coreutils
-, gtk-layer-shell
-, libevdev
-, libinput
-, libpulseaudio
-, meson
-, ninja
-, rustc
-, sassc
-, stdenv
-, udev
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  wrapGAppsHook3,
+  brightnessctl,
+  cargo,
+  coreutils,
+  gtk-layer-shell,
+  libevdev,
+  libinput,
+  libpulseaudio,
+  meson,
+  ninja,
+  rustc,
+  sassc,
+  stdenv,
+  udev,
 }:
-
 stdenv.mkDerivation rec {
   pname = "swayosd";
-  version = "0-unstable-2024-04-15";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
-    rev = "11271760052c4a4a4057f2d287944d74e8fbdb58";
-    hash = "sha256-qOxnl2J+Ivx/TIqodv3a8nP0JQsYoKIrhqnbD9IxU8g=";
+    rev = "v${version}";
+    hash = "sha256-GyvRWEzTxQxTAk+xCLFsHdd1SttBliOgJ6eZqAxQMME=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "swayosd-${version}";
-    hash = "sha256-exbVanUvGp0ub4WE3VcsN8hkcK0Ipf0tNfd92UecICg=";
+    inherit pname version src;
+    hash = "sha256-EUxJ+aGtYAO0kNggNXIZqj2DmPzc4serj0/V+fvH7ds=";
   };
 
   nativeBuildInputs = [
@@ -60,7 +59,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix PATH : ${lib.makeBinPath [ brightnessctl ]}
+      --prefix PATH : ${lib.makeBinPath [brightnessctl]}
     )
   '';
 
@@ -74,7 +73,11 @@ stdenv.mkDerivation rec {
     description = "GTK based on screen display for keyboard shortcuts";
     homepage = "https://github.com/ErikReider/SwayOSD";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ aleksana barab-i sergioribera ];
+    maintainers = with maintainers; [
+      aleksana
+      barab-i
+      sergioribera
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ya/yalc/package.nix b/pkgs/by-name/ya/yalc/package.nix
new file mode 100644
index 000000000000..5e9fe9c5fbfd
--- /dev/null
+++ b/pkgs/by-name/ya/yalc/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  yarnBuildHook,
+  yarnConfigHook,
+  yarnInstallHook,
+  unstableGitUpdater,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "yalc";
+  version = "0-unstable-2023-07-04";
+
+  src = fetchFromGitHub {
+    owner = "wclr";
+    repo = "yalc";
+    # Upstream has no tagged versions
+    rev = "3b834e488837e87df47414fd9917c10f07f0df08";
+    hash = "sha256-v8OhLVuRhnyN2PrslgVVS0r56wGhYYmjoz3ZUZ95xBc=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-+w3azJEnRx4v3nJ3rhpLWt6CjOFhMMmr1UL5hg2ZR48=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+  ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Work with yarn/npm packages locally like a boss";
+    mainProgram = "yalc";
+    homepage = "https://github.com/wclr/yalc";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+})
diff --git a/pkgs/data/misc/geolite-legacy/default.nix b/pkgs/data/misc/geolite-legacy/default.nix
index 54b9c6d27e92..6cbf620388d9 100644
--- a/pkgs/data/misc/geolite-legacy/default.nix
+++ b/pkgs/data/misc/geolite-legacy/default.nix
@@ -1,34 +1,40 @@
-{ lib, stdenv, fetchurl, zstd }:
+{
+  lib,
+  stdenv,
+  fetchzip,
+  zstd,
+}:
 
 stdenv.mkDerivation rec {
   pname = "geolite-legacy";
-  version = "20230901";
+  version = "20240720";
 
   # We use Arch Linux package as a snapshot, because upstream database is updated in-place.
-  geoip = fetchurl {
+  geoip = fetchzip {
     url = "https://archive.archlinux.org/packages/g/geoip-database/geoip-database-${version}-1-any.pkg.tar.zst";
-    sha256 = "sha256-H6tv0OEf04TvbhbWsm5vwq+lBj4GSyOezd258VOT8yQ=";
+    hash = "sha256-9rPp1Lu6Q4+Cb4N4e/ezHacpLuUwbGQefEPuSrH8O6o=";
+    nativeBuildInputs = [ zstd ];
+    stripRoot = false;
   };
 
-  extra = fetchurl {
+  extra = fetchzip {
     url = "https://archive.archlinux.org/packages/g/geoip-database-extra/geoip-database-extra-${version}-1-any.pkg.tar.zst";
-    sha256 = "sha256-Zb5m5TLJ1vcPKypZ3NliaL9oluz97ukTVGlOehuzyPU=";
+    hash = "sha256-sb06yszstKalc+b9rSuStRuY3YRebAL1Q4jEJkbGiMI=";
+    nativeBuildInputs = [ zstd ];
+    stripRoot = false;
   };
 
-  nativeBuildInputs = [ zstd ];
-
   buildCommand = ''
-    tar -xaf ${geoip}
-    tar -xaf ${extra}
-    mkdir -p $out/share
-    mv usr/share/GeoIP $out/share
+    mkdir -p $out/share/GeoIP
+    cp ${geoip}/usr/share/GeoIP/*.dat $out/share/GeoIP
+    cp ${extra}/usr/share/GeoIP/*.dat $out/share/GeoIP
   '';
 
-  meta = with lib; {
+  meta = {
     description = "GeoLite Legacy IP geolocation databases";
     homepage = "https://mailfud.org/geoip-legacy/";
-    license = licenses.cc-by-sa-40;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ fpletz ];
+    license = lib.licenses.cc-by-sa-40;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 637fc72acf0a..e8524c981d3b 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2024-09-02";
+  version = "2024-11-03";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-rgbqVU2tKLnp+ZQpLTthpo9vPFRkGuayJCADrI2R1ls=";
+    hash = "sha256-K8FiS1AiFMhVaz2Jbr0pudQJGqpwBkQ/4NZdZACtM9Q=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/interpreters/maude/default.nix b/pkgs/development/interpreters/maude/default.nix
index 667c797cd093..2050760adaf6 100644
--- a/pkgs/development/interpreters/maude/default.nix
+++ b/pkgs/development/interpreters/maude/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "3.3.1";
+  version = "3.4";
 in
 
 stdenv.mkDerivation {
@@ -13,8 +13,8 @@ stdenv.mkDerivation {
   inherit version;
 
   src = fetchurl {
-    url = "https://github.com/SRI-CSL/Maude/archive/refs/tags/Maude${version}.tar.gz";
-    sha256 = "ueM8qi3fLogWT8bA+ZyBnd9Zr9oOKuoiu2YpG6o5J1E=";
+    url = "https://github.com/maude-lang/Maude/archive/refs/tags/Maude${version}.tar.gz";
+    sha256 = "IXWEWAmh388NpNSt9wnOpLkzhZ09N+AStO2wn5dRT8o=";
   };
 
   nativeBuildInputs = [ flex bison unzip makeWrapper ];
diff --git a/pkgs/development/libraries/libdex/default.nix b/pkgs/development/libraries/libdex/default.nix
index 28279f92bbb2..e605ff3ea7bd 100644
--- a/pkgs/development/libraries/libdex/default.nix
+++ b/pkgs/development/libraries/libdex/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdex";
-  version = "0.8.0";
+  version = "0.8.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdex/${lib.versions.majorMinor finalAttrs.version}/libdex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZZq10Ot/EL02rwzeCAVRWJh2kLlxTn9bABx4jsHQGiU=";
+    hash = "sha256-lVR1rT5Dqr1vb3BDUmS17ne9JlvZVUUhH+4CawjTeKA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpanel/default.nix b/pkgs/development/libraries/libpanel/default.nix
index 75c02dda5cc1..3a8a75565418 100644
--- a/pkgs/development/libraries/libpanel/default.nix
+++ b/pkgs/development/libraries/libpanel/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpanel";
-  version = "1.8.0";
+  version = "1.8.1";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-WptrVEUvoZA6L9ZLpiJ475S5sRZZt+Gl/aNRi2bNOcM=";
+    hash = "sha256-uHuPqbeXaMxwQkN5PwFYoECh5G03uYiRiFRaf33Kpvs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index 1472aff537df..42f5bfd76b88 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -31,6 +31,12 @@ qtModule {
       url = "https://github.com/qt/qtdeclarative/commit/2aefbca84d2f3dca2c2697f13710b6907c0c7e59.patch";
       hash = "sha256-a/BX0gpW6juJbjDRo8OleMahOC6WWqreURmYZNiGm5c=";
     })
+    # Backport patch to fix Kirigami applications crashing
+    # FIXME: remove for 6.8.1
+    (fetchpatch2 {
+      url = "https://github.com/qt/qtdeclarative/commit/0ae3697cf40bcd3ae1de20621abad17cf6c5f52d.patch";
+      hash = "sha256-YuTHqHCWOsqUOATfaAZRxPSwMsFNylxoqnqCeW5kPjs=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 5d43df7bc82b..afe6c2f3c6c8 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vte";
-  version = "0.78.0";
+  version = "0.78.1";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional (gtkVersion != null) "devdoc";
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "vte";
     rev = finalAttrs.version;
-    hash = "sha256-Ql4q30Q4OEyH63SMbpMVyT/ZySeH/5b+5vo+Xv2HGdQ=";
+    hash = "sha256-dVCvf4eTIJlrSzG6xLdKU47N9uAtHDwRrGkWtSmqbEU=";
   };
 
   patches = [
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 7813c67b62a2..6d1dcd366593 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -209,6 +209,7 @@ mapAliases {
   inherit (pkgs) web-ext; # added 2023-08-20
   inherit (pkgs) wrangler; # added 2024-07-01
   inherit (pkgs) write-good; # added 2023-08-20
+  inherit (pkgs) yalc; # added 2024-06-29
   inherit (pkgs) yaml-language-server; # added 2023-09-05
   inherit (pkgs) yarn; # added 2024-08-13
   inherit (pkgs) yo; # added 2023-08-20
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index a7d44f69d9ea..d5de56d929ba 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -236,5 +236,4 @@
 , "webtorrent-cli"
 , "wring"
 , "@yaegassy/coc-nginx"
-, "yalc"
 ]
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 0130c8645cf2..94112fd7dd24 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -38322,15 +38322,6 @@ let
         sha512 = "KCfK3Vi2F+PH1klYauoQzg81GQ8/GGjQRKYY6tRnpQUPKTs/1gBZSRWtTEd7jGdSn1LZL7gpAmJT+BcS55k2XQ==";
       };
     };
-    "npm-packlist-2.2.2" = {
-      name = "npm-packlist";
-      packageName = "npm-packlist";
-      version = "2.2.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/npm-packlist/-/npm-packlist-2.2.2.tgz";
-        sha512 = "Jt01acDvJRhJGthnUJVF/w6gumWOZxO7IkpY/lsX9//zqQgnF7OJaxgQXcerd4uQOLu7W5bkb4mChL9mdfm+Zg==";
-      };
-    };
     "npm-packlist-8.0.2" = {
       name = "npm-packlist";
       packageName = "npm-packlist";
@@ -84792,65 +84783,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  yalc = nodeEnv.buildNodePackage {
-    name = "yalc";
-    packageName = "yalc";
-    version = "1.0.0-pre.53";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/yalc/-/yalc-1.0.0-pre.53.tgz";
-      sha512 = "tpNqBCpTXplnduzw5XC+FF8zNJ9L/UXmvQyyQj7NKrDNavbJtHvzmZplL5ES/RCnjX7JR7W9wz5GVDXVP3dHUQ==";
-    };
-    dependencies = [
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-4.3.0"
-      sources."balanced-match-1.0.2"
-      sources."brace-expansion-1.1.11"
-      sources."chalk-4.1.2"
-      sources."cliui-7.0.4"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."concat-map-0.0.1"
-      sources."detect-indent-6.1.0"
-      sources."emoji-regex-8.0.0"
-      sources."escalade-3.2.0"
-      sources."fs-extra-8.1.0"
-      sources."fs.realpath-1.0.0"
-      sources."get-caller-file-2.0.5"
-      sources."glob-7.2.3"
-      sources."graceful-fs-4.2.11"
-      sources."has-flag-4.0.0"
-      sources."ignore-5.3.2"
-      sources."ignore-walk-3.0.4"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."ini-2.0.0"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."jsonfile-4.0.0"
-      sources."minimatch-3.1.2"
-      sources."npm-bundled-1.1.2"
-      sources."npm-normalize-package-bin-1.0.1"
-      sources."npm-packlist-2.2.2"
-      sources."once-1.4.0"
-      sources."path-is-absolute-1.0.1"
-      sources."require-directory-2.1.1"
-      sources."string-width-4.2.3"
-      sources."strip-ansi-6.0.1"
-      sources."supports-color-7.2.0"
-      sources."universalify-0.1.2"
-      sources."wrap-ansi-7.0.0"
-      sources."wrappy-1.0.2"
-      sources."y18n-5.0.8"
-      sources."yargs-16.2.0"
-      sources."yargs-parser-20.2.9"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Work with npm/yarn packages locally like a boss.";
-      homepage = "https://github.com/whitecolor/yalc";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
 }
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index c26963682a1f..a48d8abefa86 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -77,5 +77,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/localstack/localstack";
     license = licenses.asl20;
     maintainers = [ ];
+    mainProgram = "localstack";
   };
 }
diff --git a/pkgs/development/python-modules/pyfxa/default.nix b/pkgs/development/python-modules/pyfxa/default.nix
index 4460239e6368..d3a4dcfac3ed 100644
--- a/pkgs/development/python-modules/pyfxa/default.nix
+++ b/pkgs/development/python-modules/pyfxa/default.nix
@@ -12,8 +12,8 @@
   pythonOlder,
   requests,
   responses,
-  setuptools,
-  six,
+  hatchling,
+  parameterized,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     hash = "sha256-dTsWFWaqX6YypNJz9WSlcxJlYOstmTu2ZgOG3RPSViw=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   dependencies = [
     cryptography
@@ -36,8 +36,6 @@ buildPythonPackage rec {
     pybrowserid
     pyjwt
     requests
-    setuptools # imports pkg_resources
-    six
   ];
 
   nativeCheckInputs = [
@@ -45,6 +43,7 @@ buildPythonPackage rec {
     mock
     responses
     pytestCheckHook
+    parameterized
   ];
 
   pythonImportsCheck = [ "fxa" ];
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index b4978a83621d..c1480a273229 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.17.0";
+  version = "5.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vElS6f46xVvK+p5/IvjgCI4wMZlBe3Q5ZaQUie1yLJw=";
+    hash = "sha256-XJWAzJ8B5MZlMA6gF8OAUeXUHfPH2/buvoGlthgc+Qw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytask/default.nix b/pkgs/development/python-modules/pytask/default.nix
new file mode 100644
index 000000000000..260b9634b311
--- /dev/null
+++ b/pkgs/development/python-modules/pytask/default.nix
@@ -0,0 +1,85 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
+  attrs,
+  click,
+  click-default-group,
+  networkx,
+  optree,
+  packaging,
+  pluggy,
+  rich,
+  sqlalchemy,
+  universal-pathlib,
+  pytestCheckHook,
+  nbmake,
+  pexpect,
+  pytest-xdist,
+  syrupy,
+  git,
+  tomli,
+}:
+buildPythonPackage rec {
+  pname = "pytask";
+  version = "0.5.1";
+  pyproject = true;
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "pytask-dev";
+    repo = "pytask";
+    rev = "v${version}";
+    hash = "sha256-b+sS+l0Rp5bb8Dh6UBv3xHYTYKFp3dD5AuLqxB3n6Go=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies = [
+    attrs
+    click
+    click-default-group
+    networkx
+    optree
+    packaging
+    pluggy
+    rich
+    sqlalchemy
+    universal-pathlib
+  ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    git
+    nbmake
+    pexpect
+    pytest-xdist
+    syrupy
+  ];
+
+  # The test suite runs the installed command for e2e tests
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
+
+  disabledTests = [
+    # This accesses the network
+    "test_download_file"
+    # Racy
+    "test_more_nested_pytree_and_python_node_as_return_with_names"
+  ];
+
+  meta = with lib; {
+    description = "Workflow management system that facilitates reproducible data analyses";
+    homepage = "https://github.com/pytask-dev/pytask";
+    changelog = "https://github.com/pytask-dev/pytask/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erooke ];
+  };
+}
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 6903f1261079..6f437dd9f219 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -53,6 +53,7 @@ buildPythonPackage rec {
   ];
 
   pythonRelaxDeps = [
+    "attrs"
     "boto3"
     "cloudpickle"
     "importlib-metadata"
diff --git a/pkgs/development/python-modules/tokenizers/Cargo.lock b/pkgs/development/python-modules/tokenizers/Cargo.lock
index 476c2cabfae1..431acffc96d3 100644
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.15"
+version = "0.6.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64e15c1ab1f89faffbf04a634d5e1962e9074f2741eef6d97f3c4e322426d526"
+checksum = "23a1e53f0f5d86382dafe1cf314783b2044280f406e7e1506368220ad11b1338"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -28,36 +28,36 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb47de1e80c2b463c735db5b217a0ddc39d612e7ac9e2e96a5aed1f57616c1cb"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d36fc52c7f6c869915e99412912f22093507da8d9e942ceaf66fe4b7c14422a"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.4"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
 dependencies = [
  "anstyle",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -92,9 +92,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cc"
-version = "1.1.22"
+version = "1.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9540e661f81799159abee814118cc139a2004b3a3aa3ea37724a1b66530b90e0"
+checksum = "67b9470d453346108f93a59222a9a1a5724db32d0a4727b7ab7ace4b4d822dc9"
 dependencies = [
  "shlex",
 ]
@@ -107,9 +107,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "console"
@@ -186,18 +186,18 @@ dependencies = [
 
 [[package]]
 name = "derive_builder"
-version = "0.20.1"
+version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd33f37ee6a119146a1781d3356a7c26028f83d779b2e04ecd45fdc75c76877b"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
 dependencies = [
  "derive_builder_macro",
 ]
 
 [[package]]
 name = "derive_builder_core"
-version = "0.20.1"
+version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7431fa049613920234f22c47fdc33e6cf3ee83067091ea4277a3f8c4587aae38"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -207,9 +207,9 @@ dependencies = [
 
 [[package]]
 name = "derive_builder_macro"
-version = "0.20.1"
+version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4abae7035bf79b9877b779505d8cf3749285b80c43941eda66604841889451dc"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
  "syn",
@@ -294,9 +294,9 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "humantime"
@@ -376,9 +376,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.159"
+version = "0.2.161"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+checksum = "8e9489c2807c139ffd9c1794f4af0ebe86a828db53ecdc7fea2111d0fed085d1"
 
 [[package]]
 name = "linux-raw-sys"
@@ -386,16 +386,6 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
-[[package]]
-name = "lock_api"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
 [[package]]
 name = "log"
 version = "0.4.22"
@@ -483,6 +473,21 @@ dependencies = [
  "rawpointer",
 ]
 
+[[package]]
+name = "ndarray"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "882ed72dce9365842bf196bdeedf5055305f11fc8c03dee7bb0194a6cad34841"
+dependencies = [
+ "matrixmultiply",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "portable-atomic",
+ "portable-atomic-util",
+ "rawpointer",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -528,12 +533,12 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 
 [[package]]
 name = "numpy"
-version = "0.21.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec170733ca37175f5d75a5bea5911d6ff45d2cd52849ce98b685394e4f2f37f4"
+checksum = "edb929bc0da91a4d85ed6c0a84deaa53d411abfb387fc271124f91bf6b89f14e"
 dependencies = [
  "libc",
- "ndarray",
+ "ndarray 0.16.1",
  "num-complex",
  "num-integer",
  "num-traits",
@@ -543,12 +548,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.1"
+version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82881c4be219ab5faaf2ad5e5e5ecdff8c66bd7402ca3160975c93b24961afd1"
-dependencies = [
- "portable-atomic",
-]
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
 [[package]]
 name = "onig"
@@ -572,29 +574,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "parking_lot"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets",
-]
-
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -613,6 +592,15 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
 
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90a7d5beecc52a491b54d6dd05c7a45ba1801666a5baad9fdbfc6fef8d2d206c"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.20"
@@ -624,24 +612,24 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pyo3"
-version = "0.21.2"
+version = "0.22.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e00b96a521718e08e03b1a622f01c8a8deb50719335de3f60b3b3950f069d8"
+checksum = "3d922163ba1f79c04bc49073ba7b32fd5a8d3b76a87c955921234b8e77333c51"
 dependencies = [
  "cfg-if",
  "indoc",
  "libc",
  "memoffset",
- "parking_lot",
+ "once_cell",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
@@ -651,9 +639,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.21.2"
+version = "0.22.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7883df5835fafdad87c0d888b266c8ec0f4c9ca48a5bed6bbb592e8dedee1b50"
+checksum = "bc38c5feeb496c8321091edf3d63e9a6829eab4b863b4a6a65f26f3e9cc6b179"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -661,9 +649,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.21.2"
+version = "0.22.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01be5843dc60b916ab4dad1dca6d20b9b4e6ddc8e15f50c47fe6d85f1fb97403"
+checksum = "94845622d88ae274d2729fcefc850e63d7a3ddff5e3ce11bd88486db9f1d357d"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -671,9 +659,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.21.2"
+version = "0.22.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77b34069fc0682e11b31dbd10321cbf94808394c56fd996796ce45217dfac53c"
+checksum = "e655aad15e09b94ffdb3ce3d217acf652e26bbc37697ef012f5e5e348c716e5e"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -683,9 +671,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.21.2"
+version = "0.22.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08260721f32db5e1a5beae69a55553f56b99bd0e1c3e6e0a5e8851a9d0f5a85c"
+checksum = "ae1e3f09eecd94618f60a455a23def79f79eba4dc561a97324bf9ac8c6df30ce"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -770,20 +758,11 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
-dependencies = [
- "bitflags 2.6.0",
-]
-
 [[package]]
 name = "regex"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -816,9 +795,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.37"
+version = "0.38.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
+checksum = "aa260229e6538e52293eeb577aabd09945a09d6d9cc0fc550ed7529056c2e32a"
 dependencies = [
  "bitflags 2.6.0",
  "errno",
@@ -833,26 +812,20 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
 [[package]]
 name = "serde"
-version = "1.0.210"
+version = "1.0.214"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+checksum = "f55c3193aca71c12ad7890f1785d2b73e1b9f63a0bbc353c08ef26fe03fc56b5"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.210"
+version = "1.0.214"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -861,9 +834,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.128"
+version = "1.0.132"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
 dependencies = [
  "itoa",
  "memchr",
@@ -903,9 +876,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.79"
+version = "2.0.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
+checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -933,18 +906,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.64"
+version = "1.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
+checksum = "02dd99dc800bbb97186339685293e1cc5d9df1f8fae2d0aecd9ff1c77efea892"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.64"
+version = "1.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
+checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -953,7 +926,7 @@ dependencies = [
 
 [[package]]
 name = "tokenizers"
-version = "0.20.0-dev.0"
+version = "0.20.2"
 dependencies = [
  "aho-corasick",
  "derive_builder",
@@ -983,12 +956,12 @@ dependencies = [
 
 [[package]]
 name = "tokenizers-python"
-version = "0.20.0-dev.0"
+version = "0.20.2"
 dependencies = [
  "env_logger",
  "itertools 0.12.1",
  "libc",
- "ndarray",
+ "ndarray 0.15.6",
  "numpy",
  "pyo3",
  "rayon",
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index ce8e034b8ce0..19b280719759 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -74,14 +74,14 @@ let
 in
 buildPythonPackage rec {
   pname = "tokenizers";
-  version = "0.20.1";
+  version = "0.20.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "tokenizers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QTe1QdmJHSoosNG9cCJS7uQNdoMwgL+CJHQQUX5VtSY=";
+    hash = "sha256-6uUlDLL1dMg5/6/z8AuB7ibqSJ7IUVexHDTkLx35wFY=";
   };
 
   cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
diff --git a/pkgs/games/openttd/jgrpp.nix b/pkgs/games/openttd/jgrpp.nix
index fa8bda67b4aa..72735402047e 100644
--- a/pkgs/games/openttd/jgrpp.nix
+++ b/pkgs/games/openttd/jgrpp.nix
@@ -16,6 +16,7 @@ openttd.overrideAttrs (oldAttrs: rec {
   meta = {
     homepage = "https://github.com/JGRennison/OpenTTD-patches";
     changelog = "https://github.com/JGRennison/OpenTTD-patches/blob/jgrpp-${version}/jgrpp-changelog.md";
+    mainProgram = "openttd";
   };
 
 })
diff --git a/pkgs/misc/flashfocus/default.nix b/pkgs/misc/flashfocus/default.nix
index 8c7fb067f1ab..f49c7936f60e 100644
--- a/pkgs/misc/flashfocus/default.nix
+++ b/pkgs/misc/flashfocus/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchPypi, netcat-openbsd, nix-update-script }:
+{ lib, python3Packages, fetchPypi, netcat-openbsd, procps, bash, nix-update-script }:
 
 python3Packages.buildPythonApplication rec {
   pname = "flashfocus";
@@ -13,13 +13,20 @@ python3Packages.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace bin/nc_flash_window \
-      --replace "nc" "${lib.getExe netcat-openbsd}"
+      --replace-fail "nc" "${lib.getExe netcat-openbsd}"
+
+    substituteInPlace src/flashfocus/util.py \
+      --replace-fail "pidof" "${lib.getExe' procps "pidof"}"
   '';
 
   nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
+  buildInputs = [
+    bash
+  ];
+
   pythonRelaxDeps = [
     "pyyaml"
     "xcffib"
diff --git a/pkgs/os-specific/linux/tuxedo-drivers/default.nix b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
new file mode 100644
index 000000000000..805d2c553473
--- /dev/null
+++ b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  kernel,
+  kmod,
+  pahole,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tuxedo-drivers-${kernel.version}";
+  version = "4.9.0";
+
+  src = fetchFromGitLab {
+    group = "tuxedocomputers";
+    owner = "development/packages";
+    repo = "tuxedo-drivers";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-b0ogwUA9k5NKyTyJUigt/EN1V8Q+8Tc6I+y6isBcet0=";
+  };
+
+  buildInputs = [ pahole ];
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  # kernel makeFlags contain O=$$(buildRoot), that upstream passes through to make and causes build failure, so we filter it out here
+  makeFlags =
+    (lib.filter (flag: lib.head (lib.strings.splitString "=" flag) != "O") kernel.makeFlags)
+    ++ [
+      "KERNELRELEASE=${kernel.modDirVersion}"
+      "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+      "INSTALL_MOD_PATH=${placeholder "out"}"
+    ];
+
+  meta = {
+    broken = stdenv.hostPlatform.isAarch64 || (lib.versionOlder kernel.version "5.5");
+    description = "Keyboard and hardware I/O driver for TUXEDO Computers laptops";
+    homepage = "https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers";
+    license = lib.licenses.gpl3Plus;
+    longDescription = ''
+      Drivers for several platform devices for TUXEDO notebooks:
+      - Driver for Fn-keys
+      - SysFS control of brightness/color/mode for most TUXEDO keyboards
+      - Hardware I/O driver for TUXEDO Control Center
+
+      Can be used with the "hardware.tuxedo-drivers" NixOS module.
+    '';
+    maintainers = with lib.maintainers; [
+      aprl
+      blanky0230
+      keksgesicht
+      xaverdh
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix b/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
deleted file mode 100644
index 23285d5e26d2..000000000000
--- a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, kernel, linuxHeaders, pahole }:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tuxedo-keyboard-${kernel.version}";
-  version = "3.2.14";
-
-  src = fetchFromGitHub {
-    owner = "tuxedocomputers";
-    repo = "tuxedo-keyboard";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-L3NsUUKA/snUcRWwlZidsBiTznhfulNldidEDDmNOkw=";
-  };
-
-  buildInputs = [
-    pahole
-    linuxHeaders
-  ];
-
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/lib/modules/${kernel.modDirVersion}"
-
-    for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko uniwill_wmi.ko; do
-        mv src/$module $out/lib/modules/${kernel.modDirVersion}
-    done
-
-    runHook postInstall
-  '';
-
-  meta = {
-    broken = stdenv.hostPlatform.isAarch64 || (lib.versionOlder kernel.version "5.5");
-    description = "Keyboard and hardware I/O driver for TUXEDO Computers laptops";
-    homepage = "https://github.com/tuxedocomputers/tuxedo-keyboard/";
-    license = lib.licenses.gpl3Plus;
-    longDescription = ''
-      This driver provides support for Fn keys, brightness/color/mode for most TUXEDO
-      keyboards (except white backlight-only models).
-
-      Can be used with the "hardware.tuxedo-keyboard" NixOS module.
-    '';
-    maintainers = [ lib.maintainers.blanky0230 ];
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 788770427964..76ce8d6b6dc9 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -32,7 +32,7 @@ let
       inherit version;
 
       src = fetchurl {
-        url = "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz";
+        url = "https://archive.mariadb.org/mariadb-${version}/source/mariadb-${version}.tar.gz";
         inherit hash;
       };
 
@@ -244,26 +244,26 @@ in
     # see https://mariadb.org/about/#maintenance-policy for EOLs
     mariadb_105 = self.callPackage generic {
       # Supported until 2025-06-24
-      version = "10.5.26";
-      hash = "sha256-3V+ZodMK5HNl/Bix3u/23AqzishOfZ/ZyMBP9rAZYfE=";
+      version = "10.5.27";
+      hash = "sha256-76ZPpfczuCKrGmeV4evBecFgwIaQ7Ncduh6w9hru3RQ=";
       inherit (self.darwin.apple_sdk.frameworks) CoreServices;
     };
     mariadb_106 = self.callPackage generic {
       # Supported until 2026-07-06
-      version = "10.6.19";
-      hash = "sha256-vOyw/3t5pBNEc2+plHEHh8FVFtUet3FfJ4w/D8t+hwM=";
+      version = "10.6.20";
+      hash = "sha256-R/BavH2+uz8msx51AisbOWnbvEdSxK5wH4kgpgSJbUE=";
       inherit (self.darwin.apple_sdk.frameworks) CoreServices;
     };
     mariadb_1011 = self.callPackage generic {
       # Supported until 2028-02-16
-      version = "10.11.9";
-      hash = "sha256-CgAYCGTNAWGHyYb6q4AQ3iOhF7mnX5HWRWQh+JTkjSA=";
+      version = "10.11.10";
+      hash = "sha256-sGp0ZQuDoWqpqwmJhEgrAo51sABnSxH/KIdyxhmm8CI=";
       inherit (self.darwin.apple_sdk.frameworks) CoreServices;
     };
     mariadb_114 = self.callPackage generic {
       # Supported until 2029-05-29
-      version = "11.4.3";
-      hash = "sha256-bwAXuZAbsYl94O7SHK75/6nWbvVZNFoNim8BEwhBPs4=";
+      version = "11.4.4";
+      hash = "sha256-lvvS5uk/t+izc+6nXYW2/qV8DhEaAgkMu+/tUlmdx3s=";
       inherit (self.darwin.apple_sdk.frameworks) CoreServices;
     };
   }
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 2a591c0d68d0..8b88e94b5e1b 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -105,6 +105,7 @@ stdenv.mkDerivation rec {
     description = "Next generation of fcitx";
     homepage = "https://github.com/fcitx/fcitx5";
     license = licenses.lgpl21Plus;
+    mainProgram = "fcitx5";
     maintainers = with maintainers; [ poscat ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f967261b29b4..3eb9296dc85c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -720,6 +720,8 @@ mapAliases {
   linuxPackages_testing_bcachefs = throw "'linuxPackages_testing_bcachefs' has been removed, please use 'linuxPackages_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
   linux_testing_bcachefs = throw "'linux_testing_bcachefs' has been removed, please use 'linux_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
 
+  linuxstopmotion = stopmotion; # Added 2024-11-01
+
   llvmPackages_git = (callPackages ../development/compilers/llvm { }).git;
 
   lld_9 = throw "lld_9 has been removed from nixpkgs"; # Added 2024-04-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7a436a24a2b..28ec2e898fd4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10000,7 +10000,7 @@ with pkgs;
   mole = callPackage ../tools/networking/mole { };
 
   morgen = callPackage ../applications/office/morgen {
-    electron = electron_30;
+    electron = electron_32;
   };
 
   mosh = callPackage ../tools/networking/mosh { };
@@ -32164,8 +32164,6 @@ with pkgs;
     curses = ncurses;
   };
 
-  linuxstopmotion = libsForQt5.callPackage ../applications/video/linuxstopmotion { };
-
   sweethome3d = recurseIntoAttrs (
     (callPackage ../applications/misc/sweethome3d { }) //
     (callPackage ../applications/misc/sweethome3d/editors.nix {
@@ -38238,8 +38236,6 @@ with pkgs;
 
   sieveshell = with python3.pkgs; toPythonApplication managesieve;
 
-  gortr = callPackage ../servers/gortr { };
-
   stayrtr = callPackage ../servers/stayrtr { };
 
   sunshine = callPackage ../servers/sunshine { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d9fade706894..663aa9191cc3 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -474,7 +474,7 @@ in {
 
     rust-out-of-tree-module = if lib.versionAtLeast kernel.version "6.7" then callPackage ../os-specific/linux/rust-out-of-tree-module { } else null;
 
-    tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;
+    tuxedo-drivers = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-drivers { } else null;
 
     jool = callPackage ../os-specific/linux/jool { };
 
@@ -606,6 +606,7 @@ in {
     kvdo = throw "kvdo was removed, because it was added to mainline in kernel version 6.9"; # Added 2024-07-08
     system76-power = lib.warn "kernelPackages.system76-power is now pkgs.system76-power" pkgs.system76-power; # Added 2024-10-16
     system76-scheduler = lib.warn "kernelPackages.system76-scheduler is now pkgs.system76-scheduler" pkgs.system76-scheduler; # Added 2024-10-16
+    tuxedo-keyboard = self.tuxedo-drivers; # Added 2024-09-28
   });
 
   hardenedPackagesFor = kernel: overrides: packagesFor (hardenedKernelFor kernel overrides);
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 6f4a454b8d14..95772c0afc1c 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -555,8 +555,7 @@ in {
           name = "pdo_dblib";
           internalDeps = [ php.extensions.pdo ];
           configureFlags = [ "--with-pdo-dblib=${freetds}" ];
-          # Doesn't seem to work on darwin.
-          meta.broken = (!stdenv.hostPlatform.isDarwin);
+          meta.broken = stdenv.hostPlatform.isDarwin;
           doCheck = false;
         }
         {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 939450efc352..4864abd7fe75 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10449,6 +10449,8 @@ self: super: with self; {
 
   pysyncthru = callPackage ../development/python-modules/pysyncthru { };
 
+  pytask = callPackage ../development/python-modules/pytask { };
+
   pytest-mockito = callPackage ../development/python-modules/pytest-mockito { };
 
   pytest-pudb = callPackage ../development/python-modules/pytest-pudb { };