diff --git a/ci/eval/compare/utils.nix b/ci/eval/compare/utils.nix
index 8d707fbedbdd..6e75b2a62790 100644
--- a/ci/eval/compare/utils.nix
+++ b/ci/eval/compare/utils.nix
@@ -212,13 +212,25 @@ rec {
             else if rebuildCount <= 500 then
               [ "101-500" ]
             else if rebuildCount <= 1000 then
-              [ "501-1000" ]
+              [
+                "501-1000"
+                "501+"
+              ]
             else if rebuildCount <= 2500 then
-              [ "1001-2500" ]
+              [
+                "1001-2500"
+                "501+"
+              ]
             else if rebuildCount <= 5000 then
-              [ "2501-5000" ]
+              [
+                "2501-5000"
+                "501+"
+              ]
             else
-              [ "5001+" ];
+              [
+                "5001+"
+                "501+"
+              ];
         in
         lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
       ) rebuildCountByKernel
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index bc5566f3cbd3..f316656a585c 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -110,7 +110,7 @@ stdenvNoCC.mkDerivation (
       shell =
         let
           devmode' = devmode.override {
-            buildArgs = "./.";
+            buildArgs = toString ../.;
             open = "/share/doc/nixpkgs/manual.html";
           };
           nixos-render-docs-redirects' = writeShellScriptBin "redirects" "${lib.getExe nixos-render-docs-redirects} --file ${toString ../redirects.json} $@";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 18277e877340..1277d6d8eda8 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -226,6 +226,8 @@
 
 - `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
 
+- `services.mongodb.initialRootPassword` has been replaced with the more secure option [`services.mongodb.initialRootPasswordFile`](#opt-services.mongodb.initialRootPasswordFile)
+
 - `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.
 
 - `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.
@@ -386,6 +388,8 @@
 
 - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
 
+- [`services.mongodb`](#opt-services.mongodb.enable) is now compatible with the `mongodb-ce` binary package. To make use of it, set [`services.mongodb.package`](#opt-services.mongodb.package) to `pkgs.mongodb-ce`.
+
 - [`services.jupyter`](#opt-services.jupyter.enable) is now compatible with `Jupyter Notebook 7`. See [the migration guide](https://jupyter-notebook.readthedocs.io/en/latest/migrate_to_notebook7.html) for details.
 
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
@@ -398,6 +402,8 @@
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
+- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
+
 - The paperless module now has an option for regular automatic export of
   documents data using the integrated document exporter.
 
diff --git a/nixos/doc/manual/shell.nix b/nixos/doc/manual/shell.nix
index 4f6ab400f22c..6e9d253e4718 100644
--- a/nixos/doc/manual/shell.nix
+++ b/nixos/doc/manual/shell.nix
@@ -7,7 +7,7 @@ let
   common = import ./common.nix;
   inherit (common) outputPath indexPath;
   devmode = pkgs.devmode.override {
-    buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
+    buildArgs = ''${toString ../../release.nix} -A manualHTML.${builtins.currentSystem}'';
     open = "/${outputPath}/${indexPath}";
   };
   nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" "${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file ${toString ./redirects.json} $@";
diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix
index 90b749574bf5..129b679d73f8 100644
--- a/nixos/modules/services/databases/mongodb.nix
+++ b/nixos/modules/services/databases/mongodb.nix
@@ -10,6 +10,8 @@ let
 
   mongodb = cfg.package;
 
+  mongoshExe = lib.getExe cfg.mongoshPackage;
+
   mongoCnf =
     cfg:
     pkgs.writeText "mongodb.conf" ''
@@ -25,6 +27,13 @@ let
 in
 
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mongodb"
+      "initialRootPassword"
+    ] "Use services.mongodb.initialRootPasswordFile to securely provide the initial root password.")
+  ];
 
   ###### interface
 
@@ -34,7 +43,11 @@ in
 
       enable = lib.mkEnableOption "the MongoDB server";
 
-      package = lib.mkPackageOption pkgs "mongodb" { };
+      package = lib.mkPackageOption pkgs "mongodb" {
+        example = "pkgs.mongodb-ce";
+      };
+
+      mongoshPackage = lib.mkPackageOption pkgs "mongosh" { };
 
       user = lib.mkOption {
         type = lib.types.str;
@@ -60,10 +73,10 @@ in
         description = "Enable client authentication. Creates a default superuser with username root!";
       };
 
-      initialRootPassword = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      initialRootPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        description = "Password for the root user if auth is enabled.";
+        description = "Path to the file containing the password for the root user if auth is enabled.";
       };
 
       dbpath = lib.mkOption {
@@ -112,8 +125,8 @@ in
   config = lib.mkIf config.services.mongodb.enable {
     assertions = [
       {
-        assertion = !cfg.enableAuth || cfg.initialRootPassword != null;
-        message = "`enableAuth` requires `initialRootPassword` to be set.";
+        assertion = !cfg.enableAuth || cfg.initialRootPasswordFile != null;
+        message = "`enableAuth` requires `initialRootPasswordFile` to be set.";
       }
     ];
 
@@ -125,8 +138,6 @@ in
     };
     users.groups.mongodb = lib.mkIf (cfg.user == "mongodb") { };
 
-    environment.systemPackages = [ mongodb ];
-
     systemd.services.mongodb = {
       description = "MongoDB server";
 
@@ -164,14 +175,15 @@ in
           if ! test -e "${cfg.dbpath}/.auth_setup_complete"; then
             systemd-run --unit=mongodb-for-setup --uid=${cfg.user} ${mongodb}/bin/mongod --config ${mongoCnf cfg_}
             # wait for mongodb
-            while ! ${mongodb}/bin/mongo --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
+            while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
 
-          ${mongodb}/bin/mongo <<EOF
-            use admin
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
+          ${mongoshExe} <<EOF
+            use admin;
             db.createUser(
               {
                 user: "root",
-                pwd: "${cfg.initialRootPassword}",
+                pwd: "$initialRootPassword",
                 roles: [
                   { role: "userAdminAnyDatabase", db: "admin" },
                   { role: "dbAdminAnyDatabase", db: "admin" },
@@ -187,7 +199,8 @@ in
       postStart = ''
         if test -e "${cfg.dbpath}/.first_startup"; then
           ${lib.optionalString (cfg.initialScript != null) ''
-            ${mongodb}/bin/mongo ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
+            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p $initialRootPassword"} admin "${cfg.initialScript}"
           ''}
           rm -f "${cfg.dbpath}/.first_startup"
         fi
diff --git a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
index 018bd5f5c1cc..c01c7db37931 100644
--- a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
@@ -275,18 +275,13 @@ in
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-faster-whisper";
-            StateDirectory = [
-              "wyoming/faster-whisper"
-              "wyoming/faster-whisper/models"
-            ];
+            StateDirectory = [ "wyoming/faster-whisper" ];
             # https://github.com/home-assistant/addons/blob/master/whisper/rootfs/etc/s6-overlay/s6-rc.d/whisper/run
             ExecStart = escapeSystemdExecArgs (
               [
                 (lib.getExe cfg.package)
                 "--data-dir"
                 "/var/lib/wyoming/faster-whisper"
-                "--download-dir"
-                "/var/lib/wyoming/faster-whisper/models"
                 "--uri"
                 options.uri
                 "--device"
diff --git a/nixos/modules/services/home-automation/wyoming/openwakeword.nix b/nixos/modules/services/home-automation/wyoming/openwakeword.nix
index 7c3b21341f37..1b4e932c7b0f 100644
--- a/nixos/modules/services/home-automation/wyoming/openwakeword.nix
+++ b/nixos/modules/services/home-automation/wyoming/openwakeword.nix
@@ -126,22 +126,14 @@ in
             "--trigger-level"
             cfg.triggerLevel
           ]
-          ++ concatMap (
-            model:
-            [
-              "--preload-model"
-              model
-            ]
-              cfg.preloadModels
-          )
-          ++ concatMap (
-            dir:
-            [
-              "--custom-model-dir"
-              (toString dir)
-            ]
-              cfg.customModelsDirectories
-          )
+          ++ (concatMap (model: [
+            "--preload-model"
+            model
+          ]) cfg.preloadModels)
+          ++ (concatMap (dir: [
+            "--custom-model-dir"
+            (toString dir)
+          ]) cfg.customModelsDirectories)
           ++ cfg.extraArgs
         );
         CapabilityBoundingSet = "";
diff --git a/nixos/modules/services/home-automation/wyoming/piper.nix b/nixos/modules/services/home-automation/wyoming/piper.nix
index 7b6993a65dae..2ef64c878239 100644
--- a/nixos/modules/services/home-automation/wyoming/piper.nix
+++ b/nixos/modules/services/home-automation/wyoming/piper.nix
@@ -136,18 +136,13 @@ in
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-piper";
-            StateDirectory = [
-              "wyoming/piper"
-              "wyoming/piper/models"
-            ];
+            StateDirectory = [ "wyoming/piper" ];
             # https://github.com/home-assistant/addons/blob/master/piper/rootfs/etc/s6-overlay/s6-rc.d/piper/run
             ExecStart = escapeSystemdExecArgs (
               [
                 (lib.getExe cfg.package)
                 "--data-dir"
                 "/var/lib/wyoming/piper"
-                "--download-dir"
-                "/var/lib/wyoming/piper/models"
                 "--uri"
                 options.uri
                 "--piper"
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 01abc3807faf..19b73f5cdf30 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -48,6 +48,13 @@ let
   defaultUser = "netdata";
 
   isThereAnyWireGuardTunnels = config.networking.wireguard.enable || lib.any (c: lib.hasAttrByPath [ "netdevConfig" "Kind" ] c && c.netdevConfig.Kind == "wireguard") (builtins.attrValues config.systemd.network.netdevs);
+
+  extraNdsudoPathsEnv = pkgs.buildEnv {
+    name = "netdata-ndsudo-env";
+    paths = cfg.extraNdsudoPackages;
+    pathsToLink = [ "/bin" ];
+  };
+
 in {
   options = {
     services.netdata = {
@@ -131,6 +138,27 @@ in {
         '';
       };
 
+      extraNdsudoPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = ''
+          Extra packages to add to `PATH` to make available to `ndsudo`.
+          ::: {.warning}
+          `ndsudo` has SUID privileges, be careful what packages you list here.
+          :::
+
+          ::: {.note}
+          `cfg.package` must be built with `withNdsudo = true`
+          :::
+        '';
+        example = ''
+          [
+            pkgs.smartmontools
+            pkgs.nvme-cli
+          ]
+        '';
+      };
+
       config = lib.mkOption {
         type = lib.types.attrsOf lib.types.attrs;
         default = {};
@@ -221,6 +249,31 @@ in {
     environment.etc."netdata/netdata.conf".source = configFile;
     environment.etc."netdata/conf.d".source = configDirectory;
 
+
+    systemd.tmpfiles.settings = lib.mkIf cfg.package.withNdsudo {
+      "95-netdata-ndsudo" = {
+        "/var/lib/netdata/ndsudo" = {
+          "d" = {
+            mode = "0550";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "/var/lib/netdata/ndsudo/ndsudo" = {
+          "L+" = {
+            argument = "/run/wrappers/bin/ndsudo";
+          };
+        };
+
+        "/var/lib/netdata/ndsudo/runtime-dependencies" = {
+          "L+" = {
+            argument = "${extraNdsudoPathsEnv}/bin";
+          };
+        };
+      };
+    };
+
     systemd.services.netdata = {
       description = "Real time performance monitoring";
       after = [ "network.target" "suid-sgid-wrappers.service" ];
@@ -394,6 +447,14 @@ in {
         group = cfg.group;
         permissions = "u+rx,g+x,o-rwx";
       };
+    } // lib.optionalAttrs (cfg.package.withNdsudo) {
+      "ndsudo" = {
+        source = "${cfg.package}/libexec/netdata/plugins.d/ndsudo.org";
+        setuid = true;
+        owner = "root";
+        group = cfg.group;
+        permissions = "u+rx,g+x,o-rwx";
+      };
     };
 
     security.pam.loginLimits = [
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index dd117cca93b8..5eb314dad4ea 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -622,7 +622,11 @@ in {
   monado = handleTest ./monado.nix {};
   monetdb = handleTest ./monetdb.nix {};
   monica = handleTest ./web-apps/monica.nix {};
-  mongodb = handleTest ./mongodb.nix {};
+  mongodb = runTest ./mongodb.nix;
+  mongodb-ce = runTest ({ config, ... }: {
+    imports = [ ./mongodb.nix ];
+    defaults.services.mongodb.package = config.node.pkgs.mongodb-ce;
+  });
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
   mopidy = handleTest ./mopidy.nix {};
diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index a42ba0abf423..2b4b0fbe6a50 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -1,59 +1,37 @@
-# This test start mongodb, runs a query using mongo shell
+# This test starts mongodb and runs a query using mongo shell
+{ config, lib, ... }:
+let
+  # required for test execution on darwin
+  pkgs = config.node.pkgs;
+  testQuery = pkgs.writeScript "nixtest.js" ''
+    db.greetings.insertOne({ "greeting": "hello" });
+    print(db.greetings.findOne().greeting);
+  '';
+  mongoshExe = lib.getExe pkgs.mongosh;
+in
+{
+  name = "mongodb";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    bluescreen303
+    offline
+    phile314
+    niklaskorz
+  ];
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testQuery = pkgs.writeScript "nixtest.js" ''
-      db.greetings.insert({ "greeting": "hello" });
-      print(db.greetings.findOne().greeting);
-    '';
+  nodes.mongodb = {
+    services.mongodb.enable = true;
+  };
 
-    runMongoDBTest = pkg: ''
-      node.execute("(rm -rf data || true) && mkdir data")
-      node.execute(
-          "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
-      )
-      node.wait_for_open_port(27017)
+  testScript = ''
+    start_all()
 
-      assert "hello" in node.succeed(
-          "${pkg}/bin/mongo ${testQuery}"
-      )
+    with subtest("start mongodb"):
+        mongodb.wait_for_unit("mongodb.service")
+        mongodb.wait_for_open_port(27017)
 
-      node.execute(
-          "${pkg}/bin/mongod --shutdown --dbpath data"
-      )
-      node.wait_for_closed_port(27017)
-    '';
-
-  in
-  {
-    name = "mongodb";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        bluescreen303
-        offline
-        phile314
-      ];
-    };
-
-    nodes = {
-      node =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            # remember to update mongodb.passthru.tests if you change this
-            mongodb-7_0
-          ];
-        };
-    };
-
-    testScript =
-      ''
-        node.start()
-      ''
-      + runMongoDBTest pkgs.mongodb-7_0
-      + ''
-        node.shutdown()
-      '';
-  }
-)
+    with subtest("insert and find a document"):
+        result = mongodb.succeed("${mongoshExe} ${testQuery}")
+        print("Test output:", result)
+        assert result.strip() == "hello"
+  '';
+}
diff --git a/nixos/tests/swayfx.nix b/nixos/tests/swayfx.nix
index fe1caf8fffa8..ba8408e20460 100644
--- a/nixos/tests/swayfx.nix
+++ b/nixos/tests/swayfx.nix
@@ -12,80 +12,78 @@ import ./make-test-python.nix (
     # Found 1 error in 1 file (checked 1 source file)
     skipTypeCheck = true;
 
-    nodes.machine =
-      { config, ... }:
-      {
-        # Automatically login on tty1 as a normal user:
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
+    nodes.machine = {
+      # Automatically login on tty1 as a normal user:
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
 
-        environment = {
-          # For glinfo and wayland-info:
-          systemPackages = with pkgs; [
-            mesa-demos
-            wayland-utils
-            alacritty
-          ];
-          # Use a fixed SWAYSOCK path (for swaymsg):
-          variables = {
-            "SWAYSOCK" = "/tmp/sway-ipc.sock";
-            # TODO: Investigate if we can get hardware acceleration to work (via
-            # virtio-gpu and Virgil). We currently have to use the Pixman software
-            # renderer since the GLES2 renderer doesn't work inside the VM (even
-            # with WLR_RENDERER_ALLOW_SOFTWARE):
-            # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
-            "WLR_RENDERER" = "pixman";
-          };
-          # For convenience:
-          shellAliases = {
-            test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-            test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-          };
-
-          # To help with OCR:
-          etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
-            main = {
-              font = "inconsolata:size=14";
-            };
-            colors = rec {
-              foreground = "000000";
-              background = "ffffff";
-              regular2 = foreground;
-            };
-          };
-
-          etc."gpg-agent.conf".text = ''
-            pinentry-timeout 86400
-          '';
+      environment = {
+        # For glinfo and wayland-info:
+        systemPackages = with pkgs; [
+          mesa-demos
+          wayland-utils
+          alacritty
+        ];
+        # Use a fixed SWAYSOCK path (for swaymsg):
+        variables = {
+          "SWAYSOCK" = "/tmp/sway-ipc.sock";
+          # TODO: Investigate if we can get hardware acceleration to work (via
+          # virtio-gpu and Virgil). We currently have to use the Pixman software
+          # renderer since the GLES2 renderer doesn't work inside the VM (even
+          # with WLR_RENDERER_ALLOW_SOFTWARE):
+          # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+          "WLR_RENDERER" = "pixman";
+        };
+        # For convenience:
+        shellAliases = {
+          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
         };
 
-        fonts.packages = [ pkgs.inconsolata ];
+        # To help with OCR:
+        etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+          main = {
+            font = "inconsolata:size=14";
+          };
+          colors = rec {
+            foreground = "000000";
+            background = "ffffff";
+            regular2 = foreground;
+          };
+        };
 
-        # Automatically configure and start Sway when logging in on tty1:
-        programs.bash.loginShellInit = ''
-          if [ "$(tty)" = "/dev/tty1" ]; then
-            set -e
-
-            mkdir -p ~/.config/sway
-            sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
-
-            sway --validate
-            sway && touch /tmp/sway-exit-ok
-          fi
+        etc."gpg-agent.conf".text = ''
+          pinentry-timeout 86400
         '';
-
-        programs.sway = {
-          enable = true;
-          package = pkgs.swayfx.override { isNixOS = true; };
-        };
-
-        # To test pinentry via gpg-agent:
-        programs.gnupg.agent.enable = true;
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
       };
 
+      fonts.packages = [ pkgs.inconsolata ];
+
+      # Automatically configure and start Sway when logging in on tty1:
+      programs.bash.loginShellInit = ''
+        if [ "$(tty)" = "/dev/tty1" ]; then
+          set -e
+
+          mkdir -p ~/.config/sway
+          sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
+
+          sway --validate
+          sway && touch /tmp/sway-exit-ok
+        fi
+      '';
+
+      programs.sway = {
+        enable = true;
+        package = pkgs.swayfx.override { isNixOS = true; };
+      };
+
+      # To test pinentry via gpg-agent:
+      programs.gnupg.agent.enable = true;
+
+      # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
+
     testScript =
       { nodes, ... }:
       ''
@@ -194,7 +192,7 @@ import ./make-test-python.nix (
         swaymsg("exec swaylock")
         machine.wait_until_succeeds("pgrep -x swaylock")
         machine.sleep(3)
-        machine.send_chars("${nodes.machine.config.users.users.alice.password}")
+        machine.send_chars("${nodes.machine.users.users.alice.password}")
         machine.send_key("ret")
         machine.wait_until_fails("pgrep -x swaylock")
 
diff --git a/pkgs/applications/audio/mopidy/mopidy.nix b/pkgs/applications/audio/mopidy/mopidy.nix
index 4771ade230c9..8918d44d3c04 100644
--- a/pkgs/applications/audio/mopidy/mopidy.nix
+++ b/pkgs/applications/audio/mopidy/mopidy.nix
@@ -30,7 +30,22 @@ pythonPackages.buildPythonApplication rec {
     gst-plugins-base
     gst-plugins-good
     gst-plugins-ugly
-    gst-plugins-rs
+    # Required patches for the Spotify plugin (https://github.com/mopidy/mopidy-spotify/releases/tag/v5.0.0a3)
+    (gst-plugins-rs.overrideAttrs (
+      newAttrs: oldAttrs: {
+        cargoDeps = oldAttrs.cargoDeps.overrideAttrs (oldAttrs': {
+          vendorStaging = oldAttrs'.vendorStaging.overrideAttrs {
+            inherit (newAttrs) patches;
+            outputHash = "sha256-CegT8h+CJ6axipAD6E9drtrPJ9izRy/UCW14rbva5XA=";
+          };
+        });
+
+        # https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/merge_requests/1801/
+        patches = oldAttrs.patches or [ ] ++ [
+          ./spotify-access-token-auth.patch
+        ];
+      }
+    ))
     pipewire
   ];
 
diff --git a/pkgs/applications/audio/mopidy/spotify-access-token-auth.patch b/pkgs/applications/audio/mopidy/spotify-access-token-auth.patch
new file mode 100644
index 000000000000..495ffa519304
--- /dev/null
+++ b/pkgs/applications/audio/mopidy/spotify-access-token-auth.patch
@@ -0,0 +1,2231 @@
+From a9a05b3b62ba22d841d1e19e23d7fc0bee95ba05 Mon Sep 17 00:00:00 2001
+From: kingosticks <nick@nsteel.co.uk>
+Date: Tue, 22 Oct 2024 23:45:17 +0100
+Subject: [PATCH 1/2] net/quinn: Fix test panic due to unset default crypto
+ provider
+
+If another dep in the workspace pulls in a different rustls crypto
+provider then we need to explicitly specify our default provider.
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/merge_requests/1801>
+(cherry picked from commit a81b7f380fc11fb58994dc9c7a50dafa58314ccf)
+---
+ net/quinn/tests/quinnquic.rs | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/quinn/tests/quinnquic.rs b/net/quinn/tests/quinnquic.rs
+index 911ce520..0e071f37 100644
+--- a/net/quinn/tests/quinnquic.rs
++++ b/net/quinn/tests/quinnquic.rs
+@@ -18,6 +18,9 @@ fn init() {
+     INIT.call_once(|| {
+         gst::init().unwrap();
+         gstquinn::plugin_register_static().expect("QUIC source sink send receive tests");
++        rustls::crypto::ring::default_provider()
++            .install_default()
++            .expect("Failed to install ring crypto provider");
+     });
+ }
+ 
+-- 
+2.47.0
+
+
+From ff8190b271d5ae15fb5e91e5440a0766cb968ac7 Mon Sep 17 00:00:00 2001
+From: Guillaume Desmottes <guillaume.desmottes@onestream.live>
+Date: Wed, 15 Dec 2021 17:15:20 +0100
+Subject: [PATCH 2/2] spotify: replace username/password auth with access
+ token.
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/merge_requests/1801>
+---
+ Cargo.lock                               | 1064 +++++++++++++++++-----
+ audio/spotify/Cargo.toml                 |    6 +-
+ audio/spotify/README.md                  |   25 +-
+ audio/spotify/src/common.rs              |  141 ++-
+ audio/spotify/src/spotifyaudiosrc/imp.rs |   19 +-
+ docs/plugins/gst_plugins_cache.json      |   12 +
+ 6 files changed, 954 insertions(+), 313 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 99cec70b..9a81bdb1 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -19,45 +19,13 @@ checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+ 
+ [[package]]
+ name = "aes"
+-version = "0.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "884391ef1066acaa41e766ba8f596341b96e93ce34f9a43e7d24bf0a0eaf0561"
+-dependencies = [
+- "aes-soft",
+- "aesni",
+- "cipher",
+-]
+-
+-[[package]]
+-name = "aes-ctr"
+-version = "0.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7729c3cde54d67063be556aeac75a81330d802f0259500ca40cb52967f975763"
+-dependencies = [
+- "aes-soft",
+- "aesni",
+- "cipher",
+- "ctr",
+-]
+-
+-[[package]]
+-name = "aes-soft"
+-version = "0.6.4"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "be14c7498ea50828a38d0e24a765ed2effe92a705885b57d029cd67d45744072"
+-dependencies = [
+- "cipher",
+- "opaque-debug",
+-]
+-
+-[[package]]
+-name = "aesni"
+-version = "0.10.0"
++version = "0.8.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ea2e11f5e94c2f7d386164cc2aa1f97823fed6f259e486940a71c174dd01b0ce"
++checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+ dependencies = [
++ "cfg-if",
+  "cipher",
+- "opaque-debug",
++ "cpufeatures",
+ ]
+ 
+ [[package]]
+@@ -70,7 +38,7 @@ dependencies = [
+  "getrandom",
+  "once_cell",
+  "version_check",
+- "zerocopy 0.7.35",
++ "zerocopy",
+ ]
+ 
+ [[package]]
+@@ -160,9 +128,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "anyhow"
+-version = "1.0.92"
++version = "1.0.95"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "74f37166d7d48a0284b99dd824694c26119c700b53bf0d1540cdb147dbdaaf13"
++checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+ 
+ [[package]]
+ name = "arbitrary"
+@@ -367,6 +335,31 @@ dependencies = [
+  "zeroize",
+ ]
+ 
++[[package]]
++name = "aws-lc-rs"
++version = "1.12.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f409eb70b561706bf8abba8ca9c112729c481595893fd06a2dd9af8ed8441148"
++dependencies = [
++ "aws-lc-sys",
++ "paste",
++ "zeroize",
++]
++
++[[package]]
++name = "aws-lc-sys"
++version = "0.24.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "923ded50f602b3007e5e63e3f094c479d9c8a9b42d7f4034e4afe456aa48bfd2"
++dependencies = [
++ "bindgen",
++ "cc",
++ "cmake",
++ "dunce",
++ "fs_extra",
++ "paste",
++]
++
+ [[package]]
+ name = "aws-runtime"
+ version = "1.2.0"
+@@ -458,7 +451,7 @@ dependencies = [
+  "bytes",
+  "fastrand",
+  "hex",
+- "hmac 0.12.1",
++ "hmac",
+  "http 0.2.12",
+  "http-body 0.4.6",
+  "lru",
+@@ -600,7 +593,7 @@ dependencies = [
+  "crypto-bigint 0.5.5",
+  "form_urlencoded",
+  "hex",
+- "hmac 0.12.1",
++ "hmac",
+  "http 0.2.12",
+  "http 1.1.0",
+  "once_cell",
+@@ -866,6 +859,29 @@ dependencies = [
+  "serde",
+ ]
+ 
++[[package]]
++name = "bindgen"
++version = "0.69.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
++dependencies = [
++ "bitflags 2.6.0",
++ "cexpr",
++ "clang-sys",
++ "itertools 0.12.1",
++ "lazy_static",
++ "lazycell",
++ "log",
++ "prettyplease",
++ "proc-macro2",
++ "quote",
++ "regex",
++ "rustc-hash 1.1.0",
++ "shlex",
++ "syn 2.0.86",
++ "which",
++]
++
+ [[package]]
+ name = "bitflags"
+ version = "1.3.2"
+@@ -884,15 +900,6 @@ version = "2.3.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7c12d1856e42f0d817a835fe55853957c85c8c8a470114029143d3f12671446e"
+ 
+-[[package]]
+-name = "block-buffer"
+-version = "0.9.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+-dependencies = [
+- "generic-array",
+-]
+-
+ [[package]]
+ name = "block-buffer"
+ version = "0.10.4"
+@@ -1040,6 +1047,15 @@ dependencies = [
+  "thiserror",
+ ]
+ 
++[[package]]
++name = "cexpr"
++version = "0.6.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
++dependencies = [
++ "nom",
++]
++
+ [[package]]
+ name = "cfg-expr"
+ version = "0.15.8"
+@@ -1089,11 +1105,23 @@ dependencies = [
+ 
+ [[package]]
+ name = "cipher"
+-version = "0.2.5"
++version = "0.4.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "12f8e7987cbd042a63249497f41aed09f8e65add917ea6566effbc56578d6801"
++checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+ dependencies = [
+- "generic-array",
++ "crypto-common",
++ "inout",
++]
++
++[[package]]
++name = "clang-sys"
++version = "1.8.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
++dependencies = [
++ "glob",
++ "libc",
++ "libloading",
+ ]
+ 
+ [[package]]
+@@ -1142,6 +1170,15 @@ version = "0.4.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "4bfbf56724aa9eca8afa4fcfadeb479e722935bb2a0900c2d37e0cc477af0688"
+ 
++[[package]]
++name = "cmake"
++version = "0.1.52"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c682c223677e0e5b6b7f63a64b9351844c3f1b1678a68b7ee617e30fb082620e"
++dependencies = [
++ "cc",
++]
++
+ [[package]]
+ name = "color-name"
+ version = "1.1.0"
+@@ -1231,6 +1268,16 @@ dependencies = [
+  "libc",
+ ]
+ 
++[[package]]
++name = "core-foundation"
++version = "0.10.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
++dependencies = [
++ "core-foundation-sys",
++ "libc",
++]
++
+ [[package]]
+ name = "core-foundation-sys"
+ version = "0.8.7"
+@@ -1330,16 +1377,6 @@ dependencies = [
+  "typenum",
+ ]
+ 
+-[[package]]
+-name = "crypto-mac"
+-version = "0.11.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "25fab6889090c8133f3deb8f73ba3c65a7f456f66436fc012a1b1e272b1e103e"
+-dependencies = [
+- "generic-array",
+- "subtle",
+-]
+-
+ [[package]]
+ name = "csound"
+ version = "0.1.8"
+@@ -1364,9 +1401,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ctr"
+-version = "0.6.0"
++version = "0.9.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fb4a30d54f7443bf3d6191dcd486aca19e67cb3c49fa7a06a319966346707e7f"
++checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+ dependencies = [
+  "cipher",
+ ]
+@@ -1497,6 +1534,17 @@ dependencies = [
+  "zeroize",
+ ]
+ 
++[[package]]
++name = "der"
++version = "0.7.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
++dependencies = [
++ "const-oid",
++ "pem-rfc7468",
++ "zeroize",
++]
++
+ [[package]]
+ name = "deranged"
+ version = "0.3.11"
+@@ -1508,27 +1556,50 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "diff"
+-version = "0.1.13"
++name = "derive_builder"
++version = "0.20.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
++checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
++dependencies = [
++ "derive_builder_macro",
++]
+ 
+ [[package]]
+-name = "digest"
+-version = "0.9.0"
++name = "derive_builder_core"
++version = "0.20.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
++checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+ dependencies = [
+- "generic-array",
++ "darling",
++ "proc-macro2",
++ "quote",
++ "syn 2.0.86",
++]
++
++[[package]]
++name = "derive_builder_macro"
++version = "0.20.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
++dependencies = [
++ "derive_builder_core",
++ "syn 2.0.86",
+ ]
+ 
++[[package]]
++name = "diff"
++version = "0.1.13"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
++
+ [[package]]
+ name = "digest"
+ version = "0.10.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+ dependencies = [
+- "block-buffer 0.10.4",
++ "block-buffer",
++ "const-oid",
+  "crypto-common",
+  "subtle",
+ ]
+@@ -1545,6 +1616,12 @@ dependencies = [
+  "rgb",
+ ]
+ 
++[[package]]
++name = "dunce"
++version = "1.0.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
++
+ [[package]]
+ name = "ebml-iterable"
+ version = "0.6.2"
+@@ -1592,10 +1669,10 @@ version = "0.14.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
+ dependencies = [
+- "der",
++ "der 0.6.1",
+  "elliptic-curve",
+  "rfc6979",
+- "signature",
++ "signature 1.6.4",
+ ]
+ 
+ [[package]]
+@@ -1604,7 +1681,7 @@ version = "1.5.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "91cff35c70bba8a626e3185d8cd48cc11b5437e1a5bcd15b9b5fa3c64b6dfee7"
+ dependencies = [
+- "signature",
++ "signature 1.6.4",
+ ]
+ 
+ [[package]]
+@@ -1621,12 +1698,12 @@ checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
+ dependencies = [
+  "base16ct",
+  "crypto-bigint 0.4.9",
+- "der",
+- "digest 0.10.7",
++ "der 0.6.1",
++ "digest",
+  "ff",
+  "generic-array",
+  "group",
+- "pkcs8",
++ "pkcs8 0.9.0",
+  "rand_core",
+  "sec1",
+  "subtle",
+@@ -1834,6 +1911,12 @@ dependencies = [
+  "autocfg",
+ ]
+ 
++[[package]]
++name = "fs_extra"
++version = "1.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
++
+ [[package]]
+ name = "fst"
+ version = "0.4.7"
+@@ -1911,6 +1994,12 @@ version = "0.3.31"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+ 
++[[package]]
++name = "futures-timer"
++version = "3.0.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
++
+ [[package]]
+ name = "futures-util"
+ version = "0.3.31"
+@@ -2175,6 +2264,24 @@ dependencies = [
+  "system-deps 7.0.3",
+ ]
+ 
++[[package]]
++name = "governor"
++version = "0.6.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "68a7f542ee6b35af73b06abc0dad1c1bae89964e4e253bc4b587b91c9637867b"
++dependencies = [
++ "cfg-if",
++ "futures",
++ "futures-timer",
++ "no-std-compat",
++ "nonzero_ext",
++ "parking_lot",
++ "portable-atomic",
++ "rand",
++ "smallvec",
++ "spinning_top",
++]
++
+ [[package]]
+ name = "graphene-rs"
+ version = "0.20.5"
+@@ -3725,21 +3832,20 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+ 
+ [[package]]
+ name = "hmac"
+-version = "0.11.0"
++version = "0.12.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
++checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+ dependencies = [
+- "crypto-mac",
+- "digest 0.9.0",
++ "digest",
+ ]
+ 
+ [[package]]
+-name = "hmac"
+-version = "0.12.1"
++name = "home"
++version = "0.5.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
++checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+ dependencies = [
+- "digest 0.10.7",
++ "windows-sys 0.59.0",
+ ]
+ 
+ [[package]]
+@@ -3885,18 +3991,24 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "hyper-proxy"
+-version = "0.9.1"
++name = "hyper-proxy2"
++version = "0.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ca815a891b24fdfb243fa3239c86154392b0953ee584aa1a2a1f66d20cbe75cc"
++checksum = "9043b7b23fb0bc4a1c7014c27b50a4fc42cc76206f71d34fc0dfe5b28ddc3faf"
+ dependencies = [
+  "bytes",
+- "futures",
+- "headers 0.3.9",
+- "http 0.2.12",
+- "hyper 0.14.31",
++ "futures-util",
++ "headers 0.4.0",
++ "http 1.1.0",
++ "hyper 1.5.0",
++ "hyper-rustls 0.26.0",
++ "hyper-util",
++ "pin-project-lite",
++ "rustls-native-certs 0.7.3",
+  "tokio",
++ "tokio-rustls 0.25.0",
+  "tower-service",
++ "webpki",
+ ]
+ 
+ [[package]]
+@@ -3910,11 +4022,30 @@ dependencies = [
+  "hyper 0.14.31",
+  "log",
+  "rustls 0.21.12",
+- "rustls-native-certs",
++ "rustls-native-certs 0.6.3",
+  "tokio",
+  "tokio-rustls 0.24.1",
+ ]
+ 
++[[package]]
++name = "hyper-rustls"
++version = "0.26.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
++dependencies = [
++ "futures-util",
++ "http 1.1.0",
++ "hyper 1.5.0",
++ "hyper-util",
++ "log",
++ "rustls 0.22.4",
++ "rustls-native-certs 0.7.3",
++ "rustls-pki-types",
++ "tokio",
++ "tokio-rustls 0.25.0",
++ "tower-service",
++]
++
+ [[package]]
+ name = "hyper-rustls"
+ version = "0.27.3"
+@@ -3925,7 +4056,9 @@ dependencies = [
+  "http 1.1.0",
+  "hyper 1.5.0",
+  "hyper-util",
++ "log",
+  "rustls 0.23.16",
++ "rustls-native-certs 0.8.1",
+  "rustls-pki-types",
+  "tokio",
+  "tokio-rustls 0.26.0",
+@@ -4014,7 +4147,7 @@ dependencies = [
+  "iana-time-zone-haiku",
+  "js-sys",
+  "wasm-bindgen",
+- "windows-core",
++ "windows-core 0.52.0",
+ ]
+ 
+ [[package]]
+@@ -4104,6 +4237,15 @@ dependencies = [
+  "serde",
+ ]
+ 
++[[package]]
++name = "inout"
++version = "0.1.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
++dependencies = [
++ "generic-array",
++]
++
+ [[package]]
+ name = "interpolate_name"
+ version = "0.2.4"
+@@ -4214,6 +4356,15 @@ name = "lazy_static"
+ version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
++dependencies = [
++ "spin",
++]
++
++[[package]]
++name = "lazycell"
++version = "1.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+ 
+ [[package]]
+ name = "lewton"
+@@ -4222,7 +4373,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "777b48df9aaab155475a83a7df3070395ea1ac6902f5cd062b8f2b028075c030"
+ dependencies = [
+  "byteorder",
+- "ogg",
+  "tinyvec",
+ ]
+ 
+@@ -4261,86 +4411,119 @@ checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
+ 
+ [[package]]
+ name = "librespot-audio"
+-version = "0.4.2"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c176a31355e1ea8e0b9c4ced19df4947bfe4770661c25c142b6fba2365940d9d"
++checksum = "5fbda070a5598b32718e497f585f46891f7113e64aff20a13c0f2ba8fe7ccad9"
+ dependencies = [
+- "aes-ctr",
+- "byteorder",
++ "aes",
+  "bytes",
++ "ctr",
+  "futures-util",
++ "http-body-util",
++ "hyper 1.5.0",
++ "hyper-util",
+  "librespot-core",
+  "log",
++ "parking_lot",
+  "tempfile",
++ "thiserror",
+  "tokio",
+ ]
+ 
+ [[package]]
+ name = "librespot-core"
+-version = "0.4.2"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "046349f25888e644bf02d9c5de0164b2a493d29aa4ce18e1ad0b756da9b55d6d"
++checksum = "505a5ddd966231755994b60435607a1e8ae1d41c7f1169b078e0511bfb82d931"
+ dependencies = [
+  "aes",
+- "base64 0.13.1",
++ "base64 0.22.1",
+  "byteorder",
+  "bytes",
++ "data-encoding",
+  "form_urlencoded",
+  "futures-core",
+  "futures-util",
+- "hmac 0.11.0",
+- "http 0.2.12",
++ "governor",
++ "hmac",
++ "http 1.1.0",
++ "http-body-util",
+  "httparse",
+- "hyper 0.14.31",
+- "hyper-proxy",
++ "hyper 1.5.0",
++ "hyper-proxy2",
++ "hyper-rustls 0.27.3",
++ "hyper-util",
++ "librespot-oauth",
+  "librespot-protocol",
+  "log",
++ "nonzero_ext",
+  "num-bigint",
++ "num-derive",
+  "num-integer",
+  "num-traits",
+  "once_cell",
++ "parking_lot",
+  "pbkdf2",
++ "pin-project-lite",
+  "priority-queue",
+  "protobuf",
++ "quick-xml 0.36.2",
+  "rand",
++ "rsa",
+  "serde",
+  "serde_json",
+- "sha-1",
++ "sha1",
+  "shannon",
++ "sysinfo",
+  "thiserror",
++ "time",
+  "tokio",
+  "tokio-stream",
++ "tokio-tungstenite 0.24.0",
+  "tokio-util",
+  "url",
+  "uuid",
+- "vergen",
++ "vergen-gitcl",
+ ]
+ 
+ [[package]]
+ name = "librespot-metadata"
+-version = "0.4.2"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6b80361fcbcb5092056fd47c08c34d5d51b08385d8efb6941c0d3e46d032c21c"
++checksum = "6a10ab5a390f65281e763cd09c617b173f0e665994eae3d242526924625fdc66"
+ dependencies = [
+  "async-trait",
+- "byteorder",
++ "bytes",
+  "librespot-core",
+  "librespot-protocol",
+  "log",
+  "protobuf",
++ "serde",
++ "serde_json",
++ "thiserror",
++ "uuid",
+ ]
+ 
+ [[package]]
+-name = "librespot-playback"
+-version = "0.4.2"
++name = "librespot-oauth"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5190a0b9bcc7f70ee4196a6b4a1c731d405ca130d4a6fcd4c561cfdde8b7cfb7"
++checksum = "57bda94233b358fb41c04ed15507c61136c80efe876c6e05a10ddb9a182b144e"
+ dependencies = [
+- "byteorder",
+- "futures-executor",
+- "futures-util",
+- "lewton",
+- "librespot-audio",
++ "log",
++ "oauth2",
++ "thiserror",
++ "url",
++]
++
++[[package]]
++name = "librespot-playback"
++version = "0.5.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5b1bcfe1d72c5ac14c798c7e3e1c20e1fb6af2b9c254794545cfcb1f2a4627e2"
++dependencies = [
++ "futures-util",
++ "librespot-audio",
+  "librespot-core",
+  "librespot-metadata",
+  "log",
+@@ -4349,20 +4532,20 @@ dependencies = [
+  "rand",
+  "rand_distr",
+  "shell-words",
++ "symphonia",
+  "thiserror",
+  "tokio",
+- "zerocopy 0.6.6",
++ "zerocopy",
+ ]
+ 
+ [[package]]
+ name = "librespot-protocol"
+-version = "0.4.2"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5d6d3ac6196ac0ea67bbe039f56d6730a5d8b31502ef9bce0f504ed729dcb39f"
++checksum = "0d6f343f573e0469d3ff8a02b99bbd9789faa01e2ff167332542ac840a8b31e7"
+ dependencies = [
+- "glob",
+  "protobuf",
+- "protobuf-codegen-pure",
++ "protobuf-codegen",
+ ]
+ 
+ [[package]]
+@@ -4496,7 +4679,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+ dependencies = [
+  "cfg-if",
+- "digest 0.10.7",
++ "digest",
+ ]
+ 
+ [[package]]
+@@ -4624,7 +4807,7 @@ dependencies = [
+  "openssl-probe",
+  "openssl-sys",
+  "schannel",
+- "security-framework",
++ "security-framework 2.11.1",
+  "security-framework-sys",
+  "tempfile",
+ ]
+@@ -4657,6 +4840,12 @@ dependencies = [
+  "rustfft",
+ ]
+ 
++[[package]]
++name = "no-std-compat"
++version = "0.4.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b93853da6d84c2e3c7d730d6473e8817692dd89be387eb01b94d7f108ecb5b8c"
++
+ [[package]]
+ name = "nom"
+ version = "7.1.3"
+@@ -4667,12 +4856,27 @@ dependencies = [
+  "minimal-lexical",
+ ]
+ 
++[[package]]
++name = "nonzero_ext"
++version = "0.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
++
+ [[package]]
+ name = "noop_proc_macro"
+ version = "0.3.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
+ 
++[[package]]
++name = "ntapi"
++version = "0.4.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4"
++dependencies = [
++ "winapi",
++]
++
+ [[package]]
+ name = "nu-ansi-term"
+ version = "0.46.0"
+@@ -4694,6 +4898,23 @@ dependencies = [
+  "rand",
+ ]
+ 
++[[package]]
++name = "num-bigint-dig"
++version = "0.8.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
++dependencies = [
++ "byteorder",
++ "lazy_static",
++ "libm",
++ "num-integer",
++ "num-iter",
++ "num-traits",
++ "rand",
++ "smallvec",
++ "zeroize",
++]
++
+ [[package]]
+ name = "num-complex"
+ version = "0.4.6"
+@@ -4729,6 +4950,17 @@ dependencies = [
+  "num-traits",
+ ]
+ 
++[[package]]
++name = "num-iter"
++version = "0.1.45"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
++dependencies = [
++ "autocfg",
++ "num-integer",
++ "num-traits",
++]
++
+ [[package]]
+ name = "num-rational"
+ version = "0.4.2"
+@@ -4761,6 +4993,35 @@ dependencies = [
+  "libc",
+ ]
+ 
++[[package]]
++name = "num_threads"
++version = "0.1.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "oauth2"
++version = "4.4.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c38841cdd844847e3e7c8d29cef9dcfed8877f8f56f9071f77843ecf3baf937f"
++dependencies = [
++ "base64 0.13.1",
++ "chrono",
++ "getrandom",
++ "http 0.2.12",
++ "rand",
++ "reqwest 0.11.27",
++ "serde",
++ "serde_json",
++ "serde_path_to_error",
++ "sha2",
++ "thiserror",
++ "url",
++]
++
+ [[package]]
+ name = "object"
+ version = "0.36.5"
+@@ -4772,9 +5033,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ogg"
+-version = "0.8.0"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6951b4e8bf21c8193da321bcce9c9dd2e13c858fe078bf9054a288b419ae5d6e"
++checksum = "5477016638150530ba21dec7caac835b29ef69b20865751d2973fce6be386cf1"
+ dependencies = [
+  "byteorder",
+ ]
+@@ -4785,12 +5046,6 @@ version = "1.20.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+ 
+-[[package]]
+-name = "opaque-debug"
+-version = "0.3.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+-
+ [[package]]
+ name = "openssl"
+ version = "0.10.68"
+@@ -5002,12 +5257,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "pbkdf2"
+-version = "0.8.0"
++version = "0.12.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d95f5254224e617595d2cc3cc73ff0a5eaf2637519e25f03388154e9378b6ffa"
++checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+ dependencies = [
+- "crypto-mac",
+- "hmac 0.11.0",
++ "digest",
++ "hmac",
+ ]
+ 
+ [[package]]
+@@ -5020,6 +5275,15 @@ dependencies = [
+  "serde",
+ ]
+ 
++[[package]]
++name = "pem-rfc7468"
++version = "0.7.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
++dependencies = [
++ "base64ct",
++]
++
+ [[package]]
+ name = "percent-encoding"
+ version = "2.3.1"
+@@ -5068,14 +5332,35 @@ version = "0.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+ 
++[[package]]
++name = "pkcs1"
++version = "0.7.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
++dependencies = [
++ "der 0.7.9",
++ "pkcs8 0.10.2",
++ "spki 0.7.3",
++]
++
+ [[package]]
+ name = "pkcs8"
+ version = "0.9.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
+ dependencies = [
+- "der",
+- "spki",
++ "der 0.6.1",
++ "spki 0.6.0",
++]
++
++[[package]]
++name = "pkcs8"
++version = "0.10.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
++dependencies = [
++ "der 0.7.9",
++ "spki 0.7.3",
+ ]
+ 
+ [[package]]
+@@ -5118,6 +5403,12 @@ dependencies = [
+  "windows-sys 0.59.0",
+ ]
+ 
++[[package]]
++name = "portable-atomic"
++version = "1.10.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
++
+ [[package]]
+ name = "powerfmt"
+ version = "0.2.0"
+@@ -5130,7 +5421,7 @@ version = "0.2.20"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+ dependencies = [
+- "zerocopy 0.7.35",
++ "zerocopy",
+ ]
+ 
+ [[package]]
+@@ -5164,12 +5455,13 @@ dependencies = [
+ 
+ [[package]]
+ name = "priority-queue"
+-version = "1.4.0"
++version = "2.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a0bda9164fe05bc9225752d54aae413343c36f684380005398a6a8fde95fe785"
++checksum = "714c75db297bc88a63783ffc6ab9f830698a6705aa0201416931759ef4c8183d"
+ dependencies = [
+  "autocfg",
+- "indexmap 1.9.3",
++ "equivalent",
++ "indexmap 2.6.0",
+ ]
+ 
+ [[package]]
+@@ -5288,27 +5580,53 @@ dependencies = [
+ 
+ [[package]]
+ name = "protobuf"
+-version = "2.28.0"
++version = "3.7.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
++checksum = "a3a7c64d9bf75b1b8d981124c14c179074e8caa7dfe7b6a12e6222ddcd0c8f72"
++dependencies = [
++ "once_cell",
++ "protobuf-support",
++ "thiserror",
++]
+ 
+ [[package]]
+ name = "protobuf-codegen"
+-version = "2.28.0"
++version = "3.7.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "033460afb75cf755fcfc16dfaed20b86468082a2ea24e05ac35ab4a099a017d6"
++checksum = "e26b833f144769a30e04b1db0146b2aaa53fd2fd83acf10a6b5f996606c18144"
+ dependencies = [
++ "anyhow",
++ "once_cell",
+  "protobuf",
++ "protobuf-parse",
++ "regex",
++ "tempfile",
++ "thiserror",
+ ]
+ 
+ [[package]]
+-name = "protobuf-codegen-pure"
+-version = "2.28.0"
++name = "protobuf-parse"
++version = "3.7.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "95a29399fc94bcd3eeaa951c715f7bea69409b2445356b00519740bcd6ddd865"
++checksum = "322330e133eab455718444b4e033ebfac7c6528972c784fcde28d2cc783c6257"
+ dependencies = [
++ "anyhow",
++ "indexmap 2.6.0",
++ "log",
+  "protobuf",
+- "protobuf-codegen",
++ "protobuf-support",
++ "tempfile",
++ "thiserror",
++ "which",
++]
++
++[[package]]
++name = "protobuf-support"
++version = "3.7.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b088fd20b938a875ea00843b6faf48579462630015c3788d397ad6a786663252"
++dependencies = [
++ "thiserror",
+ ]
+ 
+ [[package]]
+@@ -5357,7 +5675,7 @@ dependencies = [
+  "pin-project-lite",
+  "quinn-proto",
+  "quinn-udp",
+- "rustc-hash",
++ "rustc-hash 2.0.0",
+  "rustls 0.23.16",
+  "socket2",
+  "thiserror",
+@@ -5374,7 +5692,7 @@ dependencies = [
+  "bytes",
+  "rand",
+  "ring",
+- "rustc-hash",
++ "rustc-hash 2.0.0",
+  "rustls 0.23.16",
+  "slab",
+  "thiserror",
+@@ -5603,6 +5921,7 @@ dependencies = [
+  "http 0.2.12",
+  "http-body 0.4.6",
+  "hyper 0.14.31",
++ "hyper-rustls 0.24.2",
+  "hyper-tls 0.5.0",
+  "ipnet",
+  "js-sys",
+@@ -5612,6 +5931,7 @@ dependencies = [
+  "once_cell",
+  "percent-encoding",
+  "pin-project-lite",
++ "rustls 0.21.12",
+  "rustls-pemfile 1.0.4",
+  "serde",
+  "serde_json",
+@@ -5620,11 +5940,13 @@ dependencies = [
+  "system-configuration 0.5.1",
+  "tokio",
+  "tokio-native-tls",
++ "tokio-rustls 0.24.1",
+  "tower-service",
+  "url",
+  "wasm-bindgen",
+  "wasm-bindgen-futures",
+  "web-sys",
++ "webpki-roots",
+  "winreg",
+ ]
+ 
+@@ -5682,7 +6004,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
+ dependencies = [
+  "crypto-bigint 0.4.9",
+- "hmac 0.12.1",
++ "hmac",
+  "zeroize",
+ ]
+ 
+@@ -5710,6 +6032,26 @@ dependencies = [
+  "windows-sys 0.52.0",
+ ]
+ 
++[[package]]
++name = "rsa"
++version = "0.9.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "47c75d7c5c6b673e58bf54d8544a9f432e3a925b0e80f7cd3602ab5c50c55519"
++dependencies = [
++ "const-oid",
++ "digest",
++ "num-bigint-dig",
++ "num-integer",
++ "num-traits",
++ "pkcs1",
++ "pkcs8 0.10.2",
++ "rand_core",
++ "signature 2.2.0",
++ "spki 0.7.3",
++ "subtle",
++ "zeroize",
++]
++
+ [[package]]
+ name = "rtcp-types"
+ version = "0.1.0"
+@@ -5759,6 +6101,12 @@ version = "0.1.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+ 
++[[package]]
++name = "rustc-hash"
++version = "1.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
++
+ [[package]]
+ name = "rustc-hash"
+ version = "2.0.0"
+@@ -5823,12 +6171,28 @@ dependencies = [
+  "sct",
+ ]
+ 
++[[package]]
++name = "rustls"
++version = "0.22.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
++dependencies = [
++ "log",
++ "ring",
++ "rustls-pki-types",
++ "rustls-webpki 0.102.8",
++ "subtle",
++ "zeroize",
++]
++
+ [[package]]
+ name = "rustls"
+ version = "0.23.16"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "eee87ff5d9b36712a58574e12e9f0ea80f915a5b0ac518d322b24a465617925e"
+ dependencies = [
++ "aws-lc-rs",
++ "log",
+  "once_cell",
+  "ring",
+  "rustls-pki-types",
+@@ -5846,7 +6210,32 @@ dependencies = [
+  "openssl-probe",
+  "rustls-pemfile 1.0.4",
+  "schannel",
+- "security-framework",
++ "security-framework 2.11.1",
++]
++
++[[package]]
++name = "rustls-native-certs"
++version = "0.7.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
++dependencies = [
++ "openssl-probe",
++ "rustls-pemfile 2.2.0",
++ "rustls-pki-types",
++ "schannel",
++ "security-framework 2.11.1",
++]
++
++[[package]]
++name = "rustls-native-certs"
++version = "0.8.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
++dependencies = [
++ "openssl-probe",
++ "rustls-pki-types",
++ "schannel",
++ "security-framework 3.1.0",
+ ]
+ 
+ [[package]]
+@@ -5889,11 +6278,18 @@ version = "0.102.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+ dependencies = [
++ "aws-lc-rs",
+  "ring",
+  "rustls-pki-types",
+  "untrusted",
+ ]
+ 
++[[package]]
++name = "rustversion"
++version = "1.0.19"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
++
+ [[package]]
+ name = "ryu"
+ version = "1.0.18"
+@@ -5972,9 +6368,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
+ dependencies = [
+  "base16ct",
+- "der",
++ "der 0.6.1",
+  "generic-array",
+- "pkcs8",
++ "pkcs8 0.9.0",
+  "subtle",
+  "zeroize",
+ ]
+@@ -5986,7 +6382,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+ dependencies = [
+  "bitflags 2.6.0",
+- "core-foundation",
++ "core-foundation 0.9.4",
++ "core-foundation-sys",
++ "libc",
++ "security-framework-sys",
++]
++
++[[package]]
++name = "security-framework"
++version = "3.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "81d3f8c9bfcc3cbb6b0179eb57042d75b1582bdc65c3cb95f3fa999509c03cbc"
++dependencies = [
++ "bitflags 2.6.0",
++ "core-foundation 0.10.0",
+  "core-foundation-sys",
+  "libc",
+  "security-framework-sys",
+@@ -5994,9 +6403,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "security-framework-sys"
+-version = "2.12.0"
++version = "2.13.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ea4a292869320c0272d7bc55a5a6aafaff59b4f63404a003887b679a2e05b4b6"
++checksum = "1863fd3768cd83c56a7f60faa4dc0d403f1b6df0a38c3c25f44b7894e45370d5"
+ dependencies = [
+  "core-foundation-sys",
+  "libc",
+@@ -6135,19 +6544,6 @@ dependencies = [
+  "syn 2.0.86",
+ ]
+ 
+-[[package]]
+-name = "sha-1"
+-version = "0.9.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
+-dependencies = [
+- "block-buffer 0.9.0",
+- "cfg-if",
+- "cpufeatures",
+- "digest 0.9.0",
+- "opaque-debug",
+-]
+-
+ [[package]]
+ name = "sha1"
+ version = "0.10.6"
+@@ -6156,7 +6552,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+ dependencies = [
+  "cfg-if",
+  "cpufeatures",
+- "digest 0.10.7",
++ "digest",
+ ]
+ 
+ [[package]]
+@@ -6167,7 +6563,7 @@ checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+ dependencies = [
+  "cfg-if",
+  "cpufeatures",
+- "digest 0.10.7",
++ "digest",
+ ]
+ 
+ [[package]]
+@@ -6225,7 +6621,17 @@ version = "1.6.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+ dependencies = [
+- "digest 0.10.7",
++ "digest",
++ "rand_core",
++]
++
++[[package]]
++name = "signature"
++version = "2.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
++dependencies = [
++ "digest",
+  "rand_core",
+ ]
+ 
+@@ -6296,6 +6702,15 @@ dependencies = [
+  "lock_api",
+ ]
+ 
++[[package]]
++name = "spinning_top"
++version = "0.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
++dependencies = [
++ "lock_api",
++]
++
+ [[package]]
+ name = "spki"
+ version = "0.6.0"
+@@ -6303,7 +6718,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
+ dependencies = [
+  "base64ct",
+- "der",
++ "der 0.6.1",
++]
++
++[[package]]
++name = "spki"
++version = "0.7.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
++dependencies = [
++ "base64ct",
++ "der 0.7.9",
+ ]
+ 
+ [[package]]
+@@ -6345,6 +6770,90 @@ version = "2.6.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+ 
++[[package]]
++name = "symphonia"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "815c942ae7ee74737bb00f965fa5b5a2ac2ce7b6c01c0cc169bbeaf7abd5f5a9"
++dependencies = [
++ "lazy_static",
++ "symphonia-bundle-mp3",
++ "symphonia-codec-vorbis",
++ "symphonia-core",
++ "symphonia-format-ogg",
++ "symphonia-metadata",
++]
++
++[[package]]
++name = "symphonia-bundle-mp3"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c01c2aae70f0f1fb096b6f0ff112a930b1fb3626178fba3ae68b09dce71706d4"
++dependencies = [
++ "lazy_static",
++ "log",
++ "symphonia-core",
++ "symphonia-metadata",
++]
++
++[[package]]
++name = "symphonia-codec-vorbis"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5a98765fb46a0a6732b007f7e2870c2129b6f78d87db7987e6533c8f164a9f30"
++dependencies = [
++ "log",
++ "symphonia-core",
++ "symphonia-utils-xiph",
++]
++
++[[package]]
++name = "symphonia-core"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "798306779e3dc7d5231bd5691f5a813496dc79d3f56bf82e25789f2094e022c3"
++dependencies = [
++ "arrayvec",
++ "bitflags 1.3.2",
++ "bytemuck",
++ "lazy_static",
++ "log",
++]
++
++[[package]]
++name = "symphonia-format-ogg"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ada3505789516bcf00fc1157c67729eded428b455c27ca370e41f4d785bfa931"
++dependencies = [
++ "log",
++ "symphonia-core",
++ "symphonia-metadata",
++ "symphonia-utils-xiph",
++]
++
++[[package]]
++name = "symphonia-metadata"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bc622b9841a10089c5b18e99eb904f4341615d5aa55bbf4eedde1be721a4023c"
++dependencies = [
++ "encoding_rs",
++ "lazy_static",
++ "log",
++ "symphonia-core",
++]
++
++[[package]]
++name = "symphonia-utils-xiph"
++version = "0.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "484472580fa49991afda5f6550ece662237b00c6f562c7d9638d1b086ed010fe"
++dependencies = [
++ "symphonia-core",
++ "symphonia-metadata",
++]
++
+ [[package]]
+ name = "syn"
+ version = "1.0.109"
+@@ -6382,6 +6891,19 @@ dependencies = [
+  "futures-core",
+ ]
+ 
++[[package]]
++name = "sysinfo"
++version = "0.31.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "355dbe4f8799b304b05e1b0f05fc59b2a18d36645cf169607da45bde2f69a1be"
++dependencies = [
++ "core-foundation-sys",
++ "libc",
++ "memchr",
++ "ntapi",
++ "windows",
++]
++
+ [[package]]
+ name = "system-configuration"
+ version = "0.5.1"
+@@ -6389,7 +6911,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+ dependencies = [
+  "bitflags 1.3.2",
+- "core-foundation",
++ "core-foundation 0.9.4",
+  "system-configuration-sys 0.5.0",
+ ]
+ 
+@@ -6400,7 +6922,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+ dependencies = [
+  "bitflags 2.6.0",
+- "core-foundation",
++ "core-foundation 0.9.4",
+  "system-configuration-sys 0.6.0",
+ ]
+ 
+@@ -6563,7 +7085,9 @@ checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
++ "libc",
+  "num-conv",
++ "num_threads",
+  "powerfmt",
+  "serde",
+  "time-core",
+@@ -6650,6 +7174,17 @@ dependencies = [
+  "tokio",
+ ]
+ 
++[[package]]
++name = "tokio-rustls"
++version = "0.25.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
++dependencies = [
++ "rustls 0.22.4",
++ "rustls-pki-types",
++ "tokio",
++]
++
+ [[package]]
+ name = "tokio-rustls"
+ version = "0.26.0"
+@@ -6698,6 +7233,22 @@ dependencies = [
+  "tungstenite 0.21.0",
+ ]
+ 
++[[package]]
++name = "tokio-tungstenite"
++version = "0.24.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
++dependencies = [
++ "futures-util",
++ "log",
++ "rustls 0.23.16",
++ "rustls-native-certs 0.8.1",
++ "rustls-pki-types",
++ "tokio",
++ "tokio-rustls 0.26.0",
++ "tungstenite 0.24.0",
++]
++
+ [[package]]
+ name = "tokio-util"
+ version = "0.7.12"
+@@ -6882,6 +7433,8 @@ dependencies = [
+  "log",
+  "native-tls",
+  "rand",
++ "rustls 0.23.16",
++ "rustls-pki-types",
+  "sha1",
+  "thiserror",
+  "url",
+@@ -6948,6 +7501,7 @@ dependencies = [
+  "form_urlencoded",
+  "idna 0.5.0",
+  "percent-encoding",
++ "serde",
+ ]
+ 
+ [[package]]
+@@ -6984,6 +7538,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f8c5f0a0af699448548ad1a2fbf920fb4bee257eae39953ba95cb84891a0446a"
+ dependencies = [
+  "getrandom",
++ "rand",
+ ]
+ 
+ [[package]]
+@@ -7017,13 +7572,40 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+ 
+ [[package]]
+ name = "vergen"
+-version = "3.2.0"
++version = "9.0.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e7141e445af09c8919f1d5f8a20dae0b20c3b57a45dee0d5823c6ed5d237f15a"
++checksum = "31f25fc8f8f05df455c7941e87f093ad22522a9ff33d7a027774815acf6f0639"
+ dependencies = [
+- "bitflags 1.3.2",
+- "chrono",
+- "rustc_version",
++ "anyhow",
++ "derive_builder",
++ "rustversion",
++ "time",
++ "vergen-lib",
++]
++
++[[package]]
++name = "vergen-gitcl"
++version = "1.0.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "0227006d09f98ab00ea69e9a5e055e676a813cfbed4232986176c86a6080b997"
++dependencies = [
++ "anyhow",
++ "derive_builder",
++ "rustversion",
++ "time",
++ "vergen",
++ "vergen-lib",
++]
++
++[[package]]
++name = "vergen-lib"
++version = "0.1.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c0c767e6751c09fc85cde58722cf2f1007e80e4c8d5a4321fc90d83dc54ca147"
++dependencies = [
++ "anyhow",
++ "derive_builder",
++ "rustversion",
+ ]
+ 
+ [[package]]
+@@ -7190,12 +7772,40 @@ dependencies = [
+  "ebml-iterable",
+ ]
+ 
++[[package]]
++name = "webpki"
++version = "0.22.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
++dependencies = [
++ "ring",
++ "untrusted",
++]
++
++[[package]]
++name = "webpki-roots"
++version = "0.25.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
++
+ [[package]]
+ name = "weezl"
+ version = "0.1.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
+ 
++[[package]]
++name = "which"
++version = "4.4.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
++dependencies = [
++ "either",
++ "home",
++ "once_cell",
++ "rustix",
++]
++
+ [[package]]
+ name = "winapi"
+ version = "0.3.9"
+@@ -7227,6 +7837,16 @@ version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+ 
++[[package]]
++name = "windows"
++version = "0.57.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143"
++dependencies = [
++ "windows-core 0.57.0",
++ "windows-targets 0.52.6",
++]
++
+ [[package]]
+ name = "windows-core"
+ version = "0.52.0"
+@@ -7236,17 +7856,60 @@ dependencies = [
+  "windows-targets 0.52.6",
+ ]
+ 
++[[package]]
++name = "windows-core"
++version = "0.57.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d"
++dependencies = [
++ "windows-implement",
++ "windows-interface",
++ "windows-result 0.1.2",
++ "windows-targets 0.52.6",
++]
++
++[[package]]
++name = "windows-implement"
++version = "0.57.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn 2.0.86",
++]
++
++[[package]]
++name = "windows-interface"
++version = "0.57.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn 2.0.86",
++]
++
+ [[package]]
+ name = "windows-registry"
+ version = "0.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "e400001bb720a623c1c69032f8e3e4cf09984deec740f007dd2b03ec864804b0"
+ dependencies = [
+- "windows-result",
++ "windows-result 0.2.0",
+  "windows-strings",
+  "windows-targets 0.52.6",
+ ]
+ 
++[[package]]
++name = "windows-result"
++version = "0.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5e383302e8ec8515204254685643de10811af0ed97ea37210dc26fb0032647f8"
++dependencies = [
++ "windows-targets 0.52.6",
++]
++
+ [[package]]
+ name = "windows-result"
+ version = "0.2.0"
+@@ -7262,7 +7925,7 @@ version = "0.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
+ dependencies = [
+- "windows-result",
++ "windows-result 0.2.0",
+  "windows-targets 0.52.6",
+ ]
+ 
+@@ -7480,16 +8143,6 @@ dependencies = [
+  "time",
+ ]
+ 
+-[[package]]
+-name = "zerocopy"
+-version = "0.6.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "854e949ac82d619ee9a14c66a1b674ac730422372ccb759ce0c39cabcf2bf8e6"
+-dependencies = [
+- "byteorder",
+- "zerocopy-derive 0.6.6",
+-]
+-
+ [[package]]
+ name = "zerocopy"
+ version = "0.7.35"
+@@ -7497,18 +8150,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+ dependencies = [
+  "byteorder",
+- "zerocopy-derive 0.7.35",
+-]
+-
+-[[package]]
+-name = "zerocopy-derive"
+-version = "0.6.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "125139de3f6b9d625c39e2efdd73d41bdac468ccd556556440e322be0e1bbd91"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn 2.0.86",
++ "zerocopy-derive",
+ ]
+ 
+ [[package]]
+diff --git a/audio/spotify/Cargo.toml b/audio/spotify/Cargo.toml
+index 593115bf..1c635312 100644
+--- a/audio/spotify/Cargo.toml
++++ b/audio/spotify/Cargo.toml
+@@ -11,9 +11,9 @@ rust-version.workspace = true
+ [dependencies]
+ gst.workspace = true
+ gst-base.workspace = true
+-librespot-core = "0.4"
+-librespot-playback = "0.4"
+-tokio = { version = "1", features = ["rt-multi-thread"] }
++librespot-core = "0.5"
++librespot-playback = { version = "0.5", features = ['passthrough-decoder'] }
++tokio = { version = "1.0", features = ["rt-multi-thread"] }
+ futures = "0.3"
+ anyhow = "1.0"
+ url = "2.3"
+diff --git a/audio/spotify/README.md b/audio/spotify/README.md
+index 98237747..2e364926 100644
+--- a/audio/spotify/README.md
++++ b/audio/spotify/README.md
+@@ -9,23 +9,36 @@ to respect their legal/licensing restrictions.
+ ## Spotify Credentials
+ 
+ This plugin requires a [Spotify Premium](https://www.spotify.com/premium/) account.
+-If your account is linked with Facebook, you'll need to setup
+-a [device username and password](https://www.spotify.com/us/account/set-device-password/).
+ 
+-Those username and password are then set using the `username` and `password` properties.
++Provide a Spotify access token with 'streaming' scope using the `access-token` property. Such a token can be obtained by completing
++[Spotify's OAuth flow](https://developer.spotify.com/documentation/web-api/concepts/authorization) or using the facility on their
++[Web SDK getting started guide](https://developer.spotify.com/documentation/web-playback-sdk/tutorials/getting-started).
++A token can also be obtained using [librespot-oauth](https://github.com/librespot-org/librespot/blob/dev/oauth/examples/oauth.rs):
+ 
+-You may also want to cache credentials and downloaded files, see the `cache-` properties on the element.
++```console
++cargo install librespot-oauth --example oauth && oauth
++```
++
++Note, Spotify access tokens are only valid for 1 hour and must be [refreshed](https://developer.spotify.com/documentation/web-api/tutorials/refreshing-tokens)
++for usage beyond that.
++
++It is therefore advisable to also use the `cache-credentials` property. On first usage, your access token is exchanged for a reusable credentials blob and
++stored at the location specified by this property. Once obtained, that credentials blob is used for login and any provided `access-token` is ignored.
++Unlike Spotify access tokens, the user's credentials blob does not expire. Avoiding handling token refresh greatly simplifies plugin usage.
++If you do not set `cache-credentials`, you must manage refreshing your Spotify access token so it's valid for login when the element starts.
++
++You may also want to cache downloaded files, see the `cache-files` property.
+ 
+ ## spotifyaudiosrc
+ 
+ The `spotifyaudiosrc` element can be used to play a song from Spotify using its [Spotify URI](https://community.spotify.com/t5/FAQs/What-s-a-Spotify-URI/ta-p/919201).
+ 
+ ```
+-gst-launch-1.0 spotifyaudiosrc username=$USERNAME password=$PASSWORD track=spotify:track:3i3P1mGpV9eRlfKccjDjwi ! oggdemux ! vorbisdec ! audioconvert ! autoaudiosink
++gst-launch-1.0 spotifyaudiosrc access-token=$ACCESS_TOKEN track=spotify:track:3i3P1mGpV9eRlfKccjDjwi ! oggdemux ! vorbisdec ! audioconvert ! autoaudiosink
+ ```
+ 
+ The element also implements an URI handler which accepts credentials and cache settings as URI parameters:
+ 
+ ```console
+-gst-launch-1.0 playbin3 uri=spotify:track:3i3P1mGpV9eRlfKccjDjwi?username=$USERNAME\&password=$PASSWORD\&cache-credentials=cache\&cache-files=cache
++gst-launch-1.0 playbin3 uri=spotify:track:3i3P1mGpV9eRlfKccjDjwi?access-token=$ACCESS_TOKEN\&cache-credentials=cache\&cache-files=cache
+ ```
+\ No newline at end of file
+diff --git a/audio/spotify/src/common.rs b/audio/spotify/src/common.rs
+index ed77dcc6..a5764ef8 100644
+--- a/audio/spotify/src/common.rs
++++ b/audio/spotify/src/common.rs
+@@ -18,8 +18,7 @@ use librespot_core::{
+ 
+ #[derive(Default, Debug, Clone)]
+ pub struct Settings {
+-    username: String,
+-    password: String,
++    access_token: String,
+     cache_credentials: String,
+     cache_files: String,
+     cache_max_size: u64,
+@@ -28,52 +27,46 @@ pub struct Settings {
+ 
+ impl Settings {
+     pub fn properties() -> Vec<glib::ParamSpec> {
+-        vec![glib::ParamSpecString::builder("username")
+-                    .nick("Username")
+-                    .blurb("Spotify username, Facebook accounts need a device username from https://www.spotify.com/us/account/set-device-password/")
+-                    .default_value(Some(""))
+-                    .mutable_ready()
+-                    .build(),
+-                glib::ParamSpecString::builder("password")
+-                    .nick("Password")
+-                    .blurb("Spotify password, Facebook accounts need a device password from https://www.spotify.com/us/account/set-device-password/")
+-                    .default_value(Some(""))
+-                    .mutable_ready()
+-                    .build(),
+-                glib::ParamSpecString::builder("cache-credentials")
+-                    .nick("Credentials cache")
+-                    .blurb("Directory where to cache Spotify credentials")
+-                    .default_value(Some(""))
+-                    .mutable_ready()
+-                    .build(),
+-                glib::ParamSpecString::builder("cache-files")
+-                    .nick("Files cache")
+-                    .blurb("Directory where to cache downloaded files from Spotify")
+-                    .default_value(Some(""))
+-                    .mutable_ready()
+-                    .build(),
+-                glib::ParamSpecUInt64::builder("cache-max-size")
+-                    .nick("Cache max size")
+-                    .blurb("The max allowed size of the cache, in bytes, or 0 to disable the cache limit")
+-                    .default_value(0)
+-                    .mutable_ready()
+-                    .build(),
+-                glib::ParamSpecString::builder("track")
+-                    .nick("Spotify URI")
+-                    .blurb("Spotify track URI, in the form 'spotify:track:$SPOTIFY_ID'")
+-                    .default_value(Some(""))
+-                    .mutable_ready()
+-                    .build(),
+-            ]
++        vec![
++            glib::ParamSpecString::builder("access-token")
++                .nick("Access token")
++                .blurb("Spotify access token, requires 'streaming' scope")
++                .default_value(Some(""))
++                .mutable_ready()
++                .build(),
++            glib::ParamSpecString::builder("cache-credentials")
++                .nick("Credentials cache")
++                .blurb("Directory where to cache Spotify credentials")
++                .default_value(Some(""))
++                .mutable_ready()
++                .build(),
++            glib::ParamSpecString::builder("cache-files")
++                .nick("Files cache")
++                .blurb("Directory where to cache downloaded files from Spotify")
++                .default_value(Some(""))
++                .mutable_ready()
++                .build(),
++            glib::ParamSpecUInt64::builder("cache-max-size")
++                .nick("Cache max size")
++                .blurb(
++                    "The max allowed size of the cache, in bytes, or 0 to disable the cache limit",
++                )
++                .default_value(0)
++                .mutable_ready()
++                .build(),
++            glib::ParamSpecString::builder("track")
++                .nick("Spotify URI")
++                .blurb("Spotify track URI, in the form 'spotify:track:$SPOTIFY_ID'")
++                .default_value(Some(""))
++                .mutable_ready()
++                .build(),
++        ]
+     }
+ 
+     pub fn set_property(&mut self, value: &glib::Value, pspec: &glib::ParamSpec) {
+         match pspec.name() {
+-            "username" => {
+-                self.username = value.get().expect("type checked upstream");
+-            }
+-            "password" => {
+-                self.password = value.get().expect("type checked upstream");
++            "access-token" => {
++                self.access_token = value.get().expect("type checked upstream");
+             }
+             "cache-credentials" => {
+                 self.cache_credentials = value.get().expect("type checked upstream");
+@@ -93,8 +86,7 @@ impl Settings {
+ 
+     pub fn property(&self, pspec: &glib::ParamSpec) -> glib::Value {
+         match pspec.name() {
+-            "username" => self.username.to_value(),
+-            "password" => self.password.to_value(),
++            "access-token" => self.access_token.to_value(),
+             "cache-credentials" => self.cache_credentials.to_value(),
+             "cache-files" => self.cache_files.to_value(),
+             "cache-max-size" => self.cache_max_size.to_value(),
+@@ -132,32 +124,20 @@ impl Settings {
+         let cache = Cache::new(credentials_cache, None, files_cache, max_size)?;
+ 
+         if let Some(cached_cred) = cache.credentials() {
+-            if !self.username.is_empty() && self.username != cached_cred.username {
+-                gst::debug!(
+-                    cat,
+-                    obj = &src,
+-                    "ignore cached credentials for user {} which mismatch user {}",
+-                    cached_cred.username,
+-                    self.username
+-                );
+-            } else {
+-                gst::debug!(
+-                    cat,
+-                    obj = &src,
+-                    "reuse cached credentials for user {}",
+-                    cached_cred.username
+-                );
+-                if let Ok((session, _credentials)) = Session::connect(
+-                    SessionConfig::default(),
+-                    cached_cred,
+-                    Some(cache.clone()),
+-                    true,
+-                )
+-                .await
+-                {
+-                    return Ok(session);
+-                }
+-            }
++            let cached_username = cached_cred
++                .username
++                .as_ref()
++                .map_or("UNKNOWN", |s| s.as_str());
++            gst::debug!(
++                cat,
++                obj = &src,
++                "reuse cached credentials for user {}",
++                cached_username
++            );
++
++            let session = Session::new(SessionConfig::default(), Some(cache));
++            session.connect(cached_cred, true).await?;
++            return Ok(session);
+         }
+ 
+         gst::debug!(
+@@ -166,17 +146,14 @@ impl Settings {
+             "credentials not in cache or cached credentials invalid",
+         );
+ 
+-        if self.username.is_empty() {
+-            bail!("username is not set and credentials are not in cache");
+-        }
+-        if self.password.is_empty() {
+-            bail!("password is not set and credentials are not in cache");
++        if self.access_token.is_empty() {
++            bail!("access-token is not set and credentials are not in cache");
+         }
+ 
+-        let cred = Credentials::with_password(&self.username, &self.password);
++        let cred = Credentials::with_access_token(&self.access_token);
+ 
+-        let (session, _credentials) =
+-            Session::connect(SessionConfig::default(), cred, Some(cache), true).await?;
++        let session = Session::new(SessionConfig::default(), Some(cache));
++        session.connect(cred, true).await?;
+ 
+         Ok(session)
+     }
+@@ -185,9 +162,7 @@ impl Settings {
+         if self.track.is_empty() {
+             bail!("track is not set");
+         }
+-        let track = SpotifyId::from_uri(&self.track).map_err(|_| {
+-            anyhow::anyhow!("failed to create Spotify URI from track {}", self.track)
+-        })?;
++        let track = SpotifyId::from_uri(&self.track)?;
+ 
+         Ok(track)
+     }
+diff --git a/audio/spotify/src/spotifyaudiosrc/imp.rs b/audio/spotify/src/spotifyaudiosrc/imp.rs
+index 6f429682..932f5a9f 100644
+--- a/audio/spotify/src/spotifyaudiosrc/imp.rs
++++ b/audio/spotify/src/spotifyaudiosrc/imp.rs
+@@ -52,7 +52,7 @@ enum Message {
+ }
+ 
+ struct State {
+-    player: Player,
++    player: Arc<Player>,
+ 
+     /// receiver sending buffer to streaming thread
+     receiver: mpsc::Receiver<Message>,
+@@ -321,11 +321,10 @@ struct BufferSink {
+ 
+ impl Sink for BufferSink {
+     fn write(&mut self, packet: AudioPacket, _converter: &mut Converter) -> SinkResult<()> {
+-        let oggdata = match packet {
+-            AudioPacket::OggData(data) => data,
+-            AudioPacket::Samples(_) => unimplemented!(),
++        let buffer = match packet {
++            AudioPacket::Samples(_) => unreachable!(),
++            AudioPacket::Raw(ogg) => gst::Buffer::from_slice(ogg),
+         };
+-        let buffer = gst::Buffer::from_slice(oggdata);
+ 
+         // ignore if sending fails as that means the source element is being shutdown
+         let _ = self.sender.send(Message::Buffer(buffer));
+@@ -360,7 +359,7 @@ impl URIHandlerImpl for SpotifyAudioSrc {
+         // allow to configure auth and cache settings from the URI
+         for (key, value) in url.query_pairs() {
+             match key.as_ref() {
+-                "username" | "password" | "cache-credentials" | "cache-files" => {
++                "access-token" | "cache-credentials" | "cache-files" => {
+                     self.obj().set_property(&key, value.as_ref());
+                 }
+                 _ => {
+@@ -435,10 +434,10 @@ impl SpotifyAudioSrc {
+         let (sender, receiver) = mpsc::sync_channel(2);
+         let sender_clone = sender.clone();
+ 
+-        let (mut player, mut player_event_channel) =
+-            Player::new(player_config, session, Box::new(NoOpVolume), || {
+-                Box::new(BufferSink { sender })
+-            });
++        let player = Player::new(player_config, session, Box::new(NoOpVolume), || {
++            Box::new(BufferSink { sender })
++        });
++        let mut player_event_channel = player.get_player_event_channel();
+ 
+         player.load(track, true, 0);
+ 
+diff --git a/docs/plugins/gst_plugins_cache.json b/docs/plugins/gst_plugins_cache.json
+index ac1f6425..bcc97f78 100644
+--- a/docs/plugins/gst_plugins_cache.json
++++ b/docs/plugins/gst_plugins_cache.json
+@@ -11245,6 +11245,18 @@
+                     }
+                 },
+                 "properties": {
++                    "access-token": {
++                        "blurb": "Spotify access token, requires 'streaming' scope",
++                        "conditionally-available": false,
++                        "construct": false,
++                        "construct-only": false,
++                        "controllable": false,
++                        "default": "",
++                        "mutable": "ready",
++                        "readable": true,
++                        "type": "gchararray",
++                        "writable": true
++                    },
+                     "bitrate": {
+                         "blurb": "Spotify audio bitrate in kbit/s",
+                         "conditionally-available": false,
+-- 
+2.47.0
+
diff --git a/pkgs/applications/audio/mopidy/spotify.nix b/pkgs/applications/audio/mopidy/spotify.nix
index d719a03c7cff..876f6c2d67c7 100644
--- a/pkgs/applications/audio/mopidy/spotify.nix
+++ b/pkgs/applications/audio/mopidy/spotify.nix
@@ -8,14 +8,14 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-spotify";
-  version = "5.0.0a2";
+  version = "5.0.0a3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QeABG9rQKJ8sIoK38R74N0s5rRG+zws7AZR0xPysdcY=";
+    hash = "sha256-pM+kqeWYiPXv9DZDBTgwiEwC6Sbqv6uz5vJ5odcixOw=";
   };
 
   build-system = [ pythonPackages.setuptools ];
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index d0490702c2e3..7080b25e8b77 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.34.14";
+  version = "3.34.15";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-4nptnzAvLOC8R1sqfdHJ4YYtotwcOARbu9fe4YKwIVM=";
+    hash = "sha256-TFnlQIizI+8CZgNpwkuipSCNT3OYIaOeoz6kIGcSYL4=";
   };
 
   passthru = {
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 50b8edba1ce1..36516f29bafc 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -80,14 +80,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.40.2";
+  version = "3.40.3";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-8bcCpNgw4FV++qye8G3QXA3k0QCgqByODzPUTw0VX/E=";
+    hash = "sha256-AUDohf71NIuEjFrzRQ8QsdvmEjYsZK9aI4j0msVJgcQ=";
   };
 
   passthru = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 875dd13d8c74..158805acafab 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -126,11 +126,11 @@
     "vendorHash": "sha256-P7ykNhpFoPTINX3eo61/x/9Ts2Z9dscY/P5fQNRsmVo="
   },
   "azuread": {
-    "hash": "sha256-m4ZzZFlcMBAfGN7tHjeYACMwxaG6rpUO4MPVMqjD7Hk=",
+    "hash": "sha256-UV6jgVS8tzWiEBC/C/U7/2bGZ1sqk2MnS8xNRBuL+C8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v3.0.2",
+    "rev": "v3.1.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -180,13 +180,13 @@
     "vendorHash": "sha256-iNY6Jz/SKOLynx33smDFbg371Wa31CouNtrOuV7lkcw="
   },
   "bitwarden": {
-    "hash": "sha256-zvl9B1RhViJ83/7i9ab1KvQc9Yfpzq3c1JIz+bzwVmM=",
+    "hash": "sha256-A8x17x4BrtLXvJa/px/ktuhCyXxMZHhyCARxGiDMGTw=",
     "homepage": "https://registry.terraform.io/providers/maxlaverse/bitwarden",
     "owner": "maxlaverse",
     "repo": "terraform-provider-bitwarden",
-    "rev": "v0.12.1",
+    "rev": "v0.13.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9k3+Qyural6S9xbqZ/NHXPFoo9cgLklIScTEBLuB0kA="
+    "vendorHash": "sha256-whXQejYaYH4bMpIKVphfdfcB/V9ZW+O7CHjcGCnWFco="
   },
   "brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -480,20 +480,20 @@
     "vendorHash": "sha256-EiTWJ4bw8IwsRTD9Lt28Up2DXH0oVneO2IaO8VqWtkw="
   },
   "gitea": {
-    "hash": "sha256-cIbDYFc6q6GMoQH9bqEA/LqC3MczAM7mewhYRRYQcy0=",
+    "hash": "sha256-pbh3ADR77iVwHQ3e7krSUU+rNfhdA8zYnxLbTdnRfaU=",
     "homepage": "https://registry.terraform.io/providers/go-gitea/gitea",
     "owner": "go-gitea",
     "repo": "terraform-provider-gitea",
-    "rev": "v0.5.1",
+    "rev": "v0.6.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-7gA6KoP7NwjwItigBUeCg9AYQ/MggkOHOe/bH7Tf/xA="
+    "vendorHash": "sha256-d8XoZzo2XS/wAPvdODAfK31qT1c+EoTbWlzzgYPiwq4="
   },
   "github": {
-    "hash": "sha256-curdrL2vQ0bnD3ci3ZH1GYNz9JO8ycKaZstK+v//b28=",
+    "hash": "sha256-RD2yGXClIYBa+Gs0IunPXKm0f0d1iFCVZSKUzXhlJyc=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.4.0",
+    "rev": "v6.5.0",
     "spdx": "MIT",
     "vendorHash": null
   },
@@ -750,20 +750,20 @@
     "vendorHash": "sha256-Q9LdhokZol1jhSfQVIRvPe1XrE8nVvc22aWHt7wkcHY="
   },
   "linode": {
-    "hash": "sha256-lM0haU3tLbKaW+EJNMZp9ms/nTH3xEdhBAiIjFSUZ7s=",
+    "hash": "sha256-qyHRGkhwq9YS/mYLFMXEkEdNtH3yfCrXIP4q/QdOzcY=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v2.31.1",
+    "rev": "v2.32.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WCD51W44xN+Qgojbcjrj3f9bUsVLN4itsY7ZBEen0YQ="
+    "vendorHash": "sha256-1wwePyqy6ZLc3ZN0M2zZ6sxhVGZl7gWATv1xvcHBqB4="
   },
   "linuxbox": {
-    "hash": "sha256-+8Wyrb/AjzpfhDK42ze0HBIAdGvtJUFEIpYZs7uOym4=",
+    "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
     "homepage": "https://registry.terraform.io/providers/numtide/linuxbox",
     "owner": "numtide",
     "repo": "terraform-provider-linuxbox",
-    "rev": "v0.5.6",
+    "rev": "v0.5.8",
     "spdx": "BSD-3-Clause",
     "vendorHash": "sha256-GxMCY/udIy3c7zLeNeghXtfCUw4+Ll83L/40N4/yVh8="
   },
@@ -985,11 +985,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-C0Ded8XrPh+yeN+0SvrOPaKONTWvvj4J15xsaXgsri4=",
+    "hash": "sha256-r0F+WSEY7j2AesQ0sDixOe9uKD0hOIdSzDYEhC8yEDA=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.18.3",
+    "rev": "v3.19.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1111,13 +1111,13 @@
     "vendorHash": null
   },
   "selectel": {
-    "hash": "sha256-Wd9HX3Tvoi84t3NulTQlOWWvbsMPNC0mn1yEDmlmnb8=",
+    "hash": "sha256-bXPH/1fEuGehOOSTXsR/yi0BiR8zneIc2KUqOEoG5Qw=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v6.0.1",
+    "rev": "v6.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JytWDb7d2RW/fp5rptAzmfTTuytZ+lp6cB05ol9mhhM="
+    "vendorHash": "sha256-LRs2zI5L5qdWiM8VexQPkP8SjrO/sVEj/MOX+n4NKSc="
   },
   "sentry": {
     "hash": "sha256-2JfzteVripOz96bAtQXC32wi8dWUQw8bry0HllNRQRA=",
@@ -1138,13 +1138,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-qZHbeQDbyahUuYLhWFqBogG+w2pI1XAUdPvcNTngQUw=",
+    "hash": "sha256-C8LyILuqT15NqqzBrj09N+Nx9KMhE/oBPfXtc8gPfns=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.5.0",
+    "rev": "v9.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EnEfch59DIBzK8fmhZ1mvTSxPSjtxMTAOUMeocHgA8I="
+    "vendorHash": "sha256-ijq03YXHiSKOgjG9gbyNHPUsYlYHi9nY4pmhMxM5CrI="
   },
   "skytap": {
     "hash": "sha256-JII4czazo6Di2sad1uFHMKDO2gWgZlQE8l/+IRYHQHU=",
@@ -1183,11 +1183,11 @@
     "vendorHash": "sha256-YFV+qXD78eajSeagJPgPu+qIktx1Vh/ZT0fUPOBuZyo="
   },
   "spacelift": {
-    "hash": "sha256-RWrhVeXPEgFYFGh34vFargTrZH+3CxY36+i0lmFSjXg=",
+    "hash": "sha256-qa+mBk57B2lauJI8k6t4BLksyKVM9tXKQOzo0ky/gAQ=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.19.0",
+    "rev": "v1.19.1",
     "spdx": "MIT",
     "vendorHash": "sha256-c3R/7k7y7XS2Qli00nSj7gh/3Mj88PY4WybBTq/+pPs="
   },
@@ -1355,13 +1355,13 @@
     "vendorHash": "sha256-Dxd/2TjxPoa+JcHlmmcoPx2wegZJzhbI1abNmF4wDik="
   },
   "vault": {
-    "hash": "sha256-vMt7FyNY+Tv7C+YT4h6BOn4EDU5ypOHQvtW0VtQiifg=",
+    "hash": "sha256-6xS+d1oDaRz6UVyK9Z3h4LPo2jZ0iVwzfVw1e6PHnDc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v4.5.0",
+    "rev": "v4.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tg1LBq8K8loMkPUXPMEi9Y4Epg0ZfpaYADfWLaZ2k3U="
+    "vendorHash": "sha256-H53MSJVW5hmG16VmTrHsSnphsgp8DG9B/Ur3SGDhSxE="
   },
   "vcd": {
     "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",
@@ -1373,13 +1373,13 @@
     "vendorHash": "sha256-eCIJ2w8DjmUCGp0VbliLaQ6C29mJhl6Spya06Xyiqd4="
   },
   "venafi": {
-    "hash": "sha256-9Nn2dFF9W8STQoRXFNiXYCrHEWiirNvOAAS1f1brutw=",
+    "hash": "sha256-/fRqTu/M3OHR5v7pWAE04ijq70F7MxRILP1Ab2hw7gs=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.21.1",
+    "rev": "v0.21.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-xZTd/L5ZRTRuDsdyNZEZPmlOu9nUIAE5W1UG94aOS/o="
+    "vendorHash": "sha256-kZ0JLjAYu3b01zHfp+VWTZ8sUCivfaS1Ld2/SDMOrks="
   },
   "vinyldns": {
     "hash": "sha256-ow+o9fRw/t2i4N65zuVFbfPb68ZUcJfNB5ARYqRTsIs=",
@@ -1418,13 +1418,13 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-7tLqWVJL5G+OMtGVNkpfJZ6xfZ8hJy6gsitUVd0NHGc=",
+    "hash": "sha256-8xJOuafposGNtFw6ZMfrmoGOp67rubOdrLDR9DFRxdg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.10.0",
+    "rev": "v2.11.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kjS1YYMoE5IBeKWXnxzO3nFp6NpBEwUCaTzO0VSBDLA="
+    "vendorHash": "sha256-nQM1RcdgndUwHJWAspu/INFSXBoXJgAFBZR1x2txCkE="
   },
   "vultr": {
     "hash": "sha256-vgeTK5fGHYzHCBdxq1JN9agK6+jYGkCkFnAWrkIz/gM=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2c832676bb4f..948adfaa93c6 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,32 +9,32 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.80";
-        ptb = "0.0.126";
-        canary = "0.0.569";
+        stable = "0.0.81";
+        ptb = "0.0.127";
+        canary = "0.0.574";
         development = "0.0.67";
       }
     else
       {
-        stable = "0.0.332";
-        ptb = "0.0.156";
-        canary = "0.0.681";
-        development = "0.0.76";
+        stable = "0.0.333";
+        ptb = "0.0.157";
+        canary = "0.0.686";
+        development = "0.0.78";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-oamuF2LcdBC2HUzB08lTlxvrXjE6YFBXwLJDrmYKRXM=";
+        hash = "sha256-V3xaBbCZX1TUaXxLbMOhJ8VFKMZBfCR/w5ajrAvu2kQ=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-4OvGEeOP4i4j7WwMjnnSvaNQ2e5RZ0EMF797xoIsWMY=";
+        hash = "sha256-mgR2MDQ3ZtgBltQPOxT6773aNUx5hH2P6LvFJFEuUts=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-akbcAPuxF1pl4u2Cw/I7rlv8WVDsIZDPPpGRUt1qQvA=";
+        hash = "sha256-pZdHl7U3aNmxe6PtaK7JbQ7XdAPtlTAUuGcBRFkQI3s=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -44,19 +44,19 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-ZIAFYbC4rRjb9Lz3E50TfR0Lgdmg0MZllxy+vk36Eg8=";
+        hash = "sha256-ebPbTIiaZ2hMoJdVCax0hT2bLUFLj5fuIf2e74qLHns=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Uluw2l/yAFzy4uMzp9ugFri8Psl7hy50H7QHag+St10=";
+        hash = "sha256-bZ9LVthjBib/yRfDTIXBNKDulWhW35HOdSDyEyjyLyA=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-OmN8g5Skg/KmdO8sv8iOhbZOFU/XUyUqvSthEam6RNE=";
+        hash = "sha256-F3vLcLjNhYRGnOyuNziwtbBNxiUKgw6wZaa1LbVF5PU=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-GyHOJcxWoKdFJ5/oca5JFwu5OdGGykR4OXGMaa3XfiY=";
+        hash = "sha256-SkPMUbRiY5C4sHHcnpneibG8kazHfJ3ohT1h0jbx4F8=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
index 1ae7ee66ead9..763fdab2db8a 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.10.3";
+  version = "5.10.4";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-AsxCDh/pneRHVuGtlqFYD6c9pezmKo/wrMU4RPtWlXA=";
+    hash = "sha256-3v9B4tdD9oNyQ96t21VRmV43Ib7l6ki8DlFXmbk7DJw=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/applications/science/biology/blast/bin.nix b/pkgs/applications/science/biology/blast/bin.nix
index 54d3cd783891..8f3a6f6be0b3 100644
--- a/pkgs/applications/science/biology/blast/bin.nix
+++ b/pkgs/applications/science/biology/blast/bin.nix
@@ -11,25 +11,29 @@
   glib,
   libxml2,
   coreutils,
+  sqlite,
 }:
 let
   pname = "blast-bin";
-  version = "2.14.1";
+  version = "2.16.0";
 
   srcs = rec {
     x86_64-linux = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-linux.tar.gz";
-      hash = "sha256-OO8MNOk6k0J9FlAGyCOhP+hirEIT6lL+rIInB8dQWEU=";
+      hash = "sha256-sLEwmMkB0jsyStFwDnRxu3QIp/f1F9dNX6rXEb526PQ=";
     };
     aarch64-linux = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-aarch64-linux.tar.gz";
-      hash = "sha256-JlOyoxZQBbvUcHIMv5muTuGQgrh2uom3rzDurhHQ+FM=";
+      hash = "sha256-1EeiMu08R9Glq8qRky4OTT5lQPLJcM7iaqUrmUOS4MI=";
     };
     x86_64-darwin = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-macosx.tar.gz";
-      hash = "sha256-eMfuwMCD6VlDgeshLslDhYBBp0YOpL+6q/zSchR0bAs=";
+      hash = "sha256-fu4edyD12q8G452ckrEl2Qct5+uB9JnABd7bCLkyMkw=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-aarch64-macosx.tar.gz";
+      hash = "sha256-6NpPNLBCHaBRscLZ5fjh5Dv3bjjPk2Gh2+L7xEtiJNs=";
     };
-    aarch64-darwin = x86_64-darwin;
   };
   src = srcs.${stdenv.hostPlatform.system};
 in
@@ -48,6 +52,7 @@ stdenv.mkDerivation {
       bzip2
       glib
       libxml2
+      sqlite
     ];
 
   installPhase = ''
diff --git a/pkgs/applications/version-management/git-stack/default.nix b/pkgs/applications/version-management/git-stack/default.nix
index e3a61ad02fe4..5a11cc9953a6 100644
--- a/pkgs/applications/version-management/git-stack/default.nix
+++ b/pkgs/applications/version-management/git-stack/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-stack";
-  version = "0.10.17";
+  version = "0.10.18";
 
   src = fetchFromGitHub {
     owner = "gitext-rs";
     repo = "git-stack";
     rev = "v${version}";
-    hash = "sha256-foItJSZ6jsLuWkO/c1Ejb45dSdzZ/ripieyVIYsEyy0=";
+    hash = "sha256-iFoxYq4NHC/K0ruPDXHfayZDglebBJE00V57HUH9Y84=";
   };
 
-  cargoHash = "sha256-MEhUmy4ijR/zHm/qMt4PqNGYnCfIgjNaL9SlMmXCMmc=";
+  cargoHash = "sha256-kX0eOqp3emGEYZPIzkP62WpfH8mTxMi7zB+nwtpSFuk=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     Security
diff --git a/pkgs/applications/video/mpv/scripts/twitch-chat.nix b/pkgs/applications/video/mpv/scripts/twitch-chat.nix
new file mode 100644
index 000000000000..2bce83b95bcf
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/twitch-chat.nix
@@ -0,0 +1,42 @@
+{
+  buildLua,
+  curl,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+}:
+buildLua (finalAttrs: {
+  pname = "twitch-chat";
+  version = "0-unstable-2024-06-23";
+
+  src = fetchFromGitHub {
+    owner = "CrendKing";
+    repo = "mpv-twitch-chat";
+    rev = "bb0c2e84675f4f1e0c221c8e1d3516b60242b985";
+    hash = "sha256-WyNPUiAs5U/vrjNbAgyqkfoxh9rabLmuZ1zG5uZYxaw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D main.lua $out/share/mpv/scripts/twitch-chat.lua
+    runHook postInstall
+  '';
+
+  passthru.extraWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ curl ])
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Show Twitch chat messages as subtitles when watching Twitch VOD with mpv.";
+    homepage = "https://github.com/CrendKing/mpv-twitch-chat";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.naho ];
+  };
+})
diff --git a/pkgs/by-name/ai/airwindows/cmakelists-and-helper.patch b/pkgs/by-name/ai/airwindows/cmakelists-and-helper.patch
new file mode 100644
index 000000000000..09bc63beebd5
--- /dev/null
+++ b/pkgs/by-name/ai/airwindows/cmakelists-and-helper.patch
@@ -0,0 +1,31 @@
+diff --git a/plugins/LinuxVST/CMakeLists.txt b/plugins/LinuxVST/CMakeLists.txt
+index f43ea128..b87a5c03 100755
+--- a/plugins/LinuxVST/CMakeLists.txt
++++ b/plugins/LinuxVST/CMakeLists.txt
+@@ -2,11 +2,24 @@ cmake_minimum_required(VERSION 3.9)
+ project(airwindows_ports)
+ 
+ set(CMAKE_CXX_STANDARD 14)
+-add_compile_options(-O2 -D__cdecl=)
++add_compile_options(-D__cdecl=)
++
++set(VST2_SDK_PATH "${PROJECT_SOURCE_DIR}/include/vstsdk" CACHE STRING "VST2 SDK Path")
++
++set(VSTSDK_ROOT
++    "${VST2_SDK_PATH}"
++    "${VST2_SDK_PATH}/pluginterfaces/vst2.x/"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/"
++)
++
++set(VSTSDK_SOURCES
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/audioeffectx.cpp"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/audioeffect.cpp"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/vstplugmain.cpp"
++)
+ 
+ include(Helpers.cmake)
+ 
+-add_subdirectory(include/vstsdk)
+ add_airwindows_plugin(Acceleration)
+ add_airwindows_plugin(Acceleration2)
+ add_airwindows_plugin(ADClip7)
diff --git a/pkgs/by-name/ai/airwindows/package.nix b/pkgs/by-name/ai/airwindows/package.nix
new file mode 100644
index 000000000000..ac0bd3f3714e
--- /dev/null
+++ b/pkgs/by-name/ai/airwindows/package.nix
@@ -0,0 +1,89 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  fetchzip,
+  lib,
+  cmake,
+  nix-update-script,
+}:
+let
+  # adapted from oxefmsynth
+  vst-sdk = stdenv.mkDerivation {
+    dontConfigure = true;
+    dontPatch = true;
+    dontBuild = true;
+    dontStrip = true;
+    dontPatchELF = true;
+
+    name = "vstsdk3610_11_06_2018_build_37";
+    src = fetchzip {
+      url = "https://web.archive.org/web/20181016150224if_/https://download.steinberg.net/sdk_downloads/vstsdk3610_11_06_2018_build_37.zip";
+      sha256 = "0da16iwac590wphz2sm5afrfj42jrsnkr1bxcy93lj7a369ildkj";
+    };
+
+    installPhase = ''
+      cp -r VST2_SDK $out
+    '';
+  };
+in
+stdenv.mkDerivation {
+  pname = "airwindows";
+  version = "0-unstable-2025-01-06";
+
+  src = fetchFromGitHub {
+    owner = "airwindows";
+    repo = "airwindows";
+    rev = "0ca33035253b9fc0c6c876592d9e5ff3a654cd10";
+    hash = "sha256-+AyB6y179BRWTvflA9Ld5utpF2scSJDszkGa8BCvPdM=";
+  };
+
+  # we patch helpers because honestly im spooked out by where those variables
+  # came from.
+  prePatch = ''
+    mkdir -p plugins/LinuxVST/include
+    ln -s ${vst-sdk.out} plugins/LinuxVST/include/vstsdk
+  '';
+
+  patches = [
+    ./cmakelists-and-helper.patch
+  ];
+
+  # we are building for linux, so we go to linux
+  preConfigure = ''
+    cd plugins/LinuxVST
+  '';
+
+  cmakeBuildType = "Release";
+
+  cmakeFlags = [ ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    vst-sdk
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst/airwindows
+    find "$PWD" -type f -name "*.so" -exec install -Dm755 {} $out/lib/vst/airwindows \;
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "All Airwindows VST Plugins";
+    homepage = "https://airwindows.com/";
+    platforms = lib.platforms.linux;
+    license = [
+      lib.licenses.mit
+      lib.licenses.unfree
+    ];
+    maintainers = [ lib.maintainers.l1npengtul ];
+  };
+}
diff --git a/pkgs/by-name/al/alacritty-theme/package.nix b/pkgs/by-name/al/alacritty-theme/package.nix
index a5e7d6f44c0c..48c698be1196 100644
--- a/pkgs/by-name/al/alacritty-theme/package.nix
+++ b/pkgs/by-name/al/alacritty-theme/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   pname = "alacritty-theme";
-  version = "0-unstable-2025-01-03";
+  version = "0-unstable-2025-01-21";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "aff9d111d43e1ad5c22d4e27fc1c98176e849fb9";
-    hash = "sha256-GxCdyBihypHKkPlCVGiTAD4dP3ggkSyQSNS5AKUhSVo=";
+    rev = "69d07c3bc280add63906a1cebf6be326687bc9eb";
+    hash = "sha256-G8sUu8GD44uqUyQ7sZrgrGxC4IOfhSn++WIc+U67zL0=";
     sparseCheckout = [ "themes" ];
   };
 
diff --git a/pkgs/by-name/al/alpaca-proxy/package.nix b/pkgs/by-name/al/alpaca-proxy/package.nix
index e86402560863..2c69ba00cd05 100644
--- a/pkgs/by-name/al/alpaca-proxy/package.nix
+++ b/pkgs/by-name/al/alpaca-proxy/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "alpaca-proxy";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchFromGitHub {
     owner = "samuong";
     repo = "alpaca";
     rev = "v${version}";
-    hash = "sha256-Rf8//4FeruVZZ//uba80z20XGUxycwF91Aa09fosRXI=";
+    hash = "sha256-1CMuZl1bVlofogPwA2wRuQPlXNE2EM1B8rDDDaJGq64=";
   };
 
-  vendorHash = "sha256-JEiHgyPJvWmtPf8R4aX/qlevfZRdKajre324UsgRm5Y=";
+  vendorHash = "sha256-N9qpyCQg6H1v/JGJ2wCxDX+ZTM9x6/BM6wQ26xC+dlE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/be/betterdisplay/package.nix b/pkgs/by-name/be/betterdisplay/package.nix
index 937988cd135f..b9c24e497657 100644
--- a/pkgs/by-name/be/betterdisplay/package.nix
+++ b/pkgs/by-name/be/betterdisplay/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "betterdisplay";
-  version = "3.3.0";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "https://github.com/waydabber/BetterDisplay/releases/download/v${finalAttrs.version}/BetterDisplay-v${finalAttrs.version}.dmg";
-    hash = "sha256-A0kh3XNdl5kJ32Kxwb0PAgxfGJR+EZEoaP+gspRJEcU=";
+    hash = "sha256-4hS+F9cPgQ6HEzX7RkikANyJqc2bMAhKCYlL1lmka54=";
   };
 
   dontPatch = true;
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 4bb110d0b884..40912b780968 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -3,13 +3,10 @@
   buildNpmPackage,
   cargo,
   copyDesktopItems,
-  electron_32,
+  electron_33,
   fetchFromGitHub,
-  glib,
   gnome-keyring,
-  gtk3,
   jq,
-  libsecret,
   makeDesktopItem,
   makeWrapper,
   napi-rs-cli,
@@ -26,7 +23,7 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_32;
+  electron = electron_33;
 
   bitwardenDesktopNativeArch =
     {
@@ -39,13 +36,13 @@ let
 in
 buildNpmPackage rec {
   pname = "bitwarden-desktop";
-  version = "2024.12.1";
+  version = "2025.1.1";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-nmQUfVhSJrnYWbxjNk0r6vEtPqA8kksEX5gUmpeKe6M=";
+    hash = "sha256-0NXrTBkCyo9Hw+fyFTfXfa1efBlaM6xWd9Uvsbathpw=";
   };
 
   patches = [
@@ -70,7 +67,7 @@ buildNpmPackage rec {
     "--legacy-peer-deps"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-5rOA7xtw2jqjoLxEl4lsLWpv32/TYmEaK+UN7R8EoJc=";
+  npmDepsHash = "sha256-DDsPkvLGOhjmdYEOmhZfe4XHGFyowvWO24YcCA5griM=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
@@ -82,7 +79,7 @@ buildNpmPackage rec {
     ) patches;
     patchFlags = [ "-p4" ];
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-Fh6pbmFof/qIhVETtBA1fGlC45fuu1n7g9hosvmfHZc=";
+    hash = "sha256-IL8+n+rhRbvRO1jxJSy9PjUMb/tI4S/gzpUNOojBPWk=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
@@ -100,12 +97,6 @@ buildNpmPackage rec {
     rustPlatform.cargoSetupHook
   ];
 
-  buildInputs = [
-    glib
-    gtk3
-    libsecret
-  ];
-
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'
diff --git a/pkgs/by-name/bn/bngblaster/package.nix b/pkgs/by-name/bn/bngblaster/package.nix
index 79b4cbb77105..e737a3374f5f 100644
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bngblaster";
-  version = "0.9.14";
+  version = "0.9.15";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "bngblaster";
     rev = finalAttrs.version;
-    hash = "sha256-vToKrP/T3qVb9UylNyZRvP+kWoizIjjXTbVlNebKG/M=";
+    hash = "sha256-HqwyqUkLYoXTjx01pB8sL3hBXwLqe441M+LTqBhaZ58=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ca/cargo-binstall/package.nix b/pkgs/by-name/ca/cargo-binstall/package.nix
index ac353879f7ec..20cdbf61b9ea 100644
--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.10.19";
+  version = "1.10.22";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-dKQRXEZfvONaWocvoaEQtENAyNvIUaqomckaSj7bUtM=";
+    hash = "sha256-b2Cn5FWXmI5ij98A8Y0KUm8LGB73Ho2UzhrOd+7eCEg=";
   };
 
-  cargoHash = "sha256-gN6aNPV6K8BUTUvTTKtTu54JFLwL1XSA0rA4EyKdovc=";
+  cargoHash = "sha256-LbfgOfd6ubAWP6l5gi5Xd737LxgymlDS2+qdhr+FJPE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-modules/package.nix b/pkgs/by-name/ca/cargo-modules/package.nix
index 2084275ec1ba..0737be7896de 100644
--- a/pkgs/by-name/ca/cargo-modules/package.nix
+++ b/pkgs/by-name/ca/cargo-modules/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = "cargo-modules";
     tag = "v${version}";
-    hash = "sha256-QVG/N+t6fify6I9uvLAqWLagmEnhd5i5Iz9HWdysmzk=";
+    hash = "sha256-mrl1I1dmf2WqtUbBsUq3kgqPwc4S/EaYRc/B9hpEo90=";
   };
 
-  cargoHash = "sha256-9SzM9jkAcnRctNedImoH+32hVAtPAkXLzxgmOo3Dcxc=";
+  cargoHash = "sha256-6vmd7yQcDf1keu6uPKJFRMpt3ZgRe1M3AfUZjf1KBIk=";
 
   checkFlags = [
     "--skip=cfg_test::with_tests::smoke"
diff --git a/pkgs/by-name/ci/circup/package.nix b/pkgs/by-name/ci/circup/package.nix
index f212569df456..c7464f2ee953 100644
--- a/pkgs/by-name/ci/circup/package.nix
+++ b/pkgs/by-name/ci/circup/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "circup";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = "circup";
     tag = version;
-    hash = "sha256-4jmqS/XMB8t7aMfHriipi+VnCbZqrqjt21K5ktes2ec=";
+    hash = "sha256-G2c2Psd5cyjKkpqYQOLVWSeLIWdoxYm45KLT0q7cTzQ=";
   };
 
   pythonRelaxDeps = [ "semver" ];
diff --git a/pkgs/by-name/cl/clapboard/package.nix b/pkgs/by-name/cl/clapboard/package.nix
index 7b8948a6bdc8..4af853976162 100644
--- a/pkgs/by-name/cl/clapboard/package.nix
+++ b/pkgs/by-name/cl/clapboard/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clapboard";
-  version = "1.0.0";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "clapboard";
     rev = "v${version}";
-    hash = "sha256-dXlUOIYgptYqUIIC7batc0TVQeP89i8vizwYSIUlzGA=";
+    hash = "sha256-TM07BcluIh+MEcVg1ApZu85rj36ZBUfn125A0eALNMo=";
   };
 
-  cargoHash = "sha256-Ll2fpH0v3ZWizrl6Mip0gaPCHlQAdddh9F9bNXveb/0=";
+  cargoHash = "sha256-Oz/UWN/Ck4uxGQjnaE9KB70AElCjqjJaZLGU71nh6N8=";
 
   meta = with lib; {
     description = "Wayland clipboard manager that will make you clap";
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index 4bc7fe2500e6..59d1a4828d79 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.20.1";
+  version = "2.20.2";
 
   dontConfigure = true;
   dontBuild = true;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-9BNp4PxRL9YbzQ/AeW6EFk6xv1XmwDwxZgu3DL79H8w=";
+    hash = "sha256-t2CT2bseVlVVt5h5j9r9usdr7za2ki+qYSsm5wG7kk8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/da/dafny/deps.json b/pkgs/by-name/da/dafny/deps.json
index bea763e1a178..fe629403b62f 100644
--- a/pkgs/by-name/da/dafny/deps.json
+++ b/pkgs/by-name/da/dafny/deps.json
@@ -1,73 +1,73 @@
 [
   {
     "pname": "Boogie",
-    "version": "3.1.3",
-    "hash": "sha256-0XQcD1ImPNPXQ43fTkahC3qr2zUvHNdmgw0tmYE+7Hc="
+    "version": "3.2.5",
+    "hash": "sha256-/ZbKajyZuBV3zyh7JfwBfrcxaRpIkUfWGOjxB1qExX8="
   },
   {
     "pname": "Boogie.AbstractInterpretation",
-    "version": "3.2.3",
-    "hash": "sha256-SwJ5D3tOU+qcyQdNITIM15ujMEC++aXHOsUSovWbsC4="
+    "version": "3.4.3",
+    "hash": "sha256-s3cykv7AMeC+UhmYzGdM75/3/7CxX4h292DGTE9Yd4U="
   },
   {
     "pname": "Boogie.BaseTypes",
-    "version": "3.2.3",
-    "hash": "sha256-cIUdpGGjMKn70Z0nD8rvva8UbFSoLDUrBprC+TMG/EA="
+    "version": "3.4.3",
+    "hash": "sha256-vSjGt+GKK2oGNY9ZJTvDT8A/H+eCbm1D+CppoKIWW88="
   },
   {
     "pname": "Boogie.CodeContractsExtender",
-    "version": "3.2.3",
-    "hash": "sha256-L+phJ66oHNINliPkabU3vO4Vl9Lkv+nug+DWC8VmFlc="
+    "version": "3.4.3",
+    "hash": "sha256-mb8RXgKJCutupsg/oFxMENlltn5nmjt7bXAodN6t9dA="
   },
   {
     "pname": "Boogie.Concurrency",
-    "version": "3.2.3",
-    "hash": "sha256-w+5B+uyfKCf8j8hP0G/SSPUd2lT2T8A4Lkg0tsxniBg="
+    "version": "3.4.3",
+    "hash": "sha256-piDvI01lZb23LkL/NX+NDnGVnHn1q4B/YoS7FrcQZ+M="
   },
   {
     "pname": "Boogie.Core",
-    "version": "3.2.3",
-    "hash": "sha256-qqoeLAdpRRaTISdgxyE3iFqhrmezxISaE5bm02rXVyE="
+    "version": "3.4.3",
+    "hash": "sha256-EUckeyktsBHLVCQlf9CQtx3vmgts2zpVcS0NiVw6WlY="
   },
   {
     "pname": "Boogie.ExecutionEngine",
-    "version": "3.2.3",
-    "hash": "sha256-8EKwiBnoMFGxeK2+IuG5p6BtnPlR0CCekXi4PBFLEbU="
+    "version": "3.4.3",
+    "hash": "sha256-+57PiqmW9CJuHYoAt6hMuWOveZpZTztwUrzzQsajo2A="
   },
   {
     "pname": "Boogie.Graph",
-    "version": "3.2.3",
-    "hash": "sha256-7XjrCHSnvEL7eMmma2vKA7r8YGJe8Oo4E8U9Wja/al0="
+    "version": "3.4.3",
+    "hash": "sha256-eWn8EWUlWZQ2U06anUBaPfdBNzqK5xP7xdntSB7F3mw="
   },
   {
     "pname": "Boogie.Houdini",
-    "version": "3.2.3",
-    "hash": "sha256-g7i0yF/89IWXElTi0onOgvPaesqlPGl3qINMCePHGA8="
+    "version": "3.4.3",
+    "hash": "sha256-BJLTqC2ih5XHLCmzf/4TKUZCpUCf6PmBTujIIRykLcc="
   },
   {
     "pname": "Boogie.Model",
-    "version": "3.2.3",
-    "hash": "sha256-gRMZQQFMjQEQasg3A3iZ9/0KUWCxAoUPiHPZHbWXUs4="
+    "version": "3.4.3",
+    "hash": "sha256-3CrdoCM85IkZ7E8gTdmUspmUFbYpBu1PmbF4a2U7I8E="
   },
   {
     "pname": "Boogie.Provers.LeanAuto",
-    "version": "3.2.3",
-    "hash": "sha256-kMLvTTnvKWjggSby7D4jkaRmdvvOum0ZlfM6yU2760Q="
+    "version": "3.4.3",
+    "hash": "sha256-GJY7XUBFhL6N7U8QJmvCc7G8k3pV8LfyMhDev37GmFc="
   },
   {
     "pname": "Boogie.Provers.SMTLib",
-    "version": "3.2.3",
-    "hash": "sha256-SCfEJCRueTE66ZZbHX8FHpD50SrBDQne8725uiKjbvM="
+    "version": "3.4.3",
+    "hash": "sha256-llI/WhQsM8KygDB/OYY5yc8U9SN3rd3NCkWFsB3yCDM="
   },
   {
     "pname": "Boogie.VCExpr",
-    "version": "3.2.3",
-    "hash": "sha256-U6Rc5P0dUtNZ1IGDBU4hggwreVxSZqu6cZSKcWLpq/o="
+    "version": "3.4.3",
+    "hash": "sha256-muY74ki4Cq8JoA4tGUxxWPNAlGhAq4dtGTSoCxNQZm0="
   },
   {
     "pname": "Boogie.VCGeneration",
-    "version": "3.2.3",
-    "hash": "sha256-snbFiueD508B1GLqIC8cQdT9jW2jkRyhmYxPTlfnyrQ="
+    "version": "3.4.3",
+    "hash": "sha256-ngZtONjWgr0BbQcGNl5uynY5Ac6JRDZujgUNQJgvhJg="
   },
   {
     "pname": "CocoR",
@@ -739,11 +739,6 @@
     "version": "4.3.0",
     "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
   },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.0.1",
-    "hash": "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="
-  },
   {
     "pname": "System.Runtime.Handles",
     "version": "4.3.0",
diff --git a/pkgs/by-name/da/dafny/package.nix b/pkgs/by-name/da/dafny/package.nix
index 6ff063fdc4b5..1b5cdecb3404 100644
--- a/pkgs/by-name/da/dafny/package.nix
+++ b/pkgs/by-name/da/dafny/package.nix
@@ -38,19 +38,18 @@ let
 in
 buildDotnetModule rec {
   pname = "Dafny";
-  version = "4.8.0";
+  version = "4.9.1";
 
   src = fetchFromGitHub {
     owner = "dafny-lang";
     repo = "dafny";
-    rev = "v${version}";
-    hash = "sha256-x/fX4o+R72Pl02u1Zsr80Rh/4Wb/aKw90fhAGmsfFUI=";
+    tag = "v${version}";
+    hash = "sha256-fCBaOF1mDrqJaUiATZAhzLjlK3NGVFnxdOwgHbOkkgY=";
   };
 
   postPatch =
     let
-      # This file wasn't updated between 4.6.0 and 4.7.0.
-      runtimeJarVersion = "4.6.0";
+      runtimeJarVersion = "4.9.1";
     in
     ''
       cp ${writeScript "fake-gradlew-for-dafny" ''
diff --git a/pkgs/by-name/db/dbvisualizer/package.nix b/pkgs/by-name/db/dbvisualizer/package.nix
index 66afb65afc29..3722b2454239 100644
--- a/pkgs/by-name/db/dbvisualizer/package.nix
+++ b/pkgs/by-name/db/dbvisualizer/package.nix
@@ -13,7 +13,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "24.3.2";
+  version = "24.3.3";
 
   src =
     let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "https://www.dbvis.com/product_download/dbvis-${finalAttrs.version}/media/dbvis_linux_${underscoreVersion}.tar.gz";
-      hash = "sha256-oZxOGudRGFfbVz7n5eeKxr/7lxUhYAHjD0wsHw6G8OI=";
+      hash = "sha256-RDmakZJ7mjTzx4QaKwT6H25dDvQANbLhd2+f8EYbmDA=";
     };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index 311acdceb04f..7b118f2c0cc8 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -19,17 +19,17 @@
 
 let
   deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "1.152.1";
+    version = "1.154.3";
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
       tag = "v${version}";
-      hash = "sha256-ty2pZWMZ5ZFwwpLm22ChxVAf2cqmIimk8BWvMBqzmks=";
+      hash = "sha256-SjNFgvg6sHW40v13OuR3BL3+JdDxntDCKtbe/C/04as=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "deltachat-core-rust";
       inherit version src;
-      hash = "sha256-wbk4/yhhIRPD3x8ghAwJ0lQy0k8GQopTBBT1a021FRo=";
+      hash = "sha256-kbSRGuyCJlTxzKr/C+MLczqT7WNTqZ2/Z42psbBFW+w=";
     };
   };
   electron = electron_32;
@@ -37,18 +37,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "1.50.1";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G/qBGyx+vxkJvwmBYG5kpx01OO0C9dPji0Cafna9pyw=";
+    hash = "sha256-yKIGgeUjfpw0MMCnrD2TYrACfb/V6681IukZZY8feZc=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-UwfblmCkJOuy2Et5Rjm8ONWLbDmLppazqIk2+rV2RJU=";
+    hash = "sha256-YgHJN0LNgXoDCLqOw891CD23kpQ0wCnKFp5WccTHHw8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ep/epson-escpr2/package.nix b/pkgs/by-name/ep/epson-escpr2/package.nix
index 88dffb9df345..13bcd4818c8f 100644
--- a/pkgs/by-name/ep/epson-escpr2/package.nix
+++ b/pkgs/by-name/ep/epson-escpr2/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.24";
+  version = "1.2.25";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retreive the download link for source package for x86 CPU
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/58/53/436aba09336f96ed31378f90848be6588a177439/epson-inkjet-printer-escpr2-1.2.24-1.src.rpm";
-    sha256 = "sha256-SI5vXdpxRu6/QdAMdgNpqgcTqyHntiS0zo38XPd4Xtg=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/60/34/8e2b40dc2a02ae67c82b2c55786159f07edf3f5a/epson-inkjet-printer-escpr2-1.2.25-1.src.rpm";
+    sha256 = "sha256-rhNv6Ak83KG5SmdVUyu/2UXTB0BTj4yDyKRO++9q8WY=";
   };
 
   unpackPhase = ''
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     # Fixes "implicit declaration of function" errors
     # source of patch: https://aur.archlinux.org/packages/epson-inkjet-printer-escpr2
     (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/bug_x86_64.patch?h=epson-inkjet-printer-escpr2";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/bug_x86_64.patch?h=epson-inkjet-printer-escpr2&id=575d1b959063044f233cca099caceec8e6d5c02f";
       sha256 = "sha256-G6/3oj25FUT+xv9aJ7qP5PBZWLfy+V8MCHUYucDhtzM=";
     })
   ];
diff --git a/pkgs/by-name/ep/epubcheck/package.nix b/pkgs/by-name/ep/epubcheck/package.nix
index 1619d621f0e0..fe5240ae668c 100644
--- a/pkgs/by-name/ep/epubcheck/package.nix
+++ b/pkgs/by-name/ep/epubcheck/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "epubcheck";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchzip {
     url = "https://github.com/w3c/epubcheck/releases/download/v${version}/epubcheck-${version}.zip";
-    sha256 = "sha256-7Vfbs0lqrm/YDSfvMxaQu9IsYx1PugpbsDYLU2fIC6U=";
+    sha256 = "sha256-BL+DNd6QeAx4MATaXVX/4mtalY7jzAdYeUsPktPp4UA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fo/font-manager/package.nix b/pkgs/by-name/fo/font-manager/package.nix
index c86340595dc4..243c36a26c87 100644
--- a/pkgs/by-name/fo/font-manager/package.nix
+++ b/pkgs/by-name/fo/font-manager/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "font-manager";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "font-manager";
     rev = version;
-    hash = "sha256-nUFxjqUiL8zLfPJrLM1aQ/SZ2x6CYFKFJI1W/eXlrV8=";
+    hash = "sha256-x7ZRC/xwF6Y2BhbtApVZ4hPZGNGaJiilqpxLyax9r2g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/git-repo/package.nix b/pkgs/by-name/gi/git-repo/package.nix
index 551363bbf231..fe59c3f0d8a5 100644
--- a/pkgs/by-name/gi/git-repo/package.nix
+++ b/pkgs/by-name/gi/git-repo/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.50.1";
+  version = "2.51";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    hash = "sha256-HJdXdFaC8yFef2gMJpSfZ2TDxEZkZLWZcum41dfG/DQ=";
+    hash = "sha256-A0mLb3QYI3Eapv5xBMPHcoiaR9np8dx5EAQKXIlhYBg=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
diff --git a/pkgs/applications/version-management/git-workspace/default.nix b/pkgs/by-name/gi/git-workspace/package.nix
similarity index 74%
rename from pkgs/applications/version-management/git-workspace/default.nix
rename to pkgs/by-name/gi/git-workspace/package.nix
index 36ca542517f9..1d8ef47ff0d0 100644
--- a/pkgs/applications/version-management/git-workspace/default.nix
+++ b/pkgs/by-name/gi/git-workspace/package.nix
@@ -1,14 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, libiconv
-, Security
-, pkg-config
-, openssl
-, nix-update-script
-, testers
-, git-workspace
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,8 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/gi/gitleaks/package.nix b/pkgs/by-name/gi/gitleaks/package.nix
index 1849d92aef0e..df35284fc381 100644
--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.23.1";
+  version = "8.23.2";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = "gitleaks";
     tag = "v${version}";
-    hash = "sha256-gz/2DwkvSY6vOKW1ttJcLjjtii0jWIdQC1/xzU5vCRA=";
+    hash = "sha256-lwjGoDMNRgYDHI+8IjOD8sWJMUgv/Bg3pUzrUrcYiR4=";
   };
 
   vendorHash = "sha256-hq3v//fhCUOvKPBZ/+YrLIc4nDLxR9Yc+MeIXY7TArA=";
diff --git a/pkgs/by-name/gm/gmic/package.nix b/pkgs/by-name/gm/gmic/package.nix
index 89f3e13b3919..481699eb5b2d 100644
--- a/pkgs/by-name/gm/gmic/package.nix
+++ b/pkgs/by-name/gm/gmic/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchurl,
+  buildPackages,
   cimg,
   cmake,
   common-updater-scripts,
@@ -96,6 +97,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace CMakeLists.txt \
         --replace "LD_LIBRARY_PATH" "DYLD_LIBRARY_PATH"
+    ''
+    + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      substituteInPlace CMakeLists.txt --replace-fail \
+        'LD_LIBRARY_PATH=''${GMIC_BINARIES_PATH} ''${GMIC_BINARIES_PATH}/gmic' \
+        '${lib.getExe buildPackages.gmic}'
     '';
 
   passthru = {
diff --git a/pkgs/by-name/gr/grpc_cli/package.nix b/pkgs/by-name/gr/grpc_cli/package.nix
index 9682fadc552d..639282db9958 100644
--- a/pkgs/by-name/gr/grpc_cli/package.nix
+++ b/pkgs/by-name/gr/grpc_cli/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.69.0";
+  version = "1.70.0";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-rRiPUcr6of/sjqB+qr7eOkKVFGTnu8UjluULmcn8df4=";
+    hash = "sha256-kJhGAhqu25Q2g6BWkVGp6nGYrWdBnMhoMu6e7ifNbgk=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index 70a185ecea1e..7a1241b80885 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.20.13";
+  version = "2.20.14";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-BcI5LHAKDpd68w/D7TKOS3ChthsiWislm3yKyd0cSkM=";
+    hash = "sha256-42prPQTrjTgfHiwcpIKHpuiQLw4xhZ3wK1PkVLaC4OQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index d55803b46007..e93cdcaceca0 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -28,13 +28,13 @@
 
 gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lT6f/5NB73xj9cVesi2SNsL5jVciwZJp8QRohiv+3Hk=";
+    hash = "sha256-PotjNmR69yAEZP/Dn4lB0p7sHBjAPclNDbc5WkBZx4s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprpaper/package.nix b/pkgs/by-name/hy/hyprpaper/package.nix
index 3ce41db29987..bbf718c12f11 100644
--- a/pkgs/by-name/hy/hyprpaper/package.nix
+++ b/pkgs/by-name/hy/hyprpaper/package.nix
@@ -2,7 +2,6 @@
   lib,
   gcc14Stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   cairo,
   expat,
@@ -33,24 +32,15 @@
 
 gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpaper";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprpaper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IRZ5NrKFwBVueYrZYUQfpTwp2rZHgAkPwgvdnfVBF8E=";
+    hash = "sha256-pmkJCzjflvsOytiu2mgn2wfSeyL6mTfoi214T4A2OZQ=";
   };
 
-  patches = [
-    # FIXME: remove in next release
-    (fetchpatch2 {
-      name = "fix-hypr-wayland-scanner-0.4.4-build.patch";
-      url = "https://github.com/hyprwm/hyprpaper/commit/505e447b6c48e6b49f3aecf5da276f3cc5780054.patch?full_index=1";
-      hash = "sha256-Vk2P2O4XQiCYqV0KbK/ADe8KPmaTs3Mg7JRJ3cGW9lM=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/ip/ipatool/package.nix b/pkgs/by-name/ip/ipatool/package.nix
index ea9bf1fdd9ea..b3803294619b 100644
--- a/pkgs/by-name/ip/ipatool/package.nix
+++ b/pkgs/by-name/ip/ipatool/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "ipatool";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "majd";
     repo = "ipatool";
     rev = "v${version}";
-    hash = "sha256-e+gkr8i6dVfxyBM5Vi2YpW4eQ4LE2vhgQadLAFeHK4Q=";
+    hash = "sha256-HniMGlT4RaX7OGcQ6z8Ms6O78dWN4iK+ODzmYfxFNPw=";
   };
 
-  vendorHash = "sha256-aVMWXlHMGdbApKLhuZZpaAYY5QpMMgXc/6f9r79/dTw=";
+  vendorHash = "sha256-/uB4mviMaPyYX59XrRqigOI0YK3necdRC2ZPErai1NU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index bde21bdc48a8..b208b5255ee3 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.0.2-8";
+  version = "7.0.2-9";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    hash = "sha256-gpbMVVMV1ywbSb6A3IGFS/vnBk9EXTNzaW1r8Ygo1RY=";
+    hash = "sha256-zaBu/hhFIMjneb7yUzToaJJAaSptxLld8zOvfGckHLY=";
   };
 }).overrideAttrs (old: {
   pname = "jellyfin-ffmpeg";
diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index 625fad1d092c..cbb542a8fdb1 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "jjui";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
-    rev = "v${version}";
-    hash = "sha256-MdSzY2JWL34qB13mX4FWG/4wzl30FmATYQ09N1v5Isc=";
+    tag = "v${version}";
+    hash = "sha256-V2HwVpZ7K7mYoZECOc+dfXuvBlRsN5OgRHasdpX+kFw=";
   };
 
   vendorHash = "sha256-pzbOFXSlEebc4fCyNyQSdeVqar+HfEjsSyJo+mHkQeg=";
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index 449304dc5c1e..14c73156648f 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "sha256-+xU/B4BfRnnoNvFDp09c0gSuccOsvqerBe+OASxukFw=";
+    sha256 = "sha256-59nW3pfyG/M+kHvZhqQDgCXzlIea8KX9GXhyA6w7ITE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ku/kubescape/package.nix b/pkgs/by-name/ku/kubescape/package.nix
index 845fd6110169..41198bfc8f02 100644
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "3.0.23";
+  version = "3.0.24";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     tag = "v${version}";
-    hash = "sha256-LC5m+r38mm5c8dmlo4+E5eWlfF0xJIglTcGpvY3EDOg=";
+    hash = "sha256-gzwdDUYOHZnd9mMHmuW9q1xhxWjpk5u/yoxdJkSNrVA=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-J8+GyOgzR2MkJSskM7lzloyKw/JywCT38WFnosg6ACM=";
+  vendorHash = "sha256-GL5V3f2hiTzNDhBKyvyT8BlbRCaPSJXLy/+xiYjhsvw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ld/ldeep/package.nix b/pkgs/by-name/ld/ldeep/package.nix
index 3c43a5cfe6bb..2c76328c9fc8 100644
--- a/pkgs/by-name/ld/ldeep/package.nix
+++ b/pkgs/by-name/ld/ldeep/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ldeep";
-  version = "1.0.79";
+  version = "1.0.81";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "franc-pentest";
     repo = "ldeep";
     tag = version;
-    hash = "sha256-tq5M1YOTiXHdv8dTw2acnBzz0lZu6TtZFEi9rC1Sx14=";
+    hash = "sha256-IpqQNZJ6+aBhwLds0CmKKC/JM5VoU4uFz9x4E5JHa1k=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/le/leptonica/package.nix b/pkgs/by-name/le/leptonica/package.nix
index 41af5b44a967..c9950cba2174 100644
--- a/pkgs/by-name/le/leptonica/package.nix
+++ b/pkgs/by-name/le/leptonica/package.nix
@@ -1,26 +1,58 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, which, gnuplot
-, giflib, libjpeg, libpng, libtiff, libwebp, openjpeg, zlib
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  autoreconfHook,
+  pkg-config,
+  which,
+  gnuplot,
+  giflib,
+  libjpeg,
+  libpng,
+  libtiff,
+  libwebp,
+  openjpeg,
+  zlib,
 }:
 
 stdenv.mkDerivation rec {
   pname = "leptonica";
-  version = "1.84.1";
+  version = "1.85.0";
 
-  src = fetchurl {
-    url = "https://github.com/DanBloomberg/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-Kz4SVLHMo4HnfIGbWcqZd0/0NTAgm5rrUR4dRliKZPY=";
+  src = fetchFromGitHub {
+    owner = "DanBloomBerg";
+    repo = pname;
+    rev = version;
+    hash = "sha256-meiSi0qL4i/KCMe5wsRK1/mbuRLHUb55DDOnxkrXZSs=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ giflib libjpeg libpng libtiff libwebp openjpeg zlib ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = [
+    giflib
+    libjpeg
+    libpng
+    libtiff
+    libwebp
+    openjpeg
+    zlib
+  ];
   enableParallelBuilding = true;
 
-  nativeCheckInputs = [ which gnuplot ];
+  nativeCheckInputs = [
+    which
+    gnuplot
+  ];
 
   # Fails on pngio_reg for unknown reason
   doCheck = false; # !stdenv.hostPlatform.isDarwin;
 
+  passthru.updateScript = nix-update-script { };
   meta = {
+    maintainers = with lib.maintainers; [ patrickdag ];
     description = "Image processing and analysis library";
     homepage = "http://www.leptonica.org/";
     license = lib.licenses.bsd2; # http://www.leptonica.org/about-the-license.html
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index cf825c44a757..c16f5c6ce64a 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.154.3";
+  version = "1.155.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     tag = "v${version}";
-    hash = "sha256-SjNFgvg6sHW40v13OuR3BL3+JdDxntDCKtbe/C/04as=";
+    hash = "sha256-gmlIhB0Vou0fYXORAs01o87m6BtyJokvJQWYqCWY11I=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "deltachat-core-rust";
     inherit version src;
-    hash = "sha256-kbSRGuyCJlTxzKr/C+MLczqT7WNTqZ2/Z42psbBFW+w=";
+    hash = "sha256-R7LWMUIxSVYdxkA1GBmXyh5FS9I4i4YjOgR8CX6whpw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libtomcrypt/package.nix b/pkgs/by-name/li/libtomcrypt/package.nix
index f2a74bba838b..35bb906ee2a2 100644
--- a/pkgs/by-name/li/libtomcrypt/package.nix
+++ b/pkgs/by-name/li/libtomcrypt/package.nix
@@ -24,13 +24,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [
-    libtool
+  buildInputs = [
     libtommath
   ];
 
   postPatch = ''
-    substituteInPlace makefile.shared --replace "LIBTOOL:=glibtool" "LIBTOOL:=libtool"
+    substituteInPlace makefile.shared \
+      --replace-fail "LIBTOOL:=glibtool" "LIBTOOL:=libtool" \
+      --replace-fail libtool "${lib.getExe libtool}"
   '';
 
   preBuild = ''
diff --git a/pkgs/by-name/li/limo/package.nix b/pkgs/by-name/li/limo/package.nix
index 7acd6bc5757b..b3fdb4e4ab1e 100644
--- a/pkgs/by-name/li/limo/package.nix
+++ b/pkgs/by-name/li/limo/package.nix
@@ -10,6 +10,7 @@
   libarchive,
   libcpr,
   libloot,
+  lz4,
   pugixml,
 
   libsForQt5,
@@ -20,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "limo";
-  version = "1.0.11";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "limo-app";
     repo = "limo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KQD7U9sHHsxKIzMbrYqhTBUfFZpsoqiSxz5zMNIxU4o=";
+    hash = "sha256-fzqIZ/BqOpPjo18qi4VidGg1ruhQLqfwoA/hidGPEao=";
   };
 
   patches = lib.optionals (!withUnrar) [
@@ -48,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
       libarchive
       libcpr
       libloot
+      lz4
       pugixml
 
       libsForQt5.qtbase
@@ -61,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags =
     [
       (lib.cmakeFeature "LIMO_INSTALL_PREFIX" (placeholder "out"))
+    ]
+    ++ lib.optionals (withUnrar) [
       (lib.cmakeBool "USE_SYSTEM_LIBUNRAR" true)
     ]
     ++ lib.optionals (!withUnrar) [
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 550269e1639e..f37a7b81d83b 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -82,13 +82,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "4529";
+  version = "4546";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-YqXL6nxUQrF/RI9GEzlBo6iiaLFYba0cXsVVqM/aGTw=";
+    hash = "sha256-NUt6Q372jsCzcSAEqe2VZB2ZUpGSZyrvr0wyqrBYoOY=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index c4011b066d0c..faccb2953d7e 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.211";
+  version = "1.212";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-w3Rk0NDYXPzzg1JGsC6zIvr0SiM3ZzHHW9NwHNAhnaM=";
+    hash = "sha256-g64kMY/9kHSlUH2rvDxKy4nmS+TH//SNJfCnQXHC4Q8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ma/marktext/package.nix b/pkgs/by-name/ma/marktext/package.nix
index 0ab0eb5ba935..1a095a3520eb 100644
--- a/pkgs/by-name/ma/marktext/package.nix
+++ b/pkgs/by-name/ma/marktext/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "marktext";
-  version = "0.17.1-unstable-2024-06-10";
+  version = "0.17.0-unstable-2024-06-10";
 
   src = fetchFromGitHub {
     owner = "marktext";
     repo = "marktext";
-    rev = "cd8452979bf2441f8064968ab1f9ae28302c9d75";
-    hash = "sha256-6oD9Bp0XonhNHWA8JajyWdNkAXpX4GoKPpdLzpvr+jM=";
+    rev = "11c8cc1e1929a7975df39fa5f4503130fef53547";
+    hash = "sha256-5PIOTg4/RBave/b3CArQSLvmA64ME9++3O1JT4lgKm0=";
     postFetch = ''
       cd $out
       patch -p1 < ${./0001-update-electron.patch}
diff --git a/pkgs/by-name/ma/matomo/package.nix b/pkgs/by-name/ma/matomo/package.nix
index 7954fe5009f2..ba607cbd1c1f 100644
--- a/pkgs/by-name/ma/matomo/package.nix
+++ b/pkgs/by-name/ma/matomo/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "matomo";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "https://builds.matomo.org/matomo-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5glMwwIG0Uo8bu904u40FUa+yaUlrQe1nUCkv9/ATks=";
+    hash = "sha256-ZEwz/KKZZwTFsKfwR0iKZM1ta4CUXJsWgBXika+pjb0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index b3882597b015..93de6a156b3b 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -16,6 +16,8 @@
   usage,
   mise,
   testers,
+  runCommand,
+  jq,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -89,7 +91,30 @@ rustPlatform.buildRustPackage rec {
 
   passthru = {
     updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = mise; };
+    tests = {
+      version = testers.testVersion { package = mise; };
+      usageCompat =
+        # should not crash
+        runCommand "mise-usage-compatibility"
+          {
+            nativeBuildInputs = [
+              mise
+              usage
+              jq
+            ];
+          }
+          ''
+            export HOME=$(mktemp -d)
+
+            spec="$(mise usage)"
+            for shl in bash fish zsh; do
+              echo "testing $shl"
+              usage complete-word --shell $shl --spec "$spec"
+            done
+
+            touch $out
+          '';
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 81fc56bf02d5..2fd6497c3ed0 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -5,13 +5,13 @@
   autoPatchelfHook,
   curl,
   openssl,
-  testers,
-  mongodb-ce,
+  versionCheckHook,
   writeShellApplication,
   jq,
   nix-update,
   gitMinimal,
   pup,
+  nixosTests,
 }:
 
 let
@@ -63,6 +63,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mongod";
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
   passthru = {
 
     updateScript =
@@ -102,9 +107,8 @@ stdenv.mkDerivation (finalAttrs: {
         command = lib.getExe script;
       };
 
-    tests.version = testers.testVersion {
-      package = mongodb-ce;
-      command = "mongod --version";
+    tests = {
+      inherit (nixosTests) mongodb-ce;
     };
   };
 
diff --git a/pkgs/by-name/mo/monitorcontrol/package.nix b/pkgs/by-name/mo/monitorcontrol/package.nix
index 92932d8e059a..197dba9c9389 100644
--- a/pkgs/by-name/mo/monitorcontrol/package.nix
+++ b/pkgs/by-name/mo/monitorcontrol/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchurl,
   stdenv,
-  _7zz,
+  undmg,
 }:
 
 # This cannot be built from source due to the problematic nature of XCode - so
@@ -10,18 +10,23 @@
 
 stdenv.mkDerivation rec {
   pname = "MonitorControl";
-  version = "4.2.0";
+  version = "4.3.3";
 
   src = fetchurl {
     url = "https://github.com/MonitorControl/${pname}/releases/download/v${version}/MonitorControl.${version}.dmg";
-    sha256 = "Q96uK6wVe1D2uLvWL+pFR6LcmrU7cgmr2Y5tPvvTDgI=";
+    hash = "sha256-myx3adoU3FYYrs6LFRSiXtwSsoaujjQ/PYgAF/Xuk2g=";
   };
 
-  # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
-  nativeBuildInputs = [ _7zz ];
+  nativeBuildInputs = [ undmg ];
 
   sourceRoot = "MonitorControl.app";
 
+  unpackCmd = ''
+    runHook preUnpack
+    undmg $src
+    runHook postUnpack
+  '';
+
   installPhase = ''
     mkdir -p "$out/Applications/MonitorControl.app"
     cp -R . "$out/Applications/MonitorControl.app"
diff --git a/pkgs/by-name/mo/mov-cli/package.nix b/pkgs/by-name/mo/mov-cli/package.nix
index 3637bd41eb92..0e0c0004ebe3 100644
--- a/pkgs/by-name/mo/mov-cli/package.nix
+++ b/pkgs/by-name/mo/mov-cli/package.nix
@@ -9,7 +9,7 @@
 
 let
   pname = "mov-cli";
-  version = "4.4.15";
+  version = "4.4.16";
 in
 python3.pkgs.buildPythonPackage {
   inherit pname version;
@@ -19,7 +19,7 @@ python3.pkgs.buildPythonPackage {
     owner = "mov-cli";
     repo = "mov-cli";
     tag = version;
-    hash = "sha256-mHtKQtLhHYwd2GEA0rCZQ4C/DEgsc6Rk7ZLpXFyW5d8=";
+    hash = "sha256-hOnbBXzg9S0pqEcdXVrdG+P9tLqE8NC++ppOwqd+y+M=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 994826d6d854..e1ef604a18b2 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -4,18 +4,19 @@
   pkg-config,
   libsodium,
   buildGoModule,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "museum";
-  version = "0.9.53";
+  version = "0.9.81";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-aczWqK6Zymvl46fHN6QXT0f5V2lpC+8kpSbEoTiP+7k=";
+    hash = "sha256-4vX3UWbYYCjNxtSNUAE9hg9NokeJFPTjLvHYTkQlB0w=";
   };
 
   vendorHash = "sha256-Vz9AodHoClSmo51ExdOS4bWH13i1Sug++LQMIsZY2xY=";
@@ -40,6 +41,13 @@ buildGoModule rec {
       $out/share/museum
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "photos-v(.*)"
+    ];
+  };
+
   meta = {
     description = "API server for ente.io";
     homepage = "https://github.com/ente-io/ente/tree/main/server";
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index abb136321a3f..2b9975e48e98 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -502,6 +502,9 @@ def execute(argv: list[str]) -> None:
                         specialisation=args.specialisation,
                         install_bootloader=args.install_bootloader,
                     )
+                    print_result("Done. The new configuration is", path_to_config)
+                case Action.BUILD:
+                    print_result("Done. The new configuration is", path_to_config)
                 case Action.BUILD_VM | Action.BUILD_VM_WITH_BOOTLOADER:
                     # If you get `not-found`, please open an issue
                     vm_path = next(path_to_config.glob("bin/run-*-vm"), "not-found")
diff --git a/pkgs/by-name/nw/nwg-dock/package.nix b/pkgs/by-name/nw/nwg-dock/package.nix
index 5b2ecdb95d51..c3cc4c19ea72 100644
--- a/pkgs/by-name/nw/nwg-dock/package.nix
+++ b/pkgs/by-name/nw/nwg-dock/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9s0kweFBxzNYZOqIGG/hPF1DsECm7N0dhgRlc7DGUOc=";
+    sha256 = "sha256-Ymk4lpX8RAxWot7U+cFtu1eJd6VHP+JS1I2vF0V1T70=";
   };
 
   vendorHash = "sha256-iR+ytThRwmCvFEMcpSELPRwiramN5jPXAjaJtda4pOw=";
diff --git a/pkgs/by-name/od/odin/package.nix b/pkgs/by-name/od/odin/package.nix
index 6aa3f7ed1606..d6669f2e0a32 100644
--- a/pkgs/by-name/od/odin/package.nix
+++ b/pkgs/by-name/od/odin/package.nix
@@ -91,7 +91,6 @@ stdenv.mkDerivation {
     mainProgram = "odin";
     maintainers = with lib.maintainers; [
       astavie
-      znaniye
     ];
     platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isMusl;
diff --git a/pkgs/by-name/ol/ols/package.nix b/pkgs/by-name/ol/ols/package.nix
index 39f11a15c51d..98ac10309089 100644
--- a/pkgs/by-name/ol/ols/package.nix
+++ b/pkgs/by-name/ol/ols/package.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       astavie
-      znaniye
     ];
     mainProgram = "ols";
   };
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 6b58757fc0fd..cde4b0d81e04 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -7,19 +7,19 @@
 }:
 let
   pname = "open-webui";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-9HRUFG8knKJx5Fr0uxLPMwhhbNnQ7CSywla8LGZu8l4=";
+    hash = "sha256-spdwd3ffibmHb9LDgK1EkpUAK6OsD9d6gocrbEx/CrE=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-copQjrFgVJ6gZ8BwPiIsHEKSZDEiuVU3qygmPFv5Y1A=";
+    npmDepsHash = "sha256-9wu5SWtom/pZrFRP8rrsZMoGEnN4MVAlkyeydr0Fslo=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
diff --git a/pkgs/by-name/pi/pinact/package.nix b/pkgs/by-name/pi/pinact/package.nix
index f09487dcc088..f3eae241bfc9 100644
--- a/pkgs/by-name/pi/pinact/package.nix
+++ b/pkgs/by-name/pi/pinact/package.nix
@@ -8,19 +8,19 @@
 
 let
   pname = "pinact";
-  version = "1.1.2";
+  version = "1.2.0";
   src = fetchFromGitHub {
     owner = "suzuki-shunsuke";
     repo = "pinact";
     tag = "v${version}";
-    hash = "sha256-QBWxs0YRTWItJ1aTG33Z6vK8/vaZBTuZAVPYqD6dIvE=";
+    hash = "sha256-OmWt4EyUHZyQDIj1Uro+bnC29MNi6wlXO2ksRP84F2U=";
   };
   mainProgram = "pinact";
 in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-Y44nJv0eWM0xO+lB56OBcEe/CCipPj8Ptg7WuJ2Vszo=";
+  vendorHash = "sha256-sZv91EYksNmMhWbT/5PUQTM2gND/8b4ORVfMNtlAI2A=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index ddc1bb4e0df0..1c3de33192a4 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "pkgsite";
-  version = "0-unstable-2025-01-08";
+  version = "0-unstable-2025-01-21";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "840de57bb85975c3c0bcb24ba00fee86ef8c0748";
-    hash = "sha256-TNnZG9Q3RmB5TfHDqPCHfChsdkZ6FOErbzo47cRXhTw=";
+    rev = "ce52a304a0f4dccd8ae7abfdd3712c9dae7b4f34";
+    hash = "sha256-6fZr9mi6SGIe7AUNv6cS6R+kBNjFbPfdamnpGclimWQ=";
   };
 
   vendorHash = "sha256-Z+Ji3RO2zn5vn9DXOAxyeI4OZXGOfyVdfdIsNyJHZpE=";
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index 2e8143793bfc..c600d2525aeb 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -15,6 +15,7 @@
   musl,
   nss,
   patchelf,
+  openssl,
   stdenv,
   xorg,
 }:
@@ -48,6 +49,7 @@ stdenv.mkDerivation {
       musl
       nss
       stdenv.cc.cc
+      openssl
       xorg.libX11
       xorg.libXcomposite
       xorg.libXdamage
diff --git a/pkgs/by-name/qr/qrcp/package.nix b/pkgs/by-name/qr/qrcp/package.nix
index 1e965ad41bdd..7b4bee0d3be1 100644
--- a/pkgs/by-name/qr/qrcp/package.nix
+++ b/pkgs/by-name/qr/qrcp/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "qrcp";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "claudiodangelis";
     repo = "qrcp";
-    rev = version;
-    hash = "sha256-MmWBcDtZUDX5IV7XXifBp7KfeRh+0qU4vdfCoMv/UNk=";
+    tag = "v${version}";
+    hash = "sha256-Ueow5lFnLLeJxk1+hcH4bhwrNu17pgJ50CXd2Adswvg=";
   };
 
-  vendorHash = "sha256-lqGPPyoSO12MyeYIuYcqDVHukj7oR3zmHgsS6SxY3yo=";
+  vendorHash = "sha256-0x35Ds3v5youpSBapgkP8R7YW3FuninFM5pyd2PJRP4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/qu/quartus-prime-lite/package.nix b/pkgs/by-name/qu/quartus-prime-lite/package.nix
index 75ddc5450147..94c3b8c74b04 100644
--- a/pkgs/by-name/qu/quartus-prime-lite/package.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/package.nix
@@ -54,6 +54,7 @@ buildFHSEnv rec {
       xorg.libSM
       xorg.libXau
       xorg.libXdmcp
+      xorg.libXScrnSaver
       libudev0-shim
       bzip2
       brotli
diff --git a/pkgs/by-name/ra/rasm/package.nix b/pkgs/by-name/ra/rasm/package.nix
index 1d40233a15d9..77081f621490 100644
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rasm";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "EdouardBERGE";
     repo = "rasm";
     rev = "v${version}";
-    hash = "sha256-xDiGVPXi12P2YzSESO4I4WGeQgWU9UPhJbenoN8sADc=";
+    hash = "sha256-vuOI29VMTBWIyP7jRIwYbXKWf9ijg8HqLhMEj1R9iQQ=";
   };
 
   # by default the EXEC variable contains `rasm.exe`
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index b115c57a6a75..b5bd2b651403 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.01.06.00";
+  version = "2025.01.20.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-3Wa10eLlvOXw8DZAwQiCTGFOcUEsHvYhl6OTEYsCdZ8=";
+    hash = "sha256-dmx9FPgyVz5s32peKTg4xA72JD7X2R9ks8HSna3msmA=";
   };
 
-  cargoHash = "sha256-UI70YLTR/+fKh+4wD2hZJyuzN4ZNUCkrhyf9CRepetA=";
+  cargoHash = "sha256-cZ4Xs2EdajbGLE5c+KzUGH94dJvHpHRDyCISFm/B7qc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 9aeeecaa1c4b..a1b0b6a9896c 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -7,11 +7,11 @@
 renode.overrideAttrs (
   finalAttrs: _: {
     pname = "renode-unstable";
-    version = "1.15.3+20250109git606a24e00";
+    version = "1.15.3+20250121git0a17b4a64";
 
     src = fetchurl {
       url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-      hash = "sha256-ZA52irUSACBBLkJ1o75SHVFIxlaNQV25VTcUfjv6bPk=";
+      hash = "sha256-8RQaupK2mk79JQK4wLknuE9KLPF7tkrIjptwLr9VH1c=";
     };
 
     passthru.updateScript =
diff --git a/pkgs/by-name/re/retrospy/package.nix b/pkgs/by-name/re/retrospy/package.nix
index 68bedc968f87..8f0f3b81fd4e 100644
--- a/pkgs/by-name/re/retrospy/package.nix
+++ b/pkgs/by-name/re/retrospy/package.nix
@@ -8,13 +8,13 @@
   runCommandLocal,
 }:
 let
-  version = "6.6";
+  version = "6.7";
 
   src = fetchFromGitHub {
     owner = "retrospy";
     repo = "RetroSpy";
     rev = "v${version}";
-    hash = "sha256-vYhFpmP9CmZz/lqNwNAvpf7pQnhKR/pdetPJqorUtMY=";
+    hash = "sha256-L16LezV9z7pCRcXKv+KfGTCbCQfBd3y3dUidNeJUznQ=";
   };
 
   executables = [
@@ -76,5 +76,6 @@ buildDotnetModule {
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.naxdy ];
     platforms = lib.platforms.linux;
+    mainProgram = "RetroSpy";
   };
 }
diff --git a/pkgs/by-name/ro/roslyn-ls/cachedirectory.patch b/pkgs/by-name/ro/roslyn-ls/cachedirectory.patch
new file mode 100644
index 000000000000..23aec8aa8af1
--- /dev/null
+++ b/pkgs/by-name/ro/roslyn-ls/cachedirectory.patch
@@ -0,0 +1,13 @@
+diff --git a/src/LanguageServer/Microsoft.CodeAnalysis.LanguageServer/Program.cs b/src/LanguageServer/Microsoft.CodeAnalysis.LanguageServer/Program.cs
+index 5c80f55e9dd..17373f36ebf 100644
+--- a/src/LanguageServer/Microsoft.CodeAnalysis.LanguageServer/Program.cs
++++ b/src/LanguageServer/Microsoft.CodeAnalysis.LanguageServer/Program.cs
+@@ -97,7 +97,7 @@ static async Task RunAsync(ServerConfiguration serverConfiguration, Cancellation
+     var assemblyLoader = new CustomExportAssemblyLoader(extensionManager, loggerFactory);
+     var typeRefResolver = new ExtensionTypeRefResolver(assemblyLoader, loggerFactory);
+ 
+-    var cacheDirectory = Path.Combine(Path.GetDirectoryName(typeof(Program).Assembly.Location)!, "cache");
++    var cacheDirectory = Path.Combine(Environment.GetEnvironmentVariable("XDG_CACHE_HOME") ?? Path.Combine(Environment.GetEnvironmentVariable("HOME")!, ".cache"), "roslyn");
+ 
+     using var exportProvider = await ExportProviderBuilder.CreateExportProviderAsync(extensionManager, assemblyLoader, serverConfiguration.DevKitDependencyPath, cacheDirectory, loggerFactory);
+ 
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 52fe26f065cd..6e01757f5149 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -50,9 +50,14 @@ buildDotnetModule rec {
 
   nativeBuildInputs = [ jq ];
 
-  # until upstream updates net6.0 here:
-  # https://github.com/dotnet/roslyn/blob/6cc106c0eaa9b0ae070dba3138a23aeab9b50c13/eng/targets/TargetFrameworks.props#L20
-  patches = [ ./force-sdk_8_0.patch ];
+  patches = [
+    # until upstream updates net6.0 here:
+    # https://github.com/dotnet/roslyn/blob/6cc106c0eaa9b0ae070dba3138a23aeab9b50c13/eng/targets/TargetFrameworks.props#L20
+    ./force-sdk_8_0.patch
+    # until made configurable/and or different location
+    # https://github.com/dotnet/roslyn/issues/76892
+    ./cachedirectory.patch
+  ];
 
   postPatch = ''
     # Upstream uses rollForward = latestPatch, which pins to an *exact* .NET SDK version.
diff --git a/pkgs/by-name/ro/routinator/package.nix b/pkgs/by-name/ro/routinator/package.nix
index 63b88774c790..b887bc6b4bc5 100644
--- a/pkgs/by-name/ro/routinator/package.nix
+++ b/pkgs/by-name/ro/routinator/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "routinator";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SUcAhXIPgYGFkUIgSrUJrxwWQvkkmWG/d12hv8+PQI0=";
+    hash = "sha256-6wYNuGSB55ozzPEbptfEEp/euzh/IRfNrdREWF0xGTU=";
   };
 
-  cargoHash = "sha256-1JxAbQPCQqDVry3wGIdY4q18rzCXlJ7Dnc8LIvhkW1g=";
+  cargoHash = "sha256-2fyfiwShxsz61nFTNfzjrbClnzIgjQP+kGHgZSB534I=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks;
diff --git a/pkgs/by-name/sh/shader-slang/package.nix b/pkgs/by-name/sh/shader-slang/package.nix
index a37c211cb91e..c4287d676979 100644
--- a/pkgs/by-name/sh/shader-slang/package.nix
+++ b/pkgs/by-name/sh/shader-slang/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shader-slang";
-  version = "2025.3";
+  version = "2025.3.1";
 
   src = fetchFromGitHub {
     owner = "shader-slang";
     repo = "slang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kEW36pAo10xm3qY47hXTAjiXF74qa5rfDlQ6/gcGHqs=";
+    hash = "sha256-YOZukHgXTgKyTp2b3Z0hwkipCwAkNoFlgVZfDlq1lz8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/sh/shaka-packager/package.nix b/pkgs/by-name/sh/shaka-packager/package.nix
index ec32bda90ddc..f893540846c5 100644
--- a/pkgs/by-name/sh/shaka-packager/package.nix
+++ b/pkgs/by-name/sh/shaka-packager/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shaka-packager";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "shaka-project";
     repo = "shaka-packager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xXKgL8sUP+meFXV9S/i7dao7BIkIx+e/ujjpew7xGL0=";
+    hash = "sha256-Syty10LHGIlP5Jw+UneQMN+wBz/ggvV0xV8+3ThU8SM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sh/showmethekey/package.nix b/pkgs/by-name/sh/showmethekey/package.nix
index 1af1969bb012..3281b3b5a123 100644
--- a/pkgs/by-name/sh/showmethekey/package.nix
+++ b/pkgs/by-name/sh/showmethekey/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "showmethekey";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "AlynxZhou";
     repo = "showmethekey";
     tag = "v${version}";
-    hash = "sha256-D8eh0Wun3bm5k2kuCgaEAR33O6i4aowifd1b0tSWV64=";
+    hash = "sha256-/pfXAn6dWFIHsP1VBj+Cf989RuVzv4IbSClbJEvGstI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sk/skim/package.nix b/pkgs/by-name/sk/skim/package.nix
index 8a2468a6b8c2..00ef53d2315d 100644
--- a/pkgs/by-name/sk/skim/package.nix
+++ b/pkgs/by-name/sk/skim/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "skim";
-  version = "0.15.7";
+  version = "0.16.0";
 
   outputs = [
     "out"
@@ -24,14 +24,14 @@ rustPlatform.buildRustPackage rec {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${version}";
-    hash = "sha256-vUKHyrvCGtRKziUqgIbgVP7YdH+UW3PFBECV/mo5RxY=";
+    hash = "sha256-6enC7LjhYuHQ2XyjcsuEDM0r3qMWE9MUuDvYGMswmOc=";
   };
 
   postPatch = ''
     sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/skim.vim
   '';
 
-  cargoHash = "sha256-/tfbhNlpx96jlzUYwbucXi+pk1IE2jqxgWYjNU+4mHg=";
+  cargoHash = "sha256-3IAft5ZP9da62SIBg2SmikirCAUgicmFUmkcI6yeWV8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sn/snapraid/package.nix b/pkgs/by-name/sn/snapraid/package.nix
index 0eae0f1a899d..dc9e35aca1ff 100644
--- a/pkgs/by-name/sn/snapraid/package.nix
+++ b/pkgs/by-name/sn/snapraid/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapraid";
-  version = "12.3";
+  version = "12.4";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    hash = "sha256-pkLooA3JZV/rPlE5+JeJN1QW2xAdNu7c/iFFtT4M4vc=";
+    hash = "sha256-7guTRH9AZCsQYyWLpws19/sEe9GVFop21GYPzXCK6Fg=";
   };
 
   VERSION = version;
diff --git a/pkgs/by-name/so/socalabs-sid/package.nix b/pkgs/by-name/so/socalabs-sid/package.nix
new file mode 100644
index 000000000000..516bf9c903aa
--- /dev/null
+++ b/pkgs/by-name/so/socalabs-sid/package.nix
@@ -0,0 +1,171 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  copyDesktopItems,
+  makeDesktopItem,
+  xorg,
+  freetype,
+  expat,
+  libGL,
+  libjack2,
+  curl,
+  webkitgtk_4_0,
+  libsysprof-capture,
+  pcre2,
+  util-linux,
+  libselinux,
+  libsepol,
+  libthai,
+  libxkbcommon,
+  libdatrie,
+  libepoxy,
+  libsoup_2_4,
+  lerc,
+  sqlite,
+  ninja,
+  # Disable VST building by default, since NixOS doesn't have a VST license
+  enableVST2 ? false,
+}:
+stdenv.mkDerivation {
+  pname = "socalabs-sid";
+  version = "1.1.0";
+
+  src =
+    (fetchFromGitHub {
+      owner = "FigBug";
+      repo = "SID";
+      rev = "bb826fdea39da0804c53d81d35bea29aeff4436d";
+      hash = "sha256-6IStysItOS7EltTCqdyo9vrsnSA1YYoN4y8Bjv1fhNk=";
+      fetchSubmodules = true;
+    }).overrideAttrs
+      (_: {
+        GIT_CONFIG_COUNT = 1;
+        GIT_CONFIG_KEY_0 = "url.https://github.com/.insteadOf";
+        GIT_CONFIG_VALUE_0 = "git@github.com:";
+      });
+
+  desktopItems = [
+    (makeDesktopItem {
+      type = "Application";
+      name = "socalabs-sid";
+      desktopName = "Socalabs SID";
+      comment = "Socalabs Commodore 64 SID Emulation Plugin (Standalone)";
+      icon = "SID";
+      exec = "SID";
+      categories = [
+        "Audio"
+        "AudioVideo"
+      ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    copyDesktopItems
+    ninja
+  ];
+
+  buildInputs = [
+    alsa-lib
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXinerama
+    xorg.libXrandr
+    xorg.libXtst
+    xorg.libXdmcp
+    xorg.xvfb
+    libGL
+    libjack2
+    libsysprof-capture
+    libselinux
+    libsepol
+    libthai
+    libxkbcommon
+    libdatrie
+    libepoxy
+    libsoup_2_4
+    lerc
+    freetype
+    curl
+    webkitgtk_4_0
+    pcre2
+    util-linux
+    sqlite
+    expat
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "JUCE_COPY_PLUGIN_AFTER_BUILD" false)
+    "--preset ninja-gcc"
+  ];
+
+  patchPhase = ''
+    substituteInPlace CMakeLists.txt \
+    --replace-fail 'FORMATS Standalone VST VST3 AU LV2' 'FORMATS Standalone ${lib.optionalString enableVST2 "VST"} VST3 LV2'
+
+    # we need to patch JUCE itself to enable jack MIDI support
+    # please https://github.com/juce-framework/JUCE/issues/952
+    # TODO: remove when juce updates :D
+    substituteInPlace modules/juce/modules/juce_audio_devices/native/juce_Midi_linux.cpp \
+    --replace-fail "port = client.createPort (portName, forInput, false);" "port = client.createPort (portName, forInput, true);"
+  '';
+
+  cmakeBuildType = "Release";
+
+  strictDeps = true;
+
+  preBuild = ''
+    # build takes 10 years without this set
+    HOME=(mktemp -d)
+
+    cd ../Builds/ninja-gcc
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2 $out/bin
+
+    ${lib.optionalString enableVST2 ''
+      mkdir -p $out/lib/vst
+      cp -r SID_artefacts/Release/VST/libSID.so $out/lib/vst
+    ''}
+
+    cp -r SID_artefacts/Release/LV2/SID.lv2 $out/lib/lv2
+    cp -r SID_artefacts/Release/VST3/SID.vst3 $out/lib/vst3
+
+    install -Dm755 SID_artefacts/Release/Standalone/SID $out/bin
+
+    install -Dm444 $src/plugin/Resources/icon.png $out/share/pixmaps/SID.png
+
+    runHook postInstall
+  '';
+
+  NIX_LDFLAGS = (
+    toString [
+      "-lX11"
+      "-lXext"
+      "-lXcomposite"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+      "-lXtst"
+      "-lXdmcp"
+    ]
+  );
+
+  meta = {
+    description = "Socalabs Commodore 64 SID Emulation Plugin";
+    homepage = "https://socalabs.com/synths/commodore-64-sid/";
+    mainProgram = "SID";
+    platforms = lib.platforms.linux;
+    license = [ lib.licenses.gpl3 ] ++ lib.optional enableVST2 lib.licenses.unfree;
+    maintainers = [ lib.maintainers.l1npengtul ];
+  };
+}
diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index 667531fe2209..1b32e51d4595 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -12,7 +12,7 @@
   polkit,
 }:
 let
-  version = "0.1.0";
+  version = "0.1.1";
 in
 rustPlatform.buildRustPackage {
   pname = "soteria";
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-lhS+37DqSgZrgrYgKGUpKMC22Qjdq9LPNS5k/dqvkRY=";
+    hash = "sha256-CinJEzH4GsCAzU8FiInulPHLm73KI4nLlAcskkjgeJM=";
   };
 
-  cargoHash = "sha256-NMSGSqdCu/kW6vv8+C7UC6oitZqlTklO1sRKDcc1T9o=";
+  cargoHash = "sha256-vv7gK0ZfwO2AHXXQcXfkne9wZl+8JH9h8vELdRjg8WM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/stalwart-cli/package.nix b/pkgs/by-name/st/stalwart-cli/package.nix
new file mode 100644
index 000000000000..1569f36a82aa
--- /dev/null
+++ b/pkgs/by-name/st/stalwart-cli/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  versionCheckHook,
+  stalwart-mail,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "stalwart-cli";
+  version = stalwart-mail.version;
+  src = stalwart-mail.src;
+
+  buildAndTestSubdir = "crates/cli";
+  cargoHash = "sha256-9gqk26qCic1N8LHXLX3fWyk/oQr3QifbmPzAEWL6ZHo=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "--version" ];
+
+  meta = {
+    description = "Stalwart Mail Server CLI";
+    homepage = "https://github.com/stalwartlabs/mail-server";
+    changelog = "https://github.com/stalwartlabs/mail-server/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "stalwart-cli";
+    maintainers = with lib.maintainers; [
+      giomf
+    ];
+  };
+}
diff --git a/pkgs/by-name/st/steampipe/package.nix b/pkgs/by-name/st/steampipe/package.nix
index 343aa4662c57..c47d8e7580f4 100644
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "1.0.1";
+  version = "1.0.2";
 
   env.CGO_ENABLED = 0;
 
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "turbot";
     repo = "steampipe";
     tag = "v${version}";
-    hash = "sha256-9Tlc6BlfSQyAmmk/G6TdWB0kWpbwzGWOPNNNgI3tYPM=";
+    hash = "sha256-qQAPOvBELJWnDLsxaqbLooPNwXFe+NoR2F9kT5rjv64=";
   };
 
-  vendorHash = "sha256-+y9OX/ywS/0AXCnVHf4VisTegFamt3sT/m43yVhbCNc=";
+  vendorHash = "sha256-/8MDRlPR53MTMtW/VF6XsJ2NdV4NLDF8aukx7Rm/D7A=";
   proxyVendor = true;
 
   postPatch = ''
diff --git a/pkgs/by-name/st/stenc/package.nix b/pkgs/by-name/st/stenc/package.nix
index 58c82ca15e54..4eef321366a4 100644
--- a/pkgs/by-name/st/stenc/package.nix
+++ b/pkgs/by-name/st/stenc/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  gitUpdater,
+  nix-update-script,
   autoreconfHook,
   pkg-config,
   pandoc,
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     installShellCompletion --bash bash-completion/stenc
   '';
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "SCSI Tape Encryption Manager";
diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 6e4978a6577f..f692bdd0adef 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.12";
+  version = "6.13";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-xH2pO+RbYFX03HQdfyDvr1DKEBYKWxAMEJspT9nAvf4=";
+    hash = "sha256-4gna8O4DjKWtzEwnfpJztNUfRqL/htpXXTZ0KsNQihc=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/st/stylance-cli/package.nix b/pkgs/by-name/st/stylance-cli/package.nix
index c6d6d82c827d..d0584a092852 100644
--- a/pkgs/by-name/st/stylance-cli/package.nix
+++ b/pkgs/by-name/st/stylance-cli/package.nix
@@ -5,14 +5,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "stylance-cli";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-YN7Y8dxwpZel1SeEgyckh4ZPuRqcAsNvc/fGRgvzeDw=";
+    hash = "sha256-Xh0xqD0B4uKu5uoEWNe0pf+ExhaqPBgsR1OEfKe0TvA=";
   };
 
-  cargoHash = "sha256-VKfQzsTTKIbh+X0suXyUXDsd8sDSRsc5SnO8qxcxGPQ=";
+  cargoHash = "sha256-am2vQ+PeJPU2ojeZm/AzXJxjP3aUkXnlmgcG9i8sv9g=";
 
   meta = with lib; {
     description = "Library and cli tool for working with scoped CSS in rust";
diff --git a/pkgs/by-name/su/sunshine/package.nix b/pkgs/by-name/su/sunshine/package.nix
index d1cfd6bbd85e..87f47b53f2d5 100644
--- a/pkgs/by-name/su/sunshine/package.nix
+++ b/pkgs/by-name/su/sunshine/package.nix
@@ -140,6 +140,7 @@ stdenv'.mkDerivation rec {
     ]
     ++ lib.optionals cudaSupport [
       cudaPackages.cudatoolkit
+      cudaPackages.cuda_cudart
     ]
     ++ lib.optionals stdenv.hostPlatform.isx86_64 [
       intel-media-sdk
diff --git a/pkgs/by-name/sw/swayfx-unwrapped/package.nix b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
index f771a0101e24..9e621c41ccaf 100644
--- a/pkgs/by-name/sw/swayfx-unwrapped/package.nix
+++ b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
@@ -33,6 +33,7 @@
   enableXWayland ? true,
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
   trayEnabled ? systemdSupport,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -57,6 +58,12 @@ stdenv.mkDerivation (finalAttrs: {
     [
       ./load-configuration-from-etc.patch
 
+      (fetchpatch2 {
+        # fix missing switch statement for newer libinput
+        url = "https://github.com/swaywm/sway/pull/8470.patch?full_index=1";
+        hash = "sha256-UTZ2DNEsGi5RYrgZThHkYz3AnnIl/KxieinA1WUZRq4=";
+      })
+
       (substituteAll {
         src = ./fix-paths.patch;
         inherit swaybg;
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index 79f2acbc612e..774866a05fb6 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.31.1";
+  version = "0.31.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-q/tIG+RS/guRcKLo1iXmXi8IcgXS2pfJNFEvn/jxFks=";
+    sha256 = "sha256-bgVFUBSb/vs+oEVUeF/PniqEkUAl3qRiuFWR4U+iHXo=";
   };
 
-  vendorHash = "sha256-/8tPq/piCrguFoRigzGoAUSBJ2C1AY0ghyHosPE5n68=";
+  vendorHash = "sha256-C1GpLDb4YWL0dXG/mUR+UVy17rnh0zgaICAU0C1bfq0=";
 
   doCheck = false;
   # Required for versions >= 0.28 as they introduce a gowork.sum file. This is only used for tests so we can safely disable GOWORK
diff --git a/pkgs/by-name/td/tdl/package.nix b/pkgs/by-name/td/tdl/package.nix
index 3eca5012ea1f..a721c86d3498 100644
--- a/pkgs/by-name/td/tdl/package.nix
+++ b/pkgs/by-name/td/tdl/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "tdl";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchFromGitHub {
     owner = "iyear";
     repo = "tdl";
     rev = "v${version}";
-    hash = "sha256-/aZ85FLGlNVfHG/LyfbvxBdZlne/s3ktw7RNmKeNSeI=";
+    hash = "sha256-30OClBZUjoLvZ0ZhSZx+AaS7fhjo8X392t4FQpxoG9Q=";
   };
 
-  vendorHash = "sha256-o1GVra4kbjkLtFkoqK+8We/Ov+JHsEI+4jJYX5tPimM=";
+  vendorHash = "sha256-QBqUa/PnT/Xma3SHq6YRGtVNKstTax1GVRsCDU12ETA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/temporal-cli/package.nix b/pkgs/by-name/te/temporal-cli/package.nix
index 8b45d33de589..eef36abd994a 100644
--- a/pkgs/by-name/te/temporal-cli/package.nix
+++ b/pkgs/by-name/te/temporal-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "temporal-cli";
-  version = "1.1.2";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-7wURMdi357w5S4s909PTUZanRzFyWM588DMY7iYWP88=";
+    hash = "sha256-79ANKgtKOxLmgp0qqybYJ78yWTjaOOdnEaPs0qCHje4=";
   };
 
-  vendorHash = "sha256-umGwew8RwewlYJQD1psYSd9bu67cPEiHBJkQRJGjyGY=";
+  vendorHash = "sha256-u4kLRdKMd27Jglk1+6SARjNm3WwFswGrnwxbyWmvsao=";
 
   overrideModAttrs = old: {
     # https://gitlab.com/cznic/libc/-/merge_requests/10
diff --git a/pkgs/by-name/te/terraform-ls/package.nix b/pkgs/by-name/te/terraform-ls/package.nix
index ca0531e334f1..9449895a8cb8 100644
--- a/pkgs/by-name/te/terraform-ls/package.nix
+++ b/pkgs/by-name/te/terraform-ls/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.36.3";
+  version = "0.36.4";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bn4eDAR3fYioT2kB7Hp0zP1190FMFAJ1L5lYFUUwhWk=";
+    hash = "sha256-20spDPVJC48r6Qy6KS8Yp6lUE22DuoOM17WPS3+KN9E=";
   };
 
-  vendorHash = "sha256-Qx18IisnEt0xr6Mb0nxjRp+ORu5xbmSJKrRCgRJFlbc=";
+  vendorHash = "sha256-+nE36oxW60OKTAEMetuZQhOCJraMTvU5f362k5aYVpc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/testkube/package.nix b/pkgs/by-name/te/testkube/package.nix
index d23c403e4977..1fa9d7d3df9e 100644
--- a/pkgs/by-name/te/testkube/package.nix
+++ b/pkgs/by-name/te/testkube/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "testkube";
-  version = "2.1.84";
+  version = "2.1.88";
 
   src = fetchFromGitHub {
     owner = "kubeshop";
     repo = "testkube";
     rev = "v${version}";
-    hash = "sha256-1w+n/CXFWVLROSlI/bo5g9MMb1UNsqFDz8mL+5Xxg/s=";
+    hash = "sha256-HHGY6tCB9e7RRnv9oK33Ys7kWpeDNHZkBk5RMKI1vLA=";
   };
 
-  vendorHash = "sha256-GCXbp8cJUji7vAEVpTP9T/mRIwfu5+TqEKtoOQWlxrY=";
+  vendorHash = "sha256-Dqqelz1pgLbJX2IuYfQ1HoUYkPQhzJ5A+1+XLCzFdxo=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/ti/ticktick/package.nix b/pkgs/by-name/ti/ticktick/package.nix
index d54dcdb2e53e..188aee8e1783 100644
--- a/pkgs/by-name/ti/ticktick/package.nix
+++ b/pkgs/by-name/ti/ticktick/package.nix
@@ -16,11 +16,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ticktick";
-  version = "6.0.20";
+  version = "6.0.21";
 
   src = fetchurl {
     url = "https://d2atcrkye2ik4e.cloudfront.net/download/linux/linux_deb_x64/ticktick-${finalAttrs.version}-amd64.deb";
-    hash = "sha256-aKUK0/9Y/ac9ISYJnWDUdwmvN8UYKzTY0f94nd8ofGw=";
+    hash = "sha256-e5N20FL2c6XdkDax0SMGigLuatXKZxb9c53sqQ5XVtM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/to/toast/package.nix b/pkgs/by-name/to/toast/package.nix
index 783098ee8be8..155bee53f2f9 100644
--- a/pkgs/by-name/to/toast/package.nix
+++ b/pkgs/by-name/to/toast/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "toast";
-  version = "0.47.6";
+  version = "0.47.7";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+qntd687LF4tJwHZglZ6mppHq3dOZ+l431oKBBNDI0k=";
+    sha256 = "sha256-vp70jv4F0VKd/OZHVRDcIJlKLwK9w+cV28lh0C7ESqg=";
   };
 
-  cargoHash = "sha256-A2sJ0o0RDztk3NjxG0CD8wNA4tmOizY4Tvff6ADzYQ8=";
+  cargoHash = "sha256-ezYwdUnM0xjDtmQEyTJEAoE/VjVEOOEgxvjrmusrJSY=";
 
   checkFlags = [ "--skip=format::tests::code_str_display" ]; # fails
 
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 699f0cbe3142..196591366b29 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "25.1.0";
+  version = "25.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     tag = "v${version}";
-    hash = "sha256-cb9U1xxN5pUVRiB8JKCWd4XtnkH72XH7QnvFATXaPgY=";
+    hash = "sha256-AMvYjspaLxqxq/6Nb5KMMfwWMhXfeB8NHWeveGNsWQY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/tw/twilio-cli/package.nix b/pkgs/by-name/tw/twilio-cli/package.nix
index 4af5c7ef5ca1..ed4c6ced0cf3 100644
--- a/pkgs/by-name/tw/twilio-cli/package.nix
+++ b/pkgs/by-name/tw/twilio-cli/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.22.8";
+  version = "5.22.9";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-1vDSFi6VL7s7IAMlTMj+7GrvY8evrnFPXaznSM27c6E=";
+    hash = "sha256-drQUlu5xc9HUlVP/OHDDWNEaSxT/90yhiKYh9bq2G4E=";
   };
 
   buildInputs = [ nodejs-slim ];
diff --git a/pkgs/by-name/ur/urlhunter/package.nix b/pkgs/by-name/ur/urlhunter/package.nix
index 315ce0d16343..9347fa3dfabd 100644
--- a/pkgs/by-name/ur/urlhunter/package.nix
+++ b/pkgs/by-name/ur/urlhunter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "urlhunter";
-  version = "0.1.2";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "utkusen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lX5zh+fYVSyWPUOnfRNMGZPsiuxjKBSpluPUMN9mZ+k=";
+    sha256 = "sha256-QRQLN8NFIIvlK+sHNj0MMs7tlBODMKHdWJFh/LwnysI=";
   };
 
-  vendorHash = "sha256-JDDxarFROBhdi76mY6udn++lReKLdju/JBpj3JhGdQA=";
+  vendorHash = "sha256-tlFCovCzqgaLcxcGmWXLYUjaAvFG0o11ei8uMzWJs6Q=";
 
   meta = with lib; {
     description = "Recon tool that allows searching shortened URLs";
diff --git a/pkgs/by-name/ve/ventoy/package.nix b/pkgs/by-name/ve/ventoy/package.nix
index 85af9e0bcbf8..82b06dc9dd8b 100644
--- a/pkgs/by-name/ve/ventoy/package.nix
+++ b/pkgs/by-name/ve/ventoy/package.nix
@@ -56,11 +56,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy";
-  version = "1.0.99";
+  version = "1.1.00";
 
   src = fetchurl {
     url = "https://github.com/ventoy/Ventoy/releases/download/v${finalAttrs.version}/ventoy-${finalAttrs.version}-linux.tar.gz";
-    hash = "sha256-RnzdGIp/c5vHBq28HWlfYf/e/JWRatsBWUfYCCnwCj0=";
+    hash = "sha256-J6Krr/pTHGcwWRkJdUVdt6YVg/IhUo4G2h7jjR6lcC8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/we/webex/package.nix b/pkgs/by-name/we/webex/package.nix
index 0604bf8f4755..278cb1551dc4 100644
--- a/pkgs/by-name/we/webex/package.nix
+++ b/pkgs/by-name/we/webex/package.nix
@@ -57,11 +57,11 @@
 
 stdenv.mkDerivation rec {
   pname = "webex";
-  version = "44.8.0.30404";
+  version = "44.10.2.31237";
 
   src = fetchurl {
-    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Gold/20240806164911/Webex_ubuntu.7z";
-    sha256 = "770067b495fcc3b376d77de65371f4196d0f1a0d718b84928d24aa6ea752d29b";
+    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Gold/20241119143249/Webex_ubuntu.7z";
+    sha256 = "27eb0d86fec8e6316a16913e44caed2d452b0397f188479b2e1c3d80f2d4d84e";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wo/workshop-runner/package.nix b/pkgs/by-name/wo/workshop-runner/package.nix
index 82f2eccb5053..579301859eaa 100644
--- a/pkgs/by-name/wo/workshop-runner/package.nix
+++ b/pkgs/by-name/wo/workshop-runner/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "workshop-runner";
-  version = "0.1.5";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "mainmatter";
     repo = "rust-workshop-runner";
     rev = "v${version}";
-    hash = "sha256-2lt4RloIRnFvWZ+HeZx7M2cg/wHb1/j0qDmhUhOoF+M=";
+    hash = "sha256-8Qq3kXFR4z9k7I6b9hN1JKOGNkzydo/wA99/X17iSkk=";
   };
 
-  cargoHash = "sha256-VoIAwPrkhrRl48czXtKWmLTktsZ/U4TVV924wx0DL+A=";
+  cargoHash = "sha256-pvcIN2nxLTt4nDEviJBdlX69xPtLZMyH2nVveOpD1R0=";
 
   meta = {
     description = "CLI tool to drive test-driven Rust workshops";
diff --git a/pkgs/by-name/zo/zoekt/package.nix b/pkgs/by-name/zo/zoekt/package.nix
index 09244585a55a..4bd747c77dc0 100644
--- a/pkgs/by-name/zo/zoekt/package.nix
+++ b/pkgs/by-name/zo/zoekt/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule {
   pname = "zoekt";
-  version = "3.7.2-2-unstable-2025-01-08";
+  version = "3.7.2-2-unstable-2025-01-21";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "zoekt";
-    rev = "b51a2335d51b865e1ffe84aa549e85570da61463";
-    hash = "sha256-D8jQ/u5kKRbOihbsX4U7RsoRoyqcJCqrELFt4YTgyj4=";
+    rev = "e7f0a1a349e11e1e834de840312e23716aeb0b95";
+    hash = "sha256-uH9v/Fxkfue2AWppDRpMJ0ROXOYo59GV2aAAKfYDU3M=";
   };
 
-  vendorHash = "sha256-laiBp+nMWEGofu7zOgfM2b8MIC+Dfw7eCLgb/5zf9oo=";
+  vendorHash = "sha256-7bpoUxhoVc74bN9/B6TWyufSvDRD90KpIXUMKK+3BcU=";
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index bab7cab1f300..68bd8497aad6 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -40,12 +40,12 @@ in
     { });
   julia_111-bin = wrapJulia (callPackage
     (import ./generic-bin.nix {
-      version = "1.11.2";
+      version = "1.11.3";
       sha256 = {
-        x86_64-linux = "8a372ad262d4d4d55a1044f4fe3bce7c9a4a3ce8c513d2470e58e8071eecd476";
-        aarch64-linux = "0346e6d65852a3b73ced2c80c40f5a8cf38e7048d001cd57d3d1dd9efb2f6641";
-        x86_64-darwin = "0b52ba3d7f283e43ba853bc3d0f401decf993d8d53da752bd644a9f934679184";
-        aarch64-darwin = "bcfe9c788f3dcf613a4753a4d9771d8381d00caf0e8af64d8aa87af10068b754";
+        x86_64-linux = "7d48da416c8cb45582a1285d60127ee31ef7092ded3ec594a9f2cf58431c07fd";
+        aarch64-linux = "0c1f2f60c3ecc37ae0c559db325dc64858fb11d6729b25d63f23e5285f7906ef";
+        x86_64-darwin = "5220aade1b43db722fb4e287f1c5d25aa492267b86a846db1546504836cca1be";
+        aarch64-darwin = "554fb0ddb4d94d623c83ca5e9d309fe1a7a0924445cb18ec3b863fb3367b0ba8";
       };
     })
     { });
@@ -69,8 +69,8 @@ in
     { });
   julia_111 = wrapJulia (callPackage
     (import ./generic.nix {
-      version = "1.11.2";
-      hash = "sha256-pzZblplE8n3w2FY3FsqXaeB/P3e5+fu0i80RTd91LKQ=";
+      version = "1.11.3";
+      hash = "sha256-Ansli0e04agdHs3TVa3v/bbAGBya2YjnF/XkdaEqHeg=";
       patches = [
         ./patches/1.11/0002-skip-failing-and-flaky-tests.patch
       ];
diff --git a/pkgs/development/compilers/julia/generic.nix b/pkgs/development/compilers/julia/generic.nix
index 16f7bbce0759..c04f28979a0a 100644
--- a/pkgs/development/compilers/julia/generic.nix
+++ b/pkgs/development/compilers/julia/generic.nix
@@ -91,6 +91,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  env = lib.optionalAttrs (lib.versionOlder version "1.11") {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-function-declaration"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
+
   meta = with lib; {
     description = "High-level performance-oriented dynamical language for technical computing";
     mainProgram = "julia";
diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index aa87f534dc70..7b4b5c6d438b 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.3.15";
-      hash = "sha256-sWdaT/cwtYEbjmp2h0iMQug14Vapl3aqPm8Ber2jvpg=";
+      version = "8.3.16";
+      hash = "sha256-6SCCGMvcuBaDS2xe2N3FdI+xL/d3z54OA7tIlidmCLY=";
     }
   );
 in
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index a5c67947b08d..a17780d33a9e 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "28.0.1";
+  version = "29.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bZh9zwP1Sux4aRDD/l3L5gu4iXwMbjJ+6+yJ42lNYtY=";
+    hash = "sha256-BYTPBerWCDGqcN3TpMLhtL92f413IjCgGDQqQUu5D7Y=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-h5vSdKETereFCS06HYqQPSExBWPGxJHnWCj8SJNeqE4=";
+  cargoHash = "sha256-CXMKg6xwzhrTEHu923LQAnQpo1YOQ0fceBpmVz6wM0U=";
   cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/qxmpp/default.nix b/pkgs/development/libraries/qxmpp/default.nix
index 7f4804c194ee..deab5402b73d 100644
--- a/pkgs/development/libraries/qxmpp/default.nix
+++ b/pkgs/development/libraries/qxmpp/default.nix
@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "qxmpp";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "qxmpp-project";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xqQUDFZgnBpUIv8kYvsNrJrIF259p3CccNn7u4vpxmY=";
+    sha256 = "sha256-gKA2hSkgeBe9vnhHQ3MxcQC+401gGoxSM7ETmRhvcbs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioacaia/default.nix b/pkgs/development/python-modules/aioacaia/default.nix
index 52fff8c8a6eb..74401c40d943 100644
--- a/pkgs/development/python-modules/aioacaia/default.nix
+++ b/pkgs/development/python-modules/aioacaia/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioacaia";
-  version = "0.1.13";
+  version = "0.1.14";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "zweckj";
     repo = "aioacaia";
     tag = "v${version}";
-    hash = "sha256-c+xtVUSyH9dBz97eI+8YYG/yW08kZFLNXnHudxYchCE=";
+    hash = "sha256-246/chGOaBlhEsoRcplWhRWvmaYgk6stRVqU+Crh+Kw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index a4584ba311c8..093e9c9d295d 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.6.0";
+  version = "0.6.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${version}";
-    hash = "sha256-Y6LVSk0Ut5G0aGzV+hAfGmdM8h8a+4NYycQqBKoElXU=";
+    hash = "sha256-mqxqlfpxfR5IH3MbYsLhBE36qkM7MgnyXdR0dlMr+t8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/aiowithings/default.nix b/pkgs/development/python-modules/aiowithings/default.nix
index 54d6e4d50aef..bb181edc80fb 100644
--- a/pkgs/development/python-modules/aiowithings/default.nix
+++ b/pkgs/development/python-modules/aiowithings/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiowithings";
-  version = "3.1.4";
+  version = "3.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "joostlek";
     repo = "python-withings";
     tag = "v${version}";
-    hash = "sha256-0UWwiLSTXcNDS30NWsKI1f/kTczdYXwRZr+JREU0NCM=";
+    hash = "sha256-bIeT+2iOXFf52ds5qLioUfUOpZ/vApdC+EiWjiXYwpg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 4f7f2ce33dce..622985e3f6ed 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.36.3";
+  version = "1.36.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-9KCsaCAuaZSG9/tyg5he3RcJMAYzuin+tMec5IjOWf4=";
+    hash = "sha256-omKsvzBXro4XZe+kEU6xypz2kgyYQRk4MiytYVWooVA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 20249bb5af1a..05ad19c6f1fe 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.36.3";
+  version = "1.36.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-MENwcLod9vBUmx3tcjrKdNBoUGEMffAC1kPgqp9MRSA=";
+    hash = "sha256-5gV/EnugGndwtnGvkkzGWiFNDBSirgVOsW4+pa1HU3I=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index b145d4ba8a82..70ea471ddf48 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.28.0";
+  version = "2.28.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_bigtable";
     inherit version;
-    hash = "sha256-BztPc0MxvbUXkNWg0LWL95kC/919USJ6vyiBgw+sgk0=";
+    hash = "sha256-FH3TTVNeZiZKbRbkOxQK4x2tNhcd2RxWN9n9mhYHaqA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index b1aa721e1305..ce6ab9354822 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -2,35 +2,24 @@
   lib,
   buildPythonPackage,
   cryptography,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   poetry-core,
   pyopenssl,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.14.0";
+  version = "1.15.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MIs7+c6CWtTUu6djcs8ZtdwcLOlqnSmPlkKXXmS9E90=";
+  src = fetchFromGitHub {
+    owner = "certbot";
+    repo = "josepy";
+    tag = "v${version}";
+    hash = "sha256-fK4JHDP9eKZf2WO+CqRdEjGwJg/WNLvoxiVrb5xQxRc=";
   };
 
-  patches = [
-    # don't fail tests on openssl deprecation warning, upstream is working on proper fix
-    # FIXME: remove for next update
-    (fetchpatch {
-      url = "https://github.com/certbot/josepy/commit/350410fc1d38c4ac8422816b6865ac8cd9c60fc7.diff";
-      hash = "sha256-QGbzonXb5BtTTWDeDqnZhbS6gHce99vIOm/H8QYeGXY=";
-    })
-  ];
-
   nativeBuildInputs = [ poetry-core ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index 11ba515da2e9..738208e38d8e 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "libretranslate";
-  version = "1.6.2";
+  version = "1.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LibreTranslate";
     tag = "v${version}";
-    hash = "sha256-u0m9dTxwSGU50YplV24daSO+WY/At648OpIEZYMmqqo=";
+    hash = "sha256-HEN+3hwfgPmXS5POK6jHGLWF5Tp4rCPKVbA9nWN3Q9I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llm-ollama/default.nix b/pkgs/development/python-modules/llm-ollama/default.nix
index fc6ffa59fdbf..e3012f0f74eb 100644
--- a/pkgs/development/python-modules/llm-ollama/default.nix
+++ b/pkgs/development/python-modules/llm-ollama/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "llm-ollama";
-  version = "0.8.1";
+  version = "0.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "taketwo";
     repo = "llm-ollama";
     tag = version;
-    hash = "sha256-9AgHX2FJRXSKZOLt7JR/9Fg4i2HGNQY2vSsJa4+2BGQ=";
+    hash = "sha256-/WAugfkI4izIQ7PoKM9epd/4vFxYPvsiwDbEqqTdMq4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 2178ab3ac7d9..035d71732e65 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -446,8 +446,8 @@ rec {
       "sha256-YrzTW5fEsZPDu4p84jhY4avS/wM01XybrvGCOtF48cQ=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.36.2"
-      "sha256-IwQg73lI34QtCjedW3ctRC0tzNAOXvgJl2s09GV6Zg0=";
+    buildMypyBoto3Package "ec2" "1.36.5"
+      "sha256-BKeub+Y+DKAAMTtps97o9nMVHpcPA+QF10sRAIH5VE8=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.36.0"
@@ -574,8 +574,8 @@ rec {
       "sha256-1Xjn3SfQQOXthfqH1dwHkldEIgSmUGEnn8N83H7ALXQ=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.36.0"
-      "sha256-qaBq4p1EWHOjW5L4s/Nz3tprCyln9xuvp7/Nj+n4pcU=";
+    buildMypyBoto3Package "glue" "1.36.4"
+      "sha256-b4YwzN4ovNNGyg/GDDOjlKo6anyHjdDrIuJVy0ZO1fQ=";
 
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.36.0"
@@ -866,8 +866,8 @@ rec {
       "sha256-d4AwaMKqhplnUnpLQv+zukeKX7+TlhGt5YwTZFCPlKo=";
 
   mypy-boto3-medialive =
-    buildMypyBoto3Package "medialive" "1.36.0"
-      "sha256-94Jmz9TmRnGZOJXqChyRlKE74iVt2Cjiu8jsQQo0sB0=";
+    buildMypyBoto3Package "medialive" "1.36.4"
+      "sha256-ehAZOo4ekOoPdKXhUOXv7YK67bJhd4haHM3GjuTQiBs=";
 
   mypy-boto3-mediapackage =
     buildMypyBoto3Package "mediapackage" "1.36.0"
diff --git a/pkgs/development/python-modules/netbox-interface-synchronization/default.nix b/pkgs/development/python-modules/netbox-interface-synchronization/default.nix
index cb3e55c503f6..2159ad89f4cc 100644
--- a/pkgs/development/python-modules/netbox-interface-synchronization/default.nix
+++ b/pkgs/development/python-modules/netbox-interface-synchronization/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  attrs,
   django,
   netaddr,
   netbox,
@@ -10,20 +9,19 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-interface-synchronization";
-  version = "4.1.4";
+  version = "4.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "NetTech2001";
     repo = "netbox-interface-synchronization";
     tag = version;
-    hash = "sha256-ikorJa5kCaVfxXsr8PSzuBME3PUc+UM+VDcq82WtDVs=";
+    hash = "sha256-Elk2/Ddm6kOfT4/ISEIXjACypmDxf8dAoZiWGSylHz4=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
-    attrs
     django
     netaddr
   ];
diff --git a/pkgs/development/python-modules/powerfox/default.nix b/pkgs/development/python-modules/powerfox/default.nix
index 17de893e5d45..919fec57f72e 100644
--- a/pkgs/development/python-modules/powerfox/default.nix
+++ b/pkgs/development/python-modules/powerfox/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "powerfox";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "klaasnicolaas";
     repo = "python-powerfox";
     tag = "v${version}";
-    hash = "sha256-VSkOCJu3HXBHkvYtSe/kYFOhJ9kMrcf/ijMqvUB9aRU=";
+    hash = "sha256-eBadw++8mB/RUejIbMAnfBRmM+YC7oeeBWRaHCCyizo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index e677da9a20ed..5b05258f3acf 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20250122";
+  version = "1.0.2.20250124";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FQXZsqPxWyF5II+tzOzWT/gED+GfZgiVefBPG/6wwT4=";
+    hash = "sha256-bl/ziwDSG6VmLqNo6TEhv7G+//veKNDa6nFSs4MMV5g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyecharts/default.nix b/pkgs/development/python-modules/pyecharts/default.nix
index 58b3b078acaa..38750eccb96b 100644
--- a/pkgs/development/python-modules/pyecharts/default.nix
+++ b/pkgs/development/python-modules/pyecharts/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyecharts";
-  version = "2.0.7";
+  version = "2.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "pyecharts";
     repo = "pyecharts";
     tag = "v${version}";
-    hash = "sha256-5DM5uBVa4pRLmNKCuGJu5z5wUsLBEqqKjWIP/3Mhg18=";
+    hash = "sha256-Aax/HpYJRrfituiAIT7Y6F9v9tX9EmVXtr+4R98tces=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 1ca5e1bfca12..e15dde02e599 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -31,7 +31,7 @@ let
 in
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2024.3";
+  version = "2025.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     repo = "pyopencl";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-HE7dARgKnZxqjAXX4iI1ml0N2BalyTo+ZAzjC2ThEN8=";
+    hash = "sha256-wAZBDPMJbTmujP1j7LjK28ZozZaUwKPDPZLZbFFTeAs=";
   };
 
   build-system = [
@@ -91,7 +91,10 @@ buildPythonPackage rec {
     changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    # ld: symbol(s) not found for architecture arm64
     broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+    badPlatforms = [
+      # ld: symbol(s) not found for architecture arm64/x86_64
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index c6bbb2f910c9..1b26f1ac1f6b 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.11.6";
+  version = "0.11.7";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = version;
-    hash = "sha256-QZPv3bdmk3RVLfINegSbSl8SLrjTKYkdJBiK2jRmYlU=";
+    hash = "sha256-Om43i4dAFubpWczdx9hiJblBOUeHBZLikic1f0qniL0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index d94adfdc7ba7..815e8903b73c 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2024.11.0";
+  version = "2025.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0KrtAxaEA7Qz3lFdZj3wlRaUGucBUoUNo6/jwkIlX2o=";
+    hash = "sha256-9JLzy+o76x/gvxGokHXm5BOl9QDuGv2ymhJKmomxoso=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/vcard/default.nix b/pkgs/development/python-modules/vcard/default.nix
index 11d8c496a706..16568030e235 100644
--- a/pkgs/development/python-modules/vcard/default.nix
+++ b/pkgs/development/python-modules/vcard/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   version = "0.16.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8" || pythonAtLeast "3.12";
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.13";
 
   src = fetchFromGitLab {
     owner = "engmark";
diff --git a/pkgs/development/python-modules/yte/default.nix b/pkgs/development/python-modules/yte/default.nix
index b92d0610bc06..059b35d7f3f0 100644
--- a/pkgs/development/python-modules/yte/default.nix
+++ b/pkgs/development/python-modules/yte/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yte";
-  version = "1.5.5";
+  version = "1.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "koesterlab";
     repo = "yte";
     tag = "v${version}";
-    hash = "sha256-vHrYWdyWBqonCBWg1X+lTVlOHS30/yYqZ9sVK3/2n5o=";
+    hash = "sha256-1HiAtyVT/ihr/CdZUtgN1WA+3cLHXLcSbwN/JXP/FgQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/rocm-modules/6/llvm/stage-2/1000-libcxx-failing-tests.list b/pkgs/development/rocm-modules/6/llvm/stage-2/1000-libcxx-failing-tests.list
index d5e1f675079f..a70c98d4e473 100644
--- a/pkgs/development/rocm-modules/6/llvm/stage-2/1000-libcxx-failing-tests.list
+++ b/pkgs/development/rocm-modules/6/llvm/stage-2/1000-libcxx-failing-tests.list
@@ -173,3 +173,4 @@
 ../libcxx/test/std/language.support/support.dynamic/new.delete/new.delete.array/sized_delete_array14.pass.cpp
 ../libcxx/test/std/language.support/support.dynamic/new.delete/new.delete.single/sized_delete14.pass.cpp
 ../libcxx/test/libcxx/selftest/sh.cpp/empty.sh.cpp
+../libcxx/test/libcxx/transitive_includes.sh.cpp
diff --git a/pkgs/development/tools/misc/gede/default.nix b/pkgs/development/tools/misc/gede/default.nix
index 1feff837877a..dbe1c51b7b1c 100644
--- a/pkgs/development/tools/misc/gede/default.nix
+++ b/pkgs/development/tools/misc/gede/default.nix
@@ -1,31 +1,35 @@
 {
   mkDerivation,
   lib,
-  fetchurl,
+  fetchFromGitHub,
   makeWrapper,
   python3,
+  qtbase,
   qmake,
+  qtserialport,
   ctags,
   gdb,
 }:
 
 mkDerivation rec {
   pname = "gede";
-  version = "2.18.3";
+  version = "v2.22.1";
 
-  src = fetchurl {
-    url = "http://gede.dexar.se/uploads/source/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RUl60iPa4XSlUilpYKaYQbRmLqthKHAvYonnhufjPsE=";
+  src = fetchFromGitHub {
+    owner = "jhn98032";
+    repo = "gede";
+    rev = version;
+    hash = "sha256-6YSrqLDuV4G/uvtYy4vzbwqrMFftMvZdp3kr3R436rs=";
   };
 
   nativeBuildInputs = [
-    qmake
+    ctags
     makeWrapper
     python3
+    qmake
+    qtserialport
   ];
 
-  buildInputs = [ ctags ];
-
   strictDeps = true;
 
   dontUseQmakeConfigure = true;
@@ -35,6 +39,7 @@ mkDerivation rec {
   installPhase = ''
     python build.py install --verbose --prefix="$out"
     wrapProgram $out/bin/gede \
+      --prefix QT_PLUGIN_PATH : ${qtbase}/${qtbase.qtPluginPrefix} \
       --prefix PATH : ${
         lib.makeBinPath [
           ctags
diff --git a/pkgs/development/tools/rust/cargo-edit/default.nix b/pkgs/development/tools/rust/cargo-edit/default.nix
index 7b52294da6e7..619707c703fa 100644
--- a/pkgs/development/tools/rust/cargo-edit/default.nix
+++ b/pkgs/development/tools/rust/cargo-edit/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-edit";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Y5tnY8EZJcVhYyVTpvcT6DFbPSmmw3+knzkMVvQxQbI=";
+    hash = "sha256-u5tpJEOyVGCmNYeXY4TdPTy6kZr/7nAMpCqhoeWVjfQ=";
   };
 
-  cargoHash = "sha256-X8wQvLSvZ7rrDfX423SDB5QDDMoeDDFvJZKO92CLycg=";
+  cargoHash = "sha256-RvBID/jZvSBu2PyKj532anKA/DWnpuwlyPIX3+lCVgw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/games/doom-ports/slade/default.nix b/pkgs/games/doom-ports/slade/default.nix
index a388922e168a..0c27d2c48223 100644
--- a/pkgs/games/doom-ports/slade/default.nix
+++ b/pkgs/games/doom-ports/slade/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
+    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK) "wx-config"))
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 864b20c25221..c4766a7e685d 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -949,7 +949,13 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     if ! targetHostSudoCmd "${cmd[@]}" "$action"; then
         log "warning: error(s) occurred while switching to the new configuration"
         exit 1
+    else
+        echo -n "Done. The new configuration is " >&2
+        echo "$pathToConfig"
     fi
+elif [[ "$action" = build ]]; then
+    echo -n "Done. The new configuration is " >&2
+    echo "$pathToConfig"
 fi
 
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index d15140be9882..6b10ba816b03 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.1.3";
+  version = "2025.1.4";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 549d16479aef..7ccf9f601a40 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -289,7 +289,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.1.3";
+  hassVersion = "2025.1.4";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -310,13 +310,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-JQAMh+ydcWSyKqbSt9/exf1/d3+2Oo2jfXw+5WsFYbc=";
+    hash = "sha256-QqWF/uvFQbf0tdJMzFV3hAt9Je5sFR5z+aAPtCxycbM=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-PTfdEQh8B91upX15PbcwalhpoEooEKxhYxmabyWBGrk=";
+    hash = "sha256-yzX4Wgo468On/WuK32Xdl0O3en/WFRdykvfvHNEU1S0=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index c3aa598f5f0a..033672d7666e 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20250109.0";
+  version = "20250109.2";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-kZmBZyiCUxODRcg8GnRUMWk+T+Lry1gdgY2yzQznFPI=";
+    hash = "sha256-jE8+QzYUftQFuGgJuvFYIzZ9DsEFoNpPS94Wjmk73Ss=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index dc5b7981c4ce..f375854db3bc 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.1.3";
+  version = "2025.1.4";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4cCwhumj6VFSvuWtCqpQ4AzbgK4LmWSM9GCqkI4kZpg=";
+    hash = "sha256-ysebkp0wrCGHRuHZMY6P4ftcth3gsHwtRcSGUN/7noI=";
   };
 
   build-system = [
diff --git a/pkgs/servers/monitoring/prometheus/domain-exporter.nix b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
index e09cfa5cb775..f3aa4243e89e 100644
--- a/pkgs/servers/monitoring/prometheus/domain-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "domain-exporter";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "caarlos0";
     repo = "domain_exporter";
     rev = "v${version}";
-    hash = "sha256-5GyDQkd8zXZ9TtauWfW9uW8xkgtEICFm6f4Q/jVqOBc=";
+    hash = "sha256-ExMCdrel9uRCn31cKsZkrb3yojvO0UvJYytAn1eptyo=";
   };
 
-  vendorHash = "sha256-EPpzrig40WXt5mo/vPTFjh+gYdFOlMknjNJHNChlQwk=";
+  vendorHash = "sha256-NfwxwfUpVNSARcVqOQgM++PkyLmTvXuN9nYBEPX2peY=";
 
   doCheck = false; # needs internet connection
 
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 133e25553d50..e50dbab2996f 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -35,7 +35,7 @@ let
 in
 buildPostgresqlExtension (finalAttrs: {
   pname = "postgis";
-  version = "3.5.0";
+  version = "3.5.2";
 
   outputs = [
     "out"
@@ -46,7 +46,7 @@ buildPostgresqlExtension (finalAttrs: {
     owner = "postgis";
     repo = "postgis";
     rev = "${finalAttrs.version}";
-    hash = "sha256-wh7Lav2vnKzGWuSvvMFvAaGV7ynD+KgPsFUgujdtzlA=";
+    hash = "sha256-1kOLtG6AMavbWQ1lHG2ABuvIcyTYhgcbjuVmqMR4X+g=";
   };
 
   buildInputs =
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index c539ff19ba94..03631de86122 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,7 +13,7 @@
 
 buildPostgresqlExtension rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.17.2";
+  version = "2.18.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
@@ -25,7 +25,7 @@ buildPostgresqlExtension rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    hash = "sha256-gPsAebMUBuAwP6Hoi9/vrc2IFsmTbL0wQH1g6/2k2d4=";
+    hash = "sha256-wDjzahlhUlBDXppk9HLNUOc7mlVqv56M2VGE/C04gUo=";
   };
 
   cmakeFlags =
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 911fbba3e2a2..c7c84a716dd6 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -26,7 +26,7 @@
   # Runtime dependencies
   arrow-cpp,
   babeltrace,
-  boost,
+  boost186,
   bzip2,
   cryptsetup,
   cunit,
@@ -289,7 +289,7 @@ let
       };
   };
 
-  boost' = boost.override {
+  boost' = boost186.override {
     enablePython = true;
     inherit python;
   };
diff --git a/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix b/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
index 7e7e15ebf3aa..b54dab0070bf 100644
--- a/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGhidraExtension rec {
   pname = "lightkeeper";
-  version = "1.2.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "WorksButNotTested";
     repo = "lightkeeper";
     rev = version;
-    hash = "sha256-4lj60OyVcam4JHyfIa+4auzITuEYqjz9wOQko/u+2dI=";
+    hash = "sha256-9BkI3sY/x0SwODwq646WBqU05wnfu/bU4lUfyRQV7UA=";
   };
   preConfigure = ''
     cd lightkeeper
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index b4639c43c40f..00e2d44083cb 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -48,6 +48,7 @@
   withSsl ? true,
   withSystemdJournal ? (stdenv.hostPlatform.isLinux),
   zlib,
+  withNdsudo ? false,
 }:
 let
   stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
@@ -181,6 +182,12 @@ stdenv'.mkDerivation (finalAttrs: {
         rm -rf $out/share/netdata/web/index.html
         cp $out/share/netdata/web/v1/index.html $out/share/netdata/web/index.html
       ''}
+      ${lib.optionalString withNdsudo ''
+        mv $out/libexec/netdata/plugins.d/ndsudo \
+          $out/libexec/netdata/plugins.d/ndsudo.org
+
+        ln -s /var/lib/netdata/ndsudo/ndsudo $out/libexec/netdata/plugins.d/ndsudo
+      ''}
     '';
 
   preConfigure = ''
@@ -270,7 +277,7 @@ stdenv'.mkDerivation (finalAttrs: {
           license = lib.licenses.gpl3Only;
         };
       }).goModules;
-    inherit withIpmi withNetworkViewer;
+    inherit withIpmi withNetworkViewer withNdsudo;
     tests.netdata = nixosTests.netdata;
   };
 
@@ -281,6 +288,8 @@ stdenv'.mkDerivation (finalAttrs: {
     changelog = "https://github.com/netdata/netdata/releases/tag/v${version}";
     license = [ licenses.gpl3Plus ] ++ lib.optionals (withCloudUi) [ licenses.ncul1 ];
     platforms = platforms.unix;
-    maintainers = [ ];
+    maintainers = with maintainers; [
+      mkg20001
+    ];
   };
 })
diff --git a/pkgs/tools/system/netdata/ndsudo-fix-path.patch b/pkgs/tools/system/netdata/ndsudo-fix-path.patch
index 0ec9a63231f0..be70032fff04 100644
--- a/pkgs/tools/system/netdata/ndsudo-fix-path.patch
+++ b/pkgs/tools/system/netdata/ndsudo-fix-path.patch
@@ -5,13 +5,14 @@ diff --git a/src/collectors/plugins.d/ndsudo.c b/src/collectors/plugins.d/ndsudo
 index d53ca9f28..b42a121bf 100644
 --- a/src/collectors/plugins.d/ndsudo.c
 +++ b/src/collectors/plugins.d/ndsudo.c
-@@ -357,9 +357,6 @@ int main(int argc, char *argv[]) {
+@@ -357,9 +357,9 @@ int main(int argc, char *argv[]) {
          return 3;
      }
 
 -    char new_path[] = "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
--    putenv(new_path);
--
++    char new_path[] = "PATH=/var/lib/netdata/ndsudo/runtime-dependencies";
+     putenv(new_path);
+
      setuid(0);
      setgid(0);
      setegid(0);
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 17092f5dee69..5750b99a5dc1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1256,10 +1256,6 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  git-workspace = callPackage ../applications/version-management/git-workspace {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   gitlint = python3Packages.callPackage ../applications/version-management/gitlint { };
 
   gitmux = callPackage ../applications/version-management/gitmux { buildGoModule = buildGo122Module; };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ac597f982f39..429cde592b68 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11020,7 +11020,7 @@ with self; {
       url = "mirror://cpan/authors/id/B/BP/BPS/GnuPG-Interface-1.03.tar.gz";
       hash = "sha256-WvVmMPD6wpDXJCGD9kSaoOAoKfRhHcYrxunps4CPGHo=";
     };
-    buildInputs = [ pkgs.which pkgs.gnupg1compat ];
+    buildInputs = [ pkgs.which pkgs.gnupg ];
     propagatedBuildInputs = [ MooXHandlesVia MooXlate ];
     doCheck = false;
     meta = {