diff --git a/ci/OWNERS b/ci/OWNERS
index dcc213eff007..d67e6b019b8c 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -14,7 +14,7 @@
 # Processing of this file is implemented in workflows/codeowners-v2.yml
 
 # CI
-/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil
+/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil @azuwis
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
 /.github/workflows/codeowners-v2.yml @infinisil
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 20f96f0849d1..8433042838dc 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -329,6 +329,7 @@ rec {
   ucrtAarch64 = {
     config = "aarch64-w64-mingw32";
     libc = "ucrt";
+    rust.rustcTarget = "aarch64-pc-windows-gnullvm";
     useLLVM = true;
   };
 
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index e62065775b91..2ba0bf5a7fe2 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -44,6 +44,8 @@
 - `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
   This release also deprecates some configuration keys which are likely to be removed in version 5.0.0.
 
+- `netbird` has been updated to 0.31.1. This adds a built-in relay server which is not yet supported by the NixOS module, as well as a metrics endpoint for both the management and signal services. The default metrics port for the `signal` service has been changed from `9090` to `9091` to prevent a port conflict with the management server. This can be changed with their respective `metricsPort` as needed. Refer to the [release notes](https://github.com/netbirdio/netbird/releases/tag/v0.31.1) and [this pull request](https://github.com/NixOS/nixpkgs/pull/354032#issuecomment-2480925927) for more information.
+
 - `compressDrv` can compress selected files in a derivation. `compressDrvWeb` compresses files for common web server usage (`.gz` with `zopfli`, `.br` with `brotli`).
 
 - [`hardware.display`](#opt-hardware.display.edid.enable) is a new module implementing workarounds for misbehaving monitors
@@ -85,6 +87,8 @@
 
 ## New Modules {#sec-release-24.11-new-modules}
 
+- [Coral](https://coral.ai/), hardware support for Coral.ai Edge TPU devices. Available as [hardware.coral.usb.enable](#opt-hardware.coral.usb.enable) and [hardware.coral.pcie.enable](#opt-hardware.coral.pcie.enable).
+
 - [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.
 
 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server. Available as [services.taskchampion-sync-server](#opt-services.taskchampion-sync-server.enable).
diff --git a/nixos/modules/hardware/coral.nix b/nixos/modules/hardware/coral.nix
new file mode 100644
index 000000000000..4b0cadfc3cf0
--- /dev/null
+++ b/nixos/modules/hardware/coral.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    ;
+
+  cfg = config.hardware.coral;
+in
+
+{
+  options.hardware.coral = {
+    usb.enable = mkEnableOption "Coral USB support";
+    pcie.enable = mkEnableOption "Coral PCIe support";
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.usb.enable || cfg.pcie.enable) {
+      users.groups.coral = { };
+    })
+    (mkIf cfg.usb.enable {
+      services.udev.packages = with pkgs; [ libedgetpu ];
+    })
+    (mkIf cfg.pcie.enable {
+      boot.extraModulePackages = with config.boot.kernelPackages; [ gasket ];
+      services.udev.extraRules = ''
+        SUBSYSTEM=="apex",MODE="0660",GROUP="coral"
+      '';
+    })
+  ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index cc107eefe505..a1b8f52c0773 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -52,6 +52,7 @@
   ./hardware/bladeRF.nix
   ./hardware/brillo.nix
   ./hardware/ckb-next.nix
+  ./hardware/coral.nix
   ./hardware/corectrl.nix
   ./hardware/cpu/amd-microcode.nix
   ./hardware/cpu/amd-sev.nix
diff --git a/nixos/modules/services/networking/netbird/management.nix b/nixos/modules/services/networking/netbird/management.nix
index f4b5bbf64323..4ebaa60ecb05 100644
--- a/nixos/modules/services/networking/netbird/management.nix
+++ b/nixos/modules/services/networking/netbird/management.nix
@@ -196,6 +196,12 @@ in
       description = "Internal port of the management server.";
     };
 
+    metricsPort = mkOption {
+      type = port;
+      default = 9090;
+      description = "Internal port of the metrics server.";
+    };
+
     extraOptions = mkOption {
       type = listOf str;
       default = [ ];
@@ -360,6 +366,13 @@ in
           }
         ];
 
+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
     systemd.services.netbird-management = {
       description = "The management server for Netbird, a wireguard VPN";
       documentation = [ "https://netbird.io/docs/" ];
@@ -387,6 +400,9 @@ in
             # Port to listen on
             "--port"
             cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
             # Log to stdout
             "--log-file"
             "console"
diff --git a/nixos/modules/services/networking/netbird/signal.nix b/nixos/modules/services/networking/netbird/signal.nix
index b53e9d40c2ee..3122b6c9fe5f 100644
--- a/nixos/modules/services/networking/netbird/signal.nix
+++ b/nixos/modules/services/networking/netbird/signal.nix
@@ -15,7 +15,12 @@ let
     mkOption
     ;
 
-  inherit (lib.types) enum port str;
+  inherit (lib.types)
+    listOf
+    enum
+    port
+    str
+    ;
 
   inherit (utils) escapeSystemdExecArgs;
 
@@ -41,6 +46,20 @@ in
       description = "Internal port of the signal server.";
     };
 
+    metricsPort = mkOption {
+      type = port;
+      default = 9091;
+      description = "Internal port of the metrics server.";
+    };
+
+    extraOptions = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Additional options given to netbird-signal as commandline arguments.
+      '';
+    };
+
     logLevel = mkOption {
       type = enum [
         "ERROR"
@@ -54,24 +73,38 @@ in
   };
 
   config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
     systemd.services.netbird-signal = {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = escapeSystemdExecArgs [
-          (getExe' cfg.package "netbird-signal")
-          "run"
-          # Port to listen on
-          "--port"
-          cfg.port
-          # Log to stdout
-          "--log-file"
-          "console"
-          # Log level
-          "--log-level"
-          cfg.logLevel
-        ];
+        ExecStart = escapeSystemdExecArgs (
+          [
+            (getExe' cfg.package "netbird-signal")
+            "run"
+            # Port to listen on
+            "--port"
+            cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
+            # Log to stdout
+            "--log-file"
+            "console"
+            # Log level
+            "--log-level"
+            cfg.logLevel
+          ]
+          ++ cfg.extraOptions
+        );
 
         Restart = "always";
         RuntimeDirectory = "netbird-mgmt";
diff --git a/nixos/modules/services/video/frigate.nix b/nixos/modules/services/video/frigate.nix
index 72e96df5442e..bc0f5d496afb 100644
--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@@ -6,19 +6,28 @@
 
 let
   inherit (lib)
-    literalExpression
+    any
+    attrValues
+    converge
+    elem
+    filterAttrsRecursive
+    hasPrefix
+    makeLibraryPath
+    match
     mkDefault
     mkEnableOption
     mkPackageOption
     mkIf
     mkOption
+    optionalAttrs
+    optionals
     types;
 
   cfg = config.services.frigate;
 
   format = pkgs.formats.yaml { };
 
-  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! lib.elem v [ null ])) cfg.settings;
+  filteredConfig = converge (filterAttrsRecursive (_: v: ! elem v [ null ])) cfg.settings;
 
   cameraFormat = with types; submodule {
     freeformType = format.type;
@@ -94,6 +103,15 @@ let
     proxy_connect_timeout 360;
   '';
 
+  # Discover configured detectors for acceleration support
+  detectors = attrValues cfg.settings.detectors or {};
+  withCoralUSB = any (d: d.type == "edgetpu" && hasPrefix "usb" d.device or "") detectors;
+  withCoralPCI =  any (d: d.type == "edgetpu" && hasPrefix "pci" d.device or "") detectors;
+  withCoral = withCoralPCI || withCoralUSB;
+
+  # Provide ffmpeg-full for NVIDIA hardware acceleration
+  ffmpegArgs = cfg.settings.ffmpeg.hwaccel_args or "";
+  ffmpeg' = if match "/nvidia/" ffmpegArgs != null then pkgs.ffmpeg-full else pkgs.ffmpeg-headless;
 in
 
 {
@@ -114,6 +132,27 @@ in
       '';
     };
 
+    vaapiDriver = mkOption {
+      type = nullOr (enum [ "i965" "iHD" "nouveau" "vdpau" "nvidia" "radeonsi" ]);
+      default = null;
+      example = "radeonsi";
+      description = ''
+        Force usage of a particular VA-API driver for video acceleration. Use together with `settings.ffmpeg.hwaccel_args`.
+
+        Setting this *is not required* for VA-API to work, but it can help steer VA-API towards the correct card if you have multiple.
+
+        :::{.note}
+        For VA-API to work you must enable {option}`hardware.graphics.enable` (sufficient for AMDGPU) and pass for example
+        `pkgs.intel-media-driver` (required for Intel 5th Gen. and newer) into {option}`hardware.graphics.extraPackages`.
+        :::
+
+        See also:
+
+        - https://docs.frigate.video/configuration/hardware_acceleration
+        - https://docs.frigate.video/configuration/ffmpeg_presets#hwaccel-presets
+      '';
+    };
+
     settings = mkOption {
       type = submodule {
         freeformType = format.type;
@@ -171,7 +210,6 @@ in
         set-misc
         vod
       ];
-      recommendedProxySettings = mkDefault true;
       recommendedGzipSettings = mkDefault true;
       mapHashBucketSize = mkDefault 128;
       upstreams = {
@@ -202,6 +240,7 @@ in
           # auth_location.conf
           "/auth" = {
             proxyPass = "http://frigate-api/auth";
+            recommendedProxySettings = true;
             extraConfig = ''
               internal;
 
@@ -306,11 +345,13 @@ in
           };
           "/ws" = {
             proxyPass = "http://frigate-mqtt-ws/";
+            recommendedProxySettings = true;
             proxyWebsockets = true;
             extraConfig = nginxAuthRequest + nginxProxySettings;
           };
           "/live/jsmpeg" = {
             proxyPass = "http://frigate-jsmpeg/";
+            recommendedProxySettings = true;
             proxyWebsockets = true;
             extraConfig = nginxAuthRequest + nginxProxySettings;
           };
@@ -318,6 +359,7 @@ in
           "/live/mse/api/ws" = {
             proxyPass = "http://frigate-go2rtc/api/ws";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -327,6 +369,7 @@ in
           "/live/webrtc/api/ws" = {
             proxyPass = "http://frigate-go2rtc/api/ws";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -336,6 +379,7 @@ in
           # pass through go2rtc player
           "/live/webrtc/webrtc.html" = {
             proxyPass = "http://frigate-go2rtc/webrtc.html";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -345,6 +389,7 @@ in
           # frontend uses this to fetch the version
           "/api/go2rtc/api" = {
             proxyPass = "http://frigate-go2rtc/api";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -355,6 +400,7 @@ in
           "/api/go2rtc/webrtc" = {
             proxyPass = "http://frigate-go2rtc/api/webrtc";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -363,12 +409,14 @@ in
           };
           "~* /api/.*\.(jpg|jpeg|png|webp|gif)$" = {
             proxyPass = "http://frigate-api";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               rewrite ^/api/(.*)$ $1 break;
             '';
           };
           "/api/" = {
             proxyPass = "http://frigate-api/";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               add_header Cache-Control "no-store";
               expires off;
@@ -492,6 +540,11 @@ in
       "frigate"
     ];
 
+    hardware.coral = {
+      usb.enable = mkDefault withCoralUSB;
+      pcie.enable = mkDefault withCoralPCI;
+    };
+
     users.users.frigate = {
       isSystemUser = true;
       group = "frigate";
@@ -510,26 +563,35 @@ in
         CONFIG_FILE = format.generate "frigate.yml" filteredConfig;
         HOME = "/var/lib/frigate";
         PYTHONPATH = cfg.package.pythonPath;
+      } // optionalAttrs (cfg.vaapiDriver != null) {
+        LIBVA_DRIVER_NAME = cfg.vaapiDriver;
+      } // optionalAttrs withCoral {
+        LD_LIBRARY_PATH = makeLibraryPath (with pkgs; [ libedgetpu ]);
       };
       path = with pkgs; [
         # unfree:
         # config.boot.kernelPackages.nvidiaPackages.latest.bin
-        ffmpeg-headless
+        ffmpeg'
         libva-utils
         procps
         radeontop
-      ] ++ lib.optionals (!stdenv.hostPlatform.isAarch64) [
+      ] ++ optionals (!stdenv.hostPlatform.isAarch64) [
         # not available on aarch64-linux
         intel-gpu-tools
       ];
       serviceConfig = {
-        ExecStartPre = "-rm /var/cache/frigate/*.mp4";
+        ExecStartPre = pkgs.writeShellScript "frigate-clear-cache" ''
+          rm --recursive --force /var/cache/frigate/*
+        '';
         ExecStart = "${cfg.package.python.interpreter} -m frigate";
         Restart = "on-failure";
         SyslogIdentifier = "frigate";
 
         User = "frigate";
         Group = "frigate";
+        SupplementaryGroups = [ "render" ] ++ optionals withCoral [ "coral" ];
+
+        AmbientCapabilities = optionals (elem cfg.vaapiDriver [ "i965" "iHD" ]) [ "CAP_PERFMON" ]; # for intel_gpu_top
 
         UMask = "0027";
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d01509d6d430..c0d0b025aebd 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2656,6 +2656,23 @@ let
         };
       };
 
+      jetmartin.bats = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "bats";
+          publisher = "jetmartin";
+          version = "0.1.10";
+          hash = "sha256-WD1YTRgzSVElixnNGtg6mMlcLCIaI6IBb+uh4cfzuBs=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/jetmartin.bats/changelog";
+          description = "VSCode extension for full language support for the Bats (Bash Automated Testing System) testing framework";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jetmartin.bats";
+          homepage = "https://github.com/bats-core/bats-vscode";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.dotmobo ];
+        };
+      };
+
       jkillian.custom-local-formatters = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "jkillian";
diff --git a/pkgs/by-name/ch/chez/package.nix b/pkgs/by-name/ch/chez/package.nix
index de998e550b41..52c8821bd2d1 100644
--- a/pkgs/by-name/ch/chez/package.nix
+++ b/pkgs/by-name/ch/chez/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chez-scheme";
-  version = "10.0.0";
+  version = "10.1.0";
 
   src = fetchurl {
     url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-03GZASte0ZhcQGnWqH/xjl4fWi3yfkApkfr0XcTyIyw=";
+    hash = "sha256-kYGmyMSrXl0y2Hn/FZ0zWlDU+LOIYRriKiY+kyw1OYs=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index 7ee4f6eba606..4578d709a0ac 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -29,6 +29,12 @@ let
     };
   };
 
+  # Tensorflow audio model
+  tflite_audio_model = fetchurl {
+    url = "https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download";
+    hash = "sha256-G5cbITJ2AnOl+49dxQToZ4OyeFO7MTXVVa4G8eHjZfM=";
+  };
+
   # Tensorflow Lite models
   # https://github.com/blakeblackshear/frigate/blob/v0.13.0/docker/main/Dockerfile#L96-L97
   tflite_cpu_model = fetchurl {
@@ -72,14 +78,22 @@ python.pkgs.buildPythonApplication rec {
     substituteInPlace frigate/detectors/detector_config.py \
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
+    substituteInPlace frigate/output/birdseye.py \
+      --replace-fail "/opt/frigate/" "${placeholder "out"}/${python.sitePackages}/"
+
     # work around onvif-zeep idiosyncrasy
     substituteInPlace frigate/ptz/onvif.py \
       --replace-fail dist-packages site-packages
 
+    # provide default paths for models and maps that are shipped with frigate
     substituteInPlace frigate/config.py \
       --replace-fail "/cpu_model.tflite" "${tflite_cpu_model}" \
       --replace-fail "/edgetpu_model.tflite" "${tflite_edgetpu_model}"
 
+    substituteInPlace frigate/events/audio.py \
+      --replace-fail "/cpu_audio_model.tflite" "${placeholder "out"}/share/frigate/cpu_audio_model.tflite" \
+      --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
+
     substituteInPlace frigate/test/test_config.py \
       --replace-fail "(MODEL_CACHE_DIR" "('/build/model_cache'" \
       --replace-fail "/config/model_cache" "/build/model_cache"
@@ -131,7 +145,10 @@ python.pkgs.buildPythonApplication rec {
     cp -R frigate/* $out/${python.sitePackages}/frigate/
 
     mkdir -p $out/share/frigate
-    cp -R {migrations,labelmap.txt} $out/share/frigate/
+    cp -R {migrations,labelmap.txt,audio-labelmap.txt} $out/share/frigate/
+
+    tar --extract --gzip --file ${tflite_audio_model}
+    cp --no-preserve=mode ./1.tflite $out/share/frigate/cpu_audio_model.tflite
 
     cp --no-preserve=mode ${openvino_model} $out/share/frigate/coco_91cl_bkgr.txt
     sed -i 's/truck/car/g' $out/share/frigate/coco_91cl_bkgr.txt
diff --git a/pkgs/by-name/gi/giada/package.nix b/pkgs/by-name/gi/giada/package.nix
index 2880bce40f8b..fc875f7685dc 100644
--- a/pkgs/by-name/gi/giada/package.nix
+++ b/pkgs/by-name/gi/giada/package.nix
@@ -1,24 +1,26 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, fltk
-, fmt
-, rtmidi
-, libsamplerate
-, libmpg123
-, libsndfile
-, jack2
-, alsa-lib
-, libpulseaudio
-, libXpm
-, libXrandr
-, flac
-, libogg
-, libvorbis
-, libopus
-, nlohmann_json
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  fltk,
+  fontconfig,
+  fmt,
+  rtmidi,
+  libsamplerate,
+  libmpg123,
+  libsndfile,
+  jack2,
+  alsa-lib,
+  libpulseaudio,
+  libXpm,
+  libXrandr,
+  flac,
+  libogg,
+  libvorbis,
+  libopus,
+  nlohmann_json,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -47,24 +49,28 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    rtmidi
-    fltk
-    fmt
-    libmpg123
-    libsndfile
-    libsamplerate
-    nlohmann_json
-    alsa-lib
-    libXpm
-    libpulseaudio
-    jack2
-    flac
-    libogg
-    libvorbis
-    libopus
-    libXrandr
-  ];
+  buildInputs =
+    [
+      rtmidi
+      fltk
+      fmt
+      libmpg123
+      libsndfile
+      libsamplerate
+      nlohmann_json
+      alsa-lib
+      libXpm
+      libpulseaudio
+      jack2
+      flac
+      libogg
+      libvorbis
+      libopus
+      libXrandr
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isFreeBSD) [
+      fontconfig
+    ];
 
   meta = {
     description = "Free, minimal, hardcore audio tool for DJs, live performers and electronic musicians";
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
new file mode 100644
index 000000000000..ea5143015c9f
--- /dev/null
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  dart-sass,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "homer";
+  version = "24.11.4";
+  src = fetchFromGitHub {
+    owner = "bastienwirtz";
+    repo = "homer";
+    rev = "v${version}";
+    hash = "sha256-UaoBdYzTEYB1pkiTYrt4T7GjwMJWXPuW5VSl4MU8DCI=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-5unoY8lPaX9sZAJEBICpxSddwLV8liK1tbamB2ulvew=";
+  };
+
+  # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
+  patches = [ ./sass-embedded.patch ];
+
+  nativeBuildInputs = [
+    nodejs
+    dart-sass
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export SASS_EMBEDDED_BIN_PATH="${dart-sass}/bin/sass"
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -R dist/* $out/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A very simple static homepage for your server.";
+    homepage = "https://homer-demo.netlify.app/";
+    changelog = "https://github.com/bastienwirtz/homer/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ stunkymonkey ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/ho/homer/sass-embedded.patch b/pkgs/by-name/ho/homer/sass-embedded.patch
new file mode 100644
index 000000000000..a7109354c7f4
--- /dev/null
+++ b/pkgs/by-name/ho/homer/sass-embedded.patch
@@ -0,0 +1,133 @@
+diff --git a/package.json b/package.json
+index f121431..97f1b11 100644
+--- a/package.json
++++ b/package.json
+@@ -28,5 +28,10 @@
+     "vite-plugin-pwa": "^0.20.5"
+   },
+   "license": "Apache-2.0",
+-  "packageManager": "pnpm@9.12.1+sha512.e5a7e52a4183a02d5931057f7a0dbff9d5e9ce3161e33fa68ae392125b79282a8a8a470a51dfc8a0ed86221442eb2fb57019b0990ed24fab519bf0e1bc5ccfc4"
++  "packageManager": "pnpm@9.12.1+sha512.e5a7e52a4183a02d5931057f7a0dbff9d5e9ce3161e33fa68ae392125b79282a8a8a470a51dfc8a0ed86221442eb2fb57019b0990ed24fab519bf0e1bc5ccfc4",
++  "pnpm": {
++    "patchedDependencies": {
++      "sass-embedded": "patches/sass-embedded.patch"
++    }
++  }
+ }
+diff --git a/patches/sass-embedded.patch b/patches/sass-embedded.patch
+new file mode 100644
+index 0000000..f941a8e
+--- /dev/null
++++ b/patches/sass-embedded.patch
+@@ -0,0 +1,15 @@
++diff --git a/dist/lib/src/compiler-path.js b/dist/lib/src/compiler-path.js
++index ae33aa3028e1a120d9e84b043bb19a71f1083b96..7a49d16a54982312ad638632d6750d7bec670f02 100644
++--- a/dist/lib/src/compiler-path.js
+++++ b/dist/lib/src/compiler-path.js
++@@ -24,6 +24,10 @@ function isLinuxMusl(path) {
++ }
++ /** The full command for the embedded compiler executable. */
++ exports.compilerCommand = (() => {
+++    const binPath = process.env.SASS_EMBEDDED_BIN_PATH;
+++    if (binPath) {
+++        return [binPath];
+++    }
++     const platform = process.platform === 'linux' && isLinuxMusl(process.execPath)
++         ? 'linux-musl'
++         : process.platform;
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 4c4267a..fd278e1 100644
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -4,6 +4,11 @@ settings:
+   autoInstallPeers: true
+   excludeLinksFromLockfile: false
+ 
++patchedDependencies:
++  sass-embedded:
++    hash: 6wjvcsryx2tfkpottp4wf5nbzi
++    path: patches/sass-embedded.patch
++
+ importers:
+ 
+   .:
+@@ -26,7 +31,7 @@ importers:
+     devDependencies:
+       '@vitejs/plugin-vue':
+         specifier: ^5.1.4
+-        version: 5.1.4(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)
++        version: 5.1.4(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)
+       '@vue/eslint-config-prettier':
+         specifier: ^10.0.0
+         version: 10.0.0(eslint@9.12.0)(prettier@3.3.3)
+@@ -44,13 +49,13 @@ importers:
+         version: 3.3.3
+       sass-embedded:
+         specifier: ^1.79.5
+-        version: 1.79.5
++        version: 1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       vite:
+         specifier: ^5.4.9
+-        version: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
++        version: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       vite-plugin-pwa:
+         specifier: ^0.20.5
+-        version: 0.20.5(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
++        version: 0.20.5(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+ 
+ packages:
+ 
+@@ -3516,9 +3521,9 @@ snapshots:
+ 
+   '@types/trusted-types@2.0.7': {}
+ 
+-  '@vitejs/plugin-vue@5.1.4(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)':
++  '@vitejs/plugin-vue@5.1.4(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)':
+     dependencies:
+-      vite: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
++      vite: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       vue: 3.5.12
+ 
+   '@vue/compiler-core@3.5.12':
+@@ -4693,7 +4698,7 @@ snapshots:
+   sass-embedded-win32-x64@1.79.5:
+     optional: true
+ 
+-  sass-embedded@1.79.5:
++  sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
+     dependencies:
+       '@bufbuild/protobuf': 2.2.0
+       buffer-builder: 0.2.0
+@@ -4975,18 +4980,18 @@ snapshots:
+ 
+   varint@6.0.0: {}
+ 
+-  vite-plugin-pwa@0.20.5(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
++  vite-plugin-pwa@0.20.5(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+     dependencies:
+       debug: 4.3.7
+       pretty-bytes: 6.1.1
+       tinyglobby: 0.2.9
+-      vite: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
++      vite: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       workbox-build: 7.1.0
+       workbox-window: 7.1.0
+     transitivePeerDependencies:
+       - supports-color
+ 
+-  vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0):
++  vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0):
+     dependencies:
+       esbuild: 0.21.5
+       postcss: 8.4.47
+@@ -4994,7 +4999,7 @@ snapshots:
+     optionalDependencies:
+       fsevents: 2.3.3
+       sass: 1.79.5
+-      sass-embedded: 1.79.5
++      sass-embedded: 1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       terser: 5.35.0
+ 
+   vue-eslint-parser@9.4.3(eslint@9.12.0):
+-- 
+2.47.0
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index b39954953c26..8a501f1e6c60 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.36.0";
+  version = "1.37.0";
   outputs = [ "out" "man" "doc" ];
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4p4otR0W/v0DoWwwcNq/UEDa1V8vlZMpdk33B/9A4Bo=";
+    hash = "sha256-WF1kyIZyqnIYfFL/HZWBER97aXH3FSCbTRonOKSwgNg=";
   };
 
-  cargoHash = "sha256-y6wBFjBOeymbXUIeflQ35FxQRMPlDvB0Zeo2bQeZjJ0=";
+  cargoHash = "sha256-/uWxYxczTOlUs2wOCCn5wwbGETHwIqdDI2mb/h4xVxQ=";
 
   nativeBuildInputs = [ installShellFiles mdbook ];
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
diff --git a/pkgs/by-name/ki/kid3/package.nix b/pkgs/by-name/ki/kid3/package.nix
index 8403db5c9f3f..7f314d6bb2e3 100644
--- a/pkgs/by-name/ki/kid3/package.nix
+++ b/pkgs/by-name/ki/kid3/package.nix
@@ -42,11 +42,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kid3";
-  version = "3.9.5";
+  version = "3.9.6";
 
   src = fetchurl {
     url = "mirror://kde/stable/kid3/${finalAttrs.version}/kid3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pCT+3eNcF247RDNEIqrUOEhBh3LaAgdR0A0IdOXOgUU=";
+    hash = "sha256-zyf/zENpyZQNp7/BL9EN+9pSa4GH5bYmYqvoBp/CbCc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lc/lcov/package.nix b/pkgs/by-name/lc/lcov/package.nix
index fcdd944a1ad9..62889fb5968e 100644
--- a/pkgs/by-name/lc/lcov/package.nix
+++ b/pkgs/by-name/lc/lcov/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "lcov";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "linux-test-project";
     repo = "lcov";
     rev = "v${version}";
-    hash = "sha256-QfA+mzLfpi2fuhcPvCKO7YnPef1GMhCbgBWdXFTXPzE=";
+    hash = "sha256-cZdDlOf3IgPQrUNl+wu6Gwecaj+r2xu0eqmlz67TeAI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/li/libedgetpu/package.nix b/pkgs/by-name/li/libedgetpu/package.nix
index 9ead9c5f60b3..563e4d56dda1 100644
--- a/pkgs/by-name/li/libedgetpu/package.nix
+++ b/pkgs/by-name/li/libedgetpu/package.nix
@@ -43,6 +43,12 @@ stdenv.mkDerivation {
     })
   ];
 
+  postPatch = ''
+    # Use dedicated group for coral devices
+    substituteInPlace debian/edgetpu-accelerator.rules \
+      --replace-fail "plugdev" "coral"
+  '';
+
   makeFlags = [
     "-f"
     "makefile_build/Makefile"
diff --git a/pkgs/by-name/me/meshoptimizer/package.nix b/pkgs/by-name/me/meshoptimizer/package.nix
index 60d1e27e76a5..168ee2c72994 100644
--- a/pkgs/by-name/me/meshoptimizer/package.nix
+++ b/pkgs/by-name/me/meshoptimizer/package.nix
@@ -9,12 +9,12 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "meshoptimizer";
-  version = "0.21";
+  version = "0.22";
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "meshoptimizer";
     rev = "v${version}";
-    hash = "sha256-G8rR4Ff3mVxTPD1etI82fYwFawsjrLvwWuEuib+dUBU=";
+    hash = "sha256-/47CfgPtj+e4iz01+rwahP+jCXPXXZhTeLLiLktrJ6g=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index d743dda45176..89ce2edf1547 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -2,24 +2,24 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  python311,
+  python312,
   nixosTests,
 }:
 let
   pname = "open-webui";
-  version = "0.3.35";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-H46qoOEajPKRU/Lbd6r7r0vRjWSd7uGoA0deaDv6HSw=";
+    hash = "sha256-OVj7yAHN3XMeqTa1oZIxEz9cwt4kW1ng+bwD44y/qQA=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-ohWSfwZfC/jfOpnNSqsvMyYnukk3Xa3Tq32PAl8Ds60=";
+    npmDepsHash = "sha256-qT7oqOZSZjicsFnd7nsnGvW5ifAV16Ah/fPSaKlf7fw=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
@@ -41,7 +41,7 @@ let
     '';
   };
 in
-python311.pkgs.buildPythonApplication rec {
+python312.pkgs.buildPythonApplication rec {
   inherit pname version src;
   pyproject = true;
 
@@ -61,7 +61,8 @@ python311.pkgs.buildPythonApplication rec {
     "pytest-docker"
   ];
 
-  dependencies = with python311.pkgs; [
+  dependencies = with python312.pkgs; [
+    aiocache
     aiohttp
     alembic
     anthropic
@@ -86,22 +87,24 @@ python311.pkgs.buildPythonApplication rec {
     flask-cors
     fpdf2
     ftfy
-    qdrant-client
     google-generativeai
     googleapis-common-protos
     langchain
     langchain-chroma
     langchain-community
     langfuse
+    ldap3
     markdown
     nltk
     openai
     opencv-python-headless
     openpyxl
+    opensearch-py
     pandas
     passlib
     peewee
     peewee-migrate
+    pgvector
     psutil
     psycopg2-binary
     pydub
@@ -119,21 +122,22 @@ python311.pkgs.buildPythonApplication rec {
     python-socketio
     pytube
     pyxlsb
+    qdrant-client
     rank-bm25
     rapidocr-onnxruntime
     redis
     requests
     sentence-transformers
+    soundfile
     tiktoken
     unstructured
     uvicorn
     validators
-    xhtml2pdf
     xlrd
     youtube-transcript-api
   ];
 
-  build-system = with python311.pkgs; [ hatchling ];
+  build-system = with python312.pkgs; [ hatchling ];
 
   pythonImportsCheck = [ "open_webui" ];
 
@@ -144,11 +148,11 @@ python311.pkgs.buildPythonApplication rec {
   };
 
   meta = {
+    changelog = "https://github.com/open-webui/open-webui/blob/${src.rev}/CHANGELOG.md";
     description = "Comprehensive suite for LLMs with a user-friendly WebUI";
     homepage = "https://github.com/open-webui/open-webui";
-    changelog = "https://github.com/open-webui/open-webui/blob/${src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ shivaraj-bh ];
     mainProgram = "open-webui";
+    maintainers = with lib.maintainers; [ shivaraj-bh ];
   };
 }
diff --git a/pkgs/tools/misc/plfit/default.nix b/pkgs/by-name/pl/plfit/package.nix
similarity index 59%
rename from pkgs/tools/misc/plfit/default.nix
rename to pkgs/by-name/pl/plfit/package.nix
index 8b1726666bcc..a5922d5a75e9 100644
--- a/pkgs/tools/misc/plfit/default.nix
+++ b/pkgs/by-name/pl/plfit/package.nix
@@ -1,21 +1,22 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, python ? null
-, swig
-, llvmPackages
+{
+  cmake,
+  fetchFromGitHub,
+  lib,
+  llvmPackages,
+  python ? null,
+  stdenv,
+  swig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plfit";
-  version = "0.9.6";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ntamas";
     repo = "plfit";
     rev = finalAttrs.version;
-    hash = "sha256-XRl6poEdgPNorFideQmEJHCU+phs4rIhMYa8iAOtL1A=";
+    hash = "sha256-ur+ai0in7PaoDZcPzuUzQTrZ3nB0H5FDSfPBpl1e9ug=";
   };
 
   postPatch = lib.optionalString (python != null) ''
@@ -24,18 +25,22 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail ' ''${Python3_SITELIB}' ' ${placeholder "out"}/${python.sitePackages}'
   '';
 
-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optionals (python != null) [
-    python
-    swig
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+    ]
+    ++ lib.optionals (python != null) [
+      python
+      swig
+    ];
 
-  cmakeFlags = [
-    "-DPLFIT_USE_OPENMP=ON"
-  ] ++ lib.optionals (python != null) [
-    "-DPLFIT_COMPILE_PYTHON_MODULE=ON"
-  ];
+  cmakeFlags =
+    [
+      "-DPLFIT_USE_OPENMP=ON"
+    ]
+    ++ lib.optionals (python != null) [
+      "-DPLFIT_COMPILE_PYTHON_MODULE=ON"
+    ];
 
   buildInputs = lib.optionals stdenv.cc.isClang [
     llvmPackages.openmp
@@ -43,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Fitting power-law distributions to empirical data";
     homepage = "https://github.com/ntamas/plfit";
     changelog = "https://github.com/ntamas/plfit/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 })
diff --git a/pkgs/by-name/ra/rabbit/package.nix b/pkgs/by-name/ra/rabbit/package.nix
index 2d94ea3e5128..9fb39a708577 100644
--- a/pkgs/by-name/ra/rabbit/package.nix
+++ b/pkgs/by-name/ra/rabbit/package.nix
@@ -5,28 +5,22 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "rabbit";
-  version = "2.2.0";
+  version = "2.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "natarajan-chidambaram";
     repo = "RABBIT";
     rev = "refs/tags/${version}";
-    hash = "sha256-diy94QhgLHLvkb1kKhGDxiHAyQ43BNJUXjHFYahEDpw=";
+    hash = "sha256-QmP6yfVnlYoNVa4EUtKR9xbCnQW2V6deV0+hN9IGtic=";
   };
 
   pythonRelaxDeps = [
     "numpy"
-    "scikit-learn"
-    "scipy"
-    "tqdm"
-    "pandas"
-    "urllib3"
   ];
 
-  build-system = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+  build-system = with python3.pkgs; [
+    setuptools
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index d97f78c64895..bc2aa1ef07f0 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
     rev = "refs/tags/" + version;
-    hash = "sha256-yi8lPm3zkmamN6gPlGfojNlIXM1cgSr1zL2zMNni5f0=";
+    hash = "sha256-mbf39AcW7MYu0A6D7poX6TChJccqweBvUbzJ1Ib+ABI=";
   };
 
-  cargoHash = "sha256-1SdyVtMjkfXH9iGew9i8xpx8WlUly4vIcKY3weeW3LQ=";
+  cargoHash = "sha256-aWEqPIAcq5ZWCf0ZOYnswmj2dR0+41D1HMna0TAhxcE=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ve/velero/package.nix b/pkgs/by-name/ve/velero/package.nix
index 357c68d3c8c7..5c47803841d9 100644
--- a/pkgs/by-name/ve/velero/package.nix
+++ b/pkgs/by-name/ve/velero/package.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.14.1";
+  version = "1.15.0";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    hash = "sha256-rXWBTPM3dCGON1DvpCOsA4C4mAuVDqV9YbrvP5yDCa0=";
+    hash = "sha256-Ba5Bjock3NmNI6XdnX7UOW35ytgnHzYAjX9Cu6iGILo=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorHash = "sha256-HpPJXYBrk5qfV01VOqXGpn4waEONJa61mqLbEsuwrEs=";
+  vendorHash = "sha256-FcyqCnOZSdoyOjBIrEC1AKM5KqWSkNxbgvXeG3Y0CO4=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index b0f32c7382a3..06e830712fad 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -90,13 +90,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "zed-editor";
-  version = "0.162.3";
+  version = "0.162.5";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-B0iTJMVUpsSVZ0l2bdPnWc7YaZErKnxqiuhgYopmJ/4=";
+    hash = "sha256-ZrjrJbRvyw5insK+v5fxKj8ouylIPxapDVFgLb3M3uE=";
   };
 
   patches =
@@ -118,7 +118,7 @@ rustPlatform.buildRustPackage rec {
     ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-88x9x+EoH1Vi34CdFdYRD8EQzGHU+8DTHd0tT+tyW8k=";
+  cargoHash = "sha256-/KjZTtkSI7njErwgwJY5OEM172TreBfq80w8bA3xg2k=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/data/fonts/font-awesome/default.nix b/pkgs/data/fonts/font-awesome/default.nix
index f0622f56cd95..fe48972b0573 100644
--- a/pkgs/data/fonts/font-awesome/default.nix
+++ b/pkgs/data/fonts/font-awesome/default.nix
@@ -61,7 +61,7 @@ in
     hash = "sha256-gd23ZplNY56sm1lfkU3kPXUOmNmY5SRnT0qlQZRNuBo=";
   };
   v6 = font-awesome {
-    version = "6.6.0";
-    hash = "sha256-tQ9Hxph5YiPZMiO9gs2HCkRJ8cdECa2swgS++cytEnM=";
+    version = "6.7.1";
+    hash = "sha256-Lzy12F0qEGzvdyN9SC3nyh2eTc80HM4qR5U6h0G15bo=";
   };
 }
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index a8454ba56f3b..7fd8b18d4bb4 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "1.5.1";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4/NDZGq62M0tdWerIkmoYS0WHC06AV8c9vlo/6FhsAo=";
+    hash = "sha256-SiP9h0m2Y+eRicRWTmwjqXpmgizoUadofgSMmRYEFg0=";
   };
 
   nativeBuildInputs = [ git pkg-config ];
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl erlang ] ++
     lib.optionals stdenv.hostPlatform.isDarwin [ Security SystemConfiguration ];
 
-  cargoHash = "sha256-B8tCVkubP04gAHKQC0idR5AjpVHG/kCXvPCfwKCuaSo=";
+  cargoHash = "sha256-MQX0hQlucaOgX42XHw55QCsIADAib7cKs4PeMc7Za4s=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/libraries/fltk/common.nix b/pkgs/development/libraries/fltk/common.nix
index d17cc9bd2ae5..43776d5918b6 100644
--- a/pkgs/development/libraries/fltk/common.nix
+++ b/pkgs/development/libraries/fltk/common.nix
@@ -85,6 +85,8 @@ stdenv.mkDerivation rec {
     libGLU
   ] ++ lib.optionals (withExamples && withGL) [
     glew
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    fontconfig
   ];
 
   propagatedBuildInputs = [
@@ -93,7 +95,6 @@ stdenv.mkDerivation rec {
     libpng
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     freetype
-    fontconfig
     libX11
     libXext
     libXinerama
diff --git a/pkgs/development/ocaml-modules/merlin-extend/default.nix b/pkgs/development/ocaml-modules/merlin-extend/default.nix
index a8ccd2cf4a01..17013a11caad 100644
--- a/pkgs/development/ocaml-modules/merlin-extend/default.nix
+++ b/pkgs/development/ocaml-modules/merlin-extend/default.nix
@@ -2,13 +2,11 @@
 
 buildDunePackage rec {
   pname = "merlin-extend";
-  version = "0.6";
-
-  useDune2 = true;
+  version = "0.6.2";
 
   src = fetchurl {
-    url = "https://github.com/let-def/merlin-extend/releases/download/v${version}/merlin-extend-v${version}.tbz";
-    sha256 = "0hvc4mz92x3rl2dxwrhvhzwl4gilnyvvwcqgr45vmdpyjyp3dwn2";
+    url = "https://github.com/let-def/merlin-extend/releases/download/v${version}/merlin-extend-${version}.tbz";
+    hash = "sha256-R1WOfzC2RGLyucgvt/eHEzrPoNUTJFK2rXhI4LD013k=";
   };
 
   nativeBuildInputs = [ cppo ];
diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index b04866a54607..5e70f24eedda 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   pythonOlder,
-  pythonAtLeast,
   fetchFromGitHub,
   # build-system
   setuptools,
@@ -30,17 +29,16 @@
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.12.0";
+  version = "0.12.3";
   pyproject = true;
 
-  # https://github.com/MatthiasValvekens/certomancer/issues/12
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-c2Fq4YTHQvhxuZrpKQYZvqHIMfubbkeKV4rctELLeJU=";
+    hash = "sha256-2BjLoGUWU0RaWVI9JA3s/Hf5aVtmv8hn+fB2jkWdQNY=";
   };
 
   build-system = [
@@ -75,11 +73,6 @@ buildPythonPackage rec {
     requests
   ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
-  disabledTests = [
-    # pyhanko_certvalidator.errors.DisallowedAlgorithmError
-    "test_validate"
-  ];
-
   pythonImportsCheck = [ "certomancer" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
index d721bb46d2a6..4d8fa08d8e0c 100644
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pyhanko-certvalidator";
-  version = "0.26.3";
+  version = "0.26.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,17 +26,12 @@ buildPythonPackage rec {
     owner = "MatthiasValvekens";
     repo = "certvalidator";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uUmsWiN182g+kxrCny7UNLDHdAdqKk64w6vnjmGBNjM=";
+    hash = "sha256-+/3n+v/8Tpqt7UoOrBi4S84N6Jioay7e2j+SvKJeoLA=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace ', "pytest-runner",' ""
-  '';
+  build-system = [ setuptools ];
 
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     asn1crypto
     cryptography
     oscrypto
@@ -51,26 +46,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTestPaths = [
-    # Requests
-    "tests/test_crl_client.py"
-  ];
-
-  disabledTests = [
-    # Look for nonexisting certificates
-    "test_basic_certificate_validator_tls"
-    # Failed to fetch OCSP response from http://ocsp.digicert.com
-    "test_fetch_ocsp_aiohttp"
-    "test_fetch_ocsp_requests"
-    "test_fetch_ocsp_err_requests"
-    # Unable to build a validation path for the certificate "%s" - no issuer matching "%s" was found
-    "test_revocation_mode_hard_aiohttp_autofetch"
-    # The path could not be validated because no revocation information could be found for intermediate certificate 1
-    "test_revocation_mode_hard"
-    # ValueError: Hash algorithm not known for ed448
-    "test_ed"
-  ];
-
   pythonImportsCheck = [ "pyhanko_certvalidator" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyhanko/default.nix b/pkgs/development/python-modules/pyhanko/default.nix
index 30b7533e7de4..ab7898a73fd9 100644
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -39,18 +39,22 @@
 
 buildPythonPackage rec {
   pname = "pyhanko";
-  version = "0.25.1";
+  version = "0.25.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "pyHanko";
     rev = "refs/tags/v${version}";
-    hash = "sha256-keWAiqwaMZYh92B0mlR4+jjxBKLOAJ9Kgc0l0GiIQbc=";
+    hash = "sha256-HJkCQ5YDVr17gtY4PW89ep7GwFdP21/ruBEKm7j3+Qo=";
   };
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "cryptography"
+  ];
+
   dependencies = [
     asn1crypto
     click
diff --git a/pkgs/development/python-modules/ray/binary-hashes.nix b/pkgs/development/python-modules/ray/binary-hashes.nix
index bab6c0695e54..6afd032a2006 100644
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@@ -1,11 +1,11 @@
 {
   cp310 = {
-    hash = "sha256-On1vcVm85BF7/o+cPQtl/yclf+LdjXN9rQ84aWZkQNo=";
+    hash = "sha256-Ypj7mBzQ+oYH8ZF96yeSWrit1IxgulvQ9s9A1MxdrOQ=";
   };
   cp311 = {
-    hash = "sha256-7OgCzzocECtT9juLyQ2UeXHEs4feryM8Ik7Y7zSh88s=";
+    hash = "sha256-Ia7hJ64anPYZMAGrQdJVG8yBMxujtxltAA8W0Q8VxwU=";
   };
   cp312 = {
-    hash = "sha256-B1B9L5lh6NU5DA62Bt8kkhbvWvsf+BhVgfPpIEHWYpM=";
+    hash = "sha256-AWkw5rp0uRtAEXpksk97//SKangPI9KwZKej9DvE4aI=";
   };
 }
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 41bfd53c9bf0..e193d25e2f1c 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -8,55 +8,63 @@
   autoPatchelfHook,
 
   # dependencies
-  aiohttp,
-  aiohttp-cors,
   aiosignal,
-  attrs,
   click,
-  cloudpickle,
-  colorama,
-  colorful,
-  cython,
   filelock,
   frozenlist,
-  gpustat,
-  grpcio,
   jsonschema,
   msgpack,
-  numpy,
-  opencensus,
   packaging,
-  prometheus-client,
-  psutil,
-  pydantic,
-  py-spy,
+  protobuf,
   pyyaml,
   requests,
-  setproctitle,
-  smart-open,
-  virtualenv,
+  watchfiles,
 
   # optional-dependencies
+  # adag
+  cupy,
+  # client
+  grpcio,
+  # data
   fsspec,
+  numpy,
   pandas,
   pyarrow,
+  # default
+  aiohttp,
+  aiohttp-cors,
+  colorful,
+  opencensus,
+  prometheus-client,
+  pydantic,
+  py-spy,
+  smart-open,
+  virtualenv,
+  # observability
+  opentelemetry-api,
+  opentelemetry-sdk,
+  opentelemetry-exporter-otlp,
+  # rllib
   dm-tree,
-  gym,
+  gymnasium,
   lz4,
-  matplotlib,
   scikit-image,
   scipy,
-  aiorwlock,
+  typer,
+  rich,
+  # serve
   fastapi,
   starlette,
   uvicorn,
-  tabulate,
+  # serve-grpc
+  pyopenssl,
+  # tune
   tensorboardx,
 }:
 
 let
   pname = "ray";
-  version = "2.38.0";
+  version = "2.39.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -84,68 +92,84 @@ buildPythonPackage rec {
     autoPatchelfHook
   ];
 
-  pythonRelaxDeps = [
-    "click"
-    "grpcio"
-    "protobuf"
-    "virtualenv"
-  ];
-
   dependencies = [
-    aiohttp
-    aiohttp-cors
-    aiosignal
-    attrs
     click
-    cloudpickle
-    colorama
-    colorful
-    cython
+    aiosignal
     filelock
     frozenlist
-    gpustat
-    grpcio
     jsonschema
     msgpack
-    numpy
-    opencensus
     packaging
-    prometheus-client
-    psutil
-    pydantic
-    py-spy
+    protobuf
     pyyaml
     requests
-    setproctitle
-    smart-open
-    virtualenv
+    watchfiles
   ];
 
   optional-dependencies = rec {
-    air-deps = data-deps ++ serve-deps ++ tune-deps ++ rllib-deps;
-    data-deps = [
+    adag = [
+      cupy
+    ];
+    air = lib.unique (data ++ serve ++ tune ++ train);
+    all = lib.flatten (builtins.attrValues optional-dependencies);
+    client = [ grpcio ];
+    data = [
       fsspec
+      numpy
       pandas
       pyarrow
     ];
-    rllib-deps = tune-deps ++ [
+    default = [
+      aiohttp
+      aiohttp-cors
+      colorful
+      grpcio
+      opencensus
+      prometheus-client
+      pydantic
+      py-spy
+      requests
+      smart-open
+      virtualenv
+    ];
+    observability = [
+      opentelemetry-api
+      opentelemetry-sdk
+      opentelemetry-exporter-otlp
+    ];
+    rllib = [
       dm-tree
-      gym
+      gymnasium
       lz4
-      matplotlib
       pyyaml
       scikit-image
       scipy
+      typer
+      rich
     ];
-    serve-deps = [
-      aiorwlock
-      fastapi
+    serve = lib.unique (
+      [
+        fastapi
+        requests
+        starlette
+        uvicorn
+        watchfiles
+      ]
+      ++ default
+    );
+    serve-grpc = lib.unique (
+      [
+        grpcio
+        pyopenssl
+      ]
+      ++ serve
+    );
+    train = tune;
+    tune = [
+      fsspec
       pandas
-      starlette
-      uvicorn
-    ];
-    tune-deps = [
-      tabulate
+      pyarrow
+      requests
       tensorboardx
     ];
   };
diff --git a/pkgs/os-specific/linux/gasket/default.nix b/pkgs/os-specific/linux/gasket/default.nix
index a25bbeee4033..65516be7dcd1 100644
--- a/pkgs/os-specific/linux/gasket/default.nix
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -1,4 +1,10 @@
-{ stdenv, lib, fetchFromGitHub, kernel }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  kernel
+}:
 
 stdenv.mkDerivation rec {
   pname = "gasket";
@@ -11,6 +17,20 @@ stdenv.mkDerivation rec {
     sha256 = "O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/google/gasket-driver/issues/36
+      # https://github.com/google/gasket-driver/pull/35
+      name = "linux-6.12-compat.patch";
+      url = "https://github.com/google/gasket-driver/commit/4b2a1464f3b619daaf0f6c664c954a42c4b7ce00.patch";
+      hash = "sha256-UOoOSEnpUMa4QXWVFpGFxBoF5szXaLEfcWtfKatO5XY=";
+    })
+  ];
+
+  postPatch = ''
+    cd src
+  '';
+
   makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -21,7 +41,6 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
-  sourceRoot = "${src.name}/src";
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index c445af0654a1..905aa1838a7c 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.11.2";
+  version = "2024.11.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
index 65e56d0746f3..e257f96db6b3 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "mushroom";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "piitaya";
     repo = "lovelace-mushroom";
     rev = "v${version}";
-    hash = "sha256-d38FyJ3pQ6L0AY2j6aTB8CRxJt8LDgT1A9ZpMoQgbXo=";
+    hash = "sha256-nUGRn5fRP47F3+/wpU9j2HfAliz94O8GkS7jB+07bKE=";
   };
 
-  npmDepsHash = "sha256-9i7pJh1dmhKobGFcLvZlc0JfaygwVuBvm6ttphl7SWg=";
+  npmDepsHash = "sha256-62wYR7Qkmcb4f2dWe6M3HMvrX9GyinNdTz0JeuismiA=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d373e2528b40..818b834349af 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -439,7 +439,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.11.2";
+  hassVersion = "2024.11.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -457,13 +457,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-cP9Q700JLnThAPDfeJ8mx+PSI6I62hjA49TpAMHN2Wk=";
+    hash = "sha256-9b4HPSCPYUUwKxn0JBw5uN6nI97jvgqBHFRUNhDue/k=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-qBKcY8PybEJeExTjxs9bgiM6YWjyoSLE1dzgrD1Hdtc=";
+    hash = "sha256-W7Z6C3kMyEIkY/3zQHm1OMMN7Tuj3ThsubLo6KjVotw=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 3f7c19381d2e..9dcf47815bb7 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.11.2";
+  version = "2024.11.3";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-P9fhFl91IJyRCacJ5lDJu036hgzcNMCF7LO4Brv4P6c=";
+    hash = "sha256-wctoMEduYZxGiSNgZWq4OPgBaiykwTY7FP8PhRsMh0I=";
   };
 
   build-system = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 042e7bbe40de..b19dd4db3134 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4957,7 +4957,7 @@ with pkgs;
     beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_17; });
   };
 
-  plfit = callPackage ../tools/misc/plfit {
+  plfit = callPackage ../by-name/pl/plfit/package.nix {
     python = null;
   };