diff --git a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
index 999215622dd2..995b811ec4f9 100755
--- a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
+++ b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
@@ -97,6 +97,7 @@ CROSS_TARGETS=(
     riscv64-unknown-linux-gnu
     s390x-unknown-linux-gnu
     x86_64-unknown-freebsd
+    loongarch64-unknown-linux-gnu
 )
 
 is_cross() {
@@ -264,14 +265,14 @@ EOF
 
             # individual file entries
             cat <<EOF
-$attr = import <nix/fetchurl.nix> {
+  $attr = import <nix/fetchurl.nix> {
     url = "http://tarballs.nixos.org/${s3_prefix}/${nixpkgs_revision}/$fname";
     hash = "${sri}";$(
     [[ -n ${executable_nix} ]] && printf "\n    %s" "${executable_nix}"
     [[ -n ${name_nix} ]]       && printf "\n    %s" "${name_nix}"
     [[ -n ${unpack_nix} ]]     && printf "\n    %s" "${unpack_nix}"
     )
-};
+  };
 EOF
     done
     # footer
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index c52e34b1b15a..e5ba6c54fb8c 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Initial support for the [COSMIC DE](https://system76.com/cosmic), a Rust-based desktop environment by System76, makers of Pop!_OS. Toggle the greeter (login manager) using `services.displayManager.cosmic-greeter.enable` and the DE itself with `services.desktopManager.cosmic.enable`. Mostly stable but still experimental. Please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
+- NixOS now has initial support for the [**COSMIC DE**](https://system76.com/cosmic) which is currently at **Alpha 7**. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. Enable COSMIC by enabling the greeter (login manager) `services.displayManager.cosmic-greeter.enable` and the DE itself by enabling `services.desktopManager.cosmic.enable` options. The support in NixOS/nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
 
 - `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
 
@@ -164,6 +164,8 @@
 
 - [`yarr`](https://github.com/nkanaev/yarr), a small, web-based feed aggregator and RSS reader. Available as [services.yarr](#opt-services.yarr.enable).
 
+- [OliveTin](https://www.olivetin.app/), gives safe and simple access to predefined shell commands from a web interface. Available as [services.olivetin](#opt-services.olivetin.enable).
+
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
 
 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).
@@ -577,6 +579,11 @@
 
   Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
 
+- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter
+  containing the final arguments including overrides.
+  This allows packaging configuration to be overridden in a consistent manner by
+  providing an alternative to `rec {}` syntax.
+
 - KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
   ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and
   [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0)
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 4b487179231b..1cf9cdbfdfe6 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1604,6 +1604,7 @@
   ./services/web-apps/mediagoblin.nix
   ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/mobilizon.nix
+  ./services/web-apps/olivetin.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
   ./services/web-apps/pds.nix
diff --git a/nixos/modules/services/web-apps/olivetin.nix b/nixos/modules/services/web-apps/olivetin.nix
new file mode 100644
index 000000000000..5facc7eb7a56
--- /dev/null
+++ b/nixos/modules/services/web-apps/olivetin.nix
@@ -0,0 +1,152 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.olivetin;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.olivetin = {
+    enable = lib.mkEnableOption "OliveTin";
+
+    package = lib.mkPackageOption pkgs "olivetin" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = "The user account under which OliveTin runs.";
+      default = "olivetin";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = "The group under which OliveTin runs.";
+      default = "olivetin";
+    };
+
+    path = lib.mkOption {
+      type =
+        with lib.types;
+        listOf (oneOf [
+          package
+          str
+        ]);
+      description = ''
+        Packages added to the service's {env}`PATH`.
+      '';
+      defaultText = lib.literalExpression ''
+        with pkgs; [ bash ]
+      '';
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of OliveTin. See <https://docs.olivetin.app/config.html> for more information.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          ListenAddressSingleHTTPFrontend = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              The address to listen on for the internal "microproxy" frontend.
+            '';
+            default = "127.0.0.1:8000";
+            example = "0.0.0.0:8000";
+          };
+        };
+      };
+    };
+
+    extraConfigFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/olivetin.yaml" ];
+      description = ''
+        Config files to merge into the settings defined in [](#opt-services.olivetin.settings).
+        This is useful to avoid putting secrets into the nix store.
+        See <https://docs.olivetin.app/config.html> for more information.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.olivetin = {
+      path = with pkgs; [ bash ];
+    };
+
+    systemd.services.olivetin = {
+      description = "OliveTin";
+
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [
+        "network-online.target"
+        "local-fs.target"
+      ];
+      after = [
+        "network-online.target"
+        "local-fs.target"
+      ];
+
+      inherit (cfg) path;
+
+      preStart = ''
+        tmp="$(mktemp -d)"
+        trap 'rm -rf "$tmp"' EXIT
+        cd "$tmp"
+
+        cp ${settingsFormat.generate "olivetin-config.yaml" cfg.settings} config.yaml
+        chmod +w config.yaml
+        for ((i=0; i < ${toString (lib.length cfg.extraConfigFiles)}; i++)); do
+          ${lib.getExe pkgs.yq} -yi '
+            def merge($y):
+              . as $x |
+              if ($x | type == "object") and ($y | type == "object") then
+                $x + $y + with_entries(select(.key | in($y)) | .key as $key | .value |= merge($y[$key]))
+              elif ($x | type == "array") and ($y | type == "array") then
+                $x + $y
+              else
+                $y
+              end;
+            merge($f | fromjson)
+          ' config.yaml --rawfile f <(${lib.getExe pkgs.yq} -c . "$CREDENTIALS_DIRECTORY/config-$i.yaml")
+        done
+        chmod -w config.yaml
+
+        mkdir -p /run/olivetin/config
+        mv config.yaml /run/olivetin/config/config.yaml
+      '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        RuntimeDirectory = "olivetin";
+        Restart = "always";
+
+        LoadCredential = lib.imap0 (i: path: "config-${toString i}.yaml:${path}") cfg.extraConfigFiles;
+
+        ExecStart = "${lib.getExe cfg.package} -configdir /run/olivetin/config";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "olivetin") {
+      olivetin = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "olivetin") { olivetin = { }; };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e3e2f5763d17..65f3b6316a19 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -966,6 +966,7 @@ in
   oddjobd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./oddjobd.nix { };
   obs-studio = runTest ./obs-studio.nix;
   oh-my-zsh = handleTest ./oh-my-zsh.nix { };
+  olivetin = runTest ./olivetin.nix;
   ollama = runTest ./ollama.nix;
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
diff --git a/nixos/tests/olivetin.nix b/nixos/tests/olivetin.nix
new file mode 100644
index 000000000000..f9d9e98610ef
--- /dev/null
+++ b/nixos/tests/olivetin.nix
@@ -0,0 +1,57 @@
+{ lib, ... }:
+
+{
+  name = "olivetin";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.olivetin = {
+      enable = true;
+      settings = {
+        actions = [
+          {
+            id = "hello_world";
+            title = "Say Hello";
+            shell = "echo -n 'Hello World!' | tee /tmp/result";
+          }
+        ];
+      };
+      extraConfigFiles = [
+        (builtins.toFile "secrets.yaml" ''
+          actions:
+            - id: secret
+              title: Secret Action
+              shell: echo -n secret > /tmp/result2
+        '')
+      ];
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.olivetin.settings.ListenAddressSingleHTTPFrontend = "0.0.0.0:8000";
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("olivetin.service")
+    machine.wait_for_open_port(8000)
+
+    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/hello_world"))
+    assert response["logEntry"]["exitCode"] == 0
+    assert response["logEntry"]["output"] == "Hello World!"
+    assert machine.succeed("cat /tmp/result") == "Hello World!"
+
+    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/secret"))
+    assert response["logEntry"]["exitCode"] == 0
+    assert machine.succeed("cat /tmp/result2") == "secret"
+  '';
+}
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index a42220b34131..a1d284a44add 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -20,12 +20,12 @@ let
     sha256Hash = "sha256-VNXErfb4PhljcJwGq863ldh/3i8fMdJirlwolEIk+fI=";
   };
   betaVersion = {
-    version = "2024.3.2.11"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 2"
-    sha256Hash = "sha256-pE17kbLnsEMRtaQencKqckW3uke9IliLkoHP6q3NrQg=";
+    version = "2024.3.2.12"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 3"
+    sha256Hash = "sha256-wmCPkYV88/OwuPqm10t3jT1x+cFRK+7Mgy683Au1P3g=";
   };
   latestVersion = {
-    version = "2025.1.1.6"; # "Android Studio Narwhal | 2025.1.1 Canary 6"
-    sha256Hash = "sha256-FUDb8/kyvO3M/NJp30VZCyNacJ90y/fawrDTFin7g6o=";
+    version = "2025.1.1.7"; # "Android Studio Narwhal | 2025.1.1 Canary 7"
+    sha256Hash = "sha256-RQOmTzmk0el8WXE3cnSBCnpginFk0bK45Aij7eil1uM=";
   };
 in
 {
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 970459b3cc99..d888c32436d7 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -11844,6 +11844,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  peek-nvim = buildVimPlugin {
+    pname = "peek.nvim";
+    version = "2024-04-09";
+    src = fetchFromGitHub {
+      owner = "toppair";
+      repo = "peek.nvim";
+      rev = "5820d937d5414baea5f586dc2a3d912a74636e5b";
+      sha256 = "01bdrk1h1xaq2bbbgwsrb2h2cc9j2d88kjcx2k3p8j8kgk20yql4";
+    };
+    meta.homepage = "https://github.com/toppair/peek.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   persisted-nvim = buildVimPlugin {
     pname = "persisted.nvim";
     version = "2025-03-30";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 4b1dfa5ae8ce..48db101cb795 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2744,6 +2744,10 @@ in
     ];
   };
 
+  peek-nvim = super.peek-nvim.overrideAttrs {
+    runtimeDeps = [ deno ];
+  };
+
   persisted-nvim = super.persisted-nvim.overrideAttrs {
     nvimSkipModules = [
       # /lua/persisted/init.lua:44: attempt to index upvalue 'config' (a nil value)
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 1401e2d6fad8..d6ac74a9881c 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -909,6 +909,7 @@ https://github.com/frankroeder/parrot.nvim/,HEAD,
 https://github.com/lewis6991/pckr.nvim/,HEAD,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
+https://github.com/toppair/peek.nvim/,HEAD,
 https://github.com/olimorris/persisted.nvim/,HEAD,
 https://github.com/folke/persistence.nvim/,,
 https://github.com/Weissle/persistent-breakpoints.nvim/,,
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index ef6854e558f4..70da877684b3 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -121,10 +121,27 @@ stdenv.mkDerivation rec {
 
   # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
   # it is not possible to use substituteAll
-  postPatch = ''
-    substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mamePath "$out/opt/mame"
-  '';
+  postPatch =
+    ''
+      substituteInPlace src/emu/emuopts.cpp \
+        --subst-var-by mamePath "$out/opt/mame"
+    ''
+    # MAME's build system uses `sw_vers` to test whether it needs to link with
+    # the Metal framework or not. However:
+    # a) that would return the build system's version, not the target's, and
+    # b) it can't actually find `sw_vers` in $PATH, so it thinks it's on macOS
+    #    version 0, and doesn't link with Metal - causing missing symbol errors
+    #    when it gets to the link step, because other parts of the build system
+    #    _do_ use the correct target version number.
+    # This replaces the `sw_vers` call with the macOS version actually being
+    # targeted, so everything gets linked correctly.
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      for file in scripts/src/osd/{mac,sdl}.lua; do
+        substituteInPlace "$file" --replace-fail \
+          'backtick("sw_vers -productVersion")' \
+          "os.getenv('MACOSX_DEPLOYMENT_TARGET') or '$darwinMinVersion'"
+        done
+    '';
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index d9da5e0104b5..0a7e8b0152a9 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -787,7 +787,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "135.0.7049.95",
+    "version": "135.0.7049.114",
     "deps": {
       "depot_tools": {
         "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
@@ -798,16 +798,16 @@
         "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
       },
       "ungoogled-patches": {
-        "rev": "135.0.7049.95-1",
-        "hash": "sha256-kLLtJti5GIF9TT0cH8zvsxywJzD22X8u2bB/tqENSjo="
+        "rev": "135.0.7049.114-1",
+        "hash": "sha256-frUL7b+4CyrzBa5T1HzFseWHwFa2MPgkpkrFeASWyLA="
       },
       "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
-        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
+        "rev": "63fd8a7d9d09e41ba37b84386c85d5f249f848f7",
+        "hash": "sha256-U6OJHocA6vI36QCU8UITUsVlentm210CwdThCwlDw5E=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
diff --git a/pkgs/applications/office/softmaker/softmaker-office-nx.nix b/pkgs/applications/office/softmaker/softmaker-office-nx.nix
index f6b152df6883..e584a8078340 100644
--- a/pkgs/applications/office/softmaker/softmaker-office-nx.nix
+++ b/pkgs/applications/office/softmaker/softmaker-office-nx.nix
@@ -6,9 +6,9 @@
   # overridable. This is useful when the upstream archive was replaced
   # and nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1222";
+    version = "1224";
     edition = "";
-    hash = "sha256-8ya9RYpd9G5SITYOpvhxjQE8ieV8TuAApkjNwCf9nHs=";
+    hash = "sha256-Y6x5E8WeI7Pf/wczWNKnHsCbXWW4Jdzo4ToBdzgmOF8=";
   },
 
   ...
diff --git a/pkgs/applications/office/softmaker/softmaker-office.nix b/pkgs/applications/office/softmaker/softmaker-office.nix
index 8cc4bfada5c9..ec51ce3693aa 100644
--- a/pkgs/applications/office/softmaker/softmaker-office.nix
+++ b/pkgs/applications/office/softmaker/softmaker-office.nix
@@ -7,9 +7,9 @@
   # Softmaker Office or when the upstream archive was replaced and
   # nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1222";
+    version = "1224";
     edition = "2024";
-    hash = "sha256-eyYBK5ZxPcBakOvXUQZIU2aftyH6PXh/rtqC/1BJhg4=";
+    hash = "sha256-ix9R9Xlugvu5qmKAqC2DsZFhyJ+VVsD7MSpBv+4lmTY=";
   },
 
   ...
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 12dfe62bb2bf..a817172589f3 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.6";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6p2KMFTdC04lEhNQiu88ALBPrpQUF9JhXDacntoq4lE=";
+    hash = "sha256-LSuNVfGus9kO1g4EfVCw6yWxudvYqBnM5mpJWH7MBCs=";
   };
 
   # remove if updating to rust 1.85
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-2pi2hfQTLs2HAlgp1DQCMFp/nMJQfcuQFhGlrsWgy5E=";
+  cargoHash = "sha256-lq+0R5g4MwVm8ESjKpz+aymjpqcaAE856XnBtYXYs8A=";
 
   env.RUSTC_BOOTSTRAP = 1;
 
diff --git a/pkgs/by-name/am/amazon-q-cli/package.nix b/pkgs/by-name/am/amazon-q-cli/package.nix
index a5432f353e58..fb941a20c72e 100644
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "amazon-q-cli";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-q-developer-cli";
     tag = "v${version}";
-    hash = "sha256-Hi0klNNxtWlZvcqobb8Y2hLsw/Pck1YQZB4AYBmcNKI=";
+    hash = "sha256-fOz9oz+xNwX2Bzl6szgQ9oai6lqP+EzbaCNzHPUT2cA=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-XK6B2OTCnWMow3KHWU6OK1HsyQW7apcLoYRP7viTte0=";
+  cargoHash = "sha256-H9bCke3vQDuS6RDEg8dzeFiBWCex64A8KSRhfgyp8e8=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index 24570317174c..a9b40b05521d 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -54,7 +54,7 @@
   opencolorio,
   openexr,
   openimagedenoise,
-  openimageio,
+  openimageio_2,
   openjpeg,
   openpgl,
   opensubdiv,
@@ -246,7 +246,7 @@ stdenv'.mkDerivation (finalAttrs: {
       libwebp
       opencolorio
       openexr
-      openimageio
+      openimageio_2
       openjpeg
       openpgl
       (opensubdiv.override { inherit cudaSupport; })
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index 0d11a4b64ec5..86bede7a095f 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.77.97";
+  version = "1.77.101";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-1MIcibP89EMCOK4A9lbXxGgwvMKCB+3UxrT+UYiwmtk=";
+      hash = "sha256-/JY1eBLw3xTxeAinctlpTSbwk6QibPdMVhZcBkbe7G4=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-6JO67t5yR2psvlYhOMERnMgta+YYTIQx/zen7y3B1Ec=";
+      hash = "sha256-mRbRGCsvkrNVfwYrlfgGyU94dEezFTI/ittkbVynp7Q=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-d2MQMf1twOhcAouIPpdjG5jB/tZ7FGi/lrRJZ/A/ibs=";
+      hash = "sha256-tn5HdMLoVRY1oLAYc/O2v2mVblb6KYud53yoHloEQ44=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-vEF26I1+nqBERFdZEKLcDZBDru0RXcwytvblRuqL8/M=";
+      hash = "sha256-HJel3HVz5MoOWXGTEH8Gu+Fq2Xur7xHXeZTUmWcWksk=";
     };
   };
 
diff --git a/pkgs/by-name/br/brush/package.nix b/pkgs/by-name/br/brush/package.nix
index db08db94ccce..0a9e153f19ba 100644
--- a/pkgs/by-name/br/brush/package.nix
+++ b/pkgs/by-name/br/brush/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "brush";
-  version = "0.2.16";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "reubeno";
     repo = "brush";
     tag = "brush-shell-v${version}";
-    hash = "sha256-ZQ1IiWkM888CWEtwWJ+dMjJO1sGvBTA8E6f9v9JLh/w=";
+    hash = "sha256-64xj9yu6OCNTnuymEd5ihdE0s8RWfrSMfTz9TlMQ6Sg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Vg5efRierCc7sT+7b94/4i4+3L5CoOrDoeMx/Rzg5mE=";
+  cargoHash = "sha256-AIEgSUl3YFCa6FOgoZYpPc1qc2EOfpm1lZEQYlBgkGg=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index 80b346367c0b..41dfb674a59b 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -19,17 +19,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-kRj2hEtE8FYky9Fn8hgHBo+UwWjOoS7/ROh9qz/0Vzs=";
+    hash = "sha256-DmU9Dlb8w3a8U+oSGwWARPh1SRbv/8TW7TO9SSvDe1U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jADtvhMzWdJydT1T14PSk4ggZpWIcXiOK0TW2llKeos=";
+  cargoHash = "sha256-wWs3B5hh2DP93i+4gGDTi+7NT4bj8ULJ+fT95sXxUdg=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index 6b3bc72759eb..9a01ac0198d0 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-hJOM5dZdLq6uYfhfspZzpbHgUOK/FWuIXuFPoisS8DU=";
+    hash = "sha256-2rGw4Jmr2rL9X1URA5wVPIZocuroS8yaQs42sJqiTbw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-95jTSn0yYj2PNVtfumfD1rPf1yLXHUi60FBqENK8CSw=";
+  cargoHash = "sha256-+nkXcbAPcIkg+p4ct/E0bm5O0n1MGN43AaWPjw13t9s=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index e244f19b7251..07a2d1e13126 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  fetchpatch,
   cosmic-wallpapers,
   libcosmicAppHook,
   just,
@@ -14,23 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
+    hash = "sha256-KMP7TmamtbycF/nKctjYozMJwVr9zdp4A8AWriswo2g=";
   };
 
-  patches = [
-    # TOOD: This is merged and will be included in the 7th Alpha release, remove it then.
-    (fetchpatch {
-      url = "https://github.com/pop-os/cosmic-bg/commit/6a824a7902d7cc72b5a3117b6486603a1795a1d6.patch";
-      hash = "sha256-jL0az87BlJU99lDF3jnE74I4m/NV6NViyYXTfZoBDM4=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace config/src/lib.rs data/v1/all \
       --replace-fail '/usr/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg' \
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index 5d0bf4b2137c..8d21ef249c05 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-CygtVtzO8JJQv+G3yx/OCCy8BlPqyNqcmf3Mv1gFuT4=";
+    hash = "sha256-2AnGEUWumE1C4Mi5inN7enbxCdWCKbQdYpUvTK3jGQ4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bfVsfrxGi0Lq/YRddCVhfqXL8kPGL9p4bqSNPsmjx0o=";
+  cargoHash = "sha256-fj6TIBuZ5hrds4WMHRa2krXN5fivKriO2Q/FWdnlGaA=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 6523bba876aa..c0669fbc280a 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -21,21 +21,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-mKVZI/x8+LrwFHGnJOzOq/vFkGev7sM9xJQOTA7uZGA=";
+    hash = "sha256-mgUSkYtc+i9pXv0n3zLHwBXFxfeWlhbsFJKa7X+mI98=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+b8pSSBUMs1EJDlldgR1UqLLH0sLU/djMOtE3JsDpkQ=";
+  cargoHash = "sha256-qfPLDgGeYGSO0ZKJooXRK0NnTqzJ6zq6RhBpTTUusQY=";
 
   # COSMIC applications now uses vergen for the About page
   # Update the COMMIT_DATE to match when the commit was made
-  env.VERGEN_GIT_COMMIT_DATE = "2025-02-20";
+  env.VERGEN_GIT_COMMIT_DATE = "2025-04-17";
   env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
   postPatch = ''
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index a03abe1467f2..6e6ca5699c24 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-i1CVhfieexeiKPwp0y29QyrKspzEFkp1+zwIaM9D/Qc=";
+    hash = "sha256-bI5yTpqU2N6hFwI9wi4b9N5onY5iN+8YDM3bSgdYxjQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I5WRuEogMwa0dB6wxhWDxivqhCdUugvsPrwUvjjDnt8=";
+  cargoHash = "sha256-7AOdSk9XIXFCDyCus3XgOK3ZBVa4CvX+NFM0jHf7Wbs=";
 
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-21";
+    VERGEN_GIT_COMMIT_DATE = "2025-04-22";
     VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 
@@ -72,7 +72,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     defaultCargoTestFlags="$cargoTestFlags"
 
-    cargoTestFlags="$defaultCargoTestFlags --package cosmic-files"
+    # Some tests with the `compio` runtime expect io_uring support but that
+    # is disabled in the Nix sandbox and the tests fail because they can't
+    # run in the sandbox. Ideally, the `compio` crate should fallback to a
+    # non-io_uring runtime but for some reason, that doesn't happen.
+    cargoTestFlags="$defaultCargoTestFlags --package cosmic-files -- \
+      --skip operation::tests::copy_dir_to_same_location \
+      --skip operation::tests::copy_file_to_same_location \
+      --skip operation::tests::copy_file_with_diff_name_to_diff_dir \
+      --skip operation::tests::copy_file_with_extension_to_same_loc \
+      --skip operation::tests::copy_to_diff_dir_doesnt_dupe_files \
+      --skip operation::tests::copying_file_multiple_times_to_same_location"
     runHook cargoCheckHook
 
     cargoTestFlags="$defaultCargoTestFlags --package cosmic-files-applet"
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index fbc9027fdd59..567a1ccfef3f 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -17,17 +17,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-K6kCBtlmFfav8UP4zorzDJBzHt4CoSaFFAufrW1DPrw=";
+    hash = "sha256-o9ZoRHi+k+HCSGfRz1lQFAeJMCqcTQEHf5rf9wn3qqY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nmkM/Jm2P5ftZFfzX+O1Fe6eobRbgBkajZsbyI67Zfw=";
+  cargoHash = "sha256-hUHkyz/avFu9g1FMdC+4vz6xM75CauurrarhouuVZXc=";
+
+  env.VERGEN_GIT_COMMIT_DATE = "2025-04-25";
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
   cargoBuildFlags = [ "--all" ];
 
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 633a290eb0ef..fc45130d977a 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-j5H2+BOWxq2jShN15QCvj9rY6OK+vlUbyR9R07Ka2rA=";
+    hash = "sha256-KDmEYeuiDTYvqg2XJK8pMDfsmROKtN+if5Qxz57H5xs=";
   };
 
   nativeBuildInputs = [ just ];
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index 6a93e7252dce..1915a726d201 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,13 +16,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-idle";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-hORU+iMvWA4XMSWmzir9EwjpLK5vOLR8BgMZz+aIZ4U=";
+    hash = "sha256-dRvcow+rZ4sJV6pBxRIw6SCmU3aXP9uVKtFEJ9vozzI=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index 0d56a0417696..2473f8ae7b18 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
+    hash = "sha256-niMsDLVMUEr8VyubDm6RGgS7p22v5nH/F8cASJOszhs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";
+  cargoHash = "sha256-Wh3vI42RBfXpI7mvPVUmGK3fITGi+EGyo+lG7VnZg3w=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index 37182f07f3a2..86950218c451 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-notifications";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-d6bAiRSO2opKSZfadyQYrU9oIrXwPNzO/g2E2RY6q04=";
+    hash = "sha256-xcGmcOoxHb7gj6fW7xPZ5R0MTkMVXNJgvr9d5LPy9kw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-utip7E8NST88mPaKppkuOcdW+QkFoRqWy3a2McvMHo8=";
+  cargoHash = "sha256-7EDe1OjGS6Xl0N/BrZG8lzWO0pFbwiEp+kn6WyydJQM=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index ea506efa6ef3..5af20b11b42c 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ezOeRgqI/GOWFknUVZI7ZLEy1GYaBI+/An83HWKL6ho=";
+    hash = "sha256-POjuxrNBajp4IOw7YwF2TS4OfoM8Hxo1fO48nkhKj8U=";
   };
 
   postPatch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vYehF2RjPrTZiuGcRUe4XX3ftRo7f+SIoKizD/kOtR8=";
+  cargoHash = "sha256-kfExKggQo3MoTXw1JbKWjLu5kwYF0n7DzSQcG6e1+QQ=";
 
   nativeBuildInputs = [ libcosmicAppHook ];
 
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index b658e6fd8068..d3b0193a8413 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-6lt9Rig1pM37B7+nRrR+eYke8umSfYlg8aLB45Q1X+4=";
+    hash = "sha256-QcrkfU6HNZ2tWfKsMdcv58HC/PE7b4T14AIep85TWOY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EIp9s42deMaB7BDe7RAqj2+CnTXjHCtZjS5Iq8l46A4=";
+  cargoHash = "sha256-qufOJeWPRjj4GgWNJmQfYaGKeYOQbkTeFzrUSi9QNnQ=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index 5dfe5ba01ba3..143f4ed2624e 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Ebjj+C+yLCRomZy2W8mYDig1pv7aQcD3A9V2M53RM5U=";
+    hash = "sha256-/xf3IOFVpctfgaaNNq2HUzK/qHt7Qikcv0JKoPJboRU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-p1ylYB6xuF0UrhUO+QbGIgxqvZeQ6+GIbSNijTDXyRE=";
+  cargoHash = "sha256-0RrtErTR2J5mn/Lfppk+5X8UUOC2LN65krAq1uz/O4M=";
 
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index f48a3d48b2c6..3986184d7d9e 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-randr";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
+    hash = "sha256-vCGbWsG/F3WhWVSy8Z3r4ZHpks/X/57/ZZXuw6BFl+c=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
+  cargoHash = "sha256-lW44Y7RhA1l+cCDwqSq9sbhWi+kONJ0zy1fUu8WPYw0=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index d27d8b6661bc..d4535d3a8826 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-/sGYF+XWmPraNGlBVUcN/nokDB9JwWViEAL9gVH3ZaI=";
+    hash = "sha256-VvU/9vYdoTvy3yzdeXrhKrtS9tUHMKnaSAeNTEKk5PA=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index 15750f68f38c..84e338b7d375 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-session";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-2EKkVdZ7uNNJ/E/3knmeH3EBa+tkYmIxP3t9d6yacww=";
+    hash = "sha256-vozm4vcXV3RB9Pk6om1UNCfGh80vIVJvSwbzwGDQw3Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iYObxjWJUKgZKGTkqtYgQK4758k0EYZGhIAM/oLxxso=";
+  cargoHash = "sha256-68budhhbt8wPY7sfDqwIs4MWB/NBXsswK6HbC2AnHqE=";
 
   postPatch = ''
     substituteInPlace data/start-cosmic \
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     (placeholder "out")
     "--set"
     "cosmic_dconf_profile"
-    "cosmic"
+    "${placeholder "out"}/etc/dconf/profile/cosmic"
     "--set"
     "cargo-target-dir"
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
@@ -51,18 +51,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.XDP_COSMIC = "${xdg-desktop-portal-cosmic}/libexec/xdg-desktop-portal-cosmic";
 
-  postInstall = ''
-    dconf_profile_dst=$out/etc/dconf/profile/cosmic
-    if [ ! -f $dconf_profile_dst ]; then
-        install -Dm0644 data/dconf/profile/cosmic $dconf_profile_dst
-    else
-        # future proofing
-        echo 'The Justfile is now correctly installing the dconf profile.'
-        echo 'Please remove the dconf profile from the `postInstall` phase.'
-        exit 1
-    fi
-  '';
-
   passthru = {
     providedSessions = [ "cosmic" ];
     tests = {
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index 5f89008fb012..fac94b5b6edb 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -6,6 +6,7 @@
   pop-gtk-theme,
   adw-gtk3,
   pkg-config,
+  libpulseaudio,
   geoclue2-with-demo-agent,
   libinput,
   udev,
@@ -14,13 +15,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings-daemon";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-DtwW6RxHnNh87Xu0NCULfUsHNzYU9tHtFKE9HO3rvME=";
+    hash = "sha256-vdhkE5CmgiGYg5TXxN7lLqxjv7apKEKvIscXFIzZfRc=";
   };
 
   postPatch = ''
@@ -31,11 +32,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lGzQBL9IXbPsaKeVHp34xkm5FnTxWvfw4wg3El4LZdA=";
+  cargoHash = "sha256-Dzv1SDeZFIa+LFQQ91lO7RBHldsjDnGf+R12Ln2WZwU=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libinput
+    libpulseaudio
     udev
   ];
 
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index c37320999138..7e79d7c6babd 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   cmake,
   just,
@@ -28,25 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
+    hash = "sha256-rrPgCXl4uD4Gvstgj9Sdv6rB/0d8wa56CdBjAkTLQG8=";
   };
 
-  patches = [
-    # TODO: This is merged and will be included in the 7th Alpha release, remove it then.
-    (fetchpatch {
-      url = "https://github.com/pop-os/cosmic-settings/commit/2e2898b31fabcb3f3b561e6c4cea2aca9de9b284.patch";
-      hash = "sha256-ZGJlGmR6lZB697uQ+ZsjvisNbPKBlBdRK/Ti541ZdlE=";
-    })
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
+  cargoHash = "sha256-7Aoy/okgFSwDU6jMYzTGtwPbK82yMgL5bnKBfBUD3vA=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 56c943e1b031..44158ec40501 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ce7PaHBhRFUoujAS6j10XWbD2PxzK6XXIk/ENclT1iY=";
+    hash = "sha256-skNzkpcdGJkve7enlnnZxYxnScHFmyaCAy0xaMEEsE0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-kPCE6F8/UsTJOmIjwxBLISk/Jhfljwa666WhXuKkkDE=";
+  cargoHash = "sha256-2iWJFPSvNQ6JwQwzowKYbgjog2gsjOUlReai/j0d3Do=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index e15383b16936..0e1cf1012723 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,22 +15,22 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-sdeRkT6UcyBKIFnJZn3aGf8LZQimqVPqtXo7RtwUs5M=";
+    hash = "sha256-leCKdnlevfLiPJkloWCpOjkHaSf7+EYdobZRZ/Jis+4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Qznkqp+zWpP/ok2xG7U5lYBW0qo4+ARnm8hgxU20ha0=";
+  cargoHash = "sha256-Re9t25tkwmrvXB9GmPSVG+QDUZmk5rwrrY2ntlB3Tdw=";
 
   # COSMIC applications now uses vergen for the About page
   # Update the COMMIT_DATE to match when the commit was made
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-21";
+    VERGEN_GIT_COMMIT_DATE = "2025-04-20";
     VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 3c2497b7662a..81401142d385 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -8,7 +8,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     tag = "epoch-${finalAttrs.version}";
     forceFetchGit = true;
     fetchLFS = true;
-    hash = "sha256-Exrps3DicL/G/g0kbSsCvoFhiJn1k3v8I09GhW7EwNM=";
+    hash = "sha256-XtNmV6fxKFlirXQvxxgAYSQveQs8RCTfcFd8SVdEXtE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index e3e6404dbffd..f2729979df5d 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  cosmic-wallpapers,
   libcosmicAppHook,
   pkg-config,
   libinput,
@@ -15,33 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3jivE0EaSddPxMYn9DDaYUMafPf60XeCwVeQegbt++c=";
+    hash = "sha256-d7KYZbq8O/t5V/gU+wwstp06vyfnmt6vRKo+54Dct+o=";
   };
 
-  postPatch = ''
-    # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present
-    # in the `pop-wallpapers` package, we're using the Orion Nebula image
-    # from NASA available in the `cosmic-wallpapers` package. Mainly because
-    # the previous image was used in the GNOME shell extension and the
-    # Orion Nebula image is widely used in the Rust-based COSMIC DE's
-    # marketing materials. Another reason to use the Orion Nebula image
-    # is that it's actually the default wallpaper as configured by the
-    # `cosmic-bg` package's configuration in upstream [1] [2].
-    #
-    # [1]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/config/src/lib.rs#L142
-    # [2]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/data/v1/all#L3
-    substituteInPlace src/view/mod.rs \
-      --replace-fail '/usr/share/backgrounds/pop/kate-hazen-COSMIC-desktop-wallpaper.png' "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-l5y9bOG/h24EfiAFfVKjtzYCzjxU2TI8wh6HBUwoVcE=";
+  cargoHash = "sha256-TjgnPuFUIDtxx9kpvN9hKiir3/ZVtCc0z1CE4UHre1Q=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 47aced70a01e..69813cc7e83d 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.247.1";
+  version = "0.249.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c9ZcqJuue5Nccuhpoxud0LevJD2jNPAYuIrBaEuUihY=";
+    hash = "sha256-DNa/ovllWJwsja8+QXP4Z38NE2uO99kHFQsXAEbKciQ=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
       --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
   '';
 
-  vendorHash = "sha256-c+fg2eJiuLr7UuWier7VFdLNFGDo0aCMo0q8/spnmSE=";
+  vendorHash = "sha256-Nj9oQryh3tsXUoIPunl5EXKkWeT76zGTsdFaK0UuNVY=";
 
   excludedPackages = [
     "bundle/internal"
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 5f5dc8ba7b8d..b5725fdb7b62 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -21,17 +21,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6mRu1B02bX7Ax0d7MgI1cGalIKOqFMN+xP8ii+pUJWE=";
+    hash = "sha256-/5KCwWyPdx/OKjoKgHZ8BAih7dh21VrbC+N1U74B/KI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YZ6O31R/1L7m25Z+6Xq6b44cRAX1jgRFPlhmoFVYFok=";
+  cargoHash = "sha256-3I1yplJjVH7Mf2wjwk8qSdbHTcR20QSJGF9MHtnu+q8=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 196ddfcadef4..5a0b6d62cdec 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -19,14 +19,14 @@ let
     src = fetchFromGitHub {
       owner = "domenkozar";
       repo = "nix";
-      rev = "f3f44b2baaf6c4c6e179de8cbb1cc6db031083cd";
-      hash = "sha256-E3j+3MoY8Y96mG1dUIiLFm2tZmNbRvSiyN7CrSKuAVg=";
+      rev = "090394819020afda8eae69e395b1accba9c0fab2";
+      hash = "sha256-eUYh7+PgqLXTt8/9IOxEuW2qyxADECmTic8QNhEwKSw=";
     };
     doCheck = false;
     doInstallCheck = false;
   });
 
-  version = "1.5.2";
+  version = "1.6";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
@@ -36,11 +36,11 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-rXtUUxfQ34ukTy2OyHwuypnSgK95FRPGwJf69QnWMrc=";
+    hash = "sha256-ui6UwatBHN2WFvStGUHVOdBu72MsG/7b0GeyRdTCyEw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-oiOh8m7MypViLbzy/13NpSiOwkfRwybUpDs91f+HbGA=";
+  cargoHash = "sha256-XS6F/Sp5peJdzAormYPjAA4SJfusMH6PRYIM3Tw5AUw=";
 
   buildAndTestSubdir = "devenv";
 
diff --git a/pkgs/by-name/do/docfd/package.nix b/pkgs/by-name/do/docfd/package.nix
index 33f0d56825a8..9f72c144373b 100644
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@@ -14,7 +14,7 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "docfd";
-  version = "10.1.3";
+  version = "10.2.0";
 
   minimalOCamlVersion = "5.1";
 
@@ -22,7 +22,7 @@ ocamlPackages.buildDunePackage rec {
     owner = "darrenldl";
     repo = "docfd";
     rev = version;
-    hash = "sha256-ZD1nKl/hfidlTGdBnNINt2EmlUmFWaJjSvY3wkyJJcg=";
+    hash = "sha256-wVhsZTG8yEkxKA0ta3IDe7O/ER5RuBuFOPKHP8xS2GA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/do/docker-language-server/package.nix b/pkgs/by-name/do/docker-language-server/package.nix
index c6c06164e655..3c9a284d50bd 100644
--- a/pkgs/by-name/do/docker-language-server/package.nix
+++ b/pkgs/by-name/do/docker-language-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.3.4";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-st7ZsifOJy2se0dgJHtonMSQC1hO8z3yhPYJ4H5nqAk=";
+    hash = "sha256-irjIa+GC/4tEMoC8ZY/8n9J/Z5G/VesSj4xWqnOj6uY=";
   };
 
-  vendorHash = "sha256-Odyc1pGp52f8S2bXT7v4Rpk2H3vxr+DghsNcFUVU62k=";
+  vendorHash = "sha256-O1SQVKfnOkxWqJWamRkb8RMRsWriBZqH3oYSzIHX7Ug=";
 
   nativeCheckInputs = [
     docker
diff --git a/pkgs/by-name/dp/dprint/plugins/default.nix b/pkgs/by-name/dp/dprint/plugins/default.nix
index 0c0d2ab0b492..391a23e3e4cb 100644
--- a/pkgs/by-name/dp/dprint/plugins/default.nix
+++ b/pkgs/by-name/dp/dprint/plugins/default.nix
@@ -1,4 +1,8 @@
-{ lib, fetchurl }:
+{
+  lib,
+  fetchurl,
+  stdenv,
+}:
 let
   mkDprintPlugin =
     {
@@ -12,28 +16,32 @@ let
       license ? lib.licenses.mit,
       maintainers ? [ lib.maintainers.phanirithvij ],
     }:
-    fetchurl {
-      inherit
-        hash
-        url
-        pname
-        version
-        ;
-      name = "${pname}-${version}.wasm";
+    stdenv.mkDerivation (finalAttrs: {
+      inherit pname version;
+      src = fetchurl { inherit url hash; };
+      dontUnpack = true;
       meta = {
-        inherit
-          description
-          license
-          maintainers
-          ;
+        inherit description license maintainers;
       };
+      /*
+        in the dprint configuration
+        dprint expects a plugin path to end with .wasm extension
+
+        for auto update with nixpkgs-update to work
+        we cannot have .wasm extension at the end in the nix store path
+      */
+      buildPhase = ''
+        mkdir -p $out
+        cp $src $out/plugin.wasm
+      '';
       passthru = {
         updateScript = ./update-plugins.py;
         inherit initConfig updateUrl;
       };
-    };
+    });
   inherit (lib)
     filterAttrs
+    isDerivation
     mapAttrs'
     nameValuePair
     removeSuffix
@@ -45,5 +53,13 @@ let
     name: _:
     nameValuePair (removeSuffix ".nix" name) (import (./. + "/${name}") { inherit mkDprintPlugin; })
   ) files;
+  # Expects a function that receives the dprint plugin set as an input
+  # and returns a list of plugins
+  # Example:
+  # pkgs.dprint-plugins.getPluginList (plugins: [
+  #   plugins.dprint-plugin-toml
+  #   (pkgs.callPackage ./dprint/plugins/sample.nix {})
+  # ]
+  getPluginList = cb: map (p: "${p}/plugin.wasm") (cb plugins);
 in
-plugins // { inherit mkDprintPlugin; }
+plugins // { inherit mkDprintPlugin getPluginList; }
diff --git a/pkgs/by-name/dp/dprint/plugins/update-plugins.py b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
index 9a3bd7e38cae..f065d673152b 100755
--- a/pkgs/by-name/dp/dprint/plugins/update-plugins.py
+++ b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
@@ -29,11 +29,9 @@ else:
 
 
 # get sri hash for a url, no unpack
-def nix_prefetch_url(url, name, algo="sha256"):
+def nix_prefetch_url(url, algo="sha256"):
     hash = (
-        subprocess.check_output(
-            ["nix-prefetch-url", "--type", algo, "--name", name, url]
-        )
+        subprocess.check_output(["nix-prefetch-url", "--type", algo, url])
         .decode("utf-8")
         .rstrip()
     )
@@ -119,7 +117,7 @@ def update_plugin_by_name(name):
     data = requests.get(p["updateUrl"]).json()
     p["url"] = data["url"]
     p["version"] = data["version"]
-    p["hash"] = nix_prefetch_url(data["url"], f"{name}-{data["version"]}.wasm")
+    p["hash"] = nix_prefetch_url(data["url"])
 
     write_plugin_derivation(p)
 
@@ -136,7 +134,7 @@ def update_plugins():
             pname = pname.replace("/", "-")
         drv_attrs = {
             "url": e["url"],
-            "hash": nix_prefetch_url(e["url"], f"{pname}-{e["version"]}.wasm"),
+            "hash": nix_prefetch_url(e["url"]),
             "updateUrl": update_url,
             "pname": pname,
             "version": e["version"],
diff --git a/pkgs/by-name/e1/e1s/package.nix b/pkgs/by-name/e1/e1s/package.nix
index 06a15d5098e8..c921f86e0cbf 100644
--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "e1s";
-  version = "1.0.45";
+  version = "1.0.46";
 in
 buildGoModule {
   inherit pname version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "keidarcy";
     repo = "e1s";
     tag = "v${version}";
-    hash = "sha256-1dbdIShEyQ9/1kXx0w4SiEu6c53WUj5+RtmIcwuhSRA=";
+    hash = "sha256-Wnj6HNxVdhnmGMtw+Da/LRxMkXBm+rWDUcHPOxFXDLU=";
   };
 
   vendorHash = "sha256-bBl4D7HNIiAym6BWSJ0x4LZnIEUMfECj6dDDVZIFrHA=";
diff --git a/pkgs/by-name/ed/eduvpn-client/package.nix b/pkgs/by-name/ed/eduvpn-client/package.nix
index 8bccd6c70fee..c5f26ab71b49 100644
--- a/pkgs/by-name/ed/eduvpn-client/package.nix
+++ b/pkgs/by-name/ed/eduvpn-client/package.nix
@@ -40,6 +40,10 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
+  postInstall = ''
+    ln -s $out/${python3Packages.python.sitePackages}/eduvpn/data/share/ $out/share
+  '';
+
   checkInputs = with python3Packages; [
     pytestCheckHook
   ];
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index b2db5105301c..2b61b9e4d3f0 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eza";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HtukMHiTWWejbq+cpeyF4QmTaBP4yvvyVb/xaacHKwI=";
+    hash = "sha256-r8svNiz0hcK0QQ0LvkYKTc9gLOEDLylZss32g6sM/hY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-T/ryAhBM0ECttDx3vMesLfTXfnHecM/0gpOCcg/o2kI=";
+  cargoHash = "sha256-akoRFvlwHUg8KzmxMGkJ//fIrX/+/yu6fHbxBjgwUZc=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/fu/fulcio/package.nix b/pkgs/by-name/fu/fulcio/package.nix
index f8a732e9f38e..672679e569d4 100644
--- a/pkgs/by-name/fu/fulcio/package.nix
+++ b/pkgs/by-name/fu/fulcio/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ymPczybHADTz4uiY8aLLre+Q8bBq/5L5MXJ26eBhi+U=";
+    hash = "sha256-UVUVT4RvNHvzIwV6azu2h1O9lnNu0PQnnkj4wbrY8BA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-lfJCPE8FRAX+juXQ7CiwItbnd0kAheaEdWG0Bwoyz/Y=";
+  vendorHash = "sha256-lNPRejC7Z3OHDvhJGzPIlgqi7eXjlqgeECJO/13gGt4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 6bf88ca92389..ff4032cf0181 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.71.0";
+  version = "2.71.2";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-Wx1C5xrjssF09ok9YYXsewDi5Tdi3Gepfnf1FueEpkI=";
+    hash = "sha256-n1qGJ5/X7wp4kgQqgcUomNvln2WavDJOjwxjVokfbiU=";
   };
 
   vendorHash = "sha256-69bGTUdVD/jebvmxYu0Mx7poSlbkXBAXUWLJ1CclXJU=";
diff --git a/pkgs/by-name/gp/gpupad/package.nix b/pkgs/by-name/gp/gpupad/package.nix
index 7b076839a3d5..d9b87cdc3a47 100644
--- a/pkgs/by-name/gp/gpupad/package.nix
+++ b/pkgs/by-name/gp/gpupad/package.nix
@@ -7,7 +7,7 @@
   glslang,
   imath,
   ktx-tools,
-  openimageio,
+  openimageio_2,
   qt6Packages,
   spdlog,
   spirv-cross,
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     glslang
     imath # needed for openimageio
     ktx-tools
-    openimageio
+    openimageio_2
     qt6Packages.qtbase
     qt6Packages.qtdeclarative
     qt6Packages.qtmultimedia
diff --git a/pkgs/by-name/ht/httpx/package.nix b/pkgs/by-name/ht/httpx/package.nix
index cc2bd31b4b1e..4c8b7761c8c4 100644
--- a/pkgs/by-name/ht/httpx/package.nix
+++ b/pkgs/by-name/ht/httpx/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.6.10";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     tag = "v${version}";
-    hash = "sha256-lU5LtYFnWJu4yZTqdJFqLnaAUOQ3Nc2EaNPrvTxoW3Q=";
+    hash = "sha256-V4OTIUm7KSUSKgQczkOtIw8HlkLEMgvX53a4caQP5IU=";
   };
 
-  vendorHash = "sha256-+m0TPKIBCnRfswrMw9+w1r/pWaRmkI+s0RRbv5X5GBo=";
+  vendorHash = "sha256-lwk/ajywAJ969U5gpYQgIg8+u1xKARFH+HTk2+OgY4A=";
 
   subPackages = [ "cmd/httpx" ];
 
diff --git a/pkgs/by-name/hy/hyprls/package.nix b/pkgs/by-name/hy/hyprls/package.nix
index ac7f9b559992..3262ddb485c6 100644
--- a/pkgs/by-name/hy/hyprls/package.nix
+++ b/pkgs/by-name/hy/hyprls/package.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   meta = {
     description = "LSP server for Hyprland's configuration language";
-    homepage = "https://en.ewen.works/hyprls";
+    homepage = "https://gwen.works/hyprls";
     changelog = "https://github.com/hyprland-community/hyprls/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ arthsmn ];
diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index 8cbe4d22a60a..ea2729d7123b 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${version}";
-    hash = "sha256-YTijKTelSFDVYSx0XocOx2OqEDCtoIMGBLEH3uUbg20=";
+    hash = "sha256-l4D0tE0yB2eLy9QlB9kraOtCUfqVRhYyaMUb/Xvv82c=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
@@ -32,7 +32,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-AC+nXaUvnppEIPDthfWDffeoh8hcsd3wDynmF34XBD8=";
+  vendorHash = "sha256-z9gS8i9GatDq4flomPcBUpf7b/6BJZ42lGOmpfpdmao=";
 
   # options used by upstream:
   # https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml
@@ -48,6 +48,8 @@ buildGoModule rec {
     ldflags+=" -X github.com/simulot/immich-go/Date=$(cat SOURCE_DATE)"
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     writableTmpDirAsHomeHook
   ];
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index 618b19bf11cc..d52400feecd1 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -11,9 +11,9 @@
 
 let
   pname = "jetbrains-toolbox";
-  version = "2.5.4.38621";
+  version = "2.6.1.40902";
 
-  passthru.updateScript = ./update.sh;
+  updateScript = ./update.sh;
 
   meta = {
     description = "Jetbrains Toolbox";
@@ -34,30 +34,26 @@ let
     attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   linux = appimageTools.wrapAppImage rec {
-    inherit
-      pname
-      version
-      passthru
-      meta
-      ;
+    inherit pname version meta;
+
+    source =
+      let
+        arch = selectSystem {
+          x86_64-linux = "";
+          aarch64-linux = "-arm64";
+        };
+      in
+      fetchzip {
+        url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}${arch}.tar.gz";
+        hash = selectSystem {
+          x86_64-linux = "sha256-P4kv6ca6mGtl334HKNkdo9Iib/Cgu3ROrbQKlQqxUj4=";
+          aarch64-linux = "sha256-mG8GAVPi2I0A13rKhXoXxiRIHK1QOWPv4gZxfm0+DKs=";
+        };
+      };
 
     src = appimageTools.extractType2 {
       inherit pname version;
-      src =
-        let
-          arch = selectSystem {
-            x86_64-linux = "";
-            aarch64-linux = "-arm64";
-          };
-        in
-        fetchzip {
-          url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}${arch}.tar.gz";
-          hash = selectSystem {
-            x86_64-linux = "sha256-rq0Hn9g+/u9C8vbEVH2mv62c1dvxr+t9tBhf26swQgI=";
-            aarch64-linux = "sha256-52wFejaKBSg/eeJu3NDGl1AdZLsJdi/838YeROD4Loc=";
-          };
-        }
-        + "/jetbrains-toolbox";
+      src = source + "/jetbrains-toolbox";
       postExtract = ''
         patchelf --add-rpath ${lib.makeLibraryPath [ icu ]} $out/jetbrains-toolbox
       '';
@@ -71,15 +67,15 @@ let
       wrapProgram $out/bin/jetbrains-toolbox \
         --append-flags "--update-failed"
     '';
+
+    passthru = {
+      src = source;
+      inherit updateScript;
+    };
   };
 
   darwin = stdenv.mkDerivation (finalAttrs: {
-    inherit
-      pname
-      version
-      passthru
-      meta
-      ;
+    inherit pname version meta;
 
     src =
       let
@@ -91,8 +87,8 @@ let
       fetchurl {
         url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${finalAttrs.version}${arch}.dmg";
         hash = selectSystem {
-          x86_64-darwin = "sha256-y0zXQEqY5lj/e440dRtyBfaw8CwqqgzO3Ujreb37Z/I=";
-          aarch64-darwin = "sha256-9Bj5puG9NUHO53oXBRlB5DvX9jGTmrkDgjV2QPH9qg0=";
+          x86_64-darwin = "sha256-Dw1CqthgvKIlHrcQIoOpYbAG5c6uvq/UgzaO4n25YJY=";
+          aarch64-darwin = "sha256-b/z8Pq8h6n34junSMyxRS3Y/TQ3tu05Bh77xlvMvEtI=";
         };
       };
 
@@ -109,6 +105,10 @@ let
 
       runHook postInstall
     '';
+
+    passthru = {
+      inherit updateScript;
+    };
   });
 in
 if stdenv.hostPlatform.isDarwin then darwin else linux
diff --git a/pkgs/by-name/ko/koreader/package.nix b/pkgs/by-name/ko/koreader/package.nix
index bb1969b3ac19..993331c2784c 100644
--- a/pkgs/by-name/ko/koreader/package.nix
+++ b/pkgs/by-name/ko/koreader/package.nix
@@ -11,6 +11,7 @@
   luajit,
   sdcv,
   SDL2,
+  openssl,
   nix-update-script,
 }:
 let
@@ -18,21 +19,21 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2024.11";
+  version = "2025.04";
 
   src =
     {
       aarch64-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-arm64.deb";
-        hash = "sha256-uy+4+pNyz10xrGM0QF9q0y6UpQK1B9PGNqrcK6nENQY=";
+        hash = "sha256-bpKNP+1C0oHZEv6HGL4dBziv3RfCow882yV8JFLtDJ4=";
       };
       armv7l-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-armhf.deb";
-        hash = "sha256-lTc12qmoe0kGUhrStlGfDRw+cNJnX7F09/jKKc/1U9g=";
+        hash = "sha256-q3M33f0b5FAU/nmPfzsXu93mVZOhXMVgBbfwnieqkeM=";
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-        hash = "sha256-ibehFrOcJqhM+CMAcHDn3Xwy6CueB8kdnoYMMDe/2Js=";
+        hash = "sha256-ZZujk98YVvNJmffW2fDg+n+z1xgtkha7y1LasYEhCR4=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -40,9 +41,9 @@ stdenv.mkDerivation rec {
   src_repo = fetchFromGitHub {
     repo = "koreader";
     owner = "koreader";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-EI8UOQuwhJqcAp8QnLYhI0K+uV/7ZqxdHNk8mPkDWA0=";
+    hash = "sha256-Kt00AZARfQjGY8FzDcQB8UaowWW2+KWyXJzexFNmZmM=";
   };
 
   nativeBuildInputs = [
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
     luajit_lua52
     sdcv
     SDL2
+    openssl
   ];
 
   dontConfigure = true;
@@ -63,18 +65,31 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out
+    dpkg-deb -x $src .
     cp -R usr/* $out/
+
+    # Link required binaries
     ln -sf ${luajit_lua52}/bin/luajit $out/lib/koreader/luajit
     ln -sf ${sdcv}/bin/sdcv $out/lib/koreader/sdcv
     ln -sf ${gnutar}/bin/tar $out/lib/koreader/tar
+
+    # Link SSL/network libraries
+    ln -sf ${openssl.out}/lib/libcrypto.so.3 $out/lib/koreader/libs/libcrypto.so.1.1
+    ln -sf ${openssl.out}/lib/libssl.so.3 $out/lib/koreader/libs/libssl.so.1.1
+
+    # Copy fonts
     find ${src_repo}/resources/fonts -type d -execdir cp -r '{}' $out/lib/koreader/fonts \;
+
+    # Remove broken symlinks
     find $out -xtype l -print -delete
-    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
+
+    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : $out/lib/koreader/libs:${
       lib.makeLibraryPath [
         gtk3-x11
         SDL2
         glib
         stdenv.cc.cc
+        openssl.out
       ]
     }
   '';
diff --git a/pkgs/by-name/li/live555/package.nix b/pkgs/by-name/li/live555/package.nix
index 617b3e3b711a..84ccfaa25b97 100644
--- a/pkgs/by-name/li/live555/package.nix
+++ b/pkgs/by-name/li/live555/package.nix
@@ -1,12 +1,17 @@
 {
-  lib,
+  buildPackages,
   cctools,
   fetchpatch,
   fetchurl,
+  lib,
+  live555,
   openssl,
+  runCommand,
   stdenv,
-  vlc,
 }:
+let
+  isStatic = stdenv.hostPlatform.isStatic;
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "live555";
@@ -42,8 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
     "PREFIX=${placeholder "out"}"
     "C_COMPILER=$(CC)"
     "CPLUSPLUS_COMPILER=$(CXX)"
-    "LIBRARY_LINK=$(AR) cr "
     "LINK=$(CXX) -o "
+    "LIBRARY_LINK=${if isStatic then "$(AR) cr " else "$(CC) -o "}"
   ];
 
   # Since NIX_CFLAGS_COMPILE affects both C and C++ toolchains, we set CXXFLAGS
@@ -83,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     let
       platform =
         if stdenv.hostPlatform.isLinux then
-          "linux"
+          if isStatic then "linux" else "linux-with-shared-libraries"
         else if stdenv.hostPlatform.isDarwin then
           "macosx-catalina"
         else
@@ -97,10 +102,33 @@ stdenv.mkDerivation (finalAttrs: {
       runHook postConfigure
     '';
 
-  passthru.tests = {
-    # Downstream dependency
-    inherit vlc;
-  };
+  doInstallCheck = true;
+  installCheckPhase = ''
+    if ! ($out/bin/openRTSP || :) 2>&1 | grep -q "Usage: "; then
+      echo "Executing example program failed" >&2
+      exit 1
+    else
+      echo "Example program executed successfully"
+    fi
+  '';
+
+  passthru.tests =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    {
+      # The installCheck phase above cannot be ran in cross-compilation scenarios,
+      # therefore the passthru test
+      run-test-prog = runCommand "live555-run-test-prog" { } ''
+        if ! (${emulator} ${live555}/bin/openRTSP || :) 2>&1 | grep -q "Usage: "; then
+          echo "Executing example program failed" >&2
+          exit 1
+        else
+          echo "Example program executed successfully"
+          touch $out
+        fi
+      '';
+    };
 
   meta = {
     homepage = "http://www.live555.com/liveMedia/";
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index ee9c8d85f47e..8715e8383b3e 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "5141";
+  version = "5186";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-qHjHsc2v4LB+GVYni97d3KVo5uJqpF7RQqG2rWXwpHY=";
+    hash = "sha256-f07FvHgRobUbei06kcKHJ1ulLCYARAvo64oWsDBwHO0=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index e50876658ad2..06e6a6f40b87 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.21";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M=";
+    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM=";
+  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix
index bf9c911ae031..d4d5da794911 100644
--- a/pkgs/by-name/lo/lockbook/package.nix
+++ b/pkgs/by-name/lo/lockbook/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "0.9.21";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M=";
+    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM=";
+  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [
diff --git a/pkgs/by-name/lx/lx-music-desktop/electron-builder.patch b/pkgs/by-name/lx/lx-music-desktop/electron-builder.patch
new file mode 100644
index 000000000000..fcb90f89cd2b
--- /dev/null
+++ b/pkgs/by-name/lx/lx-music-desktop/electron-builder.patch
@@ -0,0 +1,23 @@
+diff --git a/build-config/build-pack.js b/build-config/build-pack.js
+index 569252c..ccaef34 100644
+--- a/build-config/build-pack.js
++++ b/build-config/build-pack.js
+@@ -1,7 +1,5 @@
+ /* eslint-disable no-template-curly-in-string */
+-
+ const builder = require('electron-builder')
+-const beforePack = require('./build-before-pack')
+ const afterPack = require('./build-after-pack')
+ 
+ /**
+@@ -11,8 +9,9 @@ const afterPack = require('./build-after-pack')
+ const options = {
+   appId: 'cn.toside.music.desktop',
+   productName: 'lx-music-desktop',
+-  beforePack,
+   afterPack,
++  electronVersion: "@electron_version@",
++  electronDist: "./electron-dist",
+   protocols: {
+     name: 'lx-music-protocol',
+     schemes: [
diff --git a/pkgs/by-name/lx/lx-music-desktop/package.nix b/pkgs/by-name/lx/lx-music-desktop/package.nix
index 138564e76548..8979de91851d 100644
--- a/pkgs/by-name/lx/lx-music-desktop/package.nix
+++ b/pkgs/by-name/lx/lx-music-desktop/package.nix
@@ -1,93 +1,98 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  buildNpmPackage,
+
+  fetchFromGitHub,
+  replaceVars,
+
   makeWrapper,
 
-  dpkg,
-  libGL,
-  systemd,
-  electron_32,
-
+  electron_34,
   commandLineArgs ? "",
 }:
 
 let
+  # if we want to use later electron, we'll need to bump the `node-abi` npm package version
+  electron = electron_34;
+in
+buildNpmPackage rec {
   pname = "lx-music-desktop";
   version = "2.10.0";
 
-  buildUrl =
-    version: arch:
-    "https://github.com/lyswhut/lx-music-desktop/releases/download/v${version}/lx-music-desktop_${version}_${arch}.deb";
-
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = buildUrl version "amd64";
-      hash = "sha256-btNB8XFCJij1wUVZoWaa55vZn5n1gsKSMnEbQPTd9lg=";
-    };
-
-    aarch64-linux = fetchurl {
-      url = buildUrl version "arm64";
-      hash = "sha256-GVTzxTV7bM4AWZ+Xfb70fyedDMIa9eX/YwnGkm3WOsk=";
-    };
-
-    armv7l-linux = fetchurl {
-      url = buildUrl version "armv7l";
-      hash = "sha256-3zttIk+A4BpG0W196LzgTJ5WeqWvLjqPFz6e9RCGlJo=";
-    };
+  src = fetchFromGitHub {
+    owner = "lyswhut";
+    repo = "lx-music-desktop";
+    tag = "v${version}";
+    hash = "sha256-8IzQEGdaeoBbCsZSPhVowipeBr4YHGm/G28qGHtCY/s=";
   };
 
-  host = stdenv.hostPlatform.system;
-  src = srcs.${host} or (throw "Unsupported system: ${host}");
-
-  runtimeLibs = lib.makeLibraryPath [
-    libGL
-    stdenv.cc.cc
+  patches = [
+    # set electron version and dist dir
+    # disable before-pack: it would copy prebuilt libraries
+    (replaceVars ./electron-builder.patch {
+      electron_version = electron.version;
+    })
   ];
-in
-stdenv.mkDerivation {
-  inherit pname version src;
 
   nativeBuildInputs = [
-    dpkg
     makeWrapper
   ];
 
-  runtimeDependencies = map lib.getLib [
-    systemd
-  ];
+  npmDepsHash = "sha256-awD8gu1AnhUn5uT/dITXjMVWNAwABAmcEVZOKukbWrI=";
+
+  makeCacheWritable = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  # we haven't set up npm_config_nodedir at this point
+  # and electron-rebuild will rebuild the native libs later anyway
+  npmFlags = [ "--ignore-scripts" ];
+
+  preBuild = ''
+    # delete prebuilt libs
+    rm -r build-config/lib
+
+    # don't spam the build logs
+    substituteInPlace build-config/pack.js \
+      --replace-fail 'new Spinnies({' 'new Spinnies({disableSpins:true,'
+
+    # this directory is configured to be used in the patch
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    export npm_config_nodedir=${electron.headers}
+    export npm_config_build_from_source="true"
+
+    npm rebuild --no-progress --verbose
+  '';
+
+  npmBuildScript = "pack:dir";
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/opt/lx-music-desktop
-    cp -r opt/lx-music-desktop/{resources,locales} $out/opt/lx-music-desktop
-    cp -r usr/share $out/share
-
-    substituteInPlace $out/share/applications/lx-music-desktop.desktop \
-        --replace-fail "/opt/lx-music-desktop/lx-music-desktop" "$out/bin/lx-music-desktop" \
+    mkdir -p "$out/opt/lx-music-desktop"
+    cp -r build/*-unpacked/{locales,resources{,.pak}} "$out/opt/lx-music-desktop"
+    rm "$out/opt/lx-music-desktop/resources/app-update.yml"
 
     runHook postInstall
   '';
 
   postFixup = ''
-    makeWrapper ${electron_32}/bin/electron $out/bin/lx-music-desktop \
+    makeWrapper ${lib.getExe electron} $out/bin/lx-music-desktop \
         --add-flags $out/opt/lx-music-desktop/resources/app.asar \
-        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-        --add-flags ${lib.escapeShellArg commandLineArgs} \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
   '';
 
   meta = with lib; {
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Music software based on Electron and Vue";
     homepage = "https://github.com/lyswhut/lx-music-desktop";
     changelog = "https://github.com/lyswhut/lx-music-desktop/releases/tag/v${version}";
     license = licenses.asl20;
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "armv7l-linux"
-    ];
+    platforms = electron.meta.platforms;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     mainProgram = "lx-music-desktop";
     maintainers = with maintainers; [ oosquare ];
diff --git a/pkgs/by-name/ly/LycheeSlicer/package.nix b/pkgs/by-name/ly/LycheeSlicer/package.nix
index 044d22cff5df..91012f6450a2 100644
--- a/pkgs/by-name/ly/LycheeSlicer/package.nix
+++ b/pkgs/by-name/ly/LycheeSlicer/package.nix
@@ -7,11 +7,11 @@
 }:
 let
   pname = "LycheeSlicer";
-  version = "7.3.1";
+  version = "7.3.2";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-21ySVT2Un/WAWxvEAH5GfrumGbsSaeNVjaMsL9mYwsg=";
+    hash = "sha256-CmN4Q4gTGYeICIoLz0UuVlSyOstXW/yYVb4s1dT5EOc=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/ma/mapcache/package.nix b/pkgs/by-name/ma/mapcache/package.nix
index 5d38ce3f0362..f0a4f3aab53a 100644
--- a/pkgs/by-name/ma/mapcache/package.nix
+++ b/pkgs/by-name/ma/mapcache/package.nix
@@ -12,6 +12,7 @@
   fcgi,
   gdal,
   geos,
+  gfortran,
   libgeotiff,
   libjpeg,
   libpng,
@@ -23,21 +24,26 @@
   zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mapcache";
   version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "mapcache";
-    rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    tag = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
     hash = "sha256-AwdZdOEq9SZ5VzuBllg4U1gdVxZ9IVdqiDrn3QuRdCk=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # work around for `ld: file not found: @rpath/libquadmath.0.dylib`
+      gfortran.cc
+    ];
 
   buildInputs = [
     apacheHttpd
@@ -70,6 +76,12 @@ stdenv.mkDerivation rec {
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-std=c99";
 
+  prePatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "include_directories(\''${TIFF_INCLUDE_DIR})" "" \
+      --replace-fail "target_link_libraries(mapcache \''${TIFF_LIBRARY})" "target_link_libraries(mapcache TIFF::TIFF)"
+  '';
+
   meta = {
     description = "Server that implements tile caching to speed up access to WMS layers";
     homepage = "https://mapserver.org/mapcache/";
@@ -78,4 +90,4 @@ stdenv.mkDerivation rec {
     maintainers = lib.teams.geospatial.members;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 42ae07ad0b6c..17814c92d431 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -11,8 +11,8 @@ mattermost.override {
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.7.0";
-    srcHash = "sha256-T8lLF5AsJYALVijXOUxkSACa6h8W4HcqoML2+BPsEsY=";
+    version = "10.7.1";
+    srcHash = "sha256-pUVy/l6C3ygwX2JMQmHEpiHwYEUBl1/k37gq2fLM0Os=";
     vendorHash = "sha256-B2vfHszOVKbkN7h0tQGeGzLdeuxQDgaFv9QWkQgGCWs=";
     npmDepsHash = "sha256-ZMgsfdmGtU3PgdmiY0xMCHh8dAOAmEFNbKcxXKO7CJc=";
     lockfileOverlay = ''
diff --git a/pkgs/by-name/mi/miniflux/package.nix b/pkgs/by-name/mi/miniflux/package.nix
index 59762d4ed2bc..75397b7ecc80 100644
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = version;
-    hash = "sha256-1W+sFXvM5qOYxpbRBkZIvombchv2oYkcFuq7/ETGjfs=";
+    hash = "sha256-AQ6HVRVlWt1D8fA4Z2FH7VIEKydDva7txwa/9Rfq0Ho=";
   };
 
-  vendorHash = "sha256-bulQrLtA61RMZVhTtupTJUUTWJGWXcmpGaNUAoXEfYE=";
+  vendorHash = "sha256-9I0/dyjanuV8oZystox9RY/gGx1SZuFRTghArv5aJ64=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
new file mode 100644
index 000000000000..24cb51325a2a
--- /dev/null
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -0,0 +1,140 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  stdenvNoCC,
+  writableTmpDirAsHomeHook,
+  buf,
+  protoc-gen-go,
+  protoc-gen-go-grpc,
+  grpc-gateway,
+  buildNpmPackage,
+  installShellFiles,
+  versionCheckHook,
+  nixosTests,
+}:
+
+buildGoModule (
+  finalAttrs:
+
+  let
+    gen = stdenvNoCC.mkDerivation {
+      pname = "olivetin-gen";
+      inherit (finalAttrs) version src;
+
+      nativeBuildInputs = [
+        writableTmpDirAsHomeHook
+        buf
+        protoc-gen-go
+        protoc-gen-go-grpc
+        grpc-gateway
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pushd proto
+        buf generate
+        popd
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cp -r service/gen $out
+
+        runHook postInstall
+      '';
+
+      outputHashMode = "recursive";
+      outputHash = "sha256-KygZ7NqkfhczYy1YMR824Om4NTq06+KHa/jvmsCty3s=";
+    };
+
+    webui = buildNpmPackage {
+      pname = "olivetin-webui";
+      inherit (finalAttrs) version src;
+
+      npmDepsHash = "sha256-VxIPjpsbxEPP15cu5Wvz0qeDGXTMb2tojdry8YaHMVI=";
+
+      sourceRoot = "${finalAttrs.src.name}/webui.dev";
+
+      buildPhase = ''
+        runHook preBuild
+
+        npx parcel build --public-url "."
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cp -r dist $out
+        cp -r *.png $out
+
+        runHook postInstall
+      '';
+    };
+  in
+
+  {
+    pname = "olivetin";
+    version = "2025.4.22";
+
+    src = fetchFromGitHub {
+      owner = "OliveTin";
+      repo = "OliveTin";
+      tag = finalAttrs.version;
+      hash = "sha256-dgoYGtBsyaCTgxCT/y7rU5B9pEvIU/yiLU2/pPm/vJU=";
+    };
+
+    modRoot = "service";
+
+    vendorHash = "sha256-yUW4BrC7Oqs+mvvZGp6oxdGQ9fxP5gQNacq6Pz5ZHAQ=";
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X main.version=${finalAttrs.version}"
+    ];
+
+    __darwinAllowLocalNetworking = true;
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    preBuild = ''
+      ln -s ${gen} gen
+      substituteInPlace internal/config/config.go \
+        --replace-fail 'config.WebUIDir = "./webui"' 'config.WebUIDir = "${webui}"'
+      substituteInPlace internal/httpservers/webuiServer_test.go \
+        --replace-fail '"../webui/"' '"${webui}"'
+    '';
+
+    postInstall = ''
+      installManPage ../var/manpage/OliveTin.1.gz
+    '';
+
+    nativeInstallCheckInputs = [ versionCheckHook ];
+    versionCheckProgram = "${placeholder "out"}/bin/OliveTin";
+    versionCheckProgramArg = "-version";
+    doInstallCheck = true;
+
+    passthru = {
+      inherit gen webui;
+      tests = { inherit (nixosTests) olivetin; };
+      updateScript = ./update.sh;
+    };
+
+    meta = {
+      description = "Gives safe and simple access to predefined shell commands from a web interface";
+      homepage = "https://www.olivetin.app/";
+      downloadPage = "https://github.com/OliveTin/OliveTin";
+      changelog = "https://github.com/OliveTin/OliveTin/releases/tag/${finalAttrs.version}";
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [ defelo ];
+      mainProgram = "OliveTin";
+    };
+  }
+)
diff --git a/pkgs/by-name/ol/olivetin/update.sh b/pkgs/by-name/ol/olivetin/update.sh
new file mode 100755
index 000000000000..88436b64bb58
--- /dev/null
+++ b/pkgs/by-name/ol/olivetin/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update common-updater-scripts
+
+set -euo pipefail
+
+nix-update olivetin --src-only
+update-source-version olivetin --source-key=gen --ignore-same-version
+update-source-version olivetin --source-key=webui.npmDeps --ignore-same-version
+update-source-version olivetin --source-key=goModules --ignore-same-version
diff --git a/pkgs/by-name/op/openimageio/2.nix b/pkgs/by-name/op/openimageio/2.nix
new file mode 100644
index 000000000000..d31dd2190a51
--- /dev/null
+++ b/pkgs/by-name/op/openimageio/2.nix
@@ -0,0 +1,15 @@
+{ fetchFromGitHub, openimageio }:
+
+let
+  version = "2.5.17.0";
+in
+openimageio.overrideAttrs {
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "OpenImageIO";
+    tag = "v${version}";
+    hash = "sha256-d5LqRcqWj6E9jJYY/Pa5e7/MeuQGMjUo/hMCYRKsKeU=";
+  };
+}
diff --git a/pkgs/development/libraries/openimageio/default.nix b/pkgs/by-name/op/openimageio/package.nix
similarity index 71%
rename from pkgs/development/libraries/openimageio/default.nix
rename to pkgs/by-name/op/openimageio/package.nix
index adb25d2ab3ae..00965236dc63 100644
--- a/pkgs/development/libraries/openimageio/default.nix
+++ b/pkgs/by-name/op/openimageio/package.nix
@@ -15,23 +15,17 @@
   fmt,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "2.5.16.0";
+  version = "3.0.5.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
-    rev = "v${version}";
-    hash = "sha256-hUCwlzQW5mJH5HYPbLWOcupc36nxM12CV0sakZhiGzo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CG2tb6jf7xmQnrLaTqEFKG3g4nkEwZoI44bXxdCRmrM=";
   };
 
-  # Workaround broken zlib version detection in CMake < 3.37.
-  postPatch = ''
-    substituteInPlace ./src/cmake/Config.cmake.in \
-      --replace " @ZLIB_VERSION@" ""
-  '';
-
   outputs = [
     "bin"
     "out"
@@ -73,11 +67,11 @@ stdenv.mkDerivation rec {
       --replace "\''${_IMPORT_PREFIX}/lib/lib" "$out/lib/lib"
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://openimageio.org";
     description = "Library and tools for reading and writing images";
-    license = licenses.bsd3;
-    maintainers = [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ yzx9 ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/op/ophcrack/package.nix b/pkgs/by-name/op/ophcrack/package.nix
index bee8b7dd76f6..3379e9818f60 100644
--- a/pkgs/by-name/op/ophcrack/package.nix
+++ b/pkgs/by-name/op/ophcrack/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   version = "3.8.0";
 
   src = fetchurl {
-    url = "mirror://ophcrack/ophcrack/${version}/ophcrack-${version}.tar.bz2";
+    url = "mirror://sourceforge/ophcrack/${version}/ophcrack-${version}.tar.bz2";
     hash = "sha256-BIpt9XmDo6WjGsfE7BLfFqpJ5lKilnbZPU75WdUK7uA=";
   };
 
diff --git a/pkgs/by-name/os/osu-lazer-bin/package.nix b/pkgs/by-name/os/osu-lazer-bin/package.nix
index 64cadde4d1e0..ff542b27c083 100644
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.420.0";
+  version = "2025.424.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-rFPh1mziEcbqBhxRAoV2qHKNQeWjWIrprx6tXnLoGLs=";
+        hash = "sha256-fgG3SnltGxOYHwos8BTngaW4YrRdpOdURxd73sz0t7o=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-PlyJkN9ALSE8s2gPVkMXoZd+1FKqqFxIFPLkJkXwk0k=";
+        hash = "sha256-0K+uAH4f8JOfzG4J37aGaStpEkH5tdUfHEqsogMtN2I=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-yrVFep119E2PkRsyB0UPhZnjR7jXuhd9CktIgL98om4=";
+        hash = "sha256-8nOoSkNbzEFpDj0FivCYI20tZzT02YHcKZblfEfh+Zo=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/os/osu-lazer/package.nix b/pkgs/by-name/os/osu-lazer/package.nix
index e4ca7f559171..f24e49e6ca3e 100644
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@@ -22,13 +22,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.420.0";
+  version = "2025.424.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-yDWU4mQYR6a9eKTEEsxZ2UASvMuQzWi+HZbDmanhalA=";
+    hash = "sha256-+r7YeaNrUkoYoMzGqhqT+bqdO1UohvJRlAcAskF7vn4=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index f5cafcae0af3..0cf6e9f50a27 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pocket-id";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ax5E3e3GUrQLVsQREUhjmORjXQgKrEBVa9ySJr5ZLUY=";
+    hash = "sha256-fyyeYArjhsS/R9VsZsRM3oO5fz8EUqjNIuvFJpGZbds=";
   };
 
   backend = buildGoModule {
diff --git a/pkgs/by-name/qq/qq/sources.nix b/pkgs/by-name/qq/qq/sources.nix
index 88a12e54e587..c07157d208c5 100644
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-04-06
+# Last updated: 2025-04-25
 {
-  version = "3.2.16-2025.4.1";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.16_250401_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.16_250401_arm64_01.deb";
-  arm64_hash = "sha256-av1Pu5ZXASc0Jmm0c7xxtmECIHAYWOo1NQOdI3fDmZA=";
-  amd64_hash = "sha256-f+7bo4zVSywnAE1WJPUjVLyFJQYlz56QVEah2uDSzP8=";
+  version = "3.2.17-2025.4.23";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250423_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250423_arm64_01.deb";
+  arm64_hash = "sha256-BJ6WNswd9foQRD+SrJm854OiSVxREHJIv+VFe1NGnKE=";
+  amd64_hash = "sha256-l65Gci0wRcGuL7xqwnCng8hWdlbNC6pEaE8NaZpftM0=";
 }
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 38baf0ed9b65..432694ae5081 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.21.1";
+  version = "3.21.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5RQsGznVMVR24v0hxIWKV+Hs6SR0g0tsY7tpgFp8sps=";
+    hash = "sha256-ksI55x1rmpIRfNNgajmAvprKU3OwL4EW8QpNV2eyPTc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 2dc6e54c8bf0..1f99ae9cae86 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -28,20 +28,19 @@
   # More information can be found in there README:
   # https://raw.githubusercontent.com/rerun-io/rerun/5a9794990c4903c088ad77174e65eb2573162d97/crates/utils/re_analytics/README.md
   buildWebViewerFeatures ? [
-    "grpc"
     "map_view"
   ],
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "rerun-io";
     repo = "rerun";
-    tag = version;
-    hash = "sha256-J9Iy/KiDajDavL95qLcQBfUWpZ6OiUtldk+ZAGpSNWA=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZMvX/9kz+tEiQ01GO7B+/wdxxkFkuExR9jA2KROIbgw=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -51,7 +50,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cGg8yi/jYKyle8dudHSNLPMnOtcgqlBQmu83h4B26NI=";
+  cargoHash = "sha256-2BMBfEunRRMX4++w0Fg9wTAeEmODtOTcruXCO9JKreo=";
 
   cargoBuildFlags = [ "--package rerun-cli" ];
   cargoTestFlags = [ "--package rerun-cli" ];
@@ -153,7 +152,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Visualize streams of multimodal data. Fast, easy to use, and simple to integrate.  Built in Rust using egui";
     homepage = "https://github.com/rerun-io/rerun";
-    changelog = "https://github.com/rerun-io/rerun/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/rerun-io/rerun/blob/${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
@@ -164,4 +163,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "rerun";
   };
-}
+})
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index de384b3ad805..90614ca17229 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Yi8eRA2xL+wumXXrq5c4NNtPORZ3BjEM5IowDEfsjwA=";
+    hash = "sha256-DXu9/DRwcffZtsql/Qk+6GyzhiYXUyW6R9FCAvLhn6o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rJNA6Lh3OnY60BZ8YnjP+7cSGftbCb69ISQyr7z523Q=";
+  cargoHash = "sha256-4TK7HEdSCvUGqsAH+dnPgMBYmT/0mOnvQXHr/PtcsT0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ru/rundeck-cli/package.nix b/pkgs/by-name/ru/rundeck-cli/package.nix
new file mode 100644
index 000000000000..2bfb535e08a9
--- /dev/null
+++ b/pkgs/by-name/ru/rundeck-cli/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  jdk11,
+  unzip,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rundeck-cli";
+  version = "2.0.8";
+
+  src = fetchurl {
+    url = "https://github.com/rundeck/rundeck-cli/releases/download/v${finalAttrs.version}/rundeck-cli-${finalAttrs.version}-all.jar";
+    hash = "sha256-mpy4oS7zCUdt4Q+KQPrGGbw6Gzmh1Msygl+NXDmFhDw=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk11 ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/rundeck-cli
+    cp $src $out/share/rundeck-cli/rundeck-cli.jar
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe jdk11} $out/bin/rd \
+      --add-flags "-jar $out/share/rundeck-cli/rundeck-cli.jar"
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/rd";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "The official CLI tool for Rundeck";
+    longDescription = ''
+      The rd command provides command line access to the Rundeck HTTP API,
+      allowing you to access and control your Rundeck server from the
+      command line or shell scripts.
+    '';
+    homepage = "https://github.com/rundeck/rundeck-cli";
+    changelog = "https://github.com/rundeck/rundeck-cli/blob/v${finalAttrs.version}/docs/changes.md";
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "rd";
+  };
+})
diff --git a/pkgs/by-name/ru/rundeck/package.nix b/pkgs/by-name/ru/rundeck/package.nix
index f02bbb3e3e26..914495c525b6 100644
--- a/pkgs/by-name/ru/rundeck/package.nix
+++ b/pkgs/by-name/ru/rundeck/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rundeck";
-  version = "5.10.0-20250312";
+  version = "5.11.1-20250415";
 
   src = fetchurl {
     url = "https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-${finalAttrs.version}.war/artifacts/rundeck-${finalAttrs.version}.war/download?distro_version_id=167";
-    hash = "sha256-BwO7FM1LP0OrjG7opz4qqDuJQdtBmmFtZTtigV99ssE=";
+    hash = "sha256-WOxY2GGtll+2xkSbJUKOvgsr408nIvRcEuBULcawijc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.liberodark ];
+    maintainers = with lib.maintainers; [ liberodark ];
     mainProgram = "rundeck";
   };
 })
diff --git a/pkgs/by-name/sd/SDL2_classic_image/package.nix b/pkgs/by-name/sd/SDL2_classic_image/package.nix
new file mode 100644
index 000000000000..6a6f58fc573a
--- /dev/null
+++ b/pkgs/by-name/sd/SDL2_classic_image/package.nix
@@ -0,0 +1,13 @@
+{
+  SDL2_image,
+  SDL2_classic,
+  enableSTB ? true,
+}:
+
+(SDL2_image.override {
+  SDL2 = SDL2_classic;
+  inherit enableSTB;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_image";
+  }
diff --git a/pkgs/by-name/sd/SDL2_classic_mixer/package.nix b/pkgs/by-name/sd/SDL2_classic_mixer/package.nix
new file mode 100644
index 000000000000..4aaf22b7cd6e
--- /dev/null
+++ b/pkgs/by-name/sd/SDL2_classic_mixer/package.nix
@@ -0,0 +1,11 @@
+{
+  SDL2_mixer,
+  SDL2_classic,
+}:
+
+(SDL2_mixer.override {
+  SDL2 = SDL2_classic;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_mixer";
+  }
diff --git a/pkgs/by-name/sd/SDL2_classic_mixer_2_0/package.nix b/pkgs/by-name/sd/SDL2_classic_mixer_2_0/package.nix
new file mode 100644
index 000000000000..ba06648eebf6
--- /dev/null
+++ b/pkgs/by-name/sd/SDL2_classic_mixer_2_0/package.nix
@@ -0,0 +1,8 @@
+{
+  SDL2_mixer_2_0,
+  SDL2_classic_mixer,
+}:
+
+SDL2_mixer_2_0.override {
+  SDL2_mixer = SDL2_classic_mixer;
+}
diff --git a/pkgs/by-name/sd/SDL2_classic_ttf/package.nix b/pkgs/by-name/sd/SDL2_classic_ttf/package.nix
new file mode 100644
index 000000000000..9190cfc7953e
--- /dev/null
+++ b/pkgs/by-name/sd/SDL2_classic_ttf/package.nix
@@ -0,0 +1,11 @@
+{
+  SDL2_ttf,
+  SDL2_classic,
+}:
+
+(SDL2_ttf.override {
+  SDL2 = SDL2_classic;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_ttf";
+  }
diff --git a/pkgs/by-name/sd/SDL2_image/package.nix b/pkgs/by-name/sd/SDL2_image/package.nix
index 86a463897705..f5d8a4522c49 100644
--- a/pkgs/by-name/sd/SDL2_image/package.nix
+++ b/pkgs/by-name/sd/SDL2_image/package.nix
@@ -3,8 +3,6 @@
   SDL2,
   autoreconfHook,
   fetchurl,
-  giflib,
-  libXpm,
   libjpeg,
   libpng,
   libtiff,
diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
index 046a290cdf1e..1a6647bc8954 100644
--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop-bin";
-  version = "7.47.0";
+  version = "7.51.0";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-PP8D6D/DJiONJp0UNUSoy8zDwWGVWRRMsqfPTWQCgs8=";
+    hash = "sha256-dUcBvKbGVsEUxOSv8u/jjuvYjHar2+zbv+/ZRS85w1w=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index bd3656ced768..ef9e9a592c17 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "25.2.2";
+  version = "25.4.2";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-9EWbYju0e3DdS8bnuMiD4Cdodz/LxbLyCItNEWSIi/UADxtH7smAbpAu4Awcgbb3o39x94Mf8rbqcxmIktDDhQ==";
-        x86_64-linux = "sha512-j8TI46Jr/Tc99Ri3aFY0z73HFY5AWpeAv/yJy8xsV8rNGWEwKlCvJzkrEUpvpFUBMoHgGw3PTQ7CYUQ5bmB/CA==";
+        aarch64-linux = "sha512-BqZjccLs1eHcHmmzyWa3L37KjKjHJFxEhk+BtAD52Z9Mg8wq2Qpz0+z5JrCOXdqLf+j5jfmAQae2HpQhQrqV3g==";
+        x86_64-linux = "sha512-P4+FQd5Uis1rCzCOCpNNAbGS70t/u7FYHkz2+ylF+yBHauARsyvLm1IbUKZyqCsruae0O8n2wIuIltpLImNtqA==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index 631262f158e8..b7e25d2e6b44 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-crpEJdhO27cVXl4YnPmUwvJFAeezcxdS/vJPJ2m1VU8=";
+    hash = "sha256-qwTFD9lIHY5sBliB5ri5AOvW5Cr/nvM+u7e7JS0CAKQ=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index c40d3dcda16d..b3c8ae469dc7 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.35.3";
+  version = "2.35.4";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ebbc8pKZ8QkxGq9MttpulBkQLXcjH25Zoq8owxIamKg=";
+    hash = "sha256-bp0KtTsKSBfCLwKfHseLKnGh9ub09+FC841y0I+KNtw=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-Bgi8Pd7lON0DTSzHKaHHbqdS9S/i01tJV/x5bgmiWCo=";
+  vendorHash = "sha256-vWjFdwcVbw8lxJl2mR54O8DpiwbGzyCy50Heu7NFLA8=";
 
   subPackages = [ "cmd/werf" ];
 
@@ -39,7 +39,7 @@ buildGoModule (finalAttrs: {
     [
       "-s"
       "-w"
-      "-X github.com/werf/werf/v2/pkg/werf.Version=${finalAttrs.src.rev}"
+      "-X github.com/werf/werf/v2/pkg/werf.Version=v${finalAttrs.version}"
     ]
     ++ lib.optionals (finalAttrs.env.CGO_ENABLED == 1) [
       "-extldflags=-static"
@@ -103,7 +103,7 @@ buildGoModule (finalAttrs: {
       Buildah.
     '';
     homepage = "https://werf.io";
-    changelog = "https://github.com/werf/werf/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/werf/werf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.azahi ];
     mainProgram = "werf";
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index ad5d3b4dfca3..d304b767327f 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
   libcosmicAppHook,
   pkg-config,
   util-linux,
@@ -18,22 +17,22 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ymBmnSEXGCNbLTIVzHP3tjKAG0bgvEFU1C8gnxiow98=";
+    hash = "sha256-7yfrjKHuYOWPMMkHdGZ+g0hynh2TtSf4h8zW13tTus4=";
   };
 
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-20";
-    VERGEN_GIT_SHA = finalAttrs.src.rev;
+    VERGEN_GIT_COMMIT_DATE = "2025-04-08";
+    VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FO/GIzv9XVu8SSV+JbOf98UX/XriRgqTthtzvRIWNjo=";
+  cargoHash = "sha256-fOaLeWtrjgBDSShC5OmBZKODNQn4bp/+iPZX5ZMQFqk=";
 
   separateDebugInfo = true;
 
@@ -51,15 +50,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   checkInputs = [ gst_all_1.gstreamer ];
 
-  # TODO: Remove this when updating to the next version
-  patches = [
-    (fetchpatch {
-      name = "cosmic-portal-fix-examples-after-ashpd-api-update.patch";
-      url = "https://github.com/pop-os/xdg-desktop-portal-cosmic/commit/df831ce7a48728aa9094fa1f30aed61cf1cc6ac3.diff?full_index=1";
-      hash = "sha256-yRrB3ds9TtN1OBZEZbnE6h2fkPyP4PP2IJ17n+0ugEo=";
-    })
-  ];
-
   postPatch = ''
     # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present
     # in the `pop-wallpapers` package, we're using the Orion Nebula image
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/fetch-yarn-berry-deps.nix b/pkgs/by-name/ya/yarn-berry/fetcher/fetch-yarn-berry-deps.nix
index 3fef9b87644a..f54ba6291c82 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/fetch-yarn-berry-deps.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/fetch-yarn-berry-deps.nix
@@ -58,6 +58,8 @@ stdenv.mkDerivation (
 
     outputHashMode = "recursive";
 
+    dontFixup = true; # fixup phase does the patching of the shebangs, and FODs must never contain nix store paths.
+
     passthru = {
       inherit berryVersion;
     };
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
index 75e0b9240c46..aced36b9b700 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
@@ -13,18 +13,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yarn-berry-${toString berryVersion}-fetcher";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitLab {
     domain = "cyberchaos.dev";
     owner = "yuka";
     repo = "yarn-berry-fetcher";
-    tag = "1.0.0";
-    hash = "sha256-iMU/SadzrNv8pZSgp2fBwWVgrgZsnyPRsvs0ugvwyks=";
+    tag = "1.0.1";
+    hash = "sha256-v92+aeGmT151TvcW7FvuooF3g+opdZw7QHY+CcLweJE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ETFaCu+6Ar7tEeRCbTbesEqx9BdztSvPXB7Dc5KGIx0=";
+  cargoHash = "sha256-TR9FT95WAaiRvoYBXeT0U6agF94BAdMswNncYysESKo=";
 
   env.YARN_ZIP_SUPPORTED_CACHE_VERSION = berryCacheVersion;
   env.LIBZIP_SYS_USE_PKG_CONFIG = 1;
diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 9b9d0e34ca8c..b5dc05ec9e45 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   copyDesktopItems,
   makeWrapper,
-  ffmpeg,
+  ffmpeg-headless,
   yt-dlp,
   makeDesktopItem,
   electron,
@@ -28,7 +28,7 @@ buildNpmPackage rec {
     makeWrapper
   ];
   buildInputs = [
-    ffmpeg
+    ffmpeg-headless
     yt-dlp
   ];
 
@@ -56,7 +56,7 @@ buildNpmPackage rec {
   # Also stop it from downloading ytdlp
   postPatch = ''
     substituteInPlace src/renderer.js \
-      --replace-fail $\{__dirname}/../ffmpeg '${lib.getExe ffmpeg}' \
+      --replace-fail $\{__dirname}/../ffmpeg '${lib.getExe ffmpeg-headless}' \
       --replace-fail 'path.join(os.homedir(), ".ytDownloader", "ytdlp")' '`${lib.getExe yt-dlp}`' \
       --replace-fail '!!localStorage.getItem("fullYtdlpBinPresent")' 'true'
     # Disable auto-updates
@@ -66,7 +66,8 @@ buildNpmPackage rec {
 
   postInstall = ''
     makeWrapper ${electron}/bin/electron $out/bin/ytdownloader \
-        --add-flags $out/lib/node_modules/ytdownloader/main.js
+        --add-flags $out/lib/node_modules/ytdownloader/main.js \
+        --prefix PATH : ${lib.makeBinPath [ ffmpeg-headless ]}
 
     install -Dm444 assets/images/icon.png $out/share/pixmaps/ytdownloader.png
   '';
diff --git a/pkgs/by-name/zs/zsh-wd/package.nix b/pkgs/by-name/zs/zsh-wd/package.nix
index 4ec34b4e7aa8..07569ac9ce9f 100644
--- a/pkgs/by-name/zs/zsh-wd/package.nix
+++ b/pkgs/by-name/zs/zsh-wd/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "wd";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "mfaerevaag";
     repo = "wd";
     rev = "v${version}";
-    hash = "sha256-u1VrsSF+JqsvWOZfj5mSOknLra6Bxl9tR7fybyP476Y=";
+    hash = "sha256-/xOe7XFzQt+qVGf6kfsOPPM8szWYhnmx5Mq/QIw0y1c=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/data/fonts/nerd-fonts/manifests/checksums.json b/pkgs/data/fonts/nerd-fonts/manifests/checksums.json
index 0cb041a7e586..9f56ba534988 100644
--- a/pkgs/data/fonts/nerd-fonts/manifests/checksums.json
+++ b/pkgs/data/fonts/nerd-fonts/manifests/checksums.json
@@ -1,70 +1,72 @@
 {
-  "0xProto.tar.xz": "d72bdd83f02a9071d4bb0acd38a37fe687a47bd29189e838edf847ed39b87e10",
-  "3270.tar.xz": "304010729a11da9bea9f2f1e35e84f4f2240cd8b0ec2a315ef3c1af0ba3af185",
-  "Agave.tar.xz": "2f7939592934ac02ed74e90556a7e13e95ca621b6e44df31db729ae6930f9cb4",
-  "AnonymousPro.tar.xz": "85798dd957cb18837c387ca7fd43044a62830a58860d24e7bd315fc10b5b94f6",
-  "Arimo.tar.xz": "4abbf467968a0f31bb3ad8da7ecd15117cdc8265a67a793e5b9ded6437654ce7",
-  "AurulentSansMono.tar.xz": "b1898e9bbfa1cbea8fd514b151ff4bb572d2562234e942408a9ef90dfb14075f",
-  "BigBlueTerminal.tar.xz": "44bf48101c6c31f6777a42430021681cf54c2f0699f1357a33c73c8788c5aa35",
-  "BitstreamVeraSansMono.tar.xz": "0e5c4ed24358be59a8f7268f3b7352d92f5f19894cdbc62e3c0d91af16250d95",
-  "CascadiaCode.tar.xz": "86ac1e16199fe9c3448a7882e4f3e90c11c27396fd4771c552661648e3d18f96",
-  "CascadiaMono.tar.xz": "29e494f00c6ec0bbbeba031cb69f30ebbe4cf46945d341e0347aab7073049bf0",
-  "CodeNewRoman.tar.xz": "b032b5521c070076148f986d861708ed142fe19f2014a9f248ca4d0a43e9cc8e",
-  "ComicShannsMono.tar.xz": "cb3667e107e265010566d05e544170b57eec3808f33b0c1790b3b1bd069690aa",
-  "CommitMono.tar.xz": "aa7f15a591374a04379223a0c224cd66a7c98938e52cda306311681cc51a1c22",
-  "Cousine.tar.xz": "c7ee3224ff34c69fadfe947d5a9bf349952206cf8e0708564f7cf3d49095d4d8",
-  "D2Coding.tar.xz": "cad0abe4898b6d9aa12d28c4383ea7260eadba951b6ed9d347a524efc234dd1b",
-  "DaddyTimeMono.tar.xz": "8a4b6f1fda69bad7dbf102059416998caa5a870fb413c49e88d64ac2912a93e5",
-  "DejaVuSansMono.tar.xz": "e02d9dcf740b6fe72288ece5ea235a78cdc3763502b2682d7659c7618d4400c5",
-  "DepartureMono.tar.xz": "45dca8cadd11f6eb289c13f66be3ad7fbd525504168d3c0931d57c8ad56be909",
-  "DroidSansMono.tar.xz": "1e2b79f888e4d07617857ddae0f82ffe07b65328fc0664e9a94bc0fac1aef888",
-  "EnvyCodeR.tar.xz": "be99355fc93e9c351a4c70d7713c8f4fe038a65ac72f7ac9cc5550bc52734b70",
-  "FantasqueSansMono.tar.xz": "947166571476762b8e9b87a6b0532f9eab29147dc9e5d15aad1b7983229328d7",
-  "FiraCode.tar.xz": "7c64c44d7e530b25faf23904e135e9d1ff0339a92ee64e35e7da9116aa48af67",
-  "FiraMono.tar.xz": "d23c8db9d53397606bcfe6593f576abb12dd8e3d0605062231e391e2719e92c0",
-  "GeistMono.tar.xz": "8c5cacfa8a1fe276ea4ebdbe3b542ce71a7144c04a811c9f210faa401b436b3b",
-  "Go-Mono.tar.xz": "d3d2a8ec7f30513e52412f8907ec4838fd5843323b9e2a5a841de6531aff9a3a",
-  "Gohu.tar.xz": "da43efcf1eb53dc1773938861a9f3fcb19b71065a6a5bb0295e6038e90545027",
-  "Hack.tar.xz": "f797524e4b99191a5f35614c6fe48e96f7b8872712e2943a2aaf59cda086e909",
-  "Hasklig.tar.xz": "9cb2f02337782dd5eb1711f9890edaeea3d59eca00dd7ea3810c237336883fe3",
-  "HeavyData.tar.xz": "a3473e58cf5a7469a511dfdba2935611945e5cbd2f17d09a361c1ce19a30df0f",
-  "Hermit.tar.xz": "fddd0ada8ab3266042d4f6ddb3dd7a9c652c15ac80eda35097c3914281e14db0",
-  "IBMPlexMono.tar.xz": "f7b420dae1361d347858c78d6d48e385bc644e32781cc21eb7dcc483c3682eb1",
-  "Inconsolata.tar.xz": "d843486d7bab95ccf06c6c17ef03773b2dc5b284602b3926356a668c49be565f",
-  "InconsolataGo.tar.xz": "105963a2025b4cb96798d1538f38aa65bd13a856cda9941ce25c139959eccd03",
-  "InconsolataLGC.tar.xz": "442501cffb407e11539fa9fb4714253d779dd0508c0257c42eec187f11a18b13",
-  "IntelOneMono.tar.xz": "0a5287b9e24a9adce148daea25c04242ae65f9bb04e3610c8374eaca7379ec20",
-  "Iosevka.tar.xz": "01b352cd732b36d24fb7b0f2b331ddc34c2a39155af6e7a42bddf2ee279bb25d",
-  "IosevkaTerm.tar.xz": "5ca2a43d1ed2a0098fbc9f87e7dc89c6a13d0399bcb82f09359fa141f9afb70b",
-  "IosevkaTermSlab.tar.xz": "c8e7e72b6652adb34e4f0af20e22d1eda06368db3a6ebab5194d1078944ea31a",
-  "JetBrainsMono.tar.xz": "7d171ea3884be22fc08bf1a1aee640a3dc93f031989c27f6f9ceb30a6a668de1",
-  "Lekton.tar.xz": "2f83aabdf69d1ae28e9b60ef3777e572aafc359f32c8eae7a6278337f1364014",
-  "LiberationMono.tar.xz": "cc2d9a78c88c91875d8fee10d7d5d67ee9f0687ef004fd61bee4e7a1ecef700b",
-  "Lilex.tar.xz": "1f4d1c13252f12e9b09e09f881ea21a77645e1eac3472604990b3a11deea78c1",
-  "MPlus.tar.xz": "55d7390e8b45fc19a028dd93d42aebf0fe55fd85321940d1be13a5f6fa592e76",
-  "MartianMono.tar.xz": "7cad96ae914fecff010fa438276a99daf984044ade8b473049b3b63f771a5603",
-  "Meslo.tar.xz": "6ad716ed719e2c97794abd5856a90c6131c406606b249debdc83b04ae11f4cb7",
-  "Monaspace.tar.xz": "faeb907827a2a07ae64c8fa1a5ca48cd9e60c9084a24c48d779a30cf6bd0693a",
-  "Monofur.tar.xz": "9dfad24a7debf0ca56db2465e8bd5a0a28435945c23e2a831bcd111785b57480",
-  "Monoid.tar.xz": "51765143936c5c5078249eb77f2dc862f0d9436328c4c698918b276637d5caee",
-  "Mononoki.tar.xz": "b9bff1032796daffef71610639685d28a4a5baf31cb4ca43dd53f3d14820f5cf",
-  "NerdFontsSymbolsOnly.tar.xz": "8b5ecbe2612cb37d75e2645f7644876bc38960574909b1c01c002d0e8d33deb3",
-  "Noto.tar.xz": "556a30d1dcdbf565946605f50657fa77105d95d150413492cfa7065263f56427",
-  "OpenDyslexic.tar.xz": "5cd679c82f992f4140f2ab4f6cb77b0080f71a3d7152fb8c91fe0c07f4dcce83",
-  "Overpass.tar.xz": "6dc50cddca27afa51bd2cce334d6b451d6ce56e6f955c06518ae5b9b1f99e9fc",
-  "ProFont.tar.xz": "960a9f36ea58ab07c2955b8cb37b4386626ae19b23d026095ef896a05842dadb",
-  "ProggyClean.tar.xz": "70e91ef90a6d6230f6870a978b856e6138dcff0b98efa9ba3e84c447dda638a2",
-  "Recursive.tar.xz": "2c9d0b6db82ef6acf71b235b5bd7b16f33cfbbba5ce08bfb1278f7dc6ec1eb20",
-  "RobotoMono.tar.xz": "fad79b182e2c27454276b45d9633c0800302da996168bc5cee0109fda2181ed3",
-  "ShareTechMono.tar.xz": "0f7fb196b3700caeee85ddad56efde174416d73afc651a79d38bd319c1587d43",
-  "SourceCodePro.tar.xz": "87834bca780558bbe3ff808e51c89e1c3d98140a2c1a0d3100e10e944456a63c",
-  "SpaceMono.tar.xz": "a2058cfc43eee5a170208c6e90fa77d8f0aa755e0d213e795f70781f7d807942",
-  "Terminus.tar.xz": "88b17b50aab7ee284f9a1ed395f96c20ab4d22640fde1fe0f80a31f1eacd6585",
-  "Tinos.tar.xz": "f763b82e01f06ebce5830c475306598734d2fc91ded1760fe925a826b3cba8ef",
-  "Ubuntu.tar.xz": "4ff08c04bec3ec86b60d75a987b5c09d7e5c434f006f426bcfdac80f6f66d938",
-  "UbuntuMono.tar.xz": "dc8a6aebd8950e59dd89a1c5f49be3914879691e2e1293c157b7f66291c09712",
-  "UbuntuSans.tar.xz": "3d0ed4bbadf13f9655c5e4a3bc089eef6db232fa3d4552144b1683adc9fad98d",
-  "VictorMono.tar.xz": "f61229287e333e575f134923fd46da32fe4e01120a2a74a17d2d9b7591a9b87e",
-  "ZedMono.tar.xz": "fa29af2373bbf6edda1c3c9a42655227748d1a9f7b2563bf4b79253618768318",
-  "iA-Writer.tar.xz": "50d885c7f03931323c5ea232c677b8963f8d1a196cfd8f2935e2ddcf535b5971"
+  "0xProto.tar.xz": "effaa4c257c1f25e6d2d50679e9b845eab36b346dea9ee26f4405da1a21e6428",
+  "3270.tar.xz": "6d9dd76987968e8a0b30d3ae4d18b8139d6ddf6cd53409272dbc596654ea38b1",
+  "AdwaitaMono.tar.xz": "39b7598b2ec30111d1ace82b274809e5d0930e241683c1c91f5b4c7e64a975cf",
+  "Agave.tar.xz": "fe4879b0cff2d33d7fb08d1c8ba4e0cad9f44843644fe284fda1e89addf9c4ab",
+  "AnonymousPro.tar.xz": "7ebace54eda35943062eaad9dd4f16de24390b672f31bff45475b82acb1955c0",
+  "Arimo.tar.xz": "006464de19502bd49a72265058811665b62b823509bbbd2e7181ba87046b6b08",
+  "AtkinsonHyperlegibleMono.tar.xz": "8643ab571f547c6af0352a08e617ba7303965b2882ab9f36d61e8d4680761a59",
+  "AurulentSansMono.tar.xz": "a0d642ace8f9d616a9c9cbbe46e188c60ddf7486b0cf2685a3558e06aba2c284",
+  "BigBlueTerminal.tar.xz": "9df627ec74a21f4da8df4821dba85cabcc452f95b636e8802eeaa2e6f3129e13",
+  "BitstreamVeraSansMono.tar.xz": "59162ab2d67d39827e497beda03fbe6327d3535d2ee3b1dd7050fdeafe1f9c36",
+  "CascadiaCode.tar.xz": "804b3d311665a059140466fe142cc76cf14ef0695b7c4d3a174f7f8fba46b6e3",
+  "CascadiaMono.tar.xz": "7c22db8c8460ef62abffbb6d5c7b212507de0798a4a762fa2a005a8bc4c90fc6",
+  "CodeNewRoman.tar.xz": "2db8def7863ea49b6ef69f353988d7e0f73a8646722e5946932740d76eb46b25",
+  "ComicShannsMono.tar.xz": "23d90d18dae663b7d0dcdb4edd2f5087eecb40b00f046a1f46a9abf3ecb47651",
+  "CommitMono.tar.xz": "44cdabae7708de3548fdd78ed59cdbb1fedbca18e16644047ed4a23623a530ca",
+  "Cousine.tar.xz": "63bc50fc2b88897096626cf9e835d4237ee0052f9bfd902dc1f5304c693c32e6",
+  "D2Coding.tar.xz": "5b4e8c53599ee79067a4439bfbf31bb3f1b40e93ac6493f718b48feaf972173d",
+  "DaddyTimeMono.tar.xz": "854c8cbf59e1fcc48f114408d93f63cad70c6ba8eefad5bf3071bd9dd8ef48f8",
+  "DejaVuSansMono.tar.xz": "0e58ff9c1f9378922b7f324fdba953929d88d61b36aedd80ee43964567b226cc",
+  "DepartureMono.tar.xz": "f099f71bc240fb59ffeaba50d26206b32df7e54051e49d6837a1702e4d3b4f3f",
+  "DroidSansMono.tar.xz": "43ad0a4e238ad078300d0aa2ebca5f7aaf6ff2cdb25c5cfe8191b79aab7d0af2",
+  "EnvyCodeR.tar.xz": "b631d34ab3e3e26aba7169b382d573d82bc6647d3ddae67e9ce28481f64715e7",
+  "FantasqueSansMono.tar.xz": "462b5490475fb8560dded4eb6cdd9cfd0049b800acee329094def095557d0ffd",
+  "FiraCode.tar.xz": "d83fb093e0e05a531cd6f19886a6ceb884a4fa5ea3b53cf099fc1f30c5b3e47d",
+  "FiraMono.tar.xz": "2e4adc97fefdfa2ad70a6e6e79bc0418acd401a305bcb5fcd848a84e03e35a74",
+  "GeistMono.tar.xz": "43ef3d73cadddea5be746e20c9f27fbaa59ceb106b8b26f7245ba2de2e46b1f6",
+  "Go-Mono.tar.xz": "81c879e6a86dd6e6cb94d7a73322bf39f06b3294a727effb5a5bb5c7f9274fd6",
+  "Gohu.tar.xz": "458b08f1216c18a46fc3e00701d6d171a4d536192b0885c041d8cc1befb6b44d",
+  "Hack.tar.xz": "1d00a1435638084174516975840854368a45ac30bb0bad2c0c49db713b5925f0",
+  "Hasklig.tar.xz": "e82418895a7036158baf9a425faea7de1fe332267b218341eec44c6b5071d1ad",
+  "HeavyData.tar.xz": "ed0d49911ae0caa1d625ae64832b49b4c94e90fa2ec0b1e5e7df440ccb28698b",
+  "Hermit.tar.xz": "206ae23c386dcb84a2dfaca678af36123fbaff1fb402326021973485018467f3",
+  "IBMPlexMono.tar.xz": "95e6ecaa5dfb9a96f27a6b6edc7be396fb6df30bc311a6f7e15cad56a30051c2",
+  "Inconsolata.tar.xz": "47df94d3826a9f3e94b4c596a78f5baaddfb27f25bdb7906c5cf65caf8962eb2",
+  "InconsolataGo.tar.xz": "0407ab5ddd9f6a9af5f178d5fa1732cbf8275c4fe6e03793adbe48bfd6c04884",
+  "InconsolataLGC.tar.xz": "59b5961b83f0fd64ef579099ca0209dd706d5025feac813c80fcc2d0648d717f",
+  "IntelOneMono.tar.xz": "9d55174210a512c6c9d0601532033d05d9e8817c760cb9ccca3c6c9c4ff6d7c1",
+  "Iosevka.tar.xz": "213ee24cda99ca84d0a8326de133e7e8b2baf9ba23659ce829f589f771d357d2",
+  "IosevkaTerm.tar.xz": "cad9da572d25e3413f7a15a319d2f3c9e7e915ee016baa99e0d88fc08cf5b781",
+  "IosevkaTermSlab.tar.xz": "8990ca82b481a02734cb96f46db789716735ca8f6c4bf89d800899a593a1f0ca",
+  "JetBrainsMono.tar.xz": "ef552a3e638f25125c6ad4c51176a6adcdce295ab1d2ffacf0db060caf8c1582",
+  "Lekton.tar.xz": "2a7fa12bf2b376307c9ca2501227b0d91dcae25c453ec095e5f768a2ca5b6fe9",
+  "LiberationMono.tar.xz": "64a9519dd6b75179a9363f9c8a0cefe2984ec8578394ced66e9d0fffd2be922f",
+  "Lilex.tar.xz": "1d011e82a59aec26bff5564ca90a8e51636364e5b7f79417708aa2c846c633b3",
+  "MPlus.tar.xz": "9c03e388d0ff2e0bc28be9bf6ab95f1e0260c5828b3159b18867a9e7a1f17f7b",
+  "MartianMono.tar.xz": "e12f5ca02756268e794d06d9cb2ada93d021ec915f5a43ec2cd77355022f3624",
+  "Meslo.tar.xz": "a57936d96aefb5cfff0660f3294210ee04705529af6cf811e2274b0923a03939",
+  "Monaspace.tar.xz": "5fdb97828e1a23fd28ea5ed0e7d15cdebb77ef079aaa48b93f1526764b40ef8c",
+  "Monofur.tar.xz": "539dc64f089b189c5f14ee60df6368742cc63ccc3be753bd3c8bfba7632fe068",
+  "Monoid.tar.xz": "5c6efd6fe2f2856d5294748dc751770d1c8889665f42687a0ac8f1b3a86a3299",
+  "Mononoki.tar.xz": "5c9b3035d45aabfe1fb3ce5e3028130043398cecc1409b20fe8273692192726e",
+  "NerdFontsSymbolsOnly.tar.xz": "7f8c090da3b0eaa7108646bf34cbbb6ed13d5358a72460522108b06c7ecd716a",
+  "Noto.tar.xz": "e28b31609d17fc50bdf9e6730c947a61b0e474af726c2c044c39bc78fcd9bfde",
+  "OpenDyslexic.tar.xz": "2155e95e9c7b12d785dc589033290a8caff07c11cf1697ec3ad0bda37e3b0433",
+  "Overpass.tar.xz": "4d6d7e8b91840bb2b18bc7ac427f979183e68b6b061db58b4139ad5679bdc36f",
+  "ProFont.tar.xz": "c6d595ac9f7e0d6ac87c4c57e26c7515c544e8e5ac553c5a215394d12b201a8f",
+  "ProggyClean.tar.xz": "910c51cb06ff3233daee1d045e606ed77c290ea25dd1a54378e0517601f4785c",
+  "Recursive.tar.xz": "a047ac2e724c1614ef4350af83f35cd1d044d8d20e6477c319172b860b19329a",
+  "RobotoMono.tar.xz": "4bc63bf0105c664e466e62cb2fd1c143b310877de93dc35b3b5d48e0e4cb6702",
+  "ShareTechMono.tar.xz": "11bb01a73894f932a3702551245aa0c57d121ebf59dd293fac5ceac81af822d1",
+  "SourceCodePro.tar.xz": "d52d97b66c4c5d6d9d99c88df55148faf39738f244485026f22f8e47407744f4",
+  "SpaceMono.tar.xz": "d159c6f13291723f1821d1064a7d3e0933d96297d55bab27d76861472af68111",
+  "Terminus.tar.xz": "e857b18a99701528f873275b6012792caf6e30c34c512ee92cda51520140054f",
+  "Tinos.tar.xz": "c54f03f38fbf897f34235bc5989500361251f61220cf63afedd730edd221714e",
+  "Ubuntu.tar.xz": "534bf0ffb311a993fd23666a7f3e4f4a0cfc0662abfa8b81594705cceefb69e3",
+  "UbuntuMono.tar.xz": "a13cf890ef10517c59e812ced167245f2db47d37d2b03c9fb43ddef023a3e776",
+  "UbuntuSans.tar.xz": "0a399b03565c577ae2da9f8362e6276b0adb13bac288e49fec085c517243e27b",
+  "VictorMono.tar.xz": "67bb8c729aedbe2e0258435c78e52bb1753618a1d3d7c0c94e6f1c47763a56a9",
+  "ZedMono.tar.xz": "7dfff6bb0e45143c33703c3fdf3ff77b00f3617fef29671c7ff6af166dcf31a0",
+  "iA-Writer.tar.xz": "0156f309d942d9066a83005dd42588719a1755fb78e345e5f22ff582da46211b"
 }
diff --git a/pkgs/data/fonts/nerd-fonts/manifests/fonts.json b/pkgs/data/fonts/nerd-fonts/manifests/fonts.json
index ac13c29be107..46414245819a 100644
--- a/pkgs/data/fonts/nerd-fonts/manifests/fonts.json
+++ b/pkgs/data/fonts/nerd-fonts/manifests/fonts.json
@@ -5,7 +5,7 @@
     "folderName": "0xProto",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "0xProto",
-    "version": "2.201"
+    "version": "2.300"
   },
   {
     "caskName": "3270",
@@ -15,6 +15,14 @@
     "patchedName": "3270",
     "version": "3.0.1"
   },
+  {
+    "caskName": "adwaita-mono",
+    "description": "The monospace typeface for GNOME",
+    "folderName": "AdwaitaMono",
+    "licenseId": "OFL-1.1-no-RFN",
+    "patchedName": "AdwaitaMono",
+    "version": "32.4"
+  },
   {
     "caskName": "agave",
     "description": "A small, monospace, outline font that is geometrically regular and simple",
@@ -39,6 +47,14 @@
     "patchedName": "Arimo",
     "version": "1.33"
   },
+  {
+    "caskName": "atkynson-mono",
+    "description": "A monospaced font designed to improve legibility and readability for individuals with low vision",
+    "folderName": "AtkinsonHyperlegibleMono",
+    "licenseId": "OFL-1.1-RFN",
+    "patchedName": "AtkynsonMono",
+    "version": "2.001"
+  },
   {
     "caskName": "aurulent-sans-mono",
     "description": "Sans serif, designed by Stephen G. Hartke which also created Verily Serif",
@@ -77,7 +93,7 @@
     "folderName": "CascadiaCode",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "CaskaydiaCove",
-    "version": "2111.01"
+    "version": "2407.24"
   },
   {
     "caskName": "caskaydia-mono",
@@ -85,7 +101,7 @@
     "folderName": "CascadiaMono",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "CaskaydiaMono",
-    "version": "2111.01"
+    "version": "2407.24"
   },
   {
     "caskName": "code-new-roman",
@@ -135,14 +151,6 @@
     "patchedName": "DaddyTimeMono",
     "version": "1.2.3"
   },
-  {
-    "caskName": "departure-mono",
-    "description": "A monospaced pixel font with a lo-fi, techy vibe",
-    "folderName": "DepartureMono",
-    "licenseId": "OFL-1.1-no-RFN",
-    "patchedName": "DepartureMono",
-    "version": "1.422"
-  },
   {
     "caskName": "dejavu-sans-mono",
     "description": "Dotted zero, based on the Bitstream Vera Fonts with a wider range of character",
@@ -151,6 +159,14 @@
     "patchedName": "DejaVuSansM",
     "version": "2.37"
   },
+  {
+    "caskName": "departure-mono",
+    "description": "A monospaced pixel font with a lo-fi, techy vibe",
+    "folderName": "DepartureMono",
+    "licenseId": "OFL-1.1-no-RFN",
+    "patchedName": "DepartureMono",
+    "version": "1.422"
+  },
   {
     "caskName": "droid-sans-mono",
     "description": "Good for small screens or font sizes",
@@ -197,7 +213,7 @@
     "folderName": "GeistMono",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "GeistMono",
-    "version": "1.2.0 (1.3.0)"
+    "version": "1.401"
   },
   {
     "caskName": "go-mono",
@@ -277,7 +293,7 @@
     "folderName": "InconsolataLGC",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Inconsolata LGC",
-    "version": "1.5.2"
+    "version": "1.13"
   },
   {
     "caskName": "intone-mono",
@@ -293,7 +309,7 @@
     "folderName": "Iosevka",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Iosevka",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "iosevka-term",
@@ -301,7 +317,7 @@
     "folderName": "IosevkaTerm",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "IosevkaTerm",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "iosevka-term-slab",
@@ -309,7 +325,7 @@
     "folderName": "IosevkaTermSlab",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "IosevkaTermSlab",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "jetbrains-mono",
@@ -341,7 +357,7 @@
     "folderName": "Lilex",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Lilex",
-    "version": "2.400"
+    "version": "2.600"
   },
   {
     "caskName": "martian-mono",
@@ -349,7 +365,7 @@
     "folderName": "MartianMono",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "MartianMono",
-    "version": "1.0.0"
+    "version": "1.1.0"
   },
   {
     "caskName": "meslo-lg",
@@ -365,7 +381,7 @@
     "folderName": "Monaspace",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "Monaspice",
-    "version": "1.101"
+    "version": "1.200"
   },
   {
     "caskName": "monofur",
@@ -392,12 +408,12 @@
     "version": "1.6"
   },
   {
-    "caskName": "mplus",
+    "caskName": "m+",
     "description": "Multiple styles and weights, many glyph sets (e.g. Kana glyphs)",
     "folderName": "MPlus",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "M+",
-    "version": "2023/09"
+    "version": "1.007"
   },
   {
     "caskName": "noto",
@@ -525,7 +541,7 @@
     "folderName": "UbuntuSans",
     "licenseId": "LicenseRef-UbuntuFont",
     "patchedName": "UbuntuSans",
-    "version": "1.004"
+    "version": "1.006"
   },
   {
     "caskName": "victor-mono",
diff --git a/pkgs/data/fonts/nerd-fonts/manifests/release.json b/pkgs/data/fonts/nerd-fonts/manifests/release.json
index 0073a9ea0d40..678e97731ded 100644
--- a/pkgs/data/fonts/nerd-fonts/manifests/release.json
+++ b/pkgs/data/fonts/nerd-fonts/manifests/release.json
@@ -1,3 +1,3 @@
 {
-  "tag_name": "v3.3.0"
+  "tag_name": "v3.4.0"
 }
diff --git a/pkgs/development/compilers/osl/default.nix b/pkgs/development/compilers/osl/default.nix
index 17df7fa6f050..8a4f54b091c7 100644
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@@ -8,7 +8,7 @@
   libxml2,
   zlib,
   openexr,
-  openimageio,
+  openimageio_2,
   llvm,
   boost,
   flex,
@@ -20,9 +20,7 @@
 }:
 
 let
-
   boost_static = boost.override { enableStatic = true; };
-
 in
 stdenv.mkDerivation rec {
   pname = "openshadinglanguage";
@@ -65,7 +63,7 @@ stdenv.mkDerivation rec {
       libclang
       llvm
       openexr
-      openimageio
+      openimageio_2
       partio
       pugixml
       python3.pkgs.pybind11
diff --git a/pkgs/development/interpreters/emilua/default.nix b/pkgs/development/interpreters/emilua/default.nix
index 9610d3fc7a1a..c9101377e91d 100644
--- a/pkgs/development/interpreters/emilua/default.nix
+++ b/pkgs/development/interpreters/emilua/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   meson,
   ninja,
-  fetchFromGitHub,
   fetchFromGitLab,
   re2c,
   gperf,
@@ -28,39 +27,15 @@
   emilua, # this package
 }:
 
-let
-  trial-protocol-wrap = fetchFromGitHub {
-    owner = "breese";
-    repo = "trial.protocol";
-    rev = "79149f604a49b8dfec57857ca28aaf508069b669";
-    sparseCheckout = [
-      "include"
-    ];
-    hash = "sha256-QpQ70KDcJyR67PtOowAF6w48GitMJ700B8HiEwDA5sU=";
-    postFetch = ''
-      rm $out/*.*
-      mkdir -p $out/lib/pkgconfig
-      cat > $out/lib/pkgconfig/trial-protocol.pc << EOF
-        Name: trial.protocol
-        Version: 0-unstable-2023-02-10
-        Description:  C++ header-only library with parsers and generators for network wire protocols
-        Requires:
-        Libs:
-        Cflags:
-      EOF
-    '';
-  };
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "emilua";
-  version = "0.11.4";
+  version = "0.11.6";
 
   src = fetchFromGitLab {
     owner = "emilua";
     repo = "emilua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CVEBFySsGT0f16Dim1Pw1GdDM0fWUKieRZyxHaDH3O4=";
+    hash = "sha256-r/WfRAr8AgnZGHxzcZVLg5MHDwcOTMWqOv/Qu/75Y1c=";
   };
 
   propagatedBuildInputs = [
@@ -74,7 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     liburing
     openssl
     cereal
-    trial-protocol-wrap
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/embree/2.x.nix b/pkgs/development/libraries/embree/2.x.nix
index c3a0adf867e9..a4fd44accf6f 100644
--- a/pkgs/development/libraries/embree/2.x.nix
+++ b/pkgs/development/libraries/embree/2.x.nix
@@ -7,7 +7,7 @@
   ispc,
   tbb,
   glfw,
-  openimageio,
+  openimageio_2,
   libjpeg,
   libpng,
   libpthreadstubs,
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     ispc
     tbb
     glfw
-    openimageio
+    openimageio_2
     libjpeg
     libpng
     libX11
diff --git a/pkgs/development/libraries/embree/default.nix b/pkgs/development/libraries/embree/default.nix
index ace060f54d07..96e431e14c05 100644
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@@ -7,7 +7,7 @@
   ispc,
   tbb,
   glfw,
-  openimageio,
+  openimageio_2,
   libjpeg,
   libpng,
   libpthreadstubs,
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     tbb
     glfw
-    openimageio
+    openimageio_2
     libjpeg
     libpng
     libX11
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 7f4406d34b95..c9b95f8913e2 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -469,6 +469,13 @@ stdenv.mkDerivation (
           hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
         })
       ]
+      ++ optionals (lib.versionOlder version "7" && stdenv.hostPlatform.isAarch32) [
+        (fetchpatch2 {
+          name = "binutils-2-43-compat.patch";
+          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/654bd47716c4f36719fb0f3f7fd8386d5ed0b916";
+          hash = "sha256-OLiQHKBNp2p63ZmzBBI4GEGz3WSSP+rMd8ITfZSVRgY=";
+        })
+      ]
       ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.1") [
         ./fix-fate-ffmpeg-spec-disposition-7.1.patch
       ]
diff --git a/pkgs/development/python-modules/docling-ibm-models/default.nix b/pkgs/development/python-modules/docling-ibm-models/default.nix
index 362e5c59ae8a..a48bfe7234cd 100644
--- a/pkgs/development/python-modules/docling-ibm-models/default.nix
+++ b/pkgs/development/python-modules/docling-ibm-models/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-ibm-models";
-  version = "3.4.1";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-ibm-models";
     tag = "v${version}";
-    hash = "sha256-IgKP+4en0N6xLBjzwmddDk8z5P3J1vo+UMW+65a01Ww=";
+    hash = "sha256-C3SRz4z5m/UjK+ZmpM94jLRr2xTwql7CdhFTj3HEOc0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/materialx/default.nix b/pkgs/development/python-modules/materialx/default.nix
index 43b766a5662f..d15207ee0a70 100644
--- a/pkgs/development/python-modules/materialx/default.nix
+++ b/pkgs/development/python-modules/materialx/default.nix
@@ -8,7 +8,7 @@
   libX11,
   libXt,
   libGL,
-  openimageio,
+  openimageio_2,
   imath,
   python,
   apple-sdk_14,
@@ -37,7 +37,7 @@ buildPythonPackage rec {
 
   buildInputs =
     [
-      openimageio
+      openimageio_2
       imath
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 138a9f93c1f5..bf63a5d343a9 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -23,7 +23,7 @@
   ninja,
   numpy,
   opencolorio,
-  openimageio,
+  openimageio_2,
   opensubdiv,
   osl,
   ptex,
@@ -131,7 +131,7 @@ buildPythonPackage rec {
       imath
       materialx
       opencolorio
-      openimageio
+      openimageio_2
       opensubdiv
       ptex
       tbb
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index a31a8aebbf2e..5af23c4c2491 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -125,6 +125,8 @@ buildPythonPackage rec {
     # No audio or video device in test environment
     export SDL_VIDEODRIVER=dummy
     export SDL_AUDIODRIVER=disk
+    # traceback for segfaults
+    export PYTHONFAULTHANDLER=1
   '';
 
   checkPhase = ''
@@ -161,12 +163,5 @@ buildPythonPackage rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = [ lib.maintainers.pbsds ];
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # loading pygame.tests.font_test
-      # /nix/store/mrvg4qq09d51w5s95v15y4ym05q009fd-stdenv-darwin/setup: line 1771: 64131 Segmentation fault: 11
-      #
-      # https://github.com/NixOS/nixpkgs/issues/400378
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index bb595909e5c9..ef53e32126bc 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -21,9 +21,9 @@
   libpng,
   libX11,
   portmidi,
-  SDL2_image,
-  SDL2_mixer,
-  SDL2_ttf,
+  SDL2_classic_image,
+  SDL2_classic_mixer,
+  SDL2_classic_ttf,
 }:
 
 buildPythonPackage rec {
@@ -87,9 +87,9 @@ buildPythonPackage rec {
     libX11
     portmidi
     SDL2_classic
-    (SDL2_image.override { enableSTB = false; })
-    SDL2_mixer
-    SDL2_ttf
+    (SDL2_classic_image.override { enableSTB = false; })
+    SDL2_classic_mixer
+    SDL2_classic_ttf
   ];
 
   preConfigure = ''
@@ -106,6 +106,8 @@ buildPythonPackage rec {
     # No audio or video device in test environment
     export SDL_VIDEODRIVER=dummy
     export SDL_AUDIODRIVER=disk
+    # traceback for segfaults
+    export PYTHONFAULTHANDLER=1
 
     ${python.interpreter} -m pygame.tests -v \
       --exclude opengl,timing \
@@ -122,10 +124,5 @@ buildPythonPackage rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ emilytrau ];
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # Several tests segfault
-      # https://github.com/pygame/pygame/issues/4486
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/pylance/default.nix b/pkgs/development/python-modules/pylance/default.nix
index 417c7b733c73..679f81833bc7 100644
--- a/pkgs/development/python-modules/pylance/default.nix
+++ b/pkgs/development/python-modules/pylance/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "pylance";
-  version = "0.25.2";
+  version = "0.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance";
     tag = "v${version}";
-    hash = "sha256-Xds+qSVB7X4CrtrOrfIdOSfgn22CnUyCfKZh2e0hzRo=";
+    hash = "sha256-TMaDLlu6JtYlFyfh9zeHRg1ky4HKlKTr9kRPT9kxTcU=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-c+uQQmB6KScB5sS+HW1TMAwNsze7Ssog2bf0kQWQUWA=";
+    hash = "sha256-43zFySOd3yGMQ06oqKXBGV1XE282D1cQEdGrijMS22o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 7075dff34b69..46ab52ab23df 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -6,7 +6,7 @@
   numpy,
   pillow,
   pooch,
-  pythonOlder,
+  pythonAtLeast,
   scooby,
   setuptools,
   typing-extensions,
@@ -15,16 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.44.2";
+  version = "0.45.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "pyvista";
     repo = "pyvista";
     tag = "v${version}";
-    hash = "sha256-ZQfI0lmh/cwE224yk6a2G3gLUCsBjCQqPI1y4zYj0FI=";
+    hash = "sha256-ruhG9HsD1PzTs/S6IDtuqIxg7UBmn67Ne2Y/H8y/9Cs=";
   };
 
   build-system = [ setuptools ];
@@ -45,9 +43,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pyvista" ];
 
   meta = with lib; {
+    broken = pythonAtLeast "3.13"; # segfault
     description = "Easier Pythonic interface to VTK";
     homepage = "https://pyvista.org";
-    changelog = "https://github.com/pyvista/pyvista/releases/tag/v${version}";
+    changelog = "https://github.com/pyvista/pyvista/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ wegank ];
   };
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a0f150e473f0..18aa20f64cf6 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -49,10 +49,6 @@ buildPythonPackage rec {
   ];
   versionCheckProgramArg = "--version";
 
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
   __darwinAllowLocalNetworking = true;
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/stdenv/linux/bootstrap-files/loongarch64-unknown-linux-gnu.nix b/pkgs/stdenv/linux/bootstrap-files/loongarch64-unknown-linux-gnu.nix
new file mode 100644
index 000000000000..88866bcd9482
--- /dev/null
+++ b/pkgs/stdenv/linux/bootstrap-files/loongarch64-unknown-linux-gnu.nix
@@ -0,0 +1,21 @@
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=loongarch64-unknown-linux-gnu
+#
+# Metadata:
+# - nixpkgs revision: bdcacf48f3b064c93a9064d1d545f75c60ca6c77
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.loongarch64-unknown-linux-gnu.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/295459473
+# - instantiated derivation: /nix/store/q7r692xs6kpsyipmkfamhj36va79wa5r-stdenv-bootstrap-tools-loongarch64-unknown-linux-gnu.drv
+# - output directory: /nix/store/gvjaqdhmvsqn821iypwj0cb8xq8yiii6-stdenv-bootstrap-tools-loongarch64-unknown-linux-gnu
+# - build time: Wed, 23 Apr 2025 12:35:42 +0000
+{
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/loongarch64-unknown-linux-gnu/bdcacf48f3b064c93a9064d1d545f75c60ca6c77/bootstrap-tools.tar.xz";
+    hash = "sha256-Yx0YmbVElsbN0VKgPiKfm7+e3ed5JXu3vZv0kKIhER8=";
+  };
+  busybox = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/loongarch64-unknown-linux-gnu/bdcacf48f3b064c93a9064d1d545f75c60ca6c77/busybox";
+    hash = "sha256-0UFp0zpeC8oTmS5/XJoMFnnOMTVTciQYmO/0JAi6uqk=";
+    executable = true;
+  };
+}
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index cea12c5e8840..7682419db9d6 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -82,6 +82,7 @@
           powerpc64le-linux = import ./bootstrap-files/powerpc64le-unknown-linux-gnu.nix;
           riscv64-linux = import ./bootstrap-files/riscv64-unknown-linux-gnu.nix;
           s390x-linux = import ./bootstrap-files/s390x-unknown-linux-gnu.nix;
+          loongarch64-linux = import ./bootstrap-files/loongarch64-unknown-linux-gnu.nix;
         };
         musl = {
           aarch64-linux = import ./bootstrap-files/aarch64-unknown-linux-musl.nix;
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 0c72ed9db33b..bd28c7fbbedf 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -183,6 +183,10 @@ lib.makeExtensible (
         version = "2.28.2";
         hash = "sha256-yl+hlZ/VFHIZwPIDEs4ysOYgprW4VEORfSyvScF7Cwg=";
         self_attribute_name = "nix_2_28";
+        patches = [
+          # fixes user/system registries regression: https://github.com/NixOS/nix/issues/13050
+          ./patches/0001-Revert-Actually-ignore-system-user-registries-during.patch
+        ];
       };
 
       nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {
diff --git a/pkgs/tools/package-management/nix/patches/0001-Revert-Actually-ignore-system-user-registries-during.patch b/pkgs/tools/package-management/nix/patches/0001-Revert-Actually-ignore-system-user-registries-during.patch
new file mode 100644
index 000000000000..c38cbb3a8011
--- /dev/null
+++ b/pkgs/tools/package-management/nix/patches/0001-Revert-Actually-ignore-system-user-registries-during.patch
@@ -0,0 +1,51 @@
+From 8df4f5db3c71046f5deaeb913e5ec0d16f70b5a2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Thu, 24 Apr 2025 14:17:18 +0200
+Subject: [PATCH] Revert "Actually ignore system/user registries during
+ locking"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit a08477975d90dc0d2c9f89d2a417bedb5b266931.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ src/libflake/flake/flakeref.cc    | 2 +-
+ tests/functional/flakes/flakes.sh | 7 -------
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/src/libflake/flake/flakeref.cc b/src/libflake/flake/flakeref.cc
+index 1580c2846..6e95eb767 100644
+--- a/src/libflake/flake/flakeref.cc
++++ b/src/libflake/flake/flakeref.cc
+@@ -39,7 +39,7 @@ FlakeRef FlakeRef::resolve(
+     ref<Store> store,
+     const fetchers::RegistryFilter & filter) const
+ {
+-    auto [input2, extraAttrs] = lookupInRegistries(store, input, filter);
++    auto [input2, extraAttrs] = lookupInRegistries(store, input);
+     return FlakeRef(std::move(input2), fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
+ }
+ 
+diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
+index b67a0964a..d8c9f254d 100755
+--- a/tests/functional/flakes/flakes.sh
++++ b/tests/functional/flakes/flakes.sh
+@@ -220,13 +220,6 @@ nix store gc
+ nix registry list --flake-registry "file://$registry" --refresh | grepQuiet flake3
+ mv "$registry.tmp" "$registry"
+ 
+-# Ensure that locking ignores the user registry.
+-mkdir -p "$TEST_HOME/.config/nix"
+-ln -sfn "$registry" "$TEST_HOME/.config/nix/registry.json"
+-nix flake metadata flake1
+-expectStderr 1 nix flake update --flake-registry '' --flake "$flake3Dir" | grepQuiet "cannot find flake 'flake:flake1' in the flake registries"
+-rm "$TEST_HOME/.config/nix/registry.json"
+-
+ # Test whether flakes are registered as GC roots for offline use.
+ # FIXME: use tarballs rather than git.
+ rm -rf "$TEST_HOME/.cache"
+-- 
+2.49.0
+
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 8ca614104bf7..732e2ced1f5c 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -22,6 +22,8 @@ let
   pname = "ghidra";
   version = "11.3.2";
 
+  isMacArm64 = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+
   releaseName = "NIX";
   distroPrefix = "ghidra_${version}_${releaseName}";
   src = fetchFromGitHub {
@@ -129,7 +131,21 @@ stdenv.mkDerivation (finalAttrs: {
     data = ./deps.json;
   };
 
-  gradleFlags = [ "-Dorg.gradle.java.home=${openjdk21}" ];
+  gradleFlags =
+    [ "-Dorg.gradle.java.home=${openjdk21}" ]
+    ++ lib.optionals isMacArm64 [
+      # For some reason I haven't been able to figure out yet, ghidra builds for
+      # arm64 seems to build the x64 binaries of the decompiler. These fail to
+      # build due to trying to link the x64 object files with arm64 stdc++
+      # library, which obviously fails.
+      #
+      # Those binaries are entirely unnecessary anyways, since we're targeting
+      # arm64 build here, so let's exclude them from the build.
+      "-x"
+      "Decompiler:linkSleighMac_x86_64Executable"
+      "-x"
+      "Decompiler:linkDecompileMac_x86_64Executable"
+    ];
 
   preBuild = ''
     export JAVA_TOOL_OPTIONS="-Duser.home=$NIX_BUILD_TOP/home"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d9638fccaf69..24d84d51a10b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14358,7 +14358,7 @@ with pkgs;
     inherit (darwin) DarwinTools;
   };
 
-  openimageio = callPackage ../development/libraries/openimageio { };
+  openimageio_2 = callPackage ../by-name/op/openimageio/2.nix { };
 
   open-music-kontrollers = lib.recurseIntoAttrs {
     eteroj = callPackage ../applications/audio/open-music-kontrollers/eteroj.nix { };