diff --git a/.github/workflows/check-maintainers-sorted.yml b/.github/workflows/check-maintainers-sorted.yml
index dcc4806e9375..3b9b5ee7fba2 100644
--- a/.github/workflows/check-maintainers-sorted.yml
+++ b/.github/workflows/check-maintainers-sorted.yml
@@ -20,7 +20,7 @@ jobs:
             lib
             maintainers
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml
index 910403e0bb00..8c35196e4944 100644
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/check-nixf-tidy.yml b/.github/workflows/check-nixf-tidy.yml
index 91a5d4c6c90f..1bb43c746bc5 100644
--- a/.github/workflows/check-nixf-tidy.yml
+++ b/.github/workflows/check-nixf-tidy.yml
@@ -34,7 +34,7 @@ jobs:
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
index 9c02e26be178..d148563c4311 100644
--- a/.github/workflows/check-shell.yml
+++ b/.github/workflows/check-shell.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       - name: Build shell
         run: nix-build shell.nix
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 37e269c9c8bb..98c769236b22 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -45,7 +45,7 @@ jobs:
     needs: get-merge-commit
     if: github.repository_owner == 'NixOS' && needs.get-merge-commit.outputs.mergedSha
     steps:
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
       # This is intentional, because we need to request the review of owners as declared in the base branch.
diff --git a/.github/workflows/editorconfig-v2.yml b/.github/workflows/editorconfig-v2.yml
index 436b7c339e8c..c2428ce64e29 100644
--- a/.github/workflows/editorconfig-v2.yml
+++ b/.github/workflows/editorconfig-v2.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           # nixpkgs commit is pinned so that it doesn't break
           # editorconfig-checker 2.4.0
diff --git a/.github/workflows/eval-lib-tests.yml b/.github/workflows/eval-lib-tests.yml
index 84d9562c220d..722371ac19a2 100644
--- a/.github/workflows/eval-lib-tests.yml
+++ b/.github/workflows/eval-lib-tests.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 15dfedb1fb55..1c823b519585 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -43,7 +43,7 @@ jobs:
           echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
 
       - name: Install Nix
-        uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -71,7 +71,7 @@ jobs:
           path: nixpkgs
 
       - name: Install Nix
-        uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -111,7 +111,7 @@ jobs:
           path: nixpkgs
 
       - name: Install Nix
-        uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -152,7 +152,7 @@ jobs:
           path: nixpkgs
 
       - name: Install Nix
-        uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -260,7 +260,7 @@ jobs:
           path: comparison
 
       - name: Install Nix
-        uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       # Important: This workflow job runs with extra permissions,
       # so we need to make sure to not run untrusted code from PRs
diff --git a/.github/workflows/keep-sorted.yml b/.github/workflows/keep-sorted.yml
index 8c7688ad42e3..ec2237f52bd9 100644
--- a/.github/workflows/keep-sorted.yml
+++ b/.github/workflows/keep-sorted.yml
@@ -27,7 +27,7 @@ jobs:
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml
index abe8ac3d2d4f..26fa03aba9b4 100644
--- a/.github/workflows/manual-nixos-v2.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml
index 88356e1d229f..a97bd0aac719 100644
--- a/.github/workflows/manual-nixpkgs-v2.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/nix-parse-v2.yml b/.github/workflows/nix-parse-v2.yml
index f149dc481ca7..cc988e20bd6e 100644
--- a/.github/workflows/nix-parse-v2.yml
+++ b/.github/workflows/nix-parse-v2.yml
@@ -32,7 +32,7 @@ jobs:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
         if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=channel:nixpkgs-unstable
diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml
index b46f926d8cad..80d6ba0b9aba 100644
--- a/.github/workflows/nixpkgs-vet.yml
+++ b/.github/workflows/nixpkgs-vet.yml
@@ -43,7 +43,7 @@ jobs:
           git worktree add "$target" "$(git rev-parse HEAD^1)"
           echo "target=$target" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@754537aaedb35f72ab11a60cc162c49ef3016495 # v31
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       - name: Fetching the pinned tool
         # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
diff --git a/doc/build-helpers/fetchers.chapter.md b/doc/build-helpers/fetchers.chapter.md
index cfd0730d031c..997f97f81bdb 100644
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@@ -773,9 +773,14 @@ Additionally, the following optional arguments can be given:
 
 : Whether to fetch LFS objects.
 
+*`preFetch`* (String)
+
+: Shell code to be executed before the repository has been fetched, to allow
+  changing the environment the fetcher runs in.
+
 *`postFetch`* (String)
 
-: Shell code executed after the file has been fetched successfully.
+: Shell code executed after the repository has been fetched successfully.
   This can do things like check or transform the file.
 
 *`leaveDotGit`* (Boolean)
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b19700606e67..73941cecfc3d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12566,12 +12566,6 @@
     githubId = 34152449;
     name = "Karl Hallsby";
   };
-  karolchmist = {
-    email = "info+nix@chmist.com";
-    github = "karolchmist";
-    githubId = 1927188;
-    name = "karolchmist";
-  };
   kashw2 = {
     email = "supra4keanu@hotmail.com";
     github = "kashw2";
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 65501ecf7f4c..adf4a5a24680 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -366,6 +366,7 @@ in
       };
 
       serviceConfig = {
+        Type = "notify";
         # Use "+" because credentialsFile may not be accessible to User= or Group=.
         ExecStartPre = [
           (
diff --git a/nixos/modules/services/web-apps/mealie.nix b/nixos/modules/services/web-apps/mealie.nix
index e1fce845caa6..46571fea4617 100644
--- a/nixos/modules/services/web-apps/mealie.nix
+++ b/nixos/modules/services/web-apps/mealie.nix
@@ -50,13 +50,24 @@ in
         Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
       '';
     };
+
+    database = {
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Configure local PostgreSQL database server for Mealie.
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
     systemd.services.mealie = {
       description = "Mealie, a self hosted recipe manager and meal planner";
 
-      after = [ "network-online.target" ];
+      after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+      requires = lib.optional cfg.database.createLocally "postgresql.service";
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
@@ -78,5 +89,21 @@ in
         StandardOutput = "journal";
       };
     };
+
+    services.mealie.settings = lib.mkIf cfg.database.createLocally {
+      DB_ENGINE = "postgres";
+      POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
+    };
+
+    services.postgresql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      ensureDatabases = [ "mealie" ];
+      ensureUsers = [
+        {
+          name = "mealie";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
   };
 }
diff --git a/nixos/tests/k3s/airgap-images.nix b/nixos/tests/k3s/airgap-images.nix
index ade04c99840a..84a535feb7fc 100644
--- a/nixos/tests/k3s/airgap-images.nix
+++ b/nixos/tests/k3s/airgap-images.nix
@@ -31,7 +31,7 @@ import ../make-test-python.nix (
 
       start_all()
       machine.wait_for_unit("k3s")
-      machine.wait_until_succeeds("journalctl -r --no-pager -u k3s | grep \"Imported images from /var/lib/rancher/k3s/agent/images/\"", timeout=120)
+      machine.wait_until_succeeds("journalctl -r --no-pager -u k3s | grep \"Imported images from /var/lib/rancher/k3s/agent/images/\"")
       images = json.loads(machine.succeed("crictl img -o json"))
       image_names = [i["repoTags"][0] for i in images["images"]]
       with open("${k3s.imagesList}") as expected_images:
diff --git a/nixos/tests/mealie.nix b/nixos/tests/mealie.nix
index 57bff29731d8..21e96dea4114 100644
--- a/nixos/tests/mealie.nix
+++ b/nixos/tests/mealie.nix
@@ -10,20 +10,35 @@ import ./make-test-python.nix (
       ];
     };
 
-    nodes = {
-      server = {
-        services.mealie = {
-          enable = true;
-          port = 9001;
+    nodes =
+      let
+        sqlite = {
+          services.mealie = {
+            enable = true;
+            port = 9001;
+          };
         };
+        postgres = {
+          imports = [ sqlite ];
+          services.mealie.database.createLocally = true;
+        };
+      in
+      {
+        inherit sqlite postgres;
       };
-    };
 
     testScript = ''
       start_all()
-      server.wait_for_unit("mealie.service")
-      server.wait_for_open_port(9001)
-      server.succeed("curl --fail http://localhost:9001")
+
+      def test_mealie(node):
+        node.wait_for_unit("mealie.service")
+        node.wait_for_open_port(9001)
+        node.succeed("curl --fail http://localhost:9001")
+
+      test_mealie(sqlite)
+      simple.send_monitor_command("quit")
+      simple.wait_for_shutdown()
+      test_mealie(postgres)
     '';
   }
 )
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index aaa8f380da6b..70c69d5c5a22 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.14.3";
-    hash = "sha256-hYtjcxlHwtvESs08WdWuMGi10LIvdH5SEBeAI7ah8oc=";
+    version = "3.15.4";
+    hash = "sha256-4YZgIUZdtD/EKc6b76J8WfTD/QRyvqPSDDdk8kMKdD0=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
deleted file mode 100644
index 7f65917312ed..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-27.0.201+up27.0.2.tgz";
-    sha256 = "0vwprcb60y15sc4lmi58gl1zr3yhsq43jlbsfm7gs20ci90frv16";
-  };
-  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-27.0.201+up27.0.2.tgz";
-    sha256 = "12dp1r82qfzqfzs4sfxc54rnw8kv42a3w4gpk5v3qkhqm6fkrnn1";
-  };
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
deleted file mode 100644
index b045a685e530..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "b3b340da3d88c6723f18cf6219edf50745d5a749cb552bd2d3eee0b1281dd5a2"
-  },
-  "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "571f0addf5253ed0e98864157c885fbd14fc67f8efcfd638cc36ade48f903b8c"
-  },
-  "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "f2fc003d8ec5c1ac66d0eeb9e410a443a0af3f5b23367d3578c55c6e9e0c618a"
-  },
-  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.15%2Bk3s1/k3s-images.txt",
-    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
-  }
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
deleted file mode 100644
index 43fa8d0ff1e0..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  k3sVersion = "1.29.15+k3s1";
-  k3sCommit = "35a47239188444222067c25cc096346adb20401f";
-  k3sRepoSha256 = "0vynlcnmhhf82hr2rv01km5jyp2c2zb7872nnd8kzdxdw3jcqp7x";
-  k3sVendorHash = "sha256-+es8ua7JuDnUXej6hqE1ooFS81NhuoYYuA2+4CgUOmU=";
-  chartVersions = import ./chart-versions.nix;
-  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.14.1";
-  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.6.0-k3s1";
-  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "1.7.26-k3s1";
-  containerdSha256 = "0snz0i7xmnvs8bj7140q0lsxqdv835hksvk36baw71w5mbm1w1xz";
-  criCtlVersion = "1.29.0-k3s1";
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
index 651e9a4ccdc1..1f7ace104885 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "aba20bf6082fdccafc36c1ba79ba2705b2ef6f159a3455585c98cf128e767986"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "1c5efab645244d13cda7111a456aff796dfb4645c845df82266c4da56d3db2a7"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "658aa3c0672f2eb3305b262a7187d0fa7fa2759dccdca196612472a9fcc4fd48"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "df41354c497c8c2514b247c237415d721fb1381bb821c00af59526ba2ef1e8e8"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "f92a63c9f570afd4a9f33b69a441ce057ee4d31359026e9b699f519ae7b8a81a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "041a626ab65e9f61bdc67e664649bc8dc434cc9f89da15611660967a1d156fa3"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.11%2Bk3s1/k3s-images.txt",
-    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.12%2Bk3s1/k3s-images.txt",
+    "sha256": "7a53b3def0199b17de6ec690d13ae2001fb83809258d28d985eafa69869c3aa9"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
index 23ce5c92fc2e..0b1653cd6653 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.30.11+k3s1";
-  k3sCommit = "c2662fbee6d24b3917cf078cbf2ff69cae501340";
-  k3sRepoSha256 = "0zsl5p2dmj3mkcjxbrhsa40r8bhgcrql8r8cxach4nv6y7fcyan5";
-  k3sVendorHash = "sha256-G7RUyFzg3B4X0tdKmD1ep9a4cnVkUmFqBP5t1s8uFLc=";
+  k3sVersion = "1.30.12+k3s1";
+  k3sCommit = "f9dbf16e17a6db90b64583316d9c321180e9c062";
+  k3sRepoSha256 = "0d0kbbf6c6gv2s0w8m7br6vxcid48g8hirmszksd3g4brix3yxz2";
+  k3sVendorHash = "sha256-FQu2Chk463c+/VYcOhfU8xIxm/ZNe1GumkEH/u2DIt0=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
index 2784691c211d..9c0007b99bda 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "2666c3880447979079b94babccf12296706167a5747a0f94962b257bda442449"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "b165c30ccff774f95019f70e200e59d3eea8a3b7fc63c64c07d839c1feb48357"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "6698d8bcfb029f1d16e0f2aa1d53be09d026995d26a0e4bfd92292f49c68538b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "9adfe524ab0bb53d0753dc92759e7f2847e5ce75b88966544da16b5c37605da8"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "0c96ae243b40bb624f9cb34e2851c9cffc77e1ed0127b3e81a2e4a0ff56511a5"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "26ab12d269a619df5d21464e6b1fa539b7c7b2f039737f656683d59eb71f83ac"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.7%2Bk3s1/k3s-images.txt",
-    "sha256": "81328fb53d1dfd0de1fb9663b00fa1dc34a2da242a33e562595fec7b448bdce1"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.8%2Bk3s1/k3s-images.txt",
+    "sha256": "7a53b3def0199b17de6ec690d13ae2001fb83809258d28d985eafa69869c3aa9"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
index a689a6065a33..495e9258de05 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.31.7+k3s1";
-  k3sCommit = "e050ca66d129762a00599628e6f55cfdfab3a7ba";
-  k3sRepoSha256 = "1q531x745ypc08wp43yf0mh0r90gpi6r8bqbmgpvx0nvv9gwn8sb";
-  k3sVendorHash = "sha256-WQPXRwW50/6e1MPnuQCAICROVlrMfARUdHJAgJ7UwQQ=";
+  k3sVersion = "1.31.8+k3s1";
+  k3sCommit = "33429f764d560f617c049e4ebb323c00963419c0";
+  k3sRepoSha256 = "0dpp3gi2g4qqi0szz53j9z06bcgkdzh3c64651d8zjjj151rmhwv";
+  k3sVendorHash = "sha256-vQQGJOFNO2rCJ/UWxWYgH617DctCmTF6eqH7Yq5T+2Q=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index 0e30a88e86ec..fe7dd8574860 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "2c81a3f3527c590180cd71717ea23d83d023669b38439720fdce62fe23543536"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "2c27bf09b90459947dff497ca5028adefa8f8f3d2ae96a3164c11b8a5ed3bb86"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "97ae9c9825844a0fc034b8a4cb35e739cf10991e633ad2a586899d2a5aa6492d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "5a3b7228988bfe725b6bfca0a8cf357dc4fe474ea910663a29d2fe58ab8065c9"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "80423c5023a7d2e3ad65e59293e46a01f5d5679c371a444d76a86b1cd2f474d1"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "3b9131e8f51b9e8b9c1a1ceb5e51ebc245959aa50446def1a4323cf9340dfe0c"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.3%2Bk3s1/k3s-images.txt",
-    "sha256": "11373c7d60ed0db9b761b07b80b66240b426bef0ecc34d6f1ac91cd9d1ff085e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s-images.txt",
+    "sha256": "aa8e10337aef453cb17e6408dbaec9eb2da409ca6ba1f8bc7332fcef97fdaf3a"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index f5aa4ee5a829..976a65943bc3 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.32.3+k3s1";
-  k3sCommit = "079ffa8d99fb859cb8c001455e47efa65535d832";
-  k3sRepoSha256 = "1cvd0668ca06ahhmkhrxwymfpssw75rjfv5n9yajzg1dmkv0cmrv";
-  k3sVendorHash = "sha256-1Kd6gt1envXmzFAtwhjPe9LLsllt2bQ7sryamGcaLRs=";
+  k3sVersion = "1.32.4+k3s1";
+  k3sCommit = "6b330558e47a257134434508c851193bb4e9bf9d";
+  k3sRepoSha256 = "1ss7w5b5k7hjd9szx7p7cqvdqddb71iddqsf6dxkk9r1g5z7sbs5";
+  k3sVendorHash = "sha256-e7uLDjCR/q04HwOHTb1E5gGiwKDN2Hbxmym7qJxfpWU=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 46d911e4efe9..0ca8f3c39bb6 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -12,16 +12,6 @@ let
   extraArgs = builtins.removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_29 = common (
-    (import ./1_29/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "29"
-      ];
-    }
-  ) extraArgs;
-
   k3s_1_30 = common (
     (import ./1_30/versions.nix)
     // {
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 0398121aca90..569a67182844 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -6,6 +6,8 @@
 
 echo "exporting $url (rev $rev) into $out"
 
+runHook preFetch
+
 $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" --name "$name" \
   ${leaveDotGit:+--leave-dotGit} \
   ${fetchLFS:+--fetch-lfs} \
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 5145aa83116f..1da8d2591c5b 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -38,6 +38,11 @@ lib.makeOverridable (
       nonConeMode ? false,
       name ? null,
       nativeBuildInputs ? [ ],
+      # Shell code executed before the file has been fetched.  This, in
+      # particular, can do things like set NIX_PREFETCH_GIT_CHECKOUT_HOOK to
+      # run operations between the checkout completing and deleting the .git
+      # directory.
+      preFetch ? "",
       # Shell code executed after the file has been fetched
       # successfully. This can do things like check or transform the file.
       postFetch ? "",
@@ -75,7 +80,6 @@ lib.makeOverridable (
       server admins start using the new version?
     */
 
-    assert deepClone -> leaveDotGit;
     assert nonConeMode -> (sparseCheckout != [ ]);
 
     let
@@ -130,6 +134,7 @@ lib.makeOverridable (
           deepClone
           branchName
           nonConeMode
+          preFetch
           postFetch
           ;
         rev = revWithTag;
diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index d962a6228f4f..936e7405e049 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -81,7 +81,6 @@ appimageTools.wrapAppImage {
     license = licenses.unfree;
     maintainers = with maintainers; [
       jshcmpbll
-      mjm
       edmundmiller
       zh4ngx
     ];
diff --git a/pkgs/by-name/ch/charliecloud/package.nix b/pkgs/by-name/ch/charliecloud/package.nix
index dd831bd34ebd..f14227833d94 100644
--- a/pkgs/by-name/ch/charliecloud/package.nix
+++ b/pkgs/by-name/ch/charliecloud/package.nix
@@ -13,26 +13,30 @@
   findutils,
   sudo,
   nixosTests,
+  pkg-config,
+  fuse3,
 }:
 
-stdenv.mkDerivation rec {
-
-  version = "0.24";
+stdenv.mkDerivation (finalAttrs: {
   pname = "charliecloud";
+  version = "0.38";
 
   src = fetchFromGitHub {
     owner = "hpc";
     repo = "charliecloud";
-    rev = "v${version}";
-    sha256 = "sha256-kdaVlwE3vdCxsmJTOUwx8J+9UcBuXbKDwS2MHX2ZPPM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mr2Qa1PRTarJ0I8nkH/Xsq8QN3OxOfL8tpl1lL1WV0c=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     makeWrapper
+    pkg-config
   ];
+
   buildInputs = [
     docker
+    fuse3
     (python3.withPackages (ps: [
       ps.lark
       ps.requests
@@ -48,11 +52,12 @@ stdenv.mkDerivation rec {
     in
     [
       "--with-python=${pythonEnv}/bin/python3"
+      "-disable-bundled-lark"
     ];
 
   preConfigure = ''
     patchShebangs test/
-    substituteInPlace configure.ac --replace "/usr/bin/env" "${coreutils}/bin/env"
+    substituteInPlace configure.ac --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
   '';
 
   makeFlags = [
@@ -94,5 +99,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.bzizou ];
     platforms = lib.platforms.linux;
   };
-
-}
+})
diff --git a/pkgs/by-name/cl/clightning/package.nix b/pkgs/by-name/cl/clightning/package.nix
index 0cd9776b4cf2..cdfe44916f55 100644
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "25.02.1";
+  version = "25.02.2";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-0eRLc/bR4sjnNIKzhkX9yVCAoypf1TVhpa884mmVC54=";
+    hash = "sha256-2wp9o1paWJWfxIvm9BDnsKX3GDUXKaPkpB89cwb6Oj8=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool
diff --git a/pkgs/by-name/de/devilutionx/package.nix b/pkgs/by-name/de/devilutionx/package.nix
index bf72f91e1285..a3f8d21ba257 100644
--- a/pkgs/by-name/de/devilutionx/package.nix
+++ b/pkgs/by-name/de/devilutionx/package.nix
@@ -101,7 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = "In order to play this game a copy of diabdat.mpq is required. Place a copy of diabdat.mpq in ~/.local/share/diasurgical/devilution before executing the game.";
     license = lib.licenses.sustainableUse;
     maintainers = with lib.maintainers; [
-      karolchmist
       aanderse
     ];
     platforms = with lib.platforms; linux ++ windows;
diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index 31013115cb09..5d7244f21ba4 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -6,9 +6,9 @@
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "4.24.0";
+  version = "4.25.0";
 
-  nugetHash = "sha256-ERewWqfEyyZKpHFFALpMGJT0fDWywBYY5buU/wTZZTg=";
+  nugetHash = "sha256-1T6cJKODI5Rm6Ze0f7X/Ecdrrn1NulKSnO3lMW73W0M=";
 
   passthru.tests = testers.testVersion {
     package = finalAttrs.finalPackage;
diff --git a/pkgs/by-name/fh/fheroes2/package.nix b/pkgs/by-name/fh/fheroes2/package.nix
index e7f229193b2c..b7d9455064b4 100644
--- a/pkgs/by-name/fh/fheroes2/package.nix
+++ b/pkgs/by-name/fh/fheroes2/package.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
       On linux, the data can be placed in ~/.local/share/fheroes2 folder.
     '';
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.karolchmist ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/go/gotestsum/package.nix b/pkgs/by-name/go/gotestsum/package.nix
index 11a808c00534..e3e3c5927481 100644
--- a/pkgs/by-name/go/gotestsum/package.nix
+++ b/pkgs/by-name/go/gotestsum/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gotestsum";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "gotestyourself";
     repo = "gotestsum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nIdGon14bAaSxUmJNlpLztQVbA8SJ76+Ve46gbM0awk=";
+    hash = "sha256-l4K+8J24egaKS64inQrBWnPLLGBu1W03OUi4WWQoAgs=";
   };
 
-  vendorHash = "sha256-x48jjd6cIX/M8U+5QwrKalt1iLgeQKeJItLJsxXrPgY=";
+  vendorHash = "sha256-SJacdFAdMiKDGLnEEBKnblvHglIBIKf2N20EOFCPs88=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/he/helmsman/package.nix b/pkgs/by-name/he/helmsman/package.nix
index f97fdd7c6192..f214e13d782c 100644
--- a/pkgs/by-name/he/helmsman/package.nix
+++ b/pkgs/by-name/he/helmsman/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.18.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-k/rgQttCA4Ahip9zV+z9zbVSy8NKUTIR4/pluqpP/1c=";
+    sha256 = "sha256-As0YjqMdPCgIzYWB1Wf3R11mwj6CglWZdvCRzlHDvkw=";
   };
 
   subPackages = [ "cmd/helmsman" ];
 
-  vendorHash = "sha256-lIBtKwxdmUIRYifEhrjzHilEsgLIf4Mtq/pa7N/E+NM=";
+  vendorHash = "sha256-A5wFoOvBbjBv4F5Ul91GF9/l+8QXh9Xmmvhk5qNmems=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ku/kubectl-gadget/package.nix b/pkgs/by-name/ku/kubectl-gadget/package.nix
index 680208ed0559..ae5a5c6703c0 100644
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kubectl-gadget";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     rev = "v${version}";
-    hash = "sha256-xG4DVMsV8+ljscmRoDxw3YgdEYki5bcieSmZsCGcDVA=";
+    hash = "sha256-fizq0S2pvhrMwGR/l6yqzq3IXDuD01Abi3VRiNJqs48=";
   };
 
-  vendorHash = "sha256-Ow56GMCAoKnwDMy/FMF4e/hHxA63ycwH+jOZS+vzQwc=";
+  vendorHash = "sha256-zBEb61gxjCRXjdANIHWKVNu5Do+iEmxttKvyiYp8FYQ=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ld/ldc/bootstrap.nix b/pkgs/by-name/ld/ldc/bootstrap.nix
index fcb1f5191de9..3c6f528a5386 100644
--- a/pkgs/by-name/ld/ldc/bootstrap.nix
+++ b/pkgs/by-name/ld/ldc/bootstrap.nix
@@ -14,13 +14,17 @@ let
   OS = if hostPlatform.isDarwin then "osx" else hostPlatform.parsed.kernel.name;
   ARCH =
     if hostPlatform.isDarwin && hostPlatform.isAarch64 then "arm64" else hostPlatform.parsed.cpu.name;
-  version = "1.30.0";
+  # Work around macOS Sequoia 15.4 segfault by downgrading the bootstrap compiler - see:
+  # - https://github.com/NixOS/nixpkgs/issues/398443
+  # - https://github.com/dlang/dmd/issues/21126#issuecomment-2775948553
+  # TODO: Remove this when bootstrap can be upgraded to a fixed version (>= 1.41.0-beta2)?
+  version = if hostPlatform.isDarwin then "1.28.1" else "1.30.0";
   hashes = {
     # Get these from `nix store prefetch-file https://github.com/ldc-developers/ldc/releases/download/v1.19.0/ldc2-1.19.0-osx-x86_64.tar.xz` etc..
-    osx-x86_64 = "sha256-AAWZvxuZC82xvrW6fpYm783TY+H8k3DvqE94ZF1yjmk=";
+    osx-x86_64 = "sha256-mqQ+hNlDePOGX2mwgEEzHGiOAx3SxfNA6x8+ML3qYmw=";
     linux-x86_64 = "sha256-V4TUzEfQhFrwiX07dHOgjdAoGkzausCkhnQIQNAU/eE=";
     linux-aarch64 = "sha256-kTeglub75iv/jWWNPCn15aCGAbmck0RQl6L7bFOUu7Y=";
-    osx-arm64 = "sha256-Nb/owBdIeroB9jLMDvwjo8bvsTC9vFyJPLMTOMsSAd4=";
+    osx-arm64 = "sha256-m93rGywncBnPEWslcrXuGBnZ+Z/mNgLIaevkL/uBOu0=";
   };
 in
 stdenv.mkDerivation {
diff --git a/pkgs/by-name/ld/ldc/package.nix b/pkgs/by-name/ld/ldc/package.nix
index 03f87a50d91c..ca6837771718 100644
--- a/pkgs/by-name/ld/ldc/package.nix
+++ b/pkgs/by-name/ld/ldc/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   callPackage,
   makeWrapper,
   removeReferencesTo,
@@ -44,6 +45,17 @@ stdenv.mkDerivation (finalAttrs: {
   # https://issues.dlang.org/show_bug.cgi?id=19553
   hardeningDisable = [ "fortify" ];
 
+  # Fix output programs segfaulting on macOS Sequoia 15.4 - see:
+  # https://github.com/NixOS/nixpkgs/issues/398443
+  # https://github.com/ldc-developers/ldc/issues/4899
+  # TODO: Remove this when upgrading to a fixed version (>= 1.41.0-beta2)
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ldc-developers/ldc/commit/60079c3b596053b1a70f9f2e0cf38a287089df56.patch";
+      hash = "sha256-Y/5+zt5ou9rzU7rLJq2OqUxMDvC7aSFS6AsPeDxNATQ=";
+    })
+  ];
+
   postPatch =
     ''
       patchShebangs runtime tools tests
diff --git a/pkgs/by-name/mo/mochi/package.nix b/pkgs/by-name/mo/mochi/package.nix
index d3c73f9fa685..22b87f1a4e5d 100644
--- a/pkgs/by-name/mo/mochi/package.nix
+++ b/pkgs/by-name/mo/mochi/package.nix
@@ -10,14 +10,14 @@
 
 let
   pname = "mochi";
-  version = "1.18.7";
+  version = "1.18.11";
 
   linux = appimageTools.wrapType2 rec {
     inherit pname version meta;
 
     src = fetchurl {
       url = "https://mochi.cards/releases/Mochi-${version}.AppImage";
-      hash = "sha256-FCh8KLnvs26GKTVJY4Tqp+iA8sNlK7e0rv+oywBIF+U=";
+      hash = "sha256-NQ591KtWQz8hlXPhV83JEwGm+Au26PIop5KVzsyZKp4=";
     };
 
     appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -37,7 +37,7 @@ let
 
     src = fetchzip {
       url = "https://mochi.cards/releases/Mochi-${version}.dmg";
-      hash = "sha256-W3JqEPF8iCiXlKqjPoFcm7lP+n3lN4XBeAQdBEWvy8s=";
+      hash = "sha256-5RM4eqHQoYfO5JiUH9ol+3XxOk4VX4ocE3Yia82sovI=";
       stripRoot = false;
       nativeBuildInputs = [ _7zz ];
     };
diff --git a/pkgs/by-name/mo/monero-cli/package.nix b/pkgs/by-name/mo/monero-cli/package.nix
index 0ad489b74309..2fddc205709d 100644
--- a/pkgs/by-name/mo/monero-cli/package.nix
+++ b/pkgs/by-name/mo/monero-cli/package.nix
@@ -19,7 +19,7 @@
   trezorSupport ? true,
   hidapi,
   libusb1,
-  protobuf,
+  protobuf_21,
   udev,
 }:
 
@@ -40,22 +40,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "monero-cli";
-  version = "0.18.3.4";
+  version = "0.18.4.0";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    hash = "sha256-nDiFJjhsISYM8kTgJUaPYL44iyccnz5+Pd5beBh+lsM=";
+    hash = "sha256-0byMtX2f+8FqNhLPN1oLxIUTWg5RSbHfwiL8pUIAcgQ=";
   };
 
   patches = [
     ./use-system-libraries.patch
-    # https://github.com/monero-project/monero/pull/9462
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/65568d3a884857ce08d1170f5801a6891a5c187c.patch?full_index=1";
-      hash = "sha256-Btuy69y02UyVMmsOiCRPZhM7qW5+FRNujOZjNMRdACQ=";
-    })
   ];
 
   postPatch = ''
@@ -88,7 +83,7 @@ stdenv.mkDerivation rec {
       python3
       hidapi
       libusb1
-      protobuf
+      protobuf_21
     ]
     ++ lib.optionals (trezorSupport && stdenv.hostPlatform.isLinux) [ udev ];
 
@@ -99,6 +94,7 @@ stdenv.mkDerivation rec {
       # required by monero-gui
       "-DBUILD_GUI_DEPS=ON"
       "-DReadline_ROOT_DIR=${readline.dev}"
+      "-Wno-dev"
     ]
     ++ lib.optional stdenv.hostPlatform.isDarwin "-DBoost_USE_MULTITHREADED=OFF"
     ++ lib.optional trezorSupport [
diff --git a/pkgs/by-name/mo/monero-cli/use-system-libraries.patch b/pkgs/by-name/mo/monero-cli/use-system-libraries.patch
index adb41fb4ac25..33dc84018bcb 100644
--- a/pkgs/by-name/mo/monero-cli/use-system-libraries.patch
+++ b/pkgs/by-name/mo/monero-cli/use-system-libraries.patch
@@ -1,8 +1,8 @@
 diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index 5b7f69a56..cc4b0a346 100644
+index 538e4d215..cc4b0a346 100644
 --- a/external/CMakeLists.txt
 +++ b/external/CMakeLists.txt
-@@ -35,25 +35,14 @@
+@@ -35,26 +35,14 @@
  # ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
  # others.
  
@@ -10,6 +10,7 @@ index 5b7f69a56..cc4b0a346 100644
 -
 -message(STATUS "Using in-tree miniupnpc")
 -set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
+-set(UPNPC_BUILD_SHARED OFF CACHE BOOL "Disable building shared library" FORCE)
 -add_subdirectory(miniupnp/miniupnpc)
 -set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
 -set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
@@ -34,13 +35,13 @@ index 5b7f69a56..cc4b0a346 100644
  
  if(NOT UNBOUND_INCLUDE_DIR)
    die("Could not find libunbound")
-@@ -69,4 +58,3 @@ endif()
+@@ -70,4 +58,3 @@ endif()
  add_subdirectory(db_drivers)
  add_subdirectory(easylogging++)
  add_subdirectory(qrcodegen)
 -add_subdirectory(randomx EXCLUDE_FROM_ALL)
 diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
-index 71f5393e8..bb48083d0 100644
+index 884a7b5fc..24c10334e 100644
 --- a/src/p2p/net_node.inl
 +++ b/src/p2p/net_node.inl
 @@ -60,9 +60,9 @@
diff --git a/pkgs/applications/blockchains/monero-gui/move-log-file.patch b/pkgs/by-name/mo/monero-gui/move-log-file.patch
similarity index 100%
rename from pkgs/applications/blockchains/monero-gui/move-log-file.patch
rename to pkgs/by-name/mo/monero-gui/move-log-file.patch
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/by-name/mo/monero-gui/package.nix
similarity index 83%
rename from pkgs/applications/blockchains/monero-gui/default.nix
rename to pkgs/by-name/mo/monero-gui/package.nix
index 790f691b79b2..d1683b09a684 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/by-name/mo/monero-gui/package.nix
@@ -10,47 +10,38 @@
   miniupnpc,
   monero-cli,
   pkg-config,
-  qtbase,
-  qtdeclarative,
-  qtgraphicaleffects,
-  qtmacextras,
-  qtmultimedia,
-  qtquickcontrols,
-  qtquickcontrols2,
-  qttools,
-  qtxmlpatterns,
+  qt5,
   quirc,
   randomx,
   rapidjson,
   stdenv,
   unbound,
-  wrapQtAppsHook,
   zeromq,
 
   trezorSupport ? true,
   hidapi,
   libusb1,
-  protobuf,
+  protobuf_21,
   python3,
   udev,
 }:
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.18.3.4";
+  version = "0.18.4.0";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero-gui";
     rev = "v${version}";
-    hash = "sha256-wnU24EmZig2W/psy4OhaQVy2WwR0CgljlyYwOg4bzwM=";
+    hash = "sha256-JwYx5TjGp3VPPSgjN0+w1A4RoZGm7A73Gpg44fre1/c=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapQtAppsHook
-    (lib.getDev qttools)
+    qt5.wrapQtAppsHook
+    (lib.getDev qt5.qttools)
   ];
 
   buildInputs =
@@ -60,24 +51,24 @@ stdenv.mkDerivation rec {
       libgpg-error
       libsodium
       miniupnpc
-      qtbase
-      qtdeclarative
-      qtgraphicaleffects
-      qtmultimedia
-      qtquickcontrols
-      qtquickcontrols2
-      qtxmlpatterns
+      qt5.qtbase
+      qt5.qtdeclarative
+      qt5.qtgraphicaleffects
+      qt5.qtmultimedia
+      qt5.qtquickcontrols
+      qt5.qtquickcontrols2
+      qt5.qtxmlpatterns
       quirc
       randomx
       rapidjson
       unbound
       zeromq
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ qtmacextras ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ qt5.qtmacextras ]
     ++ lib.optionals trezorSupport [
       hidapi
       libusb1
-      protobuf
+      protobuf_21
       python3
     ]
     ++ lib.optionals (trezorSupport && stdenv.hostPlatform.isLinux) [
diff --git a/pkgs/applications/blockchains/monero-gui/use-system-libquirc.patch b/pkgs/by-name/mo/monero-gui/use-system-libquirc.patch
similarity index 100%
rename from pkgs/applications/blockchains/monero-gui/use-system-libquirc.patch
rename to pkgs/by-name/mo/monero-gui/use-system-libquirc.patch
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 7ad9eb5a8d5b..41f5d202f377 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.11.1";
+  version = "2.11.3";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KzZYaxpfTUgOHeuG9mddbmab5jDbEjxkB8IGLKr4W1Q=";
+    hash = "sha256-Z4EBXWUtBzW65ONvt94sKzVDHw8qVz2cR5qewUm5nXI=";
   };
 
-  vendorHash = "sha256-CvxAP35/hinewnNhrW9urI0J3DI5QfZybbyRbz9Ol4s=";
+  vendorHash = "sha256-uCNTUfYfMDjgM3RXsgAIzIFSuoHOCVks8aBR58RlU6Q=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index d6f2a91f72f1..fb98f42c403e 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.29.5";
+  version = "1.29.6";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-x6/hPW8sD/wwgjlA6+Cz3t3c7KICD/bhzz5yfks/In8=";
+    hash = "sha256-h5M6OZ22/fb6sI536/+n164jHgxQD5Z1ds2dcDj1IjI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/no/noseyparker/package.nix b/pkgs/by-name/no/noseyparker/package.nix
index 95ea63774953..d59e4e355b2a 100644
--- a/pkgs/by-name/no/noseyparker/package.nix
+++ b/pkgs/by-name/no/noseyparker/package.nix
@@ -5,7 +5,7 @@
   boost,
   cmake,
   git,
-  hyperscan,
+  vectorscan,
   openssl,
   pkg-config,
 }:
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [
     boost
-    hyperscan
+    vectorscan
     openssl
   ];
 
@@ -59,7 +59,5 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/praetorian-inc/noseyparker/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ _0x4A6F ];
-    # limited by hyperscan
-    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/by-name/os/ossia-score/package.nix b/pkgs/by-name/os/ossia-score/package.nix
index 5d4b1e9358af..e733aef67387 100644
--- a/pkgs/by-name/os/ossia-score/package.nix
+++ b/pkgs/by-name/os/ossia-score/package.nix
@@ -44,13 +44,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "ossia-score";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "ossia";
     repo = "score";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-f4n1EPOAAAWyHJvbA2xF1ZpOd9sjo4NWG73EaDik78Q=";
+    hash = "sha256-pm+CB1DMO5iyXzt4XR1OQUyTr37R007a64AHDbecJk0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pr/pre-commit/package.nix b/pkgs/by-name/pr/pre-commit/package.nix
index 8c3b9aca06e6..5bee2ddd0c3e 100644
--- a/pkgs/by-name/pr/pre-commit/package.nix
+++ b/pkgs/by-name/pr/pre-commit/package.nix
@@ -197,6 +197,11 @@ buildPythonApplication rec {
     "pre_commit"
   ];
 
+  # add gitMinimal as fallback, if git is not installed
+  preFixup = ''
+    makeWrapperArgs+=(--suffix PATH : ${lib.makeBinPath [ gitMinimal ]})
+  '';
+
   passthru.tests = callPackage ./tests.nix {
     inherit gitMinimal pre-commit;
   };
diff --git a/pkgs/by-name/pr/prefect/package.nix b/pkgs/by-name/pr/prefect/package.nix
index 239bb1fa8c28..5378da18d94c 100644
--- a/pkgs/by-name/pr/prefect/package.nix
+++ b/pkgs/by-name/pr/prefect/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "prefect";
-  version = "3.3.5";
+  version = "3.4.0";
   pyproject = true;
 
   # Trying to install from source is challenging
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   # Source will be missing sdist, uv.lock, ui artefacts ...
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L5L1ldEpOHJPE9K8UPvpUZlF/85mm5llN912LIlvs9k=";
+    hash = "sha256-uguh6sOIy0mOASFsw8ADb8vpmQm7S+t4ZS/6MFFYiic=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/pr/process-compose/package.nix b/pkgs/by-name/pr/process-compose/package.nix
index e88658dcb0bb..c0f717f787a0 100644
--- a/pkgs/by-name/pr/process-compose/package.nix
+++ b/pkgs/by-name/pr/process-compose/package.nix
@@ -10,13 +10,13 @@ let
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "1.46.0";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-E7ovd/dNSMxVld7CS4ZjxZxUVDXLuoQR7W4ZZ1cPMP0=";
+    hash = "sha256-FnxpaaZLpYMqLGXv/9HP3jh0DuujXoDH2H+omRzgeyQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -45,7 +45,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-pztub6PsHhF56ks4UFG9u/mGrvKFUZi+7EudpP9DVYE=";
+  vendorHash = "sha256-4ktj2mRSrY81xvQJd76jo9WJw/ohHXypWuSANp9C+6U=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/pr/proksi/package.nix b/pkgs/by-name/pr/proksi/package.nix
index f60a31829f2e..eaa6f88b7f8f 100644
--- a/pkgs/by-name/pr/proksi/package.nix
+++ b/pkgs/by-name/pr/proksi/package.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "proksi";
-  version = "0.5.3";
+  version = "0.5.3-unstable-2025-05-05";
 
   src = fetchFromGitHub {
     owner = "luizfonseca";
     repo = "proksi";
-    tag = "proksi-v${finalAttrs.version}";
-    hash = "sha256-zwLF6yL/EqyBtZ+hHXLJRe2UaZyhSzotEFYlpoLXKZ4=";
+    rev = "d0d95bd0bc142fafbe095248597a057524ff0721";
+    hash = "sha256-D+MS7Y7aKlgAY7T2vq+rayZ8fjP+98gGJrF5qLvH37Q=";
   };
 
   postPatch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vFZUcHh/gI4fdlM6LcN+6kjweLUnPNYNq6Y+XxWoSl8=";
+  cargoHash = "sha256-HEwtaERPw6llwhXPgifrtuO1fjV1gCEuH80PaIukp6Q=";
 
   nativeBuildInputs = [
     pkg-config
@@ -61,11 +61,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
+  # remove after updating to the next stable version
+  preVersionCheck = ''
+    export version=0.5.3
+  '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [
-      "--version-regex"
-      "proksi-v(.*)"
+      "--version=branch"
+      "--version-regex=proksi-v(.*)"
     ];
   };
 
diff --git a/pkgs/by-name/sm/smpq/package.nix b/pkgs/by-name/sm/smpq/package.nix
index e32f27e6fd63..817b2077d04b 100644
--- a/pkgs/by-name/sm/smpq/package.nix
+++ b/pkgs/by-name/sm/smpq/package.nix
@@ -32,7 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "smpq";
     maintainers = with lib.maintainers; [
       aanderse
-      karolchmist
     ];
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/st/stormlib/package.nix b/pkgs/by-name/st/stormlib/package.nix
index 55b1badd1c83..cf7f4d7ebcf2 100644
--- a/pkgs/by-name/st/stormlib/package.nix
+++ b/pkgs/by-name/st/stormlib/package.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       aanderse
-      karolchmist
     ];
     platforms = lib.platforms.all;
     broken = stdenv.hostPlatform.isDarwin; # installation directory mismatch
diff --git a/pkgs/by-name/ti/tilem/gcc14-fix.patch b/pkgs/by-name/ti/tilem/gcc14-fix.patch
new file mode 100644
index 000000000000..f1ef81e57cd6
--- /dev/null
+++ b/pkgs/by-name/ti/tilem/gcc14-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/gui/macro.c b/gui/macro.c
+index ae8db8b..226d48f 100644
+--- a/gui/macro.c
++++ b/gui/macro.c
+@@ -86,7 +86,7 @@ void tilem_macro_add_action(TilemMacro* macro, int type, char * value) {
+ 	macro->actions = tilem_macro_actions_new(macro, n + 1);
+ 
+ 	/* Then we need to save the action */	
+-	macro->actions[n] =  g_new(char, strlen(value)); /* FIXME : gcc says : "assignment from incompatible pointer type" ??? */
++	macro->actions[n] =  g_new(TilemMacroAtom, 1); /* FIXME : gcc says : "assignment from incompatible pointer type" ??? */
+ 	macro->actions[n]->value = g_strdup(value);
+ 	macro->actions[n]->type = type;
+ 	macro->n++;
diff --git a/pkgs/by-name/ti/tilem/package.nix b/pkgs/by-name/ti/tilem/package.nix
index 400bcd36923e..a5caea4922cc 100644
--- a/pkgs/by-name/ti/tilem/package.nix
+++ b/pkgs/by-name/ti/tilem/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
     libticables2
     libticalcs2
   ];
+  patches = [ ./gcc14-fix.patch ];
   env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
   meta = with lib; {
     homepage = "http://lpg.ticalc.org/prj_tilem/";
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index 484eb79e038b..98abd0cd17e3 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "ytdl-sub";
-  version = "2025.04.18";
+  version = "2025.05.05";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = version;
-    hash = "sha256-TaZS9kaBcl6F1CvP8q4pGcZE1b1dAf1qnXHjfM/AFWg=";
+    hash = "sha256-zLYP3iGbTcWuffed7o5RuoYjlUvVFRt8FUOhL1vbW/U=";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/lxqt/lxqt-policykit/default.nix b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
index 30aff45ade87..3885ba8b2538 100644
--- a/pkgs/desktops/lxqt/lxqt-policykit/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
@@ -7,7 +7,6 @@
   liblxqt,
   libqtxdg,
   lxqt-build-tools,
-  pcre,
   pkg-config,
   polkit,
   polkit-qt-1,
@@ -42,7 +41,6 @@ stdenv.mkDerivation rec {
     kwindowsystem
     liblxqt
     libqtxdg
-    pcre
     polkit
     polkit-qt-1
     qtbase
diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index 0c47e1bc7975..444d483aefdf 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "8.1.0";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    hash = "sha256-jVMXSy83z4zaG1YtCPRGvj1yl6wa5MJYtNp4XIsIY1k=";
+    hash = "sha256-dginzwQrzcgnVdRO54cGPVh6+yVx0zLsFeeAVhxWFnE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/scala/bare.nix b/pkgs/development/compilers/scala/bare.nix
index d3e79fdde206..a8e74ed19767 100644
--- a/pkgs/development/compilers/scala/bare.nix
+++ b/pkgs/development/compilers/scala/bare.nix
@@ -43,7 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = platforms.all;
     mainProgram = "scala";
     maintainers = with maintainers; [
-      karolchmist
       virusdave
       kashw2
       natsukagami
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index c5e5cf18eed5..1943a92bbd6b 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -129,8 +129,8 @@ stdenv.mkDerivation (
     ];
 
     env = {
-      # only build shell/IDE docs and man pages
-      DOC_TARGETS = "chunks man";
+      # only build man pages and shell/IDE docs
+      DOC_TARGETS = "man chunks";
     };
 
     buildInputs =
diff --git a/pkgs/development/python-modules/aiohttp-client-cache/default.nix b/pkgs/development/python-modules/aiohttp-client-cache/default.nix
index e7e1812db0ff..23e833ac89ed 100644
--- a/pkgs/development/python-modules/aiohttp-client-cache/default.nix
+++ b/pkgs/development/python-modules/aiohttp-client-cache/default.nix
@@ -14,22 +14,19 @@
   poetry-core,
   pytest-aiohttp,
   pytestCheckHook,
-  pythonOlder,
   redis,
   url-normalize,
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp-client-cache";
-  version = "0.12.4";
+  version = "0.13.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     pname = "aiohttp_client_cache";
     inherit version;
-    hash = "sha256-5g/oFhNrWx1m87trJyq4HZeFTqHk2bVwhaNgQmln0mU=";
+    hash = "sha256-3FzWI0CtvuGOD+3HsMN1Qmkt8I+O2ZRddRtykqBDOFM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/async-lru/default.nix b/pkgs/development/python-modules/async-lru/default.nix
index fcf7ef5207f4..e86fa73e88e4 100644
--- a/pkgs/development/python-modules/async-lru/default.nix
+++ b/pkgs/development/python-modules/async-lru/default.nix
@@ -3,40 +3,41 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+  setuptools,
   typing-extensions,
   pytestCheckHook,
   pytest-asyncio,
+  pytest-cov-stub,
+  pytest-timeout,
 }:
 
 buildPythonPackage rec {
   pname = "async-lru";
-  version = "2.0.4";
-
-  disabled = pythonOlder "3.8";
-
-  format = "setuptools";
+  version = "2.0.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "async-lru";
     tag = "v${version}";
-    hash = "sha256-S2sOkgtS+YdMtVP7UHD3+oR8Fem8roLhhgVVfh33PcM=";
+    hash = "sha256-FJ1q6W9IYs0OSMZc+bI4v22hOAAWAv2OW3BAqixm8Hs=";
   };
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [ typing-extensions ];
+  build-system = [ setuptools ];
 
-  postPatch = ''
-    sed -i -e '/^addopts/d' -e '/^filterwarnings/,+2d' setup.cfg
-  '';
+  dependencies = lib.optionals (pythonOlder "3.11") [ typing-extensions ];
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
+    pytest-cov-stub
+    pytest-timeout
   ];
 
   pythonImportsCheck = [ "async_lru" ];
 
   meta = with lib; {
+    changelog = "https://github.com/aio-libs/async-lru/releases/tag/${src.tag}";
     description = "Simple lru cache for asyncio";
     homepage = "https://github.com/wikibusiness/async_lru";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/blocksat-cli/default.nix b/pkgs/development/python-modules/blocksat-cli/default.nix
index c283bdd70d81..c0d8fefe68d7 100644
--- a/pkgs/development/python-modules/blocksat-cli/default.nix
+++ b/pkgs/development/python-modules/blocksat-cli/default.nix
@@ -29,6 +29,12 @@ buildPythonPackage rec {
     hash = "sha256-7lSK9IGu/K03xSDxZv+BSTJwLrQoHs+POBq/ixYTVR4=";
   };
 
+  # Upstream setup.py installs both the CLI and GUI versions.
+  # To pull only the required dependencyes, either setup_cli.py or setup_gui.py should be used.
+  postPatch = ''
+    mv setup_cli.py setup.py
+  '';
+
   pythonRelaxDeps = [ "pyasyncore" ];
 
   build-system = [ setuptools ];
@@ -48,8 +54,13 @@ buildPythonPackage rec {
     "test_monitor_get_stats"
     "test_monitor_update_with_reporting_enabled"
     "test_erasure_recovery"
+    # Non-NixOS package managers are not present in the build environment.
+    "test_parse_upgradable_list_apt"
+    "test_parse_upgradable_list_dnf"
   ];
 
+  disabledTestPaths = [ "blocksatgui/tests/" ];
+
   pythonImportsCheck = [ "blocksatcli" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyisy/default.nix b/pkgs/development/python-modules/pyisy/default.nix
index 210704420c69..297fbb1b5cb9 100644
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyisy";
-  version = "3.4.0";
+  version = "3.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "automicus";
     repo = "PyISY";
     tag = "v${version}";
-    hash = "sha256-rXSkDG7AK8+r4x3ttk7GJw1hH+xLLVx0gTGK0PvQNfE=";
+    hash = "sha256-9gGrrFh5xCuX4GjF6a6RRGkpF/rH07Zz0nyKvgwgEkU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sphinx-autoapi/default.nix b/pkgs/development/python-modules/sphinx-autoapi/default.nix
index a600c758f336..5baa2f0cd3a2 100644
--- a/pkgs/development/python-modules/sphinx-autoapi/default.nix
+++ b/pkgs/development/python-modules/sphinx-autoapi/default.nix
@@ -68,6 +68,6 @@ buildPythonPackage rec {
       import the project being documented.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ karolchmist ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/url-normalize/default.nix b/pkgs/development/python-modules/url-normalize/default.nix
index b914c8ae61eb..d800fb80b7a4 100644
--- a/pkgs/development/python-modules/url-normalize/default.nix
+++ b/pkgs/development/python-modules/url-normalize/default.nix
@@ -2,58 +2,42 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  poetry-core,
-  pytest-flakes,
-  pytest-mock,
+  idna,
+  pytest-cov-stub,
   pytest-socket,
   pytestCheckHook,
-  six,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "url-normalize";
-  version = "1.4.3";
-  format = "pyproject";
+  version = "2.2.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "niksite";
-    repo = pname;
-    rev = version;
-    hash = "sha256-WE3MM9B/voI23taFbLp2FYhl0uxOfuUWsaCTBG1hyiY=";
+    repo = "url-normalize";
+    tag = "v${version}";
+    hash = "sha256-ZFY1KMEHvteMFVM3QcYjCiTz3dLxRWyv/dZQMzVxGvo=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ six ];
+  dependencies = [ idna ];
 
   nativeCheckInputs = [
-    pytest-flakes
-    pytest-mock
+    pytest-cov-stub
     pytest-socket
     pytestCheckHook
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/niksite/url-normalize/pull/28
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/niksite/url-normalize/commit/b8557b10c977b191cc9d37e6337afe874a24ad08.patch";
-      hash = "sha256-SVCQATV9V6HbLmjOHs7V7eBagO0PuqZLubIJghBYfQQ=";
-    })
-  ];
-
-  postPatch = ''
-    sed -i "/--cov/d" tox.ini
-    sed -i "/--flakes/d" tox.ini
-  '';
-
   pythonImportsCheck = [ "url_normalize" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/niksite/url-normalize/blob/${src.tag}/CHANGELOG.md";
     description = "URL normalization for Python";
     homepage = "https://github.com/niksite/url-normalize";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 5edbe112a8f1..92970af95b55 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.15-rc4",
-        "hash": "sha256:0zg817b9bbpl80cjmxgmxivi6xr80hng704mdl6m5knrl0v4ay5j"
+        "version": "6.15-rc5",
+        "hash": "sha256:158bpvdbgaknywz4wh3k72qf85p5n3szk5h74cnpya8ic5z5qpmb"
     },
     "6.1": {
         "version": "6.1.136",
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 0f924e135aae..69dc64712451 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -220,18 +220,6 @@ stdenv.mkDerivation {
         ./nix-etag-1.15.4.patch
         ./nix-skip-check-logs-path.patch
       ]
-      ++
-        lib.optionals
-          (lib.elem pname [
-            "nginx"
-            "nginxQuic"
-            "tengine"
-          ])
-          [
-            # https://github.com/NixOS/nixpkgs/issues/357522
-            # https://github.com/zlib-ng/patches/blob/5a036c0a00120c75ee573b27f4f44ade80d82ff2/nginx/README.md
-            ./nginx-zlib-ng.patch
-          ]
       ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
         (fetchpatch {
           url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/102-sizeof_test_fix.patch";
diff --git a/pkgs/servers/http/nginx/nginx-zlib-ng.patch b/pkgs/servers/http/nginx/nginx-zlib-ng.patch
deleted file mode 100644
index 0bda52411390..000000000000
--- a/pkgs/servers/http/nginx/nginx-zlib-ng.patch
+++ /dev/null
@@ -1,271 +0,0 @@
---- a/auto/lib/zlib/conf
-+++ b/auto/lib/zlib/conf
-@@ -33,8 +33,8 @@ if [ $ZLIB != NONE ]; then
- 
-         *)
-             have=NGX_ZLIB . auto/have
--            LINK_DEPS="$LINK_DEPS $ZLIB/libz.a"
--            CORE_LIBS="$CORE_LIBS $ZLIB/libz.a"
-+            LINK_DEPS="$LINK_DEPS $ZLIB/libz-ng.a"
-+            CORE_LIBS="$CORE_LIBS $ZLIB/libz-ng.a"
-             #CORE_LIBS="$CORE_LIBS -L $ZLIB -lz"
-         ;;
- 
-@@ -50,10 +50,10 @@ else
-         ngx_feature="zlib library"
-         ngx_feature_name="NGX_ZLIB"
-         ngx_feature_run=no
--        ngx_feature_incs="#include <zlib.h>"
-+        ngx_feature_incs="#include <zlib-ng.h>"
-         ngx_feature_path=
--        ngx_feature_libs="-lz"
--        ngx_feature_test="z_stream z; deflate(&z, Z_NO_FLUSH)"
-+        ngx_feature_libs="-lz-ng"
-+        ngx_feature_test="zng_stream z; zng_deflate(&z, Z_NO_FLUSH)"
-         . auto/feature
- 
- 
-diff --git a/src/core/ngx_config.h b/src/core/ngx_config.h
-index 1861be6..bd427b8 100644
---- a/src/core/ngx_config.h
-+++ b/src/core/ngx_config.h
-@@ -141,5 +141,9 @@ typedef intptr_t        ngx_flag_t;
- 
- #endif
- 
-+/* Force enable ZLIB-NG */
-+#ifndef NGX_ZLIB_NG
-+#define NGX_ZLIB_NG 1
-+#endif
- 
- #endif /* _NGX_CONFIG_H_INCLUDED_ */
-diff --git a/src/http/modules/ngx_http_gunzip_filter_module.c b/src/http/modules/ngx_http_gunzip_filter_module.c
-index 5d170a1..d8dcc96 100644
---- a/src/http/modules/ngx_http_gunzip_filter_module.c
-+++ b/src/http/modules/ngx_http_gunzip_filter_module.c
-@@ -10,7 +10,14 @@
- #include <ngx_core.h>
- #include <ngx_http.h>
- 
--#include <zlib.h>
-+#if defined(NGX_ZLIB_NG)
-+# include <zlib-ng.h>
-+# define ZPREFIX(x) zng_ ## x
-+# define z_stream zng_stream
-+#elif defined(NGX_ZLIB)
-+# include <zlib.h>
-+# define ZPREFIX(x) x
-+#endif
- 
- 
- typedef struct {
-@@ -312,7 +319,7 @@ ngx_http_gunzip_filter_inflate_start(ngx_http_request_t *r,
-     ctx->zstream.opaque = ctx;
- 
-     /* windowBits +16 to decode gzip, zlib 1.2.0.4+ */
--    rc = inflateInit2(&ctx->zstream, MAX_WBITS + 16);
-+    rc = ZPREFIX(inflateInit2)(&ctx->zstream, MAX_WBITS + 16);
- 
-     if (rc != Z_OK) {
-         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
-@@ -435,7 +442,7 @@ ngx_http_gunzip_filter_inflate(ngx_http_request_t *r,
-                    ctx->zstream.avail_in, ctx->zstream.avail_out,
-                    ctx->flush, ctx->redo);
- 
--    rc = inflate(&ctx->zstream, ctx->flush);
-+    rc = ZPREFIX(inflate)(&ctx->zstream, ctx->flush);
- 
-     if (rc != Z_OK && rc != Z_STREAM_END && rc != Z_BUF_ERROR) {
-         ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
-@@ -533,7 +540,7 @@ ngx_http_gunzip_filter_inflate(ngx_http_request_t *r,
- 
-     if (rc == Z_STREAM_END && ctx->zstream.avail_in > 0) {
- 
--        rc = inflateReset(&ctx->zstream);
-+        rc = ZPREFIX(inflateReset)(&ctx->zstream);
- 
-         if (rc != Z_OK) {
-             ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
-@@ -584,7 +591,7 @@ ngx_http_gunzip_filter_inflate_end(ngx_http_request_t *r,
-     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                    "gunzip inflate end");
- 
--    rc = inflateEnd(&ctx->zstream);
-+    rc = ZPREFIX(inflateEnd)(&ctx->zstream);
- 
-     if (rc != Z_OK) {
-         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
-diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
-index 7113df6..d6c2ea1 100644
---- a/src/http/modules/ngx_http_gzip_filter_module.c
-+++ b/src/http/modules/ngx_http_gzip_filter_module.c
-@@ -9,7 +9,14 @@
- #include <ngx_core.h>
- #include <ngx_http.h>
- 
--#include <zlib.h>
-+#if defined(NGX_ZLIB_NG)
-+# include <zlib-ng.h>
-+# define ZPREFIX(x) zng_ ## x
-+# define z_stream zng_stream
-+#elif defined(NGX_ZLIB)
-+# include <zlib.h>
-+# define ZPREFIX(x) x
-+#endif
- 
- 
- typedef struct {
-@@ -454,7 +461,7 @@ failed:
-     ctx->done = 1;
- 
-     if (ctx->preallocated) {
--        deflateEnd(&ctx->zstream);
-+        ZPREFIX(deflateEnd)(&ctx->zstream);
- 
-         ngx_pfree(r->pool, ctx->preallocated);
-     }
-@@ -527,10 +534,20 @@ ngx_http_gzip_filter_memory(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
-             wbits = ngx_max(wbits, 13);
-         }
- 
--        ctx->allocated = 8192 + 16 + (1 << (wbits + 2))
--                         + 131072 + (5 << (memlevel + 6))
--                         + 4 * (64 + sizeof(void*));
-         ctx->zlib_ng = 1;
-+        ctx->allocated = 6144 // State
-+                         + 65536 // Window
-+                         + 65536 // Prev
-+                         + 131072 // Head
-+                         + 163840 // Pending
-+                         + 56 + 8 // Alloc struct + padding
-+#if (defined(__s390__) || defined(__s390x__) || defined(__zarch__))
-+                         + 4096 // Required to fix allocation alignment
-+#else
-+                         + 64 // Required to fix allocation alignment
-+#endif
-+                         + 256; // Extra to allow for future changes
-+
-     }
- }
- 
-@@ -623,7 +640,7 @@ ngx_http_gzip_filter_deflate_start(ngx_http_request_t *r,
-     ctx->zstream.zfree = ngx_http_gzip_filter_free;
-     ctx->zstream.opaque = ctx;
- 
--    rc = deflateInit2(&ctx->zstream, (int) conf->level, Z_DEFLATED,
-+    rc = ZPREFIX(deflateInit2)(&ctx->zstream, (int) conf->level, Z_DEFLATED,
-                       ctx->wbits + 16, ctx->memlevel, Z_DEFAULT_STRATEGY);
- 
-     if (rc != Z_OK) {
-@@ -758,7 +775,7 @@ ngx_http_gzip_filter_deflate(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
-                  ctx->zstream.avail_in, ctx->zstream.avail_out,
-                  ctx->flush, ctx->redo);
- 
--    rc = deflate(&ctx->zstream, ctx->flush);
-+    rc = ZPREFIX(deflate)(&ctx->zstream, ctx->flush);
- 
-     if (rc != Z_OK && rc != Z_STREAM_END && rc != Z_BUF_ERROR) {
-         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
-@@ -882,7 +899,7 @@ ngx_http_gzip_filter_deflate_end(ngx_http_request_t *r,
-     ctx->zin = ctx->zstream.total_in;
-     ctx->zout = ctx->zstream.total_out;
- 
--    rc = deflateEnd(&ctx->zstream);
-+    rc = ZPREFIX(deflateEnd)(&ctx->zstream);
- 
-     if (rc != Z_OK) {
-         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
-diff --git a/src/http/modules/ngx_http_log_module.c b/src/http/modules/ngx_http_log_module.c
-index f7c4bd2..ad71d4d 100644
---- a/src/http/modules/ngx_http_log_module.c
-+++ b/src/http/modules/ngx_http_log_module.c
-@@ -9,8 +9,13 @@
- #include <ngx_core.h>
- #include <ngx_http.h>
- 
--#if (NGX_ZLIB)
--#include <zlib.h>
-+#if defined(NGX_ZLIB_NG)
-+# include <zlib-ng.h>
-+# define ZPREFIX(x) zng_ ## x
-+# define z_stream zng_stream
-+#elif defined(NGX_ZLIB)
-+# include <zlib.h>
-+# define ZPREFIX(x) x
- #endif
- 
- 
-@@ -634,7 +639,7 @@ ngx_http_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
-     zstream.next_out = out;
-     zstream.avail_out = size;
- 
--    rc = deflateInit2(&zstream, (int) level, Z_DEFLATED, wbits + 16, memlevel,
-+    rc = ZPREFIX(deflateInit2)(&zstream, (int) level, Z_DEFLATED, wbits + 16, memlevel,
-                       Z_DEFAULT_STRATEGY);
- 
-     if (rc != Z_OK) {
-@@ -647,7 +652,7 @@ ngx_http_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
-                    zstream.next_in, zstream.next_out,
-                    zstream.avail_in, zstream.avail_out);
- 
--    rc = deflate(&zstream, Z_FINISH);
-+    rc = ZPREFIX(deflate)(&zstream, Z_FINISH);
- 
-     if (rc != Z_STREAM_END) {
-         ngx_log_error(NGX_LOG_ALERT, log, 0,
-@@ -663,7 +668,7 @@ ngx_http_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
- 
-     size -= zstream.avail_out;
- 
--    rc = deflateEnd(&zstream);
-+    rc = ZPREFIX(deflateEnd)(&zstream);
- 
-     if (rc != Z_OK) {
-         ngx_log_error(NGX_LOG_ALERT, log, 0, "deflateEnd() failed: %d", rc);
-diff --git a/src/stream/ngx_stream_log_module.c b/src/stream/ngx_stream_log_module.c
-index 0ff7f42..0b9d12c 100644
---- a/src/stream/ngx_stream_log_module.c
-+++ b/src/stream/ngx_stream_log_module.c
-@@ -9,8 +9,13 @@
- #include <ngx_core.h>
- #include <ngx_stream.h>
- 
--#if (NGX_ZLIB)
--#include <zlib.h>
-+#if defined(NGX_ZLIB_NG)
-+# include <zlib-ng.h>
-+# define ZPREFIX(x) zng_ ## x
-+# define z_stream zng_stream
-+#elif defined(NGX_ZLIB)
-+# include <zlib.h>
-+# define ZPREFIX(x) x
- #endif
- 
- 
-@@ -525,7 +530,7 @@ ngx_stream_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
-     zstream.next_out = out;
-     zstream.avail_out = size;
- 
--    rc = deflateInit2(&zstream, (int) level, Z_DEFLATED, wbits + 16, memlevel,
-+    rc = ZPREFIX(deflateInit2)(&zstream, (int) level, Z_DEFLATED, wbits + 16, memlevel,
-                       Z_DEFAULT_STRATEGY);
- 
-     if (rc != Z_OK) {
-@@ -538,7 +543,7 @@ ngx_stream_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
-                    zstream.next_in, zstream.next_out,
-                    zstream.avail_in, zstream.avail_out);
- 
--    rc = deflate(&zstream, Z_FINISH);
-+    rc = ZPREFIX(deflate)(&zstream, Z_FINISH);
- 
-     if (rc != Z_STREAM_END) {
-         ngx_log_error(NGX_LOG_ALERT, log, 0,
-@@ -554,7 +559,7 @@ ngx_stream_log_gzip(ngx_fd_t fd, u_char *buf, size_t len, ngx_int_t level,
- 
-     size -= zstream.avail_out;
- 
--    rc = deflateEnd(&zstream);
-+    rc = ZPREFIX(deflateEnd)(&zstream);
- 
-     if (rc != Z_OK) {
-         ngx_log_error(NGX_LOG_ALERT, log, 0, "deflateEnd() failed: %d", rc);
diff --git a/pkgs/servers/monitoring/laurel/default.nix b/pkgs/servers/monitoring/laurel/default.nix
index 6dd83daa56c3..e21072772356 100644
--- a/pkgs/servers/monitoring/laurel/default.nix
+++ b/pkgs/servers/monitoring/laurel/default.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "laurel";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "threathunters-io";
     repo = "laurel";
     tag = "v${version}";
-    hash = "sha256-fToxRAcZOZvuuzaaWSjweqEwdUu3K2EKXY0K2Qixqpo=";
+    hash = "sha256-rOf7UtkMoYpReZr/2135QcpMEfYD80IY4zF0TwAWr4I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-i5wsS7y65sIvICfgViVIAbQU9f1E0EmspX+YVKDSKOU=";
+  cargoHash = "sha256-Pfs4Bg6VZIiiXQu0ZKcDi9zeEYl08kOnWi3R2iaQG24=";
 
   postPatch = ''
     # Upstream started to redirect aarch64-unknown-linux-gnu to aarch64-linux-gnu-gcc
@@ -29,6 +29,14 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
   buildInputs = [ acl ];
 
+  checkFlags = [
+    # Nix' build sandbox does not allow setting ACLs:
+    # https://github.com/NixOS/nix/blob/2.28.3/src/libstore/unix/build/local-derivation-goal.cc#L1760-L1769
+    # Skip the tests that are failing with "Operation not supported (os error 95)" because of this:
+    "--skip=rotate::test::existing"
+    "--skip=rotate::test::fresh_file"
+  ];
+
   meta = with lib; {
     description = "Transform Linux Audit logs for SIEM usage";
     homepage = "https://github.com/threathunters-io/laurel";
diff --git a/pkgs/shells/nushell/plugins/net.nix b/pkgs/shells/nushell/plugins/net.nix
index 08b8e1b4d80e..986dd9101f20 100644
--- a/pkgs/shells/nushell/plugins/net.nix
+++ b/pkgs/shells/nushell/plugins/net.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell_plugin_net";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "fennewald";
     repo = "nu_plugin_net";
     rev = "refs/tags/${version}";
-    hash = "sha256-Cop2gI5xhhWhw5Cyb4CABSzqs2bxDreohOzgGh/wPXg=";
+    hash = "sha256-HiNydU40FprxVmRRZtnXom2kFYI04mbeuGTq8+BMh7o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-8IlCUI0HOsr06vsSv0WBxfoaEe1Dz21tZdWZ6jrNkaw=";
+  cargoHash = "sha256-tq0XqY2B7tC2ep8vH6T3nkAqxqhniqzYnhbkfB3SbHU=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index eed2fe81c5bc..2b912f4e9b87 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -901,6 +901,7 @@ mapAliases {
   k3s_1_26 = throw "'k3s_1_26' has been removed from nixpkgs as it has reached end of life"; # Added 2024-05-20
   k3s_1_27 = throw "'k3s_1_27' has been removed from nixpkgs as it has reached end of life on 2024-06-28"; # Added 2024-06-01
   k3s_1_28 = throw "'k3s_1_28' has been removed from nixpkgs as it has reached end of life"; # Added 2024-12-15
+  k3s_1_29 = throw "'k3s_1_29' has been removed from nixpkgs as it has reached end of life"; # Added 2025-05-05
   # k3d was a 3d editing software k-3d - "k3d has been removed because it was broken and has seen no release since 2016" Added 2022-01-04
   # now kube3d/k3d will take it's place
   kube3d = k3d; # Added 2022-0705
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7ba147d1d92f..ecc062684dab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10568,6 +10568,7 @@ with pkgs;
   nginx = nginxStable;
 
   nginxQuic = callPackage ../servers/http/nginx/quic.nix {
+    zlib-ng = zlib-ng.override { withZlibCompat = true; };
     withPerl = false;
     # We don't use `with` statement here on purpose!
     # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
@@ -10581,6 +10582,7 @@ with pkgs;
   };
 
   nginxStable = callPackage ../servers/http/nginx/stable.nix {
+    zlib-ng = zlib-ng.override { withZlibCompat = true; };
     withPerl = false;
     # We don't use `with` statement here on purpose!
     # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
@@ -10592,6 +10594,7 @@ with pkgs;
   };
 
   nginxMainline = callPackage ../servers/http/nginx/mainline.nix {
+    zlib-ng = zlib-ng.override { withZlibCompat = true; };
     withKTLS = true;
     withPerl = false;
     # We don't use `with` statement here on purpose!
@@ -13054,7 +13057,6 @@ with pkgs;
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
 
   inherit (callPackage ../applications/networking/cluster/k3s { })
-    k3s_1_29
     k3s_1_30
     k3s_1_31
     k3s_1_32
@@ -14852,8 +14854,6 @@ with pkgs;
 
   ledger-agent = with python3Packages; toPythonApplication ledger-agent;
 
-  monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui { };
-
   napari = with python3Packages; toPythonApplication napari;
 
   nano-wallet = libsForQt5.callPackage ../applications/blockchains/nano-wallet { };