diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 702c60751033..4e57b1601b43 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -61,6 +61,10 @@
   OpenSMTPD 7.6.0 or later. The package has been removed in favor of a set of new
   `opensmtpd-table-*` packages.
 
+- `postsrsd` upgraded to `>= 2.0.0`, with some different behaviors and
+  configuration settings. Notably, it now defaults to listening on a socket
+  rather than a port. See [Migrating from version 1.x](https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x) and [Postfix Setup](https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup) for details.
+
 - The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
   `perlPackages.Xapian`.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6cd1b7070cfe..9279d4713240 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2115,6 +2115,12 @@
     githubId = 891399;
     name = "Alessandro Sappia";
   };
+  asauzeau = {
+    email = "antoine.sauzeau3@gmail.com";
+    github = "AntoineSauzeau";
+    githubId = 72159603;
+    name = "Antoine Sauzeau";
+  };
   asbachb = {
     email = "asbachb-nixpkgs-5c2a@impl.it";
     matrix = "@asbachb:matrix.org";
@@ -24059,6 +24065,13 @@
     githubId = 886074;
     name = "Matthieu Coudron";
   };
+  tetov = {
+    email = "anton@tetov.se";
+    github = "tetov";
+    githubId = 14882117;
+    keys = [ { fingerprint = "2B4D 0035 AFF0 F7DA CE5B  29D7 337D DB57 4A88 34DB"; } ];
+    name = "Anton Tetov";
+  };
   teutat3s = {
     email = "teutates@mailbox.org";
     matrix = "@teutat3s:pub.solar";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index da72f22d8f66..9bd0199f7cf1 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -232,6 +232,10 @@
 
 - [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes.
 
+- [Prometheus eBPF Exporter](https://github.com/cloudflare/ebpf_exporter),
+  Prometheus exporter for custom eBPF metrics. Available as
+  [services.prometheus.exporters.ebpf](#opt-services.prometheus.exporters.ebpf.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}
@@ -477,6 +481,8 @@
 
 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
 
+- [`hardware.xone`](options.html#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](options.html#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
+
 - `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.
 
   Example:
diff --git a/nixos/modules/hardware/xone.nix b/nixos/modules/hardware/xone.nix
index 04216e8260a7..f2b2bf668d1d 100644
--- a/nixos/modules/hardware/xone.nix
+++ b/nixos/modules/hardware/xone.nix
@@ -21,6 +21,7 @@ in
       extraModulePackages = with config.boot.kernelPackages; [ xone ];
     };
     hardware.firmware = [ pkgs.xow_dongle-firmware ];
+    hardware.xpad-noone.enable = lib.mkDefault true;
   };
 
   meta = {
diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index 3f0db2d91c00..e7c133bceac1 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -7,16 +7,52 @@
 let
 
   cfg = config.services.postsrsd;
+  runtimeDirectoryName = "postsrsd";
+  runtimeDirectory = "/run/${runtimeDirectoryName}";
+  # TODO: follow RFC 42, but we need a libconfuse format first:
+  #       https://github.com/NixOS/nixpkgs/issues/401565
+  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
+  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
+  #
+  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
+  # don't have exactly the same semantics as libconfuse strings. For example,
+  # "${F}" gets treated as an env var reference, see above issue for details.
+  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
+  configFile = pkgs.writeText "postsrsd.conf" ''
+    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
+    domains = ${libconfuseDomains}
+    separator = "${cfg.separator}"
+    socketmap = "unix:${runtimeDirectory}/socket"
+
+    # Disable postsrsd's jailing in favor of confinement with systemd.
+    unprivileged-user = ""
+    chroot-dir = ""
+  '';
 
 in
 {
-
-  ###### interface
+  imports =
+    map
+      (
+        name:
+        lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
+          `postsrsd` was upgraded to `>= 2.0.0`, with some different behaviors and configuration settings:
+            - NixOS Release Notes: https://nixos.org/manual/nixos/unstable/release-notes#sec-nixpkgs-release-25.05-incompatibilities
+            - NixOS Options Reference: https://nixos.org/manual/nixos/unstable/options#opt-services.postsrsd.enable
+            - Migration instructions: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x
+            - Postfix Setup: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#postfix-setup
+        ''
+      )
+      [
+        "domain"
+        "forwardPort"
+        "reversePort"
+        "timeout"
+        "excludeDomains"
+      ];
 
   options = {
-
     services.postsrsd = {
-
       enable = lib.mkOption {
         type = lib.types.bool;
         default = false;
@@ -29,9 +65,11 @@ in
         description = "Secret keys used for signing and verification";
       };
 
-      domain = lib.mkOption {
-        type = lib.types.str;
-        description = "Domain name for rewrite";
+      domains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "Domain names for rewrite";
+        default = [ config.networking.hostName ];
+        defaultText = lib.literalExpression "[ config.networking.hostName ]";
       };
 
       separator = lib.mkOption {
@@ -44,36 +82,6 @@ in
         description = "First separator character in generated addresses";
       };
 
-      # bindAddress = lib.mkOption { # uncomment once 1.5 is released
-      #   type = lib.types.str;
-      #   default = "127.0.0.1";
-      #   description = "Socket listen address";
-      # };
-
-      forwardPort = lib.mkOption {
-        type = lib.types.int;
-        default = 10001;
-        description = "Port for the forward SRS lookup";
-      };
-
-      reversePort = lib.mkOption {
-        type = lib.types.int;
-        default = 10002;
-        description = "Port for the reverse SRS lookup";
-      };
-
-      timeout = lib.mkOption {
-        type = lib.types.int;
-        default = 1800;
-        description = "Timeout for idle client connections in seconds";
-      };
-
-      excludeDomains = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = "Origin domains to exclude from rewriting in addition to primary domain";
-      };
-
       user = lib.mkOption {
         type = lib.types.str;
         default = "postsrsd";
@@ -85,17 +93,10 @@ in
         default = "postsrsd";
         description = "Group for the daemon";
       };
-
     };
-
   };
 
-  ###### implementation
-
   config = lib.mkIf cfg.enable {
-
-    services.postsrsd.domain = lib.mkDefault config.networking.hostName;
-
     users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
       postsrsd = {
         group = cfg.group;
@@ -107,30 +108,42 @@ in
       postsrsd.gid = config.ids.gids.postsrsd;
     };
 
-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [ "network.target" ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-
+    systemd.services.postsrsd-generate-secrets = {
       path = [ pkgs.coreutils ];
-
-      serviceConfig = {
-        ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -a${cfg.separator} -f${toString cfg.forwardPort} -r${toString cfg.reversePort} -t${toString cfg.timeout} "-X${lib.concatStringsSep "," cfg.excludeDomains}"'';
-        User = cfg.user;
-        Group = cfg.group;
-        PermissionsStartOnly = true;
-      };
-
-      preStart = ''
-        if [ ! -e "${cfg.secretsFile}" ]; then
+      script = ''
+        if [ -e "${cfg.secretsFile}" ]; then
+          echo "Secrets file exists. Nothing to do!"
+        else
           echo "WARNING: secrets file not found, autogenerating!"
           DIR="$(dirname "${cfg.secretsFile}")"
           install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
           install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
         fi
       '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
     };
 
+    systemd.services.postsrsd = {
+      description = "PostSRSd SRS rewriting server";
+      after = [
+        "network.target"
+        "postsrsd-generate-secrets.service"
+      ];
+      before = [ "postfix.service" ];
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "postsrsd-generate-secrets.service" ];
+      confinement.enable = true;
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
+        User = cfg.user;
+        Group = cfg.group;
+        PermissionsStartOnly = true;
+        RuntimeDirectory = runtimeDirectoryName;
+        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      };
+    };
   };
 }
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 258d13e3c7c7..2adc59eefbef 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -65,6 +65,7 @@ let
         "dnssec"
         "domain"
         "dovecot"
+        "ebpf"
         "fastly"
         "flow"
         "fritz"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/ebpf.nix b/nixos/modules/services/monitoring/prometheus/exporters/ebpf.nix
new file mode 100644
index 000000000000..8ccb6d21623b
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/ebpf.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.ebpf;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    ;
+in
+{
+  port = 9435;
+  extraOpts = {
+    names = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "timers" ];
+      description = ''
+        List of eBPF programs to load
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [
+        "CAP_BPF"
+        "CAP_DAC_READ_SEARCH"
+        "CAP_PERFMON"
+      ];
+      CapabilityBoundingSet = [
+        "CAP_BPF"
+        "CAP_DAC_READ_SEARCH"
+        "CAP_PERFMON"
+      ];
+      ExecStart = ''
+        ${pkgs.prometheus-ebpf-exporter}/bin/ebpf_exporter \
+        --config.dir=${pkgs.prometheus-ebpf-exporter}/examples \
+        --config.names=${concatStringsSep "," cfg.names} \
+        --web.listen-address ${cfg.listenAddress}:${toString cfg.port}
+      '';
+    };
+  };
+}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 46b8d13364c6..ef356dbc7bb1 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -407,6 +407,20 @@ let
         '';
       };
 
+    ebpf = {
+      exporterConfig = {
+        enable = true;
+        names = [ "timers" ];
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-ebpf-exporter.service")
+        wait_for_open_port(9435)
+        succeed(
+            "curl -sSf http://localhost:9435/metrics | grep 'ebpf_exporter_enabled_configs{name=\"timers\"} 1'"
+        )
+      '';
+    };
+
     fastly = {
       exporterConfig = {
         enable = true;
diff --git a/pkgs/applications/networking/mailreaders/imapfilter.nix b/pkgs/applications/networking/mailreaders/imapfilter.nix
index 93eede6853d6..3084c682574c 100644
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imapfilter";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "lefcha";
     repo = "imapfilter";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pYnv9slw4bRPfCnhd/tlJC9JEx+3h40nyZ3qUll7p6c=";
+    sha256 = "sha256-9uPcdxZioXfdSuZO/fgtoIbQdWtc2DRr28iTonnG05U=";
   };
   makeFlags = [
     "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
diff --git a/pkgs/build-support/node/fetch-yarn-deps/common.js b/pkgs/build-support/node/fetch-yarn-deps/common.js
index 8e0d1b0e470b..95dab609a855 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/common.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/common.js
@@ -5,7 +5,9 @@ const path = require('path')
 const urlToName = url => {
 	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
 
-	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+	if (url.startsWith('file:')) {
+		return url
+	} else if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
 		return path.basename(url)
 	} else {
 		return url
diff --git a/pkgs/by-name/au/audiobookshelf/source.json b/pkgs/by-name/au/audiobookshelf/source.json
index 8284635c4be9..a23e8c81d69d 100644
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "38f05a857ff3cec50bafb594b5d0ab49d6c585ae",
-  "hash": "sha256-FFZPhQRqmL6pp5aS6qg1Dhf80PAFE2O9oDJB5kSHL50=",
-  "version": "2.20.0",
-  "depsHash": "sha256-mB57omyxV338K4LpNMfIThLc2Mz71NqEyFTjWrfAo10=",
-  "clientDepsHash": "sha256-Wnmue1aGWN9rwP3xYp5q+POP85tHY5gbYBQMKXu9H3Q="
+  "rev": "fd84cd0d7f647705a49f300b9bdb940f9725e1a7",
+  "hash": "sha256-+e8CaJaDuYsj48nF98uLf9dSeXGWEDvNy5myQ9x2Yug=",
+  "version": "2.21.0",
+  "depsHash": "sha256-AwY4TrIm5jR7lu/l9RyOzwX4N31Q8x+WKeIbxW4+g8s=",
+  "clientDepsHash": "sha256-rQT0l7Gs5xwDaP+5rhX2nUGBk5jaUMo0JR0Emo87ie4="
 }
diff --git a/pkgs/by-name/aw/aws-lambda-rie/package.nix b/pkgs/by-name/aw/aws-lambda-rie/package.nix
index a259673271c9..bd53d7a73108 100644
--- a/pkgs/by-name/aw/aws-lambda-rie/package.nix
+++ b/pkgs/by-name/aw/aws-lambda-rie/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.23";
+  version = "1.25";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-runtime-interface-emulator";
     rev = "v${version}";
-    sha256 = "sha256-zbeaWbvWk3duBfdUb70G/O4gO20NSHiwuTUZjtGlM3Q=";
+    sha256 = "sha256-GHoEyTM3vDVmozcKoi5ETG4V10o82HcigmmhIMV0UJg=";
   };
 
   vendorHash = "sha256-fGoqKDBg+O4uzGmhEIROsBvDS+6zWCzsXe8U6t98bqk=";
diff --git a/pkgs/by-name/cl/cliqr/package.nix b/pkgs/by-name/cl/cliqr/package.nix
index 94c8fc4b17e3..2f5774a48419 100644
--- a/pkgs/by-name/cl/cliqr/package.nix
+++ b/pkgs/by-name/cl/cliqr/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliqr";
-  version = "0.1.26";
+  version = "0.1.29";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "cliqr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JM5sWVby8dSFz2YtNXgU9z5fc6EI5nnxmpQN/71kdjI=";
+    hash = "sha256-fhNMiUaCTk4xYGJRMuZCHeYvzGeVwkS7E7LU1L+LuBg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 5a0b6d62cdec..ad98ee708a0b 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -19,8 +19,8 @@ let
     src = fetchFromGitHub {
       owner = "domenkozar";
       repo = "nix";
-      rev = "090394819020afda8eae69e395b1accba9c0fab2";
-      hash = "sha256-eUYh7+PgqLXTt8/9IOxEuW2qyxADECmTic8QNhEwKSw=";
+      rev = "b455edf3505f1bf0172b39a735caef94687d0d9c";
+      hash = "sha256-bYyjarS3qSNqxfgc89IoVz8cAFDkF9yPE63EJr+h50s=";
     };
     doCheck = false;
     doInstallCheck = false;
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index fcdbd9325607..f0b8ca3d34d9 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-7BTQiUf78CKozZAUdw0Y1U7EO+ZvMDim3N/PPebDMNg=";
+    hash = "sha256-nlhW3ftBOjb2BHz1qjOI4VGiSn1+VAUcaA9n0nPikCU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fl/fleet/package.nix b/pkgs/by-name/fl/fleet/package.nix
new file mode 100644
index 000000000000..0b2c945d6801
--- /dev/null
+++ b/pkgs/by-name/fl/fleet/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "fleet";
+  version = "4.67.1";
+
+  src = fetchFromGitHub {
+    owner = "fleetdm";
+    repo = "fleet";
+    tag = "fleet-v${finalAttrs.version}";
+    hash = "sha256-cZ0YTFcyPt7NMZUDZCdlVPTuhwRy7mTp7JCdINqiwOM=";
+  };
+  vendorHash = "sha256-gFAotYho18Jn8MaFK6ShoMA1VLXVENcrASvHWZGFOFg=";
+
+  subPackages = [
+    "cmd/fleet"
+  ];
+
+  ldflags = [
+    "-X github.com/fleetdm/fleet/v4/server/version.appName=fleet"
+    "-X github.com/fleetdm/fleet/v4/server/version.version=${finalAttrs.version}"
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/fleet-v${finalAttrs.version}";
+    description = "CLI tool to launch Fleet server";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      asauzeau
+    ];
+    mainProgram = "fleet";
+  };
+})
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
index cf237afa0a06..09cec8c283cb 100644
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -1,26 +1,26 @@
 {
-  "version": "1.132.1",
-  "hash": "sha256-nZ7kG60TTOVB4yGUsRrcHuWwIamsWlJ7zBvJCP9d4zQ=",
+  "version": "1.132.3",
+  "hash": "sha256-QwQSqWSQ82R5LrbyerAZflDRM2DS+rpA8E6uzxQbs48=",
   "components": {
     "cli": {
-      "npmDepsHash": "sha256-PZOYCJ5FQboy5uVZCqJ4CfxDVSHburP4kxhi01HrKns=",
-      "version": "2.2.63"
+      "npmDepsHash": "sha256-7CWJEEr/6+Duc90Qww6rhVLXEtxz3hymLcQIzv3YPg0=",
+      "version": "2.2.65"
     },
     "server": {
-      "npmDepsHash": "sha256-p46OKwRpk9n15201ImLMlDokezJPXD+GXUWtSHduGfU=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-CdE8H8+uAlthHhko5Ir+BETqkZoNzpimgHB2gVJbus8=",
+      "version": "1.132.3"
     },
     "web": {
-      "npmDepsHash": "sha256-HEwmwn1DP+9WnqYSOcR2AoOLU7tTjwi2fN17Vq9cZVE=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-3UoNfa2P4bVFQSQTSbRacSxh2UbPokDHqveCHt9bnko=",
+      "version": "1.132.3"
     },
     "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-Mdn7pmYJmdizQlVINCme6wv6ocqyrBO6U4F5x2xJonc=",
-      "version": "1.132.1"
+      "npmDepsHash": "sha256-Rfds2/c8Q6KfWzyztxLcKS40JKOMh04JzMICsDvqMgs=",
+      "version": "1.132.3"
     },
     "geonames": {
-      "timestamp": "20250424184923",
-      "hash": "sha256-f0IMmEEyw0JSm+u3zgcE4dtTfPpAKvhDFhlqA9F8cVg="
+      "timestamp": "20250428153140",
+      "hash": "sha256-RDetKDf/qFRwlB+Jo5ivD6yp1paMWFJeUf1Vft70Kdw="
     }
   }
 }
diff --git a/pkgs/by-name/ku/kubelogin-oidc/package.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
index d6873e804dc6..d368963d7e1d 100644
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${version}";
-    hash = "sha256-ZmNiFO1YGZC+vxpeliNuXfL8Azy2YmLgKqga/a3/9U8=";
+    hash = "sha256-zdUtLjILildwSOA5CV1SNzVtMj+Tz1KkHB2MH1SZ8wk=";
   };
 
   subPackages = [ "." ];
@@ -22,7 +22,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorHash = "sha256-b8d06JhapPF8HwP1twgkcSR6RzM9x1G4zW3YBqmM3YM=";
+  vendorHash = "sha256-5NiGgZLSf/STr888JPsZZqaqXUI+g+26OEKRXp7xS4E=";
 
   # test all packages
   preCheck = ''
diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix
index 81330f818f79..72ce99baa6bc 100644
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   cmake,
   fetchFromGitHub,
+  fetchpatch,
   tbb_2021_11,
 
   useTBB ? true,
@@ -19,6 +20,21 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IABVErXWYQFXZcwsFKfQhm3ox7UZUcW5uzVrGwsSp94=";
   };
 
+  patches = [
+    # build(cmake): Use tbb32 pkgconfig package on 32-bit builds (BLAKE3-team/BLAKE3#482)
+    (fetchpatch {
+      url = "https://github.com/BLAKE3-team/BLAKE3/commit/dab799623310c8f4be6575002d5c681c09a0e209.patch";
+      hash = "sha256-npCtM8nOFU8Tcu//IykjMs8aLU12d93+mIfKuxHkuaQ=";
+      relative = "c";
+    })
+    # build(cmake): Relax Clang frontend variant detection (BLAKE3-team/BLAKE3#477)
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/BLAKE3-team/BLAKE3/pull/477.patch";
+      hash = "sha256-kidCMGd/i9D9HLLTt7l1DbiU71sFTEyr3Vew4XHUHls=";
+      relative = "c";
+    })
+  ];
+
   sourceRoot = finalAttrs.src.name + "/c";
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/liblzf/lib_test.c b/pkgs/by-name/li/liblzf/lib_test.c
new file mode 100644
index 000000000000..04655d35a1e4
--- /dev/null
+++ b/pkgs/by-name/li/liblzf/lib_test.c
@@ -0,0 +1,33 @@
+#include "lzf.h"
+#include <stdio.h>
+#include <string.h>
+
+int main(void) {
+  const char *test = "liblzf test for nixpkgs, nixpkgs for test liblzf";
+  const size_t ilen = strlen(test) + 1;
+
+  printf("Test string length: %zu\n", ilen);
+
+  char compressed[100];
+  char decompressed[100];
+
+  unsigned int clen =
+      lzf_compress(test, ilen, compressed, sizeof(compressed));
+  if (!clen)
+    return 1;
+
+  printf("Compressed length: %d\n", clen);
+
+  unsigned int dlen =
+      lzf_decompress(compressed, clen, decompressed, sizeof(decompressed));
+  if (!dlen)
+    return 2;
+
+  if (strcmp(test, decompressed) != 0) {
+    printf("Strings don't match!\n");
+    return 3;
+  }
+
+  printf("Strings match, tests passed!\n");
+  return 0;
+}
diff --git a/pkgs/by-name/li/liblzf/package.nix b/pkgs/by-name/li/liblzf/package.nix
new file mode 100644
index 000000000000..693488d64db4
--- /dev/null
+++ b/pkgs/by-name/li/liblzf/package.nix
@@ -0,0 +1,137 @@
+{
+  lib,
+  stdenv,
+  fetchDebianPatch,
+  fetchpatch,
+  fetchurl,
+  pkg-config,
+  testers,
+  validatePkgConfig,
+  autoconf,
+  automake,
+  libtool,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "liblzf";
+  version = "3.6";
+
+  src = fetchurl {
+    url = "http://dist.schmorp.de/liblzf/liblzf-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nF3gH3ucyuQMP2GdJqer7JmGwGw20mDBec7dBLiftGo=";
+  };
+
+  patches = [
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "4";
+      patch = "0001-Make-sure-that-the-library-is-linked-with-C-symbols.patch";
+      hash = "sha256-Rgfp/TysRcEJaogOo/Xno+G4HZzj9Loa69DL43Bp1Ok=";
+    })
+    (
+      let
+        name = "liblzf-3.6-autoconf-20140314.patch";
+      in
+      fetchpatch {
+        inherit name;
+        url = "https://src.fedoraproject.org/rpms/liblzf/raw/53da654eead51a24ac81a28e1b1c531eb1afab28/f/${name}";
+        hash = "sha256-rkhI8w0HV3fGiDfHiXBzrnxqGDE/Yo5ntePrsscMiyg=";
+      }
+    )
+  ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+    validatePkgConfig
+  ];
+
+  preConfigure = ''
+    sh ./bootstrap.sh
+  '';
+
+  postInstall = ''
+    pushd $out/bin
+    ln -s lzf unlzf
+    popd
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  passthru.tests = {
+    pkgConfigTest = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      version = "${finalAttrs.version}.0";
+      versionCheck = true;
+    };
+
+    exeTest = testers.runCommand {
+      name = "${finalAttrs.pname}-exe-test";
+      buildInputs = [ finalAttrs.finalPackage ];
+      script = ''
+        lzf -h 2> /dev/null
+
+        echo "LZFLZFLZFLZFLZFLZFLZFLZF" > test.txt
+
+        # unlzf writes to filename minus ".lzf"
+        cp test.txt test.txt.orig
+
+        lzf test.txt
+        unlzf test.txt.lzf
+
+        # Compare results
+        if ! cmp -s test.txt test.txt.orig; then
+          echo "Executable test failed: files don't match"
+          exit 1
+        fi
+
+        echo "Decompressed output matches test string (lzf & unlzf)"
+
+        touch $out
+      '';
+    };
+
+    shlibTest = testers.runCommand {
+      name = "${finalAttrs.pname}-shlib-test";
+      inherit stdenv; # with CC
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [
+        finalAttrs.finalPackage.dev
+        finalAttrs.finalPackage
+      ];
+      # tests both the library and pkg-config file
+      script = ''
+        $CC -g ${./lib_test.c} -o lib_test \
+          $(pkg-config --cflags --libs liblzf)
+
+        ./lib_test >/dev/null
+
+        echo "Built and tested file linked against liblzf using pkg-config"
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    changelog =
+      "http://cvs.schmorp.de/liblzf/Changes?pathrev=rel-"
+      + builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version;
+    description = "Small data compression library";
+    downloadPage = "http://dist.schmorp.de/liblzf/";
+    homepage = "http://software.schmorp.de/pkg/liblzf.html";
+    license = with lib.licenses; [
+      bsd2
+      gpl2Plus
+    ];
+    mainProgram = "lzf";
+    maintainers = with lib.maintainers; [
+      tetov
+    ];
+    platforms = lib.platforms.unix;
+    pkgConfigModules = [ "liblzf" ];
+  };
+})
diff --git a/pkgs/by-name/mi/miru/darwin.nix b/pkgs/by-name/mi/miru/darwin.nix
index 792282b44663..42aabead4c49 100644
--- a/pkgs/by-name/mi/miru/darwin.nix
+++ b/pkgs/by-name/mi/miru/darwin.nix
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-o/7CTkIVufD5ai99XZFyDUgCIV7r4PbUcqkYcMVZwKE=";
+    hash = "sha256-V4Vo9fuQ0X7Q6CBM7Akh3+MrgQOBgCuC41khFatYWi4=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/mi/miru/linux.nix b/pkgs/by-name/mi/miru/linux.nix
index e31b02d79554..80d5850e1ebc 100644
--- a/pkgs/by-name/mi/miru/linux.nix
+++ b/pkgs/by-name/mi/miru/linux.nix
@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    hash = "sha256-AhaGiZ/Vx9nJmIXrzZ1JMLqjWfQDyoKpzl55NT712Ro=";
+    hash = "sha256-nLPqEI6u5NNQ/kPbXRWPG0pIwutKNK2J8JeTPN6wHlg=";
   };
 
   extraInstallCommands =
diff --git a/pkgs/by-name/mi/miru/package.nix b/pkgs/by-name/mi/miru/package.nix
index f250c3a524f7..3141c48afca0 100644
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "miru";
-  version = "5.5.9";
+  version = "5.5.10";
   meta = {
     description = "Stream anime torrents, real-time with no waiting for downloads";
     homepage = "https://miru.watch";
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index b91bd9401033..dcf4d86a9f70 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.16.3";
+  version = "3.16.4";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-C/IfCNOFsSnpJMVSVhOkfx1F2IhOM8ntgdKjr7MKdkc=";
+    hash = "sha256-8P73YitjuU9SGDBNimqJsvSfGOE9lNCVUNN3f4KXWSY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/or/oras/package.nix b/pkgs/by-name/or/oras/package.nix
index 52f862548d8a..da05223e2f2f 100644
--- a/pkgs/by-name/or/oras/package.nix
+++ b/pkgs/by-name/or/oras/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "oras";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "oras-project";
     repo = "oras";
     rev = "v${version}";
-    hash = "sha256-iSmoD2HhzVrWQBaZ7HaIjcPmybl4JTVeVVfbn29i91Q=";
+    hash = "sha256-IXIw2prApg5iL3BPbOY4x09KjyhFvKofgfz2L6UXKR8=";
   };
 
-  vendorHash = "sha256-zxcRMrr0mfSiuZpXYe7N0nJrEmiBTgw03+Yp4PYieBY=";
+  vendorHash = "sha256-PLGWPoMCsmdnsKD/FdaRHGO0X9/0Y/8DWV21GsCBR04=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/po/postsrsd/package.nix b/pkgs/by-name/po/postsrsd/package.nix
index f100d56d94cf..b9a653fe35b3 100644
--- a/pkgs/by-name/po/postsrsd/package.nix
+++ b/pkgs/by-name/po/postsrsd/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  libconfuse,
   stdenv,
   fetchFromGitHub,
   cmake,
@@ -8,18 +9,20 @@
 
 stdenv.mkDerivation rec {
   pname = "postsrsd";
-  version = "1.12";
+  version = "2.0.10";
 
   src = fetchFromGitHub {
     owner = "roehling";
     repo = "postsrsd";
     rev = version;
-    sha256 = "sha256-aSI9TR1wSyMA0SKkbavk+IugRfW4ZEgpzrNiXn0F5ak=";
+    sha256 = "sha256-8uy7a3wUGuLE4+6ZPqbFMdPzm6IZqQSvpZzLYAkBxNg=";
   };
 
   cmakeFlags = [
     "-DGENERATE_SRS_SECRET=OFF"
     "-DINIT_FLAVOR=systemd"
+    "-DFETCHCONTENT_TRY_FIND_PACKAGE_MODE=ALWAYS"
+    "-DINSTALL_SYSTEMD_SERVICE=OFF"
   ];
 
   preConfigure = ''
@@ -31,6 +34,10 @@ stdenv.mkDerivation rec {
     help2man
   ];
 
+  buildInputs = [
+    libconfuse
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/roehling/postsrsd";
     description = "Postfix Sender Rewriting Scheme daemon";
diff --git a/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
new file mode 100644
index 000000000000..02d934714c8b
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-ebpf-exporter/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  pkgs,
+  libbpf,
+  libelf,
+  libsystemtap,
+  libz,
+}:
+
+let
+  version = "2.4.2";
+  tag = "v${version}";
+in
+buildGoModule.override
+  {
+    stdenv = pkgs.clangStdenv;
+  }
+  {
+    name = "ebpf_exporter";
+
+    src = fetchFromGitHub {
+      inherit tag;
+      owner = "cloudflare";
+      repo = "ebpf_exporter";
+      hash = "sha256-gXzaMx9Z6LzrlDaQnagQIi183uKhJvdYiolYb8P+MIs=";
+    };
+
+    vendorHash = "sha256-GhQvPp8baw2l91OUOg+/lrG27P/D4Uzng8XevJf8Pj4=";
+
+    postPatch = ''
+      substituteInPlace examples/Makefile \
+        --replace-fail "-Wall -Werror" ""
+    '';
+
+    buildInputs = [
+      libbpf
+      libelf
+      libsystemtap
+      libz
+    ];
+
+    CGO_LDFLAGS = "-l bpf";
+
+    hardeningDisable = [ "zerocallusedregs" ];
+
+    # Tests fail on trying to access cgroups.
+    doCheck = false;
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X github.com/prometheus/common/version.Version=${version}"
+      "-X github.com/prometheus/common/version.Revision=${tag}"
+      "-X github.com/prometheus/common/version.Branch=unknown"
+      "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+      "-X github.com/prometheus/common/version.BuildDate=unknown"
+    ];
+
+    postBuild = ''
+      BUILD_LIBBPF=0 make examples
+    '';
+
+    postInstall = ''
+      mkdir -p $out/examples
+      mv examples/*.o examples/*.yaml $out/examples
+    '';
+
+    passthru.tests = { inherit (nixosTests.prometheus-exporters) ebpf; };
+
+    meta = {
+      description = "Prometheus exporter for custom eBPF metrics";
+      mainProgram = "ebpf_exporter";
+      homepage = "https://github.com/cloudflare/ebpf_exporter";
+      changelog = "https://github.com/cloudflare/ebpf_exporter/releases/tag/v${tag}";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ jpds ];
+      platforms = lib.platforms.linux;
+    };
+  }
diff --git a/pkgs/by-name/ta/tail-tray/package.nix b/pkgs/by-name/ta/tail-tray/package.nix
index 88e0e6765085..8acc87c9446e 100644
--- a/pkgs/by-name/ta/tail-tray/package.nix
+++ b/pkgs/by-name/ta/tail-tray/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tail-tray";
-  version = "0.2.20";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "SneWs";
     repo = "tail-tray";
     tag = "v${version}";
-    sha256 = "sha256-vsxWGXpmkznfqFwtuLdG6yGAS/Lhs6NLRuzQ/g/WLu8=";
+    sha256 = "sha256-zdmU4GdEVOT8wUgOxJAGsLQEb35O/RUjc8HcYpwIkiM=";
   };
 
   nativeBuildInputs = with kdePackages; [
diff --git a/pkgs/by-name/x2/x264/package.nix b/pkgs/by-name/x2/x264/package.nix
index 48852d9215b0..7e209794f89b 100644
--- a/pkgs/by-name/x2/x264/package.nix
+++ b/pkgs/by-name/x2/x264/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
       # `AS' is set to the binutils assembler, but we need nasm
       unset AS
     ''
-    + lib.optionalString stdenv.hostPlatform.isAarch ''
+    + lib.optionalString (stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isLoongArch64) ''
       export AS=$CC
     '';
 
diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index bd6108e8da5d..34574c744c14 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
-  pcre,
   pkg-config,
   protobufc,
   withCrypto ? true,
@@ -36,7 +35,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      pcre
       protobufc
     ]
     ++ lib.optionals withCrypto [ openssl ]
diff --git a/pkgs/development/cuda-modules/nccl-tests/default.nix b/pkgs/development/cuda-modules/nccl-tests/default.nix
index d00549e637eb..0f4145ba5a0a 100644
--- a/pkgs/development/cuda-modules/nccl-tests/default.nix
+++ b/pkgs/development/cuda-modules/nccl-tests/default.nix
@@ -25,13 +25,13 @@ in
 backendStdenv.mkDerivation (finalAttrs: {
 
   pname = "nccl-tests";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "nccl-tests";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PntD5seMq7s0x4hOO/wBDQdElhKCY6mFrTf073mf7zM=";
+    hash = "sha256-OgffbW9Vx/sm1I1tpaPGdAhIpV4jbB4hJa9UcEAWkdE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/tbb/2022_0.nix b/pkgs/development/libraries/tbb/2022_0.nix
index 14231faf6068..75348dfa3323 100644
--- a/pkgs/development/libraries/tbb/2022_0.nix
+++ b/pkgs/development/libraries/tbb/2022_0.nix
@@ -34,11 +34,12 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/899.patch";
       hash = "sha256-kU6RRX+sde0NrQMKlNtW3jXav6J4QiVIUmD50asmBPU=";
     })
-  ];
-
-  cmakeFlags = [
-    # Skip tests to work around https://github.com/uxlfoundation/oneTBB/issues/1695
-    (lib.cmakeBool "TBB_TEST" (!stdenv.hostPlatform.isWindows))
+    # Fix tests on FreeBSD and Windows
+    (fetchpatch {
+      name = "fix-tbb-freebsd-and-windows-tests.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1696.patch";
+      hash = "sha256-yjX2FkOK8bz29a/XSA7qXgQw9lxzx8VIgEBREW32NN4=";
+    })
   ];
 
   # Fix build with modern gcc
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 05e18da04560..8b677cc4f77e 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -44,11 +44,12 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/1193.patch";
       hash = "sha256-ZQbwUmuIZoGVBof8QNR3V8vU385e2X7EvU3+Fbj4+M8=";
     })
-  ];
-
-  cmakeFlags = [
-    # Skip tests to work around https://github.com/uxlfoundation/oneTBB/issues/1695
-    (lib.cmakeBool "TBB_TEST" (!stdenv.hostPlatform.isWindows))
+    # Fix tests on FreeBSD and Windows
+    (fetchpatch {
+      name = "fix-tbb-freebsd-and-windows-tests.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1696.patch";
+      hash = "sha256-yjX2FkOK8bz29a/XSA7qXgQw9lxzx8VIgEBREW32NN4=";
+    })
   ];
 
   # Fix build with modern gcc
diff --git a/pkgs/development/python-modules/django-axes/default.nix b/pkgs/development/python-modules/django-axes/default.nix
index dc60f0395603..aaaf0c6c3b4d 100644
--- a/pkgs/development/python-modules/django-axes/default.nix
+++ b/pkgs/development/python-modules/django-axes/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-axes";
-  version = "7.0.2";
+  version = "7.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-axes";
     tag = version;
-    hash = "sha256-yPHS9CgtAQeokq7ClI1fUcgR5YCjmcHjQHNcfQdTZtc=";
+    hash = "sha256-qSXrPa49JDkcW0bmisYzZy40E3O5i6WfD0t9HXFhgqQ=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/flowmc/default.nix b/pkgs/development/python-modules/flowmc/default.nix
index 19b72b1f9ebd..2ae8cfbb2fdb 100644
--- a/pkgs/development/python-modules/flowmc/default.nix
+++ b/pkgs/development/python-modules/flowmc/default.nix
@@ -8,7 +8,6 @@
 
   # dependencies
   chex,
-  coveralls,
   equinox,
   jax,
   jaxtyping,
@@ -22,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "flowmc";
-  version = "0.4.3";
+  version = "0.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kazewong";
     repo = "flowMC";
     tag = "flowMC-${version}";
-    hash = "sha256-M0FrIe7q0YI6f+IwQeMsZKahw9wcQd42hf/dmXJp2Fk=";
+    hash = "sha256-hyrsL8agY+bNcRcEmgEtv97cFROgeLFxxtKTfx0HoH8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/ipydatawidgets/default.nix b/pkgs/development/python-modules/ipydatawidgets/default.nix
index cacce82794b8..bf3ff8800aab 100644
--- a/pkgs/development/python-modules/ipydatawidgets/default.nix
+++ b/pkgs/development/python-modules/ipydatawidgets/default.nix
@@ -40,6 +40,17 @@ buildPythonPackage rec {
     nbval
   ];
 
+  # Tests bind ports
+  __darwinAllowLocalNetworking = true;
+
+  pytestFlagsArray = [
+    # https://github.com/vidartf/ipydatawidgets/issues/62
+    "--deselect=ipydatawidgets/tests/test_ndarray_trait.py::test_dtype_coerce"
+
+    # https://github.com/vidartf/ipydatawidgets/issues/63
+    "--deselect=examples/test.ipynb::Cell\\\ 3"
+  ];
+
   meta = {
     description = "Widgets to help facilitate reuse of large datasets across different widgets";
     homepage = "https://github.com/vidartf/ipydatawidgets";
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 46143c1f8ce5..114fb07b7b51 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -1,16 +1,26 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   nodejs,
   yarn-berry_3,
+  distutils,
+
+  # build-system
   hatch-jupyter-builder,
   hatchling,
-  jupyter-server,
   jupyterlab,
+
+  # dependencies
+  jupyter-server,
   jupyterlab-server,
   notebook-shim,
   tornado,
+
+  # tests
   pytest-jupyter,
   pytestCheckHook,
 }:
@@ -29,13 +39,17 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "timeout = 300" ""
+      --replace-fail "timeout = 300" ""
   '';
 
-  nativeBuildInputs = [
-    nodejs
-    yarn-berry_3.yarnBerryConfigHook
-  ];
+  nativeBuildInputs =
+    [
+      nodejs
+      yarn-berry_3.yarnBerryConfigHook
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      distutils
+    ];
 
   missingHashes = ./missing-hashes.json;
 
diff --git a/pkgs/development/python-modules/pylint-odoo/default.nix b/pkgs/development/python-modules/pylint-odoo/default.nix
new file mode 100644
index 000000000000..06644f508c03
--- /dev/null
+++ b/pkgs/development/python-modules/pylint-odoo/default.nix
@@ -0,0 +1,44 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pylint-plugin-utils,
+  pytestCheckHook,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "pylint-odoo";
+  version = "9.3.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "OCA";
+    repo = "pylint-odoo";
+    tag = "v${version}";
+    hash = "sha256-HPai1HQlfHJUHLqEYn4U6qdupJLLrynwtfm7Q8IbRps=";
+  };
+
+  pythonRelaxDeps = [
+    "pylint-plugin-utils"
+    "pylint"
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pylint-plugin-utils
+  ];
+
+  pythonImportsCheck = [ "pylint_odoo" ];
+
+  BUILD_README = true; # Enables more tests
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Odoo plugin for Pylint";
+    homepage = "https://github.com/OCA/pylint-odoo";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/development/python-modules/pynvim-pp/default.nix b/pkgs/development/python-modules/pynvim-pp/default.nix
index feb57706f7a5..f41d69a8c387 100644
--- a/pkgs/development/python-modules/pynvim-pp/default.nix
+++ b/pkgs/development/python-modules/pynvim-pp/default.nix
@@ -8,20 +8,22 @@
 
 buildPythonPackage {
   pname = "pynvim-pp";
-  version = "unstable-2024-07-31";
+  version = "0-unstable-2025-02-08";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "pynvim_pp";
-    rev = "6d3c298b7eb9543bce7ab515b0a39f256c1d37ca";
-    hash = "sha256-W6YaxI/fa2HL6+FIBTTA+7K2Be02iuIfFFVO/hhYnpo=";
+    rev = "781f6beda5f5966857792af040d5e2ecff5467e4";
+    hash = "sha256-ggZqlaCP9WNECO+eRwi968EvQb8zuHCic6+9Zngsd24=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [ pynvim ];
 
+  pythonImportsCheck = [ "pynvim_pp" ];
+
   meta = {
     homepage = "https://github.com/ms-jpq/pynvim_pp";
     description = "Dependency to chadtree and coq_nvim plugins";
diff --git a/pkgs/development/python-modules/pythreejs/default.nix b/pkgs/development/python-modules/pythreejs/default.nix
new file mode 100644
index 000000000000..0ad007444f8b
--- /dev/null
+++ b/pkgs/development/python-modules/pythreejs/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  jupyterlab,
+  setuptools,
+
+  ipywidgets,
+  ipydatawidgets,
+  numpy,
+  traitlets,
+}:
+
+buildPythonPackage rec {
+  pname = "pythreejs";
+  version = "2.4.2";
+  pyproject = true;
+
+  # github sources need to invoke npm, but no package-lock.json present:
+  # https://github.com/jupyter-widgets/pythreejs/issues/419
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-pWi/3Ew3l8TCM5FYko7cfc9vpKJnsI487FEh4geLW9Y=";
+  };
+
+  build-system = [
+    jupyterlab
+    setuptools
+  ];
+
+  # It seems pythonRelaxDeps doesn't work for these
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "jupyterlab~=" "jupyterlab>="
+
+    # https://github.com/jupyter-widgets/pythreejs/pull/420
+    substituteInPlace setupbase.py \
+      --replace-fail "import pipes" "" \
+      --replace-fail "pipes.quote" "shlex.quote"
+  '';
+
+  # Don't run npm install, all files are already where they should be present.
+  # If we would run npm install, npm would detect package-lock.json is an old format,
+  # and try to fetch more metadata from the registry, which cannot work in the sandbox.
+  setupPyBuildFlags = [ "--skip-npm" ];
+
+  dependencies = [
+    ipywidgets
+    ipydatawidgets
+    numpy
+    traitlets
+  ];
+
+  # There are no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pythreejs" ];
+
+  meta = {
+    description = "Interactive 3D graphics for the Jupyter Notebook and JupyterLab, using Three.js and Jupyter Widgets";
+    homepage = "https://github.com/jupyter-widgets/pythreejs";
+    changelog = "https://github.com/jupyter-widgets/pythreejs/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ flokli ];
+  };
+}
diff --git a/pkgs/development/python-modules/pythreejs/fix-re.error.patch b/pkgs/development/python-modules/pythreejs/fix-re.error.patch
new file mode 100644
index 000000000000..74e75676e7cb
--- /dev/null
+++ b/pkgs/development/python-modules/pythreejs/fix-re.error.patch
@@ -0,0 +1,13 @@
+diff --git a/setupbase.py b/setupbase.py
+index 0ce0ac8..7762e23 100644
+--- a/setupbase.py
++++ b/setupbase.py
+@@ -659,7 +659,7 @@ def _translate_glob(pat):
+         translated_parts.append(_translate_glob_part(part))
+     os_sep_class = '[%s]' % re.escape(SEPARATORS)
+     res = _join_translated(translated_parts, os_sep_class)
+-    return '{res}\\Z(?ms)'.format(res=res)
++    return '(?ms){res}\\Z'.format(res=res)
+ 
+ 
+ def _join_translated(translated_parts, os_sep_class):
diff --git a/pkgs/development/python-modules/std2/default.nix b/pkgs/development/python-modules/std2/default.nix
index f25c28601d12..f17a5695f471 100644
--- a/pkgs/development/python-modules/std2/default.nix
+++ b/pkgs/development/python-modules/std2/default.nix
@@ -7,17 +7,19 @@
 
 buildPythonPackage {
   pname = "std2";
-  version = "0-unstable-2024-09-02";
+  version = "0-unstable-2025-02-06";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "std2";
-    rev = "205d1f52e9b5438ef2b732c77e1144847cafa8d0";
-    hash = "sha256-WdUefadEk92cGnDI+KbQBpjg+d7KgI6bjlQlyhRRRFA=";
+    rev = "47fda91f8c8db9d5a8faa6f55d739d74afffc440";
+    hash = "sha256-n+6FxVQjzYhjQMJr+i+D8uSiVjI7HFkegxy5keVjKGs=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "std2" ];
 
   meta = {
     homepage = "https://github.com/ms-jpq/std2";
diff --git a/pkgs/development/python-modules/tensordict/default.nix b/pkgs/development/python-modules/tensordict/default.nix
index 19bfaa01a116..29602609fbe4 100644
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@@ -1,44 +1,56 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
   # build-system
+  pybind11,
   setuptools,
-  torch,
+  setuptools-scm,
+
+  # nativeBuildInputs
+  cmake,
 
   # dependencies
   cloudpickle,
+  importlib-metadata,
   numpy,
   orjson,
   packaging,
+  torch,
 
   # tests
   h5py,
   pytestCheckHook,
-
-  stdenv,
 }:
 
 buildPythonPackage rec {
   pname = "tensordict";
-  version = "0.7.2";
+  version = "0.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "tensordict";
     tag = "v${version}";
-    hash = "sha256-ZDfRvfyBashU4kIoo8JX/EoCv4tpDOyggOlpdVCudT8=";
+    hash = "sha256-2S0xpsJNDdIGoLbALAIcSEVqYD5Nq2YXs3mWFtSUvsA=";
   };
 
   build-system = [
+    pybind11
     setuptools
-    torch
+    setuptools-scm
   ];
 
+  nativeBuildInputs = [
+    cmake
+  ];
+  dontUseCmakeConfigure = true;
+
   dependencies = [
     cloudpickle
+    importlib-metadata
     numpy
     orjson
     packaging
@@ -66,10 +78,15 @@ buildPythonPackage rec {
     "test_map_iter_interrupt_early"
   ];
 
-  disabledTestPaths = [
-    # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
-    "test/test_compile.py"
-  ];
+  disabledTestPaths =
+    [
+      # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
+      "test/test_compile.py"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Hangs forever
+      "test/test_distributed.py"
+    ];
 
   meta = {
     description = "Pytorch dedicated tensor container";
diff --git a/pkgs/development/python-modules/xgrammar/default.nix b/pkgs/development/python-modules/xgrammar/default.nix
index d97fac3743e3..90caf1208c0f 100644
--- a/pkgs/development/python-modules/xgrammar/default.nix
+++ b/pkgs/development/python-modules/xgrammar/default.nix
@@ -74,6 +74,9 @@ buildPythonPackage rec {
 
     # Torch not compiled with CUDA enabled
     "test_token_bitmask_operations"
+
+    # AssertionError
+    "test_json_schema_converter"
   ];
 
   pythonImportsCheck = [ "xgrammar" ];
diff --git a/pkgs/development/tools/devpod/add-tauri-updater-feature.patch b/pkgs/development/tools/devpod/add-tauri-updater-feature.patch
deleted file mode 100644
index 166948c78a03..000000000000
--- a/pkgs/development/tools/devpod/add-tauri-updater-feature.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/Cargo.toml b/Cargo.toml
-index 03f64e53..9e2ddcb6 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -15,6 +15,7 @@ serde_json = "1.0"
- serde = { version = "1.0", features = ["derive"] }
- # Tauri
- tauri = { version = "1.2.4", features = [
-+        "updater",
-         "dialog-save",
-         "process-relaunch",
-         "window-close",
diff --git a/pkgs/development/tools/devpod/default.nix b/pkgs/development/tools/devpod/default.nix
index ed24ccc73933..db37f9aded68 100644
--- a/pkgs/development/tools/devpod/default.nix
+++ b/pkgs/development/tools/devpod/default.nix
@@ -1,53 +1,54 @@
 {
   lib,
+  stdenv,
   buildGoModule,
-  copyDesktopItems,
-  desktopToDarwinBundle,
+  rustPlatform,
   fetchFromGitHub,
   fetchYarnDeps,
-  gtk3,
+
+  cargo-tauri,
+  desktop-file-utils,
   installShellFiles,
   jq,
-  libayatana-appindicator,
-  libsoup_2_4,
-  makeDesktopItem,
-  mkYarnPackage,
-  openssl,
+  makeBinaryWrapper,
+  moreutils,
+  nodejs,
   pkg-config,
-  rust,
-  rustPlatform,
-  stdenv,
+  yarnConfigHook,
+  wrapGAppsHook3,
+
+  glib-networking,
+  libayatana-appindicator,
+  openssl,
+  webkitgtk_4_1,
+
   testers,
-  webkitgtk_4_0,
 }:
 
 let
-  pname = "devpod";
-  version = "0.5.20";
+  version = "0.6.15";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-8LbqrOKC1als3Xm6ZuU2AySwT0UWjLN2xh+/CvioYew=";
+    repo = "devpod";
+    tag = "v${version}";
+    hash = "sha256-fLUJeEwNDyzMYUEYVQL9XGQv/VAxjH4IZ1SJa6jx4Mw=";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Codespaces but open-source, client-only and unopinionated: Works with any IDE and lets you use any cloud, kubernetes or just localhost docker";
     mainProgram = "devpod";
     homepage = "https://devpod.sh";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ maxbrunet ];
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      maxbrunet
+      tomasajt
+    ];
   };
-in
-rec {
-  devpod = buildGoModule {
-    inherit
-      version
-      src
-      pname
-      meta
-      ;
+
+  devpod = buildGoModule (finalAttrs: {
+    pname = "devpod";
+    inherit version src meta;
 
     vendorHash = null;
 
@@ -69,123 +70,123 @@ rec {
     '';
 
     passthru.tests.version = testers.testVersion {
-      package = devpod;
+      package = finalAttrs.finalPackage;
       command = "devpod version";
       version = "v${version}";
     };
-  };
+  });
 
-  devpod-desktop =
-    let
-      frontend-build = mkYarnPackage {
-        inherit version;
-        pname = "devpod-frontend";
+  devpod-desktop = rustPlatform.buildRustPackage {
+    pname = "devpod-desktop";
+    inherit version src;
 
-        src = "${src}/desktop";
+    sourceRoot = "${src.name}/desktop";
 
-        offlineCache = fetchYarnDeps {
-          yarnLock = "${src}/desktop/yarn.lock";
-          hash = "sha256-vUV4yX+UvEKrP0vHxjGwtW2WyONGqHVmFor+WqWbkCc=";
-        };
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/desktop/yarn.lock";
+      hash = "sha256-0Ov+Ik+th2IiuuqJyiO9t8vTyMqxDa9juEwbwHFaoi4=";
+    };
 
-        packageJSON = ./package.json;
+    cargoRoot = "src-tauri";
+    buildAndTestSubdir = "src-tauri";
 
-        buildPhase = ''
-          export HOME=$(mktemp -d)
-          yarn --offline run build
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-BwuV5nAQcTAtdfK4+NKEt8Cj7gqnatRwHh/BYJJrIPo=";
 
-          cp -r deps/devpod/dist $out
-        '';
+    patches = [
+      # don't create a .desktop file automatically registered to open the devpod:// URI scheme
+      # we edit the in-store .desktop file in postInstall to support opening the scheme,
+      # but users will have to configure the default handler manually
+      ./dont-auto-register-scheme.patch
 
-        doDist = false;
-        dontInstall = true;
-      };
+      # disable the button that symlinks the `devpod-cli` binary to ~/.local/bin/devpod
+      # and don't show popup where it prompts you to press the above mentioned button
+      # we'll symlink it manually to $out/bin/devpod in postInstall
+      ./dont-copy-sidecar-out-of-store.patch
 
-      rustTargetPlatformSpec = stdenv.hostPlatform.rust.rustcTarget;
-    in
-    rustPlatform.buildRustPackage {
-      inherit version src;
-      pname = "devpod-desktop";
+      # otherwise it's going to get stuck in an endless error cycle, quickly increasing the log file size
+      ./exit-update-checker-loop.patch
+    ];
 
-      sourceRoot = "${src.name}/desktop/src-tauri";
+    postPatch =
+      ''
+        ln -s ${lib.getExe devpod} src-tauri/bin/devpod-cli-${stdenv.hostPlatform.rust.rustcTarget}
 
-      useFetchCargoVendor = true;
-      cargoHash = "sha256-HD9b7OWilltL5Ymj28zoZwv5TJV3HT3LyCdagMqLH6E=";
-
-      # Workaround:
-      #   The `tauri` dependency features on the `Cargo.toml` file does not match the allowlist defined under `tauri.conf.json`.
-      #   Please run `tauri dev` or `tauri build` or add the `updater` feature.
-      # Upstream is not interested in fixing that: https://github.com/loft-sh/devpod/pull/648
-      patches = [ ./add-tauri-updater-feature.patch ];
-
-      postPatch =
-        ''
-          ln -s ${devpod}/bin/devpod bin/devpod-cli-${rustTargetPlatformSpec}
-          cp -r ${frontend-build} frontend-build
-
-          substituteInPlace tauri.conf.json --replace '"distDir": "../dist",' '"distDir": "frontend-build",'
-        ''
-        + lib.optionalString stdenv.hostPlatform.isLinux ''
-          substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-            --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
-
-          # Since `cargo build` is used instead of `tauri build`, configs are merged manually.
-          jq --slurp '.[0] * .[1]' tauri.conf.json tauri-linux.conf.json >tauri.conf.json.merged
-          mv tauri.conf.json.merged tauri.conf.json
-        '';
-
-      nativeBuildInputs =
-        [
-          copyDesktopItems
-          pkg-config
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [
-          jq
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          desktopToDarwinBundle
-        ];
-
-      buildInputs =
-        [
-          libsoup_2_4
-          openssl
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [
-          gtk3
-          libayatana-appindicator
-          webkitgtk_4_0
-        ];
-
-      desktopItems = [
-        (makeDesktopItem {
-          name = "DevPod";
-          categories = [ "Development" ];
-          comment = "Spin up dev environments in any infra";
-          desktopName = "DevPod";
-          exec = "DevPod %U";
-          icon = "DevPod";
-          terminal = false;
-          type = "Application";
-          mimeTypes = [ "x-scheme-handler/devpod" ];
-        })
-      ];
-
-      postInstall = ''
-        ln -sf ${devpod}/bin/devpod $out/bin/devpod-cli
-        mv $out/bin/devpod-desktop $out/bin/DevPod
-
-        mkdir -p $out/share/icons/hicolor/{256x256@2,128x128,32x32}/apps
-        cp icons/128x128@2x.png $out/share/icons/hicolor/256x256@2/apps/DevPod.png
-        cp icons/128x128.png $out/share/icons/hicolor/128x128/apps/DevPod.png
-        cp icons/32x32.png $out/share/icons/hicolor/32x32/apps/DevPod.png
+        # disable upstream updater
+        jq '.plugins.updater.endpoints = [ ] | .bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json \
+          | sponge src-tauri/tauri.conf.json
+      ''
+      + lib.optionalString stdenv.hostPlatform.isLinux ''
+        substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+          --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
       '';
 
-      meta = meta // {
-        mainProgram = "DevPod";
-        # darwin does not build
-        # https://github.com/h4llow3En/mac-notification-sys/issues/28
-        platforms = lib.platforms.linux;
-      };
+    nativeBuildInputs =
+      [
+        cargo-tauri.hook
+        jq
+        moreutils
+        nodejs
+        yarnConfigHook
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        desktop-file-utils
+        pkg-config
+        wrapGAppsHook3
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        makeBinaryWrapper
+      ];
+
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+      glib-networking
+      libayatana-appindicator
+      openssl
+      webkitgtk_4_1
+    ];
+
+    postInstall =
+      lib.optionalString stdenv.hostPlatform.isDarwin ''
+        # replace sidecar binary with symlink
+        ln -sf ${lib.getExe devpod} "$out/Applications/DevPod.app/Contents/MacOS/devpod-cli"
+
+        makeWrapper "$out/Applications/DevPod.app/Contents/MacOS/DevPod Desktop" "$out/bin/DevPod Desktop"
+      ''
+      + lib.optionalString stdenv.hostPlatform.isLinux ''
+        # replace sidecar binary with symlink
+        ln -sf ${lib.getExe devpod} "$out/bin/devpod-cli"
+
+        # set up scheme handling
+        desktop-file-edit "$out/share/applications/DevPod.desktop" \
+          --set-key="Exec"     --set-value="\"DevPod Desktop\" %u" \
+          --set-key="MimeType" --set-value="x-scheme-handler/devpod"
+
+        # whitespace in the icon name causes gtk-update-icon-cache to fail
+        desktop-file-edit "$out/share/applications/DevPod.desktop" \
+          --set-key="Icon"     --set-value="DevPod-Desktop"
+
+        for dir in "$out"/share/icons/hicolor/*/apps; do
+          mv "$dir/DevPod Desktop.png" "$dir/DevPod-Desktop.png"
+        done
+      ''
+      + ''
+        # propagate the `devpod` command
+        ln -s ${lib.getExe devpod} "$out/bin/devpod"
+      '';
+
+    # we only want to wrap the main binary
+    dontWrapGApps = true;
+
+    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapGApp "$out/bin/DevPod Desktop"
+    '';
+
+    meta = meta // {
+      mainProgram = "DevPod Desktop";
+      platforms = lib.platforms.linux ++ lib.platforms.darwin;
     };
+  };
+in
+{
+  inherit devpod devpod-desktop;
 }
diff --git a/pkgs/development/tools/devpod/dont-auto-register-scheme.patch b/pkgs/development/tools/devpod/dont-auto-register-scheme.patch
new file mode 100644
index 000000000000..1d05ada1ce6e
--- /dev/null
+++ b/pkgs/development/tools/devpod/dont-auto-register-scheme.patch
@@ -0,0 +1,13 @@
+diff --git a/src-tauri/src/custom_protocol.rs b/src-tauri/src/custom_protocol.rs
+index b6ed6e7..5434337 100644
+--- a/src-tauri/src/custom_protocol.rs
++++ b/src-tauri/src/custom_protocol.rs
+@@ -162,7 +162,7 @@ impl CustomProtocol {
+     pub fn setup(&self, app: AppHandle) {
+         let app_handle = app.clone();
+ 
+-        let result = tauri_plugin_deep_link::register(APP_URL_SCHEME, move |url_scheme| {
++        let result = tauri_plugin_deep_link::listen(move |url_scheme| {
+             tauri::async_runtime::block_on(async {
+                 info!("App opened with URL: {:?}", url_scheme.to_string());
+ 
diff --git a/pkgs/development/tools/devpod/dont-copy-sidecar-out-of-store.patch b/pkgs/development/tools/devpod/dont-copy-sidecar-out-of-store.patch
new file mode 100644
index 000000000000..6aab73b0c795
--- /dev/null
+++ b/pkgs/development/tools/devpod/dont-copy-sidecar-out-of-store.patch
@@ -0,0 +1,25 @@
+diff --git a/src/client/client.ts b/src/client/client.ts
+index 3e1747e..a842534 100644
+--- a/src/client/client.ts
++++ b/src/client/client.ts
+@@ -250,6 +250,7 @@ class Client {
+   }
+ 
+   public async isCLIInstalled(): Promise<Result<boolean>> {
++    return Return.Value(true);
+     try {
+       // we're in a flatpak, we need to check in other paths.
+       if (import.meta.env.TAURI_IS_FLATPAK === "true") {
+diff --git a/src/components/useInstallCLI.tsx b/src/components/useInstallCLI.tsx
+index ba3be79..ad25f3f 100644
+--- a/src/components/useInstallCLI.tsx
++++ b/src/components/useInstallCLI.tsx
+@@ -77,7 +77,7 @@ export function useInstallCLI() {
+           variant="outline"
+           isLoading={isLoading}
+           onClick={() => addBinaryToPath({})}
+-          isDisabled={status === "success"}>
++          isDisabled={true}>
+           Add CLI to Path
+         </Button>
+         <AlertDialog isOpen={isOpen} onClose={onClose} leastDestructiveRef={cancelRef}>
diff --git a/pkgs/development/tools/devpod/exit-update-checker-loop.patch b/pkgs/development/tools/devpod/exit-update-checker-loop.patch
new file mode 100644
index 000000000000..39080eca1af7
--- /dev/null
+++ b/pkgs/development/tools/devpod/exit-update-checker-loop.patch
@@ -0,0 +1,13 @@
+diff --git a/src-tauri/src/updates.rs b/src-tauri/src/updates.rs
+index 51b8c41..9cc954d 100644
+--- a/src-tauri/src/updates.rs
++++ b/src-tauri/src/updates.rs
+@@ -176,7 +176,7 @@ impl<'a> UpdateHelper<'a> {
+             if updater.is_err() {
+                 error!("Failed to get updater");
+ 
+-                continue;
++                return;
+             }
+             info!("Attempting to check update");
+             if let Ok(update) = updater.unwrap().check().await {
diff --git a/pkgs/development/tools/devpod/package.json b/pkgs/development/tools/devpod/package.json
deleted file mode 100644
index 1efadc72ce6f..000000000000
--- a/pkgs/development/tools/devpod/package.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "name": "devpod",
-  "private": true,
-  "version": "0.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "tsc && vite build",
-    "preview": "vite preview",
-    "tauri": "tauri",
-    "desktop:dev": "tauri dev --config src-tauri/tauri-dev.conf.json",
-    "desktop:dev:debug": "export DEBUG=true; yarn desktop:dev",
-    "desktop:build:dev": "DEBUG=true tauri build --config src-tauri/tauri-dev.conf.json",
-    "desktop:build:debug": "tauri build --debug",
-    "desktop:build": "tauri build --features enable-updater",
-    "format:check": "prettier --check .",
-    "format:fix": "prettier --write .",
-    "types:check": "tsc -p ./tsconfig.json --noEmit"
-  },
-  "dependencies": {
-    "@chakra-ui/icons": "2.1.1",
-    "@chakra-ui/react": "2.8.1",
-    "@emotion/react": "11.11.1",
-    "@emotion/styled": "11.11.0",
-    "@headlessui/react": "1.7.17",
-    "@tanstack/react-query": "4.36.1",
-    "@tanstack/react-query-devtools": "4.36.1",
-    "@tanstack/react-table": "8.10.7",
-    "@tauri-apps/api": "1.5.3",
-    "dayjs": "1.11.10",
-    "framer-motion": "10.16.9",
-    "markdown-to-jsx": "7.3.2",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
-    "react-hook-form": "7.48.2",
-    "react-icons": "4.12.0",
-    "react-router": "6.20.0",
-    "react-router-dom": "6.20.0",
-    "tauri-plugin-store-api": "https://github.com/tauri-apps/tauri-plugin-store#v1",
-    "uuid": "9.0.1",
-    "xterm": "5.3.0",
-    "xterm-addon-fit": "0.7.0"
-  },
-  "devDependencies": {
-    "@tanstack/eslint-plugin-query": "4.36.1",
-    "@tauri-apps/cli": "1.5.11",
-    "@types/node": "18.15.3",
-    "@types/react": "18.2.28",
-    "@types/react-dom": "18.2.13",
-    "@types/uuid": "9.0.5",
-    "@typescript-eslint/eslint-plugin": "5.59.11",
-    "@typescript-eslint/parser": "5.59.11",
-    "@vitejs/plugin-react": "4.1.0",
-    "eslint": "8.44.0",
-    "eslint-config-prettier": "8.8.0",
-    "eslint-config-react-app": "7.0.1",
-    "eslint-plugin-react": "7.34.1",
-    "eslint-plugin-react-hooks": "4.6.0",
-    "prettier": "3.0.3",
-    "typescript": "5.0.4",
-    "vite": "4.4.9"
-  },
-  "resolutions": {
-    "lodash": "4.17.21"
-  }
-}
diff --git a/pkgs/development/tools/misc/tokei/default.nix b/pkgs/development/tools/misc/tokei/default.nix
index da22f57b399b..42e0ba450c75 100644
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tokei";
-  version = "12.1.2";
+  version = "13.0.0-alpha.8";
 
   src = fetchFromGitHub {
     owner = "XAMPPRocky";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jqDsxUAMD/MCCI0hamkGuCYa8rEXNZIR8S+84S8FbgI=";
+    sha256 = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hCFFqvnbm0MXDvC5ea7Uo3xQdMO2e4tU7dEAvZxTM3s=";
+  cargoHash = "sha256-LzlyrKaRjUo6JnVLQnHidtI4OWa+GrhAc4D8RkL+nmQ=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f7732ba13471..0e6e7069543c 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,16 +16,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.14.3"; # zen
+      version = "6.14.4"; # zen
       suffix = "zen1"; # zen
-      sha256 = "17r4gmxbgs0aizlp35pdq515ag50zc3q20fxapbya4yp5qs6ncz0"; # zen
+      sha256 = "186rrmsi5y1nwhrd0f1bxjmkr5bhlagr0ih6pfdp5ks25is721ca"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.14.3"; # lqx
+      version = "6.14.4"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "1xqhjvi7a6gbsm3zq3gwc5hl8xw17afqx1b1db0p1cp5c9xn3vxa"; # lqx
+      sha256 = "1j255qi5r2y2n3dks50b2kna2qdm43skggjrgi362yjhb11psvw6"; # lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
index 5d6de9f2b0e4..fd617a294dbf 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@@ -6,18 +6,18 @@
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.4.0";
+  version = "4.4.3";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-YbzPnKiVPjkVAsJwpKIbjFRa9tqJidYN3AeyKskddA4=";
+    hash = "sha256-LhA4yDodTyeKxSr3BAYea/gohrHdsQIb2+MVixOBjC8=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-RC2j3Zf3t75Xi4RbUgRVittEosbfJxcBBg6Tm8cy7L8=";
+  npmDepsHash = "sha256-/0bxOC9e8+mfWAyj/yPXVGS4OAdFNU5H3x8z9aS0LBA=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 1ac92426e20d..ded740920ff7 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -13,11 +13,11 @@
 callPackage ../nginx/generic.nix args rec {
   pname = "openresty";
   nginxVersion = "1.27.1";
-  version = "${nginxVersion}.1";
+  version = "${nginxVersion}.2";
 
   src = fetchurl {
     url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "sha256-ebBx4nvcFD1fQB0Nv1BN5EIAcNhnU4xe3CVG0DUf1cA=";
+    sha256 = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg=";
   };
 
   # generic.nix applies fixPatch on top of every patch defined there.
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 49b540e855a3..51277f42aada 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -367,7 +367,6 @@ let
     };
 in
 self: {
-  mariadb_105 = throw "'mariadb_105' has been removed because it reached its End of Life. Consider upgrading to 'mariadb_106'.";
   # see https://mariadb.org/about/#maintenance-policy for EOLs
   mariadb_106 = self.callPackage generic {
     # Supported until 2026-07-06
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 816ae125e41d..9124dde8caeb 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -43,6 +43,7 @@ let
     x86_64-linux.target = "x86_64";
     armv7l-linux.target = "arm";
     aarch64-linux.target = "aarch64";
+    loongarch64-linux.target = "loongarch64";
     riscv32-linux.target = "riscv32";
     riscv64-linux.target = "riscv64";
   };
@@ -54,6 +55,7 @@ let
     x86_64-linux.target = "x86_64";
     armv7l-linux.target = "arm";
     aarch64-linux.target = "arm64";
+    loongarch64-linux.target = "loongarch64";
     riscv32-linux.target = "riscv32";
     riscv64-linux.target = "riscv64";
   };
diff --git a/pkgs/tools/networking/octodns/default.nix b/pkgs/tools/networking/octodns/default.nix
index e511070a4b79..d59389f8b273 100644
--- a/pkgs/tools/networking/octodns/default.nix
+++ b/pkgs/tools/networking/octodns/default.nix
@@ -1,26 +1,28 @@
 {
   lib,
-  buildPythonPackage,
-  dnspython,
   fetchFromGitHub,
-  fqdn,
-  idna,
-  natsort,
-  pytestCheckHook,
-  python-dateutil,
-  python,
-  pythonOlder,
-  pyyaml,
+  python3,
   runCommand,
-  setuptools,
-}:
 
-buildPythonPackage rec {
+  # passthru
+  octodns,
+}:
+let
+  # Export `python` with `octodns` as a module for `octodns-providers`.
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      octodns = final.toPythonModule octodns;
+    };
+  };
+  python3Packages = python.pkgs;
+in
+python3Packages.buildPythonApplication rec {
   pname = "octodns";
   version = "1.10.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = python.pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "octodns";
@@ -29,11 +31,11 @@ buildPythonPackage rec {
     hash = "sha256-L3c4lYt/fgMctJFArc1XlR+hvpz10kcBcYYXajnNQr0=";
   };
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     dnspython
     fqdn
     idna
@@ -42,21 +44,30 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3Packages; [
     pytestCheckHook
   ];
 
   pythonImportsCheck = [ "octodns" ];
 
-  passthru.withProviders =
-    ps:
-    let
-      pyEnv = python.withPackages ps;
-    in
-    runCommand "octodns-with-providers" { } ''
-      mkdir -p $out/bin
-      ln -st $out/bin ${pyEnv}/bin/octodns-*
-    '';
+  passthru = {
+    providers = lib.recurseIntoAttrs (
+      lib.packagesFromDirectoryRecursive {
+        inherit (python3Packages) callPackage;
+        directory = ./providers;
+      }
+    );
+
+    withProviders =
+      ps:
+      let
+        pyEnv = python.withPackages ps;
+      in
+      runCommand "octodns-with-providers" { } ''
+        mkdir -p $out/bin
+        ln -st $out/bin ${pyEnv}/bin/octodns-*
+      '';
+  };
 
   meta = with lib; {
     description = "Tools for managing DNS across multiple providers";
diff --git a/pkgs/tools/networking/octodns/providers/bind/default.nix b/pkgs/tools/networking/octodns/providers/bind/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/bind/default.nix
rename to pkgs/tools/networking/octodns/providers/bind/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/cloudflare/default.nix b/pkgs/tools/networking/octodns/providers/cloudflare/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/cloudflare/default.nix
rename to pkgs/tools/networking/octodns/providers/cloudflare/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/ddns/default.nix b/pkgs/tools/networking/octodns/providers/ddns/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/ddns/default.nix
rename to pkgs/tools/networking/octodns/providers/ddns/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/gandi/default.nix b/pkgs/tools/networking/octodns/providers/gandi/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/gandi/default.nix
rename to pkgs/tools/networking/octodns/providers/gandi/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/hetzner/default.nix b/pkgs/tools/networking/octodns/providers/hetzner/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/hetzner/default.nix
rename to pkgs/tools/networking/octodns/providers/hetzner/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/powerdns/default.nix b/pkgs/tools/networking/octodns/providers/powerdns/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/powerdns/default.nix
rename to pkgs/tools/networking/octodns/providers/powerdns/package.nix
diff --git a/pkgs/tools/networking/octodns/providers/transip/default.nix b/pkgs/tools/networking/octodns/providers/transip/package.nix
similarity index 100%
rename from pkgs/tools/networking/octodns/providers/transip/default.nix
rename to pkgs/tools/networking/octodns/providers/transip/package.nix
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7a1de7f5a91d..edc08cfce88e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1105,6 +1105,7 @@ mapAliases {
   MACS2 = macs2; # Added 2023-06-12
   mailctl = throw "mailctl has been renamed to oama"; # Added 2024-08-19
   mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
+  mariadb_105 = throw "'mariadb_105' has been removed because it reached its End of Life. Consider upgrading to 'mariadb_106'."; # Added 2025-04-26
   mariadb_110 = throw "mariadb_110 has been removed from nixpkgs, please switch to another version like mariadb_114"; # Added 2024-08-15
   mariadb-client = hiPrio mariadb.client; # added 2019.07.28
   maligned = throw "maligned was deprecated upstream in favor of x/tools/go/analysis/passes/fieldalignment"; # Added 20204-08-24
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 986f3c6bcb22..c2d40e5cca43 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -419,17 +419,9 @@ with pkgs;
 
   deviceTree = callPackage ../os-specific/linux/device-tree { };
 
-  octodns = python3Packages.callPackage ../tools/networking/octodns { };
+  octodns = callPackage ../tools/networking/octodns { };
 
-  octodns-providers = recurseIntoAttrs {
-    bind = python3Packages.callPackage ../tools/networking/octodns/providers/bind { };
-    gandi = python3Packages.callPackage ../tools/networking/octodns/providers/gandi { };
-    hetzner = python3Packages.callPackage ../tools/networking/octodns/providers/hetzner { };
-    powerdns = python3Packages.callPackage ../tools/networking/octodns/providers/powerdns { };
-    cloudflare = python3Packages.callPackage ../tools/networking/octodns/providers/cloudflare { };
-    ddns = python3Packages.callPackage ../tools/networking/octodns/providers/ddns { };
-    transip = python3Packages.callPackage ../tools/networking/octodns/providers/transip { };
-  };
+  octodns-providers = octodns.providers;
 
   oletools = with python3.pkgs; toPythonApplication oletools;
 
@@ -11233,7 +11225,6 @@ with pkgs;
   mariadb-connector-c_3_3 = callPackage ../servers/sql/mariadb/connector-c/3_3.nix { };
 
   inherit (import ../servers/sql/mariadb pkgs)
-    mariadb_105
     mariadb_106
     mariadb_1011
     mariadb_114
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c852edd8f59a..36a3f5d30d93 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12599,6 +12599,8 @@ self: super: with self; {
 
   pylint-flask = callPackage ../development/python-modules/pylint-flask { };
 
+  pylint-odoo = callPackage ../development/python-modules/pylint-odoo { };
+
   pylint-plugin-utils = callPackage ../development/python-modules/pylint-plugin-utils { };
 
   pylint-venv = callPackage ../development/python-modules/pylint-venv { };
@@ -14325,6 +14327,8 @@ self: super: with self; {
 
   pythran = callPackage ../development/python-modules/pythran { inherit (pkgs.llvmPackages) openmp; };
 
+  pythreejs = callPackage ../development/python-modules/pythreejs { };
+
   pytibber = callPackage ../development/python-modules/pytibber { };
 
   pytikz-allefeld = callPackage ../development/python-modules/pytikz-allefeld { };