diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 3de5b90203c3..ac6fbac74b90 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml
index 687dc6eaf64e..d9687774da19 100644
--- a/.github/workflows/manual-nixos-v2.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml
index 2eb84dfd327e..d8516fb8de4f 100644
--- a/.github/workflows/manual-nixpkgs-v2.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 7fcfba51ba4f..ebe086b37ea4 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -142,6 +142,8 @@
 
 - [victorialogs][https://docs.victoriametrics.com/victorialogs/], log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable)
 
+- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable)
+
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
 - [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c46cd9d4b6e4..d062381889fb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1118,6 +1118,7 @@
   ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gobgpd.nix
+  ./services/networking/gokapi.nix
   ./services/networking/gvpe.nix
   ./services/networking/hans.nix
   ./services/networking/harmonia.nix
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index 772375d8947d..73758a7bed9e 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -8,7 +8,7 @@
   services.userborn.enable = lib.mkDefault true;
 
   # Random perl remnants
-  system.disableInstallerTools = lib.mkDefault true;
+  system.tools.nixos-generate-config.enable = lib.mkDefault false;
   programs.less.lessopen = lib.mkDefault null;
   programs.command-not-found.enable = lib.mkDefault false;
   boot.enableContainers = lib.mkDefault false;
@@ -20,9 +20,4 @@
   # Check that the system does not contain a Nix store path that contains the
   # string "perl".
   system.forbiddenDependenciesRegexes = [ "perl" ];
-
-  # Re-add nixos-rebuild to the systemPackages that was removed by the
-  # `system.disableInstallerTools` option.
-  environment.systemPackages = [ pkgs.nixos-rebuild ];
-
 }
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 456bd136d1d9..065ec581ee90 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -520,7 +520,7 @@ in
             elif [[ $compression == zstd ]]; then
               compressionCmd=(zstd --rm)
             fi
-            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c -print0 | xargs -0 -r "''${compressionCmd[@]}" --force --quiet
+            find ${baseDir}/build-logs -ignore_readdir_race -type f -name "*.drv" -mtime +3 -size +0c -print0 | xargs -0 -r "''${compressionCmd[@]}" --force --quiet
           '';
         startAt = "Sun 01:45";
         serviceConfig.Slice = "system-hydra.slice";
diff --git a/nixos/modules/services/misc/jackett.nix b/nixos/modules/services/misc/jackett.nix
index 93f1868ad821..3596ff6543e4 100644
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@@ -86,7 +86,7 @@ in
         ProtectProc = "invisible";
         ProtectSystem = "strict";
         ReadWritePaths = [
-          "${config.users.users.${cfg.user}.home}"
+          cfg.dataDir
         ];
         RemoveIPC = true;
         RestrictAddressFamilies = [
diff --git a/nixos/modules/services/networking/birdwatcher.nix b/nixos/modules/services/networking/birdwatcher.nix
index 3325d454633a..a136b4d08abb 100644
--- a/nixos/modules/services/networking/birdwatcher.nix
+++ b/nixos/modules/services/networking/birdwatcher.nix
@@ -59,7 +59,7 @@ in
           [bird]
           listen = "0.0.0.0:29184"
           config = "/etc/bird/bird.conf"
-          birdc  = "''${pkgs.bird}/bin/birdc"
+          birdc  = "''${pkgs.bird2}/bin/birdc"
           ttl = 5 # time to live (in minutes) for caching of cli output
 
           [parser]
diff --git a/nixos/modules/services/networking/gokapi.nix b/nixos/modules/services/networking/gokapi.nix
new file mode 100644
index 000000000000..d90588b55ba0
--- /dev/null
+++ b/nixos/modules/services/networking/gokapi.nix
@@ -0,0 +1,143 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.gokapi;
+  settingsFormat = pkgs.formats.json { };
+  userSettingsFile = settingsFormat.generate "generated-config.json" cfg.settings;
+in
+{
+  options.services.gokapi = {
+    enable = lib.mkEnableOption "Lightweight selfhosted Firefox Send alternative without public upload";
+
+    mutableSettings = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Allow changes to the program config made by the program to persist between restarts.
+        If disabled all required values must be set using nix, and all changes to config format over application updates must be resolved by user.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "gokapi" { };
+
+    environment = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (lib.types.either lib.types.str lib.types.int);
+        options = {
+          GOKAPI_CONFIG_DIR = lib.mkOption {
+            type = lib.types.str;
+            default = "%S/gokapi/config";
+            description = "Sets the directory for the config file.";
+          };
+          GOKAPI_CONFIG_FILE = lib.mkOption {
+            type = lib.types.str;
+            default = "config.json";
+            description = "Sets the filename for the config file.";
+          };
+          GOKAPI_DATA_DIR = lib.mkOption {
+            type = lib.types.str;
+            default = "%S/gokapi/data";
+            description = "Sets the directory for the data.";
+          };
+          GOKAPI_PORT = lib.mkOption {
+            type = lib.types.port;
+            default = 53842;
+            description = "Sets the port of the service.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Environment variables to be set for the gokapi service. Can use systemd specifiers.
+        For full list see <https://gokapi.readthedocs.io/en/latest/advanced.html#environment-variables>.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = { };
+      };
+      default = { };
+      description = ''
+        Configuration settings for the generated config json file.
+        See <https://gokapi.readthedocs.io/en/latest/advanced.html#config-json> for more information
+      '';
+    };
+    settingsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = ''
+        Path to config file to parse and append to settings.
+        Largely useful for loading secrets from a file not in the nix store. Can use systemd specifiers.
+        See <https://gokapi.readthedocs.io/en/latest/advanced.html#config-json> for more information
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.gokapi = {
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = lib.mapAttrs (_: value: toString value) cfg.environment;
+      unitConfig = {
+        Description = "gokapi service";
+      };
+      serviceConfig = {
+        ExecStartPre =
+          let
+            updateScript = lib.getExe (
+              pkgs.writeShellApplication {
+                name = "merge-config";
+                runtimeInputs = with pkgs; [ jq ];
+                text = ''
+                  echo "Running merge-config"
+                  mutableSettings="$1"
+                  statefulSettingsFile="$2"
+                  settingsFile="$3"
+                  if [[ "$mutableSettings" == true ]]; then
+                    if [[ -f "$statefulSettingsFile" ]]; then
+                      echo "Updating stateful config file"
+                      merged="$(jq -s '.[0] * .[1]' "$statefulSettingsFile" ${userSettingsFile})"
+                      echo "$merged" > "$statefulSettingsFile"
+                    fi
+                  else
+                    echo "Overwriting stateful config file"
+                    mkdir -p "$(dirname "$statefulSettingsFile")"
+                    cat ${userSettingsFile} > "$statefulSettingsFile"
+                  fi
+                  if [ "$settingsFile" != "null" ]; then
+                    echo "Merging settings file into current stateful settings file"
+                    merged="$(jq -s '.[0] * .[1]' "$statefulSettingsFile" "$settingsFile")"
+                    echo "$merged" > "$statefulSettingsFile"
+                  fi
+                '';
+              }
+            );
+          in
+          lib.strings.concatStringsSep " " [
+            updateScript
+            (lib.boolToString cfg.mutableSettings)
+            "${cfg.environment.GOKAPI_CONFIG_DIR}/${cfg.environment.GOKAPI_CONFIG_FILE}"
+            (if (cfg.settingsFile == null) then "null" else cfg.settingsFile)
+          ];
+        ExecStart = lib.getExe cfg.package;
+        RestartSec = 30;
+        DynamicUser = true;
+        PrivateTmp = true;
+        StateDirectory = "gokapi";
+        CacheDirectory = "gokapi";
+        Restart = "on-failure";
+      };
+    };
+  };
+  meta.maintainers = with lib.maintainers; [
+    delliott
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1eda3377c0ae..94656b9fe0b0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -479,6 +479,7 @@ in {
   gobgpd = handleTest ./gobgpd.nix {};
   gocd-agent = handleTest ./gocd-agent.nix {};
   gocd-server = handleTest ./gocd-server.nix {};
+  gokapi = runTest ./gokapi.nix;
   gollum = handleTest ./gollum.nix {};
   gonic = handleTest ./gonic.nix {};
   google-oslogin = handleTest ./google-oslogin {};
diff --git a/nixos/tests/birdwatcher.nix b/nixos/tests/birdwatcher.nix
index 00b3b6d77af2..f82d0823b9df 100644
--- a/nixos/tests/birdwatcher.nix
+++ b/nixos/tests/birdwatcher.nix
@@ -72,7 +72,7 @@ makeTest {
           [bird]
           listen = "0.0.0.0:29184"
           config = "/etc/bird/bird.conf"
-          birdc  = "${pkgs.bird}/bin/birdc"
+          birdc  = "${pkgs.bird2}/bin/birdc"
           ttl = 5 # time to live (in minutes) for caching of cli output
           [parser]
           filter_fields = []
diff --git a/nixos/tests/gokapi.nix b/nixos/tests/gokapi.nix
new file mode 100644
index 000000000000..585424f6b9f3
--- /dev/null
+++ b/nixos/tests/gokapi.nix
@@ -0,0 +1,22 @@
+{ lib, ... }:
+let
+  port = 6000;
+in
+{
+  name = "gokapi";
+
+  meta.maintainers = with lib.maintainers; [ delliott ];
+
+  nodes.machine = {
+    services.gokapi = {
+      enable = true;
+      environment.GOKAPI_PORT = port;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("gokapi.service")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/default.nix b/pkgs/applications/editors/vim/plugins/default.nix
index 3063c2e696cf..eb7c70db0e5d 100644
--- a/pkgs/applications/editors/vim/plugins/default.nix
+++ b/pkgs/applications/editors/vim/plugins/default.nix
@@ -24,6 +24,11 @@ let
     inherit (neovimUtils) buildNeovimPlugin;
   };
 
+  extras = callPackage ./extras.nix {
+    inherit buildVimPlugin;
+    inherit (neovimUtils) buildNeovimPlugin;
+  };
+
   # TL;DR
   # * Add your plugin to ./vim-plugin-names
   # * run ./update.py
@@ -36,9 +41,11 @@ let
   };
 
   aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: { };
-
-  extensible-self = lib.makeExtensible (
-    extends aliases (extends overrides (extends plugins initialPackages))
-  );
 in
-extensible-self
+lib.pipe initialPackages [
+  (extends plugins)
+  (extends extras)
+  (extends overrides)
+  (extends aliases)
+  lib.makeExtensible
+]
diff --git a/pkgs/applications/editors/vim/plugins/extras.nix b/pkgs/applications/editors/vim/plugins/extras.nix
new file mode 100644
index 000000000000..a5fbf0acb77e
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/extras.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  buildVimPlugin,
+  buildNeovimPlugin,
+  nodePackages,
+  neovim-unwrapped,
+}:
+let
+  luaPackages = neovim-unwrapped.lua.pkgs;
+in
+self: super:
+(
+  let
+    nodePackageNames = [
+      "coc-cmake"
+      "coc-docker"
+      "coc-emmet"
+      "coc-eslint"
+      "coc-explorer"
+      "coc-flutter"
+      "coc-git"
+      "coc-go"
+      "coc-haxe"
+      "coc-highlight"
+      "coc-html"
+      "coc-java"
+      "coc-jest"
+      "coc-json"
+      "coc-lists"
+      "coc-ltex"
+      "coc-markdownlint"
+      "coc-pairs"
+      "coc-prettier"
+      "coc-r-lsp"
+      "coc-rls"
+      "coc-rust-analyzer"
+      "coc-sh"
+      "coc-smartf"
+      "coc-snippets"
+      "coc-solargraph"
+      "coc-spell-checker"
+      "coc-sqlfluff"
+      "coc-stylelint"
+      "coc-sumneko-lua"
+      "coc-tabnine"
+      "coc-texlab"
+      "coc-tsserver"
+      "coc-ultisnips"
+      "coc-vetur"
+      "coc-vimlsp"
+      "coc-vimtex"
+      "coc-wxml"
+      "coc-yaml"
+      "coc-yank"
+    ];
+    nodePackage2VimPackage =
+      name:
+      buildVimPlugin {
+        pname = name;
+        inherit (nodePackages.${name}) version meta;
+        src = "${nodePackages.${name}}/lib/node_modules/${name}";
+      };
+  in
+  lib.genAttrs nodePackageNames nodePackage2VimPackage
+)
+// (
+  let
+    luarocksPackageNames = [
+      "fidget-nvim"
+      "gitsigns-nvim"
+      "image-nvim"
+      "lsp-progress-nvim"
+      "lualine-nvim"
+      "luasnip"
+      "lush-nvim"
+      "lz-n"
+      "lze"
+      "lzextras"
+      "lzn-auto-require"
+      "middleclass"
+      "mini-test"
+      "neorg"
+      "neotest"
+      "nui-nvim"
+      "nvim-cmp"
+      "nvim-nio"
+      "nvim-web-devicons"
+      "oil-nvim"
+      "orgmode"
+      "papis-nvim"
+      "rest-nvim"
+      "rocks-config-nvim"
+      "rtp-nvim"
+      "telescope-manix"
+      "telescope-nvim"
+    ];
+    toVimPackage =
+      name:
+      buildNeovimPlugin {
+        luaAttr = luaPackages.${name};
+      };
+  in
+  lib.genAttrs luarocksPackageNames toVimPackage
+)
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 129b5c92c00f..a78d1b5c4699 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1281,6 +1281,7 @@ in
     dependencies = [ self.plenary-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   gitsigns-nvim = super.gitsigns-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -1421,6 +1422,7 @@ in
     doInstallCheck = true;
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   image-nvim = super.image-nvim.overrideAttrs {
     dependencies = with self; [
       nvim-treesitter
@@ -1683,6 +1685,7 @@ in
     dependencies = [ self.lualine-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   luasnip = super.luasnip.overrideAttrs {
     dependencies = [ luaPackages.jsregexp ];
   };
@@ -1949,6 +1952,7 @@ in
     ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   neotest = super.neotest.overrideAttrs {
     dependencies = with self; [
       nvim-nio
@@ -2838,6 +2842,7 @@ in
   };
 
   # needs  "http" and "json" treesitter grammars too
+  # NOTE: this overrides a luaPackages-based plugin
   rest-nvim = super.rest-nvim.overrideAttrs {
     dependencies = with self; [
       plenary-nvim
@@ -3225,6 +3230,7 @@ in
     dependencies = [ self.plenary-nvim ];
   };
 
+  # NOTE: this overrides a luaPackages-based plugin
   telescope-nvim = super.telescope-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -3988,101 +3994,6 @@ in
     '';
 
   };
-}
-// (
-  let
-    nodePackageNames = [
-      "coc-cmake"
-      "coc-docker"
-      "coc-emmet"
-      "coc-eslint"
-      "coc-explorer"
-      "coc-flutter"
-      "coc-git"
-      "coc-go"
-      "coc-haxe"
-      "coc-highlight"
-      "coc-html"
-      "coc-java"
-      "coc-jest"
-      "coc-json"
-      "coc-lists"
-      "coc-ltex"
-      "coc-markdownlint"
-      "coc-pairs"
-      "coc-prettier"
-      "coc-r-lsp"
-      "coc-rls"
-      "coc-rust-analyzer"
-      "coc-sh"
-      "coc-smartf"
-      "coc-snippets"
-      "coc-solargraph"
-      "coc-spell-checker"
-      "coc-sqlfluff"
-      "coc-stylelint"
-      "coc-sumneko-lua"
-      "coc-tabnine"
-      "coc-texlab"
-      "coc-tsserver"
-      "coc-ultisnips"
-      "coc-vetur"
-      "coc-vimlsp"
-      "coc-vimtex"
-      "coc-wxml"
-      "coc-yaml"
-      "coc-yank"
-    ];
-    nodePackage2VimPackage =
-      name:
-      buildVimPlugin {
-        pname = name;
-        inherit (nodePackages.${name}) version meta;
-        src = "${nodePackages.${name}}/lib/node_modules/${name}";
-      };
-  in
-  lib.genAttrs nodePackageNames nodePackage2VimPackage
-)
-// (
-  let
-    luarocksPackageNames = [
-      "fidget-nvim"
-      "gitsigns-nvim"
-      "image-nvim"
-      "lsp-progress-nvim"
-      "lualine-nvim"
-      "luasnip"
-      "lush-nvim"
-      "lz-n"
-      "lze"
-      "lzextras"
-      "lzn-auto-require"
-      "middleclass"
-      "mini-test"
-      "neorg"
-      "neotest"
-      "nui-nvim"
-      "nvim-cmp"
-      "nvim-nio"
-      "nvim-web-devicons"
-      "oil-nvim"
-      "orgmode"
-      "papis-nvim"
-      "rest-nvim"
-      "rocks-config-nvim"
-      "rtp-nvim"
-      "telescope-manix"
-      "telescope-nvim"
-    ];
-    toVimPackage =
-      name:
-      neovimUtils.buildNeovimPlugin {
-        luaAttr = luaPackages.${name};
-      };
-  in
-  lib.genAttrs luarocksPackageNames toVimPackage
-)
-// {
 
   rocks-nvim =
     (neovimUtils.buildNeovimPlugin {
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 0be8f36274a3..75ef7b1a9bf0 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -10,46 +10,11 @@
 
 let
   pname = "1password";
-  version = if channel == "stable" then "8.10.60" else "8.10.68-12.BETA";
 
-  sources = {
-    stable = {
-      x86_64-linux = {
-        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-QCoV66LvGo6vA5fjuE3fG+LwehKVMPmgaDghh9YEvmA=";
-      };
-      aarch64-linux = {
-        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-E5TniXur9ATJ3ER/zTFc6EiBrH/kbNvIao0ADLyBZZE=";
-      };
-      x86_64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-2Nv4CHKLgCFbU1TeJQhIq8YdkJSQJXtUw2S17B8cS4s=";
-      };
-      aarch64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-drJiM8EiUM3M54+KPQdLvAmSfBH5YPqQk14yjHzoBtM=";
-      };
-    };
-    beta = {
-      x86_64-linux = {
-        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-/0Y1qnCI/gXGKTHk9EIaUVbHTwRkOvwOOiMif6sRkqw=";
-      };
-      aarch64-linux = {
-        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-4J6a10r5n8ffqC5Y2pjO/GJLXY5AQDkQWmFNLYeK/Xw=";
-      };
-      x86_64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-XvflRqqUI59ekuSiQXyACzS94VIrl8wJjemi0xAznZU=";
-      };
-      aarch64-darwin = {
-        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-UErp3pcSXz/C5s3JraLoBN89tL8ghgJ3XLpg7KtU8Sc=";
-      };
-    };
-  };
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+  inherit (versions.${channel} or (throw "unknown channel ${channel}")) version;
+
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
 
   src = fetchurl {
     inherit
diff --git a/pkgs/applications/misc/1password-gui/sources.json b/pkgs/applications/misc/1password-gui/sources.json
new file mode 100644
index 000000000000..e6f70a4e3f01
--- /dev/null
+++ b/pkgs/applications/misc/1password-gui/sources.json
@@ -0,0 +1,38 @@
+{
+  "stable": {
+    "x86_64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.60.x64.tar.gz",
+      "hash": "sha256-QCoV66LvGo6vA5fjuE3fG+LwehKVMPmgaDghh9YEvmA="
+    },
+    "aarch64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.60.arm64.tar.gz",
+      "hash": "sha256-E5TniXur9ATJ3ER/zTFc6EiBrH/kbNvIao0ADLyBZZE="
+    },
+    "x86_64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.60-x86_64.zip",
+      "hash": "sha256-2Nv4CHKLgCFbU1TeJQhIq8YdkJSQJXtUw2S17B8cS4s="
+    },
+    "aarch64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.60-aarch64.zip",
+      "hash": "sha256-drJiM8EiUM3M54+KPQdLvAmSfBH5YPqQk14yjHzoBtM="
+    }
+  },
+  "beta": {
+    "x86_64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.68-12.BETA.x64.tar.gz",
+      "hash": "sha256-/0Y1qnCI/gXGKTHk9EIaUVbHTwRkOvwOOiMif6sRkqw="
+    },
+    "aarch64-linux": {
+      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.68-12.BETA.arm64.tar.gz",
+      "hash": "sha256-4J6a10r5n8ffqC5Y2pjO/GJLXY5AQDkQWmFNLYeK/Xw="
+    },
+    "x86_64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-x86_64.zip",
+      "hash": "sha256-XvflRqqUI59ekuSiQXyACzS94VIrl8wJjemi0xAznZU="
+    },
+    "aarch64-darwin": {
+      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-aarch64.zip",
+      "hash": "sha256-UErp3pcSXz/C5s3JraLoBN89tL8ghgJ3XLpg7KtU8Sc="
+    }
+  }
+}
diff --git a/pkgs/applications/misc/1password-gui/update.sh b/pkgs/applications/misc/1password-gui/update.sh
index fc6d350f2330..c32076304537 100755
--- a/pkgs/applications/misc/1password-gui/update.sh
+++ b/pkgs/applications/misc/1password-gui/update.sh
@@ -1,58 +1,83 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
+#!nix-shell -i bash -p jq gnupg
 #shellcheck shell=bash
 
-CURRENT_HASH=""
+set -euo pipefail
 
-print_hash() {
-    OS="$1"
-    CHANNEL="$2"
-    ARCH="$3"
-    VERSION="$4"
+cd -- "$(dirname "${BASH_SOURCE[0]}")"
 
-    if [[ "$OS" == "linux" ]]; then
-        if [[ "$ARCH" == "x86_64" ]]; then
-            EXT="x64.tar.gz"
-        else
-            EXT="arm64.tar.gz"
-        fi
-        URL="https://downloads.1password.com/${OS}/tar/${CHANNEL}/${ARCH}/1password-${VERSION}.${EXT}"
+mk_url() {
+  local \
+    base_url="https://downloads.1password.com" \
+    os="$1" \
+    channel="$2" \
+    arch="$3" \
+    version="$4"
+
+  if [[ ${os} == "linux" ]]; then
+    if [[ ${arch} == "x86_64" ]]; then
+      ext="x64.tar.gz"
     else
-        EXT="$ARCH.zip"
-        URL="https://downloads.1password.com/${OS}/1Password-${VERSION}-${EXT}"
+      ext="arm64.tar.gz"
     fi
+    url="${base_url}/${os}/tar/${channel}/${arch}/1password-${version}.${ext}"
+  else
+    ext="${arch}.zip"
+    url="${base_url}/mac/1Password-${version}-${ext}"
+  fi
 
-    CURRENT_HASH=$(nix store prefetch-file "$URL" --json | jq -r '.hash')
-
-    echo "$CHANNEL ${ARCH}-${OS}: $CURRENT_HASH"
+  echo "${url}"
 }
 
-if [[ -z "$STABLE_VER" && -n "$1" ]]; then
-    STABLE_VER="$1"
-fi
+cleanup() {
+  if [[ -f ${GPG_KEYRING-} ]]; then
+    rm "${GPG_KEYRING}"
+  fi
 
-if [[ -z "$BETA_VER" && -n "$2" ]]; then
-    BETA_VER="$2"
-fi
+  if [[ -f ${JSON_HEAP-} ]]; then
+    rm "${JSON_HEAP}"
+  fi
+}
 
-if [[ "${BETA_VER: -4}" != "BETA" ]]; then
-    BETA_VER="$BETA_VER.BETA"
-fi
+trap cleanup EXIT
 
-if [[ -z "$STABLE_VER" ]]; then
-    echo "No 'STABLE_VER' environment variable provided, skipping"
-else
-    print_hash "linux" "stable" "x86_64" "$STABLE_VER"
-    print_hash "linux" "stable" "aarch64" "$STABLE_VER"
-    print_hash "mac" "stable" "x86_64" "$STABLE_VER"
-    print_hash "mac" "stable" "aarch64" "$STABLE_VER"
-fi
+# Get channel versions from versions.json
+declare -A version=(
+  ["stable"]=$(jq -r '.stable.version' versions.json)
+  ["beta"]=$(jq -r '.beta.version' versions.json)
+)
 
-if [[ -z "$BETA_VER" ]]; then
-    echo "No 'BETA_VER' environment variable provided, skipping"
-else
-    print_hash "linux" "beta" "x86_64" "$BETA_VER"
-    print_hash "linux" "beta" "aarch64" "$BETA_VER"
-    print_hash "mac" "beta" "x86_64" "$BETA_VER"
-    print_hash "mac" "beta" "aarch64" "$BETA_VER"
-fi
+#
+GPG_KEYRING=$(mktemp -t 1password.kbx.XXXXXX)
+gpg --no-default-keyring --keyring "${GPG_KEYRING}" \
+  --keyserver keyserver.ubuntu.com \
+  --receive-keys 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
+
+JSON_HEAP=$(mktemp -t 1password-gui.jsonheap.XXXXXX)
+for channel in stable beta; do
+  for os in linux darwin; do
+    for arch in x86_64 aarch64; do
+      url=$(mk_url ${os} ${channel} ${arch} "${version[${channel}]}")
+      nix store prefetch-file --json "${url}" | jq "
+        {
+          \"${channel}\": {
+             \"${arch}-${os}\": {
+               \"url\": \"${url}\",
+               \"hash\": .hash,
+               \"storePath\": .storePath
+             }
+           }
+        }" >> "${JSON_HEAP}"
+
+      # For some reason 1Password PGP signs only Linux binaries.
+      if [[ ${os} == "linux" ]]; then
+         gpgv --keyring "${GPG_KEYRING}" \
+           $(nix store prefetch-file --json "${url}.sig" | jq -r .storePath) \
+           $(jq -r --slurp ".[-1].[].[].storePath" "${JSON_HEAP}")
+      fi
+    done
+  done
+done
+
+# Combine heap of hash+url objects into a single JSON object.
+jq --slurp 'reduce .[] as $x ({}; . * $x) | del (.[].[].storePath)' "${JSON_HEAP}" > sources.json
diff --git a/pkgs/applications/misc/1password-gui/versions.json b/pkgs/applications/misc/1password-gui/versions.json
new file mode 100644
index 000000000000..803d5238d94c
--- /dev/null
+++ b/pkgs/applications/misc/1password-gui/versions.json
@@ -0,0 +1,9 @@
+{
+  "stable": {
+    "version": "8.10.60"
+  },
+
+  "beta": {
+    "version": "8.10.68-12.BETA"
+  }
+}
diff --git a/pkgs/by-name/al/altus/package.nix b/pkgs/by-name/al/altus/package.nix
new file mode 100644
index 000000000000..59eb2e510921
--- /dev/null
+++ b/pkgs/by-name/al/altus/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchurl,
+  appimageTools,
+  makeWrapper,
+}:
+
+let
+  pname = "altus";
+  version = "5.6.0";
+
+  src = fetchurl {
+    name = "altus-${version}.AppImage";
+    url = "https://github.com/amanharwara/altus/releases/download/${version}/Altus-${version}.AppImage";
+    hash = "sha512-u4eBTboFJaU5qLFURXFchOmFV7GzlDbUokrBpxx8QeAJO6B0IwX1gJU0C69BKinIdO4Q93SAcjsvUkvSI+blrw==";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  extraInstallCommands = ''
+    install -m 444 -D ${appimageContents}/Altus.desktop $out/share/applications/altus.desktop
+    install -m 444 -D ${appimageContents}/Altus.png \
+      $out/share/icons/hicolor/scalable/apps/altus.png
+    substituteInPlace $out/share/applications/altus.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=altus'
+    wrapProgram "$out/bin/altus" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+  '';
+
+  meta = {
+    description = "Client for WhatsApp Web with themes, notifications and multiple accounts support";
+    homepage = "https://github.com/amanharwara/altus";
+    changelog = "https://github.com/amanharwara/altus/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ johnrtitor ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 4dca811e4eba..b1d471582f74 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -56,13 +56,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.4.1";
+  version = "4.8.4.4";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-iZKmwbSvyLTW9xWi/6WIwB1BeZai326e0Ut7x1RmKFw=";
+    hash = "sha256-uWO38eK4pJ7pkViyBh3QSVWPIMXn1tcMSS4Bt1M1bpk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ba/bark/package.nix b/pkgs/by-name/ba/bark/package.nix
index 67dadd7660d7..ff30f59217d6 100644
--- a/pkgs/by-name/ba/bark/package.nix
+++ b/pkgs/by-name/ba/bark/package.nix
@@ -1,23 +1,55 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, alsa-lib
-, speexdsp
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  alsa-lib,
+  libopus,
+  soxr,
+  cmake,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (final: {
   pname = "bark";
-  version = "unstable-2023-08-22";
+  version = "0.6.0";
   src = fetchFromGitHub {
     owner = "haileys";
     repo = "bark";
-    rev = "2586b9fb58b496f8ef06f516c9cd3aace77521f7";
-    hash = "sha256-sGroae6uJhB9UIpFmvt520Zs9k0ir7H8pGkhKJmVWek=";
+    tag = "v${final.version}";
+    hash = "sha256-JaUIWGCYhasM0DgqL+DiG2rE1OWVg/N66my/4RWDN1E=";
   };
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WqJZoYpOQQGJGvND2R1o2nvK5P24z7YeJ9i26mai45M=";
-  buildInputs = [ alsa-lib speexdsp ];
-  nativeBuildInputs = [ pkg-config ];
+  cargoHash = "sha256-LcmX8LbK8UHDDeqwLTFEUuRBv9GgDiCpXP4bmIR3gME=";
+
+  # Broken rustdoc comment
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/haileys/bark/pull/13.patch";
+      hash = "sha256-cA1bqc7XhJ2cxOYvjIJ9oopzBZ9I4rGERkiwDAUh3V4";
+    })
+  ];
+
+  buildInputs = [
+    alsa-lib
+    libopus
+    soxr
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Live sync audio streaming for local networks";
@@ -27,5 +59,4 @@ rustPlatform.buildRustPackage {
     platforms = lib.platforms.linux;
     mainProgram = "bark";
   };
-}
-
+})
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index 01be0da24a3a..ca6dc376ee14 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -1,20 +1,20 @@
 {
-  buildGo124Module,
+  buildGoModule,
   lib,
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
 }:
 
-buildGo124Module rec {
+buildGoModule rec {
   pname = "beszel";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     tag = "v${version}";
-    hash = "sha256-4RuYZcBR7X9Ug6l91N/FtyfT38HlW2guputzo4kF8YU=";
+    hash = "sha256-yYSX58qA4vE7Bp3ADc6rIMf9yaeU7Zw7D5rmES6x6oA=";
   };
 
   webui = buildNpmPackage {
@@ -48,7 +48,7 @@ buildGo124Module rec {
 
     sourceRoot = "${src.name}/beszel/site";
 
-    npmDepsHash = "sha256-UKOS7QyGsdKosjhxVhZErFkXhnfrFxdX0ozBUJGsNII=";
+    npmDepsHash = "sha256-27NUV23dNHFSwOHiB/wGSAWkp6eZMnw/6Pd3Fwn98+s=";
   };
 
   sourceRoot = "${src.name}/beszel";
diff --git a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
index 1213cb16ec1c..d56c65f42581 100644
--- a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
+++ b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bundle-licenses";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "sstadick";
     repo = "cargo-bundle-licenses";
     rev = "v${version}";
-    hash = "sha256-leSHjl/B76Z4JM1wO9IBKbdfMgHtY/pGut1hnDd8/L0=";
+    hash = "sha256-pTxZ9s8ZccylMfEiifYmJuBB+riZ37QJSAMpVuSgLzs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I5zIrMZ9GnlAUfWaaFP6yr+pv8wWtxguxSL0zho3BRs=";
+  cargoHash = "sha256-4zolwQzK6dnFIcS2NwuxYZRS2AGcUGHh+KQzDkI0J6c=";
 
   meta = with lib; {
     description = "Generate a THIRDPARTY file with all licenses in a cargo project";
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index 1f44d2542749..89ba5a817b3b 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.20.4";
+  version = "1.20.5";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-pvTHrFrnRSprsbIPenVPVnnmU59OQCZc9DF+8wcWJ3A=";
+    hash = "sha256-dBx/WHi+qFrOyA0lIjvARcAZ96WvHCjVs94XicSL5L0=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-hAnIKuFtS6l4nhq8bTcHkvW43FT6K8+0FglRRNfDtPg=";
+  vendorHash = "sha256-rQDVXMLXI2/D4SNLfs3CT4chDnzhh1aU5xuMMBDMhLI=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/co/countryguess/package.nix b/pkgs/by-name/co/countryguess/package.nix
new file mode 100644
index 000000000000..22cf4135f4db
--- /dev/null
+++ b/pkgs/by-name/co/countryguess/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  makeWrapper,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "countryguess";
+  version = "0-unstable-2025-03-04";
+  # upstream pyproject.toml is nonsense. Copied from another project
+  # without customizing it for this project.
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "swarbler";
+    repo = "countryguess";
+    rev = "28f45231bc3d8bedeb7d1b51d56ca1b56796ff8c";
+    hash = "sha256-S/fy94aRoVI2CvICrviQ2ZgVESWYLuREb5mwsfXL6Hc=";
+  };
+
+  dependencies = with python3Packages; [
+    art
+    colorama
+  ];
+
+  # upstream python file lacks shebang
+  postPatch = ''
+    echo '#!/usr/bin/env python3' | cat - countryguess.py > temp && mv temp countryguess.py
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm744 countryguess.py $out/bin/countryguess
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Guess the 193 U.N. recognised countries";
+    homepage = "https://github.com/swarbler/countryguess";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "countryguess";
+  };
+}
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 185393564477..2d11c6c897dd 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.16.0";
+  version = "4.17.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${version}";
-    hash = "sha256-yFBKDb4XdCw5en/VN5IP8iCTdSRMqATVR8vV3G1gHJQ=";
+    hash = "sha256-4h911E5iAfqfuF66PsW0+amKw9hneaV3LS5UFsPR690=";
   };
 
-  vendorHash = "sha256-4LDH1mJE0SJFvHYT14uCcgzy5CQ61V2gj1SfyHLEQXY=";
+  vendorHash = "sha256-158Rzie6fECkjDK18KE6WVSPlgTZAS++pSkv7KmdByk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/go/gokapi/package.nix b/pkgs/by-name/go/gokapi/package.nix
new file mode 100644
index 000000000000..4788ad771657
--- /dev/null
+++ b/pkgs/by-name/go/gokapi/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "gokapi";
+  version = "1.9.6";
+
+  src = fetchFromGitHub {
+    owner = "Forceu";
+    repo = "Gokapi";
+    tag = "v${version}";
+    hash = "sha256-RDEvKh3tUun7wt1nhtCim95wEN9V9RlztZ9zcw9nS1o=";
+  };
+
+  vendorHash = "sha256-9GRAlgng+yq7q0VQz374jIOCjeDIIDD631BglM/FsQQ=";
+
+  # This is the go generate is ran in the upstream builder, but we have to run the components separately for things to work.
+  preBuild = ''
+    cd ./cmd/gokapi/
+    go run ../../build/go-generate/updateVersionNumbers.go
+    # Tries to download "golang.org/x/exp/slices"
+    # go run ../../build/go-generate/updateProtectedUrls.go
+    go run ../../build/go-generate/buildWasm.go
+    # Must be specify go root to import wasm_exec.js
+    GOROOT="$(go env GOROOT)" go run "../../build/go-generate/copyStaticFiles.go"
+    cd ../..
+  '';
+
+  subPackages = [
+    "cmd/gokapi"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) gokapi;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Lightweight selfhosted Firefox Send alternative without public upload";
+    homepage = "https://github.com/Forceu/Gokapi";
+    changelog = "https://github.com/Forceu/Gokapi/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      delliott
+    ];
+    mainProgram = "gokapi";
+  };
+}
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index 66896bf076d1..a818df4cdef6 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h8HOCZ/rw2Buzku+GKF77VXxrGjCSOQkLhptiEKMYg0=";
+    hash = "sha256-EV3945SnjOCuRVbGRghsWx/9D89FyshnSO1Q6/TuQ14=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index 504339329de3..a75945415d7a 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -19,7 +19,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.39.0";
+  version = "1.40.0";
   outputs =
     [
       "out"
@@ -33,11 +33,11 @@ rustPlatform.buildRustPackage rec {
     owner = "casey";
     repo = "just";
     tag = version;
-    hash = "sha256-K2MUS6wo0qxJnnIWDdmxHRNwyzx1z7yscVwMzXKAwQA=";
+    hash = "sha256-pmuwZoBIgUsKWFTXo8HYHVxrDWPMO8cumD/UHajFS6A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nDwJgZPWw86qpaGaYWB/Qqbym0FR2EpEKAme5CKbMv0=";
+  cargoHash = "sha256-mQQGxtSgNuRbz/83eWru+dmtWiLSKdVH+3z88BNugQE=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
diff --git a/pkgs/by-name/li/libgedit-amtk/package.nix b/pkgs/by-name/li/libgedit-amtk/package.nix
index 73d3adee7a31..141cdc97aecc 100644
--- a/pkgs/by-name/li/libgedit-amtk/package.nix
+++ b/pkgs/by-name/li/libgedit-amtk/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libgedit-amtk";
-  version = "5.9.0";
+  version = "5.9.1";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "gedit";
     repo = "libgedit-amtk";
     rev = version;
-    hash = "sha256-D6jZmadUHDtxedw/tCsKHzcWXobs6Vb7dyhbVKqu2Zc=";
+    hash = "sha256-myKpZtqtf40UByBUKVF0jv521kGAUA6KDmbDJy/Q1q8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 7814426077f1..f9692fc4647b 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.405";
+  version = "0.0.406";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-a81ToAFJAay9KpVigVNknaaGbZeKN7FKYQ6XG1tzv+s=";
+    hash = "sha256-uhLde8+5EmG+jb+Yn4F4SvDimXjH337OwR5rhdsREpM=";
   };
 
-  vendorHash = "sha256-PoJy/tpjkUkxHiJZNFzl2UXj29iojwL9g6YrAEkSvKk=";
+  vendorHash = "sha256-hLxUr99gnEz2pFM0Dc8XCGgzMuoqzTmtP4Xp7vHF69U=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/ne/newsraft/package.nix b/pkgs/by-name/ne/newsraft/package.nix
index 5304c5e83ee9..419bb9dc16ca 100644
--- a/pkgs/by-name/ne/newsraft/package.nix
+++ b/pkgs/by-name/ne/newsraft/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsraft";
-  version = "0.28";
+  version = "0.29";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "newsraft";
     repo = "newsraft";
     rev = "newsraft-${finalAttrs.version}";
-    hash = "sha256-iRoQLGmiAPpt9ZpvHpytIWHldkvV/5qVjurypCycJYI=";
+    hash = "sha256-6rDnGVOApSURuXom+XxPPOG7lxMbHGTL+4Oqrx+Jq2w=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/oh/oh-my-zsh/package.nix b/pkgs/by-name/oh/oh-my-zsh/package.nix
index 38bec0c943c8..139982212a54 100644
--- a/pkgs/by-name/oh/oh-my-zsh/package.nix
+++ b/pkgs/by-name/oh/oh-my-zsh/package.nix
@@ -19,14 +19,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2025-02-19";
+  version = "2025-03-11";
   pname = "oh-my-zsh";
 
   src = fetchFromGitHub {
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    rev = "6e7ac0544e71c7b777746cb50f70de68c6495b86";
-    sha256 = "sha256-d4w15ja5qe4axOwNyIoXZdVcgUedAIgZQrhINmNNJFw=";
+    rev = "f97e871c33da57d20e1b0411da6b1674126192a9";
+    sha256 = "sha256-L2g9kw5mFfIz+IwTSfdHN4O48tew6D807gJvrgtkjJM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/se/sequoia-sqv/package.nix b/pkgs/by-name/se/sequoia-sqv/package.nix
index a1c492d03587..85a94c70ded2 100644
--- a/pkgs/by-name/se/sequoia-sqv/package.nix
+++ b/pkgs/by-name/se/sequoia-sqv/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia-sqv";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia-sqv";
     rev = "v${version}";
-    hash = "sha256-frGukJDsxq+BWLPC/4imfc42lDKVF8BPIQQDazaLaQ0=";
+    hash = "sha256-xkvCEHVyRf1tQ/oo6Hg4Nri2WxdmH0fZFX24CPwJpZQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WaLRBf+Umaa8LTQ97TsJJ7pUlmficIwuFV6d5QDT6SA=";
+  cargoHash = "sha256-ZynvC4t9NBri5gc9lt2tHd/45V6QsKHbZb7HjHUQQUI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/si/signal-desktop/generic.nix b/pkgs/by-name/si/signal-desktop/generic.nix
index de6134797b93..9478ac430f02 100644
--- a/pkgs/by-name/si/signal-desktop/generic.nix
+++ b/pkgs/by-name/si/signal-desktop/generic.nix
@@ -5,6 +5,7 @@
   autoPatchelfHook,
   noto-fonts-color-emoji,
   dpkg,
+  libarchive,
   asar,
   rsync,
   python3,
@@ -53,7 +54,9 @@
 
 {
   pname,
-  dir,
+  libdir,
+  bindir,
+  extractPkg,
   version,
   hash,
   url,
@@ -100,7 +103,7 @@ stdenv.mkDerivation rec {
     recursiveHash = true;
     downloadToTemp = true;
     nativeBuildInputs = [
-      dpkg
+      (if ARCH == "x64" then dpkg else libarchive)
       asar
     ];
     # Signal ships the Apple emoji set without a licence via an npm
@@ -117,10 +120,10 @@ stdenv.mkDerivation rec {
     # unlicensed emoji files, but the rest of the work is done in the
     # main derivation.
     postFetch = ''
-      dpkg-deb -x $downloadedFile $out
-      asar extract "$out/opt/${dir}/resources/app.asar" $out/asar-contents
+      ${extractPkg}
+      asar extract "$out/${libdir}/resources/app.asar" $out/asar-contents
       rm -r \
-        "$out/opt/${dir}/resources/app.asar"{,.unpacked} \
+        "$out/${libdir}/resources/app.asar"{,.unpacked} \
         $out/asar-contents/node_modules/emoji-datasource-apple
     '';
   };
@@ -196,14 +199,14 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
 
     mv usr/share $out/share
-    mv "opt/${dir}" "$out/lib/${dir}"
+    mv "${libdir}" "$out/lib/signal-desktop"
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s "$out/lib/${dir}/${pname}" $out/bin/${pname}
+    ln -s "$out/lib/signal-desktop/signal-desktop" $out/bin/${meta.mainProgram}
 
     # Create required symlinks:
-    ln -s libGLESv2.so "$out/lib/${dir}/libGLESv2.so.2"
+    ln -s libGLESv2.so "$out/lib/signal-desktop/libGLESv2.so.2"
 
     # Copy the Noto Color Emoji PNGs into the ASAR contents. See `src`
     # for the motivation, and the script for the technical details.
@@ -218,7 +221,7 @@ stdenv.mkDerivation rec {
     substituteInPlace asar-contents/preload.bundle.js \
       --replace-fail \
         'emoji://jumbo?emoji=' \
-        "file://$out/lib/${lib.escapeURL dir}/resources/app.asar/$emojiPrefix/"
+        "file://$out/lib/signal-desktop/resources/app.asar/$emojiPrefix/"
 
     # `asar(1)` copies files from the corresponding `.unpacked`
     # directory when extracting, and will put them back in the modified
@@ -227,7 +230,7 @@ stdenv.mkDerivation rec {
     asar pack \
       --unpack '*.node' \
       asar-contents \
-      "$out/lib/${dir}/resources/app.asar"
+      "$out/lib/signal-desktop/resources/app.asar"
 
     runHook postInstall
   '';
@@ -239,13 +242,13 @@ stdenv.mkDerivation rec {
     )
 
     # Fix the desktop link
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace-fail "/opt/${dir}/${pname}" ${meta.mainProgram} \
+    substituteInPlace $out/share/applications/signal-desktop.desktop \
+      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
       --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"
 
     # Note: The following path contains bundled libraries:
-    # $out/lib/${dir}/resources/app.asar.unpacked/node_modules/
-    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/${dir}/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
+    # $out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/
+    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
index b12cb4b80540..f0065972a000 100644
--- a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
@@ -1,8 +1,15 @@
 { callPackage }:
-callPackage ./generic.nix { } rec {
+callPackage ./generic.nix { } {
   pname = "signal-desktop";
-  dir = "Signal";
-  version = "7.36.0";
-  url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-nmAqFDw35pdZg5tiq9MUlqXnbRLRkSOX9SWhccnE2Xw=";
+  version = "7.46.0-1";
+
+  libdir = "usr/lib64/signal-desktop";
+  bindir = "usr/bin";
+  extractPkg = ''
+    mkdir -p $out
+    bsdtar -xf $downloadedFile -C "$out"
+  '';
+
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/08759579-signal-desktop/signal-desktop-7.46.0-1.fc42.aarch64.rpm";
+  hash = "sha256-kiNwaB+jNOgkfkJ4V5Fj23RNILP3IOZfKWKAehMmtZ0=";
 }
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop.nix b/pkgs/by-name/si/signal-desktop/signal-desktop.nix
index e4d12ceed09a..fd069778673c 100644
--- a/pkgs/by-name/si/signal-desktop/signal-desktop.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-desktop.nix
@@ -1,8 +1,12 @@
 { callPackage }:
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
-  dir = "Signal";
   version = "7.46.0";
+
+  libdir = "opt/Signal";
+  bindir = libdir;
+  extractPkg = "dpkg-deb -x $downloadedFile $out";
+
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
   hash = "sha256-HbmyivfhvZfXdtcL/Cjzl4v0Ck/fJCD517iTjIeidgc=";
 }
diff --git a/pkgs/by-name/si/signal-desktop/update.sh b/pkgs/by-name/si/signal-desktop/update.sh
index a2d0e2aae340..dc2c6864cec6 100755
--- a/pkgs/by-name/si/signal-desktop/update.sh
+++ b/pkgs/by-name/si/signal-desktop/update.sh
@@ -1,39 +1,33 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update curl coreutils jq
+#!nix-shell -i bash -p bash common-updater-scripts curl coreutils jq
 
 set -ex
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
-curl_github() {
-  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
-}
+latestTag=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} \
+  "https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest" \
+  | jq -r ".tag_name")
+latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
 
-case "$UPDATE_NIX_ATTR_PATH" in
-signal-desktop)
-  latestTag=$(curl_github https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest | jq -r ".tag_name")
-  latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-  latestVersionAarch64=$(curl_github "https://api.github.com/repos/0mniteck/Signal-Desktop-Mobian/releases/latest" | jq -r ".tag_name")
+latestBuildInfoAarch64=$(curl \
+  "https://copr.fedorainfracloud.org/api_3/package/?ownername=useidel&projectname=signal-desktop&packagename=signal-desktop&with_latest_succeeded_build=true" \
+  | jq '.builds.latest_succeeded')
+latestBuildAarch64=$(jq '.id' <<< $latestBuildInfoAarch64)
+latestVersionAarch64=$(jq -r '.source_package.version' <<< $latestBuildInfoAarch64)
 
-  echo "Updating signal-desktop for x86_64-linux"
-  nix-update --version "$latestVersion" \
-    --system x86_64-linux \
-    --override-filename "$SCRIPT_DIR/signal-desktop.nix" \
-  signal-desktop
+echo "Updating signal-desktop for x86_64-linux"
+update-source-version signal-desktop "$latestVersion" \
+  --system=x86_64-linux \
+  --file="$SCRIPT_DIR/signal-desktop.nix"
 
-  echo "Updating signal-desktop for aarch64-linux"
-  nix-update --version "$latestVersionAarch64" \
-    --system aarch64-linux \
-    --override-filename "$SCRIPT_DIR/signal-desktop-aarch64.nix" \
-    signal-desktop
+echo "Updating signal-desktop for aarch64-linux"
+update-source-version signal-desktop "$latestVersionAarch64" "" \
+  "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/$(printf "%08d" $latestBuildAarch64)-signal-desktop/signal-desktop-$latestVersionAarch64.fc42.aarch64.rpm" \
+  --system=aarch64-linux \
+  --file="$SCRIPT_DIR/signal-desktop-aarch64.nix"
 
-  echo "Updating signal-desktop for darwin"
-  nix-update --version "$latestVersion" \
-    --system aarch64-darwin \
-    --override-filename "$SCRIPT_DIR/signal-desktop-darwin.nix" \
-    signal-desktop
-  ;;
-*)
-  echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
-  ;;
-esac
+echo "Updating signal-desktop for darwin"
+update-source-version signal-desktop "$latestVersion" \
+  --system=aarch64-darwin \
+  --file="$SCRIPT_DIR/signal-desktop-darwin.nix"
diff --git a/pkgs/by-name/st/storj-uplink/package.nix b/pkgs/by-name/st/storj-uplink/package.nix
index 354b9fff7983..7e329edb21b2 100644
--- a/pkgs/by-name/st/storj-uplink/package.nix
+++ b/pkgs/by-name/st/storj-uplink/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.123.4";
+  version = "1.124.4";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-H62QB/lS3rDUPDJMckRVhChgevyXfQzPBT+XI4/uDNE=";
+    hash = "sha256-3VrmFSE5YdZYxcEoWtEgonQz7ZERLfF12zcPExNToVs=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-s6UrM7Kj/w09EXLHeyzcE6YLzucUz/qEpXsghFETRig=";
+  vendorHash = "sha256-d/ddvixerg30JZtQGNWycUR93Qeaha89W8unKUFPkDg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 4657f53cf80b..a8b2bfeec9a9 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
     tag = version;
-    hash = "sha256-M3n644064cmg7PHmJqQpPZHl4SjshERh2gkKCWvOzcw=";
+    hash = "sha256-2jUCRt0Ws0KHAClSsTAui8LOz6eGGpV7F7Z3DdzqORM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TtLPH6k1oXAJRgbUXTvcOMOWmYCOCuhM+82yLBkwPXo=";
+  cargoHash = "sha256-lwIUmJ/Hgl6Kycd+SVRCawwlF7UJ0pyE2r6iJInYWX8=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ts/tsukimi/package.nix b/pkgs/by-name/ts/tsukimi/package.nix
index 633a790ed00f..09cb809c7fc4 100644
--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -11,25 +11,39 @@
   libepoxy,
   wrapGAppsHook4,
   nix-update-script,
+  stdenv,
+  meson,
+  ninja,
+  rustc,
+  cargo,
+  dbus,
+  desktop-file-utils,
 }:
-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation rec {
   pname = "tsukimi";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "tsukinaha";
     repo = "tsukimi";
     tag = "v${version}";
-    hash = "sha256-MNPg3qg9wRRWKofH4NSRIa76+nA3IFoMfOt6s5+4y8A=";
-    fetchSubmodules = true;
+    hash = "sha256-7Us+mz0FHetka4uVDCWkAGyGMZRhQDotRsySljYZgCo=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-mS5qKEm3oCHiFP5i/XHnIOBmXzvlgfE2i/f0lLl4TN4=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    hash = "sha256-JaBFL7XHVjf4NP41n9qtb5oQyaP1bYQETPYMCR9XEvQ=";
+  };
 
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook4
+    meson
+    ninja
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    desktop-file-utils
   ];
 
   buildInputs =
@@ -39,6 +53,7 @@ rustPlatform.buildRustPackage rec {
       libadwaita
       openssl
       libepoxy
+      dbus
     ]
     ++ (with gst_all_1; [
       gstreamer
@@ -51,23 +66,6 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false; # tests require networking
 
-  postPatch = ''
-    substituteInPlace build.rs \
-      --replace-fail 'i18n/locale' "$out/share/locale"
-
-    substituteInPlace src/lib.rs \
-      --replace-fail '/usr/share/locale' "$out/share/locale"
-  '';
-
-  postInstall = ''
-    install -Dm644 resources/moe.tsuna.tsukimi.gschema.xml -t $out/share/glib-2.0/schemas
-    glib-compile-schemas $out/share/glib-2.0/schemas
-
-    install -Dm644 resources/icons/tsukimi.png -t $out/share/pixmaps
-
-    install -Dm644 resources/moe.tsuna.tsukimi.desktop.in $out/share/applications/moe.tsuna.tsukimi.desktop
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 3cf861d4b09b..42581f08a706 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -161,6 +161,65 @@ qtModule (
       # Fix race condition exposed by missing dependency
       # https://bugs.gentoo.org/933368
       ./qtwebengine-fix_build_pdf_extension_util.patch
+
+      # The latest version of Clang changed what macros it predefines on Apple
+      # targets, causing errors about predefined macros in zlib.
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/2f39ac8d0a414dd65c0e1d5aae38c8f97aa06ae9.patch";
+        hash = "sha256-3kA2os0IntxIiJwzS5nPd7QWYlOWOpoLKYsOQFYv0Sk=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # The latest version of Clang changed what macros it predefines on Apple
+      # targets, causing errors about predefined macros in libpng.
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/66defc14abe47c0494da9faebebfa0a5b6efcf38.patch";
+        hash = "sha256-ErS5Eycls5+xQLGYKz1r/tQC6IcRJWb/WoGsUyzO9WY=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # https://trac.macports.org/ticket/71563
+      # src/3rdparty/chromium/third_party/freetype/src/src/gzip/ftzconf.h:228:12: error: unknown type name 'Byte'
+      (fetchpatch2 {
+        url = "https://github.com/macports/macports-ports/raw/f9a4136c48020b01ecc6dffa99b88333c360f056/aqua/qt5/files/patch-qtwebengine-chromium-freetype-gzip.diff";
+        hash = "sha256-NeLmMfYMo80u3h+5GTenMANWfWLPeS35cKg+h3vzW4g=";
+        extraPrefix = "";
+      })
+
+      # src/3rdparty/chromium/base/process/process_metrics_mac.cc:303:17: error: static assertion expression is not an integral constant expression
+      (fetchpatch2 {
+        url = "https://github.com/macports/macports-ports/raw/f9a4136c48020b01ecc6dffa99b88333c360f056/aqua/qt5/files/patch-qtwebengine_chromium_static_page_size.diff";
+        hash = "sha256-8TFN5XU0SUvPJCFU6wvcKP5a8HCd0ygUnLT8BF4MZ/E=";
+        extraPrefix = "";
+      })
+
+      # Add "-target-feature +aes" to the arm crc32c build flags
+      (fetchpatch2 {
+        url = "https://github.com/chromium/chromium/commit/9f43d823b6b4cdea62f0cc7563ff01f9239b8970.patch";
+        hash = "sha256-2WCx+ZOWA8ZyV2yiSQLx9uFZOoeWQHxLqwLEZsV41QU=";
+        stripLen = 1;
+        extraPrefix = "src/3rdparty/chromium/";
+      })
+
+      # Fix build with clang and libc++ 19
+      # https://github.com/freebsd/freebsd-ports/commit/0ddd6468fb3cb9ba390973520517cb1ca2cd690d
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-libc++19";
+        hash = "sha256-pSVPnuEpjFHW60dbId5sZ3zHP709EWG4LSWoS+TkgcQ=";
+        extraPrefix = "";
+      })
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-src_3rdparty_chromium_third__party_blink_renderer_platform_wtf_hash__table.h";
+        hash = "sha256-+vyWC7Indd1oBhvL5fMTlIH4mM4INgISZFAbHsq32Lg=";
+        extraPrefix = "";
+      })
+      (fetchpatch2 {
+        url = "https://github.com/freebsd/freebsd-ports/raw/0ddd6468fb3cb9ba390973520517cb1ca2cd690d/www/qt5-webengine/files/patch-src_3rdparty_chromium_third__party_perfetto_include_perfetto_tracing_internal_track__event__data__source.h";
+        hash = "sha256-DcAYOV9b30ogPCiedvQimEmiZpUJquk5j6WLjJxR54U=";
+        extraPrefix = "";
+      })
     ];
 
     postPatch =
@@ -248,6 +307,8 @@ qtModule (
             # https://trac.macports.org/ticket/70850
             "-Wno-enum-constexpr-conversion"
             "-Wno-unused-but-set-variable"
+            # Clang 19
+            "-Wno-error=missing-template-arg-list-after-template-kw"
           ]
         );
       }
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index 8463e1ea8c7b..298f59292134 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -26,12 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-WzkhmCk8C5Il1Fm+i6cQz4JI8e4zAGves9kvsAElkrQ=";
   };
 
-  postPatch = ''
-    # only a small portion of the listed packages are actually needed for running the tests
-    # so instead of removing them one by one remove everything
-    rm test-requirements.txt
-  '';
-
   build-system = [
     openstackdocstheme
     setuptools
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 1b2d87d166a3..4458b38abb85 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2025.1.30.194235";
+  version = "2025.3.8.214559";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-P3KUpmltw7xX/6xq9RMFlP8UMDp2/ynvVCkK3rvwzk0=";
+    hash = "sha256-ExAQPrvK6lQ+tmsgNNAvbsVWGuZyqjRecL/5fW0dLgY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index e7139259acfb..50623673355a 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lightning-utilities";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "utilities";
     tag = "v${version}";
-    hash = "sha256-lRH1ZQQHnn18NxmLDHy/uSgzgXpLuDD5/08OIErEs7g=";
+    hash = "sha256-QHE2ksoINQ0sfTSxXxM9ZVEIhEOncaq1i8ZNqznISJw=";
   };
 
   postPatch = ''
@@ -49,9 +49,13 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    "lightning_utilities.core.enums.StrEnum"
+    # DocTestFailure
     "lightning_utilities.core.imports.RequirementCache"
+
+    # NameError: name 'operator' is not defined. Did you forget to import 'operator'
     "lightning_utilities.core.imports.compare_version"
+
+    # importlib.metadata.PackageNotFoundError: No package metadata was found for pytorch-lightning==1.8.0
     "lightning_utilities.core.imports.get_dependency_min_version_spec"
 
     # weird doctests fail on imports, but providing the dependency
diff --git a/pkgs/development/python-modules/pyoxigraph/default.nix b/pkgs/development/python-modules/pyoxigraph/default.nix
new file mode 100644
index 000000000000..29115fa8573a
--- /dev/null
+++ b/pkgs/development/python-modules/pyoxigraph/default.nix
@@ -0,0 +1,70 @@
+{
+  stdenv,
+  apple-sdk_15,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  pythonOlder,
+  pytestCheckHook,
+  rustPlatform,
+}:
+buildPythonPackage rec {
+  pname = "pyoxigraph";
+  pyproject = true;
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "oxigraph";
+    repo = "oxigraph";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-yMXNt7pGiwYDXjmHxKUQpqNrAmnFpg21Vc5R1DmwsHc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-qOGpM3SOAOMO5W3wj4ruXlymp9bV4sqOU75gMVSEyfk=";
+  };
+
+  buildAndTestSubdir = "python";
+
+  dependencies = lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
+  disabled = pythonOlder "3.8";
+
+  disabledTests = [
+    "test_update_load"
+  ];
+
+  disabledTestPaths = [
+    # These require network access
+    "lints/test_spec_links.py"
+    "lints/test_debian_compatibility.py"
+    "oxrocksdb-sys/rocksdb/tools/block_cache_analyzer/block_cache_pysim_test.py"
+    "oxrocksdb-sys/rocksdb/tools"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "pyoxigraph" ];
+
+  meta = {
+    homepage = "https://github.com/oxigraph/oxigraph";
+    description = "SPARQL graph database";
+    maintainers = with lib.maintainers; [ dadada ];
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/pyqt/sip.nix b/pkgs/development/python-modules/pyqt/sip.nix
index 4a4ceebf66a6..d5195eac8466 100644
--- a/pkgs/development/python-modules/pyqt/sip.nix
+++ b/pkgs/development/python-modules/pyqt/sip.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyqt5-sip";
-  version = "12.15.0";
+  version = "12.17.0";
 
   src = fetchPypi {
-    pname = "PyQt5_sip";
+    pname = "pyqt5_sip";
     inherit version;
-    hash = "sha256-0j/fzzY7XO3Z05+KnFcQ59UoBPWwiljpHGOLNur8twI=";
+    hash = "sha256-aC2tzb0iOa+f3AwGKOJ3a4IOEovsiLSbjWkv5oL5C08=";
   };
 
   # There is no test code and the check phase fails with:
diff --git a/pkgs/development/python-modules/python-ironicclient/default.nix b/pkgs/development/python-modules/python-ironicclient/default.nix
index c1b31bfb091a..33a6f644051a 100644
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@@ -65,7 +65,16 @@ buildPythonPackage rec {
 
   checkPhase = ''
     runHook preCheck
-    stestr run
+    stestr run -e <(echo "
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_no_options
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_description
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_extra
+      ironicclient.tests.unit.osc.v1.test_baremetal_chassis.TestChassisCreate.test_chassis_create_with_uuid
+      ironicclient.tests.unit.osc.v1.test_baremetal_conductor.TestBaremetalConductorShow.test_conductor_show
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestBaremetalCreate
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestBaremetalShow.test_baremetal_show
+      ironicclient.tests.unit.osc.v1.test_baremetal_node.TestNodeHistoryEventGet.test_baremetal_node_history_list
+    ")
     runHook postCheck
   '';
 
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index 980165a6c29f..444e0b7191d2 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
   version = "42.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-nW6cSOhC56YkyUQiXcJTqaojRseIf9q8YGSe4skhTA4=";
@@ -86,6 +84,9 @@ buildPythonPackage rec {
     chmod +x bin/*
 
     stestr --test-path tempest/tests run -e <(echo "
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_load_json_resource_list
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_load_json_saved_state
+      tempest.tests.cmd.test_cleanup.TestTempestCleanup.test_take_action_got_exception
       tempest.tests.lib.cli.test_execute.TestExecute.test_execute_with_prefix
     ")
   '';
diff --git a/pkgs/development/tools/rust/cargo-outdated/default.nix b/pkgs/development/tools/rust/cargo-outdated/default.nix
index 56f6e258638a..d76f344a63a6 100644
--- a/pkgs/development/tools/rust/cargo-outdated/default.nix
+++ b/pkgs/development/tools/rust/cargo-outdated/default.nix
@@ -1,40 +1,27 @@
 {
   lib,
   rustPlatform,
-  fetchCrate,
+  fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  curl,
-  CoreFoundation,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
-
 rustPlatform.buildRustPackage rec {
   pname = "cargo-outdated";
-  version = "0.16.0";
+  version = "0.17.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-bAo3098QxepKbvBb9uF6iGNW0+RAKCCMyWfuG5WyREo=";
+  src = fetchFromGitHub {
+    owner = "kbknapp";
+    repo = "cargo-outdated";
+    rev = "v${version}";
+    hash = "sha256-ey11ANSflWGnCsn6M9GupgC4DE5mWww6vw5pK0CFdLo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-h+sxnTAJ1uhPUk5dRiYPgPoxvbpVggnCn0TQ6kRCzO4=";
+  cargoHash = "sha256-PYlVXGfitsjEGiw07L5b+L8pfxvtkHshIjTXeuPUTdk=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      curl
-      CoreFoundation
-      CoreServices
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Cargo subcommand for displaying when Rust dependencies are out of date";
diff --git a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
index 9212db7482fe..53913aa00d45 100644
--- a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "KartoffelToby";
   domain = "better_thermostat";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "KartoffelToby";
     repo = "better_thermostat";
     tag = version;
-    hash = "sha256-zXO2UDLhSTOemzsO9G5ZUzr50Zg8kDW/aObn6Y3j70k=";
+    hash = "sha256-rE14iKAXo3hecK3bQ9MLcOtnZviwjOpYKGlIc4+uCfw=";
   };
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c2648e0bbfce..9eb326ca2c34 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -213,7 +213,7 @@ mapAliases {
   bibata-extra-cursors = throw "bibata-cursors has been removed as it was broken"; # Added 2024-07-15
   bitcoin-unlimited = throw "bitcoin-unlimited has been removed as it was broken and unmaintained"; # Added 2024-07-15
   bitcoind-unlimited = throw "bitcoind-unlimited has been removed as it was broken and unmaintained"; # Added 2024-07-15
-  bird = bird2; # Added 2025-01-11
+  bird = throw "The bird alias was ambiguous and has been removed for the time being. Please explicitly choose bird2 or bird3."; # Added 2025-01-11
   bisq-desktop = throw "bisq-desktop has been removed because OpenJFX 11 was removed"; # Added 2024-11-17
   bitwarden = bitwarden-desktop; # Added 2024-02-25
   blender-with-packages = args:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3c50c47a49d4..adce9d5bf86d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6583,9 +6583,7 @@ with pkgs;
   cargo-edit = callPackage ../development/tools/rust/cargo-edit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security SystemConfiguration;
-  };
+  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated { };
   inherit (callPackages ../development/tools/rust/cargo-pgrx { })
     cargo-pgrx_0_12_0_alpha_1
     cargo-pgrx_0_12_5
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0bb97a858b5a..eb2bfdc60cbc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12641,6 +12641,8 @@ self: super: with self; {
 
   pyowm = callPackage ../development/python-modules/pyowm { };
 
+  pyoxigraph = callPackage ../development/python-modules/pyoxigraph { };
+
   pypager = callPackage ../development/python-modules/pypager { };
 
   pypamtest = toPythonModule (pkgs.libpam-wrapper.override {