diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6116ea0a9d32..8fd206a4db13 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24749,6 +24749,12 @@
     githubId = 13155277;
     name = "Tom Houle";
   };
+  tomjnixon = {
+    name = "Tom Nixon";
+    email = "nixpkgs@tomn.co.uk";
+    github = "tomjnixon";
+    githubId = 178226;
+  };
   tomkoid = {
     email = "tomaszierl@outlook.com";
     name = "Tomkoid";
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index c93b591701a7..40440fbd16cc 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -68,8 +68,7 @@ in
       description = ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run `sudo nc -U /run/knot-resolver/control/1`
-        and give commands interactively to kresd@1.service.
+        You can run `kresd-cli 1` and give commands interactively to kresd@1.service.
       '';
     };
     package = lib.mkPackageOption pkgs "knot-resolver" {
@@ -135,7 +134,25 @@ in
 
   ###### implementation
   config = lib.mkIf cfg.enable {
-    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
+    environment = {
+      etc."knot-resolver/kresd.conf".source = configFile; # not required
+      systemPackages = [
+        (pkgs.writeShellScriptBin "kresd-cli" ''
+          if [[ ''${1:-} == -h || ''${1:-} == --help ]]; then
+            echo "Usage: $0 [X]"
+            echo
+            echo "  X is number of the control socket and corresponds to the number of the template unit."
+            exit
+          fi
+
+          exec=exec
+          if [[ "$USER" != knot-resolver ]]; then
+            exec='exec /run/wrappers/bin/sudo -u knot-resolver'
+          fi
+          $exec ${lib.getExe pkgs.socat} - /run/knot-resolver/control/''${1:-1}
+        '')
+      ];
+    };
 
     networking.resolvconf.useLocalResolver = lib.mkDefault true;
 
diff --git a/pkgs/applications/audio/vorbis-tools/default.nix b/pkgs/applications/audio/vorbis-tools/default.nix
index c824ffddde59..8ff65cef581d 100644
--- a/pkgs/applications/audio/vorbis-tools/default.nix
+++ b/pkgs/applications/audio/vorbis-tools/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   libogg,
   libvorbis,
   libao,
@@ -16,22 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vorbis-tools";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/vorbis/vorbis-tools-${version}.tar.gz";
-    sha256 = "1c7h4ivgfdyygz2hyh6nfibxlkz8kdk868a576qkkjgj5gn78xyv";
+    hash = "sha256-of493Gd3vc6/a3l+ft/gQ3lUskdW/8yMa4FrY+BGDd4=";
   };
 
-  patches = [
-    # Fixes a call to undeclared function `utf8_decode`.
-    # https://github.com/xiph/vorbis-tools/pull/33
-    (fetchpatch {
-      url = "https://github.com/xiph/vorbis-tools/commit/8a645f78b45ae7e370c0dc2a52d0f2612aa6110b.patch";
-      hash = "sha256-RkT9Xa0pRu/oO9E9qhDa17L0luWgYHI2yINIkPZanmI=";
-    })
-  ];
-
   # ld64 on darwin doesn't support nested archives and as the nested lib
   # (libbase64.a) is not required to build so leave it out
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 70d811c73ee1..4a9b4ec0d059 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -98,6 +98,7 @@ in
 
   # Darwin
   apple-sdk_14,
+  apple-sdk_15,
   cups,
   rsync, # used when preparing .app directory
 
@@ -582,7 +583,7 @@ buildStdenv.mkDerivation {
       zip
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple-sdk_14
+      (if lib.versionAtLeast version "138" then apple-sdk_15 else apple-sdk_14)
       cups
     ]
     ++ (lib.optionals (!stdenv.hostPlatform.isDarwin) (
diff --git a/pkgs/applications/version-management/svn-all-fast-export/default.nix b/pkgs/applications/version-management/svn-all-fast-export/default.nix
index 6b2628f3a4f1..2780a6e3398c 100644
--- a/pkgs/applications/version-management/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/svn-all-fast-export/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "1.0.18";
+  version = "1.0.19";
 in
 stdenv.mkDerivation {
   pname = "svn-all-fast-export";
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     owner = "svn-all-fast-export";
     repo = "svn2git";
     rev = version;
-    sha256 = "1b5yx2316hbyvw3v30vn1ljma9yd21nd59wis1gi34g92lgvqcd6";
+    sha256 = "sha256-r8tS1fbpSWp9btC2hkCg304G4lftQZ09QXWwC943miU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ad/addr-book-combine/package.nix b/pkgs/by-name/ad/addr-book-combine/package.nix
new file mode 100644
index 000000000000..23f69f5e24d7
--- /dev/null
+++ b/pkgs/by-name/ad/addr-book-combine/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromSourcehut,
+  nix-update-script,
+}:
+buildGoModule {
+  pname = "addr-book-combine";
+  version = "0-unstable-2022-12-14";
+
+  src = fetchFromSourcehut {
+    owner = "~jcc";
+    repo = "addr-book-combine";
+    rev = "11696f4726b981c774ad1d4858f1a935ac71e9ac";
+    hash = "sha256-SENur3p5LxMNnjo/+qiVdrEs+i+rI1PT1wYYdLLqWrg=";
+  };
+
+  vendorHash = null;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Combine multiple aerc-style address books into a single address book";
+    homepage = "https://jasoncarloscox.com/creations/addr-book-combine/";
+    downloadPage = "https://git.sr.ht/~jcc/addr-book-combine";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "addr-book-combine";
+    maintainers = with lib.maintainers; [ antonmosich ];
+  };
+}
diff --git a/pkgs/by-name/bu/budgie-desktop/package.nix b/pkgs/by-name/bu/budgie-desktop/package.nix
index af08bcacfeec..860cd7961bfd 100644
--- a/pkgs/by-name/bu/budgie-desktop/package.nix
+++ b/pkgs/by-name/bu/budgie-desktop/package.nix
@@ -77,6 +77,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/46c83b1265b4230668da472d9ef6926941678418.patch";
       hash = "sha256-qnA8iBEctZbE86qIPudI1vMbgFy4xDWrxxej517ORws=";
     })
+
+    # Add override for overlay-key to prevent crash with mutter-common v48-rc
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/pull/683
+    (fetchpatch {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/c24091bb424abe99ebcdd33eedd37068f735ad2a.patch";
+      hash = "sha256-4WEkscftOGZmzH7imMTmcTDPH6eHMeEhgto+R5NNlh0=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/budgie-gsettings-overrides/package.nix b/pkgs/by-name/bu/budgie-gsettings-overrides/package.nix
index 02bd605ee3cf..ca3def9789ff 100644
--- a/pkgs/by-name/bu/budgie-gsettings-overrides/package.nix
+++ b/pkgs/by-name/bu/budgie-gsettings-overrides/package.nix
@@ -35,9 +35,6 @@ let
     [org.gnome.desktop.wm.preferences:Budgie]
     titlebar-font="Noto Sans Bold 10"
 
-    [org.gnome.mutter:Budgie]
-    edge-tiling=true
-
     [com.solus-project.budgie-menu:Budgie]
     use-default-menu-icon=true
 
diff --git a/pkgs/by-name/ch/chez-matchable/package.nix b/pkgs/by-name/ch/chez-matchable/package.nix
index 1b595f432ce5..86c3095fe375 100644
--- a/pkgs/by-name/ch/chez-matchable/package.nix
+++ b/pkgs/by-name/ch/chez-matchable/package.nix
@@ -7,12 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "chez-matchable";
+  # nixpkgs-update: no auto update
   version = "0.2";
 
   src = fetchFromGitHub {
     owner = "fedeinthemix";
     repo = "chez-matchable";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-UYoT8Kp1FTfiL22ntrFXFcAB1HGVrJ6p9JgvhUKi+Yo=";
   };
 
diff --git a/pkgs/by-name/fl/fleetctl/package.nix b/pkgs/by-name/fl/fleetctl/package.nix
index 17f8b940a8c3..8cb6bd248b26 100644
--- a/pkgs/by-name/fl/fleetctl/package.nix
+++ b/pkgs/by-name/fl/fleetctl/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "fleectl";
-  version = "4.64.1";
+  version = "4.67.1";
 
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${version}";
-    hash = "sha256-cZ0YTFcyPt7NMZUDZCdlVPTuhwRy7mTp7JCdINqiwOM=";
+    hash = "sha256-shaOPK7BbIDARopzGehlIA6aPdRiFRP9hrFRNO3kfGA=";
   };
-  vendorHash = "sha256-gFAotYho18Jn8MaFK6ShoMA1VLXVENcrASvHWZGFOFg=";
+  vendorHash = "sha256-UkdHwjCcxNX7maI4QClLm5WWaLXwGlEu80eZXVoYy60=";
 
   subPackages = [
     "cmd/fleetctl"
diff --git a/pkgs/by-name/fl/fluent-gtk-theme/package.nix b/pkgs/by-name/fl/fluent-gtk-theme/package.nix
index 137f8a92dd1b..3b5b4be1c1ad 100644
--- a/pkgs/by-name/fl/fluent-gtk-theme/package.nix
+++ b/pkgs/by-name/fl/fluent-gtk-theme/package.nix
@@ -60,13 +60,13 @@ lib.checkListOfEnum "${pname}: theme variants"
   stdenvNoCC.mkDerivation
   (finalAttrs: {
     inherit pname;
-    version = "2024-06-12";
+    version = "2025-04-17";
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
       repo = "fluent-gtk-theme";
       rev = finalAttrs.version;
-      hash = "sha256-ONhW68UUrFiv5hxkR7XI8U/5+qM+tYLIS2OM05pqJi0=";
+      hash = "sha256-AaFj9lG9lWg0a0ksJ0ufoUpsunR3uDhcdb7oSrvAmPI=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/fr/freecad/package.nix b/pkgs/by-name/fr/freecad/package.nix
index 642c2fdf55a4..cd3e21f4533d 100644
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -44,6 +44,7 @@ let
     gitpython
     ifcopenshell
     matplotlib
+    opencamlib
     pivy
     ply
     py-slvs
@@ -104,6 +105,7 @@ freecad-utils.makeCustomizable (
         medfile
         mpi
         ode
+        opencamlib
         pivy
         ply # for openSCAD file support
         py-slvs
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index 005a35d26f03..d419d6b38f42 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.0.2-9";
+  version = "7.1.1-1";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    hash = "sha256-zaBu/hhFIMjneb7yUzToaJJAaSptxLld8zOvfGckHLY=";
+    hash = "sha256-gu6+fOCcrGIZiR2hMl9tk97OmCmewOVJibz52DNpL1Q=";
   };
 }).overrideAttrs
   (old: {
diff --git a/pkgs/by-name/ju/jujutsu/package.nix b/pkgs/by-name/ju/jujutsu/package.nix
index 14af7bc7b2f8..97b9eb729fc8 100644
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@@ -63,6 +63,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "jj-cli"
   ];
 
+  # taplo-cli (used in tests) always creates a reqwest client, which
+  # requires configd access on macOS.
+  sandboxProfile = ''
+    (allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))
+  '';
+
   env = {
     # Disable vendored libraries.
     ZSTD_SYS_USE_PKG_CONFIG = "1";
diff --git a/pkgs/by-name/mo/moneydance/package.nix b/pkgs/by-name/mo/moneydance/package.nix
index f487e1306f07..f08eda658829 100644
--- a/pkgs/by-name/mo/moneydance/package.nix
+++ b/pkgs/by-name/mo/moneydance/package.nix
@@ -15,11 +15,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "moneydance";
-  version = "2024.1_5118";
+  version = "2024.4_5253";
 
   src = fetchzip {
-    url = "https://infinitekind.com/stabledl/2024_5118/moneydance-linux.tar.gz";
-    hash = "sha256-wwSb3CuhuXB4I9jq+TpLPbd1k9UzqQbAaZkGKgi+nns=";
+    url = "https://infinitekind.com/stabledl/${
+      lib.replaceStrings [ "_" ] [ "." ] finalAttrs.version
+    }/moneydance-linux.tar.gz";
+    hash = "sha256-xOdkuaN17ss9tTSXgU//s6cBm2jGEgP9eTtvW0k3VWQ=";
   };
 
   # We must use wrapGAppsHook (since Java GUIs on Linux use GTK), but by
@@ -76,7 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://infinitekind.com/moneydance";
-    changelog = "https://infinitekind.com/stabledl/2024_5118/changelog.txt";
+    changelog = "https://infinitekind.com/stabledl/${
+      lib.replaceStrings [ "_" ] [ "." ] finalAttrs.version
+    }/changelog-stable.txt";
     description = "Easy to use and full-featured personal finance app that doesn't compromise your privacy";
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     license = lib.licenses.unfree;
diff --git a/pkgs/by-name/ne/netbird/package.nix b/pkgs/by-name/ne/netbird/package.nix
index faee3cb4e78a..f62bbd9e3c1e 100644
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -31,16 +31,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird";
-  version = "0.40.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GbKA6tJLCQNCiG9rj3iW4l51nQEbt42u7B6tFCbDSTQ=";
+    hash = "sha256-HmNd5MyplQ8iwpaxhEnomASIwx4VE3Qv70sURxqDzdo=";
   };
 
-  vendorHash = "sha256-vy725OvkYLyCDYEmnPpXJWqyofb29GiP4GkLn1GInm0=";
+  vendorHash = "sha256-/iqWVDqQOTFP5OZDrgq5gAH7NmHneQlf5+wAzIyoEPw=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/by-name/of/offensive-azure/package.nix b/pkgs/by-name/of/offensive-azure/package.nix
index 0243bab6a458..5c715bf6ea67 100644
--- a/pkgs/by-name/of/offensive-azure/package.nix
+++ b/pkgs/by-name/of/offensive-azure/package.nix
@@ -6,6 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "offensive-azure";
+  # nixpkgs-update: no auto update
   version = "0.4.10";
   format = "pyproject";
 
diff --git a/pkgs/by-name/pa/pantheon-tweaks/package.nix b/pkgs/by-name/pa/pantheon-tweaks/package.nix
index cd73de01ebdd..a535c5fa428a 100644
--- a/pkgs/by-name/pa/pantheon-tweaks/package.nix
+++ b/pkgs/by-name/pa/pantheon-tweaks/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pantheon-tweaks";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
     repo = pname;
     rev = version;
-    hash = "sha256-5RsNVUQ8FJmtdI7Z2le+qt9b13zHlQxiyTaUY15wSkw=";
+    hash = "sha256-85Yfhh6otNWhRqLeM6UMBiCf/omn0FyY5hdK1ZjjgmM=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
       elementary-terminal # io.elementary.terminal.settings
       granite7
       switchboard
+      wingpanel-indicator-sound # io.elementary.desktop.wingpanel.sound
     ]);
 
   mesonFlags = [
diff --git a/pkgs/by-name/pa/paps/package.nix b/pkgs/by-name/pa/paps/package.nix
index f99da48d4fb2..20d66b612011 100644
--- a/pkgs/by-name/pa/paps/package.nix
+++ b/pkgs/by-name/pa/paps/package.nix
@@ -2,42 +2,57 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoconf,
-  automake,
+  fetchpatch,
+  meson,
+  ninja,
   pkg-config,
-  intltool,
+  fmt,
+  glib,
   pango,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "paps";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "dov";
     repo = "paps";
-    rev = "v${version}";
-    sha256 = "129wpm2ayxs6qfh2761d4x9c034ivb2bcmmcnl56qs4448qb9495";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-bNF/kZl/fGAT+He9kMHYj5ERhJwCJJABjhV3H+bs3D0=";
   };
 
+  patches = [
+    # remove when 0.8.1 is released
+    (fetchpatch {
+      url = "https://github.com/dov/paps/commit/e9270aaac5e0b8018a6fad9a562ee48e7b2c3113.patch";
+      name = "fix-g_utf8_next_char-cast";
+      hash = "sha256-fedkyjd8cGFUuUQCbGii7wfMCmK6vye/1/vHWuJiJI4=";
+    })
+  ];
+
   nativeBuildInputs = [
-    autoconf
-    automake
+    meson
+    ninja
     pkg-config
-    intltool
   ];
-  buildInputs = [ pango ];
+  buildInputs = [
+    fmt
+    glib
+    pango
+  ];
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Pango to PostScript converter";
     homepage = "https://github.com/dov/paps";
-    license = licenses.lgpl2;
+    license = lib.licenses.lgpl2;
     maintainers = [ ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "paps";
   };
-}
+})
diff --git a/pkgs/by-name/ru/rundeck/package.nix b/pkgs/by-name/ru/rundeck/package.nix
index 914495c525b6..dce0dc27d73b 100644
--- a/pkgs/by-name/ru/rundeck/package.nix
+++ b/pkgs/by-name/ru/rundeck/package.nix
@@ -7,6 +7,7 @@
   which,
   coreutils,
   openssh,
+  writeScript,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,6 +44,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = writeScript "update-rundeck" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p common-updater-scripts curl jq
+    set -eu -o pipefail
+
+    latest_tag=$(curl -s "https://api.github.com/repos/rundeck/rundeck/tags" | jq -r '.[0].name')
+    version=$(echo "$latest_tag" | sed -E 's/^v//')
+    full_version="$version-$(date +"%Y%m%d")"
+
+    if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$full_version" ]]; then
+      download_url="https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-$full_version.war/artifacts/rundeck-$full_version.war/download?distro_version_id=167"
+      hash=$(curl -L "$download_url" | nix-hash --flat --type sha256 --base32 - | nix hash to-sri --type sha256)
+      update-source-version "$UPDATE_NIX_ATTR_PATH" "$full_version" "$hash"
+    fi
+  '';
+
   meta = {
     description = "Job scheduler and runbook automation";
     longDescription = ''
diff --git a/pkgs/by-name/sp/spider/package.nix b/pkgs/by-name/sp/spider/package.nix
index 5e184afd3758..a8e433ec2b20 100644
--- a/pkgs/by-name/sp/spider/package.nix
+++ b/pkgs/by-name/sp/spider/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spider";
-  version = "2.36.73";
+  version = "2.36.117";
 
   src = fetchFromGitHub {
     owner = "spider-rs";
     repo = "spider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ad5WihYMCJ1TbZGO4pQwGYTUZ2K993bynT7+KFTLGwY=";
+    hash = "sha256-D67v79+BOxliMtC9twB7PlsXy2qmNkQO9379YQ4/zeQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rCmuYRPxz29dKpIoC6fXB5h8+3fERMCcERm+C2juzZA=";
+  cargoHash = "sha256-QNHMyGQl3/hCMcqyKaDfDq5DNCnPLOLjHBiIOwmKYjk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ta/taoup/package.nix b/pkgs/by-name/ta/taoup/package.nix
index 3243c6a8ca76..6dd95c8ca094 100644
--- a/pkgs/by-name/ta/taoup/package.nix
+++ b/pkgs/by-name/ta/taoup/package.nix
@@ -11,6 +11,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "taoup";
+  # nixpkgs-update: no auto update
   version = "1.1.23";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yams/package.nix b/pkgs/by-name/ya/yams/package.nix
index 713d8a96b762..99a964ed6bf4 100644
--- a/pkgs/by-name/ya/yams/package.nix
+++ b/pkgs/by-name/ya/yams/package.nix
@@ -6,6 +6,7 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "yams";
+  # nixpkgs-update: no auto update
   version = "0.7.3";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/berry-3-offline.patch b/pkgs/by-name/ya/yarn-berry/fetcher/berry-3-offline.patch
index 0470e213e663..52e99f2fb408 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/berry-3-offline.patch
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/berry-3-offline.patch
@@ -1,5 +1,5 @@
 diff --git a/packages/plugin-essentials/sources/commands/install.ts b/packages/plugin-essentials/sources/commands/install.ts
-index 9dcd02d..cf1765a 100644
+index 9dcd02d12..cf1765a20 100644
 --- a/packages/plugin-essentials/sources/commands/install.ts
 +++ b/packages/plugin-essentials/sources/commands/install.ts
 @@ -254,6 +254,7 @@ export default class YarnCommand extends BaseCommand {
@@ -11,7 +11,7 @@ index 9dcd02d..cf1765a 100644
            configuration,
            json: this.json,
 diff --git a/packages/plugin-git/sources/GitFetcher.ts b/packages/plugin-git/sources/GitFetcher.ts
-index fe2a4fc..bfa8272 100644
+index fe2a4fce8..bfa82728e 100644
 --- a/packages/plugin-git/sources/GitFetcher.ts
 +++ b/packages/plugin-git/sources/GitFetcher.ts
 @@ -50,9 +50,14 @@ export class GitFetcher implements Fetcher {
@@ -32,7 +32,7 @@ index fe2a4fc..bfa8272 100644
  
      await scriptUtils.prepareExternalProject(cloneTarget, packagePath, {
 diff --git a/packages/plugin-npm/sources/NpmSemverFetcher.ts b/packages/plugin-npm/sources/NpmSemverFetcher.ts
-index 0f69423..5b21462 100644
+index 0f69423c7..5b21462a5 100644
 --- a/packages/plugin-npm/sources/NpmSemverFetcher.ts
 +++ b/packages/plugin-npm/sources/NpmSemverFetcher.ts
 @@ -47,6 +47,7 @@ export class NpmSemverFetcher implements Fetcher {
@@ -44,7 +44,7 @@ index 0f69423..5b21462 100644
      try {
        sourceBuffer = await npmHttpUtils.get(NpmSemverFetcher.getLocatorUrl(locator), {
 diff --git a/packages/yarnpkg-core/sources/Cache.ts b/packages/yarnpkg-core/sources/Cache.ts
-index d5e6864..374b5d6 100644
+index d5e686420..374b5d67f 100644
 --- a/packages/yarnpkg-core/sources/Cache.ts
 +++ b/packages/yarnpkg-core/sources/Cache.ts
 @@ -158,6 +158,10 @@ export class Cache {
@@ -59,27 +59,60 @@ index d5e6864..374b5d6 100644
      const mirrorPath = this.getLocatorMirrorPath(locator);
  
 diff --git a/packages/yarnpkg-core/sources/scriptUtils.ts b/packages/yarnpkg-core/sources/scriptUtils.ts
-index b3c2c59..6b9eb2f 100644
+index b3c2c5903..641687745 100644
 --- a/packages/yarnpkg-core/sources/scriptUtils.ts
 +++ b/packages/yarnpkg-core/sources/scriptUtils.ts
-@@ -287,10 +287,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
-             // Run an install; we can't avoid it unless we inspect the
-             // package.json, which I don't want to do to keep the codebase
-             // clean (even if it has a slight perf cost when cloning v1 repos)
+@@ -262,20 +262,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+               ? [`workspace`, workspace]
+               : [];
+ 
+-            // `set version` will update the Manifest to contain a `packageManager` field with the latest
+-            // Yarn version which causes the results to change depending on when this command was run,
+-            // therefore we revert any change made to it.
+-            const manifestPath = ppath.join(cwd, Filename.manifest);
+-            const manifestBuffer = await xfs.readFilePromise(manifestPath);
+-
+-            // Makes sure that we'll be using Yarn 1.x
+-            const version = await execUtils.pipevp(process.execPath, [process.argv[1], `set`, `version`, `classic`, `--only-if-needed`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
+-            if (version.code !== 0)
+-              return version.code;
+-
+-            // Revert any changes made to the Manifest by `set version`.
+-            await xfs.writeFilePromise(manifestPath, manifestBuffer);
+-
+             // Otherwise Yarn 1 will pack the .yarn directory :(
+             await xfs.appendFilePromise(ppath.join(cwd, `.npmignore` as PortablePath), `/.yarn\n`);
+ 
+@@ -284,16 +270,8 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+             // Remove environment variables that limit the install to just production dependencies
+             delete env.NODE_ENV;
+ 
+-            // Run an install; we can't avoid it unless we inspect the
+-            // package.json, which I don't want to do to keep the codebase
+-            // clean (even if it has a slight perf cost when cloning v1 repos)
 -            const install = await execUtils.pipevp(`yarn`, [`install`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
 -            if (install.code !== 0)
 -              return install.code;
 -
-             stdout.write(`\n`);
+-            stdout.write(`\n`);
+-
+-            const pack = await execUtils.pipevp(`yarn`, [...workspaceCli, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
++            env["SKIP_YARN_COREPACK_CHECK"] = "1";
++            const pack = await execUtils.pipevp(`@yarnv1@`, [...workspaceCli, `--offline`, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
+             if (pack.code !== 0)
+               return pack.code;
  
-             const pack = await execUtils.pipevp(`yarn`, [...workspaceCli, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
-@@ -375,9 +371,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
-             // We can't use `npm ci` because some projects don't have npm
-             // lockfiles that are up-to-date. Hopefully npm won't decide
-             // to change the versions randomly.
+@@ -372,13 +350,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+             delete env.NPM_CONFIG_PRODUCTION;
+             delete env.NODE_ENV;
+ 
+-            // We can't use `npm ci` because some projects don't have npm
+-            // lockfiles that are up-to-date. Hopefully npm won't decide
+-            // to change the versions randomly.
 -            const install = await execUtils.pipevp(`npm`, [`install`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
 -            if (install.code !== 0)
 -              return install.code;
- 
+-
              const packStream = new PassThrough();
              const packPromise = miscUtils.bufferStream(packStream);
+ 
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/berry-4-offline.patch b/pkgs/by-name/ya/yarn-berry/fetcher/berry-4-offline.patch
index c4f87a57ab19..7ebf48b64233 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/berry-4-offline.patch
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/berry-4-offline.patch
@@ -1,5 +1,5 @@
 diff --git a/packages/plugin-essentials/sources/commands/install.ts b/packages/plugin-essentials/sources/commands/install.ts
-index 90ba553..ef5368c 100644
+index 90ba55349..ef5368c1b 100644
 --- a/packages/plugin-essentials/sources/commands/install.ts
 +++ b/packages/plugin-essentials/sources/commands/install.ts
 @@ -302,6 +302,7 @@ export default class YarnCommand extends BaseCommand {
@@ -11,7 +11,7 @@ index 90ba553..ef5368c 100644
              newSettings[rule.name] = rule.value;
            }
 diff --git a/packages/plugin-git/sources/GitFetcher.ts b/packages/plugin-git/sources/GitFetcher.ts
-index d9f8d85..4db9f90 100644
+index d9f8d85c7..4db9f9008 100644
 --- a/packages/plugin-git/sources/GitFetcher.ts
 +++ b/packages/plugin-git/sources/GitFetcher.ts
 @@ -50,7 +50,11 @@ export class GitFetcher implements Fetcher {
@@ -28,7 +28,7 @@ index d9f8d85..4db9f90 100644
  
      const packagePath = ppath.join(projectPath, `package.tgz`);
 diff --git a/packages/plugin-npm/sources/NpmSemverFetcher.ts b/packages/plugin-npm/sources/NpmSemverFetcher.ts
-index 7347859..ea5767f 100644
+index 7347859aa..ea5767f88 100644
 --- a/packages/plugin-npm/sources/NpmSemverFetcher.ts
 +++ b/packages/plugin-npm/sources/NpmSemverFetcher.ts
 @@ -45,6 +45,7 @@ export class NpmSemverFetcher implements Fetcher {
@@ -40,7 +40,7 @@ index 7347859..ea5767f 100644
      try {
        sourceBuffer = await npmHttpUtils.get(NpmSemverFetcher.getLocatorUrl(locator), {
 diff --git a/packages/yarnpkg-core/sources/Cache.ts b/packages/yarnpkg-core/sources/Cache.ts
-index b712ecf..c7effbc 100644
+index b712ecf11..c7effbc61 100644
 --- a/packages/yarnpkg-core/sources/Cache.ts
 +++ b/packages/yarnpkg-core/sources/Cache.ts
 @@ -225,6 +225,10 @@ export class Cache {
@@ -55,27 +55,60 @@ index b712ecf..c7effbc 100644
      const mirrorPath = this.getLocatorMirrorPath(locator);
  
 diff --git a/packages/yarnpkg-core/sources/scriptUtils.ts b/packages/yarnpkg-core/sources/scriptUtils.ts
-index 2dcd7e5..fe40fbb 100644
+index 2dcd7e59e..a2a7f9791 100644
 --- a/packages/yarnpkg-core/sources/scriptUtils.ts
 +++ b/packages/yarnpkg-core/sources/scriptUtils.ts
-@@ -287,10 +287,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
-             // Run an install; we can't avoid it unless we inspect the
-             // package.json, which I don't want to do to keep the codebase
-             // clean (even if it has a slight perf cost when cloning v1 repos)
+@@ -262,20 +262,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+               ? [`workspace`, workspace]
+               : [];
+ 
+-            // `set version` will update the Manifest to contain a `packageManager` field with the latest
+-            // Yarn version which causes the results to change depending on when this command was run,
+-            // therefore we revert any change made to it.
+-            const manifestPath = ppath.join(cwd, Filename.manifest);
+-            const manifestBuffer = await xfs.readFilePromise(manifestPath);
+-
+-            // Makes sure that we'll be using Yarn 1.x
+-            const version = await execUtils.pipevp(process.execPath, [process.argv[1], `set`, `version`, `classic`, `--only-if-needed`, `--yarn-path`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
+-            if (version.code !== 0)
+-              return version.code;
+-
+-            // Revert any changes made to the Manifest by `set version`.
+-            await xfs.writeFilePromise(manifestPath, manifestBuffer);
+-
+             // Otherwise Yarn 1 will pack the .yarn directory :(
+             await xfs.appendFilePromise(ppath.join(cwd, `.npmignore`), `/.yarn\n`);
+ 
+@@ -284,16 +270,8 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+             // Remove environment variables that limit the install to just production dependencies
+             delete env.NODE_ENV;
+ 
+-            // Run an install; we can't avoid it unless we inspect the
+-            // package.json, which I don't want to do to keep the codebase
+-            // clean (even if it has a slight perf cost when cloning v1 repos)
 -            const install = await execUtils.pipevp(`yarn`, [`install`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
 -            if (install.code !== 0)
 -              return install.code;
 -
-             stdout.write(`\n`);
+-            stdout.write(`\n`);
+-
+-            const pack = await execUtils.pipevp(`yarn`, [...workspaceCli, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
++            env["SKIP_YARN_COREPACK_CHECK"] = "1";
++            const pack = await execUtils.pipevp(`@yarnv1@`, [...workspaceCli, `--offline`, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
+             if (pack.code !== 0)
+               return pack.code;
  
-             const pack = await execUtils.pipevp(`yarn`, [...workspaceCli, `pack`, `--filename`, npath.fromPortablePath(outputPath)], {cwd, env, stdin, stdout, stderr});
-@@ -375,9 +371,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
-             // We can't use `npm ci` because some projects don't have npm
-             // lockfiles that are up-to-date. Hopefully npm won't decide
-             // to change the versions randomly.
+@@ -372,13 +350,6 @@ export async function prepareExternalProject(cwd: PortablePath, outputPath: Port
+             delete env.NPM_CONFIG_PRODUCTION;
+             delete env.NODE_ENV;
+ 
+-            // We can't use `npm ci` because some projects don't have npm
+-            // lockfiles that are up-to-date. Hopefully npm won't decide
+-            // to change the versions randomly.
 -            const install = await execUtils.pipevp(`npm`, [`install`, `--legacy-peer-deps`], {cwd, env, stdin, stdout, stderr, end: execUtils.EndStrategy.ErrorCode});
 -            if (install.code !== 0)
 -              return install.code;
- 
+-
              const packStream = new PassThrough();
              const packPromise = miscUtils.bufferStream(packStream);
+ 
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/default.nix b/pkgs/by-name/ya/yarn-berry/fetcher/default.nix
index f5389311896d..00925e28b195 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/default.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/default.nix
@@ -2,6 +2,8 @@
   lib,
   newScope,
   yarn-berry,
+  yarn,
+  replaceVars,
   libzip,
   zlib,
   zlib-ng,
@@ -12,7 +14,11 @@ let
     "3" = final: {
       berryCacheVersion = "8";
 
-      berryOfflinePatches = [ ./berry-3-offline.patch ];
+      berryOfflinePatches = [
+        (replaceVars ./berry-3-offline.patch {
+          yarnv1 = lib.getExe yarn;
+        })
+      ];
 
       # Known good version: 1.11.3
       libzip =
@@ -29,7 +35,11 @@ let
     "4" = final: {
       berryCacheVersion = "10";
 
-      berryOfflinePatches = [ ./berry-4-offline.patch ];
+      berryOfflinePatches = [
+        (replaceVars ./berry-4-offline.patch {
+          yarnv1 = lib.getExe yarn;
+        })
+      ];
 
       # Known good version: 1.11.3
       libzip =
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh
index 0fda1c6e1c1a..6c6cde8d0bd0 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh
@@ -75,7 +75,7 @@ yarnBerryConfigHook() {
     export npm_config_nodedir="@nodeSrc@"
     export npm_config_node_gyp="@nodeGyp@"
 
-    YARN_IGNORE_PATH=1 @yarn_offline@ install --mode=skip-build
+    YARN_IGNORE_PATH=1 @yarn_offline@ install --mode=skip-build --inline-builds
     if [[ -z "${dontYarnBerryPatchShebangs-}" ]]; then
       echo "Running patchShebangs in between the Link and the Build step..."
       patchShebangs node_modules
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
index df15e691d95f..a48ae9db9b27 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
@@ -13,18 +13,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yarn-berry-${toString berryVersion}-fetcher";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "cyberchaos.dev";
     owner = "yuka";
     repo = "yarn-berry-fetcher";
-    tag = "1.2.1";
-    hash = "sha256-gBre1LGyDVhikigWoWWW5qZyDCHp4lDONPqg1CRtaFM=";
+    tag = finalAttrs.version;
+    hash = "sha256-4lPnjLvS9MBtFyIqFKY91w/6MAesziGMJLrE60djEsI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KNVfwv+qaJEu3TqhCKpiTfuRvFIFcHstcpjre/QXDso=";
+  cargoHash = "sha256-i0AJ3z+7oSqBW45Vs6dojcipQPoaIa6bejhqCfkdZNA=";
 
   env.YARN_ZIP_SUPPORTED_CACHE_VERSION = berryCacheVersion;
   env.LIBZIP_SYS_USE_PKG_CONFIG = 1;
diff --git a/pkgs/by-name/yt/ytmdesktop/git-rev-parse.patch b/pkgs/by-name/yt/ytmdesktop/git-rev-parse.patch
new file mode 100644
index 000000000000..cf58ab748fa3
--- /dev/null
+++ b/pkgs/by-name/yt/ytmdesktop/git-rev-parse.patch
@@ -0,0 +1,28 @@
+diff --git a/viteconfig/main.ts b/viteconfig/main.ts
+index ba6e2b6..d748d0a 100644
+--- a/viteconfig/main.ts
++++ b/viteconfig/main.ts
+@@ -3,7 +3,7 @@ import { defineConfig } from "vite";
+ 
+ let gitBranch: string = "";
+ try {
+-  gitBranch = execSync("git rev-parse --abbrev-ref HEAD").toString();
++  gitBranch = "???";
+ } catch (e) {
+   // User has likely downloaded from the YTM Desktop via the "Download ZIP".
+   // We don't plan to support this, but at least provide users with a bit of improved UX
+diff --git a/viteconfig/renderer.ts b/viteconfig/renderer.ts
+index b6531f6..321947a 100644
+--- a/viteconfig/renderer.ts
++++ b/viteconfig/renderer.ts
+@@ -6,8 +6,8 @@ import { execSync } from "node:child_process";
+ let gitBranch: string = "";
+ let gitCommitHash: string = "";
+ try {
+-  gitBranch = execSync("git rev-parse --abbrev-ref HEAD").toString();
+-  gitCommitHash = execSync("git rev-parse HEAD").toString();
++  gitBranch = "???";
++  gitCommitHash = execSync("cat .COMMIT").toString();
+ } catch (e) {
+   // User has likely downloaded from the YTM Desktop via the "Download ZIP".
+   // We don't plan to support this, but at least provide users with a bit of improved UX
diff --git a/pkgs/by-name/yt/ytmdesktop/missing-hashes.json b/pkgs/by-name/yt/ytmdesktop/missing-hashes.json
new file mode 100644
index 000000000000..37a5053f0d07
--- /dev/null
+++ b/pkgs/by-name/yt/ytmdesktop/missing-hashes.json
@@ -0,0 +1,45 @@
+{
+  "@esbuild/aix-ppc64@npm:0.21.5": "1f48fea96ab4fbc2921756361bc8a0c4d0690f14dc2298a357aa3d436bcd1cd646d490e5d71c4e0fb46b9e04401bc93153d6886456dd0665b6758be643c95a16",
+  "@esbuild/android-arm64@npm:0.21.5": "7a4831b0886c165ed671f0094dcd491235fe503364a261379c84e2225a3c3230a06bce1d3a02316fa8a040b0ffede56c617746dc3b5550549ae3fb07095bb20d",
+  "@esbuild/android-arm@npm:0.21.5": "9fa871018a9f2198f40fde2c672fcb1b9d3ab5ee602644ea4cf68c548ee2c0b6c60ad851ce85219f84886fd29757d8c49bac28ea48a2a16708a088e32dfe673a",
+  "@esbuild/android-x64@npm:0.21.5": "24e477ccdaf1437cabe8710bc052a13b975a53617094a225e39823a1c562a71ef975d860ab895c129a813302495d85387143e27068e62fc897a2ac0335e4a2f6",
+  "@esbuild/darwin-arm64@npm:0.21.5": "67b0e4ebc870d0babb6721328f02b0e75eca5ee8f176220fa194ac5897ce76a27aa4f6d724389a74e1517670f70e766fe03c30875fdebeee5b1f7b22e99c5a1f",
+  "@esbuild/darwin-x64@npm:0.21.5": "a4b6df47edf4b1e91eeca9d7af18f538e25615e00763709a4cc24a8918e7ac93b9bfc2ef9f44086f16257d05ad99e23c1213a7a1397475d1a78f0a1e773af89a",
+  "@esbuild/freebsd-arm64@npm:0.21.5": "a4cf357807f2ea445b5191b8e5488070b567e2b534dba24ce6f8f1a332598ee0b9ffa41b3b0e55cd0cf57e2b56f0f1d84413faba182b81cb43bf19edf58a7654",
+  "@esbuild/freebsd-x64@npm:0.21.5": "8957c1345196e5dabd7d9f290b5292161f5d9955f269051fa7873118cfb5a20c31d70771ea3560b513f879d0948ba32fba915fb1b387571c4fbbb1fbeaf2dd87",
+  "@esbuild/linux-arm64@npm:0.21.5": "1b95b17ed94eb977e38ea9130e677551b7cf0ccccdb3f23a9f8b59b5d67400817c2a417e4f043295bd3f67796853da2a1b1a8ca201ffe745efb40a144dfdc99c",
+  "@esbuild/linux-arm@npm:0.21.5": "6bfcd098ada5e6117d028777e5cc58456c2f570157fa0a0dce30c9d05b8389b86f74bf6b862534bf6994d342946c98b6774e1820880fd289765864b668e94c17",
+  "@esbuild/linux-ia32@npm:0.21.5": "73c249c9918f0c9a9268ffe14fe745f5e7564b309dcea213da08a5e4367ffdfc8df4b004c70f80269dce0f653a3280cfdd8bf9a7a616b5b60649e4faea6e69b5",
+  "@esbuild/linux-loong64@npm:0.21.5": "60977efe24b3b6e1461d49da07dd57c1234992b9d2e6ac7d0dedfee538321d42be25e496ffb193121d3a6c6ca6ea6722b880e95695824dcc6643a3d9426b2296",
+  "@esbuild/linux-mips64el@npm:0.21.5": "20fb6c8f6e58f66cd4351034858b2ad85bda4144576b180979305cfabed43780a71934e9f176e476c719f14e37253b231a43d46638ad232989d5f4dd72ec6b75",
+  "@esbuild/linux-ppc64@npm:0.21.5": "69f2ef1d127f48bc14cec479ae1a96dbf5fea651e0a3f148486f73495d2acb91acdaa164cd80648844916f05e7f9f9665a1864dd394e7f9acf96bea70937e6b5",
+  "@esbuild/linux-riscv64@npm:0.21.5": "60c749d87c0f67cc67c5cc0d82aa597b7a807bc52510a16960337433bdbc8fa9f3c46eba98080106c0971e404e2250ca11c441bb4ae5b7a7d78b4095e3a70363",
+  "@esbuild/linux-s390x@npm:0.21.5": "a14ff0484b962b374fd1e4662a53f8dd8999ba39fcf891f15631dfb2802c8d18893d6e366c42d28d55885e5804b7d6252c0e3cee038c241285c9b537ef12b4ae",
+  "@esbuild/linux-x64@npm:0.21.5": "9e5663fcace9c8456e9934a9ed6e7428db4080024eef3bfeaf82d476120bd881382c958be2785463d6b44467b3d3f870d6cce09a9cb37bcef19afeb97814d674",
+  "@esbuild/netbsd-x64@npm:0.21.5": "3cb6115c4557d653c7ad6d2be5b4ed7a688b14d85b7b7108a1a57dda0b2cca3f8ed13560fa6639da8788f860b75eb714a17cfb7ba8f967e93bdf40c9b3a1cde1",
+  "@esbuild/openbsd-x64@npm:0.21.5": "1caf0b502d6e2612ffd3e62589de2b9cd48cd742818746011d437e2d5787df4984f7c17b7a536aa20f12d04e519c859d755a7b57e6db0ed277054bd9c1036e85",
+  "@esbuild/sunos-x64@npm:0.21.5": "676da7301c7c600bb7de2523ecf5d877128da3c125fd8136533f5be38ca15d9f800b2fbbd396ca37d44c5daa51b8124d8a4728bb18245cd2becb3191b897c45a",
+  "@esbuild/win32-arm64@npm:0.21.5": "9b2ab87429efd3c2697dc5c7948ea57b57757b6e4709469e773b73cd5fe4b7fda5912073f4c3bdf9d0346b8f3ae443367a63bcd51de24fb81b9f592712eb3366",
+  "@esbuild/win32-ia32@npm:0.21.5": "c1fe3276507d82202c464cd4809e67e6f151e29ed9de05c32d086dfe30207db15e646911ebc7f50df659891bfee292a25062792c589c2ff769be238c6b5fb8be",
+  "@esbuild/win32-x64@npm:0.21.5": "5d7b28baa9c22684d35ec0515f6d36f8f583f26733c8e84c7f78edf17b8a7d133819267486f2fd66f20ca3a810896f11c3c81106d745040c2f07ade314846bf1",
+  "@rollup/rollup-android-arm-eabi@npm:4.25.0": "f2d7423f54f078bd5529d9c46fb8e6935e20cf33340a94375817af97251762dee8ee2a0b88f0f93d6154e43500ec45f6a8728c577fe7ed5bd0efcc7d38a02117",
+  "@rollup/rollup-android-arm64@npm:4.25.0": "c7f10f9cef68029447f509221ed44c75624296316449d5a40afc1c707653d23447be7092111b2bbb36d9fe918d05c7b144542e0f41d35254a7228fd711f5df0b",
+  "@rollup/rollup-darwin-arm64@npm:4.25.0": "86b23c2afe01bd4be8f20c7d4c500abdc03b4e1921433c5c8b4aed26a21c6288e77a6bf24cf367ce32598354830c29c561ff537e74ee86129d77b454ad03764a",
+  "@rollup/rollup-darwin-x64@npm:4.25.0": "36badafbeb30865194bb45ce8aba405bd0551f7134a9bec0661d19ccc0f60d6e28fb688c1bb42edf4ecd779a97125970ddc7ed92cb9d69edc80f42c671592209",
+  "@rollup/rollup-freebsd-arm64@npm:4.25.0": "b91c9de03945591de71b4d989bd1437f9e4f9a3e719bc9ee8cee8b8e62e1be2dbf9c140abc87ccfb1436ed1e3f545ee352ad56563f47f7b101232ad92cca0a26",
+  "@rollup/rollup-freebsd-x64@npm:4.25.0": "7b375aa4e7aa333802ab3438a3b92856b9e0653e05f8a0194fdbd59179c1e435bd7dfcc3c4241224856dabe66d866d6ce0a543ffd68c7fefb885c78a560c2b94",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.25.0": "7a8d3c4932c84f8111466ca749fc1250c5948edcde4e3149bc1ae2d9f9b32a03d976ad2dec8ffd392241623ee4913df3e4e1f76c185e4a3ead90f5f3cb24a000",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.25.0": "7367c95d900c351e12ce95e56f12b4d758e781eda9236d792c3e0af75c8967951cf0eb97db3467b63892d852cddfcb6d9632447a5038f1956bdf372ea97827ee",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.25.0": "6b5c1edc8cb456634c2cc410f581e1afaa1715a35b83f01684ea344b278b0ab7d1ed3285accf295433494cf814cbb8dd887273c78769f6ad68a5cfd8e42a76c8",
+  "@rollup/rollup-linux-arm64-musl@npm:4.25.0": "79966c734c4efb3fcd01187c642ef85b9ace5bdb42659862520c7871fa1ce6e00e5ca0b9a900775b17d2a7629d8ecc50d3d5533f539b80e9717bfdc8303ba431",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.25.0": "4682aa839f9d5fa3b03892090cb686df6ca99aa1f18a88e48a19356a0bb7a3c69241d9aa54cefbbee9064dff82aae17d50106b1dfae4bd5af8006ea021bff7ef",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.25.0": "67314611e708d2904a0569611fcf01781a9a05f70d0702554d81906b80af1f92acfb012874108779fabb57c866714d1d79be9ff70f0b7820bde4ee2c0c9c97b4",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.25.0": "823d5aa92b335fc7f291f5ac6d3e5ecb1e58fcac3ed1e2e5c1f50fa73afe710532c9002f72be2cd04b47c583a4c42d075bfb83ff37930245f9b865ff4e13f73f",
+  "@rollup/rollup-linux-x64-gnu@npm:4.25.0": "76604cf59202d091cbff6aea172bd0705cb8b49a21b7ca946bd31806f543c903f9381f6a2394029c228f395a9b1eb1c27eaf8b00b7943539e88a46cf2fd7560f",
+  "@rollup/rollup-linux-x64-musl@npm:4.25.0": "e90bf30b1ad823d5a01ebbca7343206cbb9a216f6b13eb517675fe70c18e009097329fd8507b9aeaab7307a124355259bcdc84ffb3c6d81fdb90d9b0d917d82d",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.25.0": "0426d6fb38a910b9613085db4e57449be956a22c58c173a8d8fcb88b8a1e15d86064c4e678aa3d4750dbfcfe8b0b17af58af1824a4e6114b916c0c8a2399fd88",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.25.0": "1fe8af4f364e349855b65a91b224284312b609ee801a67e37c74a17099018d4a82bd849d9ffedd9c02dd7a7647a51507bb0085ce2ed21e1f8372912414fdb1e1",
+  "@rollup/rollup-win32-x64-msvc@npm:4.25.0": "d8905143cbf990cfef4606d6cb7fa5e39d71b543898bb192057bb517245755d54aa6e38dd350ac11fcff62014c4ad027e9131fa066793754d70d2271ff2709af",
+  "electron-installer-debian@npm:3.2.0": "9ffb1fe15cf291ab23cd6ef51e20b30ebe003c58f745bc5373a3c0800f793f0cfccebfc01eec1cd6658672522a7dcb9733441cdcf9657624606333a5738538a1",
+  "electron-installer-redhat@npm:3.4.0": "78d9d76e04624e8140fdd8fc8ab9c807eac1ca49650ca1efed6ef8ff4577043413f8f4da614896cd7e6b3f93d4ed73ebca43a34d54fea96ba6dd36f2a979859a"
+}
diff --git a/pkgs/by-name/yt/ytmdesktop/package.nix b/pkgs/by-name/yt/ytmdesktop/package.nix
index f53e9493cc30..3540e1e631cc 100644
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@@ -1,19 +1,126 @@
 {
   lib,
-  asar,
-  commandLineArgs ? "",
-  copyDesktopItems,
-  electron_33,
-  fetchurl,
-  makeDesktopItem,
-  makeWrapper,
   stdenv,
-  zstd,
+
+  fetchFromGitHub,
+  makeDesktopItem,
+
+  copyDesktopItems,
+  makeWrapper,
+  nodejs,
+  yarn-berry_4,
+  zip,
+
+  electron,
+  commandLineArgs ? "",
 }:
+
+let
+  yarn-berry = yarn-berry_4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ytmdesktop";
   version = "2.0.8";
 
+  src = fetchFromGitHub {
+    owner = "ytmdesktop";
+    repo = "ytmdesktop";
+    tag = "v${finalAttrs.version}";
+    leaveDotGit = true;
+
+    postFetch = ''
+      cd $out
+      git rev-parse HEAD > .COMMIT
+      find -name .git -print0 | xargs -0 rm -rf
+    '';
+
+    hash = "sha256-QiV7U7LoJWvBqjVm7oVfHIiyw10cLSAk4lCQGO8hXtY=";
+  };
+
+  patches = [
+    # instead of runnning git during the build process
+    # use the .COMMIT file generated in the fetcher FOD
+    ./git-rev-parse.patch
+  ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace viteconfig/main.ts
+
+    # workaround for https://github.com/electron/electron/issues/31121
+    substituteInPlace src/main/index.ts \
+      --replace-fail "process.resourcesPath" "'$out/share/ytmdesktop/resources'"
+  '';
+
+  missingHashes = ./missing-hashes.json;
+
+  yarnOfflineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-piHpm7eeOoDmpgc1SmeJ3wLZHZiUZZGu+Pl30qQYqps=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    nodejs
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
+    zip
+  ];
+
+  # Don't auto-run scripts of dependencies
+  # We don't need any native modules, so this is fine
+  env.YARN_ENABLE_SCRIPTS = "0";
+
+  buildPhase = ''
+    runHook preBuild
+
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
+    zip -0Xqr ../electron.zip .
+    popd
+
+    rm -r electron-dist
+
+    # force @electron/packager to use our electron instead of downloading it
+    substituteInPlace node_modules/@electron/packager/dist/packager.js \
+      --replace-fail 'await this.getElectronZipPath(downloadOpts)' '"electron.zip"'
+
+    yarn run package
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    ''
+      runHook preInstall
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+
+      mkdir -p "$out"/share/ytmdesktop
+      cp -r out/*/{locales,resources{,.pak}} "$out"/share/ytmdesktop
+
+      install -Dm644 src/assets/icons/ytmd.png "$out"/share/pixmaps/ytmdesktop.png
+
+      makeWrapper ${lib.getExe electron} "$out"/bin/ytmdesktop \
+        --add-flags "$out"/share/ytmdesktop/resources/app.asar \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      cp -r out/*/"YouTube Music Desktop App".app "$out"/Applications
+
+      wrapProgram "$out"/Applications/"YouTube Music Desktop App".app/Contents/MacOS/youtube-music-desktop-app \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
+
+      makeWrapper "$out"/Applications/"YouTube Music Desktop App".app/Contents/MacOS/youtube-music-desktop-app "$out"/bin/ytmdesktop
+    ''
+    + ''
+      runHook postInstall
+    '';
+
   desktopItems = [
     (makeDesktopItem {
       desktopName = "YouTube Music Desktop App";
@@ -31,63 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  nativeBuildInputs = [
-    asar
-    copyDesktopItems
-    makeWrapper
-    zstd
-  ];
-
-  src = fetchurl {
-    url = "https://github.com/ytmdesktop/ytmdesktop/releases/download/v${finalAttrs.version}/youtube-music-desktop-app_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-CwidVf4i9CeD/a8u5sZrBpoYzlZqi9ptFxljr9VmKq8=";
-  };
-
-  unpackPhase = ''
-    runHook preUnpack
-
-    ar x $src data.tar.zst
-    tar xf data.tar.zst
-
-    runHook preUnpack
-  '';
-
-  postPatch = ''
-    pushd usr/lib/youtube-music-desktop-app
-
-    asar extract resources/app.asar patched-asar
-
-    # workaround for https://github.com/electron/electron/issues/31121
-    substituteInPlace patched-asar/.vite/main/index.js \
-      --replace-fail "process.resourcesPath" "'$out/lib/resources'"
-
-    asar pack patched-asar resources/app.asar
-
-    popd
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{lib,share/pixmaps}
-
-    cp -r usr/lib/youtube-music-desktop-app/{locales,resources{,.pak}} $out/lib
-    cp usr/share/pixmaps/youtube-music-desktop-app.png $out/share/pixmaps/ytmdesktop.png
-
-    runHook postInstall
-  '';
-
-  fixupPhase = ''
-    runHook preFixup
-
-    makeWrapper ${lib.getExe electron_33} $out/bin/ytmdesktop \
-      --add-flags $out/lib/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
-
-    runHook preFixup
-  '';
-
   meta = {
     changelog = "https://github.com/ytmdesktop/ytmdesktop/tag/v${finalAttrs.version}";
     description = "A Desktop App for YouTube Music";
@@ -96,12 +146,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     mainProgram = "ytmdesktop";
     maintainers = [ lib.maintainers.cjshearer ];
-    inherit (electron_33.meta) platforms;
-    # While the files we extract from the .deb are cross-platform (javascript), the installation
-    # process for darwin is different, and I don't have a test device. PRs are welcome if you can
-    # add the correct installation steps. I would suggest looking at the following:
-    # https://www.electronjs.org/docs/latest/tutorial/application-distribution#manual-packaging
-    # https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
-    badPlatforms = lib.platforms.darwin;
+    inherit (electron.meta) platforms;
   };
 })
diff --git a/pkgs/desktops/lomiri/applications/lomiri/default.nix b/pkgs/desktops/lomiri/applications/lomiri/default.nix
index 7fe54d5caf6c..1ba3ed098dcc 100644
--- a/pkgs/desktops/lomiri/applications/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri/default.nix
@@ -61,30 +61,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri";
-  version = "0.3.0";
+  version = "0.4.1";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri";
-    rev = finalAttrs.version;
-    hash = "sha256-Godl/SQ0+NkI6kwH85SXHPQ5GRlih3xvCyeYxwiqH/s=";
+    tag = finalAttrs.version;
+    hash = "sha256-5fwSLUTntVyV5FIVnPishrU/55tyTyx0Fzh6oitaWwo=";
   };
 
   patches = [
-    # Remove when version > 0.3.0
-    (fetchpatch {
-      name = "0001-lomiri-Fix-accountsservice-test.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri/-/commit/353153c4ebc40ffcc7702af42205d2075fc81503.patch";
-      hash = "sha256-J9ySZgWd7KR7aU1cCRu5iirq7bi3NdLR9SZs9Pd1I8w=";
-    })
-
-    # Remove when https://gitlab.com/ubports/development/core/lomiri/-/merge_requests/181 merged & in release
-    (fetchpatch {
-      name = "0101-lomiri-Fix-accountsservice-property-defaults.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri/-/commit/369c7aac242f1798ce46b1415ab6112ac5e9d095.patch";
-      hash = "sha256-ieJCA1F/ljmgwEfGXWCTQNG1A/bmiJhNH9uzzULpUEc=";
-    })
-
     # Fix greeter & related settings
     # These patches are seemingly not submitted upstream yet
     (fetchpatch {
@@ -99,14 +85,8 @@ stdenv.mkDerivation (finalAttrs: {
     })
     (fetchpatch {
       name = "1002-lomiri-Fix-Lomiri-greeter.patch";
-      url = "https://salsa.debian.org/ubports-team/lomiri/-/raw/ebbe0f3f568bd145bb58a2e47f7112442328a0a5/debian/patches/1008_lomiri-greeter-wayland.patch";
-      excludes = [ "data/lomiri-greeter.desktop.in.in" ]; # conflict with GNUInstallDirs patch
-      hash = "sha256-XSSxf06Su8PMoqYwqevN034b/li8G/cNXjrqOXyhTRg=";
-    })
-    (fetchpatch {
-      name = "1003-lomiri-Hide-launcher-in-greeter-mode.patch";
-      url = "https://salsa.debian.org/ubports-team/lomiri/-/raw/ebbe0f3f568bd145bb58a2e47f7112442328a0a5/debian/patches/0002_qml-shell-hide-and-disallow-launcher-in-greeter-only-mode.patch";
-      hash = "sha256-R0aMlb7N7XACCthML4SQSd0LvbadADfdQJqrYFhmujk=";
+      url = "https://salsa.debian.org/ubports-team/lomiri/-/raw/5f9d28fe6f0ba9ab7eed149b4da7f6b3f4eae55a/debian/patches/1008_lomiri-greeter-wayland.patch";
+      hash = "sha256-vuNTKWA50krtx/+XB2pMI271q57N+kqWlfq54gtf/HI=";
     })
     (fetchpatch {
       name = "1004-lomiri-Dont-reset-OSK-setting.patch";
@@ -122,11 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch =
     ''
-      # Part of greeter fix, applies separately due to merge conflicts
-      substituteInPlace data/lomiri-greeter.desktop.in.in \
-        --replace-fail '@CMAKE_INSTALL_FULL_BINDIR@/lomiri-greeter-wrapper @CMAKE_INSTALL_FULL_BINDIR@/lomiri --mode=greeter' '@CMAKE_INSTALL_FULL_BINDIR@/lomiri --mode=greeter' \
-        --replace-fail 'X-LightDM-Session-Type=mir' 'X-LightDM-Session-Type=wayland'
-
       # Written with a different qtmir branch in mind, but different branch breaks compat with some patches
       substituteInPlace CMakeLists.txt \
         --replace-fail 'qt5mir2server' 'qtmirserver'
@@ -281,7 +256,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
-  meta = with lib; {
+  meta = {
     description = "Shell of the Lomiri Operating environment";
     longDescription = ''
       Shell of the Lomiri Operating environment optimized for touch based human-machine interaction, but also supporting
@@ -291,9 +266,9 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://lomiri.com/";
     changelog = "https://gitlab.com/ubports/development/core/lomiri/-/blob/${finalAttrs.version}/ChangeLog";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "lomiri";
-    teams = [ teams.lomiri ];
-    platforms = platforms.linux;
+    teams = [ lib.teams.lomiri ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index a76595c5f148..f7ab39cfbcad 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation (finalAttrs: {
       license = licenses.mit;
       platforms = platforms.linux ++ platforms.darwin;
       badPlatforms = [
-        "riscv64-linux"
+        "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
         "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
         "powerpc64le-linux" # `#error "No support for PPC64"`
       ];
diff --git a/pkgs/development/libraries/hamlib/4.nix b/pkgs/development/libraries/hamlib/4.nix
index f4747960c022..385e29666764 100644
--- a/pkgs/development/libraries/hamlib/4.nix
+++ b/pkgs/development/libraries/hamlib/4.nix
@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hamlib";
-  version = "4.6";
+  version = "4.6.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/hamlib/hamlib-${version}.tar.gz";
-    hash = "sha256-b4c1ebxODvTlQDE+wqzU8Zi1UQ192Tl6SuaP6P8g0Wc=";
+    hash = "sha256-sqxz9E3RFh6V/e5slSdhRHV2R7+S1/2zae4v5B7Ueug=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 54aef8fb8313..7de5a4e4744f 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -101,7 +101,7 @@ in
     '';
   });
 
-  cqueues = prev.cqueues.overrideAttrs (oa: rec {
+  cqueues = prev.cqueues.overrideAttrs (oa: {
     # Parse out a version number without the Lua version inserted
     version =
       let
@@ -112,7 +112,7 @@ in
       in
       "${date}-${rev}";
 
-    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
+    meta.broken = luaOlder "5.1" || luaAtLeast "5.5";
 
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       gnum4
@@ -133,13 +133,13 @@ in
     # version, which doesn't work well for us, so modify it
     postConfigure =
       let
-        inherit (prev.cqueues) pname;
+        inherit (final.cqueues) pname version;
       in
       ''
         # 'all' target auto-detects correct Lua version, which is fine for us as
         # we only have the right one available :)
         sed -Ei ''${rockspecFilename} \
-          -e 's|lua == 5.[[:digit:]]|lua >= 5.1, <= 5.3|' \
+          -e 's|lua == 5.[[:digit:]]|lua >= 5.1, <= 5.4|' \
           -e 's|build_target = "[^"]+"|build_target = "all"|' \
           -e 's|version = "[^"]+"|version = "${version}"|'
         specDir=$(dirname ''${rockspecFilename})
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 6b2588d4b3da..857a3228cdae 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -187,6 +187,7 @@ mapAliases {
   remod-cli = pkgs.remod; # added 2024-12-04
   "reveal.js" = throw "reveal.js was removed because it provides no executable"; # added 2025-03-23
   reveal-md = pkgs.reveal-md; # added 2023-07-31
+  rollup = throw "rollup has been removed because it was broken"; # added 2025-04-28
   inherit (pkgs) rtlcss; # added 2023-08-29
   s3http = throw "s3http was removed because it was abandoned upstream"; # added 2023-08-18
   inherit (pkgs) serverless; # Added 2023-11-29
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 33d1e81694b5..546c9aa642d3 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -138,7 +138,6 @@
 , "purs-tidy"
 , "purty"
 , "rimraf"
-, "rollup"
 , "sass"
 , "semver"
 , "serve"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index d2cc1ac4c48d..2b95827a05d9 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -62086,27 +62086,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  rollup = nodeEnv.buildNodePackage {
-    name = "rollup";
-    packageName = "rollup";
-    version = "4.35.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/rollup/-/rollup-4.35.0.tgz";
-      sha512 = "kg6oI4g+vc41vePJyO6dHt/yl0Rz3Thv0kJeVQ3D1kS3E5XSuKbPc29G4IpT/Kv1KQwgHVcN+HtyS+HYLNSvQg==";
-    };
-    dependencies = [
-      sources."@types/estree-1.0.6"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Next-generation ES module bundler";
-      homepage = "https://rollupjs.org/";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   sass = nodeEnv.buildNodePackage {
     name = "sass";
     packageName = "sass";
diff --git a/pkgs/development/python-modules/conda-libmamba-solver/default.nix b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
index 572e43207050..26b6e17c0f44 100644
--- a/pkgs/development/python-modules/conda-libmamba-solver/default.nix
+++ b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
@@ -2,14 +2,13 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  libmambapy,
   hatchling,
   hatch-vcs,
   boltons,
 }:
 buildPythonPackage rec {
   pname = "conda-libmamba-solver";
-  version = "25.3.0";
+  version = "25.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -17,7 +16,7 @@ buildPythonPackage rec {
     owner = "conda";
     repo = "conda-libmamba-solver";
     tag = version;
-    hash = "sha256-7iWrvh82MOkj1tgR0M8mdv8NLGckI4fxIV4rl1DI4w0=";
+    hash = "sha256-DnRy5ntSjKADeHbqvLJz62WlLbM94U7urZLJg+Tpqbw=";
   };
 
   build-system = [
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   dependencies = [
     boltons
-    libmambapy
   ];
 
   # this package depends on conda for the import to run successfully, but conda depends on this package to execute.
diff --git a/pkgs/development/python-modules/findspark/default.nix b/pkgs/development/python-modules/findspark/default.nix
new file mode 100644
index 000000000000..9a0e3f5ff82d
--- /dev/null
+++ b/pkgs/development/python-modules/findspark/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "findspark";
+  version = "2.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "minrk";
+    repo = "findspark";
+    tag = version;
+    hash = "sha256-/+b1Pf+ySwlv6XP1wtHx1tx4WfYdu6GuxJVQkcX3MY8=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "findspark" ];
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Find pyspark to make it importable";
+    homepage = "https://github.com/minrk/findspark";
+    changelog = "https://github.com/minrk/findspark/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 28bd56d7968e..7d10c0d4c3d5 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -90,7 +90,7 @@ let
   ibisTestingData = fetchFromGitHub {
     owner = "ibis-project";
     repo = "testing-data";
-    # https://github.com/ibis-project/ibis/blob/10.4.0/nix/overlay.nix#L94-L100
+    # https://github.com/ibis-project/ibis/blob/10.5.0/nix/overlay.nix#L94-L100
     rev = "b26bd40cf29004372319df620c4bbe41420bb6f8";
     hash = "sha256-1fenQNQB+Q0pbb0cbK2S/UIwZDE4PXXG15MH3aVbyLU=";
   };
@@ -98,14 +98,14 @@ in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "10.4.0";
+  version = "10.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ibis-project";
     repo = "ibis";
     tag = version;
-    hash = "sha256-N6T3Hx4UIb08P+Xqg6RFb9q/pmAHvldW0yaFoRxmMv0=";
+    hash = "sha256-KJPl5bkD/tQlHY2k0b9zok5YCPekaXw7Y9z8P4AD3FQ=";
   };
 
   build-system = [
@@ -157,13 +157,19 @@ buildPythonPackage rec {
     "test_read_sqlite"
     "test_register_sqlite"
     "test_roundtrip_xlsx"
+
     # AssertionError: value does not match the expected value in snapshot
     "test_union_aliasing"
+
     # requires network connection
     "test_s3_403_fallback"
     "test_hugging_face"
+
     # requires pytest 8.2+
     "test_roundtrip_delta"
+
+    # AssertionError: value does not match the expected value in snapshot ibis/backends/tests/snapshots/test_sql/test_rewrite_context/sqlite/out.sql
+    "test_rewrite_context"
   ];
 
   # patch out tests that check formatting with black
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index 254909ce832d..018aa8e3c3b8 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -1,11 +1,11 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
 
   # build-system
-  flit-core,
+  hatchling,
 
   # dependencies
   click,
@@ -34,25 +34,27 @@
   pytestCheckHook,
   sphinx-inline-tabs,
   texsoup,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-book";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "jupyter-book";
     repo = "jupyter-book";
     tag = "v${version}";
-    hash = "sha256-MBSf2/+4+efWHJ530jdezeh5OLTtUZlAEOl5SqoWOuE=";
+    hash = "sha256-04I9mzJMXCpvMiOeMD/Bg8FiymkRgHf/Yo9C1VcyTsw=";
   };
 
-  build-system = [ flit-core ];
+  build-system = [ hatchling ];
 
-  pythonRelaxDeps = [ "myst-parser" ];
+  pythonRelaxDeps = [
+    "myst-parser"
+    "sphinx"
+  ];
 
   dependencies = [
     click
@@ -87,27 +89,37 @@ buildPythonPackage rec {
     pytestCheckHook
     sphinx-inline-tabs
     texsoup
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
+  disabledTests =
+    [
+      # touch the network
+      "test_create_from_cookiecutter"
 
-  disabledTests = [
-    # touch the network
-    "test_create_from_cookiecutter"
-    # flaky?
-    "test_execution_timeout"
-    # require texlive
-    "test_toc"
-    "test_toc_latex_parts"
-    "test_toc_latex_urllink"
-    # WARNING: Executing notebook failed: CellExecutionError [mystnb.exec]
-    "test_build_dirhtml_from_template"
-    "test_build_from_template"
-    "test_build_page"
-    "test_build_singlehtml_from_template"
-  ];
+      # flaky?
+      "test_execution_timeout"
+
+      # require texlive
+      "test_toc"
+      "test_toc_latex_parts"
+      "test_toc_latex_urllink"
+
+      # AssertionError: assert 'There was an error in building your book' in '1'
+      "test_build_errors"
+
+      # WARNING: Executing notebook failed: CellExecutionError [mystnb.exec]
+      "test_build_dirhtml_from_template"
+      "test_build_from_template"
+      "test_build_page"
+      "test_build_singlehtml_from_template"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # pytest.PytestUnraisableExceptionWarning: Exception ignored in: <sqlite3.Connection object at 0x115dcc9a0>
+      # ResourceWarning: unclosed database in <sqlite3.Connection object at 0x115dcc9a0>
+      "test_clean_html_latex"
+      "test_clean_latex"
+    ];
 
   disabledTestPaths = [
     # require texlive
diff --git a/pkgs/development/python-modules/narwhals/default.nix b/pkgs/development/python-modules/narwhals/default.nix
index 3633431ddc39..6c9e162220d0 100644
--- a/pkgs/development/python-modules/narwhals/default.nix
+++ b/pkgs/development/python-modules/narwhals/default.nix
@@ -13,6 +13,8 @@
   pandas,
   polars,
   pyarrow,
+  pyspark,
+  sqlframe,
 
   # tests
   duckdb,
@@ -23,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "narwhals";
-  version = "1.30.0";
+  version = "1.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "narwhals-dev";
     repo = "narwhals";
     tag = "v${version}";
-    hash = "sha256-jqrrQRviWllzZQEnlOTZ6oJM3WYQ3YlDvareTTBcNl4=";
+    hash = "sha256-AYgpHJwQVP+F2kr5YJtjnLNYedc81RvRcX1Cfh7c0xw=";
   };
 
   build-system = [
@@ -46,6 +48,8 @@ buildPythonPackage rec {
     pandas = [ pandas ];
     polars = [ polars ];
     pyarrow = [ pyarrow ];
+    pyspark = [ pyspark ];
+    sqlframe = [ sqlframe ];
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/opencamlib/default.nix b/pkgs/development/python-modules/opencamlib/default.nix
new file mode 100644
index 000000000000..82b817adae30
--- /dev/null
+++ b/pkgs/development/python-modules/opencamlib/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  scikit-build-core,
+  cmake,
+  ninja,
+  stdenv,
+  llvmPackages,
+  boost,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "opencamlib";
+  version = "2023.01.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aewallin";
+    repo = "opencamlib";
+    tag = version;
+    hash = "sha256-pUj71PdWo902dqF9O6SLnpvFooFU2OfLBv8hAVsH/iA=";
+  };
+
+  build-system = [
+    scikit-build-core
+  ];
+
+  buildInputs = [
+    boost
+  ] ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'version = "2022.12.18"' 'version = "${version}"'
+  '';
+
+  dontUseCmakeConfigure = true;
+  env.CMAKE_ARGS = "-DVERSION_STRING=${version} -DBoost_USE_STATIC_LIBS=OFF";
+
+  pythonImportsCheck = [ "opencamlib" ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    pushd examples/python
+    # this produces a lot of non-actionalble lines on stdout
+    ${python.interpreter} test.py > /dev/null
+    popd
+
+    runHook postCheck
+  '';
+
+  meta = {
+    homepage = "https://github.com/aewallin/opencamlib";
+    description = "Open source computer aided manufacturing algorithms library";
+    # from src/deb/debian_copyright.txt
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ tomjnixon ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyatag/default.nix b/pkgs/development/python-modules/pyatag/default.nix
index 6e427cabe802..3b2740f1a744 100644
--- a/pkgs/development/python-modules/pyatag/default.nix
+++ b/pkgs/development/python-modules/pyatag/default.nix
@@ -34,6 +34,7 @@ buildPythonPackage rec {
   ];
 
   # it would use the erroneous tag 3.5.1
+  # nixpkgs-update: no auto update
   passthru.skipBulkUpdate = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/python-hcl2/default.nix b/pkgs/development/python-modules/python-hcl2/default.nix
index 55daa308f3e8..2afaf4592bfe 100644
--- a/pkgs/development/python-modules/python-hcl2/default.nix
+++ b/pkgs/development/python-modules/python-hcl2/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "python-hcl2";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "amplify-education";
     repo = "python-hcl2";
     tag = "v${version}";
-    hash = "sha256-F3R7wAJ3DfEriwJC7u+WLYfkThIuqmkAlvLWA8sTW/4=";
+    hash = "sha256-PXdk1Edoqqxi3Rsx7Xn0S+kcabc3mo6GqjQ9ZgXZq10=";
   };
 
   disabled = pythonOlder "3.7";
diff --git a/pkgs/development/python-modules/skrl/default.nix b/pkgs/development/python-modules/skrl/default.nix
index 75185cae8be2..49ccd8740f92 100644
--- a/pkgs/development/python-modules/skrl/default.nix
+++ b/pkgs/development/python-modules/skrl/default.nix
@@ -16,15 +16,15 @@
 
 buildPythonPackage rec {
   pname = "skrl";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Toni-SM";
     repo = pname;
     tag = version;
-    hash = "sha256-ONCRZ5Gpvg61dhi7GVxtvXIJiyZY9Fmk2qexMXVuj3A=";
+    hash = "sha256-5lkoYAmMIWqK3+E3WxXMWS9zal2DhZkfl30EkrHKpdI=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -63,6 +63,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Reinforcement learning library using PyTorch focusing on readability and simplicity";
+    changelog = "https://github.com/Toni-SM/skrl/releases/tag/${version}";
     homepage = "https://skrl.readthedocs.io";
     license = licenses.mit;
     maintainers = with maintainers; [ bcdarwin ];
diff --git a/pkgs/development/python-modules/spsdk-mcu-link/default.nix b/pkgs/development/python-modules/spsdk-mcu-link/default.nix
new file mode 100644
index 000000000000..b62f2afd508a
--- /dev/null
+++ b/pkgs/development/python-modules/spsdk-mcu-link/default.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  hidapi,
+  pyusb,
+
+  # tests
+  click,
+  pytestCheckHook,
+  spsdk,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  spsdk-mcu-link,
+}:
+
+buildPythonPackage rec {
+  pname = "spsdk-mcu-link";
+  version = "0.6.0";
+  pyproject = true;
+
+  # Latest tag missing on GitHub
+  src = fetchPypi {
+    pname = "spsdk_mcu_link";
+    inherit version;
+    hash = "sha256-x+aOfFdD0+IfDT7LA2QlYqR7kMOwPfvlMCcZvOYnM0Q=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRemoveDeps = [
+    # unpackaged
+    "libusb_package"
+    "wasmtime"
+  ];
+
+  pythonRelaxDeps = [
+    "pyusb"
+  ];
+
+  dependencies = [
+    hidapi
+    pyusb
+  ];
+
+  nativeCheckInputs = [
+    click
+    pytestCheckHook
+    spsdk
+    writableTmpDirAsHomeHook
+  ];
+
+  # Cyclic dependency with spsdk
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = spsdk-mcu-link.overridePythonAttrs {
+      pythonImportsCheck = [
+        "spsdk_mcu_link"
+      ];
+
+      doCheck = true;
+    };
+  };
+
+  meta = {
+    description = "Debugger probe plugin for SPSDK supporting LPC-Link/MCU-Link from NXP";
+    homepage = "https://pypi.org/project/spsdk-mcu-link";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/spsdk-pyocd/default.nix b/pkgs/development/python-modules/spsdk-pyocd/default.nix
new file mode 100644
index 000000000000..87aa71450d14
--- /dev/null
+++ b/pkgs/development/python-modules/spsdk-pyocd/default.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  pyocd,
+  pyocd-pemicro,
+  spsdk,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  spsdk-pyocd,
+}:
+
+buildPythonPackage rec {
+  pname = "spsdk-pyocd";
+  version = "0.3.1";
+  pyproject = true;
+
+  # Latest tag missing on GitHub
+  src = fetchPypi {
+    pname = "spsdk_pyocd";
+    inherit version;
+    hash = "sha256-yVQtX2T1l0TmFwaZDSFCXMuoFxTalfOr3b4CCTeteKI=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    pyocd
+  ];
+
+  optional-dependencies = {
+    pemicro = [
+      pyocd-pemicro
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    spsdk
+    writableTmpDirAsHomeHook
+  ];
+
+  # Cyclic dependency with spsdk
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = spsdk-pyocd.overridePythonAttrs {
+      pythonImportsCheck = [ "spsdk_pyocd" ];
+
+      doCheck = true;
+    };
+  };
+
+  meta = {
+    description = "Debugger probe plugin for SPSDK";
+    homepage = "https://pypi.org/project/spsdk-pyocd";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index e0569c52c982..cc518a0b3343 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -27,12 +27,16 @@
   packaging,
   platformdirs,
   prettytable,
+  pyasn1,
   pyocd,
   pyserial,
   requests,
   ruamel-yaml,
   sly,
+  spsdk-mcu-link,
+  spsdk-pyocd,
   typing-extensions,
+  x690,
 
   # tests
   ipykernel,
@@ -40,26 +44,25 @@
   pytestCheckHook,
   voluptuous,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "2.5.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nxp-mcuxpresso";
     repo = "spsdk";
     tag = "v${version}";
-    hash = "sha256-Ua32c6hNjwfjsQIugiqtRL50AvOrPgqyKoG1Lb0NVqE=";
+    hash = "sha256-AdW19Zf5TZ6hChXbW9dLGcMpFTQOT1wrPzEqaSfWzDE=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=72.1,<74" "setuptools"
-
-    substituteInPlace setup.py \
-      --replace-fail "setuptools>=72.1,<74" "setuptools"
+      --replace-fail "setuptools>=72.1,<74" "setuptools" \
+      --replace-fail "setuptools_scm<8.2" "setuptools_scm"
   '';
 
   build-system = [
@@ -69,8 +72,12 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "cryptography"
-    "requests"
+    "filelock"
+    "importlib-metadata"
     "packaging"
+    "prettytable"
+    "requests"
+    "setuptools_scm"
     "typing-extensions"
   ];
 
@@ -100,26 +107,27 @@ buildPythonPackage rec {
     packaging
     platformdirs
     prettytable
+    pyasn1
     pyocd
     pyserial
     requests
     ruamel-yaml
     sly
+    spsdk-mcu-link
+    spsdk-pyocd
     typing-extensions
+    x690
   ];
 
   pythonImportsCheck = [ "spsdk" ];
 
-  preInstallCheck = ''
-    export HOME="$(mktemp -d)"
-  '';
-
   nativeCheckInputs = [
     ipykernel
     pytest-notebook
     pytestCheckHook
     voluptuous
     versionCheckHook
+    writableTmpDirAsHomeHook
   ];
   versionCheckProgramArg = "--version";
 
@@ -129,7 +137,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.tag}/docs/release_notes.rst";
+    changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/v${version}/docs/release_notes.rst";
     description = "NXP Secure Provisioning SDK";
     homepage = "https://github.com/nxp-mcuxpresso/spsdk";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/sqlframe/default.nix b/pkgs/development/python-modules/sqlframe/default.nix
new file mode 100644
index 000000000000..b09674bbe8ac
--- /dev/null
+++ b/pkgs/development/python-modules/sqlframe/default.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools-scm,
+
+  # dependencies
+  prettytable,
+  sqlglot,
+  typing-extensions,
+
+  # tests
+  databricks-sql-connector,
+  duckdb,
+  findspark,
+  google-cloud-bigquery,
+  pyspark,
+  pytest-postgresql,
+  pytest-xdist,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "sqlframe";
+  version = "3.31.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "eakmanrq";
+    repo = "sqlframe";
+    tag = "v${version}";
+    hash = "sha256-X7KZSbq9KKUE4lXZIHj++koJmjWYI1sMhA6LfClr9pU=";
+  };
+
+  build-system = [
+    setuptools-scm
+  ];
+
+  dependencies = [
+    prettytable
+    sqlglot
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "sqlframe" ];
+
+  nativeCheckInputs = [
+    databricks-sql-connector
+    duckdb
+    findspark
+    google-cloud-bigquery
+    pyspark
+    pytest-postgresql
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Requires google-cloud credentials
+    # google.auth.exceptions.DefaultCredentialsErro
+    "test_activate_bigquery_default_dataset"
+  ];
+
+  disabledTestPaths = [
+    # duckdb.duckdb.CatalogException: Catalog Error: Table Function with name "dsdgen" is not in the catalog, but it exists in the tpcds extension.
+    # "tests/integration/test_int_dataframe.py"
+    "tests/integration/"
+  ];
+
+  meta = {
+    description = "Turning PySpark Into a Universal DataFrame API";
+    homepage = "https://github.com/eakmanrq/sqlframe";
+    changelog = "https://github.com/eakmanrq/sqlframe/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index 6945e853adc3..7b109e1f2590 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -1,35 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  duckdb,
   fetchFromGitHub,
-  pytestCheckHook,
-  python-dateutil,
-  pythonOlder,
+
+  # build-system
   setuptools,
   setuptools-scm,
+
+  # dependencies
+  python-dateutil,
+
+  # tests
+  pytestCheckHook,
+  duckdb,
 }:
 
 buildPythonPackage rec {
   pname = "sqlglot";
-  version = "25.20.1";
+  version = "26.16.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     repo = "sqlglot";
     owner = "tobymao";
     tag = "v${version}";
-    hash = "sha256-RE9Hbb3g6j4j5X2ksjcBZ610RcV7Zd3YaKaBIUyD2vU=";
+    hash = "sha256-uX72AHr4IC+u5AYkW/3myruVPs5NZ1V3THVg+9GWxpg=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     # Optional dependency used in the sqlglot optimizer
     python-dateutil
   ];
@@ -41,11 +44,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "sqlglot" ];
 
-  meta = with lib; {
+  meta = {
     description = "No dependency Python SQL parser, transpiler, and optimizer";
     homepage = "https://github.com/tobymao/sqlglot";
     changelog = "https://github.com/tobymao/sqlglot/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ cpcloud ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cpcloud ];
   };
 }
diff --git a/pkgs/development/python-modules/t61codec/default.nix b/pkgs/development/python-modules/t61codec/default.nix
new file mode 100644
index 000000000000..ea0d4d5e83d4
--- /dev/null
+++ b/pkgs/development/python-modules/t61codec/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "t61codec";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "exhuma";
+    repo = "t61codec";
+    tag = "v${version}";
+    hash = "sha256-PNUahn6NpNWdK3yhcQ23qb08lkZeNW61GosShLiyPc8=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  pythonImportsCheck = [ "t61codec" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python codec for T.61 strings";
+    homepage = "https://github.com/exhuma/t61codec";
+    changelog = "https://github.com/exhuma/t61codec/blob/v${version}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/x690/default.nix b/pkgs/development/python-modules/x690/default.nix
new file mode 100644
index 000000000000..61ec38319a6b
--- /dev/null
+++ b/pkgs/development/python-modules/x690/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  t61codec,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "x690";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "exhuma";
+    repo = "x690";
+    tag = "v${version}";
+    hash = "sha256-yU4FABlTAFoj87SJXDA+sVCJT3pCbYxpTXp7Ja2ltGE=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "t61codec"
+  ];
+
+  dependencies = [
+    t61codec
+  ];
+
+  pythonImportsCheck = [ "x690" ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: "<UnknownType 99 b'abc' TypeClass.APPLICATION/TypeNature.CONSTRUCTED/3>" != "<UnknownType 99 b'abc' application/constructed/3>"
+    "test_repr"
+  ];
+
+  meta = {
+    description = "Pure Python X.690 implementation";
+    homepage = "https://github.com/exhuma/x690";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 991dda967c2e..94ca53a26a36 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -16,8 +16,8 @@ let
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
     };
     "10" = {
-      version = "10.9.0";
-      hash = "sha256-6lOrdHrIt5Id5jtC6rGt8CHh/m3tBfYvAIhcwzpGEY0=";
+      version = "10.10.0";
+      hash = "sha256-+g9ROqgZF2TStrQyQgeIwnDwe0+ZkJm2W7IBDuxwKjA=";
     };
   };
 
diff --git a/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix
new file mode 100644
index 000000000000..d825491b6605
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  zeroconf,
+  pytestCheckHook,
+  home-assistant,
+
+}:
+buildHomeAssistantComponent rec {
+  owner = "AlexxIT";
+  domain = "yandex_station";
+  version = "3.18.3";
+
+  src = fetchFromGitHub {
+    owner = "AlexxIT";
+    repo = "YandexStation";
+    tag = "v${version}";
+    hash = "sha256-l8DsL8g6K8/SjCIk7rjfQSk4iRsKBoGgzJpy7UhxQ7o=";
+  };
+
+  dependencies = [
+    zeroconf
+  ];
+
+  nativeCheckInputs = [
+    home-assistant
+    pytestCheckHook
+  ] ++ (home-assistant.getPackages "stream" home-assistant.python.pkgs);
+
+  meta = {
+    description = "Controlling Yandex.Station and other smart home devices with Alice from Home Assistant";
+    homepage = "https://github.com/AlexxIT/YandexStation";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ferrine ];
+  };
+}
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index f1f96a2d0b4b..54e0c8624d94 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -36,14 +36,15 @@ stdenv.mkDerivation rec {
     pname = "${pname}-modules";
     inherit src version;
 
-    yarnOfflineCache = callPackage ./yarn.nix {
-      inherit version src;
+    yarnOfflineCache = yarn-berry.fetchYarnBerryDeps {
+      inherit src;
       hash = yarnHash;
     };
 
     nativeBuildInputs = [
       nodejs-slim
       yarn-berry
+      yarn-berry.yarnBerryConfigHook
       mastodonGems
       mastodonGems.wrappedRuby
       brotli
@@ -56,38 +57,28 @@ stdenv.mkDerivation rec {
     buildPhase = ''
       runHook preBuild
 
-      export HOME=$PWD
-      export YARN_ENABLE_TELEMETRY=0
-      export npm_config_nodedir=${nodejs-slim}
       export SECRET_KEY_BASE_DUMMY=1
 
-      mkdir -p ~/.yarn/berry
-      ln -s $yarnOfflineCache ~/.yarn/berry/cache
-
-      yarn install --immutable --immutable-cache
-
-      patchShebangs ~/bin
-      patchShebangs ~/node_modules
+      patchShebangs bin
 
       bundle exec rails assets:precompile
 
-      yarn cache clean --all
-      rm -rf ~/node_modules/.cache
+      rm -rf node_modules/.cache
 
       # Remove workspace "package" as it contains broken symlinks
       # See https://github.com/NixOS/nixpkgs/issues/380366
-      rm -rf ~/node_modules/@mastodon
+      rm -rf node_modules/@mastodon
 
       # Remove execute permissions
-      find ~/public/assets -type f ! -perm 0555 \
+      find public/assets -type f ! -perm 0555 \
         -exec chmod 0444 {} ';'
 
       # Create missing static gzip and brotli files
-      find ~/public/assets -type f -regextype posix-extended -iregex '.*\.(css|html|js|json|svg)' \
+      find public/assets -type f -regextype posix-extended -iregex '.*\.(css|html|js|json|svg)' \
         -exec gzip --best --keep --force {} ';' \
         -exec brotli --best --keep {} ';'
-      gzip --best --keep ~/public/packs/report.html
-      brotli --best --keep ~/public/packs/report.html
+      gzip --best --keep public/packs/report.html
+      brotli --best --keep public/packs/report.html
 
       runHook postBuild
     '';
diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix
index 58563cc2a07a..15a415f21ba3 100644
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@@ -18,5 +18,5 @@ in
 })
 // {
   inherit version;
-  yarnHash = "sha256-e5c04M6XplAgaVyldU5HmYMYtY3MAWs+a8Z/BGSyGBg=";
+  yarnHash = "sha256-IC4d/skIHEzJPuKlq4rMAqV+ydqquA6toq4WWCfuDxo=";
 }
diff --git a/pkgs/servers/mastodon/update.sh b/pkgs/servers/mastodon/update.sh
index b9e3c6453f6d..330e53676b7a 100755
--- a/pkgs/servers/mastodon/update.sh
+++ b/pkgs/servers/mastodon/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p bundix coreutils diffutils nix-prefetch-github gnused jq prefetch-yarn-deps
+#! nix-shell -i bash -p bundix coreutils diffutils nix-prefetch-github gnused jq yarn-berry_4.yarn-berry-fetcher
 set -e
 
 OWNER=mastodon
@@ -110,5 +110,6 @@ echo "Creating gemset.nix"
 bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile"
 echo "" >> gemset.nix  # Create trailing newline to please EditorConfig checks
 
-echo "Required manual update of yarn-hash"
-exit 1
+echo "Updating yarnHash"
+YARN_HASH="$(yarn-berry-fetcher prefetch "$SOURCE_DIR/yarn.lock" 2>/dev/null)"
+sed -i "s;sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=;$YARN_HASH;g" source.nix
diff --git a/pkgs/servers/mastodon/yarn.nix b/pkgs/servers/mastodon/yarn.nix
deleted file mode 100644
index e38eb739737f..000000000000
--- a/pkgs/servers/mastodon/yarn.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  stdenvNoCC,
-  yarn-berry,
-  cacert,
-  version,
-  src,
-  hash,
-}:
-stdenvNoCC.mkDerivation {
-  pname = "yarn-deps";
-  inherit version src;
-
-  nativeBuildInputs = [
-    yarn-berry
-  ];
-
-  dontInstall = true;
-
-  NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
-  buildPhase = ''
-    export HOME=$(mktemp -d)
-    export YARN_ENABLE_TELEMETRY=0
-
-    yarn config set --json supportedArchitectures.os '[ "linux" ]'
-    yarn config set --json supportedArchitectures.cpu '[ "arm64", "x64", "ia32" ]'
-
-    cache="$(yarn config get cacheFolder)"
-    yarn install --immutable --mode skip-build
-
-    mkdir -p $out
-    cp -r $cache/* $out/
-  '';
-
-  outputHash = hash;
-  outputHashMode = "recursive";
-}
diff --git a/pkgs/tools/compression/bzip3/default.nix b/pkgs/tools/compression/bzip3/default.nix
index 8c00769c1f76..de47bfbf4461 100644
--- a/pkgs/tools/compression/bzip3/default.nix
+++ b/pkgs/tools/compression/bzip3/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bzip3";
-  version = "1.5.1";
+  version = "1.5.2";
 
   outputs = [
     "bin"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "kspalaiologos";
     repo = "bzip3";
     rev = finalAttrs.version;
-    hash = "sha256-QMvK0MP0Zx2mQfvYvrOjGV1Lo/ObO5diXcibmwtQATk=";
+    hash = "sha256-mu95ZYkD0isDuHdHcU4zhWxCTlaYXoM85j76IGwVAak=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/octodns/default.nix b/pkgs/tools/networking/octodns/default.nix
index 935b9e884057..e511070a4b79 100644
--- a/pkgs/tools/networking/octodns/default.nix
+++ b/pkgs/tools/networking/octodns/default.nix
@@ -8,7 +8,7 @@
   natsort,
   pytestCheckHook,
   python-dateutil,
-  python3,
+  python,
   pythonOlder,
   pyyaml,
   runCommand,
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   passthru.withProviders =
     ps:
     let
-      pyEnv = python3.withPackages ps;
+      pyEnv = python.withPackages ps;
     in
     runCommand "octodns-with-providers" { } ''
       mkdir -p $out/bin
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 18f9e0b8f132..53894d2bbaa7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11070,7 +11070,7 @@ with pkgs;
     nodejs-slim = nodejs-slim_22;
     python3 = python311;
     ruby = ruby_3_3;
-    yarn-berry = yarn-berry.override { nodejs = nodejs-slim_22; };
+    yarn-berry = yarn-berry_4.override { nodejs = nodejs-slim_22; };
   };
 
   micro-full = micro.wrapper.override {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bdc1abd3e0cc..021955fc8721 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4889,6 +4889,8 @@ self: super: with self; {
 
   findpython = callPackage ../development/python-modules/findpython { };
 
+  findspark = callPackage ../development/python-modules/findspark { };
+
   finetuning-scheduler = callPackage ../development/python-modules/finetuning-scheduler { };
 
   fingerprints = callPackage ../development/python-modules/fingerprints { };
@@ -10256,6 +10258,8 @@ self: super: with self; {
     openbabel = callPackage ../development/libraries/openbabel { inherit (self) python; };
   };
 
+  opencamlib = callPackage ../development/python-modules/opencamlib { };
+
   opencensus = callPackage ../development/python-modules/opencensus { };
 
   opencensus-context = callPackage ../development/python-modules/opencensus-context { };
@@ -16391,6 +16395,10 @@ self: super: with self; {
 
   spsdk = callPackage ../development/python-modules/spsdk { };
 
+  spsdk-mcu-link = callPackage ../development/python-modules/spsdk-mcu-link { };
+
+  spsdk-pyocd = callPackage ../development/python-modules/spsdk-pyocd { };
+
   spur = callPackage ../development/python-modules/spur { };
 
   spyder = callPackage ../development/python-modules/spyder { };
@@ -16439,6 +16447,8 @@ self: super: with self; {
 
   sqlfmt = callPackage ../development/python-modules/sqlfmt { };
 
+  sqlframe = callPackage ../development/python-modules/sqlframe { };
+
   sqlglot = callPackage ../development/python-modules/sqlglot { };
 
   sqlite-anyio = callPackage ../development/python-modules/sqlite-anyio { };
@@ -16844,6 +16854,8 @@ self: super: with self; {
 
   sysv-ipc = callPackage ../development/python-modules/sysv-ipc { };
 
+  t61codec = callPackage ../development/python-modules/t61codec { };
+
   tabcmd = callPackage ../development/python-modules/tabcmd { };
 
   tableaudocumentapi = callPackage ../development/python-modules/tableaudocumentapi { };
@@ -18970,6 +18982,8 @@ self: super: with self; {
 
   x256 = callPackage ../development/python-modules/x256 { };
 
+  x690 = callPackage ../development/python-modules/x690 { };
+
   xapian = callPackage ../development/python-modules/xapian { inherit (pkgs) xapian; };
 
   xarray = callPackage ../development/python-modules/xarray { };