diff --git a/ci/OWNERS b/ci/OWNERS
index 9265ae8bc83df..596cf711567db 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -198,8 +198,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 
 # Browsers
 /pkgs/applications/networking/browsers/firefox @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange
-/nixos/tests/chromium.nix @emilylange
+/pkgs/applications/networking/browsers/chromium @emilylange @networkException
+/nixos/tests/chromium.nix @emilylange @networkException
 
 # Certificate Authorities
 pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 43145bcdeb1ab..e2e182af8dda6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23252,6 +23252,13 @@
     name = "Vinicius Bernardino";
     keys = [ { fingerprint = "F0D3 920C 722A 541F 0CCD  66E3 A7BA BA05 3D78 E7CA"; } ];
   };
+  vog = {
+    email = "v@njh.eu";
+    github = "vog";
+    githubId = 412749;
+    name = "Volker Diels-Grabsch";
+    keys = [ { fingerprint = "A7E6 9C4F 69DC 5D6C FC84  EE34 A29F BD51 5F89 90AF"; } ];
+  };
   voidless = {
     email = "julius.schmitt@yahoo.de";
     github = "voidIess";
diff --git a/nixos/modules/services/continuous-integration/github-runners.nix b/nixos/modules/services/continuous-integration/github-runners.nix
index 4a4608c2e4f89..3a4a13d92b56f 100644
--- a/nixos/modules/services/continuous-integration/github-runners.nix
+++ b/nixos/modules/services/continuous-integration/github-runners.nix
@@ -6,5 +6,5 @@
     ./github-runner/service.nix
   ];
 
-  meta.maintainers = with lib.maintainers; [ veehaitch newam ];
+  meta.maintainers = with lib.maintainers; [ veehaitch ];
 }
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 09f271999fc4a..82ece277f1875 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -300,7 +300,7 @@ in {
 
               capabilities = mkOption {
                 type = types.listOf types.str;
-                default = ["HT40" "HT40-" "SHORT-GI-20" "SHORT-GI-40"];
+                default = ["HT40" "SHORT-GI-20" "SHORT-GI-40"];
                 example = ["LDPC" "HT40+" "HT40-" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1"];
                 description = ''
                   HT (High Throughput) capabilities given as a list of flags.
diff --git a/pkgs/applications/audio/famistudio/build-native-wrapper.nix b/pkgs/applications/audio/famistudio/build-native-wrapper.nix
deleted file mode 100644
index ddee5bf5712dc..0000000000000
--- a/pkgs/applications/audio/famistudio/build-native-wrapper.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ depname
-, version
-, src
-, sourceRoot
-, stdenv
-, lib
-, patches ? []
-, extraPostPatch ? ""
-, buildInputs ? []
-}:
-
-let
-  rebuildscriptName = if stdenv.hostPlatform.isLinux then
-    "build_linux"
-  else if stdenv.hostPlatform.isDarwin then
-    "build_macos"
-  else throw "Don't know how to rebuild FamiStudio's vendored ${depname} for ${stdenv.hostPlatform.system}";
-in
-stdenv.mkDerivation {
-  pname = "famistudio-nativedep-${depname}";
-  inherit version src sourceRoot patches buildInputs;
-
-  postPatch = let
-    libnameBase = lib.optionalString stdenv.hostPlatform.isLinux "lib" + depname;
-  in ''
-    # Use one name for build script, eases with patching
-    mv ${rebuildscriptName}.sh build.sh
-
-    # Scripts use hardcoded compilers and try to copy built libraries into FamiStudio's build tree
-    # Not all scripts use the same compiler, so don't fail on replacing that
-    substituteInPlace build.sh \
-      --replace-fail '../../FamiStudio/' "$out/lib/" \
-      --replace-quiet 'g++' "$CXX"
-
-    # Replacing gcc via sed, would break -static-libgcc otherwise
-    sed -i -e "s/^gcc/$CC/g" build.sh
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Darwin rebuild scripts try to make a universal2 dylib
-    # - build dylib for non-hostPlatform
-    # - copy built library into special directory for later packaging script
-    # - join two dylibs together into a universal2 dylib
-    # Remove everything we don't need
-    sed -ri \
-      -e '/-target ${if stdenv.hostPlatform.isx86_64 then "arm64" else "x86_64"}/d' \
-      -e '/..\/..\/Setup/d' \
-      build.sh
-
-    # Replace joining multi-arch dylibs with copying dylib for target arch
-    substituteInPlace build.sh \
-      --replace-fail 'lipo -create -output ${libnameBase}.dylib' 'cp ${libnameBase}_${if stdenv.hostPlatform.isx86_64 then "x86_64" else "arm64"}.dylib ${libnameBase}.dylib #'
-  '' + extraPostPatch;
-
-  dontConfigure = true;
-  dontInstall = true; # rebuild script automatically installs
-
-  buildPhase = ''
-    runHook preBuild
-
-    mkdir -p $out/lib
-
-    # Delete all prebuilt libraries, make sure everything is rebuilt
-    find . -name '*.so' -or -name '*.dylib' -or -name '*.a' -delete
-
-    # When calling normally, an error won't cause derivation to fail
-    source ./build.sh
-
-    runHook postBuild
-  '';
-}
diff --git a/pkgs/applications/audio/famistudio/default.nix b/pkgs/applications/audio/famistudio/default.nix
deleted file mode 100644
index 4e13d1aa0a5fa..0000000000000
--- a/pkgs/applications/audio/famistudio/default.nix
+++ /dev/null
@@ -1,125 +0,0 @@
-{ stdenv
-, lib
-, buildDotnetModule
-, dotnetCorePackages
-, callPackage
-, fetchFromGitHub
-, ffmpeg
-, glfw
-, libglvnd
-, libogg
-, libvorbis
-, openal
-, portaudio
-, rtmidi
-}:
-
-let
-  csprojName = if stdenv.hostPlatform.isLinux then
-    "FamiStudio.Linux"
-  else if stdenv.hostPlatform.isDarwin then
-    "FamiStudio.Mac"
-  else throw "Don't know how to build FamiStudio for ${stdenv.hostPlatform.system}";
-in
-buildDotnetModule rec {
-  pname = "famistudio";
-  version = "4.2.1";
-
-  src = fetchFromGitHub {
-    owner = "BleuBleu";
-    repo = "FamiStudio";
-    rev = "refs/tags/${version}";
-    hash = "sha256-WYy/6cWQg3Ayok/eAdnvlWAvdcuhy/sdlWOVvaYcPkc=";
-  };
-
-  postPatch = let
-    libname = library: "${library}${stdenv.hostPlatform.extensions.sharedLibrary}";
-    buildNativeWrapper = args: callPackage ./build-native-wrapper.nix (args // {
-      inherit version src;
-      sourceRoot = "${src.name}/ThirdParty/${args.depname}";
-    });
-    nativeWrapperToReplaceFormat = args: let
-      libPrefix = lib.optionalString stdenv.hostPlatform.isLinux "lib";
-    in {
-      package = buildNativeWrapper args;
-      expectedName = "${libPrefix}${args.depname}";
-      ourName = "${libPrefix}${args.depname}";
-    };
-    librariesToReplace = [
-      # Unmodified native libraries that we can fully substitute
-      { package = glfw; expectedName = "libglfw"; ourName = "libglfw"; }
-      { package = rtmidi; expectedName = "librtmidi"; ourName = "librtmidi"; }
-    ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-      { package = openal; expectedName = "libopenal32"; ourName = "libopenal"; }
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      { package = portaudio; expectedName = "libportaudio.2"; ourName = "libportaudio.2"; }
-    ] ++ [
-      # Native libraries, with extra code for the C# wrapping
-      (nativeWrapperToReplaceFormat { depname = "GifDec"; })
-      (nativeWrapperToReplaceFormat { depname = "NesSndEmu"; })
-      (nativeWrapperToReplaceFormat { depname = "NotSoFatso"; extraPostPatch = ''
-        # C++17 does not allow register storage class specifier
-        substituteInPlace build.sh \
-          --replace-fail "$CXX" "$CXX -std=c++14"
-      ''; })
-      (nativeWrapperToReplaceFormat { depname = "ShineMp3"; })
-      (nativeWrapperToReplaceFormat { depname = "Stb"; })
-      (nativeWrapperToReplaceFormat { depname = "Vorbis"; buildInputs = [ libogg libvorbis ]; })
-    ];
-    libraryReplaceArgs = lib.strings.concatMapStringsSep " "
-      (library: "--replace-fail '${libname library.expectedName}' '${lib.getLib library.package}/lib/${libname library.ourName}'")
-      librariesToReplace;
-  in ''
-    # Don't use any prebuilt libraries
-    rm FamiStudio/*.{dll,dylib,so*}
-
-    # Replace copying of vendored prebuilt native libraries with copying of our native libraries
-    substituteInPlace ${projectFile} ${libraryReplaceArgs}
-
-    # Un-hardcode target platform if set
-    sed -i -e '/PlatformTarget/d' ${projectFile}
-
-    # Don't require a special name to be preserved, our OpenAL isn't 32-bit
-    substituteInPlace FamiStudio/Source/AudioStreams/OpenALStream.cs \
-      --replace-fail 'libopenal32' 'libopenal'
-  '';
-
-  projectFile = "FamiStudio/${csprojName}.csproj";
-  nugetDeps = ./deps.nix;
-  dotnet-sdk = dotnetCorePackages.sdk_7_0;
-  dotnet-runtime = dotnetCorePackages.runtime_7_0;
-
-  runtimeDeps = lib.optionals stdenv.hostPlatform.isLinux [
-    libglvnd
-  ];
-
-  executables = [ "FamiStudio" ];
-
-  postInstall = ''
-    mkdir -p $out/share/famistudio
-    for datdir in Setup/Demo\ {Instruments,Songs}; do
-      cp -R "$datdir" $out/share/famistudio/
-    done
-  '';
-
-  postFixup = ''
-    # FFMpeg looked up from PATH
-    wrapProgram $out/bin/FamiStudio \
-      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    homepage = "https://famistudio.org/";
-    description = "NES Music Editor";
-    longDescription = ''
-      FamiStudio is very simple music editor for the Nintendo Entertainment System
-      or Famicom. It is targeted at both chiptune artists and NES homebrewers.
-    '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.unix;
-    mainProgram = "FamiStudio";
-  };
-}
diff --git a/pkgs/applications/backup/timeshift/default.nix b/pkgs/applications/backup/timeshift/default.nix
index 85a3295fb064f..9c6de88703b32 100644
--- a/pkgs/applications/backup/timeshift/default.nix
+++ b/pkgs/applications/backup/timeshift/default.nix
@@ -1,32 +1,36 @@
-{ callPackage
-, timeshift-unwrapped
-, rsync
-, coreutils
-, mount
-, umount
-, psmisc
-, cron
-, btrfs-progs
-, grubPackage
+{
+  callPackage,
+  btrfs-progs,
+  coreutils,
+  cron,
+  grubPackage,
+  mount,
+  psmisc,
+  rsync,
+  timeshift-unwrapped,
+  umount,
 }:
 let
   timeshift-wrapper = callPackage ./wrapper.nix { };
 in
-(timeshift-wrapper timeshift-unwrapped ([
-  rsync
+(timeshift-wrapper timeshift-unwrapped [
+  btrfs-progs
   coreutils
-  mount
-  umount
-  psmisc
   cron
-  btrfs-progs
   grubPackage
-])).overrideAttrs (oldAttrs: {
-  meta = oldAttrs.meta // {
-    description = oldAttrs.meta.description;
-    longDescription = oldAttrs.meta.longDescription + ''
-      This package comes with runtime dependencies of command utilities provided by rsync, coreutils, mount, umount, psmisc, cron and (optionally) btrfs.
-      If you want to use the commands provided by the system, override the propagatedBuildInputs or use timeshift-minimal instead
-    '';
-  };
-})
+  mount
+  psmisc
+  rsync
+  umount
+]).overrideAttrs
+  (oldAttrs: {
+    meta = oldAttrs.meta // {
+      description = oldAttrs.meta.description;
+      longDescription =
+        oldAttrs.meta.longDescription
+        + ''
+          This package comes with runtime dependencies of command utilities provided by rsync, coreutils, mount, umount, psmisc, cron and btrfs.
+          If you want to use the commands provided by the system, use timeshift-minimal instead.
+        '';
+    };
+  })
diff --git a/pkgs/applications/backup/timeshift/minimal.nix b/pkgs/applications/backup/timeshift/minimal.nix
index 96946fa72e053..113200c30e73d 100644
--- a/pkgs/applications/backup/timeshift/minimal.nix
+++ b/pkgs/applications/backup/timeshift/minimal.nix
@@ -1,5 +1,6 @@
-{ callPackage
-, timeshift-unwrapped
+{
+  callPackage,
+  timeshift-unwrapped,
 }:
 let
   timeshift-wrapper = callPackage ./wrapper.nix { };
@@ -7,9 +8,11 @@ in
 (timeshift-wrapper timeshift-unwrapped [ ]).overrideAttrs (oldAttrs: {
   meta = oldAttrs.meta // {
     description = oldAttrs.meta.description + " (without runtime dependencies)";
-    longDescription = oldAttrs.meta.longDescription + ''
-      This package is a wrapped version of timeshift-unwrapped
-      without runtime dependencies of command utilities.
-    '';
+    longDescription =
+      oldAttrs.meta.longDescription
+      + ''
+        This package is a wrapped version of timeshift-unwrapped
+        without runtime dependencies of command utilities.
+      '';
   };
 })
diff --git a/pkgs/applications/backup/timeshift/unwrapped.nix b/pkgs/applications/backup/timeshift/unwrapped.nix
index 534145c19cbe5..3fbaed4b21be9 100644
--- a/pkgs/applications/backup/timeshift/unwrapped.nix
+++ b/pkgs/applications/backup/timeshift/unwrapped.nix
@@ -1,29 +1,30 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, gettext
-, help2man
-, meson
-, ninja
-, pkg-config
-, vala
-, gtk3
-, json-glib
-, libgee
-, util-linux
-, vte
-, xapp
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gettext,
+  help2man,
+  meson,
+  ninja,
+  pkg-config,
+  vala,
+  gtk3,
+  json-glib,
+  libgee,
+  util-linux,
+  vte,
+  xapp,
 }:
 
 stdenv.mkDerivation rec {
   pname = "timeshift";
-  version = "24.06.3";
+  version = "24.06.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "timeshift";
     rev = version;
-    hash = "sha256-npYiUSAPzr6g29ilQ1JELxqR1VbOR7TNMkdx37n92kk=";
+    hash = "sha256-2qNLgUZLMcfoemdLvvjdkR7Ln5loSKGqbd402y5Id8k=";
   };
 
   patches = [
@@ -65,6 +66,9 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/linuxmint/timeshift";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ShamrockLee bobby285271 ];
+    maintainers = with maintainers; [
+      ShamrockLee
+      bobby285271
+    ];
   };
 }
diff --git a/pkgs/applications/backup/timeshift/wrapper.nix b/pkgs/applications/backup/timeshift/wrapper.nix
index 84b3f14ac2ffa..5bbfffb94d467 100644
--- a/pkgs/applications/backup/timeshift/wrapper.nix
+++ b/pkgs/applications/backup/timeshift/wrapper.nix
@@ -1,22 +1,22 @@
-{ stdenvNoCC
-, lib
-, wrapGAppsHook3
-, gdk-pixbuf
-, librsvg
-, xorg
-, shared-mime-info
+{
+  stdenvNoCC,
+  lib,
+  wrapGAppsHook3,
+  gdk-pixbuf,
+  librsvg,
+  xorg,
+  shared-mime-info,
 }:
 
-timeshift-unwrapped:
-runtimeDeps:
+timeshift-unwrapped: runtimeDeps:
 stdenvNoCC.mkDerivation {
   inherit (timeshift-unwrapped) pname version;
 
   dontUnpack = true;
 
   nativeBuildInputs = [
-    xorg.lndir
     wrapGAppsHook3
+    xorg.lndir
   ];
 
   installPhase = ''
@@ -34,7 +34,13 @@ stdenvNoCC.mkDerivation {
     )
     gappsWrapperArgs+=(
       # Thumbnailers
-      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ gdk-pixbuf librsvg shared-mime-info ]}"
+      --prefix XDG_DATA_DIRS : "${
+        lib.makeSearchPath "share" [
+          gdk-pixbuf
+          librsvg
+          shared-mime-info
+        ]
+      }"
       "''${makeWrapperArgs[@]}"
     )
     wrapProgram "$out/bin/timeshift" "''${makeWrapperArgs[@]}"
diff --git a/pkgs/applications/emulators/wine/winetricks.nix b/pkgs/applications/emulators/wine/winetricks.nix
index 6d3ac4f662963..b809a85a079b6 100644
--- a/pkgs/applications/emulators/wine/winetricks.nix
+++ b/pkgs/applications/emulators/wine/winetricks.nix
@@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
     mainProgram = "winetricks";
     license = lib.licenses.lgpl21;
     homepage = "https://github.com/Winetricks/winetricks";
-    platforms = with lib.platforms; linux;
+    platforms = with lib.platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index d4259c2895ad2..bdedac20c5ebd 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -84,6 +84,8 @@ mkChromiumDerivation (base: rec {
     homepage = if ungoogled
       then "https://github.com/ungoogled-software/ungoogled-chromium"
       else "https://www.chromium.org/";
+    # Maintainer pings for this derivation are highly unreliable.
+    # If you add yourself as maintainer here, please also add yourself as CODEOWNER.
     maintainers = with lib.maintainers; if ungoogled
       then [ networkexception emilylange ]
       else [ networkexception emilylange ];
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 4a16de319a1e3..c0a661a860389 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -663,12 +663,7 @@ let
     } // lib.optionalAttrs (!isElectron) {
       inherit chromiumDeps npmDeps;
     };
-  }
-  # overwrite `version` with the exact same `version` from the same source,
-  # except it internally points to `upstream-info.nix` for
-  # `builtins.unsafeGetAttrPos`, which is used by ofborg to decide
-  # which maintainers need to be pinged.
-  // builtins.removeAttrs upstream-info (builtins.filter (e: e != "version") (builtins.attrNames upstream-info));
+  };
 
 # Remove some extraAttrs we supplied to the base attributes already.
 in stdenv.mkDerivation (base // removeAttrs extraAttrs [
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index ecce9b395a75d..73ce63d6f8bc9 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -178,9 +178,3 @@ in stdenv.mkDerivation {
     inherit sandboxExecutableName;
   };
 }
-# the following is a complicated and long-winded variant of
-# `inherit (chromium.browser) version`, with the added benefit
-# that it keeps the pointer to upstream-info.nix for
-# builtins.unsafeGetAttrPos, which is what ofborg uses to
-# decide which maintainers need to be pinged.
-// builtins.removeAttrs chromium.browser (builtins.filter (e: e != "version") (builtins.attrNames chromium.browser))
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index 4fa6b759929d9..07b2b80494319 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.4.1";
+  version = "33.5.0";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -158,11 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
     in {
       gtk3 = fetchzip {
         urls = urlRegionVariants "gtk3";
-        hash = "sha256-pjOzU8atFNzYujxxoVihn0Cvq4Xvh7U2auSznE29Wpc=";
+        hash = "sha256-TlmDsZKHolTS+y+1BymyY49+AvqUv8zmUXCGNHCRPL0=";
       };
       gtk2 = fetchzip {
         urls = urlRegionVariants "gtk2";
-        hash = "sha256-ikgO0vVTySw3I6gdSu5k2e35xZ95bJY4f18Fjh+c0rA=";
+        hash = "sha256-f6vLHbpmvVfkjZr7x0DiCFoGGvfxHfFZ3KTagq2Mwp4=";
       };
     };
 
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index ccdef5cb3df92..74d2d776643c2 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.54.1";
+  version = "3.54.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-oeM9aED4GLdLv+iafb2jcpXdgUWn30JlrS2yQUU4kDo=";
+    hash = "sha256-77UZ2inoIX58t3dNQ9BGJiSMO+WKGUbIpjwyDl2IPNQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 7b948ccdddf0c..b8d1c3740e443 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.54.1";
+  version = "3.54.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-qEQzdJd6AcY70Dr9tcY+c6SOZ0XX1Fm08mgj3Vz5lxs=";
+    hash = "sha256-7eopEv/bZZnA6gKJw6muIBe/43oI14IjWEUhqlaGtXY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/machine-learning/shogun/default.nix b/pkgs/applications/science/machine-learning/shogun/default.nix
index 75bd2278d6069..550b3296dc001 100644
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@@ -62,6 +62,7 @@ let
       url = "https://github.com/Reactive-Extensions/RxCpp/archive/v${rxcppVersion}.tar.gz";
       sha256 = "sha256-UOc5WrG8KgAA3xJsaSCjbdPE7gSnFJay9MEK31DWUXg=";
     };
+
     gtest = fetchurl {
       url = "https://github.com/google/googletest/archive/release-${gtestVersion}.tar.gz";
       sha256 = "sha256-WKb0J3yivIVlIis7vVihd2CenEiOinJkk1m6UUUNt9g=";
@@ -69,7 +70,7 @@ let
   };
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
   outputs = [ "out" "dev" "doc" ];
@@ -132,32 +133,39 @@ stdenv.mkDerivation rec {
     ++ lib.optional opencvSupport opencv;
 
   cmakeFlags = let
-    enableIf = cond: if cond then "ON" else "OFF";
     excludeTestsRegex = lib.concatStringsSep "|" [
-      # sporadic segfault
+      # segfault
+      "SerializationXML"
       "TrainedModelSerialization"
       # broken by openblas 0.3.21
       "mathematics_lapack"
+      # fails on aarch64
+      "LinearTimeMMD"
+      "QuadraticTimeMMD"
+      "SGVectorTest"
+      "Statistics"
+      # hangs on aarch64
+      "PRange"
       # these take too long on CI
       "evaluation_cross_validation"
       "modelselection_combined_kernel"
       "modelselection_grid_search"
     ];
   in [
-    "-DBUILD_META_EXAMPLES=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPACK=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPREC=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_CPLEX=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_Mosek=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_TFLogger=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ViennaCL=ON"
-    "-DCMAKE_CTEST_ARGUMENTS=--exclude-regex;'${excludeTestsRegex}'"
-    "-DENABLE_TESTING=${enableIf doCheck}"
-    "-DDISABLE_META_INTEGRATION_TESTS=ON"
-    "-DTRAVIS_DISABLE_META_CPP=ON"
-    "-DINTERFACE_PYTHON=${enableIf pythonSupport}"
-    "-DOpenCV=${enableIf opencvSupport}"
-    "-DUSE_SVMLIGHT=${enableIf withSvmLight}"
+    (lib.cmakeBool "BUILD_META_EXAMPLES" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ARPACK" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ARPREC" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_CPLEX" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_Mosek" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_TFLogger" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ViennaCL" true)
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'")
+    (lib.cmakeBool "ENABLE_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "DISABLE_META_INTEGRATION_TESTS" true)
+    (lib.cmakeBool "TRAVIS_DISABLE_META_CPP" true)
+    (lib.cmakeBool "INTERFACE_PYTHON" pythonSupport)
+    (lib.cmakeBool "OpenCV" opencvSupport)
+    (lib.cmakeBool "USE_SVMLIGHT" withSvmLight)
   ];
 
   CXXFLAGS = "-faligned-new";
@@ -196,7 +204,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     # CMake incorrectly calculates library path from dev prefix
     substituteInPlace $dev/lib/cmake/shogun/ShogunTargets-release.cmake \
-      --replace "\''${_IMPORT_PREFIX}/lib/" "$out/lib/"
+      --replace-fail "\''${_IMPORT_PREFIX}/lib/" "$out/lib/"
   '';
 
   meta = with lib; {
@@ -205,4 +213,4 @@ stdenv.mkDerivation rec {
     license = if withSvmLight then licenses.unfree else licenses.gpl3Plus;
     maintainers = with maintainers; [ edwtjo smancill ];
   };
-}
+})
diff --git a/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix b/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix
index 2177000c3627e..f6a832386b9fe 100644
--- a/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix
@@ -1,53 +1,79 @@
-{ buildDotnetModule, emptyDirectory, fetchNupkg, dotnet-sdk }:
-
-{ pname
-, version
-  # Name of the nuget package to install, if different from pname
-, nugetName ? pname
-  # Hash of the nuget package to install, will be given on first build
-  # nugetHash uses SRI hash and should be preferred
-, nugetHash ? ""
-, nugetSha256 ? ""
-  # Additional nuget deps needed by the tool package
-, nugetDeps ? (_: [])
-  # Executables to wrap into `$out/bin`, same as in `buildDotnetModule`, but with
-  # a default of `pname` instead of null, to avoid auto-wrapping everything
-, executables ? pname
-  # The dotnet runtime to use, dotnet tools need a full SDK to function
-, dotnet-runtime ? dotnet-sdk
-, ...
-} @ args:
-
-buildDotnetModule (args // {
-  inherit pname version dotnet-runtime executables;
-
-  src = emptyDirectory;
-
-  buildInputs = [
-    (fetchNupkg {
-      pname = nugetName;
-      inherit version;
-      sha256 = nugetSha256;
-      hash = nugetHash;
-      installable = true;
-    })
-  ];
-
-  dotnetGlobalTool = true;
-
-  useDotnetFromEnv = true;
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    dotnet tool install --tool-path $out/lib/${pname} ${nugetName}
-
-    # remove files that contain nix store paths to temp nuget sources we made
-    find $out -name 'project.assets.json' -delete
-    find $out -name '.nupkg.metadata' -delete
-
-    runHook postInstall
-  '';
-})
+{
+  buildDotnetModule,
+  emptyDirectory,
+  fetchNupkg,
+  dotnet-sdk,
+  lib,
+}:
+
+fnOrAttrs:
+
+buildDotnetModule (
+  finalAttrs:
+  (
+    {
+      pname,
+      version,
+      # Name of the nuget package to install, if different from pname
+      nugetName ? pname,
+      # Hash of the nuget package to install, will be given on first build
+      # nugetHash uses SRI hash and should be preferred
+      nugetHash ? "",
+      nugetSha256 ? "",
+      # Additional nuget deps needed by the tool package
+      nugetDeps ? (_: [ ]),
+      # Executables to wrap into `$out/bin`, same as in `buildDotnetModule`, but with
+      # a default of `pname` instead of null, to avoid auto-wrapping everything
+      executables ? pname,
+      # The dotnet runtime to use, dotnet tools need a full SDK to function
+      dotnet-runtime ? dotnet-sdk,
+      ...
+    }@args:
+    let
+      nupkg = fetchNupkg {
+        pname = nugetName;
+        inherit version;
+        sha256 = nugetSha256;
+        hash = nugetHash;
+        installable = true;
+      };
+    in
+    args
+    // {
+      inherit
+        pname
+        version
+        dotnet-runtime
+        executables
+        ;
+
+      src = emptyDirectory;
+
+      buildInputs = [ nupkg ];
+
+      dotnetGlobalTool = true;
+
+      useDotnetFromEnv = true;
+
+      dontBuild = true;
+
+      installPhase = ''
+        runHook preInstall
+
+        dotnet tool install --tool-path $out/lib/${pname} ${nugetName}
+
+        # remove files that contain nix store paths to temp nuget sources we made
+        find $out -name 'project.assets.json' -delete
+        find $out -name '.nupkg.metadata' -delete
+
+        runHook postInstall
+      '';
+
+      passthru = {
+        updateScript = ./update.sh;
+        nupkg = nupkg;
+      } // args.passthru or {};
+    }
+  )
+    (if lib.isFunction fnOrAttrs then fnOrAttrs finalAttrs else fnOrAttrs)
+)
diff --git a/pkgs/build-support/dotnet/build-dotnet-global-tool/update.sh b/pkgs/build-support/dotnet/build-dotnet-global-tool/update.sh
new file mode 100755
index 0000000000000..e00fae9ace36f
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-global-tool/update.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix common-updater-scripts
+# shellcheck shell=bash
+
+set -euo pipefail
+
+attr=$UPDATE_NIX_ATTR_PATH
+
+nixeval() {
+    nix --extra-experimental-features nix-command eval --json --impure -f . "$1" | jq -r .
+}
+
+nugetName=$(nixeval "$attr.nupkg.pname")
+
+# always skip prerelease versions for now
+version=$(curl -fsSL "https://api.nuget.org/v3-flatcontainer/$nugetName/index.json" |
+    jq -er '.versions | last(.[] | select(match("^[0-9]+\\.[0-9]+\\.[0-9]+$")))')
+
+if [[ $version == $(nixeval "$attr.version") ]]; then
+    echo "$attr" is already version "$version"
+    exit 0
+fi
+
+update-source-version "$attr" "$version" --source-key=nupkg.src
diff --git a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
index d7cab0e81a609..4fbef4baa512a 100644
--- a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
+++ b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
@@ -92,6 +92,7 @@ convertIconTheme() {
 
         echo "desktopToDarwinBundle: resizing icon $in to $out, size $dim" >&2
         magick convert -scale "${dim}x${dim}" -density "$density" -units PixelsPerInch "$in" "$out"
+        convertIfUnsupportedIcon "$out" "$iconSize" "$scale"
     }
 
     function synthesizeIcon() {
@@ -107,11 +108,27 @@ convertIconTheme() {
             echo "desktopToDarwinBundle: rasterizing svg $in to $out, size $dim" >&2
             rsvg-convert --keep-aspect-ratio --width "$dim" --height "$dim" "$in" --output "$out"
             magick convert -density "$density" -units PixelsPerInch "$out" "$out"
+            convertIfUnsupportedIcon "$out" "$iconSize" "$scale"
         else
             return 1
         fi
     }
 
+    # macOS does not correctly display 16x and 32x png icons on app bundles
+    # they need to be converted to rgb+mask (argb is supported only from macOS 11)
+    function convertIfUnsupportedIcon() {
+        local -r in=$1
+        local -r iconSize=$2
+        local -r scale=$3
+        local -r out=${in%.png}.rgb
+
+        if [[ ($scale -eq 1) && ($iconSize -eq 32 || $iconSize -eq 16) ]]; then
+            echo "desktopToDarwinBundle: converting ${iconSize}x icon to rgb" >&2
+            icnsutil convert "$out" "$in"
+            rm "$in"
+        fi
+    }
+
     function getIcons() {
         local -r sharePath=$1
         local -r iconname=$2
@@ -151,6 +168,7 @@ convertIconTheme() {
                     fixed)
                         local density=$((72 * scale))x$((72 * scale))
                         magick convert -density "$density" -units PixelsPerInch "$icon" "$result"
+                        convertIfUnsupportedIcon "$result" "$iconSize" "$scale"
                         foundIcon=OTHER
                         ;;
                     threshold)
diff --git a/pkgs/by-name/am/amdvlk/package.nix b/pkgs/by-name/am/amdvlk/package.nix
index f0d60c42a33a4..f002e8450277e 100644
--- a/pkgs/by-name/am/amdvlk/package.nix
+++ b/pkgs/by-name/am/amdvlk/package.nix
@@ -23,19 +23,17 @@
 let
 
   suffix = if stdenv.system == "x86_64-linux" then "64" else "32";
-  # Fix https://github.com/NixOS/nixpkgs/issues/348903 until the glslang update to 15.0.0 is merged into master
-  glslang_fixed = glslang.overrideAttrs (finalAttrs: oldAttrs: { cmakeFlags = [ ]; });
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amdvlk";
-  version = "2024.Q3.3";
+  version = "2024.Q4.2";
 
   src = fetchRepoProject {
     name = "amdvlk-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${finalAttrs.version}";
-    hash = "sha256-wIPubMsSaNGTykD/K0gxdba128TqW5nu4CjXoLkprc0=";
+    hash = "sha256-16eHtdxoSCVEPQNvi7Kuo7CP4yddMsZqpuRsWobEOnw=";
   };
 
   buildInputs =
@@ -61,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       cmake
       directx-shader-compiler
-      glslang_fixed
+      glslang
       ninja
       patchelf
       perl
diff --git a/pkgs/development/tools/rust/cargo-deadlinks/default.nix b/pkgs/by-name/ca/cargo-deadlinks/package.nix
similarity index 89%
rename from pkgs/development/tools/rust/cargo-deadlinks/default.nix
rename to pkgs/by-name/ca/cargo-deadlinks/package.nix
index b5e73fd9e0df1..13cfbcced456a 100644
--- a/pkgs/development/tools/rust/cargo-deadlinks/default.nix
+++ b/pkgs/by-name/ca/cargo-deadlinks/package.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, apple-sdk_11 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deadlinks";
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
     # assumes the target is x86_64-unknown-linux-gnu
     "--skip simple_project::it_checks_okay_project_correctly";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
 
   meta = with lib; {
     description = "Cargo subcommand to check rust documentation for broken links";
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index 1ae39b36d2bbe..4f29725756375 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildDotnetGlobalTool,
   dotnetCorePackages,
-  nix-update-script,
 }:
 let
   inherit (dotnetCorePackages) sdk_8_0;
@@ -17,10 +16,6 @@ buildDotnetGlobalTool rec {
   dotnet-sdk = sdk_8_0;
   dotnet-runtime = sdk_8_0;
 
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
   meta = {
     description = "Roslyn-based LSP language server for C#";
     mainProgram = "csharp-ls";
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index ab9c003e27653..7bc0c0d26a9d4 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "0.29.1";
+  version = "0.30.2";
   executables = "dotnet-csharpier";
 
-  nugetHash = "sha256-VW9QzbQfbY3Tz+Gz3hQ7VC4wOtwfIYV1Yq2WJz6bL04=";
+  nugetHash = "sha256-MrpsVlIYyrlu3VvEPcLQRgD2lhfu8ZTN3pUZrZ9nQcA=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/da/dafny/package.nix b/pkgs/by-name/da/dafny/package.nix
index 2e3b0c1e911ef..6119aaf637410 100644
--- a/pkgs/by-name/da/dafny/package.nix
+++ b/pkgs/by-name/da/dafny/package.nix
@@ -42,7 +42,7 @@ buildDotnetModule rec {
     '';
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
-  buildInputs = [ jdk11 ];
+  nativeBuildInputs = [ jdk11 ];
   nugetDeps = ./deps.nix;
 
   # Build just these projects. Building Source/Dafny.sln includes a bunch of
diff --git a/pkgs/by-name/ev/evolution-data-server/package.nix b/pkgs/by-name/ev/evolution-data-server/package.nix
index 1bddb3481aab9..07d16d22110c4 100644
--- a/pkgs/by-name/ev/evolution-data-server/package.nix
+++ b/pkgs/by-name/ev/evolution-data-server/package.nix
@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.54.1";
+  version = "3.54.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/evolution-data-server-${version}.tar.xz";
-    hash = "sha256-JbM2xIprq8NjIdiAlLOCrq8Yq8urSpQ4s//5DCnhBa4=";
+    hash = "sha256-EfAlMInIq/RWz/2j/mWKNaDeK4rpPY8lfWsCCueWPSA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fa/famistudio/build-native-wrapper.nix b/pkgs/by-name/fa/famistudio/build-native-wrapper.nix
new file mode 100644
index 0000000000000..6d986ff520d93
--- /dev/null
+++ b/pkgs/by-name/fa/famistudio/build-native-wrapper.nix
@@ -0,0 +1,84 @@
+{
+  depname,
+  version,
+  src,
+  sourceRoot,
+  stdenv,
+  lib,
+  patches ? [ ],
+  extraPostPatch ? "",
+  buildInputs ? [ ],
+}:
+
+let
+  rebuildscriptName =
+    if stdenv.hostPlatform.isLinux then
+      "build_linux"
+    else if stdenv.hostPlatform.isDarwin then
+      "build_macos"
+    else
+      throw "Don't know how to rebuild FamiStudio's vendored ${depname} for ${stdenv.hostPlatform.system}";
+in
+stdenv.mkDerivation {
+  pname = "famistudio-nativedep-${depname}";
+  inherit
+    version
+    src
+    sourceRoot
+    patches
+    buildInputs
+    ;
+
+  postPatch =
+    let
+      libnameBase = lib.optionalString stdenv.hostPlatform.isLinux "lib" + depname;
+    in
+    ''
+      # Use one name for build script, eases with patching
+      mv ${rebuildscriptName}.sh build.sh
+
+      # Scripts use hardcoded compilers and try to copy built libraries into FamiStudio's build tree
+      # Not all scripts use the same compiler, so don't fail on replacing that
+      substituteInPlace build.sh \
+        --replace-fail '../../FamiStudio/' "$out/lib/" \
+        --replace-quiet 'g++' "$CXX"
+
+      # Replacing gcc via sed, would break -static-libgcc otherwise
+      sed -i -e "s/^gcc/$CC/g" build.sh
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Darwin rebuild scripts try to make a universal2 dylib
+      # - build dylib for non-hostPlatform
+      # - copy built library into special directory for later packaging script
+      # - join two dylibs together into a universal2 dylib
+      # Remove everything we don't need
+      sed -ri \
+        -e '/-target ${if stdenv.hostPlatform.isx86_64 then "arm64" else "x86_64"}/d' \
+        -e '/..\/..\/Setup/d' \
+        build.sh
+
+      # Replace joining multi-arch dylibs with copying dylib for target arch
+      substituteInPlace build.sh \
+        --replace-fail 'lipo -create -output ${libnameBase}.dylib' 'cp ${libnameBase}_${
+          if stdenv.hostPlatform.isx86_64 then "x86_64" else "arm64"
+        }.dylib ${libnameBase}.dylib #'
+    ''
+    + extraPostPatch;
+
+  dontConfigure = true;
+  dontInstall = true; # rebuild script automatically installs
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p $out/lib
+
+    # Delete all prebuilt libraries, make sure everything is rebuilt
+    find . -name '*.so' -or -name '*.dylib' -or -name '*.a' -delete
+
+    # When calling normally, an error won't cause derivation to fail
+    source ./build.sh
+
+    runHook postBuild
+  '';
+}
diff --git a/pkgs/applications/audio/famistudio/deps.nix b/pkgs/by-name/fa/famistudio/deps.nix
similarity index 100%
rename from pkgs/applications/audio/famistudio/deps.nix
rename to pkgs/by-name/fa/famistudio/deps.nix
diff --git a/pkgs/by-name/fa/famistudio/package.nix b/pkgs/by-name/fa/famistudio/package.nix
new file mode 100644
index 0000000000000..ff169cd2741ee
--- /dev/null
+++ b/pkgs/by-name/fa/famistudio/package.nix
@@ -0,0 +1,171 @@
+{
+  stdenv,
+  lib,
+  buildDotnetModule,
+  dotnetCorePackages,
+  callPackage,
+  fetchFromGitHub,
+  ffmpeg,
+  glfw,
+  libglvnd,
+  libogg,
+  libvorbis,
+  openal,
+  portaudio,
+  rtmidi,
+}:
+
+let
+  csprojName =
+    if stdenv.hostPlatform.isLinux then
+      "FamiStudio.Linux"
+    else if stdenv.hostPlatform.isDarwin then
+      "FamiStudio.Mac"
+    else
+      throw "Don't know how to build FamiStudio for ${stdenv.hostPlatform.system}";
+in
+buildDotnetModule rec {
+  pname = "famistudio";
+  version = "4.2.1";
+
+  src = fetchFromGitHub {
+    owner = "BleuBleu";
+    repo = "FamiStudio";
+    rev = "refs/tags/${version}";
+    hash = "sha256-WYy/6cWQg3Ayok/eAdnvlWAvdcuhy/sdlWOVvaYcPkc=";
+  };
+
+  postPatch =
+    let
+      libname = library: "${library}${stdenv.hostPlatform.extensions.sharedLibrary}";
+      buildNativeWrapper =
+        args:
+        callPackage ./build-native-wrapper.nix (
+          args
+          // {
+            inherit version src;
+            sourceRoot = "${src.name}/ThirdParty/${args.depname}";
+          }
+        );
+      nativeWrapperToReplaceFormat =
+        args:
+        let
+          libPrefix = lib.optionalString stdenv.hostPlatform.isLinux "lib";
+        in
+        {
+          package = buildNativeWrapper args;
+          expectedName = "${libPrefix}${args.depname}";
+          ourName = "${libPrefix}${args.depname}";
+        };
+      librariesToReplace =
+        [
+          # Unmodified native libraries that we can fully substitute
+          {
+            package = glfw;
+            expectedName = "libglfw";
+            ourName = "libglfw";
+          }
+          {
+            package = rtmidi;
+            expectedName = "librtmidi";
+            ourName = "librtmidi";
+          }
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isLinux [
+          {
+            package = openal;
+            expectedName = "libopenal32";
+            ourName = "libopenal";
+          }
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          {
+            package = portaudio;
+            expectedName = "libportaudio.2";
+            ourName = "libportaudio.2";
+          }
+        ]
+        ++ [
+          # Native libraries, with extra code for the C# wrapping
+          (nativeWrapperToReplaceFormat { depname = "GifDec"; })
+          (nativeWrapperToReplaceFormat { depname = "NesSndEmu"; })
+          (nativeWrapperToReplaceFormat {
+            depname = "NotSoFatso";
+            extraPostPatch = ''
+              # C++17 does not allow register storage class specifier
+              substituteInPlace build.sh \
+                --replace-fail "$CXX" "$CXX -std=c++14"
+            '';
+          })
+          (nativeWrapperToReplaceFormat { depname = "ShineMp3"; })
+          (nativeWrapperToReplaceFormat { depname = "Stb"; })
+          (nativeWrapperToReplaceFormat {
+            depname = "Vorbis";
+            buildInputs = [
+              libogg
+              libvorbis
+            ];
+          })
+        ];
+      libraryReplaceArgs = lib.strings.concatMapStringsSep " " (
+        library:
+        "--replace-fail '${libname library.expectedName}' '${lib.getLib library.package}/lib/${libname library.ourName}'"
+      ) librariesToReplace;
+    in
+    ''
+      # Don't use any prebuilt libraries
+      rm FamiStudio/*.{dll,dylib,so*}
+
+      # Replace copying of vendored prebuilt native libraries with copying of our native libraries
+      substituteInPlace ${projectFile} ${libraryReplaceArgs}
+
+      # Un-hardcode target platform if set
+      sed -i -e '/PlatformTarget/d' ${projectFile}
+
+      # Don't require a special name to be preserved, our OpenAL isn't 32-bit
+      substituteInPlace FamiStudio/Source/AudioStreams/OpenALStream.cs \
+        --replace-fail 'libopenal32' 'libopenal'
+    '';
+
+  projectFile = "FamiStudio/${csprojName}.csproj";
+  nugetDeps = ./deps.nix;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnetFlags = [ "-p:TargetFramework=net8.0" ];
+
+  runtimeDeps = lib.optionals stdenv.hostPlatform.isLinux [
+    libglvnd
+  ];
+
+  executables = [ "FamiStudio" ];
+
+  postInstall = ''
+    mkdir -p $out/share/famistudio
+    for datdir in Setup/Demo\ {Instruments,Songs}; do
+      cp -R "$datdir" $out/share/famistudio/
+    done
+  '';
+
+  postFixup = ''
+    # FFMpeg looked up from PATH
+    wrapProgram $out/bin/FamiStudio \
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    homepage = "https://famistudio.org/";
+    description = "NES Music Editor";
+    longDescription = ''
+      FamiStudio is very simple music editor for the Nintendo Entertainment System
+      or Famicom. It is targeted at both chiptune artists and NES homebrewers.
+    '';
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      OPNA2608
+    ];
+    platforms = lib.platforms.unix;
+    mainProgram = "FamiStudio";
+  };
+}
diff --git a/pkgs/applications/audio/famistudio/update.sh b/pkgs/by-name/fa/famistudio/update.sh
similarity index 100%
rename from pkgs/applications/audio/famistudio/update.sh
rename to pkgs/by-name/fa/famistudio/update.sh
diff --git a/pkgs/by-name/fe/fedifetcher/package.nix b/pkgs/by-name/fe/fedifetcher/package.nix
index 4eac639897618..9ef45d07a39f3 100644
--- a/pkgs/by-name/fe/fedifetcher/package.nix
+++ b/pkgs/by-name/fe/fedifetcher/package.nix
@@ -2,14 +2,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fedifetcher";
-  version = "7.1.12";
+  version = "7.1.14";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "nanos";
     repo = "FediFetcher";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DWex4pZV9ZVR1bqYcOpTe74ZQCQCQQxjWrv0QgtRY40=";
+    hash = "sha256-SfR4CYVs2kLLguKCau+x5vy6ha48Zd43OJ+tsA6M9yg=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/fi/file-roller/package.nix b/pkgs/by-name/fi/file-roller/package.nix
index 91c463802353e..5de8f9f14f468 100644
--- a/pkgs/by-name/fi/file-roller/package.nix
+++ b/pkgs/by-name/fi/file-roller/package.nix
@@ -16,20 +16,18 @@
 , gnome
 , gtk4
 , libadwaita
-, libhandy
 , json-glib
 , libarchive
-, libportal-gtk4
 , nautilus
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "file-roller";
-  version = "44.3";
+  version = "44.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/file-roller/${lib.versions.major finalAttrs.version}/file-roller-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BMinRiX+yEJn/exAMGr7QQS9My2FBh4NNtSrBTOt+ko=";
+    hash = "sha256-uMMJ2jqnhMcZVYw0ZkAjePSj1sro7XfPaEmqzVbOuew=";
   };
 
   nativeBuildInputs = [
@@ -50,10 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     gtk4
     libadwaita
-    libhandy
     json-glib
     libarchive
-    libportal-gtk4
     nautilus
   ];
 
diff --git a/pkgs/by-name/gh/ghex/package.nix b/pkgs/by-name/gh/ghex/package.nix
index 69e4c0f94ff00..b4fd1da04ff0c 100644
--- a/pkgs/by-name/gh/ghex/package.nix
+++ b/pkgs/by-name/gh/ghex/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ghex";
-  version = "46.0";
+  version = "46.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major version}/ghex-${version}.tar.xz";
-    hash = "sha256-ocRvMCDLNYuDIwJds6U5yX2ZSkxG9wH0jtxjV/f7y9E=";
+    hash = "sha256-ihOXVHTu4ncZsprXY/GyR2Chrt5tfaS2I3AwcLwm6f0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix
index 9b71405f33546..8e961ec2bd58a 100644
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@@ -1,5 +1,7 @@
 {
+  bash,
   buildDotnetModule,
+  coreutils,
   darwin,
   dotnetCorePackages,
   fetchFromGitHub,
@@ -111,12 +113,17 @@ buildDotnetModule rec {
     [
       which
       git
+      # needed for `uname`
+      coreutils
     ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
       darwin.autoSignDarwinBinariesHook
     ];
 
-  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+  buildInputs = [
+    (lib.getLib stdenv.cc.cc)
+    bash
+  ];
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.runtime_8_0;
diff --git a/pkgs/by-name/gn/gnome-extension-manager/package.nix b/pkgs/by-name/gn/gnome-extension-manager/package.nix
index 9b6167322aa57..02eb300c59ef0 100644
--- a/pkgs/by-name/gn/gnome-extension-manager/package.nix
+++ b/pkgs/by-name/gn/gnome-extension-manager/package.nix
@@ -18,6 +18,7 @@
 , glib
 , libbacktrace
 , text-engine
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -54,6 +55,14 @@ stdenv.mkDerivation rec {
     text-engine
   ];
 
+  patches = [
+    # fix black window when opened, remove in next release
+    (fetchpatch {
+      url = "https://github.com/mjakeman/extension-manager/commit/91d1c42a30e12131dc3c5afd8a709e7db2a95b70.patch";
+      hash = "sha256-NtsJeqclUx4L3wbyQ46ZCoo4IKSu4/HoT/FD20xriZ4=";
+    })
+  ];
+
   mesonFlags = [
     (lib.mesonOption "package" "Nix")
     (lib.mesonOption "distributor" "nixpkgs")
diff --git a/pkgs/by-name/gn/gnome-maps/package.nix b/pkgs/by-name/gn/gnome-maps/package.nix
index 233c0f2296eef..2dcdeed43db4e 100644
--- a/pkgs/by-name/gn/gnome-maps/package.nix
+++ b/pkgs/by-name/gn/gnome-maps/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-maps";
-  version = "47.1";
+  version = "47.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-maps/${lib.versions.major finalAttrs.version}/gnome-maps-${finalAttrs.version}.tar.xz";
-    hash = "sha256-TwLtLo44GeWdptm0rIgA6GY1349GpHzyqv2ThsgwEwM=";
+    hash = "sha256-WFHnhtrsZY8h5FeiBv8KmtFlnzdBqtlJCxvzGSFU/ps=";
   };
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/gn/gnome-software/package.nix b/pkgs/by-name/gn/gnome-software/package.nix
index 0d0569ed6b382..d265ff11611dc 100644
--- a/pkgs/by-name/gn/gnome-software/package.nix
+++ b/pkgs/by-name/gn/gnome-software/package.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-software";
-  version = "47.1";
+  version = "47.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-k8pQA2YxZ0VZTvBfytHAXPQ/Au+PZggMF/fruMo/NL8=";
+    hash = "sha256-ESM4+KmOflEl3j9XIphzU0IVt37u830/1CYvAhUcfOo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-text-editor/package.nix b/pkgs/by-name/gn/gnome-text-editor/package.nix
index 2baf665c08b1f..1ecedd090343b 100644
--- a/pkgs/by-name/gn/gnome-text-editor/package.nix
+++ b/pkgs/by-name/gn/gnome-text-editor/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-text-editor";
-  version = "47.1";
+  version = "47.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-text-editor/${lib.versions.major finalAttrs.version}/gnome-text-editor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3pVkLitA/yZf7s2GuTng/QGOTrK6SZNQ8rrSv8xUAQw=";
+    hash = "sha256-fQQDmxYXTsX9Zf6i9Efz/r2f3yqjbpmXq8b/mSzDHjg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hw/hwinfo/package.nix b/pkgs/by-name/hw/hwinfo/package.nix
index cfb940d66cd1c..15a20ebd10a8f 100644
--- a/pkgs/by-name/hw/hwinfo/package.nix
+++ b/pkgs/by-name/hw/hwinfo/package.nix
@@ -69,6 +69,13 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs src/ids/convert_hd
   '';
 
+  outputs = [
+    "bin"
+    "dev"
+    "lib"
+    "out"
+  ];
+
   # The pci/usb ids in hwinfo are ancient. We can get a more up-to-date list simply by copying from systemd
   preBuild = ''
     # since we don't have .git, we cannot run this.
@@ -94,6 +101,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   installFlags = [ "DESTDIR=$(out)" ];
 
+  enableParallelBuilding = false; # broken parallel dependencies
+
+  postInstall = ''
+    moveToOutput bin "$bin"
+    moveToOutput lib "$lib"
+  '';
+
   passthru = {
     tests = {
       version = testers.testVersion { package = finalAttrs.finalPackage; };
diff --git a/pkgs/by-name/li/libspelling/package.nix b/pkgs/by-name/li/libspelling/package.nix
index 8aec418da377a..9d0eac13bcd37 100644
--- a/pkgs/by-name/li/libspelling/package.nix
+++ b/pkgs/by-name/li/libspelling/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libspelling";
-  version = "0.4.4";
+  version = "0.4.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libspelling";
     rev = version;
-    hash = "sha256-6ggegeDR4UBP2LKn6lj0pOB1Iz7MwLEf9usIB28SEMA=";
+    hash = "sha256-+WjhBg98s5RxQfd85FtMNuoVWjw9Hap9yDqnpYNAGgw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index c9d2f1d5171e5..0fc7167c9b559 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
     rev = "v${version}";
-    hash = "sha256-Rird32KB+V1xGBZvrEaPDPOhl5YMClIljOLcFO/0vOU=";
+    hash = "sha256-T7x9xU/Tr2BKfrHQHrP6Mm6rNUWYASjEPzHIKgyS7aE=";
   };
 
   vendorHash = "sha256-qDzd+aq08PN9kl1YkvNLGvWaFVh7xFXJhGdx/ELwYGY=";
diff --git a/pkgs/by-name/on/onedrive/package.nix b/pkgs/by-name/on/onedrive/package.nix
index ae59c1c10ac95..51874c89c7298 100644
--- a/pkgs/by-name/on/onedrive/package.nix
+++ b/pkgs/by-name/on/onedrive/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   autoreconfHook,
+  coreutils,
   curl,
   fetchFromGitHub,
   installShellFiles,
@@ -57,6 +58,9 @@ stdenv.mkDerivation (finalAttrs: {
     installShellCompletion --bash --name onedrive contrib/completions/complete.bash
     installShellCompletion --fish --name onedrive contrib/completions/complete.fish
     installShellCompletion --zsh --name _onedrive contrib/completions/complete.zsh
+
+    substituteInPlace $out/lib/systemd/user/onedrive.service --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
+    substituteInPlace $out/lib/systemd/system/onedrive@.service --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/or/orca/package.nix b/pkgs/by-name/or/orca/package.nix
index 4acbd6492b253..04dbff20fcc63 100644
--- a/pkgs/by-name/or/orca/package.nix
+++ b/pkgs/by-name/or/orca/package.nix
@@ -28,13 +28,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "orca";
-  version = "47.1";
+  version = "47.2";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-0H16zehWVUaXOp8pcwcy8xcmq2vJ3Mzq0uEgTX2ARO0=";
+    hash = "sha256-XmevNX9xmOoApEOByrTE+U5oJtbtgAZo85QWziqrjlo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pb/pbm/package.nix b/pkgs/by-name/pb/pbm/package.nix
index 8a444311ffd63..57646c1db1619 100644
--- a/pkgs/by-name/pb/pbm/package.nix
+++ b/pkgs/by-name/pb/pbm/package.nix
@@ -2,9 +2,9 @@
 
 buildDotnetGlobalTool {
   pname = "pbm";
-  version = "1.3.2";
+  version = "1.4.3";
 
-  nugetHash = "sha256-xu3g8NFLZYnHzBuoIhIiAzaPJqY0xhLWLYi+ORRADH8=";
+  nugetHash = "sha256-R6dmF3HPI2BAcNGLCm6WwBlk4ev6T6jaiJUAWYKf2S4=";
 
   meta = with lib; {
     description = "CLI for managing Akka.NET applications and Akka.NET Clusters";
diff --git a/pkgs/by-name/qt/qtscrcpy/package.nix b/pkgs/by-name/qt/qtscrcpy/package.nix
index 88f13a04d03ac..320ef507d44a8 100644
--- a/pkgs/by-name/qt/qtscrcpy/package.nix
+++ b/pkgs/by-name/qt/qtscrcpy/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "qtscrcpy";
-  version = "2.2.1";
+  version = "3.0.0";
 
   src =
     (fetchFromGitHub {
       owner = "barry-ran";
       repo = "QtScrcpy";
       rev = "refs/tags/v${version}";
-      hash = "sha256-PL/UvRNqvLaFuvSHbkJsaJ2nqRp5+ERM+rmlKVtbShk=";
+      hash = "sha256-RW+7aHcxFEO4H9SVKfAfuwY0IXwThxM29oVS5zhWbpY=";
       fetchSubmodules = true;
     }).overrideAttrs
       (_: {
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index fde6c41cc0611..9266176a32433 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -11,12 +11,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.87.2";
+  version = "1.87.4";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-w4jrtrKCATUsFkMVsGee88pYiL1bahHaSy9emCh2GJE=";
+    hash = "sha256-tM8j9oFIn5gAskM7Fxu4xMRh3pRsmroDDLkGyaie9I0=";
   };
 
   dontPatch = true;
diff --git a/pkgs/by-name/rh/rhythmbox/package.nix b/pkgs/by-name/rh/rhythmbox/package.nix
index eb4d9629fbb80..0095ffd154447 100644
--- a/pkgs/by-name/rh/rhythmbox/package.nix
+++ b/pkgs/by-name/rh/rhythmbox/package.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rhythmbox";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "L21WwT/BpkxTT1AHiPtIKTbOVHs0PtkMZ94fK84M+n4=";
+    sha256 = "IBaoqNKpWcB6RnrJaCxu1gW6iIP7dgQQ1otoq4ON+fI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rt/rtkit/meson-actual-use-systemd_systemunitdir.patch b/pkgs/by-name/rt/rtkit/meson-actual-use-systemd_systemunitdir.patch
new file mode 100644
index 0000000000000..fa1ca26088ce6
--- /dev/null
+++ b/pkgs/by-name/rt/rtkit/meson-actual-use-systemd_systemunitdir.patch
@@ -0,0 +1,22 @@
+From 7d62095b94f8df3891c984a1535026d2658bb177 Mon Sep 17 00:00:00 2001
+From: Edmund Wu <fangkazuto@gmail.com>
+Date: Sat, 11 Apr 2020 16:59:35 -0400
+Subject: [PATCH] meson: actually use systemd_systemunitdir
+
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 02e6c73..ba5ba1e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -58,7 +58,7 @@ if policydir == ''
+         policydir = get_option('datadir') / 'polkit-1' / 'actions'
+ endif
+ 
+-systemunitdir = ''
++systemunitdir = get_option('systemd_systemunitdir')
+ if systemunitdir == '' and systemd_dep.found()
+         systemunitdir = systemd_dep.get_pkgconfig_variable(
+                 'systemdsystemunitdir',
diff --git a/pkgs/by-name/rt/rtkit/meson-fix-librt-find_library-check.patch b/pkgs/by-name/rt/rtkit/meson-fix-librt-find_library-check.patch
new file mode 100644
index 0000000000000..54992e84ca66e
--- /dev/null
+++ b/pkgs/by-name/rt/rtkit/meson-fix-librt-find_library-check.patch
@@ -0,0 +1,22 @@
+From 98f70edd8f534c371cb4308b9720739c5178918d Mon Sep 17 00:00:00 2001
+From: Felipe Sateler <fsateler@users.noreply.github.com>
+Date: Sat, 11 Apr 2020 10:59:21 -0400
+Subject: [PATCH] meson: fix librt find_library check
+
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 02e6c73..49da472 100644
+--- a/meson.build
++++ b/meson.build
+@@ -22,7 +22,7 @@ polkit_dep = dependency('polkit-gobject-1', required: false)
+ systemd_dep = dependency('systemd', required: false)
+ thread_dep = dependency('threads')
+ 
+-librt_dep = cc.find_library('z')
++librt_dep = cc.find_library('rt')
+ cc.check_header('sched.h', dependencies: librt_dep)
+ cc.has_function('sched_setscheduler', dependencies: librt_dep)
+ 
diff --git a/pkgs/by-name/rt/rtkit/package.nix b/pkgs/by-name/rt/rtkit/package.nix
index 9c580edc308fd..12dc6bbe392f1 100644
--- a/pkgs/by-name/rt/rtkit/package.nix
+++ b/pkgs/by-name/rt/rtkit/package.nix
@@ -15,23 +15,9 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
-      name = "meson-actual-use-systemd_systemunitdir.patch";
-      url = "https://github.com/heftig/rtkit/pull/19/commits/7d62095b94f8df3891c984a1535026d2658bb177.patch";
-      sha256 = "17acv549zqcgh7sgprfagbf6drqsr0zdwvf1dsqda7wlqc2h9zn7";
-    })
-
-    (fetchpatch {
-      name = "meson-fix-librt-find_library-check.patch";
-      url = "https://github.com/heftig/rtkit/pull/18/commits/98f70edd8f534c371cb4308b9720739c5178918d.patch";
-      sha256 = "18mnjjsdjfr184nkzi01xyphpdngi31ry4bmkv9ysjxf9wilv4nl";
-    })
-
-    (fetchpatch {
-      name = "rtkit-daemon-dont-log-debug-messages-by-default.patch";
-      url = "https://github.com/heftig/rtkit/pull/33/commits/ad649ee491ed1a41537774ad11564a208e598a09.patch";
-      sha256 = "sha256-p+MdJVMv58rFd1uc1UFKtq83RquDSFZ3M6YfaBU12UU=";
-    })
+    ./meson-actual-use-systemd_systemunitdir.patch
+    ./meson-fix-librt-find_library-check.patch
+    ./rtkit-daemon-dont-log-debug-messages-by-default.patch
   ];
 
   nativeBuildInputs = [ meson ninja pkg-config unixtools.xxd ];
diff --git a/pkgs/by-name/rt/rtkit/rtkit-daemon-dont-log-debug-messages-by-default.patch b/pkgs/by-name/rt/rtkit/rtkit-daemon-dont-log-debug-messages-by-default.patch
new file mode 100644
index 0000000000000..667d80ab69159
--- /dev/null
+++ b/pkgs/by-name/rt/rtkit/rtkit-daemon-dont-log-debug-messages-by-default.patch
@@ -0,0 +1,73 @@
+From 4880b9c67628a781bdb183dcdc69f12cb829817d Mon Sep 17 00:00:00 2001
+From: Jean Delvare <jdelvare@suse.de>
+Date: Sat, 15 Apr 2023 11:53:27 +0200
+Subject: [PATCH] rtkit-daemon: Don't log debug messages by default
+
+The rtkit-daemon service is a lot more verbose than other services
+when it doesn't have anything to do. Stop logging the debug messages
+by default to avoid flooding the system log.
+
+This addresses issue #22.
+---
+ rtkit-daemon.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/rtkit-daemon.c b/rtkit-daemon.c
+index 17122fa..0c5d814 100644
+--- a/rtkit-daemon.c
++++ b/rtkit-daemon.c
+@@ -154,6 +154,9 @@ static bool canary_demote_unknown = FALSE;
+ /* Log to stderr? */
+ static bool log_stderr = FALSE;
+ 
++/* Also log debugging messages? */
++static bool log_debug = FALSE;
++
+ /* Scheduling policy to use */
+ static int sched_policy = SCHED_RR;
+ 
+@@ -1876,6 +1879,7 @@ enum {
+         ARG_CANARY_DEMOTE_UNKNOWN,
+         ARG_CANARY_REFUSE_SEC,
+         ARG_STDERR,
++        ARG_DEBUG,
+         ARG_INTROSPECT
+ };
+ 
+@@ -1905,6 +1909,7 @@ static const struct option long_options[] = {
+     { "canary-demote-unknown",       no_argument,       0, ARG_CANARY_DEMOTE_UNKNOWN },
+     { "canary-refuse-sec",           required_argument, 0, ARG_CANARY_REFUSE_SEC },
+     { "stderr",                      no_argument,       0, ARG_STDERR },
++    { "debug",                       no_argument,       0, ARG_DEBUG },
+     { "introspect",                  no_argument,       0, ARG_INTROSPECT },
+     { NULL, 0, 0, 0}
+ };
+@@ -1933,6 +1938,7 @@ static void show_help(const char *exe) {
+                "      --version                       Show version\n\n"
+                "OPTIONS:\n"
+                "      --stderr                        Log to STDERR in addition to syslog\n"
++               "      --debug                         Also log debugging mssages\n"
+                "      --user-name=USER                Run daemon as user (%s)\n\n"
+                "      --scheduling-policy=(RR|FIFO)   Choose scheduling policy (%s)\n"
+                "      --our-realtime-priority=[%i..%i] Realtime priority for the daemon (%u)\n"
+@@ -2222,6 +2228,10 @@ static int parse_command_line(int argc, char *argv[], int *ret) {
+                                 log_stderr = TRUE;
+                                 break;
+ 
++                        case ARG_DEBUG:
++                                log_debug = TRUE;
++                                break;
++
+                         case ARG_INTROSPECT:
+                                 fputs(introspect_xml, stdout);
+                                 *ret = 0;
+@@ -2251,6 +2261,9 @@ static int parse_command_line(int argc, char *argv[], int *ret) {
+                 return -1;
+         }
+ 
++	if (!log_debug)
++                setlogmask(LOG_UPTO(LOG_INFO));
++
+         assert(our_realtime_priority >= (unsigned) sched_get_priority_min(sched_policy));
+         assert(our_realtime_priority <= (unsigned) sched_get_priority_max(sched_policy));
+ 
diff --git a/pkgs/by-name/sc/scrcpy/package.nix b/pkgs/by-name/sc/scrcpy/package.nix
index d02b5a903286a..afe4147f19309 100644
--- a/pkgs/by-name/sc/scrcpy/package.nix
+++ b/pkgs/by-name/sc/scrcpy/package.nix
@@ -16,12 +16,12 @@
 }:
 
 let
-  version = "3.0";
+  version = "3.0.2";
   prebuilt_server = fetchurl {
     name = "scrcpy-server";
     inherit version;
     url = "https://github.com/Genymobile/scrcpy/releases/download/v${version}/scrcpy-server-v${version}";
-    hash = "sha256-gABExiqU1fwW9auchtRbEFDq4+tDZRTRsNL+Jka4lOo=";
+    hash = "sha256-4Z/gJL+jNngJSUQHrWyoCab2532slemfhbp1FE4Lo10=";
   };
 in
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "Genymobile";
     repo = "scrcpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fKfiBx3uQH30ZLCWRY33KyisjxLDvWJCdKbGn4j0dWw=";
+    hash = "sha256-6CViFgQuazvKGPHGpityEI/mpgOmIBA6LTEHobWybV0=";
   };
 
   #   display.c: When run without a hardware accelerator, this allows the command to continue working rather than failing unexpectedly.
diff --git a/pkgs/by-name/ta/tagger/package.nix b/pkgs/by-name/ta/tagger/package.nix
index a8074cef40747..fa4074b8a5249 100644
--- a/pkgs/by-name/ta/tagger/package.nix
+++ b/pkgs/by-name/ta/tagger/package.nix
@@ -31,11 +31,11 @@ buildDotnetModule rec {
 
   nativeBuildInputs = [
     blueprint-compiler
-    libadwaita
   ];
 
   buildInputs = [
     chromaprint
+    libadwaita
   ];
 
   runtimeDeps = [
diff --git a/pkgs/tools/misc/tealdeer/default.nix b/pkgs/by-name/te/tealdeer/package.nix
similarity index 93%
rename from pkgs/tools/misc/tealdeer/default.nix
rename to pkgs/by-name/te/tealdeer/package.nix
index 428c235e394d5..24edef2df4936 100644
--- a/pkgs/tools/misc/tealdeer/default.nix
+++ b/pkgs/by-name/te/tealdeer/package.nix
@@ -3,7 +3,7 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
-, Security
+, apple-sdk_11
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-WCbpwvCXm54/Cv+TscaqseWzTUd8V1DxmS30fUZZTwI=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ti/time/package.nix b/pkgs/by-name/ti/time/package.nix
index 1df89b323838f..2328d03e18704 100644
--- a/pkgs/by-name/ti/time/package.nix
+++ b/pkgs/by-name/ti/time/package.nix
@@ -9,6 +9,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+6zwyB5iQp3z4zvaTO44dWYE8Y4B2XczjiMwaj47Uh4=";
   };
 
+  patches = [
+    # fixes cross-compilation to riscv64-linux
+    ./time-1.9-implicit-func-decl-clang.patch
+  ];
+
   meta = {
     description = "Tool that runs programs and summarizes the system resources they use";
     longDescription = ''
diff --git a/pkgs/by-name/ti/time/time-1.9-implicit-func-decl-clang.patch b/pkgs/by-name/ti/time/time-1.9-implicit-func-decl-clang.patch
new file mode 100644
index 0000000000000..ca76b5a50050d
--- /dev/null
+++ b/pkgs/by-name/ti/time/time-1.9-implicit-func-decl-clang.patch
@@ -0,0 +1,24 @@
+https://lists.gnu.org/archive/html/bug-time/2022-08/msg00001.html
+
+From c8deae54f92d636878097063b411af9fb5262ad3 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Mon, 15 Aug 2022 07:24:24 -0700
+Subject: [PATCH] include string.h for memset()
+
+Fixes implicit function declaration warning e.g.
+
+resuse.c:103:3: error: call to undeclared library function 'memset' with type 'void *(void *, int, unsigned long)'
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/bug-time/2022-08/msg00001.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+--- a/src/resuse.c
++++ b/src/resuse.c
+@@ -22,6 +22,7 @@
+ */ 
+ 
+ #include "config.h"
++#include <string.h>
+ #include <sys/time.h>
+ #include <sys/wait.h>
+ #include <sys/resource.h>
+
diff --git a/pkgs/by-name/up/upgrade-assistant/package.nix b/pkgs/by-name/up/upgrade-assistant/package.nix
index 4550a3f7b71ed..06e361d742676 100644
--- a/pkgs/by-name/up/upgrade-assistant/package.nix
+++ b/pkgs/by-name/up/upgrade-assistant/package.nix
@@ -1,9 +1,9 @@
 { lib, buildDotnetGlobalTool }:
 buildDotnetGlobalTool {
   pname = "upgrade-assistant";
-  version = "0.5.820";
+  version = "0.5.829";
 
-  nugetHash = "sha256-GB+q5aZRkBTeXUbIPjkPsll6pSI/H6Iyh5mY53uT284=";
+  nugetHash = "sha256-N0xEmPQ88jfirGPLJykeAJQYGwELFzKwUWdFxIgiwhY=";
 
   meta = {
     homepage = "https://github.com/dotnet/upgrade-assistant";
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index 7da4db2e7af3b..f25fc13ed6132 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -17,13 +17,13 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2024.12.3";
+  version = "2024.12.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "yt_dlp";
-    hash = "sha256-Nav/UcV2IDMQPyMwugqKH0jEOIpBOi2M3JuEZC/o7dQ=";
+    hash = "sha256-dD2+CB6ocb4/X/CD4s2V2oZt6nc/xwrmsQmDjPv3KsQ=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/desktops/gnome/extensions/arcmenu/default.nix b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
index d6179736e9e9a..157dd3edf38ae 100644
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-arcmenu";
-  version = "55";
+  version = "63";
 
   src = fetchFromGitLab {
     owner = "arcmenu";
     repo = "ArcMenu";
     rev = "v${version}";
-    hash = "sha256-xLKvcrZkqcj7aHiv9JumLWSP5LbajITAyopCIwGqpkE=";
+    hash = "sha256-XlDkdNINTnUAqr2bxL0u2tHWfiggqT1oOryED7sG/vs=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/find-latest-version.py b/pkgs/desktops/gnome/find-latest-version.py
index 1cc2b55fadb3a..d921fd7366cba 100644
--- a/pkgs/desktops/gnome/find-latest-version.py
+++ b/pkgs/desktops/gnome/find-latest-version.py
@@ -102,7 +102,7 @@ def make_version_policy(
 
 def find_versions(package_name: str, version_policy: VersionPolicy) -> List[Version]:
     # The structure of cache.json: https://gitlab.gnome.org/Infrastructure/sysadmin-bin/blob/master/ftpadmin#L762
-    cache = json.loads(requests.get(f"https://ftp.gnome.org/pub/GNOME/sources/{package_name}/cache.json").text)
+    cache = json.loads(requests.get(f"https://download.gnome.org/sources/{package_name}/cache.json").text)
     if type(cache) != list or cache[0] != 4:
         raise Exception("Unknown format of cache.json file.")
 
@@ -117,7 +117,7 @@ def find_versions(package_name: str, version_policy: VersionPolicy) -> List[Vers
 )
 parser.add_argument(
     "package-name",
-    help="Name of the directory in https://ftp.gnome.org/pub/GNOME/sources/ containing the package.",
+    help="Name of the directory in https://download.gnome.org/sources/ containing the package.",
 )
 parser.add_argument(
     "version-policy",
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index e034bff9e5765..d83c019379e45 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
-  version = "5.14.1";
+  version = "5.14.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtksourceview/${lib.versions.majorMinor finalAttrs.version}/gtksourceview-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AJhi6HuSnaWnJOzgefAfjO4p50eXoeysNJ9YwVo8vFg=";
+    hash = "sha256-Gm04emgHX4rv1OdSz0hxd8SmgjsU/4pDSYaFiurvYmQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/comicon/default.nix b/pkgs/development/python-modules/comicon/default.nix
index 78ecc0715c816..1aaf781d3b9ad 100644
--- a/pkgs/development/python-modules/comicon/default.nix
+++ b/pkgs/development/python-modules/comicon/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "comicon";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "potatoeggy";
     repo = "comicon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oiEzZRgyG/RQCo2zSTqwlOhkwz76lSImR0ZtSlIUp4Y=";
+    hash = "sha256-FvAgcpYvUTTE24jJB2ZxSNcNjAIyUBa3BaysjWXurtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hvplot/default.nix b/pkgs/development/python-modules/hvplot/default.nix
index 4831f14335c07..0687b65e297ff 100644
--- a/pkgs/development/python-modules/hvplot/default.nix
+++ b/pkgs/development/python-modules/hvplot/default.nix
@@ -69,6 +69,12 @@ buildPythonPackage rec {
     "hvplot/tests/testutil.py"
   ];
 
+  # need to set MPLBACKEND=agg for headless matplotlib for darwin
+  # https://github.com/matplotlib/matplotlib/issues/26292
+  preCheck = ''
+    export MPLBACKEND=agg
+  '';
+
   pythonImportsCheck = [ "hvplot.pandas" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/icnsutil/default.nix b/pkgs/development/python-modules/icnsutil/default.nix
index 8061c62feb228..6952aa33397f9 100644
--- a/pkgs/development/python-modules/icnsutil/default.nix
+++ b/pkgs/development/python-modules/icnsutil/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   python,
   pythonOlder,
+  pillow,
 }:
 
 buildPythonPackage rec {
@@ -20,6 +21,8 @@ buildPythonPackage rec {
     hash = "sha256-tiq8h6s2noWLBIOIWcj8jfSqJFN01ee2uoHN4aFwn7s=";
   };
 
+  dependencies = [ pillow ];
+
   checkPhase = ''
     ${python.interpreter} tests/test_icnsutil.py
     ${python.interpreter} tests/test_cli.py
diff --git a/pkgs/development/tools/fable/default.nix b/pkgs/development/tools/fable/default.nix
index ea5362daa90f6..31013115cb09c 100644
--- a/pkgs/development/tools/fable/default.nix
+++ b/pkgs/development/tools/fable/default.nix
@@ -1,11 +1,21 @@
-{ buildDotnetGlobalTool, lib }:
+{
+  buildDotnetGlobalTool,
+  lib,
+  testers,
+}:
 
-buildDotnetGlobalTool {
+buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "4.20.0";
+  version = "4.24.0";
 
-  nugetHash = "sha256-K3908gEbl9crT4wmZfBtvag5Z6qYABfalBfLZlqZuDk=";
-  passthru.updateScript = ./update.sh;
+  nugetHash = "sha256-ERewWqfEyyZKpHFFALpMGJT0fDWywBYY5buU/wTZZTg=";
+
+  passthru.tests = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    # the version is written with an escape sequence for colour, and I couldn't
+    # find a way to disable it
+    version = "[37m${finalAttrs.version}";
+  };
 
   meta = with lib; {
     description = "Fable is an F# to JavaScript compiler";
@@ -14,6 +24,9 @@ buildDotnetGlobalTool {
     changelog = "https://github.com/fable-compiler/fable/releases/tag/v${version}";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ anpin mdarocha ];
+    maintainers = with maintainers; [
+      anpin
+      mdarocha
+    ];
   };
-}
+})
diff --git a/pkgs/development/tools/fable/update.sh b/pkgs/development/tools/fable/update.sh
deleted file mode 100755
index 181570d1a0dee..0000000000000
--- a/pkgs/development/tools/fable/update.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix-prefetch jq
-
-set -euo pipefail
-URL="https://github.com/fable-compiler/fable"
-PKG="Fable"
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/default.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find default.nix in $ROOT"
-  exit 1
-fi
-
-TMP="$(mktemp -d)"
-clean_up() {
-    rm -rf "$TMP"
-}
-trap clean_up EXIT SIGINT SIGTERM
-PACKAGES="$TMP/packages"
-SRC_RW="$TMP/src"
-
-mkdir -p $SRC_RW
-mkdir -p $PACKAGES
-
-
-VER=$(curl -s "https://api.github.com/repos/fable-compiler/fable/releases/latest" | jq -r .tag_name | grep -oP '\d+\.\d+\.\d+' )
-
-CURRENT_VER=$(grep -oP '(?<=version = ")[^"]+' "$NIX_DRV")
-if [[ "$CURRENT_VER" == "$VER" ]]; then
-    echo "$PKG is already up to date: $CURRENT_VER"
-    exit
-fi
-
-
-NUGET_URL="$(curl -f "https://api.nuget.org/v3/index.json" | jq --raw-output '.resources[] | select(."@type" == "PackageBaseAddress/3.0.0")."@id"')$PKG/$VER/$PKG.$VER.nupkg"
-HASH=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$NUGET_URL")")
-
-sed -i "s/version = \".*\"/version = \"$VER\"/" "$NIX_DRV"
-sed -i "s#nugetHash = \"sha256-.\{44\}\"#nugetHash = \"$HASH\"#" "$NIX_DRV"
diff --git a/pkgs/development/tools/ocaml/melange/default.nix b/pkgs/development/tools/ocaml/melange/default.nix
new file mode 100644
index 0000000000000..c81ca2a6cf567
--- /dev/null
+++ b/pkgs/development/tools/ocaml/melange/default.nix
@@ -0,0 +1,83 @@
+{
+  buildDunePackage,
+  cmdliner,
+  cppo,
+  dune-build-info,
+  fetchurl,
+  jq,
+  lib,
+  makeWrapper,
+  menhirLib,
+  merlin,
+  nodejs,
+  ocaml,
+  ounit2,
+  ppxlib,
+  reason,
+  stdenv,
+  tree,
+}:
+
+let
+  pname = "melange";
+  versionHash =
+    if lib.versionAtLeast ocaml.version "5.2" then
+      {
+        version = "4.0.1-52";
+        hash = "sha256-kUlChqQtLX7zh90GK23ibMqyI/MIp0sMYLjkPX9vdTc=";
+      }
+    else if lib.versionAtLeast ocaml.version "5.1" then
+      {
+        version = "4.0.0-51";
+        hash = "sha256-940Yzp1ZXnN6mKVWY+nqKjn4qtBUJR5eHE55OTjGvdU=";
+      }
+    else
+      {
+        version = "4.0.0-414";
+        hash = "sha256-PILDOXYIyLvfv1sSwP6WSdCiXfpYdnct7WMw3jHBLJM=";
+      };
+  version = versionHash.version;
+  hash = versionHash.hash;
+in
+buildDunePackage {
+  inherit pname;
+  inherit version;
+  minimalOCamlVersion = "4.14";
+  src = fetchurl {
+    url = "https://github.com/melange-re/${pname}/releases/download/${version}/${pname}-${version}.tbz";
+    inherit hash;
+  };
+  nativeBuildInputs = [
+    cppo
+    makeWrapper
+  ];
+  propagatedBuildInputs = [
+    cmdliner
+    dune-build-info
+    menhirLib
+    ppxlib
+  ];
+  doCheck = true;
+  nativeCheckInputs = [
+    jq
+    merlin
+    nodejs
+    reason
+    tree
+  ];
+  checkInputs = [
+    ounit2
+  ];
+  postInstall = ''
+    wrapProgram "$out/bin/melc" --set MELANGELIB "$OCAMLFIND_DESTDIR/melange/melange:$OCAMLFIND_DESTDIR/melange/js/melange"
+  '';
+  meta = {
+    description = "Toolchain to produce JS from Reason/OCaml";
+    homepage = "https://melange.re/";
+    mainProgram = "melc";
+    license = lib.licenses.lgpl3;
+    maintainers = [
+      lib.maintainers.vog
+    ];
+  };
+}
diff --git a/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch b/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch
index 6023a5934c8f6..478ccb45ff9b7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch
+++ b/pkgs/development/tools/parsing/tree-sitter/fix-paths.patch
@@ -1,11 +1,11 @@
 diff --git a/cli/loader/src/lib.rs b/cli/loader/src/lib.rs
-index 9c1d8dfc..a5cfc74c 100644
+index 4e3effed..74b4d3e3 100644
 --- a/cli/loader/src/lib.rs
 +++ b/cli/loader/src/lib.rs
-@@ -747,7 +747,7 @@ impl Loader {
-             Podman,
+@@ -969,7 +969,7 @@ impl Loader {
          }
  
+         let root_path = root_path.unwrap_or(src_path);
 -        let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };
 +        let emcc_name = if cfg!(windows) { "emcc.bat" } else { "@emcc@" };
  
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 860fcb1cc0a48..e6225bcd82969 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -12,8 +12,8 @@ let
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
-      version = "9.14.4";
-      hash = "sha256-JqcmtjO2KaP6vaAG9pauQmCVSjYyyAVBEteuiXeeX5o=";
+      version = "9.15.0";
+      hash = "sha256-Caj+MaNP2nBjVGgGGfQAL0zO9trf+TJA0k72yDHw/Sg=";
     };
   };
 
diff --git a/pkgs/servers/sql/postgresql/ext/pg_partman.nix b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
index 19c7efdf70f29..765599e00f1d4 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@@ -2,13 +2,13 @@
 
 buildPostgresqlExtension rec {
   pname = "pg_partman";
-  version = "5.1.0";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner  = "pgpartman";
     repo   = pname;
     rev    = "refs/tags/v${version}";
-    sha256 = "sha256-GrVOJ5ywZMyqyDroYDLdKkXDdIJSDGhDfveO/ZvrmYs=";
+    sha256 = "sha256-DdF1UwfeAM4tlcvdXaiz28JA2UwNwPpXnSw5D9eZDlQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/lix/common.nix b/pkgs/tools/package-management/lix/common.nix
index 2970b421fd5f1..d39ddeda3ab27 100644
--- a/pkgs/tools/package-management/lix/common.nix
+++ b/pkgs/tools/package-management/lix/common.nix
@@ -190,7 +190,7 @@ stdenv.mkDerivation {
     [
       # Enable LTO, since it improves eval performance a fair amount
       # LTO is disabled on static due to strange linking errors
-      (lib.mesonBool "b_lto" (!stdenv.hostPlatform.isStatic))
+      (lib.mesonBool "b_lto" (!stdenv.hostPlatform.isStatic && stdenv.cc.isGNU))
       (lib.mesonEnable "gc" true)
       (lib.mesonBool "enable-tests" true)
       (lib.mesonBool "enable-docs" enableDocumentation)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1e5c6cbacdcd0..d9ab4782024dc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3282,10 +3282,6 @@ with pkgs;
 
   schleuder-cli = callPackage ../tools/security/schleuder/cli { };
 
-  tealdeer = callPackage ../tools/misc/tealdeer {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   teamocil = callPackage ../tools/misc/teamocil { };
 
   tsm-client-withGui = callPackage ../by-name/ts/tsm-client/package.nix { enableGui = true; };
@@ -6966,9 +6962,6 @@ with pkgs;
   cargo-cyclonedx = callPackage ../development/tools/rust/cargo-cyclonedx {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
   };
-  cargo-deadlinks = callPackage ../development/tools/rust/cargo-deadlinks {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
   cargo-edit = callPackage ../development/tools/rust/cargo-edit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -13832,8 +13825,6 @@ with pkgs;
   evolution = callPackage ../applications/networking/mailreaders/evolution/evolution { };
   evolutionWithPlugins = callPackage ../applications/networking/mailreaders/evolution/evolution/wrapper.nix { plugins = [ evolution evolution-ews ]; };
 
-  famistudio = darwin.apple_sdk_11_0.callPackage ../applications/audio/famistudio { };
-
   fdr = libsForQt5.callPackage ../applications/science/programming/fdr { };
 
   fetchmail = callPackage ../applications/misc/fetchmail { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index cb983434a65b0..5691515d8ba56 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1070,6 +1070,8 @@ let
 
     mec = callPackage ../development/ocaml-modules/mec { };
 
+    melange = callPackage ../development/tools/ocaml/melange { };
+
     memprof-limits = callPackage ../development/ocaml-modules/memprof-limits { };
 
     memtrace = callPackage ../development/ocaml-modules/memtrace { };