diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c2c95a58188f..2d6be5bc17c7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11951,6 +11951,13 @@
     name = "André Kugland";
     keys = [ { fingerprint = "6A62 5E60 E3FF FCAE B3AA  50DC 1DA9 3817 80CD D833"; } ];
   };
+  kuglimon = {
+    name = "Tatu Argillander";
+    email = "tatu.argillander@kouralabs.com";
+    github = "kuglimon";
+    githubId = 629430;
+    keys = [ { fingerprint = "2843 750C B1AB E256 94BE  40E2 D843 D30B 42CA 0E2D"; } ];
+  };
   kupac = {
     github = "Kupac";
     githubId = 8224569;
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 195c5259a324..35f5c4070b5a 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -426,9 +426,11 @@ in
             libvirt/qemu/networks/*.xml \
             libvirt/nwfilter/*.xml );
         do
-            mkdir -p /var/lib/$(dirname $i) -m 755
-            if [ ! -e /var/lib/$i ]; then
-              cp -pd ${cfg.package}/var/lib/$i /var/lib/$i
+            # Intended behavior
+            # shellcheck disable=SC2174
+            mkdir -p "/var/lib/$(dirname "$i")" -m 755
+            if [ ! -e "/var/lib/$i" ]; then
+              cp -pd "${cfg.package}/var/lib/$i" "/var/lib/$i"
             fi
         done
 
@@ -440,9 +442,7 @@ in
           ln -s --force "$emulator" /run/${dirName}/nix-emulators/
         done
 
-        for helper in bin/qemu-pr-helper; do
-          ln -s --force ${cfg.qemu.package}/$helper /run/${dirName}/nix-helpers/
-        done
+        ln -s --force ${cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/
 
         ${optionalString cfg.qemu.ovmf.enable (let
           ovmfpackage = pkgs.buildEnv {
diff --git a/nixos/tests/wordpress.nix b/nixos/tests/wordpress.nix
index a2cd48030298..230a75bd0dc0 100644
--- a/nixos/tests/wordpress.nix
+++ b/nixos/tests/wordpress.nix
@@ -67,7 +67,7 @@ rec {
       networking.hosts."127.0.0.1" = [ "site1.local" "site2.local" ];
     };
   }) {} [
-    "6_5" "6_6"
+    "6_6"
   ];
 
   testScript = ''
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d4a65be7953e..96b0bba1a291 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4554,8 +4554,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "4.0.15";
-          hash = "sha256-Zow0laXwORa3V5Hy40pWDa/+Xq7kQbgn/Ia6PrJxI6E=";
+          version = "4.0.16";
+          hash = "sha256-1GH3liiExURy5e6owSRr5UJ7UXa8KUgglIzfGsSPARg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index fd45ff16d257..df5a20318a2e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -50,13 +50,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-39";
+  version = "7.1.1-40";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-3NUl0q/j3dBdNBtLH+69vh0elobBnTOvqQpC/2KwGBU=";
+    hash = "sha256-NrTIx1OvwPIeVlA39hGkXZ2Atk4FCsU3/55SZeSc40E=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/build-support/xen/default.nix b/pkgs/build-support/xen/default.nix
index 9964f0386f6e..fa40fdc6d066 100644
--- a/pkgs/build-support/xen/default.nix
+++ b/pkgs/build-support/xen/default.nix
@@ -7,7 +7,6 @@
   testers,
   which,
   fetchgit,
-  fetchpatch,
 
   # Xen
   acpica-tools,
@@ -65,7 +64,6 @@
   withSeaBIOS ? true,
   withOVMF ? true,
   withIPXE ? true,
-  useDefaultPatchList ? true,
   rev,
   hash,
   patches ? [ ],
@@ -73,116 +71,26 @@
 }:
 
 let
-  # Inherit helper functions from lib and builtins.
-  inherit (builtins) elemAt isAttrs;
+  inherit (lib.meta) getExe';
+  inherit (lib.lists) optional optionals;
+  inherit (lib.systems.inspect.patterns) isLinux isAarch64;
+  inherit (lib) teams;
   inherit (lib.strings)
-    concatLines
     enableFeature
     makeSearchPathOutput
     optionalString
-    removeSuffix
     versionOlder
     ;
-  inherit (lib.platforms) linux aarch64;
-  inherit (lib) teams;
   inherit (lib.licenses)
     cc-by-40
     gpl2Only
     lgpl21Only
     mit
     ;
-  inherit (lib.meta) getExe';
-  inherit (lib.lists)
-    count
-    flatten
-    optional
-    optionals
-    range
-    remove
-    zipListsWith
-    ;
-  inherit (lib.attrsets) attrByPath;
 
   # Mark versions older than minSupportedVersion as EOL.
   minSupportedVersion = "4.16";
 
-  ## Generic Patch Handling ##
-
-  upstreamPatches = import ./patches.nix {
-    inherit lib fetchpatch;
-  };
-
-  upstreamPatchList = flatten (
-    with upstreamPatches;
-    [
-      QUBES_REPRODUCIBLE_BUILDS
-      XSA_460
-      XSA_461
-      XSA_462
-    ]
-  );
-
-  ## XSA Patches Description Builder ##
-
-  # Simple counter for the number of attrsets (patches) in the patches list after normalisation.
-  numberOfPatches = count (patch: isAttrs patch) upstreamPatchList;
-
-  # builtins.elemAt's index begins at 0, so we subtract 1 from the number of patches in order to
-  # produce the range that will be used in the following builtin.map calls.
-  availablePatchesToTry = range 0 (numberOfPatches - 1);
-
-  # Takes in an attrByPath input, and outputs the attribute value for each patch in a list.
-  # If a patch does not have a given attribute, returns `null`. Use lib.lists.remove null
-  # to remove these junk values, if necessary.
-  retrievePatchAttributes =
-    attributeName:
-    map (x: attrByPath attributeName null (elemAt upstreamPatchList x)) availablePatchesToTry;
-
-  # Produces a list of newline-separated strings that lists the vulnerabilities this
-  # Xen is NOT affected by, due to the applied Xen Security Advisory patches. This is
-  # then used in meta.longDescription, to let users know their Xen is patched against
-  # known vulnerabilities, as the package version isn't always the best indicator.
-  #
-  # Produces something like this: (one string for each XSA)
-  #  * [Xen Security Advisory #1](https://xenbits.xenproject.org/xsa/advisory-1.html): **Title for XSA.**
-  #  >Description of issue in XSA
-  #Extra lines
-  #are not indented,
-  #but markdown should be
-  #fine with it.
-  #  Fixes:
-  #  * [CVE-1999-00001](https://www.cve.org/CVERecord?id=CVE-1999-00001)
-  #  * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002)
-  #  * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003)
-  writeAdvisoryDescription =
-    if (remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then
-      zipListsWith (a: b: a + b)
-        (zipListsWith (a: b: a + "**" + b + ".**\n  >")
-          (zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ")
-            (remove null (retrievePatchAttributes [ "xsa" ]))
-            (
-              remove null (retrievePatchAttributes [
-                "meta"
-                "homepage"
-              ])
-            )
-          )
-          (
-            remove null (retrievePatchAttributes [
-              "meta"
-              "description"
-            ])
-          )
-        )
-        (
-          remove null (retrievePatchAttributes [
-            "meta"
-            "longDescription"
-          ])
-        )
-    else
-      [ ];
-
   #TODO: fix paths instead.
   scriptEnvPath = makeSearchPathOutput "out" "bin" [
     bridge-utils
@@ -204,10 +112,8 @@ let
 in
 
 stdenv.mkDerivation (finalAttrs: {
-  inherit pname version;
+  inherit pname version patches;
 
-  # TODO: Split $out in $bin for binaries and $lib for libraries.
-  # TODO: Python package to be in separate output/package.
   outputs = [
     "out"
     "man"
@@ -216,14 +122,11 @@ stdenv.mkDerivation (finalAttrs: {
     "boot"
   ];
 
-  # Main Xen source.
   src = fetchgit {
     url = "https://xenbits.xenproject.org/git-http/xen.git";
     inherit rev hash;
   };
 
-  patches = optionals useDefaultPatchList upstreamPatchList ++ patches;
-
   nativeBuildInputs = [
     autoPatchelfHook
     bison
@@ -264,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-system-qemu"
     (if withSeaBIOS then "--with-system-seabios=${systemSeaBIOS.firmware}" else "--disable-seabios")
     (if withOVMF then "--with-system-ovmf=${OVMF.firmware}" else "--disable-ovmf")
-    (if withIPXE then "--with-system-ipxe=${ipxe}" else "--disable-ipxe")
+    (if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
     (enableFeature withFlask "xsmpolicy")
   ];
 
@@ -435,14 +338,7 @@ stdenv.mkDerivation (finalAttrs: {
       + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package."
       + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
       + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
-      + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains."
-      # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to.
-      # This will hopefully give users the peace of mind that their Xen is secure, without needing
-      # to search the source code for the XSA patches.
-      + optionalString (writeAdvisoryDescription != [ ]) (
-        "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n"
-        + removeSuffix "\n" (concatLines writeAdvisoryDescription)
-      );
+      + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains.";
 
     homepage = "https://xenproject.org/";
     downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
@@ -464,8 +360,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mainProgram = "xl";
 
-    #TODO: Migrate meta.platforms to the new lib.systems.inspect.patterns.* format.
-    platforms = linux;
-    badPlatforms = aarch64;
+    platforms = [ isLinux ];
+    badPlatforms = [ isAarch64 ];
   } // meta;
 })
diff --git a/pkgs/build-support/xen/patches.nix b/pkgs/build-support/xen/patches.nix
deleted file mode 100644
index 7b8395154f28..000000000000
--- a/pkgs/build-support/xen/patches.nix
+++ /dev/null
@@ -1,156 +0,0 @@
-# Patching Xen? Check the XSAs at https://xenbits.xen.org/xsa/
-# and try applying all the ones we haven't gotten around to
-# yet, if any are necessary. Patches from other downstreams
-# are also welcome if they fix important issues with vanilla Xen.
-
-{ lib, fetchpatch }:
-
-let
-  inherit (builtins) concatStringsSep;
-  inherit (lib.strings) optionalString concatMapStrings;
-
-  xsaPatch =
-    {
-      id,
-      title,
-      description,
-      type ? "xsa",
-      hash ? "",
-      cve ? null,
-    }:
-    (fetchpatch {
-      name = "XSA-" + id + optionalString (cve != null) ("-" + concatStringsSep "+" cve);
-      url = "https://xenbits.xen.org/xsa/xsa${id}.patch";
-      inherit hash;
-      passthru = {
-        xsa = id;
-        inherit type;
-      };
-      meta = {
-        description = title;
-        longDescription =
-          description
-          + "\n"
-          + (
-            if (cve == null) then
-              # Why the two spaces preceding these CVE messages?
-              # This is parsed by writeAdvisoryDescription in generic.nix,
-              # and doing this was easier than messing with lib.strings even more.
-              "  _No CVE was assigned to this XSA._"
-            else
-              "  Fixes:${
-                  concatMapStrings (x: "\n  * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")") cve
-                }"
-          );
-        homepage = "https://xenbits.xenproject.org/xsa/advisory-${id}.html";
-      };
-    });
-  qubesPatch =
-    {
-      name,
-      tag,
-      type ? "qubes",
-      hash ? "",
-    }:
-    (fetchpatch {
-      inherit name;
-      url = "https://raw.githubusercontent.com/QubesOS/qubes-vmm-xen/v${tag}/${name}.patch";
-      inherit hash;
-      passthru.type = type;
-    });
-in
-{
-  # Example patches:
-  #
-  # "XSA_100" = xsaPatch {
-  #   id = "100";
-  #   title = "Verbatim Title of XSA";
-  #   description = ''
-  #     Verbatim description of XSA.
-  #   '';
-  #   cve = [ "CVE-1999-0001" "CVE-1999-0002" ]; # Not all XSAs have CVEs. This attribute is optional.
-  #   hash = "sha256-0000000000000000000000000000000000000000000000000000";
-  # };
-  #
-  # "QUBES_libxl-fix-all-issues" = qubesPatch {
-  #   name = "1000-libxl-fix-all-issues";
-  #   tag = "4.20.0-1";
-  #   hash = "sha256-0000000000000000000000000000000000000000000000000000";
-  # };
-
-  # Build reproducibility patches for Xen.
-  # Qubes OS has not updated them to later versions of Xen yet,
-  # but they appear to work on Xen 4.17.4 - 4.19.0.
-  QUBES_REPRODUCIBLE_BUILDS = [
-    (qubesPatch {
-      name = "1100-Define-build-dates-time-based-on-SOURCE_DATE_EPOCH";
-      tag = "4.17.4-5";
-      hash = "sha256-OwKA9oPTwhRcSmiOb+PxzifbO/IG8IHWlvddFh/nP6s=";
-    })
-    (qubesPatch {
-      name = "1101-docs-rename-DATE-to-PANDOC_REL_DATE-and-allow-to-spe";
-      tag = "4.17.4-5";
-      hash = "sha256-BUtYt0mM3bURVaGv4oDznzxx1Wo4sfOpGV5GB8qc5Ns=";
-    })
-    (qubesPatch {
-      name = "1102-docs-xen-headers-use-alphabetical-sorting-for-incont";
-      tag = "4.17.4-5";
-      hash = "sha256-mQUp2w9lUb7KDq5MuPQjs6y7iuMDeXoZjDjlXfa5z44=";
-    })
-  ];
-
-  # Xen Security Advisory #460: (4.16.6 - 4.19.0)
-  "XSA_460" = xsaPatch {
-    id = "460";
-    title = "Error handling in x86 IOMMU identity mapping";
-    description = ''
-      Certain PCI devices in a system might be assigned Reserved Memory
-      Regions (specified via Reserved Memory Region Reporting, "RMRR") for
-      Intel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used
-      for platform tasks such as legacy USB emulation.
-      Since the precise purpose of these regions is unknown, once a device
-      associated with such a region is active, the mappings of these regions
-      need to remain continuouly accessible by the device.  In the logic
-      establishing these mappings, error handling was flawed, resulting in
-      such mappings to potentially remain in place when they should have been
-      removed again.  Respective guests would then gain access to memory
-      regions which they aren't supposed to have access to.
-    '';
-    cve = [ "CVE-2024-31145" ];
-    hash = "sha256-3q4nAP2xGEptX6BIpSlALOt2r0kjj1up5pF3xCFp+l0=";
-  };
-  # Xen Security Advisory #461: (4.16.6 - 4.19.0)
-  "XSA_461" = xsaPatch {
-    id = "461";
-    title = "PCI device pass-through with shared resources";
-    description = ''
-      When multiple devices share resources and one of them is to be passed
-      through to a guest, security of the entire system and of respective
-      guests individually cannot really be guaranteed without knowing
-      internals of any of the involved guests.  Therefore such a configuration
-      cannot really be security-supported, yet making that explicit was so far
-      missing.
-    '';
-    cve = [ "CVE-2024-31146" ];
-    hash = "sha256-JQWoqf47hy9WXNkVC/LgmjUhkxN0SBF6w8PF4aFZxhM=";
-  };
-  # Xen Security Advisory #462: (4.16.6 - 4.19.0)
-  "XSA_462" = xsaPatch {
-    id = "462";
-    title = "x86: Deadlock in vlapic_error()";
-    description = ''
-      In x86's APIC (Advanced Programmable Interrupt Controller) architecture,
-      error conditions are reported in a status register.  Furthermore, the OS
-      can opt to receive an interrupt when a new error occurs.
-      It is possible to configure the error interrupt with an illegal vector,
-      which generates an error when an error interrupt is raised.
-      This case causes Xen to recurse through vlapic_error().  The recursion
-      itself is bounded; errors accumulate in the the status register and only
-      generate an interrupt when a new status bit becomes set.
-      However, the lock protecting this state in Xen will try to be taken
-      recursively, and deadlock.
-    '';
-    cve = [ "CVE-2024-45817" ];
-    hash = "sha256-01lzjaT2f69UfEdTUCkm92DDOmd+Mo8sNPZsHJfgJEM=";
-  };
-}
diff --git a/pkgs/by-name/fc/fcast-client/package.nix b/pkgs/by-name/fc/fcast-client/package.nix
index 9f9277fed327..bd6cb675a3f4 100644
--- a/pkgs/by-name/fc/fcast-client/package.nix
+++ b/pkgs/by-name/fc/fcast-client/package.nix
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
       implementations, enabling third-party developers to create their own
       receiver devices or integrate the FCast protocol into their own apps.
     '';
-    mainProgram = "fcast-client";
+    mainProgram = "fcast";
     maintainers = with lib.maintainers; [ drupol ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index 809e5133d820..5a2e8d0bdfdc 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "fzf";
-  version = "0.56.0";
+  version = "0.56.2";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf";
     rev = "v${version}";
-    hash = "sha256-HG2GQwic1wJ0OiCinBEZ1wfjqXuq37udEpBwLt7LIA0=";
+    hash = "sha256-POSploJmwMA3ZTYtQh3k45gaumG1dsuyyGn4CRO4qfY=";
   };
 
-  vendorHash = "sha256-dsQyoSJQT5PwhZ/anth5YjNXf6ZubrCza6kXWZJ3DgA=";
+  vendorHash = "sha256-4VAAka9FvKuoDZ1E1v9Es3r00GZeG8Jp4pJONYpB/t8=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index baf3e92a60b0..c69a99e60566 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -14,6 +14,7 @@
   embedScript ? null,
   additionalTargets ? { },
   additionalOptions ? [ ],
+  firmwareBinary ? "ipxe.efirom",
 }:
 
 let
@@ -130,8 +131,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
+  passthru = {
+    firmware = "${finalAttrs.finalPackage}/${firmwareBinary}";
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/ku/kubectl-klock/package.nix b/pkgs/by-name/ku/kubectl-klock/package.nix
index f04f5034fb82..60d13317d661 100644
--- a/pkgs/by-name/ku/kubectl-klock/package.nix
+++ b/pkgs/by-name/ku/kubectl-klock/package.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kubectl-klock";
-  version = "0.7.0";
+  version = "0.7.2";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -10,20 +10,20 @@ buildGoModule rec {
     owner = "applejag";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MmsHxB15gCz2W2QLC6E7Ao+9iLyVaYJatUgPcMuL79M=";
+    hash = "sha256-S7cpVRVboLkU+GgvwozJmfFAO29tKpPlk+r9mbVLxF8=";
   };
 
-  vendorHash = "sha256-lhawUcjB2EULpAFjBM4tdmDo08za2DfyZUvEPo4+LXE=";
+  vendorHash = "sha256-xz1I79FklKNpWdoQdzpXYAnKM+7FJcGn04lKH2E9A50=";
 
   postInstall = ''
     makeWrapper $out/bin/kubectl-klock $out/bin/kubectl_complete-klock --add-flags __complete
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Kubectl plugin to render watch output in a more readable fashion";
     homepage = "https://github.com/applejag/kubectl-klock";
     changelog = "https://github.com/applejag/kubectl-klock/releases/tag/v${version}";
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.scm2342 ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ scm2342 applejag ];
   };
 }
diff --git a/pkgs/by-name/mi/microcode-intel/package.nix b/pkgs/by-name/mi/microcode-intel/package.nix
index 8758051500df..46769b79174f 100644
--- a/pkgs/by-name/mi/microcode-intel/package.nix
+++ b/pkgs/by-name/mi/microcode-intel/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20241029";
+  version = "20241112";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-iS7OSWjAYBRHP7X1C+DiMwX2xudA6tXX6cEv/IcICxc=";
+    hash = "sha256-dvXt4SX/90oFM4GR9R7C2udhZ+plxnabOZpbtwN3V8Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/miniflux/package.nix b/pkgs/by-name/mi/miniflux/package.nix
index 457c22e7d243..09e7c4f6927d 100644
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     rev = "refs/tags/${version}";
-    hash = "sha256-FAeUhB05mDcdlHzJRLJR9mSKeqpKWed4Kxa89j/pjOQ=";
+    hash = "sha256-B/joQJ64/NPiZo1JEAhcrHLQ67m1oVTbmBk3drZ8lC4=";
   };
 
-  vendorHash = "sha256-FVm6kTZFp6qSUUuB2R4owzSxk+zfBWW1o7kOFadSS38=";
+  vendorHash = "sha256-hzgfuwewJDIz/iaBU3lyB2/mAxYGTWsKkaqAiCkPQQ0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -35,7 +35,7 @@ buildGoModule rec {
     description = "Minimalist and opinionated feed reader";
     homepage = "https://miniflux.app/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ rvolosatovs benpye emilylange ];
+    maintainers = with maintainers; [ rvolosatovs benpye emilylange adamcstephens ];
     mainProgram = "miniflux";
   };
 }
diff --git a/pkgs/by-name/re/remarshal_0_17/package.nix b/pkgs/by-name/re/remarshal_0_17/package.nix
new file mode 100644
index 000000000000..1a178a236e0e
--- /dev/null
+++ b/pkgs/by-name/re/remarshal_0_17/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  fetchPypi,
+}:
+
+let
+  python = python3Packages.python.override {
+    self = python3Packages.python;
+    packageOverrides = self: super: {
+      tomlkit = super.tomlkit.overridePythonAttrs (oldAttrs: rec {
+        version = "0.12.5";
+        src = fetchPypi {
+          pname = "tomlkit";
+          inherit version;
+          hash = "sha256-7vNPujmDTU1rc8m6fz5NHEF6Tlb4mn6W4JDdDSS4+zw=";
+        };
+      });
+    };
+  };
+  pythonPackages = python.pkgs;
+in
+pythonPackages.buildPythonApplication rec {
+  pname = "remarshal";
+  version = "0.17.1"; # last version with YAML 1.1 support, do not update
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dbohdan";
+    repo = "remarshal";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2WxMh5P/8NvElymnMU3JzQU0P4DMXFF6j15OxLaS+VA=";
+  };
+
+  pythonRemoveDeps = [ "pytest" ];
+
+  build-system = [ pythonPackages.poetry-core ];
+
+  dependencies = with pythonPackages; [
+    cbor2
+    colorama
+    python-dateutil
+    pyyaml
+    rich-argparse
+    ruamel-yaml
+    tomlkit
+    u-msgpack-python
+  ];
+
+  nativeCheckInputs = [ pythonPackages.pytestCheckHook ];
+
+  passthru.updateScript = throw "This package is pinned to 0.17.1 for YAML 1.1 support";
+
+  meta = with lib; {
+    changelog = "https://github.com/remarshal-project/remarshal/releases/tag/v${version}";
+    description = "Convert between TOML, YAML and JSON";
+    license = licenses.mit;
+    homepage = "https://github.com/dbohdan/remarshal";
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/rp/rpm-sequoia/package.nix b/pkgs/by-name/rp/rpm-sequoia/package.nix
index d3ecf9fa91f6..4718e8c6c876 100644
--- a/pkgs/by-name/rp/rpm-sequoia/package.nix
+++ b/pkgs/by-name/rp/rpm-sequoia/package.nix
@@ -55,13 +55,17 @@ rustPlatform.buildRustPackage rec {
     ''
     +
       # Dependents will rely on the versioned symlinks
-      ''
+      lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
         install -d $out/lib
         find target/release/ \
           -maxdepth 1 \
           -type l -name 'librpm_sequoia.*' \
           -exec cp --no-dereference {} $out/lib/ \;
-      '';
+      ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install -d $out/lib
+      ln -s librpm_sequoia.dylib $out/lib/librpm_sequoia.${version}.dylib
+    '';
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ta/taterclient-ddnet/package.nix b/pkgs/by-name/ta/taterclient-ddnet/package.nix
index 95799e7b64fb..9c912e0799e1 100644
--- a/pkgs/by-name/ta/taterclient-ddnet/package.nix
+++ b/pkgs/by-name/ta/taterclient-ddnet/package.nix
@@ -34,18 +34,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taterclient-ddnet";
-  version = "8.6.0";
+  version = "8.6.1";
 
   src = fetchFromGitHub {
     owner = "sjrc6";
     repo = "taterclient-ddnet";
     rev = finalAttrs.version;
-    hash = "sha256-IfTQRMC2wcEH+KhlADHVIhfavlTN4mfTtlN5+/KojA0=";
+    hash = "sha256-6LYXPYunhPhF9snkZLEEq7zDmyaaObb/DEqdthbcpuw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-L6NsLC5hg4/MlTfnOITBNoPIoKxlDx5BwXWnV7W4uT0=";
+    hash = "sha256-1T3Zza7nYKDW8pAJDUUWjw6Vh+dfHb11WsNk1dLyWMI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 8081be8cc9c1..4199b7c1a967 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-SS2PPniO3zSfDyCy3aM41Jq8HlOuIQj4hFUx7tUlOzM=";
-    "x86_64-linux" = "sha256-sE0P8mLvz8V45z2qGP4cAlzow58lc483+dDIbOwvC0Y=";
-    "aarch64-linux" = "sha256-W8AWgG86/MFM/xpxEIjkjeVWsCN0Mjme60geusFwMRo=";
+    "universal-macos" = "sha256-crTcTPbP4+YqeCnrk4qFGsBiPCgsQc32HK6jyb4+FOU=";
+    "x86_64-linux" = "sha256-92Qg2kVuT7RRQzcEuduETcFhI7oiIiCXPyAbAj4MhVg=";
+    "aarch64-linux" = "sha256-jztdl3gLJarUBxIAl1yzLd7cMJQEYrcjERJwRlsmxqs=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.8";
+  version = "0.16.12";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
new file mode 100644
index 000000000000..2ffe125b0378
--- /dev/null
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -0,0 +1,93 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nodejs_22,
+  gitMinimal,
+  pnpm_8,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vtsls";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "yioneko";
+    repo = "vtsls";
+    rev = "server-v${finalAttrs.version}";
+    hash = "sha256-HCi9WLh4IEfhgkQNUVk6IGkQfYagg805Rix78zG6xt0=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    nodejs_22
+    # patches are applied with git during build
+    gitMinimal
+    pnpm_8.configHook
+  ];
+
+  buildInputs = [ nodejs_22 ];
+
+  pnpmWorkspaces = [ "@vtsls/language-server" ];
+
+  pnpmDeps = pnpm_8.fetchDeps {
+    inherit (finalAttrs)
+      pnpmWorkspaces
+      pname
+      src
+      version
+      ;
+    hash = "sha256-4XxQ0Z2atTBItrD9iY7q5rJaCmb1EeDBvQ5+L3ceRXI=";
+  };
+
+  # Patches to get submodule sha from file instead of 'git submodule status'
+  patches = [ ./vtsls-build-patch.patch ];
+
+  # Skips manual confirmations during build
+  CI = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    # During build vtsls needs a working git installation.
+    git config --global user.name nixbld
+    git config --global user.email nixbld@example.com
+
+    # during build this sha is used as a marker to skip applying patches and
+    # copying files, which doesn't matter in this case
+    echo "dummysha" > ./packages/service/HEAD
+
+    # Requires a git repository during build
+    git init packages/service/vscode
+
+    # Depends on the @vtsls/language-service workspace
+    # '--workspace-concurrency=1' helps debug failing builds.
+    pnpm --filter "@vtsls/language-server..." build
+
+    # These trash deterministic builds. During build the whole directory is
+    # copied to another path.
+    rm -rf packages/service/vscode/.git
+    rm -rf packages/service/src/typescript-language-features/.git
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib/vtsls-language-server}
+    cp -r {packages,node_modules} $out/lib/vtsls-language-server
+    ln -s $out/lib/vtsls-language-server/packages/server/bin/vtsls.js $out/bin/vtsls
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "LSP wrapper for typescript extension of vscode.";
+    homepage = "https://github.com/yioneko/vtsls";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kuglimon ];
+    mainProgram = "vtsls";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/vt/vtsls/vtsls-build-patch.patch b/pkgs/by-name/vt/vtsls/vtsls-build-patch.patch
new file mode 100644
index 000000000000..1d694c75bde1
--- /dev/null
+++ b/pkgs/by-name/vt/vtsls/vtsls-build-patch.patch
@@ -0,0 +1,18 @@
+diff --git a/packages/service/scripts/patch.js b/packages/service/scripts/patch.js
+index 2d01f3a..f26c216 100644
+--- a/packages/service/scripts/patch.js
++++ b/packages/service/scripts/patch.js
+@@ -13,11 +13,7 @@ const vscTsExtPath = path.resolve(__dirname, "../vscode/extensions/typescript-la
+ const tsExtPath = path.resolve(__dirname, "../src/typescript-language-features");
+
+ async function getVscodeSha() {
+-  const { stdout } = await exec("git", ["submodule", "status", "vscode"], {
+-    cwd: path.resolve(__dirname, "../"),
+-  });
+-  const commit = stdout.match(/^\s*([^\s]+)\s/)[1];
+-  return commit;
++  return await fs.readFile('./HEAD', { encoding: 'utf8' });
+ }
+
+ /**
+
diff --git a/pkgs/by-name/ws/wstunnel/Cargo.lock b/pkgs/by-name/ws/wstunnel/Cargo.lock
index 7339e0e99303..bc1b8a289775 100644
--- a/pkgs/by-name/ws/wstunnel/Cargo.lock
+++ b/pkgs/by-name/ws/wstunnel/Cargo.lock
@@ -56,9 +56,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.15"
+version = "0.6.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64e15c1ab1f89faffbf04a634d5e1962e9074f2741eef6d97f3c4e322426d526"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -71,43 +71,43 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb47de1e80c2b463c735db5b217a0ddc39d612e7ac9e2e96a5aed1f57616c1cb"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d36fc52c7f6c869915e99412912f22093507da8d9e942ceaf66fe4b7c14422a"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.4"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
 dependencies = [
  "anstyle",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.89"
+version = "1.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86fdf8605db99b54d3cd748a44c6d04df638eb5dafb219b135d0149bd0db01f6"
+checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775"
 
 [[package]]
 name = "arc-swap"
@@ -246,9 +246,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "bb8"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b10cf871f3ff2ce56432fddc2615ac7acc3aa22ca321f8fea800846fbb32f188"
+checksum = "d89aabfae550a5c44b43ab941844ffcd2e993cb6900b342debf59e9ea74acdb8"
 dependencies = [
  "async-trait",
  "futures-util",
@@ -322,7 +322,7 @@ dependencies = [
  "hyperlocal",
  "log",
  "pin-project-lite",
- "rustls 0.23.14",
+ "rustls 0.23.16",
  "rustls-native-certs 0.7.3",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
@@ -364,15 +364,15 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.7.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "428d9aa8fbc0670b7b8d6030a7fadd0f86151cae55e4dbbece15f3780a3dfaf3"
+checksum = "9ac0150caa2ae65ca5bd83f25c7de183dea78d4d366469f148435e2acfbad0da"
 
 [[package]]
 name = "cc"
-version = "1.1.30"
+version = "1.1.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b16803a61b81d9eabb7eae2588776c4c1e584b738ede45fdbb4c972cec1e9945"
+checksum = "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
 dependencies = [
  "jobserver",
  "libc",
@@ -475,9 +475,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "concurrent-queue"
@@ -513,15 +513,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.20"
@@ -536,7 +527,7 @@ checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
 dependencies = [
  "bitflags 2.6.0",
  "crossterm_winapi",
- "mio 1.0.2",
+ "mio",
  "parking_lot",
  "rustix",
  "signal-hook",
@@ -765,6 +756,16 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "fdlimit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e182f7dbc2ef73d9ef67351c5fbbea084729c48362d3ce9dd44c28e32e277fe5"
+dependencies = [
+ "libc",
+ "thiserror",
+]
+
 [[package]]
 name = "filetime"
 version = "0.2.25"
@@ -977,9 +978,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
+checksum = "3a9bfc1af68b1726ea47d3d5109de126281def866b33970e10fbab11b5dafab3"
 
 [[package]]
 name = "heck"
@@ -1133,9 +1134,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+checksum = "bbbff0a806a4728c99295b254c8838933b5b082d75e3cb70c8dab21fdfbcfa9a"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1177,7 +1178,7 @@ dependencies = [
  "http 1.1.0",
  "hyper",
  "hyper-util",
- "rustls 0.23.14",
+ "rustls 0.23.16",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.0",
@@ -1186,9 +1187,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.9"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
+checksum = "df2dcfbe0677734ab2f3ffa7fa7bfd4706bfdc1ef393f2ee30184aed67e631b4"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1241,6 +1242,124 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -1259,12 +1378,23 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.5.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
 ]
 
 [[package]]
@@ -1285,15 +1415,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.0",
+ "hashbrown 0.15.1",
  "serde",
 ]
 
 [[package]]
 name = "inotify"
-version = "0.9.6"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+checksum = "fdd168d97690d0b8c412d6b6c10360277f4d7ee495c5d0d5d5fe0854923255cc"
 dependencies = [
  "bitflags 1.3.2",
  "inotify-sys",
@@ -1309,6 +1439,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "ipconfig"
 version = "0.3.2"
@@ -1416,9 +1555,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.159"
+version = "0.2.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
 
 [[package]]
 name = "libloading"
@@ -1453,6 +1592,12 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
+[[package]]
+name = "litemap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+
 [[package]]
 name = "lock_api"
 version = "0.4.12"
@@ -1523,18 +1668,6 @@ dependencies = [
  "adler2",
 ]
 
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.0.2"
@@ -1579,21 +1712,30 @@ dependencies = [
 
 [[package]]
 name = "notify"
-version = "6.1.1"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+checksum = "c533b4c39709f9ba5005d8002048266593c1cfaf3c5f0739d5b8ab0c6c504009"
 dependencies = [
  "bitflags 2.6.0",
- "crossbeam-channel",
  "filetime",
  "fsevent-sys",
  "inotify",
  "kqueue",
  "libc",
  "log",
- "mio 0.8.11",
+ "mio",
+ "notify-types",
  "walkdir",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "notify-types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7393c226621f817964ffb3dc5704f9509e107a8b024b489cc2c1b217378785df"
+dependencies = [
+ "instant",
 ]
 
 [[package]]
@@ -1753,18 +1895,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.6"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf123a161dde1e524adf36f90bc5d8d3462824a9c43553ad07a8183161189ec"
+checksum = "be57f64e946e500c8ee36ef6331845d40a93055567ec57e8fae13efd33759b95"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.6"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4502d8515ca9f32f1fb543d987f63d95a14934883db45bdb48060b6b69257f8"
+checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1773,9 +1915,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
 
 [[package]]
 name = "pin-utils"
@@ -1809,9 +1951,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.22"
+version = "0.2.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479cf940fbbb3426c32c5d5176f62ad57549a0bb84773423ba8be9d089f5faba"
+checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -1819,9 +1961,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.87"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3e4daa0dcf6feba26f985457cdf104d4b4256fc5a09547140f3631bb076b19a"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
 dependencies = [
  "unicode-ident",
 ]
@@ -1904,9 +2046,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1994,9 +2136,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.37"
+version = "0.38.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
+checksum = "375116bee2be9ed569afe2154ea6a99dfdffd257f533f187498c2a8f5feaf4ee"
 dependencies = [
  "bitflags 2.6.0",
  "errno",
@@ -2019,9 +2161,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.14"
+version = "0.23.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "415d9944693cb90382053259f89fbb077ea730ad7273047ec63b19bc9b160ba8"
+checksum = "eee87ff5d9b36712a58574e12e9f0ea80f915a5b0ac518d322b24a465617925e"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -2091,9 +2233,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e696e35370c65c9c541198af4543ccd580cf17fc25d8e05c5a242b202488c55"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
 
 [[package]]
 name = "rustls-webpki"
@@ -2172,9 +2314,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.12.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea4a292869320c0272d7bc55a5a6aafaff59b4f63404a003887b679a2e05b4b6"
+checksum = "fa39c7303dc58b5543c94d22c1766b0d31f2ee58306363ea622b10bbc075eaa2"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2182,18 +2324,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.210"
+version = "1.0.214"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+checksum = "f55c3193aca71c12ad7890f1785d2b73e1b9f63a0bbc353c08ef26fe03fc56b5"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.210"
+version = "1.0.214"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2202,9 +2344,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.128"
+version = "1.0.132"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
 dependencies = [
  "itoa",
  "memchr",
@@ -2331,7 +2473,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34db1a06d485c9142248b7a054f034b349b212551f3dfd19c94d45a754a217cd"
 dependencies = [
  "libc",
- "mio 1.0.2",
+ "mio",
  "signal-hook",
 ]
 
@@ -2381,6 +2523,12 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -2418,9 +2566,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.79"
+version = "2.0.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
+checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2469,18 +2617,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.64"
+version = "1.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
+checksum = "02dd99dc800bbb97186339685293e1cc5d9df1f8fae2d0aecd9ff1c77efea892"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.64"
+version = "1.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
+checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2530,6 +2678,16 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tinyvec"
 version = "1.8.0"
@@ -2547,14 +2705,14 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.40.0"
+version = "1.41.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
+checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33"
 dependencies = [
  "backtrace",
  "bytes",
  "libc",
- "mio 1.0.2",
+ "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
@@ -2600,7 +2758,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
- "rustls 0.23.14",
+ "rustls 0.23.16",
  "rustls-pki-types",
  "tokio",
 ]
@@ -2766,12 +2924,12 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.2"
+version = "2.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+checksum = "8d157f1b96d14500ffdc1f10ba712e780825526c03d9a49b4d0324b0d9113ada"
 dependencies = [
  "form_urlencoded",
- "idna 0.5.0",
+ "idna 1.0.3",
  "percent-encoding",
  "serde",
 ]
@@ -2788,6 +2946,18 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -2796,9 +2966,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
+checksum = "f8c5f0a0af699448548ad1a2fbf920fb4bee257eae39953ba95cb84891a0446a"
 dependencies = [
  "getrandom",
  "serde",
@@ -3112,9 +3282,21 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
 [[package]]
 name = "wstunnel"
-version = "10.1.5"
+version = "10.1.6"
 dependencies = [
  "ahash",
  "anyhow",
@@ -3128,6 +3310,7 @@ dependencies = [
  "crossterm",
  "fast-socks5",
  "fastwebsockets",
+ "fdlimit",
  "futures-util",
  "hickory-resolver",
  "http-body-util",
@@ -3201,6 +3384,30 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "yoke"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.35"
@@ -3222,8 +3429,51 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
+[[package]]
+name = "zerovec"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index b2b5e42062dc..5776a400be80 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -6,11 +6,10 @@
   nixosTests,
   nix-update-script,
   versionCheckHook,
-  darwin,
 }:
 
 let
-  version = "10.1.5";
+  version = "10.1.6";
 in
 
 rustPlatform.buildRustPackage {
@@ -21,7 +20,7 @@ rustPlatform.buildRustPackage {
     owner = "erebe";
     repo = "wstunnel";
     rev = "v${version}";
-    hash = "sha256-MomT9iwIsdou7lIfI7zBU9nEjjYGcsHKTlrYbK4p3BQ=";
+    hash = "sha256-ufssj7m5mly2B33e1DWY2e6AH0zTPh3SozYc663QjJ4=";
   };
 
   cargoLock = {
@@ -32,9 +31,6 @@ rustPlatform.buildRustPackage {
   };
 
   nativeBuildInputs = [ versionCheckHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
 
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 6f527cda1e7b..8c574d141ad4 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -5,7 +5,7 @@
 
 buildXenPackage.override { inherit python3Packages; } {
   pname = "xen";
-  version = "4.19.0";
-  rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239";
-  hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q=";
+  version = "4.19.0-unstable-2024-11-12";
+  rev = "251a9496485a86f302980a3f8d3c656831b5a62f";
+  hash = "sha256-kHuB6kagH3AU+Wsx4oD7HnNsZpxCu7x3v/m4/1xi6lY=";
 }
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index d4b727bd50d2..453013cdbd27 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -44,6 +44,8 @@ let
       cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
     '' + (lib.optionalString (lib.versionAtLeast release_version "14") ''
       cp -r ${monorepoSrc}/third-party "$out"
+    '') + (lib.optionalString (lib.versionAtLeast release_version "20") ''
+      cp -r ${monorepoSrc}/libc "$out"
     '') + ''
       cp -r ${monorepoSrc}/runtimes "$out"
     '' + (lib.optionalString (cxxabi == null) ''
diff --git a/pkgs/development/python-modules/docling-core/default.nix b/pkgs/development/python-modules/docling-core/default.nix
index b790ca13ab86..1b831fdaa834 100644
--- a/pkgs/development/python-modules/docling-core/default.nix
+++ b/pkgs/development/python-modules/docling-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.3.1";
+  version = "2.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DS4SD";
     repo = "docling-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yNsmMAeR1sbZsddpjMFWZy2UAbIWWiZmdW4/lwLvCbM=";
+    hash = "sha256-N8rL+5bCVF4Qi5eqgkaB2r3LTYoqTVPeK4gQ6stiW/w=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/flask-wtf/default.nix b/pkgs/development/python-modules/flask-wtf/default.nix
index 09fa23575fa4..adafdec67b2b 100644
--- a/pkgs/development/python-modules/flask-wtf/default.nix
+++ b/pkgs/development/python-modules/flask-wtf/default.nix
@@ -14,23 +14,23 @@
 
 buildPythonPackage rec {
   pname = "flask-wtf";
-  version = "1.2.1";
-  format = "pyproject";
+  version = "1.2.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "flask_wtf";
     inherit version;
-    hash = "sha256-i7Jp65u0a4fnyCM9fn3r3x+LdL+QzBeJmIwps3qXtpU=";
+    hash = "sha256-edLuHkNs9XC8y32RZTP6GHV6LxjCkKzP+rG5oLaEZms=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     flask
     itsdangerous
     wtforms
@@ -42,10 +42,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pytestFlagsArray = [
-    "-W"
-    "ignore::DeprecationWarning"
-  ];
+  pythonImportsCheck = [ "flask_wtf" ];
 
   meta = with lib; {
     description = "Simple integration of Flask and WTForms";
@@ -54,7 +51,7 @@ buildPythonPackage rec {
       mic92
       anthonyroussel
     ];
-    homepage = "https://github.com/lepture/flask-wtf/";
-    changelog = "https://github.com/wtforms/flask-wtf/releases/tag/v${version}";
+    homepage = "https://github.com/pallets-eco/flask-wtf/";
+    changelog = "https://github.com/pallets-eco/flask-wtf/releases/tag/v${version}";
   };
 }
diff --git a/pkgs/development/python-modules/private-gpt/default.nix b/pkgs/development/python-modules/private-gpt/default.nix
index 4642f2dd3221..3ed427b468ea 100644
--- a/pkgs/development/python-modules/private-gpt/default.nix
+++ b/pkgs/development/python-modules/private-gpt/default.nix
@@ -47,6 +47,7 @@ buildPythonPackage rec {
     "fastapi"
     "llama-index-core"
     "llama-index-readers-file"
+    "python-multipart"
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/sphinx-multiversion/default.nix b/pkgs/development/python-modules/sphinx-multiversion/default.nix
new file mode 100644
index 000000000000..754f8038cc59
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-multiversion/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, sphinx
+, setuptools
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-multiversion";
+  version = "0.2.4";
+
+  disabled = pythonOlder "3.7";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "sphinx-multiversion";
+    hash = "sha256-XNHKnste7WPLjWzl6cQ4yhOvT6mOfrbzdr5UHdSZC8s=";
+  };
+
+  build-system = [ setuptools ];
+  dependencies = [ sphinx ];
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  pythonImportsCheck = [ "sphinx_multiversion" ];
+
+  meta = with lib; {
+    description = "Sphinx extension for building self-hosted versioned docs.";
+    homepage = "https://holzhaus.github.io/sphinx-multiversion";
+    changelog = "https://github.com/Holzhaus/sphinx-multiversion/releases/tag/v${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ cynerd ];
+  };
+}
diff --git a/pkgs/os-specific/linux/amneziawg/default.nix b/pkgs/os-specific/linux/amneziawg/default.nix
new file mode 100644
index 000000000000..9137bf18de9e
--- /dev/null
+++ b/pkgs/os-specific/linux/amneziawg/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  srcOnly,
+  kernel,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "amneziawg";
+  version = "1.0.20240711";
+
+  src = fetchFromGitHub {
+    owner = "amnezia-vpn";
+    repo = "amneziawg-linux-kernel-module";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-WOcBTxetVz2Sr62c+2aGNyohG2ydi+R+az+4qHbKprI=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildFlags = [
+    "apply-patches"
+    "module"
+  ];
+
+  makeFlags =
+    kernel.makeFlags
+    ++ [ "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ]
+    ++ lib.optional (lib.versionAtLeast kernel.version "5.6") "KERNEL_SOURCE_DIR=${srcOnly kernel}";
+
+  enableParallelBuilding = true;
+
+  installFlags = [
+    "DEPMOD=true"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Kernel module for the AmneziaWG";
+    homepage = "https://amnezia.org";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ averyanalex ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 03663ad96b97..8afccf3e0348 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -76,10 +76,11 @@ rec {
 
   };
 
-  yaml = {}: {
+  yaml = yaml_1_1;
 
-    generate = name: value: pkgs.callPackage ({ runCommand, remarshal }: runCommand name {
-      nativeBuildInputs = [ remarshal ];
+  yaml_1_1 = {}: {
+    generate = name: value: pkgs.callPackage ({ runCommand, remarshal_0_17 }: runCommand name {
+      nativeBuildInputs = [ remarshal_0_17 ];
       value = builtins.toJSON value;
       passAsFile = [ "value" ];
       preferLocalBuild = true;
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index 5f6f3b93e280..1c6f741353fa 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -118,7 +118,7 @@ in runBuildTests {
     '';
   };
 
-  yamlAtoms = shouldPass {
+  yaml_1_1Atoms = shouldPass {
     format = formats.yaml {};
     input = {
       null = null;
@@ -129,6 +129,8 @@ in runBuildTests {
       attrs.foo = null;
       list = [ null null ];
       path = ./formats.nix;
+      no = "no";
+      time = "22:30:00";
     };
     expected = ''
       attrs:
@@ -138,9 +140,11 @@ in runBuildTests {
       list:
       - null
       - null
+      'no': 'no'
       'null': null
       path: ${./formats.nix}
       str: foo
+      time: '22:30:00'
       'true': true
     '';
   };
diff --git a/pkgs/servers/home-assistant/custom-components/systemair/package.nix b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
new file mode 100644
index 000000000000..83cc9199a20d
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "tesharp";
+  domain = "systemair";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "systemair";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lzFnKPkBOt2fkVGWCj1M/skSr8V39GgDHS+0HD4ACAw=";
+  };
+
+  meta = with lib; {
+    changelog = "https://github.com/tesharp/systemair/releases/tag/v${version}";
+    description = "Home Assistant component for Systemair SAVE Connect 2";
+    homepage = "https://github.com/tesharp/systemair";
+    maintainers = with maintainers; [ uvnikita ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 76a0ebfdf245..31949394beb1 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -1,9 +1,5 @@
 { callPackage }: builtins.mapAttrs (_: callPackage ./generic.nix) rec {
   wordpress = wordpress_6_6;
-  wordpress_6_5 = {
-    version = "6.5.5";
-    hash = "sha256-bIRmTqmzIRo1KdhAcJa1GxhVcTEiEaLFPzlNFbzfLcQ=";
-  };
   wordpress_6_6 = {
     version = "6.6.2";
     hash = "sha256-JpemjLPc9IP0/OiASSVpjHRmQBs2n8Mt4nB6WcTCB9Y=";
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index b1d49675dbd8..c1b746003be7 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.31.0";
+  version = "0.31.1";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     rev = "v${version}";
-    hash = "sha256-e3oiIVma4p3tAfDUwKC9zzgTWDjqXZSWsykR47eE+kE=";
+    hash = "sha256-tSMzLnqPwbMU/3k0JnubtWJ6GtaCtewBmBzUWrDocDY=";
   };
 
-  vendorHash = "sha256-kEwGJ2+xe7ct9ckMAE4l+2cBYcUXpoDVM3DohtzHqeY=";
+  vendorHash = "sha256-XzJ+FzGlJpnRjDt0IDbe1i7zCEDgy0L9hE/Ltqo+SoE=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index bcbe63e6f67e..2b156761aa47 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1303,6 +1303,7 @@ mapAliases {
   wordpress6_3 = throw "'wordpress6_3' has been removed in favor of the latest version"; # Added 2024-08-03
   wordpress6_4 = throw "'wordpress6_4' has been removed in favor of the latest version"; # Added 2024-08-03
   wordpress6_5 = wordpress_6_5; # Added 2024-08-03
+  wordpress_6_5 = throw "'wordpress_6_5' has been removed in favor of the latest version"; # Added 2024-11-11
   wormhole-rs = magic-wormhole-rs; # Added 2022-05-30. preserve, reason: Arch package name, main binary name
   wpa_supplicant_ro_ssids = lib.trivial.warn "Deprecated package: Please use wpa_supplicant instead. Read-only SSID patches are now upstream!" wpa_supplicant;
   wrapLisp_old = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index af23c5e21dd7..e77083a6e034 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19044,7 +19044,7 @@ with pkgs;
   });
 
   inherit (callPackage ../servers/web-apps/wordpress {})
-    wordpress wordpress_6_5 wordpress_6_6;
+    wordpress wordpress_6_6;
 
   wordpressPackages = ( callPackage ../servers/web-apps/wordpress/packages {
     plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index f7ac0ea95cde..82ffe09e97e4 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -315,6 +315,8 @@ in {
 
     akvcam = callPackage ../os-specific/linux/akvcam { };
 
+    amneziawg = callPackage ../os-specific/linux/amneziawg { };
+
     apfs = callPackage ../os-specific/linux/apfs { };
 
     ax99100 = callPackage ../os-specific/linux/ax99100 {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7fa5261b06a8..01bbd1622500 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14940,6 +14940,8 @@ self: super: with self; {
 
   sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { };
 
+  sphinx-multiversion = callPackage ../development/python-modules/sphinx-multiversion { };
+
   sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { };
 
   sphinx-pytest = callPackage ../development/python-modules/sphinx-pytest { };