diff --git a/ci/default.nix b/ci/default.nix
index 2be2a17c6f2c..c91c82867e8e 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -30,128 +30,7 @@ let
         inherit (pinned.treefmt-nix) url;
         sha256 = pinned.treefmt-nix.hash;
       };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
diff --git a/ci/treefmt.nix b/ci/treefmt.nix
new file mode 100644
index 000000000000..9575e99d8680
--- /dev/null
+++ b/ci/treefmt.nix
@@ -0,0 +1,122 @@
+{ pkgs, ... }: {
+  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+  # which creates trees within the Git repository under `.git-rewrite/t`,
+  # notably without having a `.git` themselves.
+  # So if this projectRootFile were the default `.git/config`,
+  # having the auto-rebase script use treefmt on such a tree would make it
+  # format all files in the _parent_ Git tree as well.
+  projectRootFile = ".git-blame-ignore-revs";
+
+  # Be a bit more verbose by default, so we can see progress happening
+  settings.verbose = 1;
+
+  # By default it's info, which is too noisy since we have many unmatched files
+  settings.on-unmatched = "debug";
+
+  programs.actionlint.enable = true;
+
+  programs.biome = {
+    enable = true;
+    # Disable settings validation because its inputs are liable to hash mismatch
+    validate.enable = false;
+    settings.formatter = {
+      useEditorconfig = true;
+    };
+    settings.javascript.formatter = {
+      quoteStyle = "single";
+      semicolons = "asNeeded";
+    };
+    settings.json.formatter.enabled = false;
+  };
+  settings.formatter.biome.excludes = [
+    "*.min.js"
+    "pkgs/*"
+  ];
+
+  programs.keep-sorted.enable = true;
+
+  # This uses nixfmt underneath, the default formatter for Nix code.
+  # See https://github.com/NixOS/nixfmt
+  programs.nixfmt = {
+    enable = true;
+    package = pkgs.nixfmt;
+  };
+
+  programs.yamlfmt = {
+    enable = true;
+    settings.formatter = {
+      retain_line_breaks = true;
+    };
+  };
+  settings.formatter.yamlfmt.excludes = [
+    # Aligns comments with whitespace
+    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+    # TODO: Fix formatting for auto-generated file
+    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+  ];
+
+  programs.nixf-diagnose = {
+    enable = true;
+    ignore = [
+      # Rule names can currently be looked up here:
+      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+      # TODO: Remove the following and fix things.
+      "sema-unused-def-lambda-noarg-formal"
+      "sema-unused-def-lambda-witharg-arg"
+      "sema-unused-def-lambda-witharg-formal"
+      "sema-unused-def-let"
+      # Keep this rule, because we have `lib.or`.
+      "or-identifier"
+      # TODO: remove after outstanding prelude diagnostics issues are fixed:
+      # https://github.com/nix-community/nixd/issues/761
+      # https://github.com/nix-community/nixd/issues/762
+      "sema-primop-removed-prefix"
+      "sema-primop-overridden"
+      "sema-constant-overridden"
+      "sema-primop-unknown"
+    ];
+  };
+  settings.formatter.nixf-diagnose = {
+    # Ensure nixfmt cleans up after nixf-diagnose.
+    priority = -1;
+    excludes = [
+      # Auto-generated; violates sema-extra-with
+      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+      # https://github.com/inclyc/nixf-diagnose/issues/13
+      "pkgs/servers/home-assistant/component-packages.nix"
+      # https://github.com/nix-community/nixd/issues/708
+      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+    ];
+  };
+
+  settings.formatter.editorconfig-checker = {
+    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+    options = [
+      "-disable-indent-size"
+      # TODO: Remove this once this upstream issue is fixed:
+      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+      "-disable-charset"
+    ];
+    includes = [ "*" ];
+    priority = 1;
+  };
+
+  # TODO: Upstream this into treefmt-nix eventually:
+  #   https://github.com/numtide/treefmt-nix/issues/387
+  settings.formatter.markdown-code-runner = {
+    command = pkgs.lib.getExe pkgs.markdown-code-runner;
+    options =
+      let
+        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+          presets.nixfmt = {
+            language = "nix";
+            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+          };
+        };
+      in
+      [ "--config=${config}" ];
+    includes = [ "*.md" ];
+  };
+
+  programs.zizmor.enable = true;
+}
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 8c4fc4fec0f1..72adfb5c298b 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -354,6 +354,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
   If client certificates, keys or other files are needed, these should be stored under `/etc/wpa_supplicant` and owned by `wpa_supplicant` to ensure the daemon can read them.
 
+  Similarly, the `ctrl_interface` directory set in `wpa_supplicant`'s conf must be writeable by the `wpa_supplicant` user so that the `wpa_supplicant` daemon can start successfully. If you were changing `ctrl_interface` in [extraConfig](#opt-networking.wireless.extraConfig) or in `/etc/wpa_supplicant/imperative.conf`, please remove that line.
+
   Also, the {option}`networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and {option}`networking.wireless.userControlled.enable` has been renamed to [](#opt-networking.wireless.userControlled).
 
   No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 36825e1d508c..a948cd02bc4f 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -26,6 +26,8 @@ let
           toString v
         else if lib.isString v then
           v
+        else if lib.isPath v then
+          v
         else if true == v then
           "yes"
         else if false == v then
diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix
index c625b91ec1e2..e1253d2fea64 100644
--- a/nixos/modules/system/activation/bootspec.nix
+++ b/nixos/modules/system/activation/bootspec.nix
@@ -26,9 +26,11 @@ let
             // {
               "org.nixos.bootspec.v1" = {
                 system = config.boot.kernelPackages.stdenv.hostPlatform.system;
+                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
+              }
+              // lib.optionalAttrs config.boot.kernel.enable {
                 kernel = "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
                 kernelParams = config.boot.kernelParams;
-                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
               }
               // lib.optionalAttrs config.boot.initrd.enable {
                 initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
diff --git a/nixos/tests/zenohd.nix b/nixos/tests/zenohd.nix
index ee1959e86c48..04f423057899 100644
--- a/nixos/tests/zenohd.nix
+++ b/nixos/tests/zenohd.nix
@@ -84,7 +84,7 @@
     client.wait_for_unit("multi-user.target")
 
     for be in ["fs", "rocksdb", "mem" ]:
-      client.succeed(f"mosquitto_pub -h router -t {be}/test -m hello")
+      client.succeed(f"mosquitto_pub -q 1 -h router -t {be}/test -m hello")
       client.succeed(f"curl router:8000/{be}/test | grep hello")
   '';
 }
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index a42e2ad6eeaf..0fdc124b89cd 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "transmission";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchFromGitHub {
     owner = "transmission";
     repo = "transmission";
     tag = finalAttrs.version;
-    hash = "sha256-c3BOQ25xWIj4bLDQDnfzw9ZyuPemyHrK2Ua0jbOSuOw=";
+    hash = "sha256-FI/qH0VqhEjiN+31UCOiDLWkyucMKfH4i0bYW7lceQk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 01d55aa59add..9969a1705be5 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -420,18 +420,18 @@ in
 
   docker_29 =
     let
-      version = "29.5.2";
+      version = "29.5.3";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-kHgDZVr6mAyCtZ6bSG9FWV0GhWDfXLXzHYFrmjFzO9w=";
+      cliHash = "sha256-ZYfBWNVp7w8ZKdRA6bmDVQV4UEp+t8lWehInvtfysxM=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-lux7tTyF6vm5wuIXs+z3Ygd2v4JjgHbRvOXNA4kjNtg=";
+      mobyHash = "sha256-D+XjHsKUFgMBCQsFI825JIGHEQmDt3NQCwpTdu6XSc8=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
-      containerdRev = "v2.2.3";
-      containerdHash = "sha256-jaOLZf246kmvBHHrwgvqrhxuh+n1HE6NDqckZK4tvnM=";
+      containerdRev = "v2.2.4";
+      containerdHash = "sha256-F0lw7zh4V9JlFQGkE4RNT1VLX8WWLgZAAvbP12jnRMw=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };
diff --git a/pkgs/by-name/at/atlantis/package.nix b/pkgs/by-name/at/atlantis/package.nix
index aa24e1764d77..d7cbb985ef41 100644
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlantis";
-  version = "0.43.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-btCfoku8LgsZEJ/aza75wg8spacYEeliXVmjMZYkO3M=";
+    hash = "sha256-ZHd/RSzFXbcZ7324Bbgtx681zwdHi5xYgqVlTR4glHY=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
-  vendorHash = "sha256-ilKrQulEmsyv8w2ENjhfICoiXOexjUZXeb3cPeqcTqw=";
+  vendorHash = "sha256-hxgujZGbcEelOpoy7eCnbrypXraN7aPe8Ox81kkg3gs=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index c4e70b9ab233..118a37a0023c 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -5,7 +5,7 @@
   makeWrapper,
   makeDesktopItem,
   nodejs,
-  electron_41,
+  electron_42,
   element-web,
   callPackage,
   typescript,
@@ -15,7 +15,7 @@
   commandLineArgs ? "",
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   faketty,
   asar,
   copyDesktopItems,
@@ -24,19 +24,19 @@
 }:
 
 let
-  pnpm = pnpm_10;
-  electron = electron_41;
+  pnpm = pnpm_11;
+  electron = electron_42;
   seshat = callPackage ./seshat { };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-desktop";
-  version = "1.12.18";
+  version = "1.12.21";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
+    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
+    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix
index 389ffe8251ca..ee61fce02654 100644
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -6,14 +6,13 @@
   nodejs,
   jitsi-meet,
   fetchPnpmDeps,
-  pnpm_10,
+  pnpm_11,
   pnpmConfigHook,
   faketty,
 }:
 
 let
-  pnpm = pnpm_10;
-
+  pnpm = pnpm_11;
   noPhoningHome = {
     disable_guests = true; # disable automatic guest account registration at matrix.org
   };
@@ -26,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-web";
-  version = "1.12.18";
+  version = "1.12.21";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
+    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -40,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
+    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 27282836b16e..92004e0cdb4c 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.102";
+    version = "149.0.7827.114";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-ETp7EURoN0p45cNnwcp6/aoPyKHSf+WPyUvKh+R7bp4=";
+      hash = "sha256-GVvehY+e5thM3nHYMQd/uI8HTnjvL/w8UeRpUWouzlA=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.103";
+    version = "149.0.7827.115";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/kfbyzxups2p7z7m5ltrjh7htrm_149.0.7827.103/GoogleChrome-149.0.7827.103.dmg";
-      hash = "sha256-N3U6RkBaPzVHl5JMkq+m17DJg3+XiwyS2AHinOs0sjo=";
+      url = "http://dl.google.com/release2/chrome/ny2unjynyv52nhojnzjueghuma_149.0.7827.115/GoogleChrome-149.0.7827.115.dmg";
+      hash = "sha256-q1jMxveB5FFA+wA5a5mnSPWoQFkNHQ20x51R8A/yUsk=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/ja/jasterix/package.nix b/pkgs/by-name/ja/jasterix/package.nix
new file mode 100644
index 000000000000..9b804aaabd26
--- /dev/null
+++ b/pkgs/by-name/ja/jasterix/package.nix
@@ -0,0 +1,78 @@
+{
+  boost,
+  catch2_3,
+  cmake,
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+  libarchive,
+  libpcap,
+  log4cpp,
+  onetbb,
+  openssl,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jasterix";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "OpenATSGmbH";
+    repo = "jASTERIX";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-df5tByZwtQLdV0UlSo1WkgyoF3hReU/mN74V2WL6zoI=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "jasterix-fix-tests.patch";
+      url = "https://github.com/OpenATSGmbH/jASTERIX/commit/b79e59c042ebb7eee31f50a7ed48840bcec50429.patch";
+      hash = "sha256-V0/nMJGb8ZB/Z6bKvyZnic57HXAsUAHXgyVq+D4yFDw=";
+    })
+  ];
+
+  # Disable boost-stacktrace_backtrace, which is an optional dependency and not yet available in Nix.
+  postPatch = ''
+    sed -i 's/\(find_package .*\) stacktrace_backtrace/\1/' CMakeLists.txt
+    sed -i 's/BOOST_STACKTRACE_USE_BACKTRACE/#BOOST_STACKTRACE_USE_BACKTRACE/' CMakeLists.txt
+    sed -i 's/BOOST_STACKTRACE_LINK/#BOOST_STACKTRACE_LINK/' CMakeLists.txt
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BUILD_STATIC" stdenv.hostPlatform.isStatic)
+    (lib.cmakeBool "WITH_UNIT_TESTS" finalAttrs.doCheck)
+  ];
+
+  buildInputs = [
+    boost.dev
+    catch2_3
+    libarchive.dev
+    libpcap
+    log4cpp
+    onetbb.dev
+    openssl.dev
+  ];
+
+  doCheck = true;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "C++ Library for EUROCONTROL's ASTERIX to JSON conversion";
+    homepage = "https://github.com/OpenATSGmbH/jASTERIX";
+    changelog = "https://github.com/OpenATSGmbH/jASTERIX/releases/tag/v${finalAttrs.src.tag}";
+    maintainers = [ lib.maintainers.vog ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index 1c88fc244922..b6f35b371667 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,11 +18,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.555.2";
+  version = "2.555.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-39oJV4xcGxjyjVDsNihoMF9XLDt674uQ0A96lDamKGc=";
+    hash = "sha256-XRmQXmwPI6/4n/AH3lVkuW4KBcE/TRqS0P3LabAzu5o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/kd/kdash/package.nix b/pkgs/by-name/kd/kdash/package.nix
index dfff244ffb0b..2f7f467c87e7 100644
--- a/pkgs/by-name/kd/kdash/package.nix
+++ b/pkgs/by-name/kd/kdash/package.nix
@@ -16,8 +16,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "kdash-rs";
     repo = "kdash";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-xc2vNPQWg6P+FWxKekvOTW3QHxgmkD6t/jgYGdoaMeI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CFGZIRZgOUiB/evCDUQFB+w5PJCJNtrWqYzx2yRQKpE=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Simple and fast dashboard for Kubernetes";
     mainProgram = "kdash";
     homepage = "https://github.com/kdash-rs/kdash";
+    changelog = "https://github.com/kdash-rs/kdash/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/by-name/ll/llama-swap/package.nix b/pkgs/by-name/ll/llama-swap/package.nix
index 59758a573257..94762b624033 100644
--- a/pkgs/by-name/ll/llama-swap/package.nix
+++ b/pkgs/by-name/ll/llama-swap/package.nix
@@ -8,6 +8,8 @@
 
   callPackage,
 
+  bash,
+
   nixosTests,
   nix-update-script,
 }:
@@ -17,7 +19,7 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "llama-swap";
-  version = "216";
+  version = "224";
 
   outputs = [
     "out"
@@ -28,7 +30,7 @@ buildGoModule (finalAttrs: {
     owner = "mostlygeek";
     repo = "llama-swap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PHSY4z2h406xL+EcIYyrzr4s28txO7SCsWm8hrXf+2U=";
+    hash = "sha256-IblAaM9FBdI2Y9rg36SWpclQ0jV6Y93RC+N+cXWEO94=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -41,7 +43,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-QysQ7YdwJcLTziwL25j73n3tQVvzVQIFxN4GkTU8JZg=";
+  vendorHash = "sha256-b+RreafBMCWT/jbWTlXaiDRzA4DRe76WaCEbrfRxV/4=";
 
   passthru.ui = callPackage ./ui.nix { llama-swap = finalAttrs.finalPackage; };
 
@@ -58,13 +60,18 @@ buildGoModule (finalAttrs: {
     "-X main.version=${finalAttrs.version}"
   ];
 
+  postPatch = ''
+    substituteInPlace internal/process/process_command_forking_test.go \
+      --replace "#!/bin/bash" "#!${lib.getExe bash}"
+  '';
+
   preBuild = ''
     # ldflags based on metadata from git and source
     ldflags+=" -X main.commit=$(cat COMMIT)"
     ldflags+=" -X main.date=$(cat SOURCE_DATE_EPOCH)"
 
-    # copy for go:embed in proxy/ui_embed.go
-    cp -r ${finalAttrs.passthru.ui}/ui_dist proxy/
+    # copy for go:embed in internal/server/ui_embed.go
+    cp -r ${finalAttrs.passthru.ui}/ui_dist internal/server/
   '';
 
   excludedPackages = [
diff --git a/pkgs/by-name/ll/llama-swap/ui.nix b/pkgs/by-name/ll/llama-swap/ui.nix
index 15a326366bff..9d43a142c60d 100644
--- a/pkgs/by-name/ll/llama-swap/ui.nix
+++ b/pkgs/by-name/ll/llama-swap/ui.nix
@@ -11,7 +11,7 @@ buildNpmPackage (finalAttrs: {
 
   postPatch = ''
     substituteInPlace vite.config.ts \
-      --replace-fail "../proxy/ui_dist" "${placeholder "out"}/ui_dist"
+      --replace-fail "../internal/server/ui_dist" "${placeholder "out"}/ui_dist"
   '';
 
   sourceRoot = "${finalAttrs.src.name}/ui-svelte";
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index ae0c858bf89f..bcc15e19bcc7 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   gettext,
   libuv,
@@ -106,7 +105,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.12.2";
+    version = "0.12.3";
 
     __structuredAttrs = true;
 
@@ -114,7 +113,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-V+jZiNv0SvG/GOOUPzmBkOQGrnrN3UW2BY2n9NxP2Eg=";
+      hash = "sha256-JjDU3GZf+wvsMyDjIfu1btTUBkOlpp6E1HFLqBLR9po=";
     };
 
     strictDeps = true;
@@ -124,11 +123,6 @@ stdenv.mkDerivation (
       # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
       # it installs. See https://github.com/neovim/neovim/issues/9413.
       ./system_rplugin_manifest.patch
-      (fetchpatch {
-        name = "CVE-2026-11487.patch";
-        url = "https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf.patch";
-        hash = "sha256-iWnq0ezbKYJqjvevVlcTJBvUc17ZvrhsanhtuKrh8zM=";
-      })
     ];
 
     inherit lua;
diff --git a/pkgs/by-name/oa/oauth2-proxy/package.nix b/pkgs/by-name/oa/oauth2-proxy/package.nix
index 4aff6c05f7ea..8542c14bf37c 100644
--- a/pkgs/by-name/oa/oauth2-proxy/package.nix
+++ b/pkgs/by-name/oa/oauth2-proxy/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "oauth2-proxy";
-  version = "7.15.2";
+  version = "7.15.3";
 
   src = fetchFromGitHub {
     repo = "oauth2-proxy";
     owner = "oauth2-proxy";
-    sha256 = "sha256-qhWU6i57WS8TWJ5ggzwmeoIv0osQjA9wdwqnvxMddrc=";
+    sha256 = "sha256-HpWmIOqyE3L0JYAQh+bd30Gr2dDpTGH8DwFJo5XwflY=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-Iu1dm0f3eYJpr9eR8RL7wAV8UGwpOway0aP8r5wci0M=";
+  vendorHash = "sha256-o4JWhqLbfHmlIY1XhaupIhYLfXJNguFueH+SpAe9xaw=";
 
   # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
   ldflags = [ "-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=v${version}" ];
diff --git a/pkgs/by-name/op/openocd-adi/package.nix b/pkgs/by-name/op/openocd-adi/package.nix
index 018d9552e39c..c57cae0e0995 100644
--- a/pkgs/by-name/op/openocd-adi/package.nix
+++ b/pkgs/by-name/op/openocd-adi/package.nix
@@ -5,26 +5,28 @@
   fetchFromGitHub,
 }:
 
-openocd.overrideAttrs (old: {
-  pname = "openocd-adi";
-  version = "0.12.0-1.3.1-1";
-  src = fetchFromGitHub {
-    owner = "analogdevicesinc";
-    repo = "openocd";
-    tag = "0.12.0-1.3.1-1";
-    hash = "sha256-e25mAxUmbF/hZC+aWRMt9HdwKY0FClNrZXwP3888Z9A=";
-    # openocd disables the vendored libraries that use submodules and replaces them with nix versions.
-    # this works out as one of the submodule sources seems to be flakey.
-    fetchSubmodules = false;
-  };
-  nativeBuildInputs = old.nativeBuildInputs ++ [
-    autoreconfHook
-  ];
-  meta = openocd.meta // {
-    description = "ADI fork of OpenOCD";
-    homepage = "https://github.com/analogdevicesinc/openocd";
-    maintainers = with lib.maintainers; [
-      aiyion
+openocd.overrideAttrs (
+  finalAttrs: old: {
+    pname = "openocd-adi";
+    version = "0.12.0-1.3.1-2";
+    src = fetchFromGitHub {
+      owner = "analogdevicesinc";
+      repo = "openocd";
+      tag = finalAttrs.version;
+      hash = "sha256-MqpVZN6+kcu1bspwcCDOnydQ5tC+MtO4D35KmQFRm1o=";
+      # openocd disables the vendored libraries that use submodules and replaces them with nix versions.
+      # this works out as one of the submodule sources seems to be flakey.
+      fetchSubmodules = false;
+    };
+    nativeBuildInputs = old.nativeBuildInputs ++ [
+      autoreconfHook
     ];
-  };
-})
+    meta = openocd.meta // {
+      description = "ADI fork of OpenOCD";
+      homepage = "https://github.com/analogdevicesinc/openocd";
+      maintainers = with lib.maintainers; [
+        aiyion
+      ];
+    };
+  }
+)
diff --git a/pkgs/by-name/pg/pgdog/package.nix b/pkgs/by-name/pg/pgdog/package.nix
index ee08bfc63e8d..3f12af095b81 100644
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "pgdog";
-  version = "0.1.43";
+  version = "0.1.44";
 
   src = fetchFromGitHub {
     owner = "pgdogdev";
     repo = "pgdog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0ilN89DChNOFcwsOZK7ZZPsbMCMH3NQlZlSvjT6F4oY=";
+    hash = "sha256-t45oD6b3S7oVZP/of8x2uxumjKxilNYLsqMtv2bTZoA=";
   };
 
-  cargoHash = "sha256-wh63mNo2dX4ngLW+dEu9UtWVuqNSBNrtYvK2ejHxNKg=";
+  cargoHash = "sha256-VFxogmT4gLHld+MCdYwwEwU9XiIxS6YRuMzif6oAuyE=";
 
   # Hardcoded paths for C compiler and linker
   postPatch = ''
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index 5cceb499d9b5..034254572c8a 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -11,7 +11,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.66.3";
+  version = "2.67.0";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-EGYrEWB3YVVVNmc/KqtyLYbQPTcrv6+Piwqi347DB4c=";
+    hash = "sha256-LS8KW6dZe/CYdA1LvZlq1vL8YllnDZkD9WEEDOToY1M=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index 1c707c969b25..08edd2d4d3bb 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -7,16 +7,16 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.5.2";
+  version = "6.5.4";
 
   sources = {
     "aarch64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-aarch64.AppImage";
-      hash = "sha256-VrPNKXgVO/9yvGqseOVkYKMFVqhtExL2PCJb6stn3ko=";
+      hash = "sha256-/tlCdCyy7FRlDMFWsx1S4JbIJqombk23LPum/tH6psU=";
     };
     "x86_64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-      hash = "sha256-caRL09PKJ33XHRReZ5qSpfgKH0wpJxGSHXfA83sz5UE=";
+      hash = "sha256-iQdy8nxakCv0XxpN04W50X3OWibcMn1ZnT+qYvkyfXg=";
     };
   };
 
diff --git a/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
new file mode 100644
index 000000000000..aaafec50add1
--- /dev/null
+++ b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
+index 352ea6c0..41a9a1c7 100644
+--- a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
++++ b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
+@@ -3536,7 +3536,7 @@ namespace DnsServerCore.Dns.ZoneManagers
+                     }
+                 }
+ 
+-                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, udpPayloadSize: _dnsServer.UdpPayloadSize, options: eDnsOptions);
++                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, _dnsServer.UdpPayloadSize, request.DnssecOk ? EDnsHeaderFlags.DNSSEC_OK : EDnsHeaderFlags.None, eDnsOptions);
+             }
+         }
+ 
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index a5375f487124..f143be229523 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -41,6 +41,12 @@ buildDotnetModule rec {
     libmsquic
   ];
 
+  # Confirmed correct by upstream, remove when fixed in a release:
+  # https://github.com/TechnitiumSoftware/DnsServer/issues/1967
+  patches = [
+    ./dnssec-do-bit-fix.patch
+  ];
+
   passthru.tests = {
     inherit (nixosTests) technitium-dns-server;
   };
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 97fcdac5c16d..ed25d4d3e2df 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -210,6 +210,120 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-QttKWdmWC6Zn5k2hd6RIMCpLWv71HB/A9mCbDP+i8to=";
     })
 
+    # XSA #490
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa490-4.21.patch";
+      hash = "sha256-PF4zNeaS8aXHBNKLcgjVBUqmREg+nvdyHyLlhX2YBiw=";
+    })
+
+    # XSA #491
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa491-4.21.patch";
+      hash = "sha256-I21YIcaK1v7BfBJi/aiVACgR3QyN+/gXnB4YMprT4zA=";
+    })
+
+    # XSA #492
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-01.patch";
+      hash = "sha256-U3nE7jgTKh2HmS9tMVQG+TIGvgU5B1aikC3NSER0CaY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-02.patch";
+      hash = "sha256-Y3k9ICThfnIcu59F2pFDbFWD5DL6siPJmINmC7nT2uY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-03.patch";
+      hash = "sha256-k4nPft59/MQwYKcdrzj5d80+LDhp05e86iJWzabjkQc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-04.patch";
+      hash = "sha256-Mn+8q9zsstXbmrS/rkDdtwWEiD3EGNlmpa+eB1wESA4=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-05.patch";
+      hash = "sha256-csf9nf6cz3skhq1ph8HIs2AEVgBkw29hP39zwqy2vwM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-06.patch";
+      hash = "sha256-urY9bjqqzKSGqGqEhDnagLUrzDsKkARMERT7vmukeUU=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-07.patch";
+      hash = "sha256-OyUC9bJevxiMuJuyJO9Z3ScXebe7lZM95HkK5YxGino=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-08.patch";
+      hash = "sha256-g3zV+r9LKjuMbkl4gprhWqClOgDU/Kbesr39LQiM+Aw=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-09.patch";
+      hash = "sha256-Wuc5dqwm+zwlYOzDXpRgyQH584sKwETi+xcE7HASHyI=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-10.patch";
+      hash = "sha256-ggln1O+epVOErBSUhIxX7xhwBy808vnQtcae3KYoQdo=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-11.patch";
+      hash = "sha256-/Yb1i/ms8MaVsEa/nK84CTFclOKcJoWMjjQJQab7l40=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-12.patch";
+      hash = "sha256-IpUeM+t7AZ8IVlzake+PiFAe0FCeFzChy+eaN9MAiSM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-13.patch";
+      hash = "sha256-3vZj9VrDcFtlKrlMy1OD//F+6O252m23jJ0BRShQ6wA=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-14.patch";
+      hash = "sha256-LiBavW+FTfXdELs8Fm79KeOvskRqDXytv/e7eYRgSvY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-15.patch";
+      hash = "sha256-0eK2hIFPNDIfv2W0ivkGL8Z3F+NpN4p2X0JVKjeBYWE=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-16.patch";
+      hash = "sha256-iEEkPC9mIuSF6Swt3/myUizsc8DubSPEkLkf1zm0/NE=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-17.patch";
+      hash = "sha256-YNo1wr+fRKk8+78Jf/zqJ7q9ugbzg7gyiyJ3zU+nB60=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-18.patch";
+      hash = "sha256-qNWe3iw+bYDtvBZ2KVfcy4VKu/waOyhoKZ0L8bqLdNc=";
+    })
+
+    # XSA #493
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-01.patch";
+      hash = "sha256-SvAj+9CIyedpFENCB/lQTJUB4kpVkGh+z+NNk82lQqM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-02.patch";
+      hash = "sha256-4fajBBBKMnMTy7mvFSUghwkRbYo833s3jATeGfiOrjc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-03.patch";
+      hash = "sha256-/AI9gtd60UWf89NNd7+Zx1g+KyAIM2wCih/07LN5zt4=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-04.patch";
+      hash = "sha256-qvXQG9VZkgca/za3bx1zTDkmRz5lFT3JPkbdI1mlBGY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-05.patch";
+      hash = "sha256-6pGjjPjalw6TY0n9TInE3nCXNmt6BUxwy1r1xf55U7k=";
+    })
+
+    # XSA #494
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa494-4.20.patch";
+      hash = "sha256-ns0s++J2adUD/HWuMiYad/g3MITs+twlMnkpFnP7T0w=";
+    })
+
     # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
diff --git a/pkgs/by-name/ze/zenoh-backend-filesystem/package.nix b/pkgs/by-name/ze/zenoh-backend-filesystem/package.nix
index ba3cba96ee13..4498f7fa457b 100644
--- a/pkgs/by-name/ze/zenoh-backend-filesystem/package.nix
+++ b/pkgs/by-name/ze/zenoh-backend-filesystem/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-backend-filesystem";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-backend-filesystem";
     tag = finalAttrs.version;
-    hash = "sha256-aMIVBs3K9h2aVPuaU5DzOjm3xzpHJn8MnjxdCDCANCw=";
+    hash = "sha256-xyGRL8cSTiObuFDZN+c7e9Sggfn5jx9555PU0JSPh6o=";
   };
 
-  cargoHash = "sha256-d7LgxaZHcMpqx0/+qmcHlAn1pAjBrGqjeTsiqZEJ+1Q=";
+  cargoHash = "sha256-kbMOAL/CvmbOjKVpnZrZlRsl0sibTBwvqCq5GzXjGx8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,6 +45,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ze/zenoh-backend-influxdb/package.nix b/pkgs/by-name/ze/zenoh-backend-influxdb/package.nix
index 9bc1415c6a5a..003d5dbbae2a 100644
--- a/pkgs/by-name/ze/zenoh-backend-influxdb/package.nix
+++ b/pkgs/by-name/ze/zenoh-backend-influxdb/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-backend-influxdb";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-backend-influxdb";
     tag = finalAttrs.version;
-    hash = "sha256-OwIVaWy3rgnn9Cm7sqBvFua2FOCgMQBoxPh+8HkvpB0=";
+    hash = "sha256-W+hrkmjvWPhUJgbPGwzo9159wd269P0vBIxDV+oX6H4=";
   };
 
-  cargoHash = "sha256-yOcbg4+hXdecBN3oeuhs6J1PQ43s8oYOBX/CJ3IyoJ0=";
+  cargoHash = "sha256-+wJqrGQhcrVW9un+2rPZwZl8/MzttduO9Nhn1w2cNag=";
 
   meta = {
     description = "Backend and Storages for zenoh using InfluxDB";
@@ -25,6 +25,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ze/zenoh-backend-rocksdb/package.nix b/pkgs/by-name/ze/zenoh-backend-rocksdb/package.nix
index 1746fb0eb7b0..88eb2ece2348 100644
--- a/pkgs/by-name/ze/zenoh-backend-rocksdb/package.nix
+++ b/pkgs/by-name/ze/zenoh-backend-rocksdb/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-backend-rocksdb";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-backend-rocksdb";
     tag = finalAttrs.version;
-    hash = "sha256-7IXBzrtab7NNskO6JkPkXGxqnAFmVyIe7dLqbYAKyLs=";
+    hash = "sha256-D+gc29pje4cXfIXP++572iqvzkHDrF6JVdRkdHnEY4E=";
   };
 
-  cargoHash = "sha256-Lqrhu19Z++K7GIMxBHnFNyiBDfq0MxL4tUM2VDkezHw=";
+  cargoHash = "sha256-IOdwGre7j5vyJ5Zut+Q3/548xAlXxbRTVePp9V5nssI=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,6 +45,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ze/zenoh-c/package.nix b/pkgs/by-name/ze/zenoh-c/package.nix
index 39286f61322c..1df4eaac5ac4 100644
--- a/pkgs/by-name/ze/zenoh-c/package.nix
+++ b/pkgs/by-name/ze/zenoh-c/package.nix
@@ -10,18 +10,20 @@
 
 stdenv.mkDerivation rec {
   pname = "zenoh-c";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-c";
-    tag = version;
-    hash = "sha256-Mn3diwJgMkYXP9Dn5AqquN1UJ+P+b4QadiXqzzYZK+o=";
+    # tag = version;
+    # Use 1.9.0 PR merge commit with up-to-date Cargo.lock file
+    rev = "8858e129271f4e05bb34d8ae6df3f3d221ef5299";
+    hash = "sha256-rNvtFFM9tRttuBAIrpaYTadFcUe1El7q5t7PNnMEJXA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-Z9xKC7svGPSuQm4KCKOfGAFOdWgSjBK+/LFT3rAebTg=";
+    hash = "sha256-7xWu9wgZqDzd60buMnF9B6Y5LRkG5C2JWiG7VwgSCvU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ze/zenoh-cpp/package.nix b/pkgs/by-name/ze/zenoh-cpp/package.nix
index fcfd64f6f13b..5dd17a57ae9a 100644
--- a/pkgs/by-name/ze/zenoh-cpp/package.nix
+++ b/pkgs/by-name/ze/zenoh-cpp/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenoh-cpp";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-cpp";
     tag = finalAttrs.version;
-    hash = "sha256-rznvif87UZbYzZB4yHG4R850qm6Z3beJ1NSG4wrf58M=";
+    hash = "sha256-MwQKTxrQqfoASCRk+vBeS9EHvmh6sqrpqygQVrdGkWw=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ze/zenoh-plugin-dds/package.nix b/pkgs/by-name/ze/zenoh-plugin-dds/package.nix
index 41b098d50c8c..7a25df1dcdda 100644
--- a/pkgs/by-name/ze/zenoh-plugin-dds/package.nix
+++ b/pkgs/by-name/ze/zenoh-plugin-dds/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-plugin-dds";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-plugin-dds";
     tag = finalAttrs.version;
-    hash = "sha256-vSFgxSSbLEwpwPznvy+m66Z5grgmxZiIom/I4p0xris=";
+    hash = "sha256-MOZmyZGaMJieWISZnnSTU+3+ER4FcGhg3YCTlmuWmuE=";
   };
 
-  cargoHash = "sha256-oMmO4N1EqqpWcujbm8sPPwEzNC1Gy2UdCCRqcgyQqdI=";
+  cargoHash = "sha256-O7OrgEPPkWMYCtmtdgYIcE8YUa+YpHWttwW0Gu5BLJA=";
 
   nativeBuildInputs = [
     cmake
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ kaweees ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "zenoh-bridge-dds";
   };
 })
diff --git a/pkgs/by-name/ze/zenoh-plugin-mqtt/package.nix b/pkgs/by-name/ze/zenoh-plugin-mqtt/package.nix
index ecb0ce0aacc9..b1f85df2ebc9 100644
--- a/pkgs/by-name/ze/zenoh-plugin-mqtt/package.nix
+++ b/pkgs/by-name/ze/zenoh-plugin-mqtt/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-plugin-mqtt";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-plugin-mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-ijoKL8TReNER3a9dwsPeh56l1Ze2rz6jN6L9rYQLYRU=";
+    hash = "sha256-f5y9zCUTvNG/ubw0K+AwqfQlsfeLvoUL8gy3v9T0oQ4=";
   };
 
-  cargoHash = "sha256-ZKpyVVzXC+c7JzktSOMubWl610ujoZ3Vgo4tC0/1JHk=";
+  cargoHash = "sha256-vL5lZOH8juX8zaLJZnw1y8aDZsdFC3gELNvp5MPft2o=";
 
   # Some test time out
   doCheck = false;
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "zenoh-bridge-mqtt";
   };
 })
diff --git a/pkgs/by-name/ze/zenoh-plugin-webserver/package.nix b/pkgs/by-name/ze/zenoh-plugin-webserver/package.nix
index a8cb522bb938..fc9696bd35a5 100644
--- a/pkgs/by-name/ze/zenoh-plugin-webserver/package.nix
+++ b/pkgs/by-name/ze/zenoh-plugin-webserver/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh-plugin-webserver";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-plugin-webserver";
     tag = finalAttrs.version;
-    hash = "sha256-R+MLM42m3UTBFHqCAGezU4jz0Hi1+X2W1Yje7+ctl6k=";
+    hash = "sha256-U2xcx3TVPkEgea2gdSdbEa+jDI6h6vftLUi8AZPY3fU=";
   };
 
-  cargoHash = "sha256-/WVMdSGEawvAJ0viV/2eVhWGlvgaGUpe9ZHDCBUOc1I=";
+  cargoHash = "sha256-PLmmOw2ZMPn/ODBJn1NBvWyeGEPOcKB+aepoDqhqzZc=";
 
   meta = {
     description = "Implements an HTTP server mapping URLs to zenoh paths";
@@ -25,6 +25,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ze/zenoh/package.nix b/pkgs/by-name/ze/zenoh/package.nix
index 9a4aee622eeb..1b9e02a1965f 100644
--- a/pkgs/by-name/ze/zenoh/package.nix
+++ b/pkgs/by-name/ze/zenoh/package.nix
@@ -8,22 +8,22 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenoh";
-  version = "1.4.0"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh";
     rev = finalAttrs.version;
-    hash = "sha256-XibcNrT9R8gdOnf4BtOi5Jqu+4XjeWngA3i/MXnkfn8=";
+    hash = "sha256-sFHUphFu5a+buSa3GQvSmGo8SFtn3V5ZqTOnWMPlvs8=";
   };
 
-  cargoHash = "sha256-z0hSjcmVOefSiPgk6ige4wsR+LikNIjwi0On1/hyi78=";
+  cargoHash = "sha256-1PjtZ5/bAnLlMbkcKAA6DCKDafItGiATjct5Pv8muas=";
 
   cargoBuildFlags = [
     "--workspace"
-    # exclude examples
-    "--exclude"
-    "examples"
+    "--bins"
+    "--lib"
+    "--examples"
     "--exclude"
     "zenoh-backend-example"
     "--exclude"
@@ -34,6 +34,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doCheck = false;
 
+  preInstall = ''
+    cp -r $releaseDir/examples/* $tmpDir/
+    bins=$(find $tmpDir \
+      -maxdepth 1 \
+      -type f \
+      -executable \
+      -regextype posix-extended \
+      ! -regex ".*\.(so\.[0-9.]+|so|a|d|dylib)|.*-[0-9a-f]{16,}")
+  '';
+
   passthru.tests = {
     version = testers.testVersion {
       package = zenoh;
@@ -50,6 +60,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ck3d ];
     mainProgram = "zenohd";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 916792aec826..75bdf2ed11c3 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -197,8 +197,9 @@ let
       pkgs.libxrandr
       pkgs.libxrender
       pkgs.libxtst
-      pkgs.libxcb
       pkgs.libxshmfence
+      pkgs.libxcb
+      pkgs.libxcb-util
       pkgs.libxcb-cursor
       pkgs.libxcb-image
       pkgs.libxcb-keysyms
diff --git a/pkgs/development/beam-modules/expert/default.nix b/pkgs/development/beam-modules/expert/default.nix
index 4cd3a438e436..9cd0fd7aebbd 100644
--- a/pkgs/development/beam-modules/expert/default.nix
+++ b/pkgs/development/beam-modules/expert/default.nix
@@ -11,20 +11,20 @@
   writeShellApplication,
 }:
 let
-  version = "0.1.3";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "expert-lsp";
     repo = "expert";
     tag = "v${version}";
-    hash = "sha256-CGWWbzrBjCbz9S8f1nCLx2x6j4MFgsSd5XjgrxhuvzE=";
+    hash = "sha256-QpL58+rzXCl8jT/8sbvDmDZtcWz0+ZKg47XC33EwFyE=";
   };
 
   engineDeps = fetchMixDeps {
     pname = "mix-deps-expert-engine";
 
     inherit src version;
-    hash = "sha256-relCdTBialz4Z/BpXZxmuhSYrvJqLINg/AVGfEhuDGo=";
+    hash = "sha256-4l0Tc/6sOcjGVQtzEOG6QP/ss8rqh+AOnwxuJsuCZCk=";
 
     preConfigure = ''
       cd apps/engine
@@ -38,7 +38,7 @@ mixRelease rec {
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-Rx5O77UEIDKcCz967h/8z1MAdaw0syzvLG5JOSaqgLE=";
+    hash = "sha256-q6OOealif+LClT0HlJTojDtvMk4MEtI/EjQHbLntiP8=";
 
     preConfigure = ''
       cd apps/expert
diff --git a/pkgs/development/beam-modules/hooks/beam-module-install-hook.sh b/pkgs/development/beam-modules/hooks/beam-module-install-hook.sh
index ba66032751bc..273a8e622642 100644
--- a/pkgs/development/beam-modules/hooks/beam-module-install-hook.sh
+++ b/pkgs/development/beam-modules/hooks/beam-module-install-hook.sh
@@ -7,6 +7,8 @@
 beamModuleInstallHook() {
   echo "Executing beamModuleInstallHook"
 
+  runHook preInstall
+
   mkdir -p "$out/lib/erlang/lib/${beamModuleName}-${version}"
 
   # default to rebar3
@@ -25,6 +27,8 @@ beamModuleInstallHook() {
     fi
   done
 
+  runHook postInstall
+
   echo "Finished beamModuleInstallHook"
 }
 
diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 52b3e41cee8a..0cd3bf547172 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "27.3.4.12";
-  hash = "sha256-RnCBGuqEEJ+3kkbiVNLSb8sAh2i9SNyH9ixkqtAbjsk=";
+  version = "27.3.4.13";
+  hash = "sha256-2WF+EWq1S9IaDuUuG8IR09LjYvEq81E88oq6yFazkkM=";
 }
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index bc2c9546c894..3901f643f41a 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "28.5.0.1";
-  hash = "sha256-tZQQCBDpDcrN9QX8Qwz6HqNVATck1+emGVOviEhqsLc=";
+  version = "28.5.0.2";
+  hash = "sha256-H25iMB+CvAd8yXv8jydBOCYfMm0LEwN1otRearNthYI=";
 }
diff --git a/pkgs/development/interpreters/erlang/29.nix b/pkgs/development/interpreters/erlang/29.nix
index e3c2fbd2a90e..550183d18a9a 100644
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "29.0.1";
-  hash = "sha256-0I82VBCgA8KfdNYkNWyqcH+f0Kc6al11BAErtxfVDZo=";
+  version = "29.0.2";
+  hash = "sha256-6tpe+jCOC1V2SOPMH1J8DHVXQqR4pqEjIiAcSitn8Hc=";
 }
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 24f145e288e4..646bf961f038 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -21,7 +21,6 @@
   parallelBuild ? true,
 
   fetchFromGitHub,
-  fetchpatch2,
   gawk,
   gnum4,
   gnused,
@@ -112,15 +111,6 @@ stdenv.mkDerivation {
   ++ optionals javacSupport [ openjdk11 ]
   ++ optionals enableSystemd [ systemd ];
 
-  patches = lib.optionals (!wxSupport && major == "27") [
-    # https://github.com/erlang/otp/pull/11162
-    (fetchpatch2 {
-      name = "otp-27-doc-target-fix.patch";
-      url = "https://github.com/erlang/otp/commit/7ce587b61a2557fca79f1c130794abf834f37ee1.patch?full_index=1";
-      hash = "sha256-Ce6tWUzeF6TQMxus7ultxG2piFllw/xa5IPLCxSd024=";
-    })
-  ];
-
   # disksup requires a shell
   postPatch = ''
     substituteInPlace lib/os_mon/src/disksup.erl --replace-fail '"sh ' '"${runtimeShell} '
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index c8d4f7c39424..d8aa7f0abc00 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -1003,10 +1003,17 @@ in
       # remove failing tests
       rm tests/plenary/colors/colors_spec.lua # colors depend on neovim version usually
       rm tests/plenary/capture/capture_spec.lua # because clipboard not available
+      # trailing whitespace inconsistencies
+      rm tests/plenary/api/api_spec.lua
+      rm tests/plenary/babel/tangle_spec.lua
+      rm tests/plenary/capture/datetree_spec.lua
+      rm tests/plenary/init_spec.lua
+
+      # UI tests depend on the neovim version
+      rm -r tests/plenary/ui/*
 
       # not sure why yet
-      rm tests/plenary/ui/mappings/date_spec.lua \
-        tests/plenary/capture/templates_spec.lua
+      rm tests/plenary/capture/templates_spec.lua
 
       # bypass upstream launcher that interacts with network
       nvim --headless -i NONE \
diff --git a/pkgs/development/python-modules/helium/default.nix b/pkgs/development/python-modules/helium/default.nix
index 224b96664346..b2275f8e3cf4 100644
--- a/pkgs/development/python-modules/helium/default.nix
+++ b/pkgs/development/python-modules/helium/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "helium";
-  version = "7.0.1";
+  version = "7.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mherrmann";
     repo = "helium";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gIezXLVlPOpc5GY0eK7ua6TOiAlWV9/oGZQbimKnzjI=";
+    hash = "sha256-phZ7vSwRVM7QutZuy7Krtp7gUCK+5bg0AZA5qXJSVNA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/plover/4.nix b/pkgs/development/python-modules/plover/4.nix
index bda985cb0122..eee8ac5e5dc8 100644
--- a/pkgs/development/python-modules/plover/4.nix
+++ b/pkgs/development/python-modules/plover/4.nix
@@ -70,6 +70,10 @@ buildPythonPackage (finalAttrs: {
   # Segfaults?!
   disabledTestPaths = [ "test/gui_qt/test_dictionaries_widget.py" ];
 
+  postInstall = ''
+    install -Dm 444 linux/plover.desktop $out/share/applications/plover.desktop
+  '';
+
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
diff --git a/pkgs/development/python-modules/plover/5.nix b/pkgs/development/python-modules/plover/5.nix
index 1abbf78609e9..7676abeb0ee2 100644
--- a/pkgs/development/python-modules/plover/5.nix
+++ b/pkgs/development/python-modules/plover/5.nix
@@ -124,6 +124,10 @@ buildPythonPackage (finalAttrs: {
     "test/gui_qt/test_i18n_files.py" # babel errors
   ];
 
+  postInstall = ''
+    install -Dm 444 linux/plover.desktop $out/share/applications/plover.desktop
+  '';
+
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
diff --git a/pkgs/development/python-modules/uefi-firmware-parser/default.nix b/pkgs/development/python-modules/uefi-firmware-parser/default.nix
index 031880430d35..de95d2f5a495 100644
--- a/pkgs/development/python-modules/uefi-firmware-parser/default.nix
+++ b/pkgs/development/python-modules/uefi-firmware-parser/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   nix-update-script,
   setuptools,
-  wheel,
+  setuptools-scm,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [
     setuptools
-    wheel
+    setuptools-scm
   ];
 
   pythonRemoveDeps = [ "future" ];
diff --git a/pkgs/development/python-modules/zenoh/default.nix b/pkgs/development/python-modules/zenoh/default.nix
index 8946bcc4b3ea..c74b906ce3a5 100644
--- a/pkgs/development/python-modules/zenoh/default.nix
+++ b/pkgs/development/python-modules/zenoh/default.nix
@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "zenoh";
-  version = "1.6.2"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-python";
     rev = version;
-    hash = "sha256-GGqZGtHSCaPeO6wFFBxPjdjhsIdcgI1RJ4mZbGq4uzc=";
+    hash = "sha256-rKWbJti5bgwAfc8LpQFsU6KhhcWyWAwOX+SF1UAGRbk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-2Hieow0+GzcNQmvqsJd+5bpE9RWUDbaBR9jah+O4GtI=";
+    hash = "sha256-g7Om2QvlbwVmB0wGcbuafUELh53IJ2uM+miHyzBKQQI=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6102340485fc..aca3b795ba1e 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.11";
+    version = "7.0.12";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "03h6f1pa96xdszpxcnd846n5jgwqmc49gf9wbyq1gy8rlzpc59yr";
+      sha256 = "02fkkmmc28rw0kg02807jvv6k745zqfb9wg65dfd8sl298krp0fp";
     };
 
     # This is based on the following source: