diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index be0217132c9d..123b11f4717b 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -67,6 +67,9 @@
 
 - `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
 
+- `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
+  If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
+
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index e7a10bfffaba..3e6872e5cfe1 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -24,13 +24,8 @@ let
     # write NixOS settings as JSON
     (
       umask 077
-      cp --no-preserve=mode ${settingsFile} settings.yml
+      ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml
     )
-
-    # substitute environment variables
-    env -0 | while IFS='=' read -r -d ''' n v; do
-      sed "s#@$n@#$v#g" -i settings.yml
-    done
   '';
 
   settingType =
@@ -95,20 +90,20 @@ in
           {
             server.port = 8080;
             server.bind_address = "0.0.0.0";
-            server.secret_key = "@SEARX_SECRET_KEY@";
+            server.secret_key = "$SEARX_SECRET_KEY";
 
-            engines = lib.singleton {
+            engines = [ {
               name = "wolframalpha";
               shortcut = "wa";
-              api_key = "@WOLFRAM_API_KEY@";
+              api_key = "$WOLFRAM_API_KEY";
               engine = "wolframalpha_api";
-            };
+            } ];
           }
         '';
         description = ''
           Searx settings.
           These will be merged with (taking precedence over) the default configuration.
-          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `@VARIABLE_NAME@`.
+          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `$VARIABLE_NAME`.
 
           ::: {.note}
           For available settings, see the Searx [docs](https://docs.searxng.org/admin/settings/index.html).
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5fdeacd8e59b..9d6907a1d909 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1061,7 +1061,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ombi = runTest ./ombi.nix;
-  omnom = runTest ./omnom.nix;
+  omnom = runTest ./omnom;
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   opencloud = runTest ./opencloud.nix;
@@ -1082,6 +1082,7 @@ in
   open-web-calendar = runTest ./web-apps/open-web-calendar.nix;
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix { };
   orthanc = runTest ./orthanc.nix;
+  owi = runTest ./owi.nix;
   owncast = runTest ./owncast.nix;
   outline = runTest ./outline.nix;
   i18n = runTest ./i18n.nix;
diff --git a/nixos/tests/omnom.nix b/nixos/tests/omnom.nix
deleted file mode 100644
index 4bfdbd679b39..000000000000
--- a/nixos/tests/omnom.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, ... }:
-let
-  servicePort = 9090;
-in
-{
-  name = "Basic Omnom Test";
-  meta = {
-    maintainers = lib.teams.ngi.members;
-  };
-
-  nodes = {
-    server =
-      { config, lib, ... }:
-      {
-        services.omnom = {
-          enable = true;
-          openFirewall = true;
-
-          port = servicePort;
-
-          settings = {
-            app = {
-              disable_signup = false; # restrict CLI user-creation
-              results_per_page = 50;
-            };
-            server.address = "0.0.0.0:${toString servicePort}";
-          };
-        };
-      };
-  };
-
-  # TODO: take a snapshot
-  testScript =
-    { nodes, ... }:
-    # python
-    ''
-      server.start()
-      server.wait_for_unit("omnom.service")
-      server.wait_for_open_port(${toString servicePort})
-      server.succeed("curl -sf http://localhost:${toString servicePort}")
-    '';
-}
diff --git a/nixos/tests/omnom/config.nix b/nixos/tests/omnom/config.nix
new file mode 100644
index 000000000000..55c2cca56f2e
--- /dev/null
+++ b/nixos/tests/omnom/config.nix
@@ -0,0 +1,36 @@
+{ config, pkgs, ... }:
+{
+  services.omnom = {
+    enable = true;
+    openFirewall = true;
+
+    port = 9090;
+
+    settings = {
+      app = {
+        disable_signup = false; # restrict CLI user-creation
+        results_per_page = 50;
+      };
+      server.address = "0.0.0.0:${toString config.services.omnom.port}";
+    };
+  };
+
+  programs.firefox = {
+    enable = true;
+    # librewolf allows installations of unsigned extensions
+    package = pkgs.wrapFirefox pkgs.librewolf-unwrapped {
+      nixExtensions = [
+        (
+          let
+            # specified in manifest.json of the addon
+            extid = "{f0bca7ce-0cda-41dc-9ea8-126a50fed280}";
+          in
+          pkgs.runCommand "omnom" { passthru = { inherit extid; }; } ''
+            mkdir -p $out
+            cp ${pkgs.omnom}/share/addons/omnom_ext_firefox.zip $out/${extid}.xpi
+          ''
+        )
+      ];
+    };
+  };
+}
diff --git a/nixos/tests/omnom/default.nix b/nixos/tests/omnom/default.nix
new file mode 100644
index 000000000000..6f115037aca5
--- /dev/null
+++ b/nixos/tests/omnom/default.nix
@@ -0,0 +1,105 @@
+{ config, pkgs, ... }:
+{
+  name = "Basic Omnom Test";
+  meta = {
+    inherit (pkgs.omnom.meta) maintainers;
+  };
+
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        imports = [
+          ../common/x11.nix
+          ./config.nix
+        ];
+
+        environment.systemPackages = [ pkgs.xdotool ];
+      };
+  };
+
+  testScript =
+    let
+      port = toString config.nodes.server.services.omnom.port;
+    in
+    # python
+    ''
+      import re
+
+      def open_omnom():
+        # Add-ons Manager
+        server.succeed("xdotool mousemove --sync 960 90 click 1")
+        server.sleep(10)
+        # omnom
+        server.succeed("xdotool mousemove --sync 700 190 click 1")
+        server.sleep(10)
+
+
+      service_url = "http://127.0.0.1:${toString port}"
+
+      server.start()
+      server.wait_for_unit("omnom.service")
+      server.wait_for_open_port(${toString port})
+      server.succeed(f"curl -sf '{service_url}'")
+
+      output = server.succeed("omnom create-user user user@example.com")
+      match = re.search(r"Visit (.+?) to sign in", output)
+      assert match is not None, "Login URL not found"
+      login_url = match[1].replace("0.0.0.0", "127.0.0.1")
+
+      output = server.succeed("omnom create-token user addon")
+      match = re.search(r"Token (.+?) created", output)
+      assert match is not None, "Addon token not found"
+      token = match[1]
+
+      server.wait_for_x()
+      server.succeed(f"librewolf --new-window '{login_url}' >&2 &")
+      server.wait_for_window("Omnom")
+
+      open_omnom()
+
+      # token
+      server.succeed("xdotool mousemove --sync 700 350 click 1")
+      server.succeed(f"xdotool type {token}")
+      server.sleep(10)
+
+      # url
+      server.succeed("xdotool mousemove --sync 700 470 click 1")
+      server.succeed(f"xdotool type '{service_url}'")
+      server.sleep(10)
+
+      # submit
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      open_omnom()
+
+      # save
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      # refresh
+      server.succeed("xdotool mousemove --sync 100 80 click 1")
+      server.sleep(10)
+
+      server.screenshot("home.png")
+
+      # view bookmarks
+      server.succeed("xdotool mousemove --sync 300 130 click 1")
+      server.sleep(10)
+
+      # view snapshot
+      server.succeed("xdotool mousemove --sync 970 230 click 1")
+      server.sleep(10)
+      server.succeed("xdotool mousemove --sync 160 340 click 1")
+      server.sleep(10)
+
+      server.screenshot("screenshot.png")
+
+      # view details
+      server.succeed("xdotool mousemove --sync 290 200 click 1")
+      server.sleep(10)
+
+      server.screenshot("snapshot_details.png")
+    '';
+}
diff --git a/nixos/tests/owi.nix b/nixos/tests/owi.nix
new file mode 100644
index 000000000000..74e9d2d394fd
--- /dev/null
+++ b/nixos/tests/owi.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "owi";
+
+  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];
+
+  nodes.machine = {
+    environment.systemPackages = with pkgs; [ owi ];
+
+    environment.etc."owipass.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_one(x: i32, y: i32) -> i32 {
+          (x + y)/2
+      }
+
+      fn mean_two(x: i32, y: i32) -> i32 {
+          (y + x)/2
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          // proving the commutative property of addition!
+          owi_sym::assert(mean_one(x, y) == mean_two(x, y))
+      }
+    '';
+
+    environment.etc."owifail.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_wrong(x: i32, y: i32) -> i32 {
+          (x + y) / 2
+      }
+
+      fn mean_correct(x: i32, y: i32) -> i32 {
+          (x & y) + ((x ^ y) >> 1)
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          owi_sym::assert(mean_wrong(x, y) == mean_correct(x, y))
+      }
+    '';
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      # testing
+      machine.succeed("owi rust --fail-on-assertion-only /etc/owipass.rs")
+      machine.fail("owi rust --fail-on-assertion-only /etc/owifail.rs")
+    '';
+}
diff --git a/nixos/tests/searx.nix b/nixos/tests/searx.nix
index 6cbc878df2c8..18199e6db3ed 100644
--- a/nixos/tests/searx.nix
+++ b/nixos/tests/searx.nix
@@ -28,7 +28,7 @@
         server = {
           port = "8080";
           bind_address = "0.0.0.0";
-          secret_key = "@SEARX_SECRET_KEY@";
+          secret_key = "$SEARX_SECRET_KEY";
         };
       };
     };
diff --git a/pkgs/applications/editors/greenfoot/default.nix b/pkgs/applications/editors/greenfoot/default.nix
index a88ab68cef87..4b1ff0007b45 100644
--- a/pkgs/applications/editors/greenfoot/default.nix
+++ b/pkgs/applications/editors/greenfoot/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${openjdk}/bin/java $out/bin/greenfoot \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "-Dawt.useSystemAAFontSettings=on -Xmx512M \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp -Xmx512M \
                    --add-opens javafx.graphics/com.sun.glass.ui=ALL-UNNAMED \
                    -cp $out/share/greenfoot/boot.jar bluej.Boot \
                    -greenfoot=true -bluej.compiler.showunchecked=false \
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 09a6e442549e..eaf0cc7f1b59 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2045,8 +2045,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.33.2";
-          hash = "sha256-28J1PxqJgULkbO49gjMyJf79pSlN1ZeN9vN5clJ2wYo=";
+          version = "6.35.0";
+          hash = "sha256-stSo+GHhEzIE1HevACEUmum9tNetMIfpz0t8330QlTI=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4403,8 +4403,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "4.26.0";
-          hash = "sha256-Mru3dz0Dl/oDHd0tB/0Ixd+EselC+e70Cn7sdu1gkwk=";
+          version = "4.27.0";
+          hash = "sha256-0BqIJL9Vyccjsov1JQil3dRUdo9w8ecOUotVKzBlYGQ=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };
diff --git a/pkgs/applications/graphics/processing/default.nix b/pkgs/applications/graphics/processing/default.nix
index 401e9881032b..65e28fec764a 100644
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@@ -131,11 +131,11 @@ stdenv.mkDerivation rec {
     makeWrapper $out/share/${pname}/processing $out/bin/processing \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
     makeWrapper $out/share/${pname}/processing-java $out/bin/processing-java \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/misc/ganttproject-bin/default.nix b/pkgs/applications/misc/ganttproject-bin/default.nix
index f50aff51f579..0065eac9c8d5 100644
--- a/pkgs/applications/misc/ganttproject-bin/default.nix
+++ b/pkgs/applications/misc/ganttproject-bin/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       };
 
       javaOptions = [
-        "-Dawt.useSystemAAFontSettings=on"
+        "-Dawt.useSystemAAFontSettings=gasp"
       ];
 
     in
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       mkdir -pv "$out/bin"
       wrapProgram "$out/share/ganttproject/ganttproject" \
         --set JAVA_HOME "${jre}" \
-        --set _JAVA_OPTIONS "${builtins.toString javaOptions}"
+        --prefix _JAVA_OPTIONS " " "${builtins.toString javaOptions}"
 
       mv -v "$out/share/ganttproject/ganttproject" "$out/bin"
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3902cc789074..031a7eb731e9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -36,13 +36,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-TJWa1vGYfC8mSzOdMI0WKU8ZXkm26pZKyoXLfAJVehQ=",
+    "hash": "sha256-36gEDXAZgeniGe6zCmfLkVj0yxYfSk11tmk61cWly04=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.42.0",
+    "rev": "v4.43.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-pQMQvJ/T6adUydIu6vRvSxaeEry22wYmIzY3ryPncJc="
+    "vendorHash": "sha256-jZ950/nPFt3+t3CHsNEkYo7POabRCHVvcfu04Iq3cJc="
   },
   "akamai": {
     "hash": "sha256-JALEVzmBVmHtCG4B1jNeNdSWb+SGZWDSZgUQ5voMQPg=",
@@ -1183,13 +1183,13 @@
     "vendorHash": "sha256-uMZIze8sng80sCb6f9CsWHVMmUGMaaOD4Ezx9B2fAJ4="
   },
   "sentry": {
-    "hash": "sha256-/rulw49DcAi5tk4j6XpvlG0X6HJgcMI+zotKsFU2MmI=",
+    "hash": "sha256-b5a0++mu6roN6VuJaBZEczfqA6Stt+a7fTOLGLvqPeQ=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.14.5",
+    "rev": "v0.14.6",
     "spdx": "MIT",
-    "vendorHash": "sha256-OurLZioO4zEBwsOyeUhv2KpQZEPySJn7I65w2rmvUn8="
+    "vendorHash": "sha256-67xoILi88FEN005tk8Z3ggc3ggfuS1AHthYglqvOLE4="
   },
   "shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index 7296265b84f0..4be39c483282 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,56 +1,56 @@
 {
   "stable": {
     "linux": {
-      "version": "8.11.0",
+      "version": "8.11.2",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.0.x64.tar.gz",
-          "hash": "sha256-aE7AQPzgMNZh++HOFduT4c7qipEvjUdQ9sBH8epuXeE="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.2.x64.tar.gz",
+          "hash": "sha256-2yYzUO/ZdB/BA3wT+2fKM0ZzJzBpVH/N5xaIg50lzzo="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.0.arm64.tar.gz",
-          "hash": "sha256-5jmMolrISZaoqsGEYhsTxlKgAZk+RdVUOBMQDIn9nFM="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.2.arm64.tar.gz",
+          "hash": "sha256-slKgf7ahA6pFBR2V9L8mI7ROisARRY7M4IjB1UYhwvU="
         }
       }
     },
     "darwin": {
-      "version": "8.11.0",
+      "version": "8.11.2",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.0-x86_64.zip",
-          "hash": "sha256-bZoX7mxh7JqYKgPQGUjrWEFYKGjl7dzhpL/CIt5IY00="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.2-x86_64.zip",
+          "hash": "sha256-jcfSjcAajkgRQP0JA//f4Ltc62nDeISFZxYuGObFMKA="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.0-aarch64.zip",
-          "hash": "sha256-I88nfsb1xsErgafmo0qqSHcalhTMkGH9m0bMWAGlad8="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.2-aarch64.zip",
+          "hash": "sha256-pdnEhTJCSod/VnbKVvCEqQzNjGwDPz28Or97+jLSwJk="
         }
       }
     }
   },
   "beta": {
     "linux": {
-      "version": "8.11.2-18.BETA",
+      "version": "8.11.4-21.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.2-18.BETA.x64.tar.gz",
-          "hash": "sha256-/8sXdF1JmJX3kFOn9SCRz6Cr/ZldzHfhvq1oJlV19v8="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.4-21.BETA.x64.tar.gz",
+          "hash": "sha256-HWPeTCtjHH8vngDX0+tGbiDMj1FoW8a4RCu34RqJXmI="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.2-18.BETA.arm64.tar.gz",
-          "hash": "sha256-bDRJAU6LgkoHp1Fi/KQPm/Fe/BkGt7V+dGVnLh9awcs="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.4-21.BETA.arm64.tar.gz",
+          "hash": "sha256-yPjzweuJPvvOkJcIElaAogzBpWPvYch6DQarRoaZojc="
         }
       }
     },
     "darwin": {
-      "version": "8.11.2-18.BETA",
+      "version": "8.11.4-21.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.2-18.BETA-x86_64.zip",
-          "hash": "sha256-oZqrNB49SR8UWh8qXnKi/xlT/b2YUxPCLpz2tjwzzuw="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.4-21.BETA-x86_64.zip",
+          "hash": "sha256-FozwWYQCrqWbfw9qaPRLbaUVWa5hTwG3NHjtZc4smdk="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.2-18.BETA-aarch64.zip",
-          "hash": "sha256-+EXrqEe3cDp9Ez8iug53HhSTtz0tDYsUXHAsXtRHGH4="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.4-21.BETA-aarch64.zip",
+          "hash": "sha256-0eXtLqknEPG+G+mxa7QYWkUVPu13/KAdkOb9fklZIqg="
         }
       }
     }
diff --git a/pkgs/by-name/_1/_1password-gui/update.sh b/pkgs/by-name/_1/_1password-gui/update.sh
index 07fc726e2f74..b4a2fb91f1f2 100755
--- a/pkgs/by-name/_1/_1password-gui/update.sh
+++ b/pkgs/by-name/_1/_1password-gui/update.sh
@@ -37,6 +37,7 @@ read_local_versions() {
 
 read_remote_versions() {
   local channel="$1"
+  local darwin_beta_maybe
 
   if [[ ${channel} == "stable" ]]; then
     remote_versions["stable/linux"]=$(
@@ -56,10 +57,17 @@ read_remote_versions() {
         | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password-beta") | .version | sub("_"; "-")'
     )
 
-    remote_versions["beta/darwin"]=$(
+    # Handle macOS Beta app-update feed quirk.
+    # If there is a newer release in the stable channel, queries for beta
+    # channel will return the stable channel version; masking the current beta.
+    darwin_beta_maybe=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/Y" \
         | "${JQ[@]}" 'select(.available == "1") | .version'
     )
+    # Only consider versions that end with '.BETA'
+    if [[ ${darwin_beta_maybe} =~ \.BETA$ ]]; then
+      remote_versions["beta/darwin"]=${darwin_beta_maybe}
+    fi
   fi
 }
 
@@ -98,9 +106,12 @@ for i in "${!remote_versions[@]}"; do
   fi
 done
 
-if [[ ${#new_version_available[@]} -eq 0 ]]; then
-  # up to date
-  exit
+num_updates=${#new_version_available[@]}
+if (( num_updates == 0 )); then
+  exit # up to date
+elif (( num_updates == 1 )); then
+  os=$(cut -d / -f 2 <<<"${new_version_available[@]}")
+  os_specific_update=" (${os} only)"
 fi
 
 ./update-sources.py "${new_version_available[@]}"
@@ -109,7 +120,7 @@ cat <<EOF
   {
     "attrPath": "${attr_path}",
     "oldVersion": "${old_version}",
-    "newVersion": "${new_version}",
+    "newVersion": "${new_version}${os_specific_update-}",
     "files": [
       "$PWD/sources.json"
     ]
diff --git a/pkgs/by-name/ab/abiword/package.nix b/pkgs/by-name/ab/abiword/package.nix
index aaac2f39a4f1..08a8ced24788 100644
--- a/pkgs/by-name/ab/abiword/package.nix
+++ b/pkgs/by-name/ab/abiword/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  autoreconfHook269,
+  autoreconfHook,
   autoconf-archive,
   pkg-config,
   gtk3,
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    autoreconfHook269
+    autoreconfHook
     autoconf-archive
     pkg-config
     wrapGAppsHook3
diff --git a/pkgs/by-name/al/alacritty-theme/package.nix b/pkgs/by-name/al/alacritty-theme/package.nix
index df06e6abf25e..e441805d46c3 100644
--- a/pkgs/by-name/al/alacritty-theme/package.nix
+++ b/pkgs/by-name/al/alacritty-theme/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   pname = "alacritty-theme";
-  version = "0-unstable-2025-05-15";
+  version = "0-unstable-2025-07-16";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "59a96ef4c734f97a1aadaa619b31cc1ca90a0fbc";
-    hash = "sha256-7Qu00+odZblXqN9e3uVZWfIWySFT0IiwIyK5wEbtReE=";
+    rev = "6c91a0e913396daafdb7ca43e84014d4e176623c";
+    hash = "sha256-Rq5AB9BktTaCQ1UzUITgu6g5a74C0sHpiiHAjeC1RiA=";
     sparseCheckout = [ "themes" ];
   };
 
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 430c563295eb..48da2357d034 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "7.24.0";
+  version = "7.25.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-iURIOxRgGCNXJA+9cDb07iwj0b4H8TdX8bPPmM3RjyI=";
+    hash = "sha256-e13en0fQHO0i49gP1zU6ms9TDMAwo1qsubsTi/DdIUo=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index a855ab261d01..56f3ff246ac7 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -63,9 +63,9 @@
 
   confcom = mkAzExtension rec {
     pname = "confcom";
-    version = "1.2.1";
+    version = "1.2.6";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-D78WwrOKbc8RNAa9Q3wgZRjVOUy/012+KIlTtk5NeTM=";
+    hash = "sha256-kyJ4AkPcpP/10nf4whJiuraC7hn0E6iBkhRIn43E9J0=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl_1_1 ];
diff --git a/pkgs/by-name/ba/babeltrace2/package.nix b/pkgs/by-name/ba/babeltrace2/package.nix
index e26811b6a653..91d6c8e35441 100644
--- a/pkgs/by-name/ba/babeltrace2/package.nix
+++ b/pkgs/by-name/ba/babeltrace2/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "babeltrace2";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "efficios";
     repo = "babeltrace";
     rev = "v${version}";
-    hash = "sha256-ppSPly4HR/oemsX069o6VqwSB1AU1mKRwRepwPORf7I=";
+    hash = "sha256-4vqeIwCWEAzsHTdM2S2grF7F4vPqiWTeTEZpxsqf2g8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/be/bee/package.nix b/pkgs/by-name/be/bee/package.nix
index 3ad451df6c4f..4bffa8569d31 100644
--- a/pkgs/by-name/be/bee/package.nix
+++ b/pkgs/by-name/be/bee/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bee";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "ethersphere";
     repo = "bee";
     rev = "v${version}";
-    hash = "sha256-44mjSeV8imatPpNkRSA5Uewunvkc5j6Eo+gKya+dqzE=";
+    hash = "sha256-Yz23iVYGZ4PS1jbV5zFaCEsQOoAbHBpePml0zp5GSkQ=";
   };
 
-  vendorHash = "sha256-1Hl0tT6ZI3otEdOQw9adipOGcSyZXLbSLC8s7YsFRZA=";
+  vendorHash = "sha256-0czsloD2EhSWKQbj7NJ4IqGgKM9+Vp8gSIhOKWg/onA=";
 
   subPackages = [ "cmd/bee" ];
 
diff --git a/pkgs/by-name/bl/bluej/package.nix b/pkgs/by-name/bl/bluej/package.nix
index 52e46d1f30fd..ff2238a5323a 100644
--- a/pkgs/by-name/bl/bluej/package.nix
+++ b/pkgs/by-name/bl/bluej/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${openjdk}/bin/java $out/bin/bluej \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "-Dawt.useSystemAAFontSettings=on -Xmx512M \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp -Xmx512M \
                    --add-opens javafx.graphics/com.sun.glass.ui=ALL-UNNAMED \
                    -cp $out/share/bluej/boot.jar bluej.Boot"
 
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index e60de5ac2d97..54dc21c11237 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.80.122";
+  version = "1.80.124";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-UQmSZ3Xi96Q6/8Y09L5VaPVJHv7gUXcOyv5Ba35Z80s=";
+      hash = "sha256-K3AlYkAMDz988klsGTqYtvt3tswyLa5PhTdy4f0mU9E=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-Q/m81hCZF8om3Tlxlj77GPiBElJVibJFA/ts7mtN6n8=";
+      hash = "sha256-4WP9uGuFcpW9Z0omqQBDTAjr+XCYa9mXcJGnxcm2inQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-BezJ5ZXUBC2itSNUivnqygY8VzzIXM6wb3QSC+LE1uM=";
+      hash = "sha256-vgqYktoVPDOmhibes9ghPcV2cpnyxliKvmELI8Brh0I=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-NN7Anrjym50DRo0qI5bF/XzhssgPuKOhk1CJgMoOq70=";
+      hash = "sha256-hVKuO3sSMc+yQiwHpwgYxfh7tyXHUpcWNQO6o9uf5Ro=";
     };
   };
 
diff --git a/pkgs/by-name/br/brmodelo/package.nix b/pkgs/by-name/br/brmodelo/package.nix
index bcc9e5c2df60..409b2e82cabb 100644
--- a/pkgs/by-name/br/brmodelo/package.nix
+++ b/pkgs/by-name/br/brmodelo/package.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     # _JAVA_AWT_WM_NONREPARENTING=1.
     makeWrapper ${jdk8}/bin/java $out/bin/brmodelo \
        --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-       --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
+       --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
        --add-flags "-jar $out/share/java/brModelo.jar"
 
     for size in 16 24 32 48 64 128 256; do
diff --git a/pkgs/by-name/bu/bun/package.nix b/pkgs/by-name/bu/bun/package.nix
index 4b69f29021dc..ceeb62523e3c 100644
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.2.18";
+  version = "1.2.19";
   pname = "bun";
 
   src =
@@ -86,19 +86,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-zKnrUnYrvYHriU/IJ1u6CgZU6BqtMY0ZhphUow83aaI=";
+        hash = "sha256-Z0pIN4NC76rcPCkVlrVzAQ88I4iVj3xEZ42H9vt1mZE=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-G60WcdBboVaWMVynJI7AQ9KbWV/1+xX6hraZwiVdi8U=";
+        hash = "sha256-/P1HHNvVp4/Uo5DinMzSu3AEpJ01K6A3rzth1P1dC4M=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-1/XHbGiaZ/D5pRmDy2EJacwUYhdr2P0BSDwKDBoG9P4=";
+        hash = "sha256-7CE3X3nul26pjI7wn+KnijCkibQxWUd13amCgPexEGQ=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-kOAyqYKuKZxi1kXaxsqqjrALaQkryFAb8TpZDejQmcg=";
+        hash = "sha256-w9PBTppeyD/2fQrP525DFa0G2p809Z/HsTgTeCyvH2Y=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/by-name/ca/capnproto-rust/package.nix b/pkgs/by-name/ca/capnproto-rust/package.nix
index 0cb462c0d63d..01a7e50751e6 100644
--- a/pkgs/by-name/ca/capnproto-rust/package.nix
+++ b/pkgs/by-name/ca/capnproto-rust/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "capnproto-rust";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchCrate {
     crateName = "capnpc";
     inherit version;
-    hash = "sha256-WqzcUnAx/qD50/ZlWlWS4bguTxW+qFj0uFzwsbxHBaw=";
+    hash = "sha256-9Vsr6pRfC8Onqw/Yna2cJl1L70uo3K/C80CztNw0XoQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FtJvm6uUFSHn8lQxEFoWpSZgqomfHYkR3E0kKsV/II4=";
+  cargoHash = "sha256-V92zF75fd5MVz84YnWJONNjxZsA4zHTee1hAPAkoX6k=";
 
   postInstall = ''
     mkdir -p $out/include/capnp
diff --git a/pkgs/by-name/ci/cie-middleware-linux/package.nix b/pkgs/by-name/ci/cie-middleware-linux/package.nix
index 77c9528e4451..e765490f117b 100644
--- a/pkgs/by-name/ci/cie-middleware-linux/package.nix
+++ b/pkgs/by-name/ci/cie-middleware-linux/package.nix
@@ -120,7 +120,7 @@ stdenv.mkDerivation {
     mkdir -p "$out/bin"
     makeWrapper "${jre}/bin/java" "$out/bin/cieid" \
       --add-flags "-Djna.library.path='$out/lib:${libraries}'" \
-      --add-flags '-Dawt.useSystemAAFontSettings=on' \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-cp $out/share/cieid/cieid.jar" \
       --add-flags "app.m0rf30.cieid.MainApplication"
 
diff --git a/pkgs/by-name/co/compare50/package.nix b/pkgs/by-name/co/compare50/package.nix
new file mode 100644
index 000000000000..0981bb9454b7
--- /dev/null
+++ b/pkgs/by-name/co/compare50/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "compare50";
+  version = "1.2.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cs50";
+    repo = "compare50";
+    tag = "v${version}";
+    hash = "sha256-T7ts/9Uux2gVhh5EGv8PRh9cbCQDbLBYD06sWqNSvLU=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace-fail \
+      'scripts=["bin/compare50"]' 'entry_points={"console_scripts": ["compare50=compare50.__main__:main"]}'
+    # auto included in current python version, no install needed
+    substituteInPlace setup.py --replace-fail \
+      'importlib' ' '
+  '';
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    attrs
+    intervaltree
+    jinja2
+    lib50
+    numpy
+    packaging
+    pygments
+    termcolor
+    tqdm
+  ];
+
+  pythonRelaxDeps = [
+    "attrs"
+    "numpy"
+    "termcolor"
+  ];
+
+  pythonImportsCheck = [ "compare50" ];
+
+  versionCheckProgramArg = "--version";
+  nativeCheckInputs = [ versionCheckHook ];
+
+  # repo does not use pytest
+  checkPhase = ''
+    runHook preCheck
+
+    ${python3Packages.python.interpreter} -m tests
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Tool for detecting similarity in code supporting over 300 languages";
+    homepage = "https://cs50.readthedocs.io/projects/compare50/en/latest/";
+    downloadPage = "https://github.com/cs50/compare50";
+    changelog = "https://github.com/cs50/compare50/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "compare50";
+  };
+}
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 7e3ff087f355..cbb365047ca9 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20250714";
+  version = "20250721";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-pvJnBMuTJb4juJBJObpA9hP2Fw42IssdAARUGUuEgJo=";
+    hash = "sha256-//HU8zZspR5Rq2xjo1QLLzigGJLuGJE4czUkzXnJ7EA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cr/crossfire-gridarta/package.nix b/pkgs/by-name/cr/crossfire-gridarta/package.nix
index 59d274d9774b..e60dad6e0d91 100644
--- a/pkgs/by-name/cr/crossfire-gridarta/package.nix
+++ b/pkgs/by-name/cr/crossfire-gridarta/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jre}/bin/java $out/bin/crossfire-gridarta \
       --add-flags "-jar $out/share/java/CrossfireEditor.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
 
     runHook postInstall
diff --git a/pkgs/by-name/cr/crossfire-jxclient/package.nix b/pkgs/by-name/cr/crossfire-jxclient/package.nix
index e5297d6fab50..b214fce6dcd1 100644
--- a/pkgs/by-name/cr/crossfire-jxclient/package.nix
+++ b/pkgs/by-name/cr/crossfire-jxclient/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jre}/bin/java $out/bin/crossfire-jxclient \
       --add-flags "-jar $out/share/java/jxclient.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
 
     runHook postInstall
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index 3cda7cb06e17..8a5e0eadaabc 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "filebeat";
-  version = "8.18.3";
+  version = "8.18.4";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${version}";
-    hash = "sha256-Lg+3M4zw0m7URBvC2G3aasXG7owc8JslMX4kI95qSCU=";
+    hash = "sha256-H7UKYp+REz7d9wKrP+AhIJp4ydCVS8NGKfBFvDFZWiA=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-2Rl4OJOMbt74QVb57Or2JklYSjTFRkly5GXrW0LAkoI=";
+  vendorHash = "sha256-G4+FsmmPDyssD+n1N1BnCElYv/bW7kY2tF60r49ZhN8=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/applications/audio/fmit/default.nix b/pkgs/by-name/fm/fmit/package.nix
similarity index 79%
rename from pkgs/applications/audio/fmit/default.nix
rename to pkgs/by-name/fm/fmit/package.nix
index 9455874ded68..16fca47c5506 100644
--- a/pkgs/applications/audio/fmit/default.nix
+++ b/pkgs/by-name/fm/fmit/package.nix
@@ -1,13 +1,10 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
+  libsForQt5,
   fftw,
-  qtbase,
-  qtmultimedia,
-  qmake,
   itstool,
-  wrapQtAppsHook,
   alsaSupport ? true,
   alsa-lib ? null,
   jackSupport ? false,
@@ -20,34 +17,34 @@ assert alsaSupport -> alsa-lib != null;
 assert jackSupport -> libjack2 != null;
 assert portaudioSupport -> portaudio != null;
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fmit";
   version = "1.2.14";
 
   src = fetchFromGitHub {
     owner = "gillesdegottex";
     repo = "fmit";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "1q062pfwz2vr9hbfn29fv54ip3jqfd9r99nhpr8w7mn1csy38azx";
   };
 
   nativeBuildInputs = [
-    qmake
+    libsForQt5.qmake
     itstool
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
   buildInputs =
     [
       fftw
-      qtbase
-      qtmultimedia
+      libsForQt5.qtbase
+      libsForQt5.qtmultimedia
     ]
     ++ lib.optionals alsaSupport [ alsa-lib ]
     ++ lib.optionals jackSupport [ libjack2 ]
     ++ lib.optionals portaudioSupport [ portaudio ];
 
   postPatch = ''
-    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${version}'
+    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${finalAttrs.version}'
   '';
 
   qmakeFlags =
@@ -64,15 +61,15 @@ mkDerivation rec {
       "CONFIG+=acs_portaudio"
     ];
 
-  meta = with lib; {
+  meta = {
     description = "Free Musical Instrument Tuner";
     longDescription = ''
       FMIT is a graphical utility for tuning musical instruments, with error
       and volume history, and advanced features.
     '';
     homepage = "http://gillesdegottex.github.io/fmit/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ orivej ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ orivej ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/fr/freeplane/package.nix b/pkgs/by-name/fr/freeplane/package.nix
index adc4de096c11..51950507ec63 100644
--- a/pkgs/by-name/fr/freeplane/package.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@@ -102,7 +102,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         ]
       } \
       --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-      --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on"
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/misc/gazelle-origin/default.nix b/pkgs/by-name/ga/gazelle-origin/package.nix
similarity index 73%
rename from pkgs/tools/misc/gazelle-origin/default.nix
rename to pkgs/by-name/ga/gazelle-origin/package.nix
index 37ef0aedd9cc..3fa2a2431b86 100644
--- a/pkgs/tools/misc/gazelle-origin/default.nix
+++ b/pkgs/by-name/ga/gazelle-origin/package.nix
@@ -1,26 +1,23 @@
 {
   lib,
-  buildPythonApplication,
   fetchFromGitHub,
-  bencoder,
-  pyyaml,
-  requests,
+  python3Packages,
 }:
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gazelle-origin";
   version = "3.0.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
-    repo = pname;
+    repo = "gazelle-origin";
     # Use the spinfast319 fork, since it seems that upstream
     # at <https://github.com/x1ppy/gazelle-origin> is inactive
     owner = "spinfast319";
-    rev = version;
+    tag = version;
     hash = "sha256-+yMKnfG2f+A1/MxSBFLaHfpCgI2m968iXqt+2QanM/c=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = with python3Packages; [
     bencoder
     pyyaml
     requests
@@ -28,12 +25,12 @@ buildPythonApplication rec {
 
   pythonImportsCheck = [ "gazelleorigin" ];
 
-  meta = with lib; {
+  meta = {
     description = "Tool for generating origin files using the API of Gazelle-based torrent trackers";
     homepage = "https://github.com/spinfast319/gazelle-origin";
     # TODO license is unspecified in the upstream, as well as the fork
-    license = licenses.unfree;
-    maintainers = with maintainers; [ somasis ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ somasis ];
     mainProgram = "gazelle-origin";
   };
 }
diff --git a/pkgs/by-name/go/go-licence-detector/package.nix b/pkgs/by-name/go/go-licence-detector/package.nix
index f4e1d3f66c8b..7e6fb1aacfcd 100644
--- a/pkgs/by-name/go/go-licence-detector/package.nix
+++ b/pkgs/by-name/go/go-licence-detector/package.nix
@@ -6,20 +6,15 @@
 
 buildGoModule rec {
   pname = "go-licence-detector";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "go-licence-detector";
     rev = "v${version}";
-    hash = "sha256-z2fJsDnDhD/0fF1QEQIKB398TqAsug1Ye5LbGpJWyfE=";
+    hash = "sha256-Mo4eBBP9UueLEMVnxndatizDaxVyZuHACvFoV38dRVI=";
   };
 
-  postPatch = ''
-    substituteInPlace go.mod \
-      --replace-fail "go 1.24.5" "go 1.24"
-  '';
-
   vendorHash = "sha256-quFa2gBPsyRMOBde+KsIF8NCHYSF+X9skvIWnpm2Nss=";
 
   meta = with lib; {
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index 7c25e508a09f..eace2edb9f10 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.5.4";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "gocryptfs";
     rev = "v${version}";
-    sha256 = "sha256-lDIKMcZLAE1ehijzhpx6G966xzdhusT40Dy06LXBn74=";
+    sha256 = "sha256-zvem4Uc+pNCDVMsnl/BwMYLp3DSYnYy6jwWM2kduq7k=";
   };
 
-  vendorHash = "sha256-WfTJ8TuFupEa391XQMDl3hKTjrmRHJqvYb1haAGHW/U=";
+  vendorHash = "sha256-dvOROh5TsMl+52RvKmDG4ftNv3WF19trgttu5BGWktU=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index 5da1c501a11d..0a87d4a4ef2b 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "golangci-lint";
-  version = "2.2.2";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XpFbcyuARE4gvSsWoIXM+CMUiDeuIiM5dbGPt5ACLA8=";
+    hash = "sha256-Kr4nkoqlCGyuaa4X1BLqe/WZA+ofYkWPizPMzcZQDQg=";
   };
 
-  vendorHash = "sha256-Dh+HTUM3uD/l2g4R0hFEtrzjlrOcZQf2S3ELXKWl01U=";
+  vendorHash = "sha256-SsKypfsr1woHah9rIyFnUNdp0mTde7k++E2CfE22LK4=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/applications/misc/hovercraft/default.nix b/pkgs/by-name/ho/hovercraft/package.nix
similarity index 57%
rename from pkgs/applications/misc/hovercraft/default.nix
rename to pkgs/by-name/ho/hovercraft/package.nix
index a9c882443d0f..6d25cddf4c03 100644
--- a/pkgs/applications/misc/hovercraft/default.nix
+++ b/pkgs/by-name/ho/hovercraft/package.nix
@@ -1,33 +1,26 @@
 {
   lib,
-  buildPythonApplication,
-  isPy3k,
   fetchFromGitHub,
-  manuel,
-  setuptools,
-  docutils,
-  lxml,
-  svg-path,
-  pygments,
-  watchdog,
+  python3Packages,
   fetchpatch,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "hovercraft";
   version = "2.7";
   format = "setuptools";
-  disabled = !isPy3k;
+  disabled = !python3Packages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "regebro";
     repo = "hovercraft";
-    rev = version;
-    sha256 = "0k0gjlqjz424rymcfdjpj6a71ppblfls5f8y2hd800d1as4im8az";
+    tag = version;
+    hash = "sha256-X6EaiVahAYAaFB65oqmj695wlJFXNseqz0SQLzGVD0w=";
   };
 
-  nativeCheckInputs = [ manuel ];
-  propagatedBuildInputs = [
+  nativeCheckInputs = with python3Packages; [ manuel ];
+
+  dependencies = with python3Packages; [
     setuptools
     docutils
     lxml
@@ -39,15 +32,15 @@ buildPythonApplication rec {
     (fetchpatch {
       name = "fix tests with pygments 2.14";
       url = "https://sources.debian.org/data/main/h/hovercraft/2.7-5/debian/patches/0003-Fix-tests-with-pygments-2.14.patch";
-      sha256 = "sha256-qz4Kp4MxlS3KPKRB5/VESCI++66U9q6cjQ0cHy3QjTc=";
+      hash = "sha256-qz4Kp4MxlS3KPKRB5/VESCI++66U9q6cjQ0cHy3QjTc=";
     })
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Makes impress.js presentations from reStructuredText";
     mainProgram = "hovercraft";
     homepage = "https://github.com/regebro/hovercraft";
-    license = licenses.mit;
-    maintainers = with maintainers; [ makefu ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ makefu ];
   };
 }
diff --git a/pkgs/by-name/ii/iio-sensor-proxy/package.nix b/pkgs/by-name/ii/iio-sensor-proxy/package.nix
index dee2b98620a6..e30fb572ea1b 100644
--- a/pkgs/by-name/ii/iio-sensor-proxy/package.nix
+++ b/pkgs/by-name/ii/iio-sensor-proxy/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch2,
   glib,
   cmake,
   libxml2,
@@ -26,6 +27,26 @@ stdenv.mkDerivation rec {
     hash = "sha256-MAfh6bgh39J5J3rlyPjyCkk5KcfWHMZLytZcBRPHaJE=";
   };
 
+  # Fix devices with cros-ec-accel, like Chromebooks and Framework Laptop 12
+  # https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/merge_requests/400
+  patches = [
+    (fetchpatch2 {
+      name = "mr400_1.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/f35d293e65841a3b9c0de778300c7fa58b181fd0.patch";
+      hash = "sha256-Gk8Wpy+KFhHAsR3XklcsL3Eo4fHjQuFT6PCN5hz9KHk=";
+    })
+    (fetchpatch2 {
+      name = "mr400_2.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/7416edf4da98d8e3b75f9eddb7e5c488ac4a4c54.patch";
+      hash = "sha256-5UnYam6P+paBHAI0qKXDAvrFM8JYhRVTUFePRTHCp+U=";
+    })
+    (fetchpatch2 {
+      name = "mr400_3.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/d00109194422a4fe3e9a7bc1235ffc492459c61a.patch";
+      hash = "sha256-58KrXbdpR1eWbPmsr8b0ke67hX5J0o0gtqzrz3dc+ck=";
+    })
+  ];
+
   postPatch = ''
     # upstream meson.build currently doesn't have an option to change the default polkit dir
     substituteInPlace data/meson.build \
diff --git a/pkgs/tools/misc/instaloader/default.nix b/pkgs/by-name/in/instaloader/package.nix
similarity index 52%
rename from pkgs/tools/misc/instaloader/default.nix
rename to pkgs/by-name/in/instaloader/package.nix
index 4c62eb14d938..60d9ec1ed193 100644
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/by-name/in/instaloader/package.nix
@@ -1,43 +1,37 @@
 {
   lib,
-  buildPythonPackage,
-  pythonOlder,
+  python3Packages,
   fetchFromGitHub,
-  setuptools,
-  sphinx,
-  requests,
 }:
 
-buildPythonPackage rec {
+python3Packages.buildPythonApplication rec {
   pname = "instaloader";
-  version = "4.14.1";
+  version = "4.14.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "instaloader";
     repo = "instaloader";
     tag = "v${version}";
-    sha256 = "sha256-ZGCO5xNUwrQFsSaAiP1yffrkSN+Mxdtrw+Kve0s2t2E=";
+    hash = "sha256-q5/lZ+BHnrod0vG/ZJw/5iJRKKaP3Gbns5yaZH0P2rE=";
   };
 
-  nativeBuildInputs = [
-    setuptools
+  build-system = [
+    python3Packages.setuptools
   ];
 
-  propagatedBuildInputs = [
-    requests
-    sphinx
+  dependencies = [
+    python3Packages.requests
+    python3Packages.sphinx
   ];
 
   pythonImportsCheck = [ "instaloader" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://instaloader.github.io/";
     description = "Download pictures (or videos) along with their captions and other metadata from Instagram";
-    maintainers = with maintainers; [ creator54 ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ creator54 ];
+    license = lib.licenses.mit;
     mainProgram = "instaloader";
   };
 }
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index b7e593ee2dfe..c18bff4254e0 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -65,7 +65,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     # make xdg-open overrideable at runtime
     makeWrapper ${jdk11}/bin/java $out/bin/irpf \
-      --add-flags "-Dawt.useSystemAAFontSettings=on" \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-Dswing.aatext=true" \
       --add-flags "-jar $BASEDIR/irpf.jar" \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
diff --git a/pkgs/by-name/jf/jflap/package.nix b/pkgs/by-name/jf/jflap/package.nix
index 90f32b821fa5..fbc7a152c8ce 100644
--- a/pkgs/by-name/jf/jflap/package.nix
+++ b/pkgs/by-name/jf/jflap/package.nix
@@ -55,7 +55,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/share/java
     cp -s $src $out/share/java/jflap.jar
     makeWrapper ${jre8}/bin/java $out/bin/jflap \
-      --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-jar $out/share/java/jflap.jar"
     runHook postInstall
   '';
diff --git a/pkgs/by-name/jo/josm/package.nix b/pkgs/by-name/jo/josm/package.nix
index 75ece04ea875..e2cd5ece6505 100644
--- a/pkgs/by-name/jo/josm/package.nix
+++ b/pkgs/by-name/jo/josm/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
           --add-flags "${baseJavaOpts} ${extraJavaOpts} -jar $out/share/josm/josm.jar" \
           --prefix LD_LIBRARY_PATH ":" '${libXxf86vm}/lib' \
           --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-          --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on"
+          --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
       '';
 
   passthru = {
diff --git a/pkgs/by-name/ka/kafkactl/package.nix b/pkgs/by-name/ka/kafkactl/package.nix
index 1fa763de19cb..806ec47d44d8 100644
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "5.10.1";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = "kafkactl";
     tag = "v${version}";
-    hash = "sha256-DFtpzsydA5bPec7LPSJJngS12+ekwJ/Un04yTYOLZts=";
+    hash = "sha256-9d/TXNRuU5+uDImS5hm87tIP1teH6T+/zglRYX+F6Kc=";
   };
 
   vendorHash = "sha256-rxQxNf3FBAGudgrE2wxHw4mVHxTEpQpQ+DX/nEVpoJY=";
diff --git a/pkgs/by-name/ka/kamilalisp/package.nix b/pkgs/by-name/ka/kamilalisp/package.nix
index ca898af85554..efaed71a73e0 100644
--- a/pkgs/by-name/ka/kamilalisp/package.nix
+++ b/pkgs/by-name/ka/kamilalisp/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     cp ${src} $out/share/java/kamilalisp-${version}.jar
     makeWrapper ${jre}/bin/java $out/bin/kamilalisp \
       --add-flags "-jar $out/share/java/kamilalisp-${version}.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
   '';
 
diff --git a/pkgs/by-name/ko/koto-ls/package.nix b/pkgs/by-name/ko/koto-ls/package.nix
index 63d1c16bbe2c..ff5e509a55dc 100644
--- a/pkgs/by-name/ko/koto-ls/package.nix
+++ b/pkgs/by-name/ko/koto-ls/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "koto-ls";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "koto-lang";
     repo = "koto-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4s+zWiI6Yxv1TB0drds27txnL0kE6RoqjRI36Clls6Y=";
+    hash = "sha256-a2YGjAZvLyPRfFdZdd0z7sbijS1RCPa5wY2DkJZwbmk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ewBAixbksI9ora5hBZR12lzxCPzxM2Cp6GvQz6hGCSY=";
+  cargoHash = "sha256-GFgIW+x+kncf1OTWZZZjD9yoLEwW01pWAUnJQCpPFhQ=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ko/koto/package.nix b/pkgs/by-name/ko/koto/package.nix
index 3d82d8b3682b..0525e87dbe88 100644
--- a/pkgs/by-name/ko/koto/package.nix
+++ b/pkgs/by-name/ko/koto/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "koto";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "koto-lang";
     repo = "koto";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sFADZj0mBe8TQ2x6NeXLqvvXK13WhVGD2anGWoWrSZw=";
+    hash = "sha256-KdwKJ0ZKKHU+Fe/TTIITHOyRH9uoJ3LU3qXqUwpJI6g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ok4rgqiQ7N5knXdb0Mfn3fYPPLXoRtOZVv8RvWR2h3k=";
+  cargoHash = "sha256-5uWCpTnGbqoogOxSD2GcXMjQpoYIp1GfB9k4bd+Easc=";
 
   postPatch = ''
     tomlq -ti 'del(.bench)' crates/koto/Cargo.toml
diff --git a/pkgs/by-name/la/lanzaboote-tool/package.nix b/pkgs/by-name/la/lanzaboote-tool/package.nix
deleted file mode 100644
index e6883bb8a15e..000000000000
--- a/pkgs/by-name/la/lanzaboote-tool/package.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  systemd,
-  stdenv,
-  makeWrapper,
-  binutils-unwrapped,
-  sbsigntool,
-  rustPlatform,
-  fetchFromGitHub,
-  lib,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "lanzaboote-tool";
-  version = "0.3.0";
-
-  src = fetchFromGitHub {
-    owner = "nix-community";
-    repo = "lanzaboote";
-    rev = "v${version}";
-    hash = "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=";
-  };
-
-  sourceRoot = "${src.name}/rust/tool";
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-HnTsu46P3HRYo2d1DeaP6hqn+pVW3J4IM+CneckSFoM=";
-
-  env.TEST_SYSTEMD = systemd;
-  doCheck = lib.meta.availableOn stdenv.hostPlatform systemd;
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  postInstall = ''
-    # Clean PATH to only contain what we need to do objcopy.
-    # This is still an unwrapped lanzaboote tool lacking of the
-    # UEFI stub location.
-    mv $out/bin/lzbt $out/bin/lzbt-unwrapped
-    wrapProgram $out/bin/lzbt-unwrapped \
-      --set PATH ${
-        lib.makeBinPath [
-          binutils-unwrapped
-          sbsigntool
-        ]
-      }
-  '';
-
-  nativeCheckInputs = [
-    binutils-unwrapped
-    sbsigntool
-  ];
-
-  meta = with lib; {
-    description = "Lanzaboote UEFI tooling for SecureBoot enablement on NixOS systems (unwrapped; does not contain the required stub)";
-    homepage = "https://github.com/nix-community/lanzaboote";
-    license = licenses.gpl3Only;
-    mainProgram = "lzbt-unwrapped";
-    maintainers = with maintainers; [
-      raitobezarius
-      nikstur
-    ];
-    # Broken on aarch64-linux and any other architecture for now.
-    # Wait for 0.4.0.
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-  };
-}
diff --git a/pkgs/by-name/li/libstaden-read/package.nix b/pkgs/by-name/li/libstaden-read/package.nix
index 877c5042ff84..bf431ad89e0b 100644
--- a/pkgs/by-name/li/libstaden-read/package.nix
+++ b/pkgs/by-name/li/libstaden-read/package.nix
@@ -11,14 +11,14 @@
 stdenv.mkDerivation (finalAttrs: {
   # Same name as the Debian library
   pname = "libstaden-read";
-  version = "1.15.0";
+  version = "1-15-1";
 
   src = fetchFromGitHub {
     owner = "jkbonfield";
     repo = "io_lib";
     rev = "io_lib-" + builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-2Dlx+MXmqar81/Xmf0oE+6lWX461EDYijiZsZf/VD28=";
+    hash = "sha256-X96gFrefH2NAp4+fvVLXHP9FbF04gQOWLm/tAFJPgR8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index d68e66f62a93..1364545c2b76 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.24";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-NEKmZlBw1OkikHHeohZH01/+E6bslQ6+EK0lhleI9UA=";
+    hash = "sha256-8zkEVdvoM0PDqGyqY16ZRgyY8G0LplmhAb0THwqTVig=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UDidgvZlFkUrNpnwJijEQ8ib2kiou0cHKOuBnk0u704=";
+  cargoHash = "sha256-2NGb4a/Ak8DlaxHVElJg8Vhrt4W4XPZdDE283TH19C4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix
index d4d5da794911..6b2fe18cf051 100644
--- a/pkgs/by-name/lo/lockbook/package.nix
+++ b/pkgs/by-name/lo/lockbook/package.nix
@@ -7,22 +7,22 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "0.9.22";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
+    hash = "sha256-8zkEVdvoM0PDqGyqY16ZRgyY8G0LplmhAb0THwqTVig=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
+  cargoHash = "sha256-2NGb4a/Ak8DlaxHVElJg8Vhrt4W4XPZdDE283TH19C4=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [
     "--package"
-    "lockbook-cli"
+    "lockbook"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 0062f142dec5..20cf8161869d 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2025-07-23";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "a0eedfb30fb449322deaff0b349b3a194608789e";
-    hash = "sha256-+0FZmLxWz75wU5NIxjpX+H0oNa3gGgYCjoK8JdP7sOg=";
+    rev = "affbfa8012d0dbc0eba81ea51ec32069c71af417";
+    hash = "sha256-JPcurldPuaFPfwqiWQR83x1uDcL0Dy79kx2TAOiNnyQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/ne/netbeans/package.nix b/pkgs/by-name/ne/netbeans/package.nix
index 2f8be3be2c30..364ee5feebd8 100644
--- a/pkgs/by-name/ne/netbeans/package.nix
+++ b/pkgs/by-name/ne/netbeans/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
       } \
       --prefix JAVA_HOME : ${jdk21.home} \
       --add-flags "--jdkhome ${jdk21.home} \
-      -J-Dawt.useSystemAAFontSettings=on -J-Dswing.aatext=true"
+      -J-Dawt.useSystemAAFontSettings=gasp -J-Dswing.aatext=true"
 
     # Extract pngs from the Apple icon image and create
     # the missing ones from the 1024x1024 image.
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 93fa9982f5ed..210e778c3b36 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -12,10 +12,10 @@
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-TAeFDsHGFJnUyp20ec+Rxp4t1FrWKfbtnxsE8PnLS0o=";
-    "aarch64-linux" = "sha256-F056MWf2dNAO21ezEvWg689WUibtz4Q4mcSuDuSY5EM=";
-    "x86_64-darwin" = "sha256-AN1Ha/les1ByJGfVkLDibfxjPouC0tAZ//EN3vDi1Hc=";
-    "x86_64-linux" = "sha256-XIRV1QrgRHnpJyrgK9ITxH61dve7nWfVoCPs3Tc8nuU=";
+    "aarch64-darwin" = "sha256-so+KiAo8C7olbJaCH1rIVxs/tq/g9l5pKPaU8D+Zm28=";
+    "aarch64-linux" = "sha256-JNf8g0z6oH2OXJLAmCSP0W4WX+GGyald5DAFOYCBNP0=";
+    "x86_64-darwin" = "sha256-jwmH4gEcyRNgeMvYz2SyWRagFkYN1O3ULEQIPPgqhwg=";
+    "x86_64-linux" = "sha256-ZMz7vfndYrpjUvhX8L9qv/lXcWKqXZwvfahGAE5EKYo=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.3.51";
+  version = "0.3.58";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lvosTLb9HI5IjE6Z1yEGNQn1M84zq23epgEhXGEuteQ=";
+    hash = "sha256-Zm3ydijaduPcIw5Np1+5CzNMoaASQwOT2R72/pdyUwM=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-MZAKEXA34dHiH4XYUlLq6zo8ppG8JD3nj7fhZMrr+TI=";
+    vendorHash = "sha256-8OIPFa+bl1If55YZtacyOZOqMLslbMyO9Hx0HOzmrA0=";
 
     subPackages = [ "cmd/opencode" ];
 
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 05924132cef8..2f85633231a3 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = "orchard";
     rev = version;
-    hash = "sha256-1i62fKxuLYtLIUSbUZ4nu3I1r9V6PUhaWpspH/H7k+Q=";
+    hash = "sha256-V5pBiF1IIfyyZIAoHnAccZ6YNddA4MosEJROJVEpwoo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-dWx4Ivw25H07rd0pNC3VecS7QcIc9ikEwjjUS53SefU=";
+  vendorHash = "sha256-VHEj4y7XSfdbSeBo9+ZwBZXUj/ur0w6gPrxCt2xNQMM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index 0a3ea664efb3..4b306120a697 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -7,6 +7,7 @@
   zig,
   makeWrapper,
   unstableGitUpdater,
+  nixosTests,
 }:
 
 let
@@ -75,7 +76,10 @@ ocamlPackages.buildDunePackage rec {
 
   doCheck = false;
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    tests = { inherit (nixosTests) owi; };
+  };
 
   meta = {
     description = "Symbolic execution for Wasm, C, C++, Rust and Zig";
diff --git a/pkgs/by-name/pa/particle-cli/package.nix b/pkgs/by-name/pa/particle-cli/package.nix
index 6edda5e002b4..6b3d6f59cb9f 100644
--- a/pkgs/by-name/pa/particle-cli/package.nix
+++ b/pkgs/by-name/pa/particle-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "particle-cli";
-  version = "3.38.1";
+  version = "3.38.2";
 
   src = fetchFromGitHub {
     owner = "particle-iot";
     repo = "particle-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B01aoCzcesvz6EjOQf9wTkONhByhf3YqJ18hDVNxEY4=";
+    hash = "sha256-/MfT7+g3l+5Y3mRGl0yiDMRXL2heWZzVNm+LfTmy9SA=";
   };
 
-  npmDepsHash = "sha256-rxGo5L37GnJfvDxURlSxWqm+/HfxMLNkEFceaPdvL4c=";
+  npmDepsHash = "sha256-L/DfZWvJRZzHvf9pP7bHEJt85KT0s46+KErkTNRgH04=";
 
   buildInputs = [
     udev
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 959bc9369b35..e61156eb7db5 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.28.4";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-LMkyz8Eu5W9TGZva7bPiAoN21ymKvAO6oSZcvX6rX+s=";
+    hash = "sha256-yNz/bwjOPcj4N4yXi1pckz/rGNSJeCs8xeZHj+W/+2E=";
   };
 
-  vendorHash = "sha256-hOB8MOfG+RHDJEP5DSDvSiphb+c86QySNEmRr8633cM=";
+  vendorHash = "sha256-XfHU2E2VEcQEQtcGmZqEPjdy7wxvOEdcysSYYD5oLNM=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/qu/quantlib/package.nix b/pkgs/by-name/qu/quantlib/package.nix
index fc8555fc7cb8..978bd6a8ecd1 100644
--- a/pkgs/by-name/qu/quantlib/package.nix
+++ b/pkgs/by-name/qu/quantlib/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quantlib";
-  version = "1.38";
+  version = "1.39";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "lballabio";
     repo = "QuantLib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4a86sGUOz/B5IQHE41r5+OTvR9es4FgXeufy3bKRWAc=";
+    hash = "sha256-UrFamEIeFTR0finNGESlDYbvrmD8jtv73tDUJ17P7WA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/r1/r10k/Gemfile.lock b/pkgs/by-name/r1/r10k/Gemfile.lock
index e82d217dbf37..e19552009e23 100644
--- a/pkgs/by-name/r1/r10k/Gemfile.lock
+++ b/pkgs/by-name/r1/r10k/Gemfile.lock
@@ -2,20 +2,21 @@ GEM
   remote: https://rubygems.org/
   specs:
     base64 (0.2.0)
-    colored2 (3.1.2)
+    colored2 (4.0.3)
     cri (2.15.12)
-    erubi (1.13.0)
-    faraday (2.10.1)
-      faraday-net_http (>= 2.0, < 3.2)
+    erubi (1.13.1)
+    faraday (2.13.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
       logger
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.1.1)
-      net-http
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     fast_gettext (2.4.0)
       prime
     forwardable (1.3.3)
-    gettext (3.4.9)
+    gettext (3.5.1)
       erubi
       locale (>= 2.0.5)
       prime
@@ -25,37 +26,38 @@ GEM
       fast_gettext (~> 2.1)
       gettext (~> 3.4)
       locale
-    jwt (2.8.2)
+    json (2.12.2)
+    jwt (2.10.1)
       base64
     locale (2.1.4)
     log4r (1.1.10)
-    logger (1.6.0)
-    minitar (0.12.1)
+    logger (1.7.0)
+    minitar (1.0.2)
     multi_json (1.15.0)
-    net-http (0.4.1)
+    net-http (0.6.0)
       uri
-    prime (0.1.2)
+    prime (0.1.3)
       forwardable
       singleton
-    puppet_forge (5.0.4)
+    puppet_forge (6.0.0)
       faraday (~> 2.0)
       faraday-follow_redirects (~> 0.3.0)
-      minitar (< 1.0.0)
+      minitar (~> 1.0, >= 1.0.2)
       semantic_puppet (~> 1.0)
-    r10k (4.1.0)
-      colored2 (= 3.1.2)
+    r10k (5.0.0)
+      colored2 (~> 4.0)
       cri (>= 2.15.10)
       gettext-setup (>= 0.24, < 2.0)
       jwt (>= 2.2.3, < 3)
       log4r (= 1.1.10)
-      minitar (~> 0.9)
+      minitar (>= 0.9, < 2)
       multi_json (~> 1.10)
-      puppet_forge (>= 4.1, < 6)
+      puppet_forge (>= 4.1.0, < 7)
     racc (1.8.1)
-    semantic_puppet (1.1.0)
-    singleton (0.2.0)
+    semantic_puppet (1.1.1)
+    singleton (0.3.0)
     text (1.3.1)
-    uri (0.13.0)
+    uri (1.0.3)
 
 PLATFORMS
   ruby
@@ -64,4 +66,4 @@ DEPENDENCIES
   r10k
 
 BUNDLED WITH
-   2.5.16
+   2.6.6
diff --git a/pkgs/by-name/r1/r10k/gemset.nix b/pkgs/by-name/r1/r10k/gemset.nix
index 47ddb6a768ba..1de7b337aef9 100644
--- a/pkgs/by-name/r1/r10k/gemset.nix
+++ b/pkgs/by-name/r1/r10k/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      sha256 = "0drbrv5m3l3qpal7s87gvss81cbzl76gad1hqkpqfqlphf0h7qb3";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "4.0.3";
   };
   cri = {
     groups = [ "default" ];
@@ -34,24 +34,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qnd6ff4az22ysnmni3730c41b979xinilahzg86bn7gv93ip9pw";
+      sha256 = "1naaxsqkv5b3vklab5sbb9sdpszrjzlfsbqpy7ncbnw510xi10m0";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.13.1";
   };
   faraday = {
     dependencies = [
       "faraday-net_http"
+      "json"
       "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "104s7n9505488p923cs0pl3jlgn4naam28clkm2885hrysizpjbb";
+      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
       type = "gem";
     };
-    version = "2.10.1";
+    version = "2.13.1";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -70,10 +71,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f49frpfdr8czwm2mjkfny4pini6fy49b6hamw4jrppl4vsg14ys";
+      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "3.4.0";
   };
   fast_gettext = {
     dependencies = [ "prime" ];
@@ -108,10 +109,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16h0kda5z4s4zqygyk0f52xzs9mlz9r4lnhjwk729hhmdbz68a19";
+      sha256 = "0aji3873pxn6gc5qkvnv5y9025mqk0p6h22yrpyz2b3yx9qpzv03";
       type = "gem";
     };
-    version = "3.4.9";
+    version = "3.5.1";
   };
   gettext-setup = {
     dependencies = [
@@ -128,16 +129,26 @@
     };
     version = "1.1.0";
   };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1x5b8ipv6g0z44wgc45039k04smsyf95h2m5m67mqq35sa5a955s";
+      type = "gem";
+    };
+    version = "2.12.2";
+  };
   jwt = {
     dependencies = [ "base64" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04mw326i9vsdcqwm4bf0zvnqw237f8l7022nhlbmak92bqqpg62s";
+      sha256 = "1i8wmzgb5nfhvkx1f6bhdwfm7v772172imh439v3xxhkv3hllhp6";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.10.1";
   };
   locale = {
     groups = [ "default" ];
@@ -164,20 +175,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gpg8gzi0xwymw4aaq2iafcbx31i3xzkg3fb30mdxn1d4qhc3dqa";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.7.0";
   };
   minitar = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f307mpj4j0gp7iq77xj4p149f4krcvbll9rismng3jcijpbn79s";
+      sha256 = "0wj6cgvzbnc8qvdb5rai4hf9z10a2f422gc5agnhcab7lwmyp4mi";
       type = "gem";
     };
-    version = "0.12.1";
+    version = "1.0.2";
   };
   multi_json = {
     groups = [ "default" ];
@@ -195,10 +206,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10n2n9aq00ih8v881af88l1zyrqgs5cl3njdw8argjwbl5ggqvm9";
+      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
       type = "gem";
     };
-    version = "0.4.1";
+    version = "0.6.0";
   };
   prime = {
     dependencies = [
@@ -209,10 +220,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1973kz8lbck6ga5v42f55jk8b8pnbgwp9p67dl1xw15gvz55dsfl";
+      sha256 = "1qsk9q2n4yb80f5mwslxzfzm2ckar25grghk95cj7sbc1p2k3w5s";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.1.3";
   };
   puppet_forge = {
     dependencies = [
@@ -225,10 +236,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0d65zri1nmpph8iki5iigdzfqd6rfyc1mlgdfhg69q3566rcff06";
+      sha256 = "1pwd5x0vyf04qzzdw6v98m6f6rb110g14sv6h6yj2nwz3kbbww07";
       type = "gem";
     };
-    version = "5.0.4";
+    version = "6.0.0";
   };
   r10k = {
     dependencies = [
@@ -245,10 +256,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k3fr2f0pwyrabs12wqig31f37sqrqs8qza7jrn01d6blvhvkrb4";
+      sha256 = "0m0k0aqf9gaakgkmfcx86324qx6mvs2p0ja1rrs36ifq1l70lgsf";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "5.0.0";
   };
   racc = {
     groups = [ "default" ];
@@ -265,20 +276,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ndqm3jnpdlwkk1jwqdyyb7yw7gv6r4kmjs30g09ap8siv80ilaj";
+      sha256 = "15ksbizvakfx0zfdgjbh34hqnrnkjj47m4kbnsg58mpqsx45pzqm";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   singleton = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qq54imvbksnckzf9hrq9bjzcdb0n8wfv6l5jc0di10n88277jx6";
+      sha256 = "0y2pc7lr979pab5n5lvk3jhsi99fhskl5f2s6004v8sabz51psl3";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
   };
   text = {
     groups = [ "default" ];
@@ -295,9 +306,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "094gk72ckazf495qc76gk09b5i318d5l9m7bicg2wxlrjcm3qm96";
+      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
       type = "gem";
     };
-    version = "0.13.0";
+    version = "1.0.3";
   };
 }
diff --git a/pkgs/by-name/r1/r10k/package.nix b/pkgs/by-name/r1/r10k/package.nix
index 864f1ea79733..529c1709861b 100644
--- a/pkgs/by-name/r1/r10k/package.nix
+++ b/pkgs/by-name/r1/r10k/package.nix
@@ -10,7 +10,7 @@
   testers,
 }:
 
-bundlerApp {
+bundlerApp rec {
   pname = "r10k";
   gemdir = ./.;
   exes = [ "r10k" ];
@@ -33,7 +33,7 @@ bundlerApp {
       package = r10k;
       version = (import ./gemset.nix).r10k.version;
     };
-    updateScript = bundlerUpdateScript "r10k";
+    updateScript = bundlerUpdateScript pname;
   };
 
   meta = {
@@ -47,6 +47,6 @@ bundlerApp {
       anthonyroussel
     ];
     platforms = lib.platforms.unix;
-    mainProgram = "r10k";
+    mainProgram = pname;
   };
 }
diff --git a/pkgs/by-name/st/structorizer/package.nix b/pkgs/by-name/st/structorizer/package.nix
index ebd9169f469a..830dd992f156 100644
--- a/pkgs/by-name/st/structorizer/package.nix
+++ b/pkgs/by-name/st/structorizer/package.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     install -D ${pname}.jar -t $out/share/java/
       makeWrapper ${jdk11}/bin/java $out/bin/${pname} \
       --add-flags "-jar $out/share/java/${pname}.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=lcd'
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     cat << EOF > $out/share/mime/packages/structorizer.xml
     <?xml version="1.0" encoding="UTF-8"?>
diff --git a/pkgs/by-name/ti/tigerjython/package.nix b/pkgs/by-name/ti/tigerjython/package.nix
index d58af72e1a87..b64b5b6efaef 100644
--- a/pkgs/by-name/ti/tigerjython/package.nix
+++ b/pkgs/by-name/ti/tigerjython/package.nix
@@ -87,7 +87,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --add-flags "-Duser.dir=$CUSTOM_LIBS/" \
       --add-flags "-Xmx512M" \
       --add-flags "-jar $JAR" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=lcd'
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/up/uppaal/package.nix b/pkgs/by-name/up/uppaal/package.nix
index f61425fbad55..f3770437f843 100644
--- a/pkgs/by-name/up/uppaal/package.nix
+++ b/pkgs/by-name/up/uppaal/package.nix
@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation rec {
     makeWrapper $out/lib/uppaal/uppaal $out/bin/uppaal \
       --set JAVA_HOME ${jdk17} \
       --set PATH $out/lib/uppaal:$PATH \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 3bb9de8cb72f..aae37eecd725 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.12.6";
+  version = "1.12.7";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7JT8BMKUhIwYMkIwr2mD8IQLDpldcDtAKh6R1tbAKMw=";
+    hash = "sha256-MS88KCH8ZdLyKoR0K45CSJutZSKUhz4FAE2VtrSx0ic=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
diff --git a/pkgs/by-name/wa/wait4x/package.nix b/pkgs/by-name/wa/wait4x/package.nix
index 8f14b034ef5d..a87ce1601148 100644
--- a/pkgs/by-name/wa/wait4x/package.nix
+++ b/pkgs/by-name/wa/wait4x/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "wait4x";
-  version = "3.4.0";
+  version = "3.5.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "wait4x";
     repo = "wait4x";
     rev = "v${version}";
-    hash = "sha256-Pb2Klupm6cNYUQ3bWBHwr3NW1HCdit2NFFISn9/c860=";
+    hash = "sha256-iHhUimAREKN3o36vi1Ggj8PrhXCHRllxv4yiQ2xcNig=";
   };
 
-  vendorHash = "sha256-6gRiYQYtkADBAMNqma4PfuzIttseyE/bHnlkpOgsVjI=";
+  vendorHash = "sha256-N3HYbeBoDuLvWYX+7mrCTYi38hTdK8BP9uY56fOmuls=";
 
   # Tests make network access
   doCheck = false;
diff --git a/pkgs/by-name/wo/workcraft/package.nix b/pkgs/by-name/wo/workcraft/package.nix
index 582d0750e82f..8fe9325a45a6 100644
--- a/pkgs/by-name/wo/workcraft/package.nix
+++ b/pkgs/by-name/wo/workcraft/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     makeWrapper $out/share/workcraft $out/bin/workcraft \
       --set JAVA_HOME "${jre}" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=gasp';
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp";
   '';
 
   meta = {
diff --git a/pkgs/by-name/wp/wpcleaner/package.nix b/pkgs/by-name/wp/wpcleaner/package.nix
index 3797140b0e0b..f618a5af836d 100644
--- a/pkgs/by-name/wp/wpcleaner/package.nix
+++ b/pkgs/by-name/wp/wpcleaner/package.nix
@@ -17,7 +17,7 @@ let
   botScript = "$out/bin/wpcleaner-bot";
   runTaskScript = "$out/bin/wpcleaner-run-task";
   extraJavaArgs = [
-    "-Dawt.useSystemAAFontSettings=lcd"
+    "-Dawt.useSystemAAFontSettings=gasp"
     "-Xms1g"
     "-Xmx8g"
   ];
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index 30446b44d993..03c369b1e88b 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.6.12";
+  version = "0.6.16";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     tag = version;
-    hash = "sha256-maSYT1sd1GTe0Av0NvOUinI/GBYFzjUAemRLx7sDPUk=";
+    hash = "sha256-EPj6tql05ZUImMAeeUTyNms1NdwJgtdCJmJ+O8HXP3I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fenics-dolfinx/default.nix b/pkgs/development/python-modules/fenics-dolfinx/default.nix
index 158cf7dec173..7aa04a253fe5 100644
--- a/pkgs/development/python-modules/fenics-dolfinx/default.nix
+++ b/pkgs/development/python-modules/fenics-dolfinx/default.nix
@@ -32,7 +32,6 @@
   # nativeCheckInputs
   scipy,
   matplotlib,
-  pytest-xdist,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
   mpiCheckPhaseHook,
@@ -108,7 +107,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     scipy
     matplotlib
-    pytest-xdist
     pytestCheckHook
     writableTmpDirAsHomeHook
     mpiCheckPhaseHook
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index 1690d8e1f37a..3341cd7559eb 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.9.26";
+  version = "0.9.28";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-UPqTdKhXDb1D8Ig1dMk8QIiLuyZPQxMp/P1pAKqJ+Bs=";
+    hash = "sha256-mRJpkJkSA8wNTCs3YhNm+W3OQnRVUXhCYz5CJhmqpmA=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/pyshp/default.nix b/pkgs/development/python-modules/pyshp/default.nix
index 361252eaee7c..05ebc0c376d7 100644
--- a/pkgs/development/python-modules/pyshp/default.nix
+++ b/pkgs/development/python-modules/pyshp/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyshp";
-  version = "2.3.1";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "GeospatialPython";
     repo = "pyshp";
-    rev = version;
-    hash = "sha256-yfxhgk8a1rdpGVkE1sjJqT6tiFLimhu2m2SjGxLI6wo=";
+    tag = version;
+    hash = "sha256-q1++2pifLZWc562m5cKoL2jLWM4lOnIwEAOqzKArh+w=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 9876da3d82b0..9ebb841c651b 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.9.0";
+  version = "18.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_novaclient";
     inherit version;
-    hash = "sha256-z2pLjwHsVD1adcAcIYR0upsGO9n9N0OCH+3GioRcq04=";
+    hash = "sha256-LwZqAQYe6t0c6G+/4CZ6HQ0Yi2TBZBNh9yXEJ39nqWs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvips/default.nix b/pkgs/development/python-modules/pyvips/default.nix
index dbcdadc33f2e..3db7c77b9103 100644
--- a/pkgs/development/python-modules/pyvips/default.nix
+++ b/pkgs/development/python-modules/pyvips/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyvips";
-  version = "2.2.3";
+  version = "3.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "libvips";
     repo = "pyvips";
     tag = "v${version}";
-    hash = "sha256-EGB1cOR1pVCXGjRj1NLj4Mk3kIy8luRqk3gGJqVNs7U=";
+    hash = "sha256-dyous0EahUR7pkr2siBBJwzcoC4TOsnsbRo+rVE8/QQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 6093778bd751..143314a61700 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -6,7 +6,6 @@
   boto3,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   moto,
   pytest-asyncio,
   pytestCheckHook,
@@ -19,24 +18,16 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.35.0";
+  version = "3.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "python-slack-sdk";
     tag = "v${version}";
-    hash = "sha256-yjYpALyHSTLQSuwd6xth7nqfi3m1C9tqnWrrVRmI220=";
+    hash = "sha256-Y6w4osSpirBjxPdZRlODwEAWd4Z+sPHrr7alVl/6mPA=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-aiohttp-test_init_with_loop.patch";
-      url = "https://github.com/slackapi/python-slack-sdk/pull/1697.patch";
-      hash = "sha256-rHaJBH/Yxm3Sz/jmzc4G1pVJJXz0PL2880bz5n7w3ck=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   optional-dependencies.optional = [
diff --git a/pkgs/development/python-modules/symfc/default.nix b/pkgs/development/python-modules/symfc/default.nix
index ce8f4cd947bb..085305c84711 100644
--- a/pkgs/development/python-modules/symfc/default.nix
+++ b/pkgs/development/python-modules/symfc/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "symfc";
-  version = "1.3.3";
+  version = "1.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "symfc";
     repo = "symfc";
     tag = "v${version}";
-    hash = "sha256-ec/HFs3txVtu46llTmcfDF8j0+mTkozdu7+RsZXaAGE=";
+    hash = "sha256-SGFKbOVi5cVw+8trXrSnO0v2obpJBZrj+7yXk7hK+1s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index a9ec7bfa71eb..b9040a77c1d7 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1425";
+  version = "3.0.1427";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-w4pvIWkMjFgn+v7Si8DwzSFhKobrz8EeRSiEmqyn1Ok=";
+    hash = "sha256-OuQQr9ptcTL6YjeUWIa2ak3i1NMO1uhql+dR+cIJUQU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 4277f559c276..ddc59e0bc060 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.7.4";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     tag = "v${version}";
-    hash = "sha256-MpqpzfsT9cxyKHvcw2ue67gaqQfdsLARov50ivGYO98=";
+    hash = "sha256-zoKULi12vIKMzPRE6I4Rtq4dVQL/GfNFjHR+BId1ADg=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 32db7801aa3a..84a7bb32024c 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,8 +60,8 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.106";
-    hash = "sha256-EBMxGWDLyIvm2H75RsaF4WBSoNnRp24109GsQZG44n0=";
+    version = "9.0.107";
+    hash = "sha256-08qgrQpltJMafTrsok5VQc90O6X6nlGr2ls6MdC0hX0=";
   };
 
   tomcat10 = common {
@@ -70,7 +70,7 @@ in
   };
 
   tomcat11 = common {
-    version = "11.0.8";
-    hash = "sha256-BGT3ORiCetG5hdhwpehW1ldfEJ0MrWEKSho9sPqadXI=";
+    version = "11.0.9";
+    hash = "sha256-YsVio60p26PqBPWK4x6/yGXPISAzUWP88PwD1CbtOoc=";
   };
 }
diff --git a/pkgs/servers/irc/solanum/default.nix b/pkgs/servers/irc/solanum/default.nix
index 6cadf2dc57eb..2dbd9ab7f6ce 100644
--- a/pkgs/servers/irc/solanum/default.nix
+++ b/pkgs/servers/irc/solanum/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2025-06-11";
+  version = "0-unstable-2025-07-20";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "70d491d8a4ad9fa02ce5394d9007baf5f23ca61c";
-    hash = "sha256-+AYEfG0MJE7LnoS1saA1zSSKNxAvxMppobYUK+sP4fw=";
+    rev = "7feda92636c9d5b5e7decceee1273dd18b6cc31b";
+    hash = "sha256-cfDwdE2CA69dSg59Sn1TKk3OWxvoTIm/KCiKfgzokVU=";
   };
 
   patches = [
diff --git a/pkgs/servers/mastodon/gemset.nix b/pkgs/servers/mastodon/gemset.nix
index 2782bfaa1a8f..c08b5d054499 100644
--- a/pkgs/servers/mastodon/gemset.nix
+++ b/pkgs/servers/mastodon/gemset.nix
@@ -2411,10 +2411,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rb306hbky6cxfyc8vrwpvl40fdapjvhsk62h08gg9wwbn3n8x4c";
+      sha256 = "0czsh9d738kj0bmpkjnczq9j924hg103gc00i0wfyg0fzn9psnmc";
       type = "gem";
     };
-    version = "1.18.8";
+    version = "1.18.9";
   };
   oj = {
     dependencies = [
@@ -4484,10 +4484,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nmymd86a0vb39pzj2cwv57avdrl6pl3lf5bsz58q594kqxjkw7f";
+      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
       type = "gem";
     };
-    version = "1.3.2";
+    version = "1.4.0";
   };
   tilt = {
     groups = [
diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix
index fb3b5482abb7..a5a782e1c372 100644
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@@ -5,17 +5,17 @@
   patches ? [ ],
 }:
 let
-  version = "4.4.1";
+  version = "4.4.2";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-hu6AmR0CvI3lVixJ2UmWY3KAlWbqYULCQAjRGJcuIhc=";
+    hash = "sha256-BzSN48IamwDrhBtw2TFVPJpRaWaQg96rWOlolBBJ5Fs=";
     passthru = {
       inherit version;
-      yarnHash = "sha256-Qh2jli99rxrT10KVGKnePxP6RXYIjtehDCJB5PfOngM=";
+      yarnHash = "sha256-jqiPxkbD0MmnUPK/P0zaYEB6rMRK20ito+o98+FHZdE=";
       yarnMissingHashes = ./missing-hashes.json;
     };
   };
diff --git a/pkgs/servers/varnish/dynamic.nix b/pkgs/servers/varnish/dynamic.nix
index c98d9f0fb0b2..3c5d6c17f688 100644
--- a/pkgs/servers/varnish/dynamic.nix
+++ b/pkgs/servers/varnish/dynamic.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoreconfHook269,
+  autoreconfHook,
   pkg-config,
   varnish,
   docutils,
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     pkg-config
     docutils
-    autoreconfHook269
+    autoreconfHook
     varnish.python
   ];
   buildInputs = [ varnish ];
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index 6ab563ac960f..dd900babd171 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2025-06-27";
+  version = "0-unstable-2025-07-14";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "ab03e0a670d07ccaa4e72be7c1f3da1d1092ce3e";
-    hash = "sha256-wtxddxEob8L2tavoaZaM/AaEgDzMVkAo3Z1oEtIHxYU=";
+    rev = "bb03e058d4e9c5d5918e27ae7e046fff2c91adb0";
+    hash = "sha256-taIZSyaObVmnjp6ME/QgGKlWZoeOmgRVRLYC0bb8XWk=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
index db5c894189ed..29bceca18dc2 100644
--- a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
+++ b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "steampipe-plugin-aws";
-  version = "1.17.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe-plugin-aws";
     tag = "v${version}";
-    hash = "sha256-fjxT3nG28CKdkvJSq/PJTqrttH0M96WlP1lWyh0sZtk=";
+    hash = "sha256-LbaW6a2eR1U8y82CCm0pXbzl0YyqIAqdrjraFgiNsW8=";
   };
 
-  vendorHash = "sha256-pKgt1KWVHwdVgHHNwL/FO+hLHFsCbtUepiNFItLyIlo=";
+  vendorHash = "sha256-qRTcntW+CaDlBjcBWCocey8bAgCrar6ityuaK2AgTbY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 2bc4f17978ee..227dc6d4053e 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.27.1";
+  version = "0.27.2";
   rev = "v${version}";
 
-  vendorHash = "sha256-FR9jeHVZS87Tlv1jtO4h5ZDqKIRLfa4xGlpCj1IWoXU=";
+  vendorHash = "sha256-48/BYhVWS/Tp1UKgpGX31/gdMC1xpWr06+Y+WoXPAs4=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-xmKXemr/qSLsBOwLhJIewF7Iu/ERpZX8kUFgotz4Yyw=";
+    sha256 = "sha256-d92kv1cWwZr4BzrFaI3t/JBvYERaClqFSRzrAUFkqRc=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 0f4efec3312e..c95c989ffdae 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1021,6 +1021,7 @@ mapAliases {
   larynx = piper-tts; # Added 2023-05-09
   LASzip = laszip; # Added 2024-06-12
   LASzip2 = laszip_2; # Added 2024-06-12
+  lanzaboote-tool = throw "lanzaboote-tool has been removed due to lack of integration maintenance with nixpkgs. Consider using the Nix expressions provided by https://github.com/nix-community/lanzaboote"; # Added 2025-07-23
   latencytop = throw "'latencytop' has been removed due to lack of maintenance upstream."; # Added 2024-12-04
   latinmodern-math = lmmath;
   lazarus-qt = lazarus-qt5; # Added 2024-12-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d7a334aa3031..176ddc79c6f6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2842,9 +2842,7 @@ with pkgs;
     dub-to-nix
     ;
 
-  duff = callPackage ../tools/filesystems/duff {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  duff = callPackage ../tools/filesystems/duff { };
 
   dvtm = callPackage ../tools/misc/dvtm {
     # if you prefer a custom config, write the config.h in dvtm.config.h
@@ -2854,9 +2852,7 @@ with pkgs;
 
   dvtm-unstable = callPackage ../tools/misc/dvtm/unstable.nix { };
 
-  eid-mw = callPackage ../tools/security/eid-mw {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  eid-mw = callPackage ../tools/security/eid-mw { };
 
   engauge-digitizer = libsForQt5.callPackage ../applications/science/math/engauge-digitizer { };
 
@@ -3212,9 +3208,7 @@ with pkgs;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
 
-  gsmlib = callPackage ../development/libraries/gsmlib {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  gsmlib = callPackage ../development/libraries/gsmlib { };
 
   gssdp = callPackage ../development/libraries/gssdp { };
 
@@ -7289,9 +7283,7 @@ with pkgs;
 
   flow = callPackage ../development/tools/analysis/flow { };
 
-  fswatch = callPackage ../development/tools/misc/fswatch {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  fswatch = callPackage ../development/tools/misc/fswatch { };
 
   gede = libsForQt5.callPackage ../development/tools/misc/gede { };
 
@@ -8402,9 +8394,7 @@ with pkgs;
   hamlib_3 = callPackage ../development/libraries/hamlib { };
   hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };
 
-  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix { };
 
   harfbuzzFull = harfbuzz.override {
     withGraphite2 = true;
@@ -12158,8 +12148,6 @@ with pkgs;
     hamlib = hamlib_4;
   };
 
-  fmit = libsForQt5.callPackage ../applications/audio/fmit { };
-
   focuswriter = qt6Packages.callPackage ../applications/editors/focuswriter { };
 
   fossil = callPackage ../applications/version-management/fossil {
@@ -12180,8 +12168,6 @@ with pkgs;
 
   gauche = callPackage ../development/interpreters/gauche { };
 
-  gazelle-origin = python3Packages.callPackage ../tools/misc/gazelle-origin { };
-
   geany = callPackage ../applications/editors/geany { };
   geany-with-vte = callPackage ../applications/editors/geany/with-vte.nix { };
 
@@ -12552,8 +12538,6 @@ with pkgs;
       haskellPackages.hledger-web;
   hledger-utils = with python3.pkgs; toPythonApplication hledger-utils;
 
-  hovercraft = python3Packages.callPackage ../applications/misc/hovercraft { };
-
   hpack = haskell.lib.compose.justStaticExecutables haskellPackages.hpack;
 
   hpmyroom = libsForQt5.callPackage ../applications/networking/hpmyroom { };
@@ -14782,8 +14766,6 @@ with pkgs;
 
   ibmcloud-cli = callPackage ../tools/admin/ibmcloud-cli { stdenv = stdenvNoCC; };
 
-  instaloader = python3Packages.callPackage ../tools/misc/instaloader { };
-
   iortcw = callPackage ../games/iortcw { };
   # used as base package for iortcw forks
   iortcw_sp = callPackage ../games/iortcw/sp.nix { };