diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index ee3df919cf4c..4323a34ac97f 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -23,6 +23,8 @@
 
 - [Fediwall](https://fediwall.social), a web application for live displaying toots from mastodon, inspired by mastowall. Available as [services.fediwall](#opt-services.fediwall.enable).
 
+- [umami](https://github.com/umami-software/umami), a simple, fast, privacy-focused alternative to Google Analytics. Available with [services.umami](#opt-services.umami.enable).
+
 - [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
 
 - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks.
@@ -40,6 +42,8 @@
 
 - [Chhoto URL](https://github.com/SinTan1729/chhoto-url), a simple, blazingly fast, selfhosted URL shortener with no unnecessary features, written in Rust. Available as [services.chhoto-url](#opt-services.chhoto-url.enable).
 
+- [go-httpbin](https://github.com/mccutchen/go-httpbin), a reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib. Available as [services.go-httpbin](#opt-services.go-httpbin.enable).
+
 - [tuwunel](https://matrix-construct.github.io/tuwunel/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-tuwunel](#opt-services.matrix-tuwunel.enable).
 
 - [Broadcast Box](https://github.com/Glimesh/broadcast-box), a WebRTC broadcast server. Available as [services.broadcast-box](options.html#opt-services.broadcast-box.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 916b87d3ffab..0d91b467bff9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1575,6 +1575,7 @@
   ./services/web-apps/gerrit.nix
   ./services/web-apps/glance.nix
   ./services/web-apps/glitchtip.nix
+  ./services/web-apps/go-httpbin.nix
   ./services/web-apps/goatcounter.nix
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/gotosocial.nix
@@ -1689,6 +1690,7 @@
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
+  ./services/web-apps/umami.nix
   ./services/web-apps/vikunja.nix
   ./services/web-apps/wakapi.nix
   ./services/web-apps/weblate.nix
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 54e8423ebb74..fed65ee8ec16 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -18,12 +18,16 @@ let
     ${lib.optionalString (cfg.use != "") "use=${cfg.use}"}
     ${lib.optionalString (cfg.use == "" && cfg.usev4 != "") "usev4=${cfg.usev4}"}
     ${lib.optionalString (cfg.use == "" && cfg.usev6 != "") "usev6=${cfg.usev6}"}
-    login=${cfg.username}
-    password=${
+    ${lib.optionalString (cfg.username != "") "login=${cfg.username}"}
+    ${
       if cfg.protocol == "nsupdate" then
         "/run/${RuntimeDirectory}/ddclient.key"
+      else if (cfg.passwordFile != null) then
+        "password=@password_placeholder@"
+      else if (cfg.secretsFile != null) then
+        "@secrets_placeholder@"
       else
-        "@password_placeholder@"
+        ""
     }
     protocol=${cfg.protocol}
     ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
@@ -49,6 +53,10 @@ let
         ''
           "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
         ''
+      else if (cfg.secretsFile != null) then
+        ''
+          "${pkgs.replace-secret}/bin/replace-secret" "@secrets_placeholder@" "${cfg.secretsFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+        ''
       else
         ''
           sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
@@ -126,6 +134,16 @@ in
         '';
       };
 
+      secretsFile = lib.mkOption {
+        default = null;
+        type = nullOr str;
+        description = ''
+          A file containing the secrets for the dynamic DNS provider.
+          This file should contain lines of valid secrets in the format specified by the ddclient documentation.
+          If this option is set, it overrides the `passwordFile` option.
+        '';
+      };
+
       interval = lib.mkOption {
         default = "10min";
         type = str;
@@ -244,6 +262,17 @@ in
       lib.optional (cfg.use != "")
         "Setting `use` is deprecated, ddclient now supports `usev4` and `usev6` for separate IPv4/IPv6 configuration.";
 
+    assertions = [
+      {
+        assertion = !((cfg.passwordFile != null) && (cfg.secretsFile != null));
+        message = "You cannot use both services.ddclient.passwordFile and services.ddclient.secretsFile at the same time.";
+      }
+      {
+        assertion = !(cfg.protocol == "nsupdate") || (cfg.passwordFile == null && cfg.secretsFile == null);
+        message = "You cannot use services.ddclient.passwordFile and or services.ddclient.secretsFile when services.ddclient.protocol is \"nsupdate\".";
+      }
+    ];
+
     systemd.services.ddclient = {
       description = "Dynamic DNS Client";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/go-httpbin.nix b/nixos/modules/services/web-apps/go-httpbin.nix
new file mode 100644
index 000000000000..f751b93244ef
--- /dev/null
+++ b/nixos/modules/services/web-apps/go-httpbin.nix
@@ -0,0 +1,111 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.go-httpbin;
+
+  environment = lib.mapAttrs (
+    _: value: if lib.isBool value then lib.boolToString value else toString value
+  ) cfg.settings;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.go-httpbin = {
+    enable = lib.mkEnableOption "go-httpbin";
+
+    package = lib.mkPackageOption pkgs "go-httpbin" { };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of go-httpbin.
+        See <https://github.com/mccutchen/go-httpbin#configuration> for a list of options.
+      '';
+      example = {
+        HOST = "0.0.0.0";
+        PORT = 8080;
+      };
+
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            int
+            bool
+          ]);
+
+        options = {
+          HOST = lib.mkOption {
+            type = lib.types.str;
+            description = "The host to listen on.";
+            default = "127.0.0.1";
+            example = "0.0.0.0";
+          };
+
+          PORT = lib.mkOption {
+            type = lib.types.port;
+            description = "The port to listen on.";
+            example = 8080;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.go-httpbin = {
+      wantedBy = [ "multi-user.target" ];
+
+      inherit environment;
+
+      serviceConfig = {
+        User = "go-httpbin";
+        Group = "go-httpbin";
+        DynamicUser = true;
+
+        ExecStart = lib.getExe cfg.package;
+
+        # hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = "tcp:${toString cfg.settings.PORT}";
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/lasuite-meet.nix b/nixos/modules/services/web-apps/lasuite-meet.nix
index cbdcbf0cff52..7bdfd362e3db 100644
--- a/nixos/modules/services/web-apps/lasuite-meet.nix
+++ b/nixos/modules/services/web-apps/lasuite-meet.nix
@@ -230,7 +230,7 @@ in
             type = types.str;
             default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
             defaultText = lib.literalExpression ''
-              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+              if cfg.enableNginx then "localhost,127.0.0.1,''${cfg.domain}" else ""
             '';
             description = "Comma-separated list of hosts that are able to connect to the server";
           };
@@ -328,16 +328,10 @@ in
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-meet/static
-
         if [ ! -f .version ]; then
           touch .version
         fi
 
-        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.backendPackage} migrate
-          echo -n "${cfg.backendPackage.version}" > .version
-        fi
         ${optionalString (cfg.secretKeyPath == null) ''
           if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
             (
@@ -346,11 +340,17 @@ in
             )
           fi
         ''}
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
       '';
 
       environment = pythonEnvironment;
 
       serviceConfig = {
+        BindReadOnlyPaths = "${cfg.backendPackage}/share/static:/var/lib/lasuite-meet/static";
+
         ExecStart = utils.escapeSystemdExecArgs (
           [
             (lib.getExe' cfg.backendPackage "gunicorn")
diff --git a/nixos/modules/services/web-apps/umami.nix b/nixos/modules/services/web-apps/umami.nix
new file mode 100644
index 000000000000..41593ed69a57
--- /dev/null
+++ b/nixos/modules/services/web-apps/umami.nix
@@ -0,0 +1,316 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    concatStringsSep
+    filterAttrs
+    getExe
+    hasPrefix
+    hasSuffix
+    isString
+    literalExpression
+    maintainers
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optional
+    optionalString
+    types
+    ;
+
+  cfg = config.services.umami;
+
+  nonFileSettings = filterAttrs (k: _: !hasSuffix "_FILE" k) cfg.settings;
+in
+{
+  options.services.umami = {
+    enable = mkEnableOption "umami";
+
+    package = mkPackageOption pkgs "umami" { } // {
+      apply =
+        pkg:
+        pkg.override {
+          databaseType = cfg.settings.DATABASE_TYPE;
+          collectApiEndpoint = optionalString (
+            cfg.settings.COLLECT_API_ENDPOINT != null
+          ) cfg.settings.COLLECT_API_ENDPOINT;
+          trackerScriptNames = cfg.settings.TRACKER_SCRIPT_NAME;
+          basePath = cfg.settings.BASE_PATH;
+        };
+    };
+
+    createPostgresqlDatabase = mkOption {
+      type = types.bool;
+      default = true;
+      example = false;
+      description = ''
+        Whether to automatically create the database for Umami using PostgreSQL.
+        Both the database name and username will be `umami`, and the connection is
+        made through unix sockets using peer authentication.
+      '';
+    };
+
+    settings = mkOption {
+      description = ''
+        Additional configuration (environment variables) for Umami, see
+        <https://umami.is/docs/environment-variables> for supported values.
+      '';
+
+      type = types.submodule {
+        freeformType =
+          with types;
+          attrsOf (oneOf [
+            bool
+            int
+            str
+          ]);
+
+        options = {
+          APP_SECRET_FILE = mkOption {
+            type = types.nullOr (
+              types.str
+              // {
+                # We don't want users to be able to pass a path literal here but
+                # it should look like a path.
+                check = it: isString it && types.path.check it;
+              }
+            );
+            default = null;
+            example = "/run/secrets/umamiAppSecret";
+            description = ''
+              A file containing a secure random string. This is used for signing user sessions.
+              The contents of the file are read through systemd credentials, therefore the
+              user running umami does not need permissions to read the file.
+              If you wish to set this to a string instead (not recommended since it will be
+              placed world-readable in the Nix store), you can use the APP_SECRET option.
+            '';
+          };
+          DATABASE_URL = mkOption {
+            type = types.nullOr (
+              types.str
+              // {
+                check =
+                  it:
+                  isString it
+                  && ((hasPrefix "postgresql://" it) || (hasPrefix "postgres://" it) || (hasPrefix "mysql://" it));
+              }
+            );
+            # For some reason, Prisma requires the username in the connection string
+            # and can't derive it from the current user.
+            default =
+              if cfg.createPostgresqlDatabase then
+                "postgresql://umami@localhost/umami?host=/run/postgresql"
+              else
+                null;
+            defaultText = literalExpression ''if config.services.umami.createPostgresqlDatabase then "postgresql://umami@localhost/umami?host=/run/postgresql" else null'';
+            example = "postgresql://root:root@localhost/umami";
+            description = ''
+              Connection string for the database. Must start with `postgresql://`, `postgres://`
+              or `mysql://`.
+            '';
+          };
+          DATABASE_URL_FILE = mkOption {
+            type = types.nullOr (
+              types.str
+              // {
+                # We don't want users to be able to pass a path literal here but
+                # it should look like a path.
+                check = it: isString it && types.path.check it;
+              }
+            );
+            default = null;
+            example = "/run/secrets/umamiDatabaseUrl";
+            description = ''
+              A file containing a connection string for the database. The connection string
+              must start with `postgresql://`, `postgres://` or `mysql://`.
+              If using this, then DATABASE_TYPE must be set to the appropriate value.
+              The contents of the file are read through systemd credentials, therefore the
+              user running umami does not need permissions to read the file.
+            '';
+          };
+          DATABASE_TYPE = mkOption {
+            type = types.nullOr (
+              types.enum [
+                "postgresql"
+                "mysql"
+              ]
+            );
+            default =
+              if cfg.settings.DATABASE_URL != null && hasPrefix "mysql://" cfg.settings.DATABASE_URL then
+                "mysql"
+              else
+                "postgresql";
+            defaultText = literalExpression ''if config.services.umami.settings.DATABASE_URL != null && hasPrefix "mysql://" config.services.umami.settings.DATABASE_URL then "mysql" else "postgresql"'';
+            example = "mysql";
+            description = ''
+              The type of database to use. This is automatically inferred from DATABASE_URL, but
+              must be set manually if you are using DATABASE_URL_FILE.
+            '';
+          };
+          COLLECT_API_ENDPOINT = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "/api/alternate-send";
+            description = ''
+              Allows you to send metrics to a location different than the default `/api/send`.
+            '';
+          };
+          TRACKER_SCRIPT_NAME = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            example = [ "tracker.js" ];
+            description = ''
+              Allows you to assign a custom name to the tracker script different from the default `script.js`.
+            '';
+          };
+          BASE_PATH = mkOption {
+            type = types.str;
+            default = "";
+            example = "/analytics";
+            description = ''
+              Allows you to host Umami under a subdirectory.
+              You may need to update your reverse proxy settings to correctly handle the BASE_PATH prefix.
+            '';
+          };
+          DISABLE_UPDATES = mkOption {
+            type = types.bool;
+            default = true;
+            example = false;
+            description = ''
+              Disables the check for new versions of Umami.
+            '';
+          };
+          DISABLE_TELEMETRY = mkOption {
+            type = types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Umami collects completely anonymous telemetry data in order help improve the application.
+              You can choose to disable this if you don't want to participate.
+            '';
+          };
+          HOSTNAME = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            example = "0.0.0.0";
+            description = ''
+              The address to listen on.
+            '';
+          };
+          PORT = mkOption {
+            type = types.port;
+            default = 3000;
+            example = 3010;
+            description = ''
+              The port to listen on.
+            '';
+          };
+        };
+      };
+
+      default = { };
+
+      example = {
+        APP_SECRET_FILE = "/run/secrets/umamiAppSecret";
+        DISABLE_TELEMETRY = true;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.settings.APP_SECRET_FILE != null) != (cfg.settings ? APP_SECRET);
+        message = "One (and only one) of services.umami.settings.APP_SECRET_FILE and services.umami.settings.APP_SECRET must be set.";
+      }
+      {
+        assertion = (cfg.settings.DATABASE_URL_FILE != null) != (cfg.settings.DATABASE_URL != null);
+        message = "One (and only one) of services.umami.settings.DATABASE_URL_FILE and services.umami.settings.DATABASE_URL must be set.";
+      }
+      {
+        assertion =
+          cfg.createPostgresqlDatabase
+          -> cfg.settings.DATABASE_URL == "postgresql://umami@localhost/umami?host=/run/postgresql";
+        message = "The option config.services.umami.createPostgresqlDatabase is enabled, but config.services.umami.settings.DATABASE_URL has been modified.";
+      }
+    ];
+
+    services.postgresql = mkIf cfg.createPostgresqlDatabase {
+      enable = true;
+      ensureDatabases = [ "umami" ];
+      ensureUsers = [
+        {
+          name = "umami";
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }
+      ];
+    };
+
+    systemd.services.umami = {
+      environment = mapAttrs (_: toString) nonFileSettings;
+
+      description = "Umami: a simple, fast, privacy-focused alternative to Google Analytics";
+      after = [ "network.target" ] ++ (optional (cfg.createPostgresqlDatabase) "postgresql.service");
+      wantedBy = [ "multi-user.target" ];
+
+      script =
+        let
+          loadCredentials =
+            (optional (
+              cfg.settings.APP_SECRET_FILE != null
+            ) ''export APP_SECRET="$(systemd-creds cat appSecret)"'')
+            ++ (optional (
+              cfg.settings.DATABASE_URL_FILE != null
+            ) ''export DATABASE_URL="$(systemd-creds cat databaseUrl)"'');
+        in
+        ''
+          ${concatStringsSep "\n" loadCredentials}
+          ${getExe cfg.package}
+        '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = 3;
+        DynamicUser = true;
+
+        LoadCredential =
+          (optional (cfg.settings.APP_SECRET_FILE != null) "appSecret:${cfg.settings.APP_SECRET_FILE}")
+          ++ (optional (
+            cfg.settings.DATABASE_URL_FILE != null
+          ) "databaseUrl:${cfg.settings.DATABASE_URL_FILE}");
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = (optional cfg.createPostgresqlDatabase "AF_UNIX") ++ [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ diogotcorreia ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b24bc4d7d7af..652e0fd503e9 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -618,6 +618,7 @@ in
   gnupg = runTest ./gnupg.nix;
   goatcounter = runTest ./goatcounter.nix;
   go-camo = runTest ./go-camo.nix;
+  go-httpbin = runTest ./go-httpbin.nix;
   go-neb = runTest ./go-neb.nix;
   gobgpd = runTest ./gobgpd.nix;
   gocd-agent = runTest ./gocd-agent.nix;
@@ -1508,6 +1509,7 @@ in
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;
   ulogd = runTest ./ulogd/ulogd.nix;
+  umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;
   unbound = runTest ./unbound.nix;
   unifi = runTest ./unifi.nix;
diff --git a/nixos/tests/go-httpbin.nix b/nixos/tests/go-httpbin.nix
new file mode 100644
index 000000000000..318fd8886c58
--- /dev/null
+++ b/nixos/tests/go-httpbin.nix
@@ -0,0 +1,38 @@
+{ lib, ... }:
+
+{
+  name = "go-httpbin";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.go-httpbin = {
+      enable = true;
+      settings.PORT = 8000;
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.go-httpbin.settings.HOST = "0.0.0.0";
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("go-httpbin.service")
+    machine.wait_for_open_port(8000)
+
+    resp = json.loads(machine.succeed("curl localhost:8000/get?foo=bar"))
+    assert resp["args"]["foo"] == ["bar"]
+    assert resp["method"] == "GET"
+    assert resp["origin"] == "127.0.0.1"
+    assert resp["url"] == "http://localhost:8000/get?foo=bar"
+  '';
+}
diff --git a/nixos/tests/web-apps/umami.nix b/nixos/tests/web-apps/umami.nix
new file mode 100644
index 000000000000..6004ae68226b
--- /dev/null
+++ b/nixos/tests/web-apps/umami.nix
@@ -0,0 +1,45 @@
+{ lib, ... }:
+{
+  name = "umami-nixos";
+
+  meta.maintainers = with lib.maintainers; [ diogotcorreia ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.umami = {
+        enable = true;
+        settings = {
+          APP_SECRET = "very_secret";
+        };
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("umami.service")
+
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl --fail http://localhost:3000/")
+    machine.succeed("curl --fail http://localhost:3000/script.js")
+
+    res = machine.succeed("""
+      curl -f --json '{ "username": "admin", "password": "umami" }' http://localhost:3000/api/auth/login
+    """)
+    token = json.loads(res)['token']
+
+    res = machine.succeed("""
+      curl -f -H 'Authorization: Bearer %s' --json '{ "domain": "localhost", "name": "Test" }' http://localhost:3000/api/websites
+    """ % token)
+    print(res)
+    websiteId = json.loads(res)['id']
+
+    res = machine.succeed("""
+      curl -f -H 'Authorization: Bearer %s' http://localhost:3000/api/websites/%s
+    """ % (token, websiteId))
+    website = json.loads(res)
+    assert website["name"] == "Test"
+    assert website["domain"] == "localhost"
+  '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix b/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix
index 1e4a7d7069a1..f491c138677b 100644
--- a/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix
@@ -1,31 +1,16 @@
 {
-  jq,
   lib,
-  moreutils,
   vscode-utils,
-  eslint,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-eslint";
     publisher = "dbaeumer";
-    version = "3.0.13";
-    hash = "sha256-l5VvhQPxPaQsPhXUbFW2yGJjaqnNvijn4QkXPjf1WXo=";
+    version = "3.0.15";
+    hash = "sha256-oeudNCBrHO3yvw3FrFA4EZk1yODcRRfF/y3U5tdEz4I=";
   };
 
-  nativeBuildInputs = [
-    jq
-    moreutils
-  ];
-
-  buildInputs = [ eslint ];
-
-  postInstall = ''
-    cd "$out/$installPrefix"
-    jq '.contributes.configuration.properties."eslint.nodePath".default = "${eslint}/lib/node_modules"' package.json | sponge package.json
-  '';
-
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
     description = "Integrates ESLint JavaScript into VS Code";
diff --git a/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
index 5272f895e38f..50a8fe24498a 100644
--- a/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
@@ -1,8 +1,5 @@
 {
-  jq,
   lib,
-  moreutils,
-  prettier,
   vscode-utils,
 }:
 
@@ -14,18 +11,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-pNjkJhof19cuK0PsXJ/Q/Zb2H7eoIkfXJMLZJ4lDn7k=";
   };
 
-  nativeBuildInputs = [
-    jq
-    moreutils
-  ];
-
-  buildInputs = [ prettier ];
-
-  postInstall = ''
-    cd "$out/$installPrefix"
-    jq '.contributes.configuration.properties."prettier.prettierPath".default = "${prettier}"' package.json | sponge package.json
-  '';
-
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/esbenp.prettier-vscode/changelog";
     description = "Code formatter using prettier";
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index d6d031c1ba2c..e3b12570912f 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-07-10";
+  version = "0-unstable-2025-07-28";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "92894e7bdb6304d23278dc77f8a9fa7212450f6e";
-    hash = "sha256-uA/pm3DyT0VCyq85DzZGXjSGrKQ9uoEIfrs839ta97s=";
+    rev = "4b5f6c964aa56357e19632bf73d1875c2496fdd1";
+    hash = "sha256-J1NSt2Q4+lWUVqROv5yAM/rXI5COl0FRux3xqFLw20g=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index d6ac9988d553..cd33498902e5 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "znc";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchurl {
     url = "https://znc.in/releases/archive/znc-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vmWtm2LvVFp+lIby90E07cU7pROtQ6adnYtHZgUzaxk=";
+    hash = "sha256-Tm52hR2/JgYYWXK1PsXeytaP5TtjpW5N+LizwKbEaAA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ai/aiken/package.nix b/pkgs/by-name/ai/aiken/package.nix
index dd33f445f630..368820cad5e4 100644
--- a/pkgs/by-name/ai/aiken/package.nix
+++ b/pkgs/by-name/ai/aiken/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.17";
+  version = "1.1.19";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     tag = "v${version}";
-    hash = "sha256-bEsBLihMqYHJa5913Q434xKVufxTrcaxwcANPV9u37U=";
+    hash = "sha256-S3KIOlOz21ItWI+RoeHPYROIlMbKAoNi7hXwHHjHaJs=";
   };
 
-  cargoHash = "sha256-Ob4UuBLD6HFbghv4E2XMj+xVeUSFtc9qPUNuUDgZeQA=";
+  cargoHash = "sha256-RrcP23p3KVIGKiW1crDDn5eoowjX3nTPUWBYtT9qdz0=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 3ff760bffdf0..97a68660a69b 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.8.3";
+  version = "4.8.9.1";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-hDbrp6eT+avFepJL55Vl2alOD+IMnyy8MPXZQTEmLJo=";
+    hash = "sha256-docQqOVzmgqWPhKzOmKeXhssjyhtfYy1fNn0ZGXjsZ0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ar/artichoke/package.nix b/pkgs/by-name/ar/artichoke/package.nix
index 55593a0e617c..7282ca4388be 100644
--- a/pkgs/by-name/ar/artichoke/package.nix
+++ b/pkgs/by-name/ar/artichoke/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "artichoke";
-  version = "0-unstable-2025-06-18";
+  version = "0-unstable-2025-07-28";
 
   src = fetchFromGitHub {
     owner = "artichoke";
     repo = "artichoke";
-    rev = "94921a493f680381c83465e5c50e5d494a7048f6";
-    hash = "sha256-JdCGCvs7GK/I3yyIl4n9OGtN9VwzmwdDdglwbTHfx0Y=";
+    rev = "148d3bf4bc361fa3214c02219e50e22e4cf2a3cf";
+    hash = "sha256-CKCRFSg8ROMhKwiIDU9iAYY/HfGtYlW1zrtn7thxIzY=";
   };
 
   cargoHash = "sha256-a43awTdhOlu+KO3B6XQ7Vdv4NbZ3iffq4rpmBBgUcZ8=";
diff --git a/pkgs/by-name/be/beebeep/package.nix b/pkgs/by-name/be/beebeep/package.nix
index 42a6dd4dc932..ed9138531aaa 100644
--- a/pkgs/by-name/be/beebeep/package.nix
+++ b/pkgs/by-name/be/beebeep/package.nix
@@ -2,10 +2,11 @@
   lib,
   fetchzip,
   autoPatchelfHook,
-  libsForQt5,
+  stdenv,
+  qt5,
 }:
 
-libsForQt5.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "beebeep";
   version = "5.8.6";
 
@@ -15,11 +16,11 @@ libsForQt5.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
+    qt5.wrapQtAppsHook
     autoPatchelfHook
   ];
 
-  buildInputs = with libsForQt5; [
+  buildInputs = with qt5; [
     qtbase
     qtmultimedia
     qtx11extras
diff --git a/pkgs/by-name/bl/blanket/package.nix b/pkgs/by-name/bl/blanket/package.nix
index e83a89c6e3d5..a81239eb5f10 100644
--- a/pkgs/by-name/bl/blanket/package.nix
+++ b/pkgs/by-name/bl/blanket/package.nix
@@ -18,13 +18,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "blanket";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "rafaelmardojai";
     repo = "blanket";
-    rev = version;
-    hash = "sha256-mY7c5i0me7mMbD8c6eGJeaZpR8XI5QVL4n3M+j15Z1c=";
+    tag = version;
+    hash = "sha256-LnHL/1DJXiKx9U+JkT4Wjx1vtTmKLpzZ8q6uLT5a2MY=";
   };
 
   nativeBuildInputs = [
@@ -49,13 +49,7 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [ pygobject3 ];
 
-  format = "other";
-
-  postPatch = ''
-    patchShebangs build-aux/meson/postinstall.py
-    substituteInPlace build-aux/meson/postinstall.py \
-      --replace-fail gtk-update-icon-cache gtk4-update-icon-cache
-  '';
+  pyproject = false;
 
   dontWrapGApps = true;
 
@@ -69,6 +63,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = {
     description = "Listen to different sounds";
+    changelog = "https://github.com/rafaelmardojai/blanket/releases/tag/${version}";
     homepage = "https://github.com/rafaelmardojai/blanket";
     license = lib.licenses.gpl3Plus;
     mainProgram = "blanket";
diff --git a/pkgs/by-name/ca/cargo-bolero/package.nix b/pkgs/by-name/ca/cargo-bolero/package.nix
index a673292503de..987017fdde30 100644
--- a/pkgs/by-name/ca/cargo-bolero/package.nix
+++ b/pkgs/by-name/ca/cargo-bolero/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bolero";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-xU7a5xEFSrFsQ1K5DIYgACuf+34QeCvGmWvlSSwI03I=";
+    hash = "sha256-lfBpHaY2UCBMg45S4IW8fcpkGkKJoT4qqR2yq5KiXuE=";
   };
 
-  cargoHash = "sha256-FMpM42D3h42NfDzH+EVs6NB2RVehFNFAYTMvzRQVt/s=";
+  cargoHash = "sha256-2URFqLg2aQF7MOpwG6fEPBXyBsLENWpdiXgxW/DJxQE=";
 
   buildInputs = [
     libbfd
diff --git a/pkgs/by-name/ce/cerberus/package.nix b/pkgs/by-name/ce/cerberus/package.nix
index 58e4b988930b..73454ad04917 100644
--- a/pkgs/by-name/ce/cerberus/package.nix
+++ b/pkgs/by-name/ce/cerberus/package.nix
@@ -8,13 +8,13 @@
 }:
 ocamlPackages.buildDunePackage {
   pname = "cerberus";
-  version = "0-unstable-2025-06-29";
+  version = "0-unstable-2025-07-25";
 
   src = fetchFromGitHub {
     owner = "rems-project";
     repo = "cerberus";
-    rev = "61700b301f0f1fbc1940db51c50240c397759057";
-    hash = "sha256-QpgHOQqiJMlMf2RH5/TI3AirdqYPS7HwE9YIlxgorqg=";
+    rev = "9f8f2d375366e8c6c3c60dcf2da757344d877b14";
+    hash = "sha256-wwc2XXQ3AdXBhBX7FPhpm56w3g9rrC8tESelcXSwjPE=";
   };
 
   minimalOCamlVersion = "4.12";
diff --git a/pkgs/by-name/cl/clever-tools/package.nix b/pkgs/by-name/cl/clever-tools/package.nix
index 22bbb16711b4..29e1811eaf3b 100644
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "3.13.1";
+  version = "3.14.0";
 
   nodejs = nodejs_20;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-6QzwZmDCts/ci0J2ok1Met9bNiqDHmdYj/PbvWyd4Wk=";
+    hash = "sha256-gBmYbnKsnqZ4KqjJhNmLB7lzIh3MztmcFVAPtz0dB2A=";
   };
 
-  npmDepsHash = "sha256-H53g1hbVpArFNy47M5QS2/diWbEyyoLOf86OxVffvwQ=";
+  npmDepsHash = "sha256-e3H3nLZZHZ+FX0JTPZXX+YknudnzcAKV6o2bqecZTBA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/co/comma/package.nix b/pkgs/by-name/co/comma/package.nix
index 8a17f78a76a3..779537f11180 100644
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@@ -1,6 +1,7 @@
 {
   comma,
   fetchFromGitHub,
+  installShellFiles,
   fzy,
   lib,
   nix-index-unwrapped,
@@ -11,16 +12,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comma";
-  version = "2.3.0";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
     rev = "v${version}";
-    hash = "sha256-JogC9NIS71GyimpqmX2/dhBX1IucK395iWZVVabZxiE=";
+    hash = "sha256-dNek1a8Yt3icWc8ZpVe1NGuG+eSoTDOmAAJbkYmMocU=";
   };
 
-  cargoHash = "sha256-Cd4WaOG+OkCM4Q1K9qVzMYOjSi9U8W82JypqUN20x9w=";
+  cargoHash = "sha256-SJBfWjOVrv2WMIh/cQbaFK8jn3oSbmJpdJM7pkJppDs=";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   postPatch = ''
     substituteInPlace ./src/main.rs \
@@ -33,20 +36,21 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     ln -s $out/bin/comma $out/bin/,
 
-    mkdir -p $out/etc/profile.d
-    mkdir -p $out/etc/nushell
-    mkdir -p $out/etc/fish/functions
+    mkdir -p $out/share/comma
 
-    cp $src/etc/comma-command-not-found.sh $out/etc/profile.d
-    cp $src/etc/comma-command-not-found.nu $out/etc/nushell
-    cp $src/etc/comma-command-not-found.fish $out/etc/fish/functions
+    cp $src/etc/command-not-found.sh $out/share/comma
+    cp $src/etc/command-not-found.nu $out/share/comma
+    cp $src/etc/command-not-found.fish $out/share/comma
 
-    patchShebangs $out/etc/profile.d/comma-command-not-found.sh
+    patchShebangs $out/share/comma/command-not-found.sh
     substituteInPlace \
-      "$out/etc/profile.d/comma-command-not-found.sh" \
-      "$out/etc/nushell/comma-command-not-found.nu" \
-      "$out/etc/fish/functions/comma-command-not-found.fish" \
+      "$out/share/comma/command-not-found.sh" \
+      "$out/share/comma/command-not-found.nu" \
+      "$out/share/comma/command-not-found.fish" \
       --replace-fail "comma --ask" "$out/bin/comma --ask"
+
+    "$out/bin/comma" --mangen > comma.1
+    installManPage comma.1
   '';
 
   passthru.tests = {
diff --git a/pkgs/by-name/co/corsix-th/package.nix b/pkgs/by-name/co/corsix-th/package.nix
index 6ae3ea109013..394d52233c85 100644
--- a/pkgs/by-name/co/corsix-th/package.nix
+++ b/pkgs/by-name/co/corsix-th/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corsix-th";
-  version = "0.68.0";
+  version = "0.69.0";
 
   src = fetchFromGitHub {
     owner = "CorsixTH";
     repo = "CorsixTH";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-D8ks+fiFJxwClqW1aNtGGa5UxAFvuH2f2guwPxOEQwI=";
+    hash = "sha256-U8rl24EBjSRJrK2VmCI3YKeEM7U8ynaufEghgVfqrp0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 6fe2cf916ea0..1749c5c7d787 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.186";
+  version = "0.0.187";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-s9YGKHPk4/xy3Re3NdWe1Srjg+inPft0vrQMWaRcGpA=";
+    hash = "sha256-vdLt7LtVkgcgoUzzl5jb7ERIyQMpY+iSwJpdQpWxoJw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gi/git-quick-stats/package.nix b/pkgs/by-name/gi/git-quick-stats/package.nix
index 3749c5ff8b29..57724f925fe9 100644
--- a/pkgs/by-name/gi/git-quick-stats/package.nix
+++ b/pkgs/by-name/gi/git-quick-stats/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-quick-stats";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     repo = "git-quick-stats";
     owner = "arzzen";
     rev = version;
-    sha256 = "sha256-OSEX9S6Q4R7fT2ic72GkUI5mW8wC5Hy2GQVeENlTm5E=";
+    sha256 = "sha256-utY3oD0IqnqyyDJv7i4hLkLCXukNcYSdZcaj8NUwRu0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/go/go-httpbin/package.nix b/pkgs/by-name/go/go-httpbin/package.nix
new file mode 100644
index 000000000000..9a77b98f4619
--- /dev/null
+++ b/pkgs/by-name/go/go-httpbin/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "go-httpbin";
+  version = "2.18.3";
+
+  src = fetchFromGitHub {
+    owner = "mccutchen";
+    repo = "go-httpbin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ixEbmppQ+4Udc5ytV4YPOpOT/iEbhjQIYGoOGL0dIw8=";
+  };
+
+  vendorHash = null;
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  # tests are flaky
+  doCheck = false;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/go-httpbin --help &> /dev/null
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) go-httpbin; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib";
+    homepage = "https://github.com/mccutchen/go-httpbin";
+    changelog = "https://github.com/mccutchen/go-httpbin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "go-httpbin";
+  };
+})
diff --git a/pkgs/by-name/go/gopls/package.nix b/pkgs/by-name/go/gopls/package.nix
index bf31ed9b5e94..989467a30011 100644
--- a/pkgs/by-name/go/gopls/package.nix
+++ b/pkgs/by-name/go/gopls/package.nix
@@ -11,17 +11,17 @@
 
 buildGoLatestModule (finalAttrs: {
   pname = "gopls";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     tag = "gopls/v${finalAttrs.version}";
-    hash = "sha256-QJnLJNgFtc/MmJ5WWooKcavnPPTYuM4XhUHcbwlvMLY=";
+    hash = "sha256-DYYitsrdH4nujDFJgdkObEpgElhXI7Yk2IpA/EVVLVo=";
   };
 
   modRoot = "gopls";
-  vendorHash = "sha256-P5wUGXmVvaRUpzmv/SPX8OpCXOCOg6nBI544puNOWCE=";
+  vendorHash = "sha256-J6QcefSs4XtnktlzG+/+aY6fqkHGd9MMZqi24jAwcd0=";
 
   # https://github.com/golang/tools/blob/9ed98faa/gopls/main.go#L27-L30
   ldflags = [ "-X main.version=v${finalAttrs.version}" ];
diff --git a/pkgs/by-name/gu/guile-curl/package.nix b/pkgs/by-name/gu/guile-curl/package.nix
index a990544b7600..740d88a2c8d4 100644
--- a/pkgs/by-name/gu/guile-curl/package.nix
+++ b/pkgs/by-name/gu/guile-curl/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
+  gettext,
   guile,
   pkg-config,
   texinfo,
@@ -34,6 +35,11 @@ stdenv.mkDerivation (finalAttrs: {
     curl
   ];
 
+  # error: possibly undefined macro: AC_LIB_LINKFLAGS_FROM_LIBS
+  preAutoreconf = ''
+    cp ${gettext}/share/gettext/m4/lib-{ld,link,prefix}.m4 m4
+  '';
+
   meta = {
     description = "Bindings to cURL for GNU Guile";
     homepage = "https://github.com/spk121/guile-curl";
diff --git a/pkgs/by-name/je/jellyseerr/package.nix b/pkgs/by-name/je/jellyseerr/package.nix
index 7351676250ce..52f7428e5aa5 100644
--- a/pkgs/by-name/je/jellyseerr/package.nix
+++ b/pkgs/by-name/je/jellyseerr/package.nix
@@ -17,19 +17,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jellyseerr";
-  version = "2.7.0";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "Fallenbagel";
     repo = "jellyseerr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JzJYRwrwDk8LQZAfWwym+SFTn8YhALghpZb2Dd+3nP4=";
+    hash = "sha256-MaLmdG98WewnNJt7z6OP9xv6zlNwwu/+YnPM0Iebxj4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
+    hash = "sha256-3df72m/ARgfelBLE6Bhi8+ThHytowVOBL2Ndk7auDgg=";
   };
 
   buildInputs = [ sqlite ];
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index b1402ea7fe56..fba4e166463d 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "sha256-3TRspvOvq83F6boJ3WZ7AQWQu2akL0VBAh+51vBz2sw=";
+    sha256 = "sha256-ZzCnPb/BLXnYAA/+ItNtBot0Z+dL7h6xIqxJNezqSfk=";
   };
 
   outputs = [
diff --git a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix b/pkgs/by-name/ku/kubectl/package.nix
similarity index 100%
rename from pkgs/applications/networking/cluster/kubernetes/kubectl.nix
rename to pkgs/by-name/ku/kubectl/package.nix
diff --git a/pkgs/applications/networking/cluster/kubernetes/fixup-addonmanager-lib-path.patch b/pkgs/by-name/ku/kubernetes/fixup-addonmanager-lib-path.patch
similarity index 100%
rename from pkgs/applications/networking/cluster/kubernetes/fixup-addonmanager-lib-path.patch
rename to pkgs/by-name/ku/kubernetes/fixup-addonmanager-lib-path.patch
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/by-name/ku/kubernetes/package.nix
similarity index 100%
rename from pkgs/applications/networking/cluster/kubernetes/default.nix
rename to pkgs/by-name/ku/kubernetes/package.nix
diff --git a/pkgs/by-name/le/lesspipe/package.nix b/pkgs/by-name/le/lesspipe/package.nix
index 862d3119052b..b4a572b3e606 100644
--- a/pkgs/by-name/le/lesspipe/package.nix
+++ b/pkgs/by-name/le/lesspipe/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lesspipe";
-  version = "2.18";
+  version = "2.19";
 
   src = fetchFromGitHub {
     owner = "wofr06";
     repo = "lesspipe";
     rev = "v${version}";
-    hash = "sha256-GCtcIXGrMH6LOKxjnB2SkUSChQnMj5d939i2atvqK+Q=";
+    hash = "sha256-V+fB5KkbBRhVSDgB/e7oVEyMKQ7HbR82XQYlqxcLZyQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lu/lug-helper/package.nix b/pkgs/by-name/lu/lug-helper/package.nix
index 6a5b637f46e2..c2586c8fe782 100644
--- a/pkgs/by-name/lu/lug-helper/package.nix
+++ b/pkgs/by-name/lu/lug-helper/package.nix
@@ -15,12 +15,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "lug-helper";
-  version = "4.1";
+  version = "4.2";
   src = fetchFromGitHub {
     owner = "starcitizen-lug";
     repo = "lug-helper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pj0jReezB/0yCl5EC+EQ7CVtmgGQrJwVR6pvaP/gtWg=";
+    hash = "sha256-W8GwDXYHfGdruAMdBei53V5UPYE6yks0+FW48pARknY=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ma/mandelbrot-cli/package.nix b/pkgs/by-name/ma/mandelbrot-cli/package.nix
new file mode 100644
index 000000000000..0ea9f1369927
--- /dev/null
+++ b/pkgs/by-name/ma/mandelbrot-cli/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mandelbrot-cli";
+  version = "0-unstable-2025-07-16";
+
+  src = fetchFromGitHub {
+    owner = "IronstoneInnovation";
+    repo = "mandelbrot_cli";
+    rev = "36a43d4feace4ac346c6da78262278d4deb6bb94";
+    hash = "sha256-RGv/B2Zi2hqHWPbo67vTlJIIci3a0tyIgD5+Tnf0yiY=";
+  };
+
+  cargoHash = "sha256-nOhg3nDWGA+0g499EnsX5TNwnZM2NcpqHiyQujOM3OI=";
+
+  meta = {
+    description = "A CLI for generating images of the Mandelbrot Set";
+    homepage = "https://github.com/IronstoneInnovation/mandelbrot_cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ yiyu ];
+    mainProgram = "mandelbrot-cli";
+  };
+})
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 20cf8161869d..e648cf1445dd 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-07-23";
+  version = "0-unstable-2025-07-29";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "affbfa8012d0dbc0eba81ea51ec32069c71af417";
-    hash = "sha256-JPcurldPuaFPfwqiWQR83x1uDcL0Dy79kx2TAOiNnyQ=";
+    rev = "69e91b1cee1dbd737dc60f5f99ce123a81763cda";
+    hash = "sha256-fr4cgQsW03ukgCxNBtlokAXmqjGh1fFJucWx1dJ7xV0=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index f7c0ad3e98b7..f3c0e0fd0339 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -7,43 +7,21 @@
   openssl,
   versionCheckHook,
   writeShellApplication,
+  common-updater-scripts,
+  gitMinimal,
   jq,
   nix-update,
-  gitMinimal,
   pup,
   nixosTests,
 }:
 
-let
-  version = "8.0.11";
-
-  srcs = version: {
-    "x86_64-linux" = {
-      url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-${version}.tgz";
-      hash = "sha256-XErxsovZyMR1UmwClxn5Bm08hoYHArCtn8TSv/8eDYo=";
-    };
-    "aarch64-linux" = {
-      url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2204-${version}.tgz";
-      hash = "sha256-p1eBobdnJ/uPZHScWFs3AOB7/BJn/MZQ8+VpOHonY2A=";
-    };
-    "x86_64-darwin" = {
-      url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${version}.tgz";
-      hash = "sha256-RLq+aFJixSt3EginpgIHWnR4CGk0KX5cmC3QrbW3jJ8=";
-    };
-    "aarch64-darwin" = {
-      url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${version}.tgz";
-      hash = "sha256-kNzByPEXi5T3+vr6t/EJuKIDEfGybrsbBqJ8vaEV5tY=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
-  inherit version;
+  version = "8.0.12";
 
-  src = fetchurl (
-    (srcs version).${stdenv.hostPlatform.system}
-      or (throw "unsupported system: ${stdenv.hostPlatform.system}")
-  );
+  src =
+    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported platform for mongodb-ce: ${stdenv.hostPlatform.system}");
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
   dontStrip = true;
@@ -59,29 +37,49 @@ stdenv.mkDerivation (finalAttrs: {
 
     install -Dm 755 bin/mongod -t $out/bin
     install -Dm 755 bin/mongos -t $out/bin
+
     runHook postInstall
   '';
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgram = "${placeholder "out"}/bin/mongod";
-  versionCheckProgramArg = "--version";
   # Only enable the version install check on darwin.
   # On Linux, this would fail as mongod relies on tcmalloc, which
   # requires access to `/sys/devices/system/cpu/possible`.
   # See https://github.com/NixOS/nixpkgs/issues/377016
   doInstallCheck = stdenv.hostPlatform.isDarwin;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mongod";
+  versionCheckProgramArg = "--version";
 
   passthru = {
+    sources = {
+      "x86_64-linux" = fetchurl {
+        url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2404-${finalAttrs.version}.tgz";
+        hash = "sha256-dmXt+OxvDaJRXEn3hNoiYZ9ob//tmQp2lsU2XunTNLM=";
+      };
+      "aarch64-linux" = fetchurl {
+        url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2404-${finalAttrs.version}.tgz";
+        hash = "sha256-9FdODnUqzquSKk86BN5OL+fEO07hGYg1VAtytp7ehFM=";
+      };
+      "x86_64-darwin" = fetchurl {
+        url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${finalAttrs.version}.tgz";
+        hash = "sha256-LUUhqfgP1tIupe517TdLL97jUvBZsCvzMey3JtMVTmg=";
+      };
+      "aarch64-darwin" = fetchurl {
+        url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${finalAttrs.version}.tgz";
+        hash = "sha256-9SFfRbIWVXPupxvqmQlkacmcthycu840VIupCNBf7Ew=";
+      };
+    };
     updateScript =
       let
         script = writeShellApplication {
           name = "${finalAttrs.pname}-updateScript";
 
           runtimeInputs = [
+            common-updater-scripts
             curl
+            gitMinimal
             jq
             nix-update
-            gitMinimal
             pup
           ];
 
@@ -92,16 +90,15 @@ stdenv.mkDerivation (finalAttrs: {
             # Check if the new version is available for download, if not, exit
             curl -s https://www.mongodb.com/try/download/community-edition/releases | pup 'h3:not([id]) text{}' | grep "$NEW_VERSION"
 
-            if [[ "${version}" = "$NEW_VERSION" ]]; then
+            if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
                 echo "The new version same as the old version."
                 exit 0
             fi
-          ''
-          + lib.concatStrings (
-            map (system: ''
-              nix-update --system ${system} --version "$NEW_VERSION" ${finalAttrs.pname}
-            '') finalAttrs.meta.platforms
-          );
+
+            for platform in ${lib.escapeShellArgs finalAttrs.meta.platforms}; do
+              update-source-version "mongodb-ce" "$NEW_VERSION" --ignore-same-version --source-key="sources.$platform"
+            done
+          '';
         };
       in
       {
@@ -125,7 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
       (mongos).
     '';
     maintainers = with lib.maintainers; [ drupol ];
-    platforms = lib.attrNames (srcs version);
+    platforms = lib.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/by-name/oc/ocenaudio/package.nix b/pkgs/by-name/oc/ocenaudio/package.nix
index 63ca23d4e6e0..98c86efc7d2c 100644
--- a/pkgs/by-name/oc/ocenaudio/package.nix
+++ b/pkgs/by-name/oc/ocenaudio/package.nix
@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocenaudio";
-  version = "3.15";
+  version = "3.15.2";
 
   src = fetchurl {
     name = "ocenaudio.deb";
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian12.deb?version=v${finalAttrs.version}";
-    hash = "sha256-MZjgdCBE+3dG6Ov+wwDKa/0Y8XIihwM50Gc/cgEf2FQ=";
+    hash = "sha256-sAsa/stC+OF7g7fNQGRT5x0GO0YKzH/lOPzWIZA0YsY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
index 1b08eb5882b8..b2a4d4eca800 100644
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -81,13 +81,13 @@ buildGoModule (
 
   {
     pname = "olivetin";
-    version = "2025.7.19";
+    version = "2025.7.28";
 
     src = fetchFromGitHub {
       owner = "OliveTin";
       repo = "OliveTin";
       tag = finalAttrs.version;
-      hash = "sha256-F1AJ4kbFx+L/t1TSsjbDM761LtA2M9exfjWd9VwRZuE=";
+      hash = "sha256-gh0Nc7h2Z+Nz7TixmHihFAHI0X0Y2ZeA4OMv3jOYlh4=";
     };
 
     modRoot = "service";
diff --git a/pkgs/tools/audio/piper/train.nix b/pkgs/by-name/pi/piper-train/package.nix
similarity index 100%
rename from pkgs/tools/audio/piper/train.nix
rename to pkgs/by-name/pi/piper-train/package.nix
diff --git a/pkgs/tools/audio/piper/default.nix b/pkgs/by-name/pi/piper-tts/package.nix
similarity index 91%
rename from pkgs/tools/audio/piper/default.nix
rename to pkgs/by-name/pi/piper-tts/package.nix
index deb718b916ae..7e7782e81328 100644
--- a/pkgs/tools/audio/piper/default.nix
+++ b/pkgs/by-name/pi/piper-tts/package.nix
@@ -19,7 +19,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "piper";
+  pname = "piper-tts";
   version = "2023.11.14-2";
 
   src = fetchFromGitHub {
@@ -65,12 +65,12 @@ stdenv.mkDerivation (finalAttrs: {
     inherit piper-train;
   };
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/rhasspy/piper/releases/tag/v${finalAttrs.version}";
     description = "Fast, local neural text to speech system";
     homepage = "https://github.com/rhasspy/piper";
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
     mainProgram = "piper";
   };
 })
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index 17d8fe822e0f..8fdc51f28bcf 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.5.5";
+  version = "4.5.6";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-l+HbtJyP6mygIh+H6MzfRoyz4RTgtF9B4hbQBHVRwhg=";
+    hash = "sha256-xoBGYdcef1xBlPlUOPudhX0t59OBbNavcg5CeRJiQIY=";
   };
 
-  cargoHash = "sha256-jzql0ndlQlDHYhfXO5pAKlnQr79QG/MCK+som2qwTfY=";
+  cargoHash = "sha256-o/wbBp2gIl+Dyxnee7mChVzv5qmrVAcG95i9YMxd5AI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
index 41ed10fbb1a1..88e8260022fd 100644
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -7,7 +7,7 @@
   rainfrog,
 }:
 let
-  version = "0.3.3";
+  version = "0.3.4";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "achristmascarl";
     repo = "rainfrog";
     tag = "v${version}";
-    hash = "sha256-nGUk+997TBx/2U3QMF4OpRqzwNzC0ILRraz3kOzzoBw=";
+    hash = "sha256-uERAYdDM2yKowl8WH6FB1XEbjSO/S79Fdib2QQE95N4=";
   };
 
-  cargoHash = "sha256-8RvZmQI1WXfM2Sh5bMAkeJVNvOUp8fmM0MznZzCpxgY=";
+  cargoHash = "sha256-drL2rLuJExJI799Rvh0X/c6kTqJ+3wnqaDSRiz63Nuo=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ri/ripasso-cursive/package.nix b/pkgs/by-name/ri/ripasso-cursive/package.nix
index 76ff51e97c61..b3ea8c3a235c 100644
--- a/pkgs/by-name/ri/ripasso-cursive/package.nix
+++ b/pkgs/by-name/ri/ripasso-cursive/package.nix
@@ -9,6 +9,7 @@
   installShellFiles,
   pkg-config,
   python3,
+  writableTmpDirAsHomeHook,
 
   # buildInputs
   libgpg-error,
@@ -19,14 +20,14 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   version = "0.7.0";
   pname = "ripasso-cursive";
 
   src = fetchFromGitHub {
     owner = "cortex";
     repo = "ripasso";
-    tag = "release-${version}";
+    tag = "release-${finalAttrs.version}";
     hash = "sha256-j98X/+UTea4lCtFfMpClnfcKlvxm4DpOujLc0xc3VUY=";
   };
 
@@ -44,6 +45,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     python3
     rustPlatform.bindgenHook
+    writableTmpDirAsHomeHook
   ];
 
   buildInputs = [
@@ -54,10 +56,6 @@ rustPlatform.buildRustPackage rec {
     xorg.libxcb
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     # Fails in the darwin sandbox with:
     # Attempted to create a NULL object.
@@ -81,4 +79,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ sgo ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index eae9df1c9deb..84668d194e72 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "rqlite";
-  version = "8.39.1";
+  version = "8.41.0";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = "rqlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x/J8W+lAC7d6rE3Zzc7vXVvbonCXn33Of2pKljuWpq0=";
+    hash = "sha256-3jzQ6Kby/v/cBxc1+ejm5PdmhZVVWvBrDEeuf7hqVKw=";
   };
 
-  vendorHash = "sha256-fj4YyxCIZG6ttmNVZm12xKk3+OcownrqXKc9LCAWk7U=";
+  vendorHash = "sha256-8Oejfec9QAYRkFGyEB9R/msiwzV+pgDFS+UNfvvTie4=";
 
   subPackages = [
     "cmd/rqlite"
diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
index 772386febedf..316c59ab0610 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "shopify",
-  "version": "3.82.1",
+  "version": "3.83.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shopify",
-      "version": "3.82.1",
+      "version": "3.83.0",
       "dependencies": {
-        "@shopify/cli": "3.82.1"
+        "@shopify/cli": "3.83.0"
       },
       "bin": {
         "shopify": "node_modules/@shopify/cli/bin/run.js"
@@ -579,9 +579,9 @@
       }
     },
     "node_modules/@shopify/cli": {
-      "version": "3.82.1",
-      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.82.1.tgz",
-      "integrity": "sha512-iIABwasf+aMSBIjaPsKlVSaLp3vcOIPcfiitdoMUJKQhjIVbq8KdwaAa/MLUMe5B+l230zjq/xGB8U3JeJY0eg==",
+      "version": "3.83.0",
+      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.83.0.tgz",
+      "integrity": "sha512-xdSrGV8FZAqyvtyj1fXeNbBhb9qH76l11vVhoCXKgorSCjmnYlJu9Ugffv3KqkseTR5PZsDzVJ5P6jL3f3iAXQ==",
       "license": "MIT",
       "os": [
         "darwin",
diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package.json b/pkgs/by-name/sh/shopify-cli/manifests/package.json
index f8fef2a1630d..3d9a98404740 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package.json
@@ -1,11 +1,11 @@
 {
   "name": "shopify",
-  "version": "3.82.1",
+  "version": "3.83.0",
   "private": true,
   "bin": {
     "shopify": "node_modules/@shopify/cli/bin/run.js"
   },
   "dependencies": {
-    "@shopify/cli": "3.82.1"
+    "@shopify/cli": "3.83.0"
   }
 }
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index 1b64c8313477..e94b15147477 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -5,7 +5,7 @@
   shopify-cli,
 }:
 let
-  version = "3.82.1";
+  version = "3.83.0";
 in
 buildNpmPackage {
   pname = "shopify";
@@ -13,7 +13,7 @@ buildNpmPackage {
 
   src = ./manifests;
 
-  npmDepsHash = "sha256-s0wlJxA3DUXRGBlLvyesLr9H/nbDc9yHBBWBLjQd8vE=";
+  npmDepsHash = "sha256-hnIpsPle7L8BrHZONH6vJjlFrTu2w1TsslDj0u8Ot3M=";
   dontNpmBuild = true;
 
   passthru = {
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index 0c90f0083589..8b825ed8d039 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20250726";
+  version = "20250729";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
-    rev = version;
-    hash = "sha256-BDrz2AHscjJdlnHW52TWaMGaz8TKVMRLGXs1rn2TQVI=";
+    tag = version;
+    hash = "sha256-IHQrtS75c6fAJeRD4fDc9m1Za95h1kvAZ3B7XFwDxdA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/sitespeed-io/package.nix b/pkgs/by-name/si/sitespeed-io/package.nix
index 629c83878b9b..0183e0380531 100644
--- a/pkgs/by-name/si/sitespeed-io/package.nix
+++ b/pkgs/by-name/si/sitespeed-io/package.nix
@@ -26,13 +26,13 @@ assert
   (!withFirefox && !withChromium) -> throw "Either `withFirefox` or `withChromium` must be enabled.";
 buildNpmPackage rec {
   pname = "sitespeed-io";
-  version = "37.8.0";
+  version = "38.0.0";
 
   src = fetchFromGitHub {
     owner = "sitespeedio";
     repo = "sitespeed.io";
     tag = "v${version}";
-    hash = "sha256-0bXkVqCen0kUHP8YeFkpdxTd+4Hx6YMZVTjwgWWg6nQ=";
+    hash = "sha256-PLzUpTvgyE9uxIxejU0qTChTM392+euhUtu3IND5kzw=";
   };
 
   postPatch = ''
@@ -50,7 +50,7 @@ buildNpmPackage rec {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--omit=dev" ];
-  npmDepsHash = "sha256-ZWjlueRZkH5lsalUY/xoOO/22P9Ta5CnmK0UKjapyU8=";
+  npmDepsHash = "sha256-mjFTE6k0MaGsRagC0Zk7CKTpNn2ow8WXa6KGbLuSVzc=";
 
   postInstall = ''
     mv $out/bin/sitespeed{.,-}io
diff --git a/pkgs/by-name/si/sizelint/package.nix b/pkgs/by-name/si/sizelint/package.nix
index 745b2a6ca18c..ffc3c74757e6 100644
--- a/pkgs/by-name/si/sizelint/package.nix
+++ b/pkgs/by-name/si/sizelint/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sizelint";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "a-kenji";
     repo = "sizelint";
     tag = "v${version}";
-    hash = "sha256-RwiopJHVyQE+WwiB5Bd89kfQxLl7TROZSB3aanf3fB0=";
+    hash = "sha256-06RJrE0w1Xhj364dUUuYadxleX12mkB8yO+h1QLZhH0=";
   };
 
-  cargoHash = "sha256-Kf6QreDGYM0ndmkOND4zhcDdx6SsXHuj7rcwy6tGyQk=";
+  cargoHash = "sha256-1kg1xfgzqrbZvazRavM4aW7oyRei9jKW0a+a6z2HLnc=";
 
   meta = {
     description = "Lint your file tree based on file sizes";
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index f22a683eefc3..2f873540b2f9 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -20,16 +20,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6zoI+yvE1Ep5jh9XthDqphm2zBA4UzhfK7VCKRWIH8g=";
+    hash = "sha256-VdeHb1HVGXA5RPenhhK4r/kkQiLG8/4qhdxoJ3xIqR4=";
   };
 
-  cargoHash = "sha256-t4BLko8vIVHZ44yeQoAhss3OxOlxJCErHm9h+FGG+28=";
+  cargoHash = "sha256-Wu6skjs3Stux5nCX++yoQPeA33Qln67GoKcob++Ldng=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/stalwart-mail/webadmin.nix b/pkgs/by-name/st/stalwart-mail/webadmin.nix
index 881942373b62..818314de323d 100644
--- a/pkgs/by-name/st/stalwart-mail/webadmin.nix
+++ b/pkgs/by-name/st/stalwart-mail/webadmin.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "webadmin";
-  version = "0.1.31";
+  version = "0.1.32";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webadmin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4+R7QQT0cbKYe6WzgvzreOFULBnWdNcbPC27f4r+M0g=";
+    hash = "sha256-HmQBMU7o0A20SY4tBw4SPVfHFfw8e0JsNQDNdZcex24=";
   };
 
   npmDeps = fetchNpmDeps {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-na1HEueX8w7kuDp8LEtJ0nD1Yv39cyk6sEMpS1zix2s=";
   };
 
-  cargoHash = "sha256-Q05+wH9+NfkfmEDJFLuWVQ7wuDeEu9h1XmOMN6SYdyU=";
+  cargoHash = "sha256-a2+3uNNSLfb81QXjZfftbwpgjORPRSgC056U3FINP4o=";
 
   postPatch = ''
     # Using local tailwindcss for compilation
diff --git a/pkgs/by-name/st/stu/package.nix b/pkgs/by-name/st/stu/package.nix
index cd77d9c17386..1bbc3e5d63a3 100644
--- a/pkgs/by-name/st/stu/package.nix
+++ b/pkgs/by-name/st/stu/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stu";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "stu";
     rev = "v${version}";
-    hash = "sha256-taxXk6GJ7ulPVPL4nUZwY+ln7Te54kM2xcLsRd7kpK0=";
+    hash = "sha256-2vnyRTdRr6Y8YlwBSXqcOir5xdu5msPSU3EbsB0Ya34=";
   };
 
-  cargoHash = "sha256-qc2FvlMjPp0X6EQyxNwJdpB8D1i+QzxFv9qYf/F+gXg=";
+  cargoHash = "sha256-Us4rQYq+1Akq3i31sPBIC1Df0moicnHF0J5++M8tC2U=";
 
   passthru.tests.version = testers.testVersion { package = stu; };
 
diff --git a/pkgs/by-name/su/submit50/package.nix b/pkgs/by-name/su/submit50/package.nix
index 652ab9e24f7b..6c6ddcb451bf 100644
--- a/pkgs/by-name/su/submit50/package.nix
+++ b/pkgs/by-name/su/submit50/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "submit50";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cs50";
     repo = "submit50";
     tag = "v${version}";
-    hash = "sha256-i1hO9P3FGamo4b733/U7d2fiWLdnTskrHM2BXxxDePc=";
+    hash = "sha256-D71d8f2XfLrsDRBuEZK7B96UTUkJLkHsCWchDNO8epI=";
   };
 
   build-system = [
@@ -40,7 +40,7 @@ python3Packages.buildPythonApplication rec {
     description = "Tool for submitting student CS50 code";
     homepage = "https://cs50.readthedocs.io/submit50/";
     downloadPage = "https://github.com/cs50/submit50";
-    changelog = "https://github.com/cs50/submit50/releases/tag/v${version}";
+    changelog = "https://github.com/cs50/submit50/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ethancedwards8 ];
diff --git a/pkgs/by-name/te/termius/package.nix b/pkgs/by-name/te/termius/package.nix
index 64af84f4b28c..b444503e9f94 100644
--- a/pkgs/by-name/te/termius/package.nix
+++ b/pkgs/by-name/te/termius/package.nix
@@ -16,8 +16,8 @@
 
 stdenv.mkDerivation rec {
   pname = "termius";
-  version = "9.25.1";
-  revision = "231";
+  version = "9.26.0";
+  revision = "232";
 
   src = fetchurl {
     # find the latest version with
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     # and the sha512 with
     # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
     url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-l9ShxjAzreVU3XinBDCNUQjCgXGdyDFdOMkcQgxrowhtu4KfmRioGORSnJeCCPWqIBureWSa5b572wMxCerTCQ==";
+    hash = "sha512-PBwZS1CcvGFfodM3bqM/YWDJxoF/thZvTWIIPQI1ShjVWbvJUq29J/xeaNyncgQCfowgR8xWIOVpmAjCjjyQ0A==";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/to/tokei/package.nix b/pkgs/by-name/to/tokei/package.nix
index 5be24a13671d..dc6d97745131 100644
--- a/pkgs/by-name/to/tokei/package.nix
+++ b/pkgs/by-name/to/tokei/package.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tokei";
-  version = "13.0.0-alpha.8";
+  version = "13.0.0-alpha.9";
 
   src = fetchFromGitHub {
     owner = "XAMPPRocky";
     repo = "tokei";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
+    hash = "sha256-OSIJYSUwc8SvszEOMgt+d/ljCW2jtBkPw6buof4JpUc=";
   };
 
   patches = [
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     })
   ];
 
-  cargoHash = "sha256-LzlyrKaRjUo6JnVLQnHidtI4OWa+GrhAc4D8RkL+nmQ=";
+  cargoHash = "sha256-FIT+c2YzGxJEvLB5uqkdVLWkQ/wlrbCrAkSQEoS4kJw=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
new file mode 100644
index 000000000000..bcbc6140f01b
--- /dev/null
+++ b/pkgs/by-name/um/umami/package.nix
@@ -0,0 +1,201 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchurl,
+  makeWrapper,
+  nixosTests,
+  nodejs,
+  pnpm_10,
+  prisma-engines,
+  openssl,
+  rustPlatform,
+  # build variables
+  databaseType ? "postgresql",
+  collectApiEndpoint ? "",
+  trackerScriptNames ? [ ],
+  basePath ? "",
+}:
+let
+  sources = lib.importJSON ./sources.json;
+  pnpm = pnpm_10;
+
+  geocities = stdenvNoCC.mkDerivation {
+    pname = "umami-geocities";
+    version = sources.geocities.date;
+    src = fetchurl {
+      url = "https://raw.githubusercontent.com/GitSquared/node-geolite2-redist/${sources.geocities.rev}/redist/GeoLite2-City.tar.gz";
+      inherit (sources.geocities) hash;
+    };
+
+    doBuild = false;
+
+    installPhase = ''
+      mkdir -p $out
+      cp ./GeoLite2-City.mmdb $out/GeoLite2-City.mmdb
+    '';
+
+    meta.license = lib.licenses.cc-by-40;
+  };
+
+  # Pin the specific version of prisma to the one used by upstream
+  # to guarantee compatibility.
+  prisma-engines' = prisma-engines.overrideAttrs (old: rec {
+    version = "6.7.0";
+    src = fetchFromGitHub {
+      owner = "prisma";
+      repo = "prisma-engines";
+      tag = version;
+      hash = "sha256-Ty8BqWjZluU6a5xhSAVb2VoTVY91UUj6zoVXMKeLO4o=";
+    };
+    cargoHash = "sha256-HjDoWa/JE6izUd+hmWVI1Yy3cTBlMcvD9ANsvqAoHBI=";
+
+    cargoDeps = rustPlatform.fetchCargoVendor {
+      inherit (old) pname;
+      inherit src version;
+      hash = cargoHash;
+    };
+  });
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "umami";
+  version = "2.19.0";
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    pnpm.configHook
+  ];
+
+  src = fetchFromGitHub {
+    owner = "umami-software";
+    repo = "umami";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-luiwGmCujbFGWANSCOiHIov56gsMQ6M+Bj0stcz9he8=";
+  };
+
+  # install dev dependencies as well, for rollup
+  pnpmInstallFlags = [ "--prod=false" ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      pnpmInstallFlags
+      version
+      src
+      ;
+    fetcherVersion = 2;
+    hash = "sha256-2GiCeCt/mU5Dm5YHQgJF3127WPHq5QLX8JRcUv6B6lE=";
+  };
+
+  env.CYPRESS_INSTALL_BINARY = "0";
+  env.NODE_ENV = "production";
+  env.NEXT_TELEMETRY_DISABLED = "1";
+
+  # copy-db-files uses this variable to decide which Prisma schema to use
+  env.DATABASE_TYPE = databaseType;
+
+  env.COLLECT_API_ENDPOINT = collectApiEndpoint;
+  env.TRACKER_SCRIPT_NAME = lib.concatStringsSep "," trackerScriptNames;
+  env.BASE_PATH = basePath;
+
+  # Allow prisma-cli to find prisma-engines without having to download them
+  env.PRISMA_QUERY_ENGINE_LIBRARY = "${prisma-engines'}/lib/libquery_engine.node";
+  env.PRISMA_SCHEMA_ENGINE_BINARY = "${prisma-engines'}/bin/schema-engine";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm copy-db-files
+    pnpm build-db-client # prisma generate
+
+    pnpm build-tracker
+    pnpm build-app
+
+    runHook postBuild
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    pnpm test
+
+    runHook postCheck
+  '';
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mv .next/standalone $out
+    mv .next/static $out/.next/static
+
+    # Include prisma cli in next standalone build.
+    # This is preferred to using the prisma in nixpkgs because it guarantees
+    # the version matches.
+    # See https://nextjs-forum.com/post/1280550687998083198
+    # and https://nextjs.org/docs/pages/api-reference/config/next-config-js/output#caveats
+    # Unfortunately, using outputFileTracingIncludes doesn't work because of pnpm's symlink structure,
+    # so we just copy the files manually.
+    mkdir -p $out/node_modules/.bin
+    cp node_modules/.bin/prisma $out/node_modules/.bin
+    cp -a node_modules/prisma $out/node_modules
+    cp -a node_modules/.pnpm/@prisma* $out/node_modules/.pnpm
+    cp -a node_modules/.pnpm/prisma* $out/node_modules/.pnpm
+    # remove broken symlinks (some dependencies that are not relevant for running migrations)
+    find "$out"/node_modules/.pnpm/@prisma* -xtype l -exec rm {} \;
+    find "$out"/node_modules/.pnpm/prisma* -xtype l -exec rm {} \;
+
+    cp -R public $out/public
+    cp -R prisma $out/prisma
+
+    ln -s ${geocities} $out/geo
+
+    mkdir -p $out/bin
+    # Run database migrations before starting umami.
+    # Add openssl to PATH since it is required for prisma to make SSL connections.
+    # Force working directory to $out because umami assumes many paths are relative to it (e.g., prisma and geolite).
+    makeWrapper ${nodejs}/bin/node $out/bin/umami-server  \
+      --set NODE_ENV production \
+      --set NEXT_TELEMETRY_DISABLED 1 \
+      --set PRISMA_QUERY_ENGINE_LIBRARY "${prisma-engines'}/lib/libquery_engine.node" \
+      --set PRISMA_SCHEMA_ENGINE_BINARY "${prisma-engines'}/bin/schema-engine" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          openssl
+          nodejs
+        ]
+      } \
+      --chdir $out \
+      --run "$out/node_modules/.bin/prisma migrate deploy" \
+      --add-flags "$out/server.js"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) umami;
+    };
+    inherit
+      sources
+      geocities
+      ;
+    prisma-engines = prisma-engines';
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    changelog = "https://github.com/umami-software/umami/releases/tag/v${finalAttrs.version}";
+    description = "Simple, easy to use, self-hosted web analytics solution";
+    homepage = "https://umami.is/";
+    license = with lib.licenses; [
+      mit
+      cc-by-40 # geocities
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "umami-server";
+    maintainers = with maintainers; [ diogotcorreia ];
+  };
+})
diff --git a/pkgs/by-name/um/umami/sources.json b/pkgs/by-name/um/umami/sources.json
new file mode 100644
index 000000000000..6406373132a5
--- /dev/null
+++ b/pkgs/by-name/um/umami/sources.json
@@ -0,0 +1,7 @@
+{
+  "geocities": {
+    "rev": "0817bc800279e26e9ff045b7b129385e5b23012e",
+    "date": "2025-07-29",
+    "hash": "sha256-Rw9UEvUu7rtXFvHEqKza6kn9LwT6C17zJ/ljoN+t6Ek="
+  }
+}
diff --git a/pkgs/by-name/um/umami/update.sh b/pkgs/by-name/um/umami/update.sh
new file mode 100755
index 000000000000..adfec921a26f
--- /dev/null
+++ b/pkgs/by-name/um/umami/update.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq prefetch-yarn-deps nix-prefetch-github coreutils nix-update
+# shellcheck shell=bash
+
+# This script exists to update geocities version and pin prisma-engines version
+
+set -euo pipefail
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+
+old_version=$(nix-instantiate --eval -A 'umami.version' default.nix | tr -d '"' || echo "0.0.1")
+version=$(curl -s "https://api.github.com/repos/umami-software/umami/releases/latest" | jq -r ".tag_name")
+version="${version#v}"
+
+echo "Updating to $version"
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+nix-update --version "$version" umami
+
+echo "Fetching geolite"
+geocities_rev_date=$(curl https://api.github.com/repos/GitSquared/node-geolite2-redist/branches/master | jq -r ".commit.sha, .commit.commit.author.date")
+geocities_rev=$(echo "$geocities_rev_date" | head -1)
+geocities_date=$(echo "$geocities_rev_date" | tail -1 | sed 's/T.*//')
+
+# upstream is kind enough to provide a file with the hash of the tar.gz archive
+geocities_hash=$(curl -s "https://raw.githubusercontent.com/GitSquared/node-geolite2-redist/$geocities_rev/redist/GeoLite2-City.tar.gz.sha256")
+geocities_hash_sri=$(nix-hash --to-sri --type sha256 "$geocities_hash")
+
+cat <<EOF > "$SCRIPT_DIR/sources.json"
+{
+  "geocities": {
+    "rev": "$geocities_rev",
+    "date": "$geocities_date",
+    "hash": "$geocities_hash_sri"
+  }
+}
+EOF
+
+echo "Pinning Prisma version"
+upstream_src="https://raw.githubusercontent.com/umami-software/umami/v$version"
+
+lock=$(mktemp)
+curl -s -o "$lock" "$upstream_src/pnpm-lock.yaml"
+prisma_version=$(grep "@prisma/engines@" "$lock" | head -n1 |  awk -F"[@']" '{print $4}')
+rm "$lock"
+
+nix-update --version "$prisma_version" umami.prisma-engines
diff --git a/pkgs/by-name/wo/wofi-power-menu/package.nix b/pkgs/by-name/wo/wofi-power-menu/package.nix
index b57e0b7aaf98..da3c7ba5791c 100644
--- a/pkgs/by-name/wo/wofi-power-menu/package.nix
+++ b/pkgs/by-name/wo/wofi-power-menu/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wofi-power-menu";
-  version = "0.2.9";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "szaffarano";
     repo = "wofi-power-menu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xio/Gt37PJ/0Di22na4USmfah2GV+xM2eV4NnGBeVfY=";
+    hash = "sha256-/MoMgOrpM0KHIyxqOJmC5N5NddOVVfTs5fDt1/yiBtQ=";
   };
 
-  cargoHash = "sha256-diDLKP7JGzrXgdZMwSmg70dbFlMLLWp4Ad/ejjiOSlc=";
+  cargoHash = "sha256-PWPMBYmB1lyCJFhodNSCicYJy29vEUx6k9ScQTPbZdg=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 9b09dddad71b..5b6db40575c3 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -461,10 +461,5 @@ stdenv.mkDerivation (finalAttrs: {
     # If rustc can't target a platform, we also can't build rustc for
     # that platform.
     badPlatforms = rustc.badTargetPlatforms;
-    # Builds, but can't actually compile anything
-    # https://github.com/NixOS/nixpkgs/issues/311930
-    # https://github.com/rust-lang/rust/issues/55120
-    # https://github.com/rust-lang/rust/issues/82521
-    broken = stdenv.hostPlatform.useLLVM;
   };
 })
diff --git a/pkgs/development/libraries/qtpbfimageplugin/default.nix b/pkgs/development/libraries/qtpbfimageplugin/default.nix
index c19e971db598..f79ea2200196 100644
--- a/pkgs/development/libraries/qtpbfimageplugin/default.nix
+++ b/pkgs/development/libraries/qtpbfimageplugin/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtpbfimageplugin";
-  version = "4.2";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "QtPBFImagePlugin";
     tag = version;
-    hash = "sha256-yk/DsLjNLqtmhvPcHDZGsNiAI1zBv1vBtgERvtNjF4I=";
+    hash = "sha256-WcqhYDfirMfNtUJBvhZ1559NnJun9OuhhVg6o8IcVGQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index c7513cadeaf2..f937004b80da 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "6.1.0";
+  version = "6.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-u4qCQYCpMfM/JCyyKOfTTN7vwh3EvlGnxuslUy/d9Bs=";
+    hash = "sha256-kUIgZJdX+IdMEkIK0DoKYOiv9GSaI+RhOeg9+zK4yvc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pystac-client/default.nix b/pkgs/development/python-modules/pystac-client/default.nix
index 828021182f6f..c24e2ffcf2d6 100644
--- a/pkgs/development/python-modules/pystac-client/default.nix
+++ b/pkgs/development/python-modules/pystac-client/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pystac-client";
-  version = "0.8.6";
+  version = "0.9.0";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "stac-utils";
     repo = "pystac-client";
     tag = "v${version}";
-    hash = "sha256-rbRxqR6hZy284JfQu5+dukFTBHllqzjo0k9aWhrkRAU=";
+    hash = "sha256-+DOWf1ZAwylicdSuOBNivi0Z7DxaymZF756X7fogAjc=";
   };
 
   build-system = [ setuptools ];
@@ -55,6 +55,12 @@ buildPythonPackage rec {
     "vcr"
   ];
 
+  # requires cql2
+  disabledTests = [
+    "test_filter_conversion_to_cql2_json"
+    "test_filter_conversion_to_cql2_text"
+  ];
+
   pythonImportsCheck = [ "pystac_client" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index a05d3f4b73af..3653b537faa5 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.2.6";
+  version = "6.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "softlayer";
     repo = "softlayer-python";
     tag = "v${version}";
-    hash = "sha256-qBhnHFFlP4pqlN/SETXEqYyre/ap60wHe9eCfyiB+kA=";
+    hash = "sha256-mlC4o39Ol1ALguc9KGpxB0M0vhWz4LG2uwhW8CBrVgg=";
   };
 
   build-system = [
@@ -85,7 +85,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python libraries that assist in calling the SoftLayer API";
     homepage = "https://github.com/softlayer/softlayer-python";
-    changelog = "https://github.com/softlayer/softlayer-python/releases/tag/v${version}";
+    changelog = "https://github.com/softlayer/softlayer-python/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ onny ];
   };
diff --git a/pkgs/development/tools/misc/gdbgui/default.nix b/pkgs/development/tools/misc/gdbgui/default.nix
index c988bad2c7f8..ac4450076f54 100644
--- a/pkgs/development/tools/misc/gdbgui/default.nix
+++ b/pkgs/development/tools/misc/gdbgui/default.nix
@@ -13,7 +13,7 @@
 buildPythonApplication rec {
   pname = "gdbgui";
 
-  version = "0.15.2.0";
+  version = "0.15.3.0";
   format = "setuptools";
 
   buildInputs = [ gdb ];
@@ -27,7 +27,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vmMlRmjFqhs3Vf+IU9IDtJzt4dZ0yIOmXIVOx5chZPA=";
+    hash = "sha256-/HyFE0JnoN03CDyCQCo/Y9RyH4YOMoeB7khReIb8t7Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/update-xanmod.sh b/pkgs/os-specific/linux/kernel/update-xanmod.sh
new file mode 100755
index 000000000000..fd786872fd3c
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update-xanmod.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-prefetch curl jq gawk gnused nixfmt-rfc-style
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+FILE_PATH="$SCRIPT_DIR/xanmod-kernels.nix"
+
+get_old_version() {
+    local file_path="$1"
+    local variant="$2"
+
+    grep -A 2 "$variant = {" "$file_path" | grep "version =" | cut -d '"' -f 2
+}
+
+VARIANT="${1:-lts}"
+OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$(get_old_version "$FILE_PATH" "$VARIANT")}
+
+RELEASES=$(curl --silent https://gitlab.com/api/v4/projects/xanmod%2Flinux/releases)
+
+# list of URLs. latest first, oldest last
+RELEASE_URLS=$(echo "$RELEASES" | jq '.[].assets.links.[0].name')
+
+while IFS= read -r url; do
+    # Get variant, version and suffix from url fields:
+    #                 8         9       NF
+    #                 |         |       |
+    # https://.../<variant>/<version>-<suffix>
+    release_variant=$(echo "$url" | awk -F'[/-]' '{print $8}')
+    release_version=$(echo "$url" | awk -F'[/-]' '{print $9}')
+
+    # either xanmod1 or xanmod2
+    suffix=$(echo "$url" | awk -F'[/-]' '{print $NF}')
+
+    if [[ "$release_variant" == "$VARIANT" ]]; then
+        if [[ "$release_version" == "$OLD_VERSION" ]]; then
+            echo "Xanmod $VARIANT is up-to-date: ${OLD_VERSION}"
+            exit 0
+        else
+            NEW_VERSION="$release_version"
+            SUFFIX="$suffix"
+            break
+        fi
+    fi
+done < <(echo "$RELEASE_URLS" | jq -r)
+
+echo "Updating Xanmod \"$VARIANT\" from $OLD_VERSION to $NEW_VERSION ($SUFFIX)"
+
+URL="https://gitlab.com/api/v4/projects/xanmod%2Flinux/repository/archive.tar.gz?sha=$NEW_VERSION-$SUFFIX"
+HASH="$(nix-prefetch fetchzip --quiet --url "$URL")"
+
+update_variant() {
+    local file_path="$1"
+    local variant="$2"
+    local new_version="$3"
+    local new_hash="$4"
+    local suffix="$5"
+
+    # ${variant} = {      <- range start
+    #   version = ...
+    #   hash = ...
+    #   suffix = ...
+    # };                  <- range end
+    range_start="^\s*$variant = {"
+    range_end="^\s*};"
+
+    # - Update the version and hash using sed range addresses
+    # - Remove suffix line, if it exists
+    sed -i -e "/$range_start/,/$range_end/ {
+        s|^\s*version = \".*\";|      version = \"$new_version\";|;
+        s|^\s*hash = \".*\";|      hash = \"$new_hash\";|;
+         /^\s*suffix = /d
+    }" "$file_path"
+
+    # Add suffix, if it's different than xanmod1 (the default)
+    if [[ "$suffix" != "xanmod1" ]]; then
+        sed -i -e "/$range_start/,/$range_end/ {
+            s|$range_end|      suffix = \"$suffix\";\n    };|;
+        }" "$file_path"
+    fi
+
+    # Apply proper formatting
+    nixfmt "$file_path"
+}
+
+update_variant "$FILE_PATH" "$VARIANT" "$NEW_VERSION" "$HASH" "$SUFFIX"
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 065eceed4008..5b68f009e3d8 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -13,10 +13,12 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   variants = {
+    # ./update-xanmod.sh lts
     lts = {
       version = "6.12.40";
       hash = "sha256-L8wL47kD+lrnJsrp0B1MZ2Lg8zs+m1vQ24gPGuvxIA0=";
     };
+    # ./update-xanmod.sh main
     main = {
       version = "6.15.8";
       hash = "sha256-P4DpTS0RhvsgBrNDsZMiA1NvCQucuPmJ4GDyF9mZ7ZU=";
@@ -70,6 +72,11 @@ let
           RCU_EXP_KTHREAD = yes;
         };
 
+        extraPassthru.updateScript = [
+          ./update-xanmod.sh
+          variant
+        ];
+
         extraMeta = {
           branch = lib.versions.majorMinor version;
           maintainers = with lib.maintainers; [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b495db757c3a..5062eb74a5fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4079,9 +4079,6 @@ with pkgs;
 
   pfstools = libsForQt5.callPackage ../tools/graphics/pfstools { };
 
-  piper-train = callPackage ../tools/audio/piper/train.nix { };
-  piper-tts = callPackage ../tools/audio/piper { };
-
   phosh = callPackage ../applications/window-managers/phosh { };
 
   phosh-mobile-settings =
@@ -12806,8 +12803,6 @@ with pkgs;
 
   kubeval-schema = callPackage ../applications/networking/cluster/kubeval/schema.nix { };
 
-  kubernetes = callPackage ../applications/networking/cluster/kubernetes { };
-  kubectl = callPackage ../applications/networking/cluster/kubernetes/kubectl.nix { };
   kubectl-convert = kubectl.convert;
 
   kubectl-view-allocations =