diff --git a/ci/default.nix b/ci/default.nix
index 42eeadc67def..68fce29901a0 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -49,7 +49,7 @@ let
 
         programs.keep-sorted.enable = true;
 
-        # This uses nixfmt-rfc-style underneath,
+        # This uses nixfmt underneath,
         # the default formatter for Nix code.
         # See https://github.com/NixOS/nixfmt
         programs.nixfmt.enable = true;
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 3871e9ad9a57..181621077a77 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -8,6 +8,7 @@
   this release sets the default march level to `la64v1.0`, covering the desktop and server processors of 3X5000
   and newer series. However, embedded chips without LSX (Loongson SIMD eXtension), such as 2K0300 SoC, are not
   supported. `pkgsCross.loongarch64-linux-embedded` can be used to build software and systems for these platforms.
+- The official Nix formatter `nixfmt` is now stable and available as `pkgs.nixfmt`, deprecating the temporary `pkgs.nixfmt-rfc-style` attribute. The classic `nixfmt` will stay available for some more time as `pkgs.nixfmt-classic`.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
 
diff --git a/doc/stdenv/passthru.chapter.md b/doc/stdenv/passthru.chapter.md
index db40d4bbe054..5306e4f158be 100644
--- a/doc/stdenv/passthru.chapter.md
+++ b/doc/stdenv/passthru.chapter.md
@@ -53,7 +53,7 @@ They fall in one of these categories:
 
   These tend to entail support from the derivation or the `passthru` attribute in question.
   Common examples of this type are `passthru.optional-dependencies`, `passthru.withPlugins`, and `passthru.withPackages`.
-  All of those allow associating the package with a set of components built for that specific package, such as when building Python runtime environments using (`python.withPackages`)[#python.withpackages-function].
+  All of those allow associating the package with a set of components built for that specific package, such as when building Python runtime environments using [`python.withPackages`](#python.withpackages-function).
 
 Attributes that apply only to particular [build helpers](#part-builders) or [language ecosystems](#chap-language-support) are documented there.
 
diff --git a/maintainers/scripts/auto-rebase/test/default.nix b/maintainers/scripts/auto-rebase/test/default.nix
index fd6ce30d24ac..d57a3dabde60 100644
--- a/maintainers/scripts/auto-rebase/test/default.nix
+++ b/maintainers/scripts/auto-rebase/test/default.nix
@@ -9,7 +9,7 @@ let
     stdenvNoCC
     gitMinimal
     treefmt
-    nixfmt-rfc-style
+    nixfmt
     ;
 in
 
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation {
   nativeBuildInputs = [
     gitMinimal
     treefmt
-    nixfmt-rfc-style
+    nixfmt
   ];
   patchPhase = ''
     patchShebangs .
diff --git a/maintainers/scripts/haskell/regenerate-hackage-packages.sh b/maintainers/scripts/haskell/regenerate-hackage-packages.sh
index 3b7c0a8297e1..58bb433f010e 100755
--- a/maintainers/scripts/haskell/regenerate-hackage-packages.sh
+++ b/maintainers/scripts/haskell/regenerate-hackage-packages.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nixfmt-rfc-style -I nixpkgs=.
+#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git -I nixpkgs=.
 
 set -euo pipefail
 
diff --git a/maintainers/scripts/haskell/update-cabal2nix-unstable.sh b/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
index 21c3686ad296..866e7d2a6639 100755
--- a/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
+++ b/maintainers/scripts/haskell/update-cabal2nix-unstable.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable nixfmt-rfc-style -I nixpkgs=.
+#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable -I nixpkgs=.
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.
diff --git a/maintainers/scripts/update.py b/maintainers/scripts/update.py
index 576332b76607..10d197d5fe78 100644
--- a/maintainers/scripts/update.py
+++ b/maintainers/scripts/update.py
@@ -7,6 +7,7 @@ import contextlib
 import json
 import os
 import re
+import shlex
 import subprocess
 import sys
 import tempfile
@@ -235,7 +236,11 @@ async def run_update_script(
             f"UPDATE_NIX_PNAME={package['pname']}",
             f"UPDATE_NIX_OLD_VERSION={package['oldVersion']}",
             f"UPDATE_NIX_ATTR_PATH={package['attrPath']}",
-            *update_script_command,
+            # Run all update scripts in the Nixpkgs development shell to get access to formatters and co.
+            "nix-shell",
+            nixpkgs_root + "/shell.nix",
+            "--run",
+            " ".join([ shlex.quote(s) for s in update_script_command ]),
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             cwd=worktree,
diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index 6dc84e6f7b67..f69ea279abb5 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -340,3 +340,54 @@ id-prefix: test-opt-
 list-id: test-options-list
 source: @NIXOS_TEST_OPTIONS_JSON@
 ```
+
+## Accessing VMs in the sandbox with SSH {#sec-test-sandbox-breakpoint}
+
+As explained in [](#sec-nixos-test-ssh-access), it's possible to configure an
+SSH backdoor based on AF_VSOCK. This can be used to SSH into a VM of a running
+build in a sandbox.
+
+This can be done when something in the test fails, e.g.
+
+```nix
+{
+  nodes.machine = {};
+
+  sshBackdoor.enable = true;
+  enableDebugHook = true;
+
+  testScript = ''
+    start_all()
+    machine.succeed("false") # this will fail
+  '';
+}
+```
+
+For the AF_VSOCK feature to work, `/dev/vhost-vsock` is needed in the sandbox
+which can be done with e.g.
+
+```
+nix-build -A nixosTests.foo --option sandbox-paths /dev/vhost-vsock
+```
+
+This will halt the test execution on a test-failure and print instructions
+on how to enter the sandbox shell of the VM test. Inside, one can log into
+e.g. `machine` with
+
+```
+ssh -F ./ssh_config vsock/3
+```
+
+As described in [](#sec-nixos-test-ssh-access), the numbers for vsock start at
+`3` instead of `1`. So the first VM in the network (sorted alphabetically) can
+be accessed with `vsock/3`.
+
+Alternatively, it's possible to explicitly set a breakpoint with
+`debug.breakpoint()`. This also has the benefit, that one can step through
+`testScript` with `pdb` like this:
+
+```
+$ sudo /nix/store/eeeee-attach <id>
+bash# telnet 127.0.0.1 4444
+pdb$ …
+```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index e7c195379cc7..e08b4d31c36c 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1902,6 +1902,9 @@
   "test-opt-sshBackdoor.vsockOffset": [
     "index.html#test-opt-sshBackdoor.vsockOffset"
   ],
+  "test-opt-enableDebugHook": [
+    "index.html#test-opt-enableDebugHook"
+  ],
   "test-opt-defaults": [
     "index.html#test-opt-defaults"
   ],
@@ -2010,6 +2013,9 @@
   "sec-nixos-test-testing-hardware-features": [
     "index.html#sec-nixos-test-testing-hardware-features"
   ],
+  "sec-test-sandbox-breakpoint": [
+    "index.html#sec-test-sandbox-breakpoint"
+  ],
   "chap-developing-the-test-driver": [
     "index.html#chap-developing-the-test-driver"
   ],
diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 91db5d8be3c2..bb07bba363a1 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -14,6 +14,7 @@
   extraPythonPackages ? (_: [ ]),
   nixosTests,
 }:
+
 python3Packages.buildPythonApplication {
   pname = "nixos-test-driver";
   version = "1.1";
@@ -32,6 +33,7 @@ python3Packages.buildPythonApplication {
       junit-xml
       ptpython
       ipython
+      remote-pdb
     ]
     ++ extraPythonPackages python3Packages;
 
diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
index 86e663da9b7d..823a948bc41b 100755
--- a/nixos/lib/test-driver/src/test_driver/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/__init__.py
@@ -5,6 +5,7 @@ from pathlib import Path
 
 import ptpython.ipython
 
+from test_driver.debug import Debug, DebugAbstract, DebugNop
 from test_driver.driver import Driver
 from test_driver.logger import (
     CompositeLogger,
@@ -65,6 +66,10 @@ def main() -> None:
         help="drop into a python repl and run the tests interactively",
         action=argparse.BooleanOptionalAction,
     )
+    arg_parser.add_argument(
+        "--debug-hook-attach",
+        help="Enable interactive debugging breakpoints for sandboxed runs",
+    )
     arg_parser.add_argument(
         "--start-scripts",
         metavar="START-SCRIPT",
@@ -129,6 +134,10 @@ def main() -> None:
     if not args.keep_vm_state:
         logger.info("Machine state will be reset. To keep it, pass --keep-vm-state")
 
+    debugger: DebugAbstract = DebugNop()
+    if args.debug_hook_attach is not None:
+        debugger = Debug(logger, args.debug_hook_attach)
+
     with Driver(
         args.start_scripts,
         args.vlans,
@@ -137,6 +146,7 @@ def main() -> None:
         logger,
         args.keep_vm_state,
         args.global_timeout,
+        debug=debugger,
     ) as driver:
         if args.interactive:
             history_dir = os.getcwd()
diff --git a/nixos/lib/test-driver/src/test_driver/debug.py b/nixos/lib/test-driver/src/test_driver/debug.py
new file mode 100644
index 000000000000..7f783fe96de8
--- /dev/null
+++ b/nixos/lib/test-driver/src/test_driver/debug.py
@@ -0,0 +1,53 @@
+import logging
+import os
+import random
+import shutil
+import subprocess
+import sys
+from abc import ABC, abstractmethod
+
+from remote_pdb import RemotePdb  # type:ignore
+
+from test_driver.logger import AbstractLogger
+
+
+class DebugAbstract(ABC):
+    @abstractmethod
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        pass
+
+
+class DebugNop(DebugAbstract):
+    def __init__(self) -> None:
+        pass
+
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        pass
+
+
+class Debug(DebugAbstract):
+    def __init__(self, logger: AbstractLogger, attach_command: str) -> None:
+        self.breakpoint_on_failure = False
+        self.logger = logger
+        self.attach = attach_command
+
+    def breakpoint(self, host: str = "127.0.0.1", port: int = 4444) -> None:
+        """
+        Call this function to stop execution and put the process on sleep while
+        at the same time have the test driver provide a debug shell on TCP port
+        `port`. This is meant to be used for sandboxed tests that have the test
+        driver feature `enableDebugHook` enabled.
+        """
+        pattern = str(random.randrange(999999, 9999999))
+        self.logger.log_test_error(
+            f"Breakpoint reached, run 'sudo {self.attach} {pattern}'"
+        )
+        os.environ["bashInteractive"] = shutil.which("bash")  # type:ignore
+        if os.fork() == 0:
+            subprocess.run(["sleep", pattern])
+        else:
+            # RemotePdb writes log messages to both stderr AND the logger,
+            # which is the same here. Hence, disabling the remote_pdb logger
+            # to avoid duplicate messages in the build log.
+            logging.root.manager.loggerDict["remote_pdb"].disabled = True  # type:ignore
+            RemotePdb(host=host, port=port).set_trace(sys._getframe().f_back)
diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index 57b434f09e29..361bb1c2a93d 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -13,6 +13,7 @@ from unittest import TestCase
 
 from colorama import Style
 
+from test_driver.debug import DebugAbstract, DebugNop
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine import Machine, NixStartScript, retry
@@ -67,6 +68,7 @@ class Driver:
     global_timeout: int
     race_timer: threading.Timer
     logger: AbstractLogger
+    debug: DebugAbstract
 
     def __init__(
         self,
@@ -77,12 +79,14 @@ class Driver:
         logger: AbstractLogger,
         keep_vm_state: bool = False,
         global_timeout: int = 24 * 60 * 60 * 7,
+        debug: DebugAbstract = DebugNop(),
     ):
         self.tests = tests
         self.out_dir = out_dir
         self.global_timeout = global_timeout
         self.race_timer = threading.Timer(global_timeout, self.terminate_test)
         self.logger = logger
+        self.debug = debug
 
         tmp_dir = get_tmp_dir()
 
@@ -159,6 +163,7 @@ class Driver:
             polling_condition=self.polling_condition,
             Machine=Machine,  # for typing
             t=AssertionTester(),
+            debug=self.debug,
         )
         machine_symbols = {pythonize_name(m.name): m for m in self.machines}
         # If there's exactly one machine, make it available under the name
@@ -224,8 +229,14 @@ class Driver:
                 for line in f"{exc_prefix}: {exc}".splitlines():
                     self.logger.log_test_error(line)
 
+                self.debug.breakpoint()
+
                 sys.exit(1)
 
+            except Exception:
+                self.debug.breakpoint()
+                raise
+
     def run_tests(self) -> None:
         """Run the test script (for non-interactive test runs)"""
         self.logger.info(
diff --git a/nixos/lib/test-script-prepend.py b/nixos/lib/test-script-prepend.py
index 31dad14ef8dd..067fd20fe7c5 100644
--- a/nixos/lib/test-script-prepend.py
+++ b/nixos/lib/test-script-prepend.py
@@ -1,6 +1,7 @@
 # This file contains type hints that can be prepended to Nix test scripts so they can be type
 # checked.
 
+from test_driver.debug import DebugAbstract
 from test_driver.driver import Driver
 from test_driver.vlan import VLan
 from test_driver.machine import Machine
@@ -52,4 +53,5 @@ join_all: Callable[[], None]
 serial_stdout_off: Callable[[], None]
 serial_stdout_on: Callable[[], None]
 polling_condition: PollingConditionProtocol
+debug: DebugAbstract
 t: TestCase
diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index 15bcc464f481..1f562a5f4f26 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -84,7 +84,8 @@ in
   options = {
     sshBackdoor = {
       enable = mkOption {
-        default = false;
+        default = config.enableDebugHook;
+        defaultText = lib.literalExpression "config.enableDebugHook";
         type = types.bool;
         description = "Whether to turn on the VSOCK-based access to all VMs. This provides an unauthenticated access intended for debugging.";
       };
diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index 45ab311cfbc4..ab1dc7733d5f 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -7,6 +7,7 @@
 }:
 let
   inherit (lib) types mkOption;
+  inherit (hostPkgs.stdenv.hostPlatform) isDarwin isLinux;
 
   # TODO (lib): Also use lib equivalent in nodes.nix
   /**
@@ -26,7 +27,6 @@ let
     */
     f:
     lib.mkOverride (opt.highestPrio - 1) (f opt.value);
-
 in
 {
   options = {
@@ -42,6 +42,15 @@ in
       '';
     };
 
+    enableDebugHook = lib.mkEnableOption "" // {
+      description = ''
+        Halt test execution after any test fail and provide the possibility to
+        hook into the sandbox to connect with either the test driver via
+        `telnet localhost 4444` or with the VMs via SSH and vsocks (see also
+        `sshBackdoor.enable`).
+      '';
+    };
+
     rawTestDerivation = mkOption {
       type = types.package;
       description = ''
@@ -74,15 +83,23 @@ in
     rawTestDerivation = hostPkgs.stdenv.mkDerivation config.rawTestDerivationArg;
     rawTestDerivationArg =
       finalAttrs:
-      assert lib.assertMsg (!config.sshBackdoor.enable)
-        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
+      assert lib.assertMsg (
+        config.sshBackdoor.enable -> isLinux
+      ) "The SSH backdoor is not supported for macOS host systems!";
+
+      assert lib.assertMsg (
+        config.enableDebugHook -> isLinux
+      ) "The debugging hook is not supported for macOS host systems!";
       {
         name = "vm-test-run-${config.name}";
 
         requiredSystemFeatures =
-          [ "nixos-test" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+          [ "nixos-test" ] ++ lib.optional isLinux "kvm" ++ lib.optional isDarwin "apple-virt";
+
+        nativeBuildInputs = lib.optionals config.enableDebugHook [
+          hostPkgs.openssh
+          hostPkgs.inetutils
+        ];
 
         buildCommand = ''
           mkdir -p $out
@@ -90,7 +107,15 @@ in
           # effectively mute the XMLLogger
           export LOGFILE=/dev/null
 
-          ${config.driver}/bin/nixos-test-driver -o $out
+          ${lib.optionalString config.enableDebugHook ''
+            ln -sf \
+              ${hostPkgs.systemd}/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf \
+              ssh_config
+          ''}
+
+          ${config.driver}/bin/nixos-test-driver \
+            -o $out \
+            ${lib.optionalString config.enableDebugHook "--debug-hook=${hostPkgs.breakpointHook.attach}"}
         '';
 
         passthru = config.passthru;
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
index 69b1c52a533e..33a47013bab4 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
@@ -39,7 +39,7 @@ writeScriptBin "nvidia-cdi-generator" ''
       --device-name-strategy ${device-name-strategy} \
       --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
       --library-search-path ${lib.getLib nvidia-driver}/lib \
-      --nvidia-cdi-hook-path ${lib.getExe' nvidia-container-toolkit.tools "nvidia-cdi-hook"} \
+      --nvidia-cdi-hook-path ${lib.getOutput "tools" nvidia-container-toolkit}/bin/nvidia-cdi-hook \
       ${lib.escapeShellArgs extraArgs}
   }
 
diff --git a/nixos/modules/services/web-apps/ocis.md b/nixos/modules/services/web-apps/ocis.md
index 9a21ca25f14a..43ddd3175c7d 100644
--- a/nixos/modules/services/web-apps/ocis.md
+++ b/nixos/modules/services/web-apps/ocis.md
@@ -104,7 +104,7 @@ values, and
 [`services.ocis.environmentFile`][mod-envFile] for
 sensitive values.
 
-Configuration in (`services.ocis.environment`)[mod-env] overrides those from
+Configuration in [`services.ocis.environment`][mod-env] overrides those from
 [`services.ocis.environmentFile`][mod-envFile] and will have highest
 precedence
 
diff --git a/nixos/modules/system/boot/systemd/repart.nix b/nixos/modules/system/boot/systemd/repart.nix
index b7ca00cf6a03..1240ee3244d1 100644
--- a/nixos/modules/system/boot/systemd/repart.nix
+++ b/nixos/modules/system/boot/systemd/repart.nix
@@ -85,6 +85,16 @@ in
         '';
         default = true;
       };
+
+      extraArgs = lib.mkOption {
+        description = ''
+          Extra command-line arguments to pass to systemd-repart.
+
+          See {manpage}`systemd-repart(8)` for all available options.
+        '';
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
     };
 
     systemd.repart = {
@@ -177,6 +187,7 @@ in
                                   --dry-run=no \
                                   --empty=${initrdCfg.empty} \
                                   --discard=${lib.boolToString initrdCfg.discard} \
+                                  ${utils.escapeSystemdExecArgs initrdCfg.extraArgs} \
                                   ${lib.optionalString (initrdCfg.device != null) initrdCfg.device}
               ''
             ];
diff --git a/nixos/tests/nvidia-container-toolkit.nix b/nixos/tests/nvidia-container-toolkit.nix
index 1b894a1cddd9..a0be2983747f 100644
--- a/nixos/tests/nvidia-container-toolkit.nix
+++ b/nixos/tests/nvidia-container-toolkit.nix
@@ -85,6 +85,7 @@ let
       '';
       meta.mainProgram = "nvidia-ctk";
     };
+    suppressNvidiaDriverAssertion = true;
   };
 in
 {
@@ -100,7 +101,10 @@ in
     {
       environment.systemPackages = with pkgs; [ jq ];
       virtualisation.diskSize = lib.mkDefault 10240;
-      virtualisation.containers.enable = lib.mkDefault true;
+      virtualisation.containers = {
+        containersConf.settings.engine.cdi_spec_dirs = [ "/var/run/cdi" ];
+        enable = lib.mkDefault true;
+      };
       hardware = {
         inherit nvidia-container-toolkit;
         nvidia = {
@@ -113,8 +117,8 @@ in
   nodes = {
     no-gpus = {
       virtualisation.containers.enable = false;
-      hardware.graphics.enable = false;
     };
+
     one-gpu =
       { pkgs, ... }:
       {
@@ -142,7 +146,7 @@ in
       one_gpu.wait_for_unit("nvidia-container-toolkit-cdi-generator.service")
       one_gpu.succeed("cat /var/run/cdi/nvidia-container-toolkit.json | jq")
       one_gpu.succeed("podman load < ${testContainerImage}")
-      print(one_gpu.succeed("podman run --pull=never --device=nvidia.com/gpu=all -v /run/opengl-driver:/run/opengl-driver:ro cdi-test:latest"))
+      one_gpu.succeed("podman run --pull=never --device=nvidia.com/gpu=all -v /run/opengl-driver:/run/opengl-driver:ro cdi-test:latest")
 
     # Issue: https://github.com/NixOS/nixpkgs/issues/319201
     with subtest("The generated CDI spec skips specified non-existant paths in the host"):
diff --git a/nixos/tests/qownnotes.nix b/nixos/tests/qownnotes.nix
index 3c5de65e5cfc..aafdd080be70 100644
--- a/nixos/tests/qownnotes.nix
+++ b/nixos/tests/qownnotes.nix
@@ -54,7 +54,9 @@
           machine.send_key("ret")
           machine.wait_for_text("Nextcloud")
           machine.send_key("ret")
-          machine.wait_for_text("App metric")
+
+          # OCR can't detect "App metric" anymore, so we will wait for another text
+          machine.wait_for_text("Open network settings")
           machine.send_key("ret")
 
           # Doesn't work for non-root
diff --git a/nixos/tests/systemd-repart.nix b/nixos/tests/systemd-repart.nix
index ab81ec0f370a..96a33633dc46 100644
--- a/nixos/tests/systemd-repart.nix
+++ b/nixos/tests/systemd-repart.nix
@@ -9,30 +9,37 @@ with pkgs.lib;
 
 let
   # A testScript fragment that prepares a disk with some empty, unpartitioned
-  # space. and uses it to boot the test with. Takes a single argument `machine`
-  # from which the diskImage is extracted.
-  useDiskImage = machine: ''
-    import os
-    import shutil
-    import subprocess
-    import tempfile
+  # space. and uses it to boot the test with.
+  # Takes two arguments, `machine` from which the diskImage is extracted,
+  # as well an optional `sizeDiff` (defaulting to +32M), describing how should
+  # be resized.
+  useDiskImage =
+    {
+      machine,
+      sizeDiff ? "+32M",
+    }:
+    ''
+      import os
+      import shutil
+      import subprocess
+      import tempfile
 
-    tmp_disk_image = tempfile.NamedTemporaryFile()
+      tmp_disk_image = tempfile.NamedTemporaryFile()
 
-    shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
+      shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
 
-    subprocess.run([
-      "${machine.virtualisation.qemu.package}/bin/qemu-img",
-      "resize",
-      "-f",
-      "raw",
-      tmp_disk_image.name,
-      "+32M",
-    ])
+      subprocess.run([
+        "${machine.virtualisation.qemu.package}/bin/qemu-img",
+        "resize",
+        "-f",
+        "raw",
+        tmp_disk_image.name,
+        "${sizeDiff}",
+      ])
 
-    # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
-    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
-  '';
+      # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+    '';
 
   common =
     {
@@ -98,7 +105,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")
@@ -108,6 +115,71 @@ in
       '';
   };
 
+  encrypt-tpm2 = makeTest {
+    name = "systemd-repart-encrypt-tpm2";
+    meta.maintainers = with maintainers; [ flokli ];
+
+    nodes.machine =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        imports = [ common ];
+
+        boot.initrd.systemd.enable = true;
+
+        boot.initrd.availableKernelModules = [ "dm_crypt" ];
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          created-crypt = {
+            device = "/dev/disk/by-partlabel/created-crypt";
+            crypttabExtraOpts = [ "tpm2-device=auto" ];
+          };
+        };
+        boot.initrd.systemd.repart.enable = true;
+        boot.initrd.systemd.repart.extraArgs = [
+          "--tpm2-pcrs=7"
+        ];
+        systemd.repart.partitions = {
+          "10-root" = {
+            Type = "linux-generic";
+          };
+          "10-crypt" = {
+            Type = "var";
+            Label = "created-crypt";
+            Format = "ext4";
+            Encrypt = "tpm2";
+          };
+        };
+        virtualisation.tpm.enable = true;
+        virtualisation.fileSystems = {
+          "/var" = {
+            device = "/dev/mapper/created-crypt";
+            fsType = "ext4";
+          };
+        };
+      };
+
+    testScript =
+      { nodes, ... }:
+      ''
+        ${useDiskImage {
+          inherit (nodes) machine;
+          sizeDiff = "+100M";
+        }}
+
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+
+        systemd_repart_logs = machine.succeed("journalctl --boot --unit systemd-repart.service")
+        assert "Encrypting future partition 2" in systemd_repart_logs
+
+        assert "/dev/mapper/created-crypt" in machine.succeed("mount")
+      '';
+  };
+
   after-initrd = makeTest {
     name = "systemd-repart-after-initrd";
     meta.maintainers = with maintainers; [ nikstur ];
@@ -128,7 +200,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")
@@ -196,7 +268,7 @@ in
     testScript =
       { nodes, ... }:
       ''
-        ${useDiskImage nodes.machine}
+        ${useDiskImage { inherit (nodes) machine; }}
 
         machine.start()
         machine.wait_for_unit("multi-user.target")
diff --git a/pkgs/README.md b/pkgs/README.md
index 83d264d95085..eff9421efbfb 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -940,7 +940,8 @@ Update scripts are to be invoked by the [automatic package update script](../mai
 You can run `nix-shell maintainers/scripts/update.nix` in the root of Nixpkgs repository for information on how to use it.
 `update.nix` offers several modes for selecting packages to update, and it will execute update scripts for all matched packages that have an `updateScript` attribute.
 
-Each update script will be passed the following environment variables:
+Update scripts will be run inside the [Nixpkgs development shell](../shell.nix), providing access to some useful tools for CI.
+Furthermore each update script will be passed the following environment variables:
 
 - [`UPDATE_NIX_NAME`] – content of the `name` attribute of the updated package
 - [`UPDATE_NIX_PNAME`] – content of the `pname` attribute of the updated package
diff --git a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
index 3838271d4924..bf685185c764 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
@@ -13,7 +13,7 @@ pkgs.mkShell {
 
   packages = [
     pkgs.bash
-    pkgs.nixfmt-rfc-style
+    pkgs.nixfmt
   ];
 
   EMACS2NIX = src;
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index bd12302b1afe..410a19d952fa 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "ac1f278f1b006851d95cd3236e9b909264872e9f6b5ffcf90d28198c6f2e913c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "11350d97016e084bff9d0410e3abfb0ed5dd5920378565584e88996b0a6e2da4"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c87b652cc8469019668ba5481e00b0d253e7d582e6139cb3a086b01682329f5e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1aa4286b30b5418df7b94782b70bcf79644da6c2d77bc5ab643da9c69e0290ac"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c7ebe524d0d596ff9b45695770cbd76f8fd672236c563da947ca5cb2d0a64aad"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "cff2d5270b5702b5813f662af7e1f0a741ea3a1052cc81629de6eee1d5a767bd"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.5%2Bk3s1/k3s-images.txt",
-    "sha256": "aa8e10337aef453cb17e6408dbaec9eb2da409ca6ba1f8bc7332fcef97fdaf3a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.6%2Bk3s1/k3s-images.txt",
+    "sha256": "637ccb5f5a8f4a7d13991cb3060f05b8c7c46e7351e0edae351f9ad23bb51631"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
index 4aa03d7f48eb..b8dea807d758 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_32/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.32.5+k3s1";
-  k3sCommit = "8e8f2a4726fdb4ca628eb62b2a526b64d0e6a763";
-  k3sRepoSha256 = "02qsw00f0k0kv93xws96np3fj3rdynnhjhk41a58kic1mnbgm8ss";
-  k3sVendorHash = "sha256-BZs3tgUtcLw1mqaAyOCwg6bhmeQbUGCE9wsbPSG61t4=";
+  k3sVersion = "1.32.6+k3s1";
+  k3sCommit = "eb603acd1530edcaf79a4a8ed3da54e9e03d9967";
+  k3sRepoSha256 = "05py458rdrys1hkw8rg62c98lnwjij5zby8n2zkl1kbfqy12adln";
+  k3sVendorHash = "sha256-K8vlX8rucbAOCxHbgrWHsMBWiRc/98IJVCYS8UD+ZsI=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.6.0-k3s1";
-  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  k3sCNIVersion = "1.7.1-k3s1";
+  k3sCNISha256 = "0k1qfmsi5bqgwd5ap8ndimw09hsxn0cqf4m5ad5a4mgl6akw6dqz";
   containerdVersion = "2.0.5-k3s1.32";
   containerdSha256 = "1la7ygx5caqfqk025wyrxmhjb0xbpkzwnxv52338p33g68sb3yb0";
   criCtlVersion = "1.31.0-k3s2";
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
index 5524e1c1d2dc..ee519e9efb36 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hy3.nix
@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hy3";
-  version = "hl0.49.0";
+  version = "hl0.50.0";
 
   src = fetchFromGitHub {
     owner = "outfoxxed";
     repo = "hy3";
     tag = version;
-    hash = "sha256-dYxkdbg6yj8HhuBkCmklMQVR17N7P32R8ir7b7oNxm4=";
+    hash = "sha256-1BTJSqkj+lkIry27HuqA5UB7uRqAUvGT7LAUDQhKjU0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/build-support/dotnet/add-nuget-deps/default.nix b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
index 7ddd7a556d40..29359fc01a87 100644
--- a/pkgs/build-support/dotnet/add-nuget-deps/default.nix
+++ b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
@@ -5,7 +5,7 @@
   lib,
   replaceVarsWith,
   nuget-to-nix,
-  nixfmt-rfc-style,
+  nixfmt,
   nuget-to-json,
   cacert,
   fetchNupkg,
@@ -90,7 +90,7 @@ attrs
             replacements = {
               binPath = lib.makeBinPath [
                 nuget-to-nix
-                nixfmt-rfc-style
+                nixfmt
                 nuget-to-json
               ];
             };
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 73db05beaa39..ec9782e04b51 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -909,7 +909,7 @@ rec {
         nativeBuildInputs = [
           buildPackages.perl
           buildPackages.dpkg
-          buildPackages.nixfmt-rfc-style
+          buildPackages.nixfmt
         ];
       }
       ''
diff --git a/pkgs/by-name/an/antimatter-dimensions/package.nix b/pkgs/by-name/an/antimatter-dimensions/package.nix
index 2a70d2d9722c..13fec89df4df 100644
--- a/pkgs/by-name/an/antimatter-dimensions/package.nix
+++ b/pkgs/by-name/an/antimatter-dimensions/package.nix
@@ -19,12 +19,12 @@ let
 in
 buildNpmPackage rec {
   pname = "antimatter-dimensions";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-07-15";
   src = fetchFromGitHub {
     owner = "IvarK";
     repo = "AntimatterDimensionsSourceCode";
-    rev = "7b29fa1c0771b93a8bf8198ca04886167ecffc0b";
-    hash = "sha256-z7dVToxu8qWCPajf0vKprXF4zSBCRDquBgjf55ZPgyE=";
+    rev = "01d29026a9d4a85193b563ab0a44b2b3cf02ad6e";
+    hash = "sha256-w66JgLo4SX0b63LjRd1XKDs7O/TpFFJYSbE+dOW1Unw=";
   };
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/an/anubis/package.nix b/pkgs/by-name/an/anubis/package.nix
index fc026c175bcc..43a00eefe288 100644
--- a/pkgs/by-name/an/anubis/package.nix
+++ b/pkgs/by-name/an/anubis/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "anubis";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "TecharoHQ";
     repo = "anubis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pdfe2D9KAg/vesTgOi+b5ZVkUkuWhmZC/xYXiiYzlPs=";
+    hash = "sha256-FKX8E32unAKK8e/Nlrj24FU1amc7AJw28hzmZDbIcIc=";
   };
 
-  vendorHash = "sha256-cOl+eVnj6aMKIJCjCM0aacp4/Jg5BhZqFwum+u9tOKE=";
+  vendorHash = "sha256-cWkC3Bqut5h3hHh5tPIPeHMnkwoqKMnG1x40uCtUIwI=";
 
   nativeBuildInputs = [
     esbuild
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
     pname = "anubis-xess";
     inherit (finalAttrs) version src;
 
-    npmDepsHash = "sha256-kBnexaBAMgA7QdKevW3mmlSn+QEbkTW//hYVTRFLQeQ=";
+    npmDepsHash = "sha256-jvYmAbbMRy8fK2Y0YC0UJGhNRLzk1kjzGvRbqhWFzS4=";
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index ab6279ea88ba..e11f3b35dd7a 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -56,7 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     find node_modules server/node_modules -xtype l -delete
 
     # remove non-deterministic files
-    rm node_modules/{.modules.yaml,.pnpm-workspace-state.json}
+    rm node_modules/.modules.yaml
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 955cd6348d56..7d9781f26d7a 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.31.3";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-uy2B2tjtg6/ufMWy9sPoheSw2hxIsl2gUdAKVfixpoM=";
+    hash = "sha256-Qcq96ZA95Tvs/i3MDpTsc2ZY3xSLpf10o3KpWXoJmQo=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
diff --git a/pkgs/by-name/bo/bootc/package.nix b/pkgs/by-name/bo/bootc/package.nix
index e0f4f3a0473c..72a4384a9dd5 100644
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bootc";
-  version = "1.4.0";
+  version = "1.5.0";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
+  cargoHash = "sha256-3/Ngq6ZHPoE9BMychv+Jg0LhtJrY8GPrFYu7lRvX1+k=";
   doInstallCheck = true;
 
   src = fetchFromGitHub {
     owner = "bootc-dev";
     repo = "bootc";
     rev = "v${version}";
-    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
+    hash = "sha256-1u4pBiySYzudFVf4bayQ7FbXf4EjA4v1+AOX9E+tjyA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/br/bruijn/update.sh b/pkgs/by-name/br/bruijn/update.sh
index 40454a4d226c..837a3a680170 100755
--- a/pkgs/by-name/br/bruijn/update.sh
+++ b/pkgs/by-name/br/bruijn/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils cabal2nix curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p coreutils cabal2nix curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/co/connman-gtk/package.nix b/pkgs/by-name/co/connman-gtk/package.nix
index fb784c8aae7a..21ed440396f6 100644
--- a/pkgs/by-name/co/connman-gtk/package.nix
+++ b/pkgs/by-name/co/connman-gtk/package.nix
@@ -3,32 +3,36 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  autoconf,
-  automake,
-  intltool,
+  meson,
+  ninja,
   pkg-config,
+  python3,
   gtk3,
   connman,
   openconnect,
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "connman-gtk";
-  version = "1.1.1";
+  version = "1.1.1-unstable-2018-06-26";
 
   src = fetchFromGitHub {
     owner = "jgke";
     repo = "connman-gtk";
-    rev = "v${version}";
-    hash = "sha256-2bfoGXzy4wXRALLXEEa7vPWbsBNUhE31nn7dDkuHYCY=";
+    rev = "b72c6ab3bb19c07325c8e659902b046daa23c506";
+    hash = "sha256-6lX6FYERDgLj9G6nwnP35kF5x8dpRJqfJB/quZFtFzM=";
   };
 
+  postPatch = ''
+    patchShebangs --build data/meson_post_install.py
+  '';
+
   nativeBuildInputs = [
-    autoconf
-    automake
-    intltool
+    meson
+    ninja
     pkg-config
+    python3
     wrapGAppsHook3
   ];
 
@@ -45,12 +49,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  preConfigure = ''
-    # m4/intltool.m4 is an invalid symbolic link
-    rm m4/intltool.m4
-    ln -s ${intltool}/share/aclocal/intltool.m4 m4/
-    ./autogen.sh
-  '';
+  env.MESON_INSTALL_PREFIX = placeholder "out";
 
   meta = with lib; {
     description = "GTK GUI for Connman";
diff --git a/pkgs/by-name/cr/creek/update.sh b/pkgs/by-name/cr/creek/update.sh
index a346ab54c950..566de58e738f 100755
--- a/pkgs/by-name/cr/creek/update.sh
+++ b/pkgs/by-name/cr/creek/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style
+#!nix-shell -i bash -p bash common-updater-scripts gnused
 
 latest_tag=$(list-git-tags --url=https://github.com/nmeum/creek | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/by-name/db/dbgate/package.nix b/pkgs/by-name/db/dbgate/package.nix
index 5a2e561cd40e..bc3c376337b6 100644
--- a/pkgs/by-name/db/dbgate/package.nix
+++ b/pkgs/by-name/db/dbgate/package.nix
@@ -8,25 +8,25 @@
 
 let
   pname = "dbgate";
-  version = "6.4.2";
+  version = "6.5.6";
   src =
     fetchurl
       {
         aarch64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_arm64.AppImage";
-          hash = "sha256-GDQCixckbMlEvp77uAdsTtK8CUT02mUpxluLapO0D78=";
+          hash = "sha256-S0xlC0ht6G+RDrsMaMD4nk/vKdLvtvAtUaMaFowT/Gw=";
         };
         x86_64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_x86_64.AppImage";
-          hash = "sha256-5rMkW9VY1NgeGgG37QyMI78I4G90yuWhkP60o2ClAM8=";
+          hash = "sha256-JBE/t/IwFe02LrK4Ci+2KEtAXlH1zr5WcTmQir6yvNc=";
         };
         x86_64-darwin = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-mac_x64.dmg";
-          hash = "sha256-AEYGGT/LIursXtrwVglWvMxYFA9YCqx7q7KXO0q6FZI=";
+          hash = "sha256-EkySGJCHAR/YCS/I6j2LZHA6/L0P8VX2WDPScj58mSg=";
         };
         aarch64-darwin = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-mac_universal.dmg";
-          hash = "sha256-yWDcIXrD85qr+zx5sbtci1Yw/C6gUjW7NNjfu/sClas=";
+          hash = "sha256-isOrajXB+O9y3fiSulhjoSSt/7lgu4xPMXBhUcfgK2Y=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "dbgate: ${stdenv.hostPlatform.system} is unsupported.");
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 891c0db5ee77..c710775b91c7 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -8,6 +8,7 @@
   cachix,
   nixVersions,
   openssl,
+  dbus,
   pkg-config,
   glibcLocalesUtf8,
   devenv, # required to run version test
@@ -18,8 +19,8 @@ let
     (nixVersions.git.overrideSource (fetchFromGitHub {
       owner = "cachix";
       repo = "nix";
-      rev = "afa41b08df4f67b8d77a8034b037ac28c71c77df";
-      hash = "sha256-IDB/oh/P63ZTdhgSkey2LZHzeNhCdoKk+4j7AaPe1SE=";
+      rev = "031c3cf42d2e9391eee373507d8c12e0f9606779";
+      hash = "sha256-dOi/M6yNeuJlj88exI+7k154z+hAhFcuB8tZktiW7rg=";
     })).overrideAttrs
       (old: {
         version = "2.30-devenv";
@@ -29,7 +30,7 @@ let
         __intentionallyOverridingVersion = true;
       });
 
-  version = "1.7";
+  version = "1.8";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
@@ -39,11 +40,11 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-LzMVgB8izls/22g69KvWPbuQ8C7PRT9PobbvdV3/raI=";
+    hash = "sha256-Cg4DxHCZiXiSlbwveJpyCFzWIblWi467I2/pmsAWiAw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-k/UrnRTI+Z09kdN7PYNOg9+GnumqOdm36F31CKZCGMU=";
+  cargoHash = "sha256-uUI0O60x8AVG85MJYzEbNdsO818yFu4w66WuozboWso=";
 
   buildAndTestSubdir = "devenv";
 
@@ -53,7 +54,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+    dbus
+  ];
 
   postInstall =
     let
diff --git a/pkgs/by-name/dp/dprint/plugins/update-plugins.py b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
index f065d673152b..54eab2a67355 100755
--- a/pkgs/by-name/dp/dprint/plugins/update-plugins.py
+++ b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python -p nix nixfmt-rfc-style 'python3.withPackages (pp: [ pp.requests ])'
+#!nix-shell -i python -p nix 'python3.withPackages (pp: [ pp.requests ])'
 
 import json
 import os
diff --git a/pkgs/by-name/ej/ejabberd/update.sh b/pkgs/by-name/ej/ejabberd/update.sh
index af29359a58b3..0db339651212 100755
--- a/pkgs/by-name/ej/ejabberd/update.sh
+++ b/pkgs/by-name/ej/ejabberd/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" erlang autoconf automake nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" erlang autoconf automake
 #shellcheck shell=bash
 
 set -eu -o pipefail
diff --git a/pkgs/by-name/el/elm-land/package.nix b/pkgs/by-name/el/elm-land/package.nix
index 92c09252b378..07b4c59f6a9b 100644
--- a/pkgs/by-name/el/elm-land/package.nix
+++ b/pkgs/by-name/el/elm-land/package.nix
@@ -7,7 +7,7 @@
   writeShellScript,
   nix-update,
   elm2nix,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 
 buildNpmPackage rec {
@@ -53,7 +53,7 @@ buildNpmPackage rec {
     cp "$(nix-build -A "$UPDATE_NIX_ATTR_PATH".src)/projects/cli/src/codegen/elm.json" elm.json
     trap 'rm -rf elm.json registry.dat &> /dev/null' EXIT
     ${lib.getExe elm2nix} convert > pkgs/by-name/el/elm-land/elm-srcs.nix
-    ${lib.getExe nixfmt-rfc-style} pkgs/by-name/el/elm-land/elm-srcs.nix
+    ${lib.getExe nixfmt} pkgs/by-name/el/elm-land/elm-srcs.nix
     ${lib.getExe elm2nix} snapshot
     cp registry.dat pkgs/by-name/el/elm-land/registry.dat
   '';
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 2979704c856d..88a10c2ffa41 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.9.0";
+  version = "14.11.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-LUPG0FiwOvC+4ZXkrGGHnayusg06QvIw96Jg0ug+UBQ=";
+    hash = "sha256-yOwIasMJ0kUGUwj1HN2oPIgu/U0PYT+UmoH8LLUh9EQ=";
   };
 
-  npmDepsHash = "sha256-g6tcBNzCr5lOR874qAGPAuG8WBManHYY40GKqsrBEJM=";
+  npmDepsHash = "sha256-eLhlk/9RmyJg9fpFmQ53IE6m2TN46N801n85yeEDG2M=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/fl/flow-control/update.sh b/pkgs/by-name/fl/flow-control/update.sh
index c48ce524f3ce..4016cee25a7d 100755
--- a/pkgs/by-name/fl/flow-control/update.sh
+++ b/pkgs/by-name/fl/flow-control/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style
+#!nix-shell -i bash -p bash common-updater-scripts gnused
 
 latest_tag=$(list-git-tags --url=https://github.com/neurocyte/flow | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index cbfb245ffd40..3608a13dd2c3 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.75.1";
+  version = "2.76.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-NZcU7ai/Tvg8j65w7qA5FY21R8M8az9tjDTu8YBhV4w=";
+    hash = "sha256-69vSmV+CKRQOuUxsiBBlZBSRqwEtJil4oAse+RSuSVM=";
   };
 
   vendorHash = "sha256-go5hB6vjZZrTa3PMHWpv+J0yNewijXkRD8iGL6O2GgM=";
diff --git a/pkgs/by-name/gr/gren/update.sh b/pkgs/by-name/gr/gren/update.sh
index 1b697ecb88dd..96133b395b25 100755
--- a/pkgs/by-name/gr/gren/update.sh
+++ b/pkgs/by-name/gr/gren/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p cabal2nix curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p cabal2nix curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/gu/gurobi/package.nix b/pkgs/by-name/gu/gurobi/package.nix
index fd7f9a9eeb24..26099b0de9fe 100644
--- a/pkgs/by-name/gu/gurobi/package.nix
+++ b/pkgs/by-name/gu/gurobi/package.nix
@@ -16,14 +16,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gurobi";
-  version = "12.0.2";
+  version = "12.0.3";
 
   src = fetchurl {
     url = "https://packages.gurobi.com/${lib.versions.majorMinor version}/gurobi${version}_${platform}.tar.gz";
     hash =
       {
-        aarch64-linux = "sha256-vlhF3OIMCVyS9Y31RS4eVhs4wQ4CUDGQZlNkf98Uji0=";
-        x86_64-linux = "sha256-DMSmk41YzGoonHdX2xLsioU9RTBLn4kQy4v6HgVa08U=";
+        aarch64-linux = "sha256-NrHyudaioPE34qulwQNe3RFk4KnjFTGmLRj8B9jGRu4=";
+        x86_64-linux = "sha256-Ib2ruq+Dzi2kKk8T7N56H9F7buxNdMl7rYoFGIfRECE=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index 0aa7f9292707..767627f63c96 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,19 +20,19 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "incus-ui-canonical";
-  version = "0.17.1.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${version}";
-    hash = "sha256-dAYcput4qGLQT6G10O52UUrQ7HN9kXQFgZlm5QN4xI0=";
+    hash = "sha256-dN/O3UmQfWZ85XQUGXFTF7dhXGW0CLoQ5+16AIDSAzc=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-or/lPf6pamFVJnSWU9CLTss9s6amMNd9A7H8CAFJ6RU=";
+    hash = "sha256-eiK6dyvRbttxC7rESgpYRsYkkrzLZq4RWOiUf7fsAk8=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index 5dcff98c8176..037de4dd5d79 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-dvAPKNsj8ZnH0eLofbkE09hXL1g8YdViX8sQ/9+4L7k=";
+    hash = "sha256-Ow2xi3twW6FeG88Ya5AeRNk6MIY5JGqd7e1qukKTfQs=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-ZEPzSHcp3HZ8mSoFZDUKlTi+gJ2syauJPtSFEfJnJtg=";
+    hash = "sha256-Id4taAuW/tu9YhbGxjNegdSqyNmUFRQOLF3glkFw0Vc=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index f68893fd80d8..faddadda77d6 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "0.1.29";
+  version = "0.1.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-dvAPKNsj8ZnH0eLofbkE09hXL1g8YdViX8sQ/9+4L7k=";
+    hash = "sha256-Ow2xi3twW6FeG88Ya5AeRNk6MIY5JGqd7e1qukKTfQs=";
   };
 
   sourceRoot = "source/src/backend";
diff --git a/pkgs/by-name/le/lexbor/package.nix b/pkgs/by-name/le/lexbor/package.nix
new file mode 100644
index 000000000000..e88ad0b9e96b
--- /dev/null
+++ b/pkgs/by-name/le/lexbor/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lexbor";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wsm+2L2ar+3LGyBXl39Vp9l1l5JONWvO0QbI87TDfWM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "Lexbor is development of an open source HTML Renderer library";
+    homepage = "https://github.com/lexbor/lexbor";
+    changelog = "https://github.com/lexbor/lexbor/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "lexbor";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index f21c0bf91782..cac7299f18d1 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.8";
+  version = "9.0.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-PLQgZdf2As5dwoM/L8SCBCysXUrw56/cn2NDf4jM1ac=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gkmAdiqXaaTzWMaByOKooCI7WnKZCbWi1LYG5AijDhs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix b/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
index 0b81afcdbd28..fe2fb3cfebc5 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/gclient2nix.nix
@@ -8,7 +8,7 @@
   nix-prefetch-git,
   nix,
   coreutils,
-  nixfmt-rfc-style,
+  nixfmt,
   makeWrapper,
 }:
 # Based on https://github.com/milahu/gclient2nix
@@ -19,7 +19,7 @@ let
     nix-prefetch-git
     nix
     coreutils
-    nixfmt-rfc-style
+    nixfmt
   ];
 in
 buildPythonPackage {
diff --git a/pkgs/by-name/me/memogram/package.nix b/pkgs/by-name/me/memogram/package.nix
index 017741ca6c72..9856dd9adbbb 100644
--- a/pkgs/by-name/me/memogram/package.nix
+++ b/pkgs/by-name/me/memogram/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "memogram";
-  version = "0.2.6";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "telegram-integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vpDwa5MvNyJUNCdeNK7PhXBoEHtKKsyFdbMsNRBLqW4=";
+    hash = "sha256-yQmdUphgGr/db2FJ5tghUhjWt7QGs0mCAI/NrBNRABk=";
   };
 
-  vendorHash = "sha256-F8JllhYMvBWEeHa4boFbTHLFTa0s+Tarqtf4NfVqK7s=";
+  vendorHash = "sha256-8tQ5MQ0XcBIx74EFAXxXInADFd4BnlTazeIFNXNN/Ww=";
 
   subPackages = [ "bin/memogram" ];
 
diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index b41bb53baee4..05a16236e6ef 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nzWRMCIeZ1RmZO4v5UqX1JrbN1UjBHkl/bYaERCzfew=";
+    hash = "sha256-09C5A9ToH3zzUlUcLDd/5wOOkWs4jmjaqI9HpzGebUU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9OjcEmed9nLM/fp6Qk/Gh9hTVnn5cqCxTUpAJUkI4/M=";
+  cargoHash = "sha256-TFGFHK35pary9nGG3XB474Bv2B8YW2X06NvInBLmcIA=";
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/ms/msgraph-cli/update.sh b/pkgs/by-name/ms/msgraph-cli/update.sh
index d1bc45f25dac..66ed99778a18 100755
--- a/pkgs/by-name/ms/msgraph-cli/update.sh
+++ b/pkgs/by-name/ms/msgraph-cli/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nixfmt-rfc-style common-updater-scripts
+#!nix-shell -i bash -p curl gnused common-updater-scripts
 set -eEuo pipefail
 [ -z "${DEBUG:-}" ] || set -x
 cd "${BASH_SOURCE[0]%/*}"
diff --git a/pkgs/by-name/mu/music-assistant/update-providers.py b/pkgs/by-name/mu/music-assistant/update-providers.py
index 1bbb14572e2a..393dbca9500a 100755
--- a/pkgs/by-name/mu/music-assistant/update-providers.py
+++ b/pkgs/by-name/mu/music-assistant/update-providers.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i python3 -p "music-assistant.python.withPackages (ps: music-assistant.dependencies ++ (with ps; [ jinja2 packaging ]))" -p pyright ruff isort nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i python3 -p "music-assistant.python.withPackages (ps: music-assistant.dependencies ++ (with ps; [ jinja2 packaging ]))" -p pyright ruff isort
 import asyncio
 import json
 import os.path
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index 2b93fff93630..54495d4ca2ec 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "22.0.1";
+  version = "22.0.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JAxmmcbkEZGiMzxVMeWlLnnU/iaVmXEcFESuMAaeXf0=";
+    sha256 = "sha256-wvv4EeV0hLrQ9BhWAyoMnR8tjU67OwahcR+xo10lWE8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/nauty/package.nix b/pkgs/by-name/na/nauty/package.nix
index f20c1ff37b67..769c2e121081 100644
--- a/pkgs/by-name/na/nauty/package.nix
+++ b/pkgs/by-name/na/nauty/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nauty";
-  version = "2.8.9";
+  version = "2.9.0";
 
   src = fetchurl {
     url = "https://pallini.di.uniroma1.it/nauty${
       builtins.replaceStrings [ "." ] [ "_" ] version
     }.tar.gz";
-    sha256 = "sha256-yXq0K/SHlqhqWYvOPpJpBHyisywU/CPgcgiiRP5SxO4=";
+    sha256 = "sha256-eziDTHzv4X0l4F7vHvOIL6nNGTP1grnrnedHdBGVYFM=";
   };
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  # HACK: starting from 2.8.9, the makefile tries to copy .libs/*.a files unconditionally
+  # HACK: starting from 2.9.0, the makefile tries to copy .libs/*.a files unconditionally
   dontDisableStatic = true;
 
   configureFlags = [
diff --git a/pkgs/by-name/ni/nil/package.nix b/pkgs/by-name/ni/nil/package.nix
index 23b85a6dd50e..4a534b06b729 100644
--- a/pkgs/by-name/ni/nil/package.nix
+++ b/pkgs/by-name/ni/nil/package.nix
@@ -3,7 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
   nix-update-script,
 }:
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   env = {
     CFG_RELEASE = version;
-    CFG_DEFAULT_FORMATTER = lib.getExe nixfmt-rfc-style;
+    CFG_DEFAULT_FORMATTER = lib.getExe nixfmt;
   };
 
   # might be related to https://github.com/NixOS/nix/issues/5884
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
deleted file mode 100644
index 24a34eca600b..000000000000
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ /dev/null
@@ -1 +0,0 @@
-2025-04-04
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/update.sh b/pkgs/by-name/ni/nixfmt-rfc-style/update.sh
deleted file mode 100755
index 9213c7396452..000000000000
--- a/pkgs/by-name/ni/nixfmt-rfc-style/update.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p cabal2nix curl jq
-#
-# This script will update the nixfmt-rfc-style derivation to the latest version using
-# cabal2nix.
-
-set -eo pipefail
-
-# This is the directory of this update.sh script.
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-
-derivation_file="${script_dir}/generated-package.nix"
-date_file="${script_dir}/date.txt"
-
-# This is the latest version of nixfmt-rfc-style branch on GitHub.
-new_version=$(curl --silent https://api.github.com/repos/nixos/nixfmt/git/refs/heads/master | jq '.object.sha' --raw-output)
-new_date=$(curl --silent https://api.github.com/repos/nixos/nixfmt/git/commits/"$new_version" | jq '.committer.date' --raw-output)
-
-echo "Updating nixfmt-rfc-style to version $new_date."
-echo "Running cabal2nix and outputting to ${derivation_file}..."
-
-cat > "$derivation_file" << EOF
-# This file has been autogenerate with cabal2nix.
-# Update via ./update.sh
-EOF
-
-cabal2nix --jailbreak \
-  "https://github.com/nixos/nixfmt/archive/${new_version}.tar.gz" \
-  >> "$derivation_file"
-
-date --date="$new_date" -I > "$date_file"
-
-echo "Finished."
diff --git a/pkgs/by-name/ni/nixfmt-tree/package.nix b/pkgs/by-name/ni/nixfmt-tree/package.nix
index a36a449b3449..d66d23ef3d2e 100644
--- a/pkgs/by-name/ni/nixfmt-tree/package.nix
+++ b/pkgs/by-name/ni/nixfmt-tree/package.nix
@@ -2,14 +2,14 @@
   lib,
   runCommand,
   treefmt,
-  nixfmt-rfc-style,
+  nixfmt,
   nixfmt-tree,
   git,
   writableTmpDirAsHomeHook,
 
   settings ? { },
   runtimeInputs ? [ ],
-  nixfmtPackage ? nixfmt-rfc-style,
+  nixfmtPackage ? nixfmt,
 
   # NOTE: `runtimePackages` is deprecated. Use `nixfmtPackage` and/or `runtimeInputs`.
   runtimePackages ? [ nixfmtPackage ],
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt/generated-package.nix
similarity index 82%
rename from pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
rename to pkgs/by-name/ni/nixfmt/generated-package.nix
index 1da633e8999d..03e7998038e4 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt/generated-package.nix
@@ -23,10 +23,10 @@
 }:
 mkDerivation {
   pname = "nixfmt";
-  version = "0.6.0";
+  version = "1.0.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/65af4b69133d19f534d97746c97c2d5b464f43b4.tar.gz";
-    sha256 = "0l0w3janvss1n1j7qkcml97zndm2jm2gbrzzs9d8l0ixnrw0cd5r";
+    url = "https://github.com/nixos/nixfmt/archive/v1.0.0.tar.gz";
+    sha256 = "0iy2p893b2b5y4mvhy0d62675a7nd8fc6jm9mr32v9h2baj9ii3p";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/package.nix b/pkgs/by-name/ni/nixfmt/package.nix
similarity index 53%
rename from pkgs/by-name/ni/nixfmt-rfc-style/package.nix
rename to pkgs/by-name/ni/nixfmt/package.nix
index 90e659765b68..93a198f73f2a 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/package.nix
+++ b/pkgs/by-name/ni/nixfmt/package.nix
@@ -3,30 +3,22 @@
   haskellPackages,
   lib,
   runCommand,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   inherit (haskell.lib.compose) overrideCabal justStaticExecutables;
 
-  overrides = rec {
-    version = "unstable-${lib.fileContents ./date.txt}";
-
+  overrides = {
     passthru.updateScript = ./update.sh;
 
     teams = [ lib.teams.formatter ];
 
-    preBuild = ''
-      echo -n 'nixpkgs-${version}' > .version
-    '';
-
     # These tests can be run with the following command.
     #
-    # $ nix-build -A nixfmt-rfc-style.tests
-    passthru.tests =
-      runCommand "nixfmt-rfc-style-tests" { nativeBuildInputs = [ nixfmt-rfc-style ]; }
-        ''
-          nixfmt --version > $out
-        '';
+    # $ nix-build -A nixfmt.tests
+    passthru.tests = runCommand "nixfmt-tests" { nativeBuildInputs = [ nixfmt ]; } ''
+      nixfmt --version > $out
+    '';
   };
   raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
 in
diff --git a/pkgs/by-name/ni/nixfmt/update.sh b/pkgs/by-name/ni/nixfmt/update.sh
new file mode 100755
index 000000000000..3a44a0c6279a
--- /dev/null
+++ b/pkgs/by-name/ni/nixfmt/update.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p cabal2nix curl jq
+#
+# This script will update the nixfmt derivation to the latest version using
+# cabal2nix.
+
+set -eo pipefail
+
+# This is the directory of this update.sh script.
+script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+derivation_file="${script_dir}/generated-package.nix"
+
+release_tag=$(curl --silent https://api.github.com/repos/NixOS/nixfmt/releases/latest | jq '.tag_name' --raw-output)
+
+echo "Updating nixfmt to version $release_tag."
+echo "Running cabal2nix and outputting to ${derivation_file}..."
+
+cat > "$derivation_file" << EOF
+# This file has been autogenerate with cabal2nix.
+# Update via ./update.sh
+EOF
+
+cabal2nix --jailbreak \
+  "https://github.com/nixos/nixfmt/archive/${release_tag}.tar.gz" \
+  >> "$derivation_file"
+
+echo "Finished."
diff --git a/pkgs/by-name/oa/oama/update.sh b/pkgs/by-name/oa/oama/update.sh
index 45af4b99fe59..6d4f581b99ee 100755
--- a/pkgs/by-name/oa/oama/update.sh
+++ b/pkgs/by-name/oa/oama/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p haskell.packages.ghc910.cabal2nix nix-prefetch-git curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p haskell.packages.ghc910.cabal2nix nix-prefetch-git curl jq
 
 set -euo pipefail
 
diff --git a/pkgs/by-name/pr/prometheus-cpp/package.nix b/pkgs/by-name/pr/prometheus-cpp/package.nix
index 2a0f4a88c5ea..d656565f7bee 100644
--- a/pkgs/by-name/pr/prometheus-cpp/package.nix
+++ b/pkgs/by-name/pr/prometheus-cpp/package.nix
@@ -27,12 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
-    curl
     gbenchmark
     gtest
+  ];
+  propagatedBuildInputs = [
+    civetweb
+    curl
     zlib
   ];
-  propagatedBuildInputs = [ civetweb ];
   strictDeps = true;
 
   cmakeFlags = [
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 8f943ca004ec..1932047a1b0a 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.6.5";
+  version = "25.7.7";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-P53v7Zcx6TtCRyFUTea9tpYTFx6DpXL5R60uH8qcbXk=";
+    hash = "sha256-9ldUIT3pQlkO2YhQ3cF9H6Soe8IU4AGEGNRWg0LA1MQ=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh b/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
index ed3e7f9fe855..f28f3ada43bb 100755
--- a/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
+++ b/pkgs/by-name/ri/river-bedload/update-build-zig-zon.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash jq nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash jq zon2nix
 
 commit=$(nix-instantiate --eval -A river-bedload.src.rev | jq --raw-output)
 
diff --git a/pkgs/by-name/ri/river/update.sh b/pkgs/by-name/ri/river/update.sh
index 41bbe048223c..7d7875e5c8c6 100755
--- a/pkgs/by-name/ri/river/update.sh
+++ b/pkgs/by-name/ri/river/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash common-updater-scripts gnused zon2nix
 
 latest_tag=$(list-git-tags --url=https://codeberg.org/river/river | sed 's/^v//' | sort --version-sort | tail --lines=1)
 
diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
new file mode 100644
index 000000000000..e659f665026f
--- /dev/null
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  dbus,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "secretspec";
+  version = "0.2.0";
+
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-6a3BerjcLn86XCakyYlMm4FUUQTc7iq/hCvZEbHnp4g=";
+  };
+
+  cargoHash = "sha256-4sKja7dED1RuiRYA2BNqvvYlJhPFiM8IzAgQVeSa9Oc=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Declarative secrets, every environment, any provider";
+    homepage = "https://secretspec.dev";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ domenkozar ];
+    mainProgram = "secretspec";
+  };
+})
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 86ec124538fb..c1b088fb3e57 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.61.0";
+  version = "7.62.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-foMzSKm2BROZ8ATCdYx/0sl+4tQfhgoPA4AWSHEKL0Y=";
+    hash = "sha256-79Mh5jx7cSr8AVL/oqjuTWQ+DHmyXL19rKlbyNMySt0=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -122,15 +122,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
+        "sha256-r+MktwnhmZOUc1NMumrfkTpmUUHUXKB10XKSkxg3GYU="
       else
-        "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
+        "sha256-raCVDqhtTTsdIn1vjbKW+ULrBefD8+kgJkKHls90KNs=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1752109090;
+    SOURCE_DATE_EPOCH = 1752702364;
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index a71e8dffdb56..5c4e316c4300 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "2.0.3";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H5/+XcXnINRL5BWItWx6YaPP46+k1xTbyfDqHPCRDXk=";
+    hash = "sha256-JYdc3H8PhDLkJH5ApfReq0e7HgKoJaK01JGuzoqftyc=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
diff --git a/pkgs/by-name/sp/sparrow/package.nix b/pkgs/by-name/sp/sparrow/package.nix
index f065426aa2d3..bcdd75194d5c 100644
--- a/pkgs/by-name/sp/sparrow/package.nix
+++ b/pkgs/by-name/sp/sparrow/package.nix
@@ -29,9 +29,22 @@ let
 
   openjdk = jdk23.override { enableJavaFX = true; };
 
+  sparrowArch =
+    {
+      x86_64-linux = "x86_64";
+      aarch64-linux = "aarch64";
+    }
+    ."${stdenvNoCC.hostPlatform.system}";
+
+  # nixpkgs-update: no auto update
   src = fetchurl {
-    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/sparrowwallet-${version}-x86_64.tar.gz";
-    hash = "sha256-MsERgfJGpxRkQm4Ww30Tc95kThjlgI+nO4bq2zNGdeU=";
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/sparrowwallet-${version}-${sparrowArch}.tar.gz";
+    hash =
+      {
+        x86_64-linux = "sha256-MsERgfJGpxRkQm4Ww30Tc95kThjlgI+nO4bq2zNGdeU=";
+        aarch64-linux = "sha256-31x4Ck/+Fa6CvBb6o9ncVH99Zeh0DUVv/hqVN31ysHk=";
+      }
+      ."${stdenvNoCC.hostPlatform.system}";
 
     # nativeBuildInputs, downloadToTemp, and postFetch are used to verify the signed upstream package.
     # The signature is not a self-contained file. Instead the SHA256 of the package is added to a manifest file.
@@ -49,7 +62,7 @@ let
       mkdir -m 700 -p $GNUPGHOME
       ln -s ${manifest} ./manifest.txt
       ln -s ${manifestSignature} ./manifest.txt.asc
-      ln -s $downloadedFile ./sparrowwallet-${version}-x86_64.tar.gz
+      ln -s $downloadedFile ./sparrowwallet-${version}-${sparrowArch}.tar.gz
       gpg --import ${publicKey}
       gpg --verify manifest.txt.asc manifest.txt
       sha256sum -c --ignore-missing manifest.txt
@@ -165,7 +178,6 @@ let
 
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
       rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
@@ -184,7 +196,6 @@ let
       rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
       rm -fR openpnp.capture.java/darwin-aarch64
       rm -fR openpnp.capture.java/darwin-x86-64
-      rm -fR openpnp.capture.java/linux-aarch64
       rm -fR openpnp.capture.java/win32-x86-64
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
@@ -192,9 +203,9 @@ let
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
       rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
-      rm -fR com.sparrowwallet.merged.module/linux-aarch64
       rm -fR com.sparrowwallet.merged.module/linux-arm
       rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm -fR com.fazecast.jSerialComm/FreeBSD
       rm -fR com.fazecast.jSerialComm/OpenBSD
       rm -fR com.fazecast.jSerialComm/Android
       rm -fR com.fazecast.jSerialComm/Solaris
@@ -206,7 +217,7 @@ let
       # Replace the embedded Tor binary (which is in a Tar archive)
       # with one from Nixpkgs.
       gzip -c ${torWrapper}  > tor.gz
-      cp tor.gz modules/io.matthewnelson.kmp.tor.resource.exec.tor/io/matthewnelson/kmp/tor/resource/exec/tor/native/linux-libc/x86_64/tor.gz
+      cp tor.gz modules/io.matthewnelson.kmp.tor.resource.exec.tor/io/matthewnelson/kmp/tor/resource/exec/tor/native/linux-libc/${sparrowArch}/tor.gz
     '';
 
     installPhase = ''
@@ -294,7 +305,10 @@ stdenvNoCC.mkDerivation rec {
       msgilligan
       _1000101
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "sparrow-desktop";
   };
 }
diff --git a/pkgs/by-name/st/stylelint/package.nix b/pkgs/by-name/st/stylelint/package.nix
index db76f5cceceb..8fd72c5826cb 100644
--- a/pkgs/by-name/st/stylelint/package.nix
+++ b/pkgs/by-name/st/stylelint/package.nix
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.21.1";
+  version = "16.22.0";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     tag = version;
-    hash = "sha256-obRxkExrLFLt02L1w9FBHrHgN8n+lRsPuSUra66j8hE=";
+    hash = "sha256-rl+TFRzMRliOKbTJylmflmEZHDplDPtKEVkXlXJG3a4=";
   };
 
-  npmDepsHash = "sha256-t83R9OQnSY7OVEU+TQWQMotsey/XtXIo7NLG9vyiUng=";
+  npmDepsHash = "sha256-3Lfhwv1xwv2JAoZ3DDppUQVFHp9TOMibsGVSIR4xRkA=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 3be5ecbcb5ef..4b4cd3bf46cf 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -14,13 +14,13 @@
 
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "14.0.5";
+  version = "14.1.0";
 
   src = fetchFromGitHub {
     owner = "johannesjo";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-VoE86uBl6DM6aXz7MLYekEzfixVSLjLL3yYgc2vBhp0=";
+    hash = "sha256-wZQhSQBJPyJPAMZU927Xq9bOxAohSaEg+ylk7DoTJJE=";
 
     postFetch = ''
       find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -63,7 +63,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-Jj7ulTjC19Q9PmOeVui/FAyfpsSviGLHiiz8gwsLXAg=";
+      hash = "sha256-SmA2qTi7tXxUcAlFOI61AW8pimB7YEYe749h5hjtLN8=";
     }
   );
 
diff --git a/pkgs/by-name/su/supersonic/package.nix b/pkgs/by-name/su/supersonic/package.nix
index 635befdf2bd3..9ed08e200f4e 100644
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.hostPlatform.isLinux;
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     rev = "v${version}";
-    hash = "sha256-KC5olxn1+H/Y7HCOvsNPitcGgUgh+Ye2Te1yFffr7cs=";
+    hash = "sha256-+MgDCI/wz5yfdpSy0Gh85ZWUAuL2wijixYskx/jH7Vw=";
   };
 
-  vendorHash = "sha256-uHOeeCtnwZfJ3fHTPL/MtvQZeOQ8NEgMnpiXAPjY6YE=";
+  vendorHash = "sha256-v6tPGjeJhRdSJpVPQAERRM7cpXO7Ut7kLF3EdNcDFgM=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/tr/treefmt/tests.nix b/pkgs/by-name/tr/treefmt/tests.nix
index 763bb14e5656..fd84f398012b 100644
--- a/pkgs/by-name/tr/treefmt/tests.nix
+++ b/pkgs/by-name/tr/treefmt/tests.nix
@@ -3,7 +3,7 @@
   runCommand,
   testers,
   treefmt,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   inherit (treefmt) buildConfig withConfig;
@@ -29,7 +29,7 @@ let
 
   nixfmtExamplePackage = withConfig {
     settings = nixfmtExampleConfig;
-    runtimeInputs = [ nixfmt-rfc-style ];
+    runtimeInputs = [ nixfmt ];
   };
 in
 {
diff --git a/pkgs/by-name/wa/waylock/update.sh b/pkgs/by-name/wa/waylock/update.sh
index 5caa604fce9f..8ee3e33ad250 100755
--- a/pkgs/by-name/wa/waylock/update.sh
+++ b/pkgs/by-name/wa/waylock/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style zon2nix
+#!nix-shell -i bash -p bash common-updater-scripts gnused zon2nix
 
 latest_tag=$(list-git-tags --url=https://codeberg.org/ifreund/waylock | sed 's/^v//' | tail -n 1)
 
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 8773c68b32b7..2e61baac1c6e 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-darwin-arm64-1.10.8.zip",
-    "sha256": "2aa0fda69b442577a4f0b85d2b4437efc9d49be9d7a07a1f15ab8df5b5face5a"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-arm64-1.11.0.zip",
+    "sha256": "eb0f139db3eb30b93e53afb37ec3d52c9881e39fc100287c25c66452dcefa0c8"
   },
   "x86_64-darwin": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-darwin-x64-1.10.8.zip",
-    "sha256": "8564a492699a6225474b82aa1f95d0e400c82d311841afdfaeba2d445be9caf9"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-x64-1.11.0.zip",
+    "sha256": "f020a9e23115043070ac6e4a15614d58967b65c5dc6a09918869ed20e37cddf3"
   },
   "x86_64-linux": {
-    "version": "1.10.8",
+    "version": "1.11.0",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/5c07715b357a8ba4ff6b5f208ba6c883a4539416/Windsurf-linux-x64-1.10.8.tar.gz",
-    "sha256": "c68432a5a903a7c18b4a446c24f8dc0728311242ff7c6a5a9b34d15713685063"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-linux-x64-1.11.0.tar.gz",
+    "sha256": "ff1b9a168c0d60be0f6a97ee9d22d443d5bb3384df69182ea485b7403f4f9d02"
   }
 }
diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix
index f42939b2d906..4a765d71b81c 100644
--- a/pkgs/by-name/yo/yosys/package.nix
+++ b/pkgs/by-name/yo/yosys/package.nix
@@ -85,13 +85,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "yosys";
-  version = "0.54";
+  version = "0.55";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "yosys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yEAZvdBc+923a0OTtaCpTbrl33kcmvgwFlL5VEssHkQ=";
+    hash = "sha256-GddNbAtH5SPm7KTa5kCm/vGq4xOczx+jCnOSQl55gUI=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''
diff --git a/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch b/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
deleted file mode 100644
index 07b95960ef85..000000000000
--- a/pkgs/by-name/ze/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 889ee4dd9e778511e2fb850e6467f55a331cded9 Mon Sep 17 00:00:00 2001
-From: Tobias Mayer <tobim@fastmail.fm>
-Date: Sun, 13 Nov 2022 19:06:00 +0100
-Subject: [PATCH] Fix include path in exported CMake targets
-
----
- CMakeLists.txt | 23 ++++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e22b77aa..77a15314 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -209,7 +209,6 @@ if (CAF_ROOT)
-   else()
-     find_package(CAF REQUIRED COMPONENTS openssl test io core net)
-   endif()
--  list(APPEND LINK_LIBS CAF::core CAF::io CAF::net)
-   set(BROKER_USE_EXTERNAL_CAF ON)
- else ()
-   message(STATUS "Using bundled CAF")
-@@ -243,22 +242,18 @@ endif ()
- 
- # Make sure there are no old header versions on disk.
- install(
--  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_INSTALL_PREFIX}/include/broker\")"
--  CODE "file(REMOVE_RECURSE \"${CMAKE_INSTALL_PREFIX}/include/broker\")")
-+  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")"
-+  CODE "file(REMOVE_RECURSE \"${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")")
- 
- # Install all headers except the files from broker/internal.
- install(DIRECTORY include/broker
--        DESTINATION include
-+        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
-         FILES_MATCHING PATTERN "*.hh"
-                        PATTERN "include/broker/internal" EXCLUDE)
- 
--include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/include)
--
--include_directories(${CMAKE_CURRENT_BINARY_DIR}/include)
--
- configure_file(${CMAKE_CURRENT_SOURCE_DIR}/src/config.hh.in
-                ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh)
--install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION include/broker)
-+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/broker")
- 
- if (NOT BROKER_EXTERNAL_SQLITE_TARGET)
-   include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty)
-@@ -360,6 +355,11 @@ if (ENABLE_SHARED)
-                         OUTPUT_NAME broker)
-   target_link_libraries(broker PUBLIC ${LINK_LIBS})
-   target_link_libraries(broker PRIVATE CAF::core CAF::io CAF::net)
-+  target_include_directories(
-+    broker PUBLIC
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-   install(TARGETS broker
-           EXPORT BrokerTargets
-           DESTINATION ${CMAKE_INSTALL_LIBDIR})
-@@ -373,6 +373,11 @@ if (ENABLE_STATIC)
-   endif()
-   target_link_libraries(broker_static PUBLIC ${LINK_LIBS})
-   target_link_libraries(broker_static PRIVATE CAF::core CAF::io CAF::net)
-+  target_include_directories(
-+    broker_static PUBLIC
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
-+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-   install(TARGETS broker_static
-           EXPORT BrokerTargets
-           DESTINATION ${CMAKE_INSTALL_LIBDIR})
--- 
-2.38.1
-
diff --git a/pkgs/by-name/ze/zeek/broker/default.nix b/pkgs/by-name/ze/zeek/broker/default.nix
index bd2591019582..c226782b5b62 100644
--- a/pkgs/by-name/ze/zeek/broker/default.nix
+++ b/pkgs/by-name/ze/zeek/broker/default.nix
@@ -3,32 +3,31 @@
   lib,
   fetchFromGitHub,
   cmake,
+  prometheus-cpp,
   python3,
   caf,
   openssl,
 }:
 let
-  inherit (stdenv.hostPlatform) isStatic;
-
   src-cmake = fetchFromGitHub {
     owner = "zeek";
     repo = "cmake";
-    rev = "1be78cc8a889d95db047f473a0f48e0baee49f33";
-    hash = "sha256-zcXWP8CHx0RSDGpRTrYD99lHlqSbvaliXrtFowPfhBk=";
+    rev = "fd0696f9077933660f7da5f81978e86b3e967647";
+    hash = "sha256-21wZVwoOB05l/WX/VrVbSx+lFKFQ9MHWjQQD4weavFs=";
   };
   src-3rdparty = fetchFromGitHub {
     owner = "zeek";
     repo = "zeek-3rdparty";
-    rev = "eb87829547270eab13c223e6de58b25bc9a0282e";
-    hash = "sha256-AVaKcRjF5ZiSR8aPSLBzSTeWVwGWW/aSyQJcN0Yhza0=";
+    rev = "a6cc3c7603bb535cf3bec7442140e7126e0577a8";
+    hash = "sha256-yzhuTam9zOQ3MP7fk+ACN5P5tHtHXWbyQP73DwISIv8=";
   };
   caf' = caf.overrideAttrs (old: {
-    version = "unstable-2024-01-07-zeek";
+    version = "unstable-2024-09-14-zeek";
     src = fetchFromGitHub {
       owner = "zeek";
       repo = "actor-framework";
-      rev = "e3048cdd13e085c97870a55eb1f9de04e25320f3";
-      hash = "sha256-uisoYXiZbFQa/TfWGRrCJ23MX4bg8Ds86ffC8sZSRNQ=";
+      rev = "10afbbc5ee40263b258b7cf3f0e5abb436f79e89";
+      hash = "sha256-R22eKAFNP2VVA4eL6ycN6aHM0NgDHVll9aFNmOQ/pDc=";
     };
     cmakeFlags = old.cmakeFlags ++ [
       "-DCAF_ENABLE_TESTING=OFF"
@@ -36,9 +35,9 @@ let
     doCheck = false;
   });
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "zeek-broker";
-  version = "6.2.0";
+  version = "2.6.0-unstable-2025-04-23";
   outputs = [
     "out"
     "py"
@@ -49,8 +48,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "zeek";
     repo = "broker";
-    rev = "v${version}";
-    hash = "sha256-SG5TzozKvYc7qcEPJgiEtsxgzdZbbJt90lmuUbCPyv0=";
+    rev = "5b6cbb8c2d9124aa1fb0bea5799433138dc64cf9";
+    hash = "sha256-L6Z+ltX3tJEwZ05zEftrJlOhwbhs06MY9cEJDM2kcck=";
   };
   postUnpack = ''
     rmdir $sourceRoot/cmake $sourceRoot/3rdparty
@@ -62,10 +61,6 @@ stdenv.mkDerivation rec {
     touch $sourceRoot/bindings/python/3rdparty/pybind11/CMakeLists.txt
   '';
 
-  patches = [
-    ./0001-Fix-include-path-in-exported-CMake-targets.patch
-  ];
-
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace bindings/python/CMakeLists.txt --replace " -u -r" ""
   '';
@@ -76,14 +71,16 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     openssl
+    prometheus-cpp
     python3.pkgs.pybind11
   ];
   propagatedBuildInputs = [ caf' ];
 
   cmakeFlags = [
     "-DCAF_ROOT=${caf'}"
-    "-DENABLE_STATIC_ONLY:BOOL=${if isStatic then "ON" else "OFF"}"
+    "-DENABLE_STATIC_ONLY:BOOL=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
     "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
+    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ze/zeek/fix-installation.patch b/pkgs/by-name/ze/zeek/fix-installation.patch
index 135e8c314678..7a1d98c818c3 100644
--- a/pkgs/by-name/ze/zeek/fix-installation.patch
+++ b/pkgs/by-name/ze/zeek/fix-installation.patch
@@ -28,7 +28,7 @@ diff --git a/auxil/zeekctl/CMakeLists.txt b/auxil/zeekctl/CMakeLists.txt
 index 1ebe7c2..1435509 100644
 --- a/auxil/zeekctl/CMakeLists.txt
 +++ b/auxil/zeekctl/CMakeLists.txt
-@@ -9,7 +9,7 @@ file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/VERSION" VERSION LIMIT_COUNT 1)
+@@ -9,7 +9,7 @@
  set(PREFIX "${CMAKE_INSTALL_PREFIX}")
  set(LIBDIR "${CMAKE_INSTALL_FULL_LIBDIR}")
  set(ZEEKSCRIPTDIR "${ZEEK_SCRIPT_INSTALL_PATH}")
@@ -37,7 +37,7 @@ index 1ebe7c2..1435509 100644
  
  ########################################################################
  ## Dependency Configuration
-@@ -186,38 +186,9 @@ else ()
+@@ -186,41 +186,9 @@
      set(LOGS ${VAR}/logs)
  endif ()
  
@@ -56,6 +56,8 @@ index 1ebe7c2..1435509 100644
 -            DIRECTORY_PERMISSIONS ${perms})
 -    install(DIRECTORY DESTINATION ${SPOOL}/brokerstore
 -            DIRECTORY_PERMISSIONS ${perms})
+-    install(DIRECTORY DESTINATION ${SPOOL}/extract_files
+-            DIRECTORY_PERMISSIONS ${perms})
 -    install(DIRECTORY DESTINATION ${LOGS}
 -            DIRECTORY_PERMISSIONS ${perms})
 -    set(EMPTY_WORLD_DIRS
@@ -65,6 +67,7 @@ index 1ebe7c2..1435509 100644
 -    install(DIRECTORY DESTINATION ${SPOOL})
 -    install(DIRECTORY DESTINATION ${SPOOL}/tmp)
 -    install(DIRECTORY DESTINATION ${SPOOL}/brokerstore)
+-    install(DIRECTORY DESTINATION ${SPOOL}/extract_files)
 -    install(DIRECTORY DESTINATION ${LOGS})
 -endif ()
 -
diff --git a/pkgs/by-name/ze/zeek/package.nix b/pkgs/by-name/ze/zeek/package.nix
index 95ae96c323f6..f2040d9ba2da 100644
--- a/pkgs/by-name/ze/zeek/package.nix
+++ b/pkgs/by-name/ze/zeek/package.nix
@@ -28,13 +28,13 @@ let
     p.semantic-version
   ]);
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zeek";
-  version = "6.2.1";
+  version = "7.2.1";
 
   src = fetchurl {
-    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    hash = "sha256-ZOOlK9mfZVrfxvgFREgqcRcSs18EMpADD8Y4Ev391Bw=";
+    url = "https://download.zeek.org/zeek-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nbq25TGq/HubTfAysxuVHU34xp3AkJp8yBHB20FlUC0=";
   };
 
   strictDeps = true;
@@ -110,12 +110,13 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Network analysis framework much different from a typical IDS";
     homepage = "https://www.zeek.org";
-    changelog = "https://github.com/zeek/zeek/blob/v${version}/CHANGES";
+    changelog = "https://github.com/zeek/zeek/blob/v${finalAttrs.version}/CHANGES";
     license = lib.licenses.bsd3;
+    mainProgram = "zeek";
     maintainers = with lib.maintainers; [
       pSub
       tobim
     ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/beam-modules/elvis-erlang/default.nix b/pkgs/development/beam-modules/elvis-erlang/default.nix
index 9599f9f335a3..114df9b06b50 100644
--- a/pkgs/development/beam-modules/elvis-erlang/default.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/default.nix
@@ -29,7 +29,7 @@ rebar3Relx rec {
 
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p bash common-updater-scripts git nix-prefetch-git gnutar gzip "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}" nixfmt-rfc-style
+    #!nix-shell -i bash -p bash common-updater-scripts git nix-prefetch-git gnutar gzip "rebar3WithPlugins {globalPlugins = [beamPackages.rebar3-nix];}"
 
     set -euo pipefail
 
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index 548cb2ee4d06..8372aaccbafb 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -74,7 +74,7 @@ rebar3Relx {
 
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
-    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip nixfmt-rfc-style "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"
+    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"
 
     set -ox errexit
     latest=$(list-git-tags | sed -n '/[\d\.]\+/p' | sort -V | tail -1)
diff --git a/pkgs/development/compilers/dotnet/update.sh b/pkgs/development/compilers/dotnet/update.sh
index 2e4b41244d70..8dd35a3bc0bb 100755
--- a/pkgs/development/compilers/dotnet/update.sh
+++ b/pkgs/development/compilers/dotnet/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix gnused nixfmt-rfc-style
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix gnused
 # shellcheck shell=bash
 
 set -Eeuo pipefail
diff --git a/pkgs/development/interpreters/erlang/26.nix b/pkgs/development/interpreters/erlang/26.nix
index b18854070055..78891d06af72 100644
--- a/pkgs/development/interpreters/erlang/26.nix
+++ b/pkgs/development/interpreters/erlang/26.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "26.2.5.13";
-  sha256 = "sha256-imgI9qgAi17wN/QHVC3JKrmOArq3i2k+xMg8yBK2VrQ=";
+  version = "26.2.5.14";
+  sha256 = "sha256-/m76FtCJvIjNuvM96XV3ngFMgKF8C5uCH89YQklJKpo=";
 }
diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 599cebd342bc..bc6b0507aac8 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "27.3.4.1";
-  sha256 = "sha256-L9VgcdO1TyLNm+vke90w6Xuq/T3uKzmU4d0uYEfyQlc=";
+  version = "27.3.4.2";
+  sha256 = "sha256-wbaRSTwTrNADbShNHoWorWyD+2ul6NZbRs6isP3g+OI=";
 }
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 8c6e4ee19148..e9594b18621f 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "28.0.1";
-  sha256 = "sha256-eWDDreijr7RRmr6sVNuGpQ0qmynN4FTsiBXB8DOWKr4=";
+  version = "28.0.2";
+  sha256 = "sha256-4+Jv7MUX4KAwasNyU7AiV9+Qd9NginYXTN0fDteTFEM=";
 }
diff --git a/pkgs/development/libraries/libgpod/default.nix b/pkgs/development/libraries/libgpod/default.nix
index eefcb35fca60..87f00bb23df2 100644
--- a/pkgs/development/libraries/libgpod/default.nix
+++ b/pkgs/development/libraries/libgpod/default.nix
@@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
     substituteInPlace configure.ac --replace 'libplist >= 1.0' 'libplist-2.0 >= 2.2'
   '';
 
+  preAutoreconf = ''
+    gettextize --force --copy
+    intltoolize --force --copy
+  '';
+
   configureFlags = [
     "--without-hal"
     "--enable-udev"
diff --git a/pkgs/development/python-modules/gurobipy/default.nix b/pkgs/development/python-modules/gurobipy/default.nix
index 485d26842c77..4c06dc57ddf8 100644
--- a/pkgs/development/python-modules/gurobipy/default.nix
+++ b/pkgs/development/python-modules/gurobipy/default.nix
@@ -18,14 +18,14 @@ let
   };
   platform = platforms.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   hashes = rec {
-    cp312-aarch64-darwin = "sha256-i/0ygF6PxOotAlO1vq7yx2NXAxbyah9PLIbLqg6zqNc=";
-    cp312-aarch64-linux = "sha256-WvK9RiY4T/xwDCmvDh3WnK/m9tvW78045eMoc6RvPRI=";
+    cp312-aarch64-darwin = "sha256-Ag8jJ39jDgeerBFDheq9G9n7SsIvh5btW6bZFc5PFBs=";
+    cp312-aarch64-linux = "sha256-crv1RLwFBgu5OQm3lxWs5MD0FhmPdiKphcq7no6Zqhw=";
     cp312-x86_64-darwin = cp312-aarch64-darwin;
-    cp312-x86_64-linux = "sha256-ER0yOTo5o+Ld1erRdScx04izxoW3NVDGsMqaRdlUw2Q=";
-    cp313-aarch64-darwin = "sha256-V5HcmwKfBrMY1U4N+gf1yWiMJ+XHH3pUvNqv20wJBek=";
-    cp313-aarch64-linux = "sha256-s8rr72p8a6I1WYcqtz3NgEDHFW74DN4LWRGLvf0k53k=";
+    cp312-x86_64-linux = "sha256-s/lxyvJw9nG2/89bk3s8BDClJksPAVKdyGgdYcIh8hU=";
+    cp313-aarch64-darwin = "sha256-qFUuR2c8tvH9NR7fj8rYawL4Msv7V9kO8h4Dl+ltE44=";
+    cp313-aarch64-linux = "sha256-vgXAdBQcihJsiq7MxBeVqwkaZm6rs5yh/5inS96B5mM=";
     cp313-x86_64-darwin = cp313-aarch64-darwin;
-    cp313-x86_64-linux = "sha256-JAqrYPz7/lhvRW1uy8yOyjtapf/nF+agjEHIKWQCYTc=";
+    cp313-x86_64-linux = "sha256-eaMzdm4n/veQLO7vvPAnmhyjk6J6cupi+OMBshqhfVk=";
   };
   hash =
     hashes."${pyShortVersion}-${stdenv.system}"
@@ -33,7 +33,7 @@ let
 in
 buildPythonPackage rec {
   pname = "gurobipy";
-  version = "12.0.2";
+  version = "12.0.3";
   inherit format;
 
   src = fetchPypi {
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 644a20626996..bfecda475adb 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.74.0";
+  version = "1.74.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     tag = "v${version}-stable";
-    hash = "sha256-qjr08HHEELIwdL3IZ+GWJWGvIySTTX1nv46tYNBP53Y=";
+    hash = "sha256-wxj9zkaUo5SKbPd2KqEq5r9qPk2ipHr19bIX13/hnGY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/vector/default.nix b/pkgs/development/python-modules/vector/default.nix
index 36bfa60eb3ea..b2459eed385b 100644
--- a/pkgs/development/python-modules/vector/default.nix
+++ b/pkgs/development/python-modules/vector/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "vector";
-  version = "1.6.2";
+  version = "1.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "vector";
     tag = "v${version}";
-    hash = "sha256-IMr3+YveR/FDQ2MbgbWr1KJFrdH9B+KOFVNGJjz6Zdk=";
+    hash = "sha256-KwxQ2sA8cdHmTRbh23H5iTexMlWK2MxdA8XWpXscpfU=";
   };
 
   build-system = [
diff --git a/pkgs/development/ruby-modules/bundler-update-script/default.nix b/pkgs/development/ruby-modules/bundler-update-script/default.nix
index 2135e42a2279..e248851bf7d8 100644
--- a/pkgs/development/ruby-modules/bundler-update-script/default.nix
+++ b/pkgs/development/ruby-modules/bundler-update-script/default.nix
@@ -7,7 +7,7 @@
   coreutils,
   git,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 
 attrPath:
@@ -22,7 +22,7 @@ let
         coreutils
         git
         nix
-        nixfmt-rfc-style
+        nixfmt
       ]
     }
     set -o errexit
diff --git a/pkgs/development/tools/build-managers/rebar3/default.nix b/pkgs/development/tools/build-managers/rebar3/default.nix
index 6cfedadca7d8..25beb504f882 100644
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@@ -12,7 +12,7 @@
   git,
   gnused,
   nix,
-  nixfmt-rfc-style,
+  nixfmt,
   rebar3-nix,
 }:
 
@@ -95,7 +95,7 @@ let
           git
           gnused
           nix
-          nixfmt-rfc-style
+          nixfmt
           (rebar3WithPlugins { globalPlugins = [ rebar3-nix ]; })
         ]
       }
diff --git a/pkgs/servers/home-assistant/update-component-packages.py b/pkgs/servers/home-assistant/update-component-packages.py
index a6433c9b96b4..c7ff548bd427 100755
--- a/pkgs/servers/home-assistant/update-component-packages.py
+++ b/pkgs/servers/home-assistant/update-component-packages.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort nixfmt-rfc-style
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort
 #
 # This script downloads Home Assistant's source tarball.
 # Inside the homeassistant/components directory, each integration has an associated manifest.json,
diff --git a/pkgs/servers/mobilizon/default.nix b/pkgs/servers/mobilizon/default.nix
index 0d88715bb0f2..2ffcfc1bec52 100644
--- a/pkgs/servers/mobilizon/default.nix
+++ b/pkgs/servers/mobilizon/default.nix
@@ -8,7 +8,7 @@
   git,
   cmake,
   nixosTests,
-  nixfmt-rfc-style,
+  nixfmt,
   mobilizon-frontend,
   ...
 }:
@@ -145,7 +145,7 @@ mixRelease rec {
       set -eou pipefail
 
       ${lib.getExe mix2nix} '${src}/mix.lock' > pkgs/servers/mobilizon/mix.nix
-      ${lib.getExe nixfmt-rfc-style} pkgs/servers/mobilizon/mix.nix
+      ${lib.getExe nixfmt} pkgs/servers/mobilizon/mix.nix
     '';
     elixirPackage = beamPackages.elixir;
   };
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index b836687b7d9c..36435d58ff42 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -43,7 +43,7 @@
   makeFontsConf,
   useFixedHashes ? true,
   recurseIntoAttrs,
-  nixfmt-rfc-style,
+  nixfmt,
 }:
 let
   stdenv = gcc12Stdenv;
@@ -151,7 +151,7 @@ let
         tl2nix = ./tl2nix.sed;
       }
       ''
-        xzcat "$tlpdbxz" | sed -rn -f "$tl2nix" | uniq | ${lib.getExe nixfmt-rfc-style} > "$out"
+        xzcat "$tlpdbxz" | sed -rn -f "$tl2nix" | uniq | ${lib.getExe nixfmt} > "$out"
       '';
 
   # map: name -> fixed-output hash
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 05ec44e3fbe6..5d6eae648868 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1412,7 +1412,13 @@ mapAliases {
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = throw "nixUnstable has been removed. For bleeding edge (Nix master, roughly weekly updated) use nixVersions.git, otherwise use nixVersions.latest."; # Converted to throw 2024-04-22
   nix_2_3 = nixVersions.nix_2_3;
-  nixfmt = lib.warnOnInstantiate "nixfmt was renamed to nixfmt-classic. The nixfmt attribute may be used for the new RFC 166-style formatter in the future, which is currently available as nixfmt-rfc-style" nixfmt-classic; # Added 2024-03-31
+  nixfmt-rfc-style =
+    if lib.oldestSupportedReleaseIsAtLeast 2511 then
+      lib.warnOnInstantiate
+        "nixfmt-rfc-style is now the same as pkgs.nixfmt which should be used instead."
+        nixfmt # Added 2025-07-14
+    else
+      nixfmt;
 
   # When the nixops_unstable alias is removed, nixops_unstable_minimal can be renamed to nixops_unstable.
 
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 9350d267e323..124e77761ad8 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -346,7 +346,7 @@ let
         nix-script
         nix-tree
         nixfmt-classic
-        nixfmt-rfc-style
+        nixfmt
         nota
         nvfetcher
         oama