diff --git a/doc/redirects.json b/doc/redirects.json
index 91f98a064f6f..7b0841c639b7 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -225,12 +225,6 @@
   "sec-language-cosmic": [
     "index.html#sec-language-cosmic"
   ],
-  "sec-meta-identifiers": [
-    "index.html#sec-meta-identifiers"
-  ],
-  "sec-meta-identifiers-cpe": [
-    "index.html#sec-meta-identifiers-cpe"
-  ],
   "sec-modify-via-packageOverrides": [
     "index.html#sec-modify-via-packageOverrides"
   ],
@@ -628,15 +622,6 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
-  "var-meta-identifiers-cpe": [
-    "index.html#var-meta-identifiers-cpe"
-  ],
-  "var-meta-identifiers-cpeParts": [
-    "index.html#var-meta-identifiers-cpeParts"
-  ],
-  "var-meta-identifiers-possibleCPEs": [
-    "index.html#var-meta-identifiers-possibleCPEs"
-  ],
   "var-meta-teams": [
     "index.html#var-meta-teams"
   ],
diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 947009869ff1..6f092d406126 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -248,74 +248,3 @@ Code to be executed on a peripheral device or embedded controller, built by a th
 ### `lib.sourceTypes.binaryBytecode` {#lib.sourceTypes.binaryBytecode}
 
 Code to run on a VM interpreter or JIT compiled into bytecode by a third party. This includes packages which download Java `.jar` files from another source.
-
-## Software identifiers {#sec-meta-identifiers}
-
-Package's `meta.identifiers` attribute specifies information about software identifiers associated with this package. Software identifiers are used, for example:
-* to generate Software Bill of Materials (SBOM) that lists all components used to build the software, which can later be used to perform vulnerability or license analysis of the resulting software;
-* to lookup software in different vulnerability databases or report new vulnerabilities to them.
-
-Overriding the default `meta.identifiers` attribute is optional, but it is recommended to fill in pieces to help tools mentioned above get precise data.
-For example, we could get automatic notifications about potential vulnerabilities for users in the future.
-All identifiers specified in `meta.identifiers` are expected to be unambiguous and valid.
-
-`meta.identifiers` contains `v1` attribute which is an attribute set that guarantees backward compatibility of its constituents. Right now it contains copies of all other attributes in `meta.identifiers`.
-
-### CPE {#sec-meta-identifiers-cpe}
-
-Common Platform Enumeration (CPE) is a specification maintained by NIST as part of the Security Content Automation Protocol (SCAP). It is used to identify software in National Vulnerabilities Database (NVD, https://nvd.nist.gov) and other vulnerability databases.
-
-Current version of CPE 2.3 consists of 13 parts:
-
-```
-cpe:2.3:a:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>
-```
-
-Some of them are as follows:
-
-* *CPE version* - current version of CPE is `2.3`
-* *part* - usually in Nixpkgs `a` for "application", can also be `o` for "operating system" or `h` for "hardware"
-* *vendor* - can point to the source of the package, or to Nixpkgs itself
-* *product* - name of the package
-* *version* - version of the package
-* *update* - name of the latest update, can be a patch version for semantically versioned packages
-* *edition* - any additional specification about the version
-
-You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
-
-Any fields that don't have a value are set to either `-` if the value is not available or `*` when the field can match any value.
-
-For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
-
-#### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts}
-
-This attribute contains an attribute set of all parts of the CPE for this package. Most of the parts default to `*` (match any value), with some exceptions:
-
-* `part` defaults to `a` (application), can also be set to `o` for operating systems, for example, Linux kernel, or to `h` for hardware
-* `vendor` cannot be deduced from other sources, so it must be specified by the package author
-* `product` defaults to provided derivation's `pname` attribute and must be provided explicitly if `pname` is missing
-* `version` and `update` have no defaults and should be specified explicitly or using helper functions, when missing, `cpe` attribute will be empty, and all possible guesses using helper functions will be in `possibleCPEs` attribute.
-
-It is up to the package author to make sure all parts are correct and match expected values in [NVD dictionary](https://nvd.nist.gov/products/cpe). Unknown values can be skipped, which would leave them with the default value of `*`.
-
-Following functions help with filling out `version` and `update` fields:
-
-* [`lib.meta.cpeFullVersionWithVendor`](#function-library-lib.meta.cpeFullVersionWithVendor)
-* [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor)
-
-For many packages to make CPE available it should be enough to specify only:
-
-```nix
-{
-  # ...
-  meta.identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor vendor version;
-}
-```
-
-#### `meta.identifiers.cpe` {#var-meta-identifiers-cpe}
-
-A readonly attribute that concatenates all CPE parts in one string.
-
-#### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs}
-
-A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess.
diff --git a/lib/meta.nix b/lib/meta.nix
index cf48a700b23a..ee234d94489b 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -15,12 +15,7 @@ let
     assertMsg
     ;
   inherit (lib.attrsets) mapAttrs' filterAttrs;
-  inherit (builtins)
-    isString
-    match
-    typeOf
-    elemAt
-    ;
+  inherit (builtins) isString match typeOf;
 
 in
 rec {
@@ -489,186 +484,4 @@ rec {
     assert assertMsg (match ".*/.*" y == null)
       "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
-
-  /**
-    Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` and `version` to the output, and sets `update` to `*`.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    cpeFullVersionWithVendor :: string -> string -> AttrSet
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.cpeFullVersionWithVendor` usage example
-
-    ```nix
-    lib.meta.cpeFullVersionWithVendor "gnu" "1.2.3"
-    => {
-      vendor = "gnu";
-      version = "1.2.3";
-      update = "*";
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpeFullVersionWithVendor` usage in derivations
-
-    ```nix
-    mkDerivation rec {
-      version = "1.2.3";
-      # ...
-      meta = {
-        # ...
-        identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
-      };
-    }
-    ```
-    :::
-  */
-  cpeFullVersionWithVendor = vendor: version: {
-    inherit vendor version;
-    update = "*";
-  };
-
-  /**
-    Alternate version of [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor).
-    If `cpePatchVersionInUpdateWithVendor` succeeds, returns an attribute set with `success` set to `true` and `value` set to the result.
-    Otherwise, `success` is set to `false` and `error` is set to the string representation of the error.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    tryCPEPatchVersionInUpdateWithVendor :: string -> string -> AttrSet
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.tryCPEPatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      success = true;
-      value = {
-        vendor = "gnu";
-        version = "1.2";
-        update = "3";
-      };
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` error example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "5.3p0"
-    => {
-      success = false;
-      error = "version 5.3p0 doesn't match regex `([0-9]+\\.[0-9]+)\\.([0-9]+)`";
-    }
-    ```
-
-    :::
-  */
-  tryCPEPatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      regex = "([0-9]+\\.[0-9]+)\\.([0-9]+)";
-      # we have to call toString here in case version is an attrset with __toString attribute
-      versionMatch = builtins.match regex (toString version);
-    in
-    if versionMatch == null then
-      {
-        success = false;
-        error = "version ${version} doesn't match regex `${regex}`";
-      }
-    else
-      {
-        success = true;
-        value = {
-          inherit vendor;
-          version = elemAt versionMatch 0;
-          update = elemAt versionMatch 1;
-        };
-      };
-
-  /**
-    Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` to the result. When `version` matches `X.Y.Z` where all parts are numerical, sets `version` and `update` fields to `X.Y` and `Z`. Throws an error if the version doesn't match the expected template.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    cpePatchVersionInUpdateWithVendor :: string -> string -> AttrSet
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.cpePatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      vendor = "gnu";
-      version = "1.2";
-      update = "3";
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage in derivations
-
-    ```nix
-    mkDerivation rec {
-      version = "1.2.3";
-      # ...
-      meta = {
-        # ...
-        identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor "gnu" version;
-      };
-    }
-    ```
-
-    :::
-  */
-  cpePatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      result = tryCPEPatchVersionInUpdateWithVendor vendor version;
-    in
-    if result.success then result.value else throw result.error;
 }
diff --git a/nixos/modules/services/monitoring/gatus.nix b/nixos/modules/services/monitoring/gatus.nix
index 5954f5bd7a20..eb459ddb61ae 100644
--- a/nixos/modules/services/monitoring/gatus.nix
+++ b/nixos/modules/services/monitoring/gatus.nix
@@ -105,7 +105,8 @@ in
   config = mkIf cfg.enable {
     systemd.services.gatus = {
       description = "Automated developer-oriented status page";
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
diff --git a/nixos/tests/gatus.nix b/nixos/tests/gatus.nix
index 5bb146540fba..8f679226f067 100644
--- a/nixos/tests/gatus.nix
+++ b/nixos/tests/gatus.nix
@@ -29,6 +29,6 @@
 
   testScript = ''
     machine.wait_for_unit("gatus.service")
-    machine.succeed("curl -s http://localhost:8080/metrics | grep go_info")
+    machine.wait_until_succeeds("curl -s http://localhost:8080/metrics | grep go_info", timeout=60)
   '';
 }
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index ac3afeac899e..c247bac2ebed 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "142.0-1",
+  "packageVersion": "142.0.1-1",
   "source": {
-    "rev": "142.0-1",
-    "hash": "sha256-/bn9xeDxnJCQol/E8rhS8RVhpUj7UN+QScSIzLFnZ/o="
+    "rev": "142.0.1-1",
+    "hash": "sha256-frAMrNEGv36+SshorhjnOimT3bKe9uLaDjxbuqSp39c="
   },
   "firefox": {
-    "version": "142.0",
-    "hash": "sha512-sMHHZgg6MKkrd9zxalhNn7NBzYEdIcOjTaTNDXFP1q3HO2CAktZgWGl7xFYvqsxEhZFT5J/9624U4Fnlny6iRg=="
+    "version": "142.0.1",
+    "hash": "sha512-/KG5xnoLLyFvHxH9XjoIkgmYkh49YetjPx3ef+actAzbtjpBod/E8QIlCdpkPjeRRn2I5i5+owspPr9p2Hu1hQ=="
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index a9b27084feca..cf639b34ae8c 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,7 +9,7 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.104";
+        stable = "0.0.107";
         ptb = "0.0.156";
         canary = "0.0.745";
         development = "0.0.84";
@@ -26,7 +26,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-4w8C9YHRNTgkUBzqkW1IywKtRHvtlkihjo3/shAgPac=";
+        hash = "sha256-uL923Fc8Io0GUnQjaAl7sRahL6CO/qzNzkqk/oKkZCo=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index c965c62a8f4b..6d486e5040fe 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -85,10 +85,5 @@ stdenv.mkDerivation rec {
       ivan
     ];
     platforms = platforms.unix;
-    identifiers.cpeParts = {
-      vendor = "samba";
-      inherit version;
-      update = "-";
-    };
   };
 }
diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index 88e4c321e238..feb40041f445 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -24,7 +24,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-Lt6CzSzppu5ULhzYN5FTCWtWK3AA4/8jRzXgQkU4Tco=";
   };
 
-  cargoHash = "sha256-1opQaR3vbm/DpDY5oQ1VgA4nf0nCBknxfgOSPZQbtV4=";
+  cargoPatches = [
+    # Upgrade wasmer to 6.1.0-rc.3 to fix build failure with Rust ≥ 1.89.0
+    # https://github.com/dprint/dprint/pull/1021
+    ./upgrade-wasmer.patch
+  ];
+
+  cargoHash = "sha256-RUWyR1Yr9G2xBMigDa9+LQyaU5on85xkRQYTLH9JOPg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/dp/dprint/upgrade-wasmer.patch b/pkgs/by-name/dp/dprint/upgrade-wasmer.patch
new file mode 100644
index 000000000000..6c92628aebd2
--- /dev/null
+++ b/pkgs/by-name/dp/dprint/upgrade-wasmer.patch
@@ -0,0 +1,161 @@
+From 379cf407bfc07380dad24aefb2db40f6852f32ed Mon Sep 17 00:00:00 2001
+From: Anders Kaseorg <andersk@mit.edu>
+Date: Mon, 25 Aug 2025 18:01:57 -0700
+Subject: [PATCH] Upgrade wasmer to 6.1.0-rc.3
+
+Signed-off-by: Anders Kaseorg <andersk@mit.edu>
+---
+ Cargo.lock               | 41 ++++++++++++++++++++--------------------
+ crates/dprint/Cargo.toml |  4 ++--
+ 2 files changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 9a1bc870..bff2c81b 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -455,9 +455,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+ 
+ [[package]]
+ name = "corosensei"
+-version = "0.2.1"
++version = "0.2.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ad067b451c08956709f8762dba86e049c124ea52858e3ab8d076ba2892caa437"
++checksum = "5d1ea1c2a2f898d2a6ff149587b8a04f41ee708d248c723f01ac2f0f01edc0b3"
+ dependencies = [
+  "autocfg",
+  "cfg-if",
+@@ -776,18 +776,18 @@ dependencies = [
+ 
+ [[package]]
+ name = "derive_more"
+-version = "1.0.0"
++version = "2.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
++checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
+ dependencies = [
+  "derive_more-impl",
+ ]
+ 
+ [[package]]
+ name = "derive_more-impl"
+-version = "1.0.0"
++version = "2.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
++checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -3256,16 +3256,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f25dccc6251837449135914ee1978731c2c3df9fc727088eb7e098736c0f15d1"
++checksum = "1e588d83a5ac7eb5e6af54ac4d34183442e4dd2a7358d2a11793b17c03b7df0b"
+ dependencies = [
+  "bindgen",
+  "bytes",
+  "cfg-if",
+  "cmake",
+- "derive_more 1.0.0",
+- "idna_adapter",
++ "derive_more 2.0.1",
+  "indexmap",
+  "js-sys",
+  "more-asserts",
+@@ -3278,7 +3277,6 @@ dependencies = [
+  "target-lexicon",
+  "thiserror 1.0.61",
+  "tracing",
+- "ureq",
+  "wasm-bindgen",
+  "wasmer-compiler",
+  "wasmer-compiler-cranelift",
+@@ -3292,9 +3290,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer-compiler"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6f35baeb0d5b20710b5b9c59477dbf813b1ac53da33ee46cb22f8c4190e3986e"
++checksum = "c9542eb21b9a0f7811101e26e40e360a9ac02d093e3089c8fa62dfa102478edb"
+ dependencies = [
+  "backtrace",
+  "bytes",
+@@ -3323,9 +3321,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer-compiler-cranelift"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6d657a96003ce3f54a3cbbf681fcd782b983f9362c97cfbbe243cbf66790e004"
++checksum = "a69f548bcccd4791b2647e0d748eb8ddd4d0856233778867c8b0db3781a82ca1"
+ dependencies = [
+  "cranelift-codegen",
+  "cranelift-entity",
+@@ -3343,9 +3341,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer-derive"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "62b57be80a67de03c2a02d697bfd763e097546b11f0020cf9930ebaa4f8cf965"
++checksum = "8db532c73814748214276f878b8382a8885769fdd86d0bee2792c438b0d28c62"
+ dependencies = [
+  "proc-macro-error2",
+  "proc-macro2",
+@@ -3355,9 +3353,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer-types"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1b8424d15f5c19a8df972fc9367d75ba3b87af63b279208d50a32e9a298d944b"
++checksum = "81b900743ecb272e8e8a760a42e069f19d158d9fd03c6ac256026407bdc91833"
+ dependencies = [
+  "bytecheck 0.6.11",
+  "enum-iterator",
+@@ -3375,9 +3373,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasmer-vm"
+-version = "6.0.1"
++version = "6.1.0-rc.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "faabfffefc6fc350bb5b07301f05ba604a18c3d2d97c6354183f15792577056d"
++checksum = "40956bcf167d5bed1a940649f638e2d610e5a066863b4ab6c1ab1341fef97a9a"
+ dependencies = [
+  "backtrace",
+  "cc",
+@@ -3394,6 +3392,7 @@ dependencies = [
+  "memoffset",
+  "more-asserts",
+  "region",
++ "rustversion",
+  "scopeguard",
+  "thiserror 1.0.61",
+  "wasmer-types",
+diff --git a/crates/dprint/Cargo.toml b/crates/dprint/Cargo.toml
+index 44d107d4..af733e83 100644
+--- a/crates/dprint/Cargo.toml
++++ b/crates/dprint/Cargo.toml
+@@ -58,8 +58,8 @@ webpki-roots = "=0.26.7"
+ # patch version increases of rkyv may cause panics when deserializing
+ # data serialized with older versions
+ rkyv = "=0.8.10"
+-wasmer = "=6.0.1"
+-wasmer-compiler = "=6.0.1"
++wasmer = "=6.1.0-rc.3"
++wasmer-compiler = "=6.1.0-rc.3"
+ 
+ [target.'cfg(windows)'.dependencies]
+ winreg = "=0.55.0"
diff --git a/pkgs/by-name/du/duply/package.nix b/pkgs/by-name/du/duply/package.nix
index d3157d64781e..89f0ca4fcce3 100644
--- a/pkgs/by-name/du/duply/package.nix
+++ b/pkgs/by-name/du/duply/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "duply";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/ftplicity/duply%20%28simple%20duplicity%29/2.5.x/duply_${finalAttrs.version}.tgz";
-    hash = "sha256-ABryuV5jJNoxcJLsSjODLOHuLKrSEhY3buzy1cQh+AU=";
+    hash = "sha256-DSSnjfbcgWIuWaA+4h7d/0HqpDoXqkJOyGapYX4rtP0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 5432341d60e7..47dd74f38ba3 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -49,14 +49,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.14.2";
+  version = "3.16.15";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-l8SK8LQmFK0KeWxag7CX2lnME+HOvGpn4s3FqUNsK1Q=";
+    hash = "sha256-/JMk1ZzcVDdgvTYC+HQL09CiFDmQYWcu6/uDNgYDfdM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gatus/package.nix b/pkgs/by-name/ga/gatus/package.nix
index e06c56be4ee9..ed68d6f467e5 100644
--- a/pkgs/by-name/ga/gatus/package.nix
+++ b/pkgs/by-name/ga/gatus/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gatus";
-  version = "5.19.0";
+  version = "5.23.2";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${version}";
-    hash = "sha256-Jw7OdFGSZgxy52fICURc313ONsmI9Qlsf75aS0LUB9s=";
+    hash = "sha256-b/UQwwyspOKrW9mRoq0zJZ41lNLM+XvGFlpxz+9ZMco=";
   };
 
-  vendorHash = "sha256-CofmAYsRp0bya+q/eFJkWV9tGfhg37UxDFR9vpCKYls=";
+  vendorHash = "sha256-jMNsd7AiWG8vhUW9cLs5Ha2wmdw9SHjSDXIypvCKYqk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix
index da14a4b2898a..419a6f6b817b 100644
--- a/pkgs/by-name/ge/gemini-cli/package.nix
+++ b/pkgs/by-name/ge/gemini-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TcXCGI27qJOVbR8XaJzE9dYV/3uDM9HATU1OkziRib8=";
+    hash = "sha256-ykNgtHtH+PPCycRn9j1lc8UIEHqYj54l0MTeVz6OhsQ=";
   };
 
   patches = [
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
     ./restore-missing-dependencies-fields.patch
   ];
 
-  npmDepsHash = "sha256-i4Z/zM4jRf9Orisu0xHHa3yJsDjYSmHieF2WIKU/1iY=";
+  npmDepsHash = "sha256-gpNt581BHDA12s+3nm95UOYHjoa7Nfe46vgPwFr7ZOU=";
 
   preConfigure = ''
     mkdir -p packages/generated
diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix
index bbcce772a3aa..4e12ff39093e 100644
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@@ -55,6 +55,5 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ stv0g ];
     mainProgram = "hello";
     platforms = lib.platforms.all;
-    identifiers.cpeParts.vendor = "gnu";
   };
 })
diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index bbdadfaf7234..8069cd12f86e 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -41,13 +41,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.98";
+  version = "1.98.1";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5VP7NfHc00TdTqr5wel1vrtOnJWDGZT44tKDEm/f2iw=";
+    hash = "sha256-CJM97DRSIq2d3X6aR096+9QwBeI4kQNzxufdSoEydco=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/libnl-tiny/package.nix b/pkgs/by-name/li/libnl-tiny/package.nix
index 84d9210328e6..f0fefcc64767 100644
--- a/pkgs/by-name/li/libnl-tiny/package.nix
+++ b/pkgs/by-name/li/libnl-tiny/package.nix
@@ -3,22 +3,20 @@
   lib,
   fetchgit,
   cmake,
-  pkg-config,
 }:
 
 stdenv.mkDerivation {
   pname = "libnl-tiny";
-  version = "unstable-2023-12-05";
+  version = "0-unstable-2025-03-19";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libnl-tiny.git";
-    rev = "965c4bf49658342ced0bd6e7cb069571b4a1ddff";
-    hash = "sha256-kegTV7FXMERW7vjRZo/Xp4cbSBZmynBgge2lK71Fx94=";
+    rev = "c0df580adbd4d555ecc1962dbe88e91d75b67a4e";
+    hash = "sha256-j5oIEbWqVWd7rNpCMm9+WZwud43uTGeHG81lmzQOoeY=";
   };
 
   nativeBuildInputs = [
     cmake
-    pkg-config
   ];
 
   preConfigure = ''
@@ -30,8 +28,11 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Tiny OpenWrt fork of libnl";
     homepage = "https://git.openwrt.org/?p=project/libnl-tiny.git;a=summary";
-    license = licenses.isc;
-    maintainers = with maintainers; [ mkg20001 ];
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [
+      mkg20001
+      dvn0
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index 843c368f7282..77322466aaed 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.688";
+  version = "0.689";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-JrJoFSKvy9EqsJ7jdthLmnzQqZPIsVt9aixwaWbLp8Q=";
+    hash = "sha256-ZHALILdIJHYovSdUJk2KZIG0u/vdCAROzFd7U3pqWIk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mi/mieru/package.nix b/pkgs/by-name/mi/mieru/package.nix
index 4fe19a5d8103..141dd691f232 100644
--- a/pkgs/by-name/mi/mieru/package.nix
+++ b/pkgs/by-name/mi/mieru/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "mieru";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "enfein";
     repo = "mieru";
     rev = "v${version}";
-    hash = "sha256-0kOYAtPFIXHg/CNoPxdRot9zTfEQ2uD0wBFFBW5h2ZA=";
+    hash = "sha256-x8rddxjhmHw7J7majt4qdkXRPsfm8SATFsMxN2stN14=";
   };
 
   vendorHash = "sha256-pKcdvP38fZ2KFYNDx6I4TfmnnvWKzFDvz80xMkUojqM=";
diff --git a/pkgs/by-name/pd/pdm/package.nix b/pkgs/by-name/pd/pdm/package.nix
index c561562a50d8..3f7c847cfd00 100644
--- a/pkgs/by-name/pd/pdm/package.nix
+++ b/pkgs/by-name/pd/pdm/package.nix
@@ -15,7 +15,7 @@ let
       resolvelib = super.resolvelib.overridePythonAttrs (old: rec {
         version = "1.1.0";
         src = old.src.override {
-          rev = version;
+          tag = version;
           hash = "sha256-UBdgFN+fvbjz+rp8+rog8FW2jwO/jCfUPV7UehJKiV8=";
         };
       });
diff --git a/pkgs/by-name/pr/proxify/package.nix b/pkgs/by-name/pr/proxify/package.nix
index 1a313caa2423..178e6d37f64f 100644
--- a/pkgs/by-name/pr/proxify/package.nix
+++ b/pkgs/by-name/pr/proxify/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "proxify";
-  version = "0.0.15";
+  version = "0.0.16";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "proxify";
     tag = "v${version}";
-    hash = "sha256-vAI8LKdBmujH7zidXADc8bMLXaFMjT965hR+PVZVeNw=";
+    hash = "sha256-CctbeKMf4+E+Fh/0hWLwHdTTsAavkiJ2ziMumY/+oF8=";
   };
 
-  vendorHash = "sha256-eGcCc83napjt0VBhpDiHWn7+ew77XparDJ9uyjF353w=";
+  vendorHash = "sha256-7bOnLv2IJ9tysvZm33wBeMHvdSBDg1ii/QXv2n1wqxw=";
 
   meta = {
     description = "Proxy tool for HTTP/HTTPS traffic capture";
diff --git a/pkgs/by-name/pu/pulumi/package.nix b/pkgs/by-name/pu/pulumi/package.nix
index 088bb4e1a1f4..e981ff31fedc 100644
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@@ -17,18 +17,18 @@
 }:
 buildGoModule rec {
   pname = "pulumi";
-  version = "3.190.0";
+  version = "3.192.0";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumi";
     tag = "v${version}";
-    hash = "sha256-n4YjJJZNPRjvR5WuDO3+bCvKxDrmK7VBbS6E6RP0C84=";
+    hash = "sha256-rcDXC+xlUa67afuXvmEv8UNsYWBvQQ0P4httdtdcrh4=";
     # Some tests rely on checkout directory name
     name = "pulumi";
   };
 
-  vendorHash = "sha256-ewVZNgnW7JbX0VOU14Ipo7EBkj8evOoXWjf9yLOmJF8=";
+  vendorHash = "sha256-BaFw8EnPd2GPA/p9wm8XpVy/iE8gqbteRnMQC8Z4NHQ=";
 
   sourceRoot = "${src.name}/pkg";
 
@@ -68,6 +68,10 @@ buildGoModule rec {
         # Seems to require TTY.
         "TestProgressEvents"
 
+        # Flaky; upstream “fixed” it by increasing timeout.
+        # https://github.com/pulumi/pulumi/pull/20116
+        "TestAnalyzerCancellation"
+
         # Tries to clone repo: https://github.com/pulumi/test-repo.git
         "TestValidateRelativeDirectory"
         "TestRepoLookup"
@@ -83,6 +87,8 @@ buildGoModule rec {
         "TestPulumiNewWithoutTemplateSupport"
         "TestGeneratingProjectWithAIPromptSucceeds"
         "TestPulumiNewWithRegistryTemplates"
+        "TestRunNewYesNoTemplate"
+        "TestRunNewYesWithTemplate"
 
         # Connects to https://api.pulumi.com/…
         "TestGetLatestPluginIncludedVersion"
@@ -156,18 +162,17 @@ buildGoModule rec {
         version = "v${version}";
         command = "PULUMI_SKIP_UPDATE_CHECK=1 pulumi version";
       };
+
       # Test building packages that reuse our version and src.
       inherit (pulumiPackages) pulumi-go pulumi-nodejs pulumi-python;
-      # Pulumi currently requires protobuf4, but Nixpkgs defaults to a newer
-      # version. Test that we can actually build the package with protobuf4.
-      # https://github.com/pulumi/pulumi/issues/16828
-      # https://github.com/NixOS/nixpkgs/issues/351751#issuecomment-2462163436
-      pythonPackage =
+      pythonPackage = python3Packages.pulumi;
+      pythonPackageProtobuf5 =
         (python3Packages.overrideScope (
           final: _: {
-            protobuf = final.protobuf4;
+            protobuf = final.protobuf5;
           }
         )).pulumi;
+
       pulumiTestHookShellcheck = testers.shellcheck {
         name = "pulumi-test-hook-shellcheck";
         src = ./extra/pulumi-test-hook.sh;
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
index 4632c8353e82..1958b04eeb03 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/go/pulumi-language-go";
 
-  vendorHash = "sha256-SfnGZyHuhgj277DrRqr8TkKE+ZwnPKBFu/7EcPS4OhE=";
+  vendorHash = "sha256-jwsdMSLDn2PNJFIIVhqwBLH7acFTOFLPgVNMKbI5DZE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
index 862436c760dc..af7be805670f 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";
 
-  vendorHash = "sha256-Mf/SsRRDlm/TuSOksLV8f7H7xiT6fkHWyH6fJFo5fCc=";
+  vendorHash = "sha256-Q5Pk2f3EAiM4oit1vhc+PMEuMxdbrKAue3e0pnrZw2c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
index 4672f754ed1e..dfda8bf7764b 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";
 
-  vendorHash = "sha256-cpmB1Vmi8JAh+OKzoZ/x/AxB4uxH95laSo0uBGrj3FQ=";
+  vendorHash = "sha256-BfkjDesPdPDV2uILYaMJFIvaEBKT15ukwaReAL3yziw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 7319dde4af42..3265160fe9fe 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.8.4";
+  version = "25.8.7";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6DrwdimHuCLcmSiOGghvJajowbhWh8arnL/iPPxfopQ=";
+    hash = "sha256-OBLFdJAiBleymmWVDYIu7zeMNDU++HAlyPJi5qSoRO4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ti/tile38/package.nix b/pkgs/by-name/ti/tile38/package.nix
index b35432d91348..5fd0424d0965 100644
--- a/pkgs/by-name/ti/tile38/package.nix
+++ b/pkgs/by-name/ti/tile38/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tile38";
-  version = "1.36.0";
+  version = "1.36.1";
 
   src = fetchFromGitHub {
     owner = "tidwall";
     repo = "tile38";
     tag = version;
-    hash = "sha256-FJ1I82ECCit6FV0F5VfY5xa6qCEqZo47KdnY0vwRGzg=";
+    hash = "sha256-65zUbnnksLCWCsOjO8xzyhJ2IKhPg6tttywvApzf7mw=";
   };
 
-  vendorHash = "sha256-hpqH/+MlXPz3NZ0ooyWwf1Rg2UeKW49xQ0KbCFIi7jc=";
+  vendorHash = "sha256-J8kWsbU8onvXeVLGGBX9P6hYuGy50fG+m1nFg6phBMk=";
 
   subPackages = [
     "cmd/tile38-cli"
diff --git a/pkgs/by-name/tr/tribler/package.nix b/pkgs/by-name/tr/tribler/package.nix
index a503f1e4cb05..8fcbc3aa3ff2 100644
--- a/pkgs/by-name/tr/tribler/package.nix
+++ b/pkgs/by-name/tr/tribler/package.nix
@@ -1,136 +1,160 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchPypi,
-  python311,
+  python312,
   makeWrapper,
-  libtorrent-rasterbar-1_2_x,
-  qt5,
   nix-update-script,
-  boost186,
+  fetchFromGitHub,
+  rustPlatform,
+  buildNpmPackage,
+  nodejs_24,
+  wrapGAppsHook3,
+  libappindicator-gtk3,
 }:
-
 let
-  # libtorrent-rasterbar-1_2_x requires python311 and boost 1.86
-  python3 = python311.override {
-    packageOverrides = final: prev: {
-      boost = boost186;
-    };
+  version = "8.2.3";
+  python3 = python312;
+  nodejs = nodejs_24;
+
+  src = fetchFromGitHub {
+    owner = "tribler";
+    repo = "Tribler";
+    tag = "v${version}";
+    hash = "sha256-yThl3HhPtwi/pK5Rcr2ClVLY8uCnIyfvdc53A8gjKDg=";
   };
-  libtorrent = (python3.pkgs.toPythonModule (libtorrent-rasterbar-1_2_x)).python;
+
+  tribler-webui = buildNpmPackage {
+    inherit nodejs version;
+    pname = "tribler-webui";
+    src = "${src}/src/tribler/ui";
+    npmDepsHash = "sha256-bgRwhqP6/NMPFbZks31IZtVGV9wzFFU6qSgyLvdarlY=";
+
+    # The prepack script runs the build script, which we'd rather do in the build phase.
+    npmPackFlags = [ "--ignore-scripts" ];
+
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    dontNpmBuild = true;
+    dontNpmInstall = true;
+
+    installPhase = ''
+      mkdir -pv $out
+      cp -prvd ./* $out/
+      cd $out
+      npm install
+      npm run build
+    '';
+  };
+
 in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tribler";
-  version = "7.14.0";
 
-  src = fetchurl {
-    url = "https://github.com/Tribler/tribler/releases/download/v${finalAttrs.version}/Tribler-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fQJOs9P4y71De/+svmD7YZ4+tm/bC3rspm7SbOHlSR4=";
-  };
+python3.pkgs.buildPythonApplication {
+  inherit version src;
+  name = "tribler";
+  pyproject = true;
 
-  patches = [
-    ./startupwmclass.patch
+  build-system = with python3.pkgs; [
+    setuptools
   ];
 
-  nativeBuildInputs = [
-    python3.pkgs.wrapPython
-    makeWrapper
-    # we had a "copy" of this in tribler's makeWrapper
-    # but it went out of date and broke, so please just use it directly
-    qt5.wrapQtAppsHook
-  ];
-
-  buildInputs = [ python3.pkgs.python ];
-
-  pythonPath = [
-    libtorrent
-  ]
-  ++ (with python3.pkgs; [
-    # requirements-core.txt
-    aiohttp
-    aiohttp-apispec
-    anyio
-    chardet
-    configobj
-    cryptography
-    decorator
-    faker
-    libnacl
-    lz4
-    marshmallow
-    netifaces
-    networkx
-    pony
-    psutil
-    pyasn1
-    pydantic_1
-    pyopenssl
-    pyyaml
-    sentry-sdk
-    service-identity
-    yappi
-    yarl
-    bitarray
-    filelock
-    (pyipv8.overrideAttrs (p: rec {
-      version = "2.10.0";
-      src = fetchPypi {
-        inherit (p) pname;
-        inherit version;
-        hash = "sha256-yxiXBxBiPokequm+vjsHIoG9kQnRnbsOx3mYOd8nmiU=";
-      };
-    }))
-    file-read-backwards
-    brotli
-    human-readable
+  dependencies = with python3.pkgs; [
     # requirements.txt
+    bitarray
+    configobj
+    pyipv8
+    ipv8-rust-tunnels
+    libtorrent-rasterbar
+    lz4
     pillow
-    pyqt5
-    pyqt5-sip
-    pyqtgraph
-    pyqtwebengine
-  ]);
+    pony
+    pystray
+  ];
 
-  installPhase = ''
-    mkdir -pv $out
-    # Nasty hack; call wrapPythonPrograms to set program_PYTHONPATH.
-    wrapPythonPrograms
-    cp -prvd ./* $out/
-    makeWrapper ${python3.pkgs.python}/bin/python $out/bin/tribler \
-        --set _TRIBLERPATH "$out/src" \
-        --set PYTHONPATH $out/src/tribler-core:$out/src/tribler-common:$out/src/tribler-gui:$program_PYTHONPATH \
-        --set NO_AT_BRIDGE 1 \
-        --chdir "$out/src" \
-        --add-flags "-O $out/src/run_tribler.py"
+  buildInputs = with python3.pkgs; [
+    # setup.py requirements
+    pygobject3
+    setuptools
+    # sphinx requirements
+    sphinxHook
+    sphinx
+    sphinx-autoapi
+    sphinx-rtd-theme
+    astroid
+    # tray icon deps
+    wrapGAppsHook3
+    libappindicator-gtk3
+    # test phase requirements
+    pytestCheckHook
 
-    mkdir -p $out/share/applications $out/share/icons
-    cp $out/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop $out/share/applications/
-    cp $out/build/debian/tribler/usr/share/pixmaps/tribler_big.xpm $out/share/icons/tribler.xpm
-    mkdir -p $out/share/copyright/tribler
-    mv $out/LICENSE $out/share/copyright/tribler
+  ];
+
+  outputs = [
+    "out"
+  ];
+
+  buildPhase = ''
+          # fix the entrypoint
+          substituteInPlace build/setup.py --replace-fail '"tribler=tribler.run:main"' '"tribler=tribler.run:main_sync"'
+          substituteInPlace src/run_tribler.py --replace-fail 'if __name__ == "__main__":' 'def main_sync():'
+
+          # copy the built webui
+          rm -r src/tribler/ui
+          ln -s ${tribler-webui} src/tribler/ui
+
+          # build the docs
+    # FIXME:      make doc SPHINXBUILD=${lib.getExe' python3.pkgs.sphinx "sphinx-build"}
+
+          # build the wheel
+          substituteInPlace build/win/build.py --replace-fail "if {'setup.py', 'bdist_wheel'}.issubset(sys.argv):" "if True:"
+          export GITHUB_TAG=v${version}
+          python3 build/debian/update_metainfo.py
+          python3 build/setup.py bdist_wheel
+
+        runHook pytestCheckHook
+
+          # build the docs
+        runHook sphinxHook
   '';
 
-  shellHook = ''
-    wrapPythonPrograms || true
-    export QT_QPA_PLATFORM_PLUGIN_PATH=$(echo ${qt5.qtbase.bin}/lib/qt-*/plugins/platforms)
-    export PYTHONPATH=./tribler-core:./tribler-common:./tribler-gui:$program_PYTHONPATH
-    export QT_PLUGIN_PATH="${qt5.qtsvg.bin}/${qt5.qtbase.qtPluginPrefix}"
+  postInstall = ''
+    ln -s ${tribler-webui} $out/lib/python3.12/site-packages/tribler/ui
   '';
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ libappindicator-gtk3 ]}"
+    )
+  '';
+
+  postFixup = ''
+    runHook wrapGAppsHook3
+  '';
+
+  disabledTests = [
+    "test_request_for_version"
+    "test_establish_connection"
+    "test_tracker_test_error_resolve"
+    "test_get_default_fallback"
+    "test_get_default_fallback_half_tree"
+    "test_get_set_explicit"
+  ];
+
+  disabledTestPaths = [
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Decentralised P2P filesharing client based on the Bittorrent protocol";
+    description = "Decentralized P2P filesharing client based on the Bittorrent protocol";
     mainProgram = "tribler";
     homepage = "https://www.tribler.org/";
-    changelog = "https://github.com/Tribler/tribler/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.lgpl21Plus;
+    changelog = "https://github.com/Tribler/tribler/releases/tag/v${version}";
+    license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
-      xvapx
-
       mkg20001
+      mlaradji
+      xvapx
     ];
     platforms = lib.platforms.linux;
   };
-})
+}
diff --git a/pkgs/by-name/tr/tribler/startupwmclass.patch b/pkgs/by-name/tr/tribler/startupwmclass.patch
deleted file mode 100644
index ce1ec9e4a59a..000000000000
--- a/pkgs/by-name/tr/tribler/startupwmclass.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-diff --git a/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop b/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
-index b0472a18d..0e0be14f3 100644
---- a/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
-+++ b/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
-@@ -7,3 +7,4 @@ Terminal=false
- Type=Application
- Categories=Application;Network;P2P
- MimeType=x-scheme-handler/ppsp;x-scheme-handler/tswift;x-scheme-handler/magnet;application/x-bittorrent
-+StartupWMClass=Tribler
diff --git a/pkgs/by-name/vk/vkd3d/package.nix b/pkgs/by-name/vk/vkd3d/package.nix
index 13e31f9fcb14..28c81fcb2010 100644
--- a/pkgs/by-name/vk/vkd3d/package.nix
+++ b/pkgs/by-name/vk/vkd3d/package.nix
@@ -4,6 +4,7 @@
   bison,
   fetchFromGitLab,
   flex,
+  perlPackages,
   pkg-config,
   spirv-headers,
   stdenv,
@@ -14,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vkd3d";
-  version = "1.15";
+  version = "1.17";
 
   src = fetchFromGitLab {
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "vkd3d";
-    rev = "vkd3d-${finalAttrs.version}";
-    hash = "sha256-EzXsYi9wC+JdMYE77cIeO2lV+fY4ViQM3+KcAJFv9tU=";
+    tag = "vkd3d-${finalAttrs.version}";
+    hash = "sha256-jxQ9L1GL4j3P5/nb79qAXQp8/IStOWmiK/vvbFxeg1k=";
   };
 
   outputs = [
@@ -34,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
     bison
     flex
+    perlPackages.perl
+    perlPackages.JSON
     pkg-config
     wine
   ];
@@ -61,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = with lib.licenses; [ lgpl21Plus ];
     mainProgram = "vkd3d-compiler";
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ liberodark ];
     inherit (wine.meta) platforms;
   };
 })
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 14dc685172c4..3c91d8bfea8c 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.201.6";
+  version = "0.201.8";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d1B04N5KS34ghUHOhStkCMZZosQe2yG2cu88KVxujKY=";
+    hash = "sha256-y7pWGdq7r675JnBFQwcB4QLn/0aFxpkwK7CjX0Ox+lk=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --replace-fail "inner.redirect(policy)" "inner.redirect_policy(policy)"
     '';
 
-  cargoHash = "sha256-npuNvJUN9ENNB1G8kwcz8dRdFoLBJ/UgQHd+9ojW8PI=";
+  cargoHash = "sha256-20pOYcodc2jflxibY0I0+SSC1FTxB8Jw03kcihCnBOY=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/compilers/flutter/versions/3_35/data.json b/pkgs/development/compilers/flutter/versions/3_35/data.json
index 683e5ea6230b..94de9bf9b4d5 100644
--- a/pkgs/development/compilers/flutter/versions/3_35/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_35/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "3.35.1",
-  "engineVersion": "1e9a811bf8e70466596bcf0ea3a8b5adb5f17f7f",
+  "version": "3.35.2",
+  "engineVersion": "a8bfdfc394deaed5c57bd45a64ac4294dc976a72",
   "engineSwiftShaderHash": "sha256-ATVcuxqPHqHOWYyO7DoX9LdgUiO3INUi7m9Mc6ccc1M=",
   "engineSwiftShaderRev": "d040a5bab638bf7c226235c95787ba6288bb6416",
   "channel": "stable",
   "engineHashes": {
     "aarch64-linux": {
-      "aarch64-linux": "sha256-A25De1Xqz5Tx63hx43xt+r/cH4TEbaSMMSxu3J114n4=",
-      "x86_64-linux": "sha256-A25De1Xqz5Tx63hx43xt+r/cH4TEbaSMMSxu3J114n4="
+      "aarch64-linux": "sha256-igJHgYBcmd7H9wkfe1lD5dAPio+Ivf5yXqV9E3xEtSY=",
+      "x86_64-linux": "sha256-igJHgYBcmd7H9wkfe1lD5dAPio+Ivf5yXqV9E3xEtSY="
     },
     "x86_64-linux": {
-      "aarch64-linux": "sha256-0XT18p8kcfepSG84p8Un0I71pLwJyBlH3wscCmJ9z2Q=",
-      "x86_64-linux": "sha256-0XT18p8kcfepSG84p8Un0I71pLwJyBlH3wscCmJ9z2Q="
+      "aarch64-linux": "sha256-rJSkU4oRGdIgJUbplvMjWzHC1vEAljmbQPHr43hM25w=",
+      "x86_64-linux": "sha256-rJSkU4oRGdIgJUbplvMjWzHC1vEAljmbQPHr43hM25w="
     }
   },
   "dartVersion": "3.9.0",
@@ -21,53 +21,53 @@
     "x86_64-darwin": "sha256-JNN27p/a9+7xcIkrLLM2Tuyih5R2Q0YibXqcm3QXc8U=",
     "aarch64-darwin": "sha256-VG0o4b0dPTXQmABr3+iO+xv/2IcXFt018CQYnD4kXAs="
   },
-  "flutterHash": "sha256-1G7PZLMm0VsT0CWygxOk0GGiXbtJGIBBvccQcaqV+EQ=",
+  "flutterHash": "sha256-g9g10WVf7CNoXYN8DVsWRK9N2Gz/2iQufMiQkJC35ZA=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-CEf/NUC06z7IhB4tSzIV6jia/3OElUaqNgYM9P6emQM=",
-      "aarch64-linux": "sha256-7q/ewvhysJ5SVdkILK0qkX1fw4GKi/U82sRq6JX6fzA=",
-      "x86_64-darwin": "sha256-CEf/NUC06z7IhB4tSzIV6jia/3OElUaqNgYM9P6emQM=",
-      "x86_64-linux": "sha256-7q/ewvhysJ5SVdkILK0qkX1fw4GKi/U82sRq6JX6fzA="
+      "aarch64-darwin": "sha256-niFZajz1h1MsHxb6aqJuc3uQC269Y1/D9TzS38+wkaA=",
+      "aarch64-linux": "sha256-BTcZlYd4LtSIlE25m0Lwde36Uhg0j4I9AhB10V6RiFY=",
+      "x86_64-darwin": "sha256-niFZajz1h1MsHxb6aqJuc3uQC269Y1/D9TzS38+wkaA=",
+      "x86_64-linux": "sha256-BTcZlYd4LtSIlE25m0Lwde36Uhg0j4I9AhB10V6RiFY="
     },
     "fuchsia": {
-      "aarch64-darwin": "sha256-gFqWUHEGh1fpyuiDRYOzEG2mKbDfBxP0TAfJ7nU0D+s=",
-      "aarch64-linux": "sha256-gFqWUHEGh1fpyuiDRYOzEG2mKbDfBxP0TAfJ7nU0D+s=",
-      "x86_64-darwin": "sha256-gFqWUHEGh1fpyuiDRYOzEG2mKbDfBxP0TAfJ7nU0D+s=",
-      "x86_64-linux": "sha256-gFqWUHEGh1fpyuiDRYOzEG2mKbDfBxP0TAfJ7nU0D+s="
+      "aarch64-darwin": "sha256-e6IrgTD8fCM6+buSkQNl9nXbWKm4cRCFamWqXiFLcLo=",
+      "aarch64-linux": "sha256-e6IrgTD8fCM6+buSkQNl9nXbWKm4cRCFamWqXiFLcLo=",
+      "x86_64-darwin": "sha256-e6IrgTD8fCM6+buSkQNl9nXbWKm4cRCFamWqXiFLcLo=",
+      "x86_64-linux": "sha256-e6IrgTD8fCM6+buSkQNl9nXbWKm4cRCFamWqXiFLcLo="
     },
     "ios": {
-      "aarch64-darwin": "sha256-h0fXGxzmzikdYdTrbG4+kzxj/kX5/Pz70SEcAK/KKTs=",
-      "aarch64-linux": "sha256-h0fXGxzmzikdYdTrbG4+kzxj/kX5/Pz70SEcAK/KKTs=",
-      "x86_64-darwin": "sha256-h0fXGxzmzikdYdTrbG4+kzxj/kX5/Pz70SEcAK/KKTs=",
-      "x86_64-linux": "sha256-h0fXGxzmzikdYdTrbG4+kzxj/kX5/Pz70SEcAK/KKTs="
+      "aarch64-darwin": "sha256-li5fk3EaAUwoTh65pY6UlqXuPSxmV0BvESHshMKayew=",
+      "aarch64-linux": "sha256-li5fk3EaAUwoTh65pY6UlqXuPSxmV0BvESHshMKayew=",
+      "x86_64-darwin": "sha256-li5fk3EaAUwoTh65pY6UlqXuPSxmV0BvESHshMKayew=",
+      "x86_64-linux": "sha256-li5fk3EaAUwoTh65pY6UlqXuPSxmV0BvESHshMKayew="
     },
     "linux": {
-      "aarch64-darwin": "sha256-DqDfJGNm91wT927OoBYO+h5biif/993ebrPj+I8sMrg=",
-      "aarch64-linux": "sha256-DqDfJGNm91wT927OoBYO+h5biif/993ebrPj+I8sMrg=",
-      "x86_64-darwin": "sha256-7AWtDjucIOEHc77Ff2FUoh09GUbMzwZQ9r2MAv9atQs=",
-      "x86_64-linux": "sha256-7AWtDjucIOEHc77Ff2FUoh09GUbMzwZQ9r2MAv9atQs="
+      "aarch64-darwin": "sha256-8q40JUNVYSdsKBbvdrcB/5OxjR5ZcLheGTHFja/We4U=",
+      "aarch64-linux": "sha256-8q40JUNVYSdsKBbvdrcB/5OxjR5ZcLheGTHFja/We4U=",
+      "x86_64-darwin": "sha256-B8j4FoHyQXY+/EcV9WHE+Lo6E27+uOnfCmDYggRCFKI=",
+      "x86_64-linux": "sha256-B8j4FoHyQXY+/EcV9WHE+Lo6E27+uOnfCmDYggRCFKI="
     },
     "macos": {
-      "aarch64-darwin": "sha256-x/6qDRviSVg0Z3fPN/c9iJn75csvuxJj1ytONcQ7ueo=",
-      "aarch64-linux": "sha256-x/6qDRviSVg0Z3fPN/c9iJn75csvuxJj1ytONcQ7ueo=",
-      "x86_64-darwin": "sha256-x/6qDRviSVg0Z3fPN/c9iJn75csvuxJj1ytONcQ7ueo=",
-      "x86_64-linux": "sha256-x/6qDRviSVg0Z3fPN/c9iJn75csvuxJj1ytONcQ7ueo="
+      "aarch64-darwin": "sha256-QQ+17TPTB0FTogOkyPRQkII65t03+xVJ3q7CnIhw5vA=",
+      "aarch64-linux": "sha256-QQ+17TPTB0FTogOkyPRQkII65t03+xVJ3q7CnIhw5vA=",
+      "x86_64-darwin": "sha256-QQ+17TPTB0FTogOkyPRQkII65t03+xVJ3q7CnIhw5vA=",
+      "x86_64-linux": "sha256-QQ+17TPTB0FTogOkyPRQkII65t03+xVJ3q7CnIhw5vA="
     },
     "universal": {
-      "aarch64-darwin": "sha256-+EfVH+XpI4d/UlFs6rZKdfK00IzDFz9o4CuzJRdDNfw=",
-      "aarch64-linux": "sha256-1jYtJ/toFDfUG2HIKyM1XT9rl0Fzl3or67q9ZVl1vDg=",
-      "x86_64-darwin": "sha256-nACkicnu+Pkimpyx3q/uxUcLz/xAExLbXHl+Ex4kFzA=",
-      "x86_64-linux": "sha256-XGxRc2LOqgxd8Zbd2XWhA6yj39WJCa5DC5UGYIiw4RY="
+      "aarch64-darwin": "sha256-Nv36HXVFlpGTmWlobDiMJczVIgUShvoVi8dqAWpbkJM=",
+      "aarch64-linux": "sha256-SlB09ZiXtz3DJSiv9gTy4ogHpJ9JRVzgy2nmqqmGMYs=",
+      "x86_64-darwin": "sha256-yZbzy+DNREPxzZ/F6BdjmQoOrUE+5rIw6E4CuUePPWQ=",
+      "x86_64-linux": "sha256-AdA1xjD5nkBTzp7k1FLe218FD9o1aSJHZx1nOyhneGY="
     },
     "web": {
-      "aarch64-darwin": "sha256-dltAxQPWbNoVDxz7qEc0NnE1xjDeB7r3eAwQU2iH1Vs=",
-      "aarch64-linux": "sha256-dltAxQPWbNoVDxz7qEc0NnE1xjDeB7r3eAwQU2iH1Vs=",
-      "x86_64-darwin": "sha256-dltAxQPWbNoVDxz7qEc0NnE1xjDeB7r3eAwQU2iH1Vs=",
-      "x86_64-linux": "sha256-dltAxQPWbNoVDxz7qEc0NnE1xjDeB7r3eAwQU2iH1Vs="
+      "aarch64-darwin": "sha256-kq7rn++V7zp78DszHBQuMUB/qpsbwt2kSscSJPnL1KQ=",
+      "aarch64-linux": "sha256-kq7rn++V7zp78DszHBQuMUB/qpsbwt2kSscSJPnL1KQ=",
+      "x86_64-darwin": "sha256-kq7rn++V7zp78DszHBQuMUB/qpsbwt2kSscSJPnL1KQ=",
+      "x86_64-linux": "sha256-kq7rn++V7zp78DszHBQuMUB/qpsbwt2kSscSJPnL1KQ="
     },
     "windows": {
-      "x86_64-darwin": "sha256-D/B3prbqobFlHO0dvq8fKcavqXxrvX3kqfDpma7QfNQ=",
-      "x86_64-linux": "sha256-D/B3prbqobFlHO0dvq8fKcavqXxrvX3kqfDpma7QfNQ="
+      "x86_64-darwin": "sha256-Q6Afxmf3j6SJFhWXRnyVrf4n3+hQ6baWPAoxi4eyY5o=",
+      "x86_64-linux": "sha256-Q6Afxmf3j6SJFhWXRnyVrf4n3+hQ6baWPAoxi4eyY5o="
     }
   },
   "pubspecLock": {
@@ -346,11 +346,11 @@
         "dependency": "direct main",
         "description": {
           "name": "dwds",
-          "sha256": "b14203ae57d2ef575d115e30a303c7fe643c5e6af5acfb1330d4c57091ee11c6",
+          "sha256": "b2f7e3241de2adbd5caa87ae9d05a0f9c59b9cbb8c77aeaeebf6c277821f25d5",
           "url": "https://pub.dev"
         },
         "source": "hosted",
-        "version": "24.4.0"
+        "version": "24.4.0+1"
       },
       "extension_discovery": {
         "dependency": "direct main",
diff --git a/pkgs/development/compilers/gcc/common/meta.nix b/pkgs/development/compilers/gcc/common/meta.nix
index e0325feafbe8..c69f9956ddfc 100644
--- a/pkgs/development/compilers/gcc/common/meta.nix
+++ b/pkgs/development/compilers/gcc/common/meta.nix
@@ -30,5 +30,4 @@ in
   teams = [ teams.gcc ];
   mainProgram = "${targetPrefix}gcc";
 
-  identifiers.cpeParts.vendor = "gnu";
 }
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index a79cfed28598..3e78d7946b5d 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -419,7 +419,6 @@ pipe
           platforms
           teams
           mainProgram
-          identifiers
           ;
       };
     }
diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
index 800f2000e68c..1a17e39a0690 100644
--- a/pkgs/development/compilers/llvm/common/common-let.nix
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -34,8 +34,6 @@ rec {
       ++ lib.optionals (lib.versionAtLeast release_version "7") lib.platforms.riscv
       ++ lib.optionals (lib.versionAtLeast release_version "14") lib.platforms.m68k
       ++ lib.optionals (lib.versionAtLeast release_version "16") lib.platforms.loongarch64;
-
-    identifiers.cpeParts.vendor = "llvm";
   };
 
   releaseInfo =
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index f186fbc82412..86aef1036258 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "0-unstable-2024-12-19";
+  version = "0-unstable-2025-07-23";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "3868f47c8f6c6570e62a3cdf8a7f26ffb1a67e6a";
-    hash = "sha256-rACcvyMhksw5A+Tkn6XiTqz1DHK23YKRHL7j3CEccr4=";
+    rev = "49056d178f42da98048a5d4c23f83a6f6bc6dd80";
+    hash = "sha256-sk5r18M0hJ+8CrC2G/rb+XqUmUGer2VBrVbuReHj1dM=";
   };
 
   cmakeFlags = [
@@ -56,6 +56,7 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [
       fpletz
       mkg20001
+      dvn0
     ];
     mainProgram = "jshn";
     platforms = platforms.all;
diff --git a/pkgs/development/python-modules/aiohttp-apispec/default.nix b/pkgs/development/python-modules/aiohttp-apispec/default.nix
index ec0b6391daa4..55584cea286c 100644
--- a/pkgs/development/python-modules/aiohttp-apispec/default.nix
+++ b/pkgs/development/python-modules/aiohttp-apispec/default.nix
@@ -27,11 +27,15 @@ buildPythonPackage rec {
     hash = "sha256-C+/M25oCLTNGGEUj2EyXn3UjcvPvDYFmmUW8IOoF1uU=";
   };
 
-  postPatch = ''
-    substituteInPlace tests/conftest.py \
-      --replace-fail 'aiohttp_app(loop,' 'aiohttp_app(event_loop,' \
-      --replace-fail 'return loop.run_until_complete' 'return event_loop.run_until_complete'
-  '';
+  doCheck = false;
+
+  /*
+    postPatch = ''
+      substituteInPlace tests/conftest.py \
+        --replace-fail 'aiohttp_app(loop,' 'aiohttp_app(event_loop,' \
+        --replace-fail 'return loop.run_until_complete' 'return event_loop.run_until_complete'
+    '';
+  */
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index b094970f2bdd..760a30469aad 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -17,6 +17,7 @@
   importlib-metadata,
 
   # tests
+  addBinToPathHook,
   ansible-core,
   glibcLocales,
   mock,
@@ -26,6 +27,7 @@
   pytest-xdist,
   pytestCheckHook,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -60,6 +62,7 @@ buildPythonPackage rec {
   ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
 
   nativeCheckInputs = [
+    addBinToPathHook
     ansible-core # required to place ansible CLI onto the PATH in tests
     glibcLocales
     mock
@@ -69,12 +72,11 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
     versionCheckHook
+    writableTmpDirAsHomeHook
   ];
   versionCheckProgramArg = "--version";
 
   preCheck = ''
-    export HOME=$(mktemp -d)
-    export PATH="$PATH:$out/bin";
     # avoid coverage flags
     rm pytest.ini
   '';
@@ -90,8 +92,10 @@ buildPythonPackage rec {
     # Assertion error
     "test_callback_plugin_censoring_does_not_overwrite"
     "test_get_role_list"
+    "test_include_role_events"
     "test_include_role_from_collection_events"
     "test_module_level_no_log"
+    "test_output_when_given_invalid_playbook"
     "test_resolved_actions"
   ];
 
diff --git a/pkgs/development/python-modules/argos-translate-files/default.nix b/pkgs/development/python-modules/argos-translate-files/default.nix
index c0917a76e03c..522ddeabbe35 100644
--- a/pkgs/development/python-modules/argos-translate-files/default.nix
+++ b/pkgs/development/python-modules/argos-translate-files/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "argos-translate-files";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vKnPL0xgyJ1vYtB2AgnKv4BqigSiFYmIm5HBq4hQ7nI=";
+    hash = "sha256-9ufNuExfyW3gr8+pIpp6Ie03e0hE4l3l3kk6EiVH0x8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/datrie/default.nix b/pkgs/development/python-modules/datrie/default.nix
index c76e36e6b21f..2d8b72098220 100644
--- a/pkgs/development/python-modules/datrie/default.nix
+++ b/pkgs/development/python-modules/datrie/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "datrie";
-  version = "0.8.2";
+  version = "0.8.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UlsI9jjVz2EV32zNgY5aASmM0jCy2skcj/LmSZ0Ydl0=";
+    hash = "sha256-6gIa1MiovxTginHHhypiKqOZpRD5gSloJQkcfKBDboA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dnfile/default.nix b/pkgs/development/python-modules/dnfile/default.nix
index 4edf3e8ba16b..4279f0ea4859 100644
--- a/pkgs/development/python-modules/dnfile/default.nix
+++ b/pkgs/development/python-modules/dnfile/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dnfile";
-  version = "0.16.4";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "malwarefrank";
     repo = "dnfile";
     tag = "v${version}";
-    hash = "sha256-xizjWY+ByGDOI7HyzT5U4vqmPT2woU7z/3eV0KXDb8Y=";
+    hash = "sha256-JiJ7qvBP0SDGMynQuu2AyCwHU9aDI7Pq5/Z9IiWPWng=";
     fetchSubmodules = true;
   };
 
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to parse .NET executable files";
     homepage = "https://github.com/malwarefrank/dnfile";
-    changelog = "https://github.com/malwarefrank/dnfile/blob/v${version}/HISTORY.rst";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/malwarefrank/dnfile/blob/${src.tag}/HISTORY.rst";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/ipv8-rust-tunnels/default.nix b/pkgs/development/python-modules/ipv8-rust-tunnels/default.nix
new file mode 100644
index 000000000000..657d58c7cc4d
--- /dev/null
+++ b/pkgs/development/python-modules/ipv8-rust-tunnels/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchPypi,
+  buildPythonPackage,
+}:
+
+buildPythonPackage rec {
+  pname = "ipv8-rust-tunnels";
+  version = "0.1.33";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "ipv8_rust_tunnels";
+    hash = "sha256-LwQL/u+h6mwCo207OxSk9YKxuLuxXQhh07rSWrNFh7w=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-NwYLez9NFgS0GBXrcNrKJKV+s4HIHM8jHXfmkgya03M=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  meta = with lib; {
+    description = "A set of performance enhancements to the TunnelCommunity, the anonymization layer used in IPv8 and Tribler";
+    homepage = "https://github.com/Tribler/ipv8-rust-tunnels";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ mlaradji ];
+  };
+}
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 8c055851158a..028cf5eb648d 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.5.0";
+  version = "0.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-8yRhe/xNmzITbSX/U1G5K8C1aaKWFz7iqFkcH4hu/ww=";
+    hash = "sha256-BJ2XGsTJNu2/SDKRW6cSjP7o9erUNSZnkrce3Yf1MFw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/millheater/default.nix b/pkgs/development/python-modules/millheater/default.nix
index 0a36ae615300..9be5871e551d 100644
--- a/pkgs/development/python-modules/millheater/default.nix
+++ b/pkgs/development/python-modules/millheater/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "millheater";
-  version = "012.2";
+  version = "0.12.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pymill";
     tag = version; # https://github.com/Danielhiversen/pymill/issues/87
-    hash = "sha256-tR6MZIgCazGcXRIaSXyDYIEp+kD6xyrpOXORbi8LV7E=";
+    hash = "sha256-DGMG6LabfKGmQ6MDm/skqeQuOhSlr1ssZ2Z7fItzOt0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index 202ba506dfe1..42422d61a0d7 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -54,6 +54,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  # skip spawn related tests for openmpi implemention
+  # see https://github.com/mpi4py/mpi4py/issues/545#issuecomment-2343011460
+  env.MPI4PY_TEST_SPAWN = if mpi.pname == "openmpi" then 0 else 1;
+
   passthru = {
     inherit mpi;
   };
diff --git a/pkgs/development/python-modules/mscerts/default.nix b/pkgs/development/python-modules/mscerts/default.nix
index ea6ceec821fb..da2095ec25de 100644
--- a/pkgs/development/python-modules/mscerts/default.nix
+++ b/pkgs/development/python-modules/mscerts/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mscerts";
-  version = "2025.6.27";
+  version = "2025.8.29";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ralphje";
     repo = "mscerts";
     tag = version;
-    hash = "sha256-By0gVlsVjgBREBGUOZjnKE9HTHC+zLZ4kUKIcN7/eKY=";
+    hash = "sha256-K7U4dbhH3yWElSKRhU9mHU4W+Hdc6Vb9kf/TE4EJs8c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
index b0bf59d45c62..1d14aa2d186d 100644
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -54,6 +54,7 @@ buildPythonPackage {
   ];
 
   pythonRelaxDeps = [
+    "protobuf"
     "grpcio"
     "pip"
     "semver"
@@ -66,11 +67,20 @@ buildPythonPackage {
     pulumi-python
   ];
 
+  disabledTestPaths = [
+    # TODO: remove disabledTestPaths once the test is fixed upstream.
+    # https://github.com/pulumi/pulumi/pull/19080#discussion_r2309611222
+    "lib/test/provider/experimental/test_property_value.py::test_nesting"
+  ];
+
   # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L10-L11
   # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L16
   installCheckPhase = ''
     runHook preInstallCheck
-    ${python.executable} -m pytest --junit-xml= --ignore=lib/test/automation lib/test
+    declare -a _disabledTestPathsArray
+    concatTo _disabledTestPathsArray disabledTestPaths
+    ${python.executable} -m pytest --junit-xml= --ignore=lib/test/automation lib/test \
+      "''${_disabledTestPathsArray[@]/#/--deselect=}"
     pushd lib/test_with_mocks
     ${python.executable} -m pytest --junit-xml=
     popd
@@ -86,8 +96,6 @@ buildPythonPackage {
     description = "Modern Infrastructure as Code. Any cloud, any language";
     homepage = "https://www.pulumi.com";
     license = lib.licenses.asl20;
-    # https://github.com/pulumi/pulumi/issues/16828
-    broken = lib.versionAtLeast protobuf.version "5";
     maintainers = with lib.maintainers; [
       teto
       tie
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index c759e67bbf07..2c5468f77363 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pygitguardian";
-  version = "1.24.0";
+  version = "1.25.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "GitGuardian";
     repo = "py-gitguardian";
     tag = "v${version}";
-    hash = "sha256-9Zk2XpMS8WhCOGYwtUgsjWKbUhmtKOgVWyqskLJ8DOw=";
+    hash = "sha256-XcmLaEnQ5cUTd71xvgvdS418RGOzpKydUDoSdVC/mgo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyipv8/default.nix b/pkgs/development/python-modules/pyipv8/default.nix
index cca3f6fef912..55e65a97679a 100644
--- a/pkgs/development/python-modules/pyipv8/default.nix
+++ b/pkgs/development/python-modules/pyipv8/default.nix
@@ -2,6 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  fetchFromGitHub,
   cryptography,
   libnacl,
   aiohttp,
@@ -16,12 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pyipv8";
-  version = "3.0.0";
+  version = "3.0.2197-unstable-2025-07-29";
   format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-e8HoKKA1s93LbmvHs7gJqmCcuZZ9REenBwxKJFR6wjM=";
+  src = fetchFromGitHub {
+    owner = "tribler";
+    repo = "py-ipv8";
+    rev = "db39b85f4c28880dee24d1b59d8eae8ca8b9c03d";
+    hash = "sha256-VIcBPzpK8Cdaz/dRp9QK/MtK41jm8rs/pxnLS716FNM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentence-transformers/default.nix b/pkgs/development/python-modules/sentence-transformers/default.nix
index 4872c23b0d31..178e75aae18d 100644
--- a/pkgs/development/python-modules/sentence-transformers/default.nix
+++ b/pkgs/development/python-modules/sentence-transformers/default.nix
@@ -104,6 +104,10 @@ buildPythonPackage rec {
     # Assertion error: Sparse operations take too long
     # (namely, load-sensitive test)
     "test_performance_with_large_vectors"
+
+    # NameError: name 'ParallelismConfig' is not defined
+    "test_hf_argument_parser"
+    "test_hf_argument_parser_incorrect_string_arguments"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/spsdk-pyocd/default.nix b/pkgs/development/python-modules/spsdk-pyocd/default.nix
index ef16cf229f66..1a034344701f 100644
--- a/pkgs/development/python-modules/spsdk-pyocd/default.nix
+++ b/pkgs/development/python-modules/spsdk-pyocd/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "spsdk-pyocd";
-  version = "0.3.2";
+  version = "0.3.3";
   pyproject = true;
 
   # Latest tag missing on GitHub
   src = fetchPypi {
     pname = "spsdk_pyocd";
     inherit version;
-    hash = "sha256-OcRGYZ1U5jQyRv2OSKwS3uJpvRQRW6Fbm/rDxlzyxPg=";
+    hash = "sha256-Uu5QbvDd2U9evZiY2Gg4kSPRMGpFBXpxwYVgsa5M/SI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/syne-tune/default.nix b/pkgs/development/python-modules/syne-tune/default.nix
new file mode 100644
index 000000000000..00058a4ae46d
--- /dev/null
+++ b/pkgs/development/python-modules/syne-tune/default.nix
@@ -0,0 +1,146 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  dill,
+  numpy,
+  pandas,
+  sortedcontainers,
+  typing-extensions,
+
+  # optional-dependencies
+  autograd,
+  botorch,
+  # configspace,
+  fastparquet,
+  h5py,
+  huggingface-hub,
+  matplotlib,
+  onnxruntime,
+  pymoo,
+  pyyaml,
+  scikit-learn,
+  scipy,
+  # smac,
+  statsmodels,
+  swig,
+  xgboost,
+  # yahpo-gym,
+
+  # tests
+  pytestCheckHook,
+  pytest-timeout,
+  ray,
+  writableTmpDirAsHomeHook,
+}:
+buildPythonPackage rec {
+  pname = "syne-tune";
+  version = "0.14.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "syne-tune";
+    repo = "syne-tune";
+    tag = "v${version}";
+    hash = "sha256-51QyfJ0XOcXTeE95YOhtUmhat23joaEYvUnk7hYfksY=";
+  };
+
+  postPatch = ''
+    substituteInPlace syne_tune/optimizer/schedulers/synchronous/hyperband.py \
+     --replace-fail 'metric_val=np.NAN' 'metric_val=np.nan'
+    substituteInPlace syne_tune/optimizer/schedulers/synchronous/dehb.py \
+     --replace-fail 'result_failed.metric_val = np.NAN' 'result_failed.metric_val = np.nan'
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "numpy"
+  ];
+
+  dependencies = [
+    dill
+    numpy
+    pandas
+    sortedcontainers
+    typing-extensions
+  ];
+
+  optional-dependencies = lib.fix (self: {
+    blackbox-repository = [
+      fastparquet
+      h5py
+      huggingface-hub
+      numpy
+      pandas
+      scikit-learn
+      xgboost
+    ];
+    bore = [
+      scikit-learn
+      xgboost
+    ];
+    botorch = [ botorch ];
+    gpsearchers = [
+      autograd
+      scipy
+    ];
+    kde = [ statsmodels ];
+    moo = [
+      pymoo
+      scipy
+    ];
+    sklearn = [ scikit-learn ];
+    # smac = [ smac swig ]; # smac unavailable on nixpkgs
+    visual = [ matplotlib ];
+    # yahpo = [ configspace onnxruntime pandas pyyaml yahpo-gym ]; # yahpo-gym unavailable on nixpkgs
+  });
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-timeout
+    ray
+    writableTmpDirAsHomeHook
+  ]
+  ++ ray.optional-dependencies.tune
+  ++ optional-dependencies.blackbox-repository
+  ++ optional-dependencies.bore
+  ++ optional-dependencies.botorch
+  ++ optional-dependencies.gpsearchers
+  ++ optional-dependencies.kde
+  ++ optional-dependencies.sklearn;
+
+  disabledTests = [
+    # NameError: name 'HV' is not defined
+    # these require pkg `pymoo` and adding `pymoo` raises:
+    # setuptools.errors.PackageDiscoveryError: Multiple top-level packages discovered in a flat-layout: ['cma', 'notebooks'].
+    "test_append_hypervolume_indicator"
+    "test_hypervolume"
+    "test_hypervolume_progress"
+    "test_hypervolume_simple"
+  ];
+
+  disabledTestPaths = [
+    # legacy test
+    "tst/schedulers/test_legacy_schedulers_api.py"
+  ];
+
+  pythonImportsCheck = [
+    "syne_tune"
+  ];
+
+  meta = {
+    description = "Large scale asynchronous hyperparameter and architecture optimization library";
+    homepage = "https://github.com/syne-tune/syne-tune";
+    changelog = "https://github.com/syne-tune/syne-tune/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ daspk04 ];
+  };
+}
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index 724fcc3df3af..d307f6edae15 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -21,6 +21,7 @@
   # tests
   datasets,
   numpy,
+  pytest-asyncio,
   pytestCheckHook,
   requests,
   tiktoken,
@@ -75,14 +76,14 @@ let
 in
 buildPythonPackage rec {
   pname = "tokenizers";
-  version = "0.21.4";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "tokenizers";
     tag = "v${version}";
-    hash = "sha256-HJUycrNDpy2FOYi6aZ76orLewZCuLC1MoJ57peYJqvI=";
+    hash = "sha256-HTJQ5nPkOsVqYzcsm0GLflX+teqDsrpIb5nf5pa7Gpc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -92,7 +93,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-0olujhOOO/BAH4JvnmXd1kE7T/sp5Vr3Z3P2X2jhZKs=";
+    hash = "sha256-X9tsn4gPg7Ih/8NNiCBllgcZgUR/tok+mwCJE53Z/8g=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
@@ -117,6 +118,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     datasets
     numpy
+    pytest-asyncio
     pytestCheckHook
     requests
     tiktoken
@@ -138,6 +140,23 @@ buildPythonPackage rec {
     "test_splitting"
     "TestTrainFromIterators"
 
+    # Require downloading from huggingface
+    # huggingface_hub.errors.LocalEntryNotFoundError
+    "test_async_methods_existence"
+    "test_basic_encoding"
+    "test_concurrency"
+    "test_decode"
+    "test_decode_skip_special_tokens"
+    "test_decode_stream_fallback"
+    "test_encode"
+    "test_error_handling"
+    "test_large_batch"
+    "test_numpy_inputs"
+    "test_performance_comparison"
+    "test_various_input_formats"
+    "test_with_special_tokens"
+    "test_with_truncation_padding"
+
     # Those tests require more data
     "test_from_pretrained"
     "test_from_pretrained_revision"
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 6783c86c8fc8..774867251ee3 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -59,14 +59,14 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.55.4";
+  version = "4.56.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "transformers";
     tag = "v${version}";
-    hash = "sha256-gBVFIX4wSfWVWPc0dAC9aGGjNdBhUaOfyU3C+wDr6GY=";
+    hash = "sha256-gM9kGID1lR7wN9Nxlq4h0GtI3QuJxkRVxQAsYbW8ok0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index 701ba5dad028..72799b762d41 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "0.15.0";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,14 +18,14 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-fbuh/SMfOygnuvG9zTZqem4oLaS+5uXScXPhU3aVDjM=";
+    hash = "sha256-YZmhwHA6PnQb3QXhbWK8cbV0CScbiD5k+HceDcV6iCI=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-+dPIujaxDJ7JrtNvX4VjGHFmgtCb1BJpFQL4c3E1/GY=";
+    hash = "sha256-8LofNTLa3a2dDH72T54HJR/+qArXt+X6OMJIQwmjQIQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index af99e2995c07..38eda04ecb77 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -540,13 +540,6 @@ lib.makeOverridable (
             ]
             ++ lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
           timeout = 14400; # 4 hours
-          identifiers.cpeParts = {
-            part = "o";
-            vendor = "linux";
-            product = "linux_kernel";
-            inherit version;
-            update = "*";
-          };
         }
         // extraMeta;
       };
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index bb26bcd77336..424769a4a5c1 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -183,15 +183,5 @@ lib.warnIf (withDocs != null)
       badPlatforms = [ lib.systems.inspect.patterns.isMinGW ];
       maintainers = [ ];
       mainProgram = "bash";
-      identifiers.cpeParts =
-        let
-          versionSplit = lib.split "p" version;
-        in
-        {
-          vendor = "gnu";
-          product = "bash";
-          version = lib.elemAt versionSplit 0;
-          update = lib.elemAt versionSplit 2;
-        };
     };
   }
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 66cf070c5268..3a42ab4f15aa 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -11,7 +11,6 @@ let
   inherit (lib)
     all
     attrNames
-    attrValues
     concatMapStrings
     concatMapStringsSep
     concatStrings
@@ -38,8 +37,6 @@ let
 
   inherit (lib.meta)
     availableOn
-    cpeFullVersionWithVendor
-    tryCPEPatchVersionInUpdateWithVendor
     ;
 
   inherit (lib.generators)
@@ -440,8 +437,6 @@ let
       # Used for the original location of the maintainer and team attributes to assist with pings.
       maintainersPosition = any;
       teamsPosition = any;
-
-      identifiers = attrs;
     };
 
   checkMetaAttr =
@@ -575,19 +570,6 @@ let
     else
       validYes;
 
-  # Helper functions and declarations to handle identifiers, extracted to reduce allocations
-  hasAllCPEParts = cpeParts: !any isNull (attrValues cpeParts);
-  makeCPE =
-    cpeParts:
-    "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}";
-  possibleCPEPartsFuns = [
-    (vendor: version: {
-      success = true;
-      value = cpeFullVersionWithVendor vendor version;
-    })
-    tryCPEPatchVersionInUpdateWithVendor
-  ];
-
   # The meta attribute is passed in the resulting attribute set,
   # but it's not part of the actual derivation, i.e., it's not
   # passed to the builder and is not a dependency.  But since we
@@ -652,51 +634,6 @@ let
       maintainers =
         attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ];
 
-      identifiers =
-        let
-          defaultCPEParts = {
-            part = "a";
-            vendor = null;
-            product = attrs.pname or null;
-            version = null;
-            update = null;
-            edition = "*";
-            sw_edition = "*";
-            target_sw = "*";
-            target_hw = "*";
-            language = "*";
-            other = "*";
-          };
-
-          cpeParts = defaultCPEParts // attrs.meta.identifiers.cpeParts or { };
-          cpe = if hasAllCPEParts cpeParts then makeCPE cpeParts else null;
-
-          possibleCPEs =
-            if cpe != null then
-              [ { inherit cpeParts cpe; } ]
-            else if attrs.meta.identifiers.cpeParts.vendor or null == null || attrs.version or null == null then
-              [ ]
-            else
-              concatMap (
-                f:
-                let
-                  result = f attrs.meta.identifiers.cpeParts.vendor attrs.version;
-                  # Note that attrs.meta.identifiers.cpeParts at this point can include defaults with user overrides.
-                  # Since we can't split them apart, user overrides don't apply to possibleCPEs.
-                  guessedParts = cpeParts // result.value;
-                in
-                optional (result.success && (hasAllCPEParts guessedParts)) {
-                  cpeParts = guessedParts;
-                  cpe = (makeCPE guessedParts);
-                }
-              ) possibleCPEPartsFuns;
-          v1 = { inherit cpeParts cpe possibleCPEs; };
-        in
-        v1
-        // {
-          inherit v1;
-        };
-
       # Expose the result of the checks for everyone to see.
       unfree = hasUnfreeLicense attrs;
       broken = isMarkedBroken attrs;
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index e28edd4be66a..21b5b4273d91 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -14,13 +14,13 @@ let
     }:
     buildGoModule rec {
       inherit pname;
-      version = "1.4.0";
+      version = "1.4.1";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-uGPjeBnai1QP/U9uu4wVMUVjd8Nx1sl4r83xrOdEoF0=";
+        hash = "sha256-qn65d2bG8flSlMXG5TiMrNAVX8emv4ymsGs516TKFWU=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -33,7 +33,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-lHaRabQzeh69GXQc3Spe1mLi7zyGSjhICH3ZENMJUfI=";
+      vendorHash = "sha256-lHzBpCisojRk6adWq+vZsvGqXQ22IzqO3bJa3foaWIA=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 540f3546f9ba..48ae6ca764aa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7153,6 +7153,8 @@ self: super: with self; {
 
   iptools = callPackage ../development/python-modules/iptools { };
 
+  ipv8-rust-tunnels = callPackage ../development/python-modules/ipv8-rust-tunnels { };
+
   ipwhl = callPackage ../development/python-modules/ipwhl { };
 
   ipwhois = callPackage ../development/python-modules/ipwhois { };
@@ -17788,6 +17790,8 @@ self: super: with self; {
     }
   );
 
+  syne-tune = callPackage ../development/python-modules/syne-tune { };
+
   synergy = callPackage ../development/python-modules/synergy { };
 
   synology-srm = callPackage ../development/python-modules/synology-srm { };
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index e87cd289e7a1..5dfc7ce01212 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -88,6 +88,8 @@ let
       ffmpeg-full = linux;
       firefox = linux;
       firefox-unwrapped = linux;
+      firefox-beta = linux;
+      firefox-beta-unwrapped = linux;
       gimp = linux;
       gimp3 = linux;
       gpu-screen-recorder = linux;