diff --git a/ci/eval/README.md b/ci/eval/README.md
index ec7429b7bc78..57cde7c65fe9 100644
--- a/ci/eval/README.md
+++ b/ci/eval/README.md
@@ -2,25 +2,44 @@
 
 The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
 
-Furthermore it also allows local evaluation using
+Furthermore it also allows local evaluation using:
+
 ```
-nix-build ci -A eval.full \
-  --max-jobs 4 \
-  --cores 2 \
-  --arg chunkSize 10000 \
-  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
+nix-build ci -A eval.baseline
 ```
 
+The most important two arguments are:
+- `--arg evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
+  Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
+  Example: `--arg evalSystems '["x86_64-linux" "aarch64-darwin"]'`
+- `--arg quickTest`: Enables testing a single chunk of the current system only for quick iteration.
+  Example: `--arg quickTest true`
+
+The following arguments can be used to fine-tune performance:
 - `--max-jobs`: The maximum number of derivations to run at the same time.
   Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.
 - `--cores`: The number of cores to use for each job.
   Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
-- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
+- `--arg chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
   Lowering this decreases memory usage at the cost of increased evaluation time.
   If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
-- `evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
-  Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
-
-A good default is to set `chunkSize` to 10000, which leads to about 3.6GB max memory usage per core, so suitable for fully utilising machines with 4 cores and 16GB memory, 8 cores and 32GB memory or 16 cores and 64GB memory.
+  The default is 5000.
+  Example: `--arg chunkSize 10000`
 
 Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.
+
+## Local eval with rebuilds / comparison
+
+To compare two commits locally, first run the following on the baseline commit:
+
+```
+BASELINE=$(nix-build ci -A eval.baseline --no-out-link)
+```
+
+Then, on the commit with your changes:
+
+```
+nix-build ci -A eval.full --arg baseline $BASELINE
+```
+
+Keep in mind to otherwise pass the same set of arguments for both commands (`evalSystems`, `quickTest`, `chunkSize`).
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 8d79034db59e..14005ea401af 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -240,29 +240,44 @@ let
 
   compare = callPackage ./compare { };
 
+  baseline =
+    {
+      # Whether to evaluate on a specific set of systems, by default all are evaluated
+      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
+      # The number of attributes per chunk, see ./README.md for more info.
+      chunkSize ? 5000,
+      quickTest ? false,
+    }:
+    symlinkJoin {
+      name = "nixpkgs-eval-baseline";
+      paths = map (
+        evalSystem:
+        singleSystem {
+          inherit quickTest evalSystem chunkSize;
+        }
+      ) evalSystems;
+    };
+
   full =
     {
       # Whether to evaluate on a specific set of systems, by default all are evaluated
       evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
       # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
+      chunkSize ? 5000,
       quickTest ? false,
+      baseline,
     }:
     let
       diffs = symlinkJoin {
-        name = "diffs";
+        name = "nixpkgs-eval-diffs";
         paths = map (
           evalSystem:
-          let
-            eval = singleSystem {
-              inherit quickTest evalSystem chunkSize;
-            };
-          in
           diff {
             inherit evalSystem;
-            # Local "full" evaluation doesn't do a real diff.
-            beforeDir = eval;
-            afterDir = eval;
+            beforeDir = baseline;
+            afterDir = singleSystem {
+              inherit quickTest evalSystem chunkSize;
+            };
           }
         ) evalSystems;
       };
@@ -280,7 +295,8 @@ in
     combine
     compare
     # The above three are used by separate VMs in a GitHub workflow,
-    # while the below is intended for testing on a single local machine
+    # while the below are intended for testing on a single local machine
+    baseline
     full
     ;
 }
diff --git a/lib/modules.nix b/lib/modules.nix
index cc3148b0eea7..3330579952de 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1121,6 +1121,7 @@ let
       files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
+      inherit (res.checkedAndMerged) valueMeta;
       # This allows options to be correctly displayed using `${options.path.to.it}`
       __toString = _: showOption loc;
     };
@@ -1164,7 +1165,14 @@ let
     # Type-check the remaining definitions, and merge them. Or throw if no definitions.
     mergedValue =
       if isDefined then
-        if all (def: type.check def.value) defsFinal then
+        if type.merge ? v2 then
+          # check and merge share the same closure
+          # .headError is either not-present, null, or a string describing the error
+          if checkedAndMerged.headError or null != null then
+            throw "A definition for option `${showOption loc}' is not of type `${type.description}'. TypeError: ${checkedAndMerged.headError.message}"
+          else
+            checkedAndMerged.value
+        else if all (def: type.check def.value) defsFinal then
           type.merge loc defsFinal
         else
           let
@@ -1177,6 +1185,43 @@ let
         throw
           "The option `${showOption loc}' was accessed but has no value defined. Try setting the option.";
 
+    checkedAndMerged =
+      (
+        # This function (which is immediately applied) checks that type.merge
+        # returns the proper attrset.
+        # Once use of the merge.v2 feature has propagated, consider removing this
+        # for an estimated one thousandth performance improvement (NixOS by nr.thunks).
+        {
+          headError,
+          value,
+          valueMeta,
+        }@args:
+        args
+      )
+        (
+          if type.merge ? v2 then
+            let
+              r = type.merge.v2 {
+                inherit loc;
+                defs = defsFinal;
+              };
+            in
+            r
+            // {
+              valueMeta = r.valueMeta // {
+                _internal = {
+                  inherit type;
+                };
+              };
+            }
+          else
+            {
+              headError = null;
+              value = mergedValue;
+              valueMeta = { };
+            }
+        );
+
     isDefined = defsFinal != [ ];
 
     optionalValue = if isDefined then { value = mergedValue; } else { };
@@ -1586,13 +1631,11 @@ let
         New option path as list of strings.
       */
       to,
-
       /**
         Release number of the first release that contains the rename, ignoring backports.
         Set it to the upcoming release, matching the nixpkgs/.version file.
       */
       sinceRelease,
-
     }:
     doRename {
       inherit from to;
diff --git a/lib/tests/checkAndMergeCompat.nix b/lib/tests/checkAndMergeCompat.nix
new file mode 100644
index 000000000000..dc6f26fbf917
--- /dev/null
+++ b/lib/tests/checkAndMergeCompat.nix
@@ -0,0 +1,379 @@
+{
+  pkgs ? import ../.. { },
+  currLibPath ? ../.,
+  prevLibPath ? "${
+    pkgs.fetchFromGitHub {
+      owner = "nixos";
+      repo = "nixpkgs";
+      # Parent commit of [#391544](https://github.com/NixOS/nixpkgs/pull/391544)
+      # Which was before the type.merge.v2 introduction
+      rev = "bcf94dd3f07189b7475d823c8d67d08b58289905";
+      hash = "sha256-MuMiIY3MX5pFSOCvutmmRhV6RD0R3CG0Hmazkg8cMFI=";
+    }
+  }/lib",
+}:
+let
+  lib = import currLibPath;
+
+  lib_with_merge_v2 = lib;
+  lib_with_merge_v1 = import prevLibPath;
+
+  getMatrix =
+    {
+      getType ? null,
+      # If getType is set this is only used as test prefix
+      # And the type from getType is used
+      outerTypeName,
+      innerTypeName,
+      value,
+      testAttrs,
+    }:
+    let
+      evalModules.call_v1 = lib_with_merge_v1.evalModules;
+      evalModules.call_v2 = lib_with_merge_v2.evalModules;
+      outerTypes.outer_v1 = lib_with_merge_v1.types;
+      outerTypes.outer_v2 = lib_with_merge_v2.types;
+      innerTypes.inner_v1 = lib_with_merge_v1.types;
+      innerTypes.inner_v2 = lib_with_merge_v2.types;
+    in
+    lib.mapAttrs (
+      _: evalModules:
+      lib.mapAttrs (
+        _: outerTypes:
+        lib.mapAttrs (_: innerTypes: {
+          "test_${outerTypeName}_${innerTypeName}" = testAttrs // {
+            expr =
+              (evalModules {
+                modules = [
+                  (m: {
+                    options.foo = m.lib.mkOption {
+                      type =
+                        if getType != null then
+                          getType outerTypes innerTypes
+                        else
+                          outerTypes.${outerTypeName} innerTypes.${innerTypeName};
+                      default = value;
+                    };
+                  })
+                ];
+              }).config.foo;
+          };
+        }) innerTypes
+      ) outerTypes
+    ) evalModules;
+in
+{
+  # AttrsOf string
+  attrsOf_str_ok = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = {
+      bar = "test";
+    };
+    testAttrs = {
+      expected = {
+        bar = "test";
+      };
+    };
+  };
+  attrsOf_str_err_inner = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = {
+      bar = 1; # not a string
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.bar' is not of type `string'.*";
+      };
+    };
+  };
+  attrsOf_str_err_outer = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = [ "foo" ]; # not an attrset
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `attribute set of string'.*";
+      };
+    };
+  };
+
+  # listOf string
+  listOf_str_ok = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = [
+      "foo"
+      "bar"
+    ];
+    testAttrs = {
+      expected = [
+        "foo"
+        "bar"
+      ];
+    };
+  };
+  listOf_str_err_inner = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = [
+      "foo"
+      1
+    ]; # not a string
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 2\]"' is not of type `string'.'';
+      };
+    };
+  };
+  listOf_str_err_outer = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = {
+      foo = 42;
+    }; # not a list
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `list of string'.*";
+      };
+    };
+  };
+
+  attrsOf_submodule_ok = getMatrix {
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    value = {
+      foo = {
+        nested = "test1";
+      };
+      bar = {
+        nested = "test2";
+      };
+    };
+    testAttrs = {
+      expected = {
+        foo = {
+          nested = "test1";
+        };
+        bar = {
+          nested = "test2";
+        };
+      };
+    };
+  };
+  attrsOf_submodule_err_inner = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    value = {
+      foo = [ 1 ]; # not a submodule
+      bar = {
+        nested = "test2";
+      };
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.foo' is not of type `submodule'.*";
+      };
+    };
+  };
+  attrsOf_submodule_err_outer = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    value = [ 123 ]; # not an attrsOf
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo' is not of type `attribute set of \(submodule\).*'';
+      };
+    };
+  };
+
+  # either
+  either_str_attrsOf_ok = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = "string value";
+    testAttrs = {
+      expected = "string value";
+    };
+  };
+  either_str_attrsOf_err_1 = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = 1;
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `string or attribute set of string'.*";
+      };
+    };
+  };
+  either_str_attrsOf_err_2 = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = {
+      bar = 1; # not a string
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.bar' is not of type `string'.*";
+      };
+    };
+  };
+
+  # Coereced to
+  coerce_attrsOf_str_to_listOf_str_run = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = {
+      bar = "test1"; # coerced to listOf string
+      foo = "test2"; # coerced to listOf string
+    };
+    testAttrs = {
+      expected = [
+        "test1"
+        "test2"
+      ];
+    };
+  };
+  coerce_attrsOf_str_to_listOf_str_final = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) (abort "This shouldnt run") (b.listOf b.str);
+    value = [
+      "test1"
+      "test2"
+    ]; # already a listOf string
+    testAttrs = {
+      expected = [
+        "test1"
+        "test2"
+      ]; # Order should be kept
+    };
+  };
+  coerce_attrsOf_str_to_listOf_err_coercer_input = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = [
+      { }
+      { }
+    ]; # not coercible to listOf string, with the given coercer
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 1\]"' is not of type `string'.*'';
+      };
+    };
+  };
+  coerce_attrsOf_str_to_listOf_err_coercer_ouput = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = {
+      foo = {
+        bar = 1;
+      }; # coercer produces wrong type -> [ { bar = 1; } ]
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 1\]"' is not of type `string'.*'';
+      };
+    };
+  };
+  coerce_str_to_int_coercer_ouput = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "int->str";
+    getType = a: b: a.coercedTo b.int builtins.toString a.str;
+    value = [ ];
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo' is not of type `string or signed integer convertible to it.*'';
+      };
+    };
+  };
+
+  # Submodule
+  submodule_with_ok = getMatrix {
+    outerTypeName = "submoduleWith";
+    innerTypeName = "mixed_types";
+    getType =
+      a: b:
+      a.submodule (m: {
+        options.attrs = m.lib.mkOption {
+          type = b.attrsOf b.str;
+        };
+        options.list = m.lib.mkOption {
+          type = b.listOf b.str;
+        };
+        options.either = m.lib.mkOption {
+          type = b.either a.str a.int;
+        };
+      });
+    value = {
+      attrs = {
+        foo = "bar";
+      };
+      list = [
+        "foo"
+        "bar"
+      ];
+      either = 123; # int
+    };
+    testAttrs = {
+      expected = {
+        attrs = {
+          foo = "bar";
+        };
+        list = [
+          "foo"
+          "bar"
+        ];
+        either = 123;
+      };
+    };
+  };
+}
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 301808ae6651..fbbccd8172f6 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -345,14 +345,14 @@ checkConfigOutput '^true$' "$@" ./define-module-check.nix
 set --
 checkConfigOutput '^"42"$' config.value ./declare-coerced-value.nix
 checkConfigOutput '^"24"$' config.value ./declare-coerced-value.nix ./define-value-string.nix
-checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
+checkConfigError 'A definition for option .*. is not of type .*.\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
 
 # Check coerced option merging.
 checkConfigError 'The option .value. in .*/declare-coerced-value.nix. is already declared in .*/declare-coerced-value-no-default.nix.' config.value ./declare-coerced-value.nix ./declare-coerced-value-no-default.nix
 
 # Check coerced value with unsound coercion
 checkConfigOutput '^12$' config.value ./declare-coerced-value-unsound.nix
-checkConfigError 'A definition for option .* is not of type .*. Definition values:\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
+checkConfigError 'A definition for option .* is not of type .*.\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
 checkConfigError 'toInt: Could not convert .* to int' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
 
 # Check `graph` attribute
@@ -761,6 +761,26 @@ checkConfigOutput '"bar"' config.sub.conditionalImportAsNixos.foo ./specialArgs-
 checkConfigError 'attribute .*bar.* not found' config.sub.conditionalImportAsNixos.bar ./specialArgs-class.nix
 checkConfigError 'attribute .*foo.* not found' config.sub.conditionalImportAsDarwin.foo ./specialArgs-class.nix
 checkConfigOutput '"foo"' config.sub.conditionalImportAsDarwin.bar ./specialArgs-class.nix
+# Check that some types expose the 'valueMeta'
+checkConfigOutput '\{\}' options.str.valueMeta ./types-valueMeta.nix
+checkConfigOutput '["foo", "bar"]' config.attrsOfResult ./types-valueMeta.nix
+checkConfigOutput '2' config.listOfResult ./types-valueMeta.nix
+
+# Check that composed types expose the 'valueMeta'
+# attrsOf submodule (also on merged options,types)
+checkConfigOutput '42' options.attrsOfModule.valueMeta.attrs.foo.configuration.options.bar.value ./composed-types-valueMeta.nix
+checkConfigOutput '42' options.mergedAttrsOfModule.valueMeta.attrs.foo.configuration.options.bar.value ./composed-types-valueMeta.nix
+
+# listOf submodule (also on merged options,types)
+checkConfigOutput '42' config.listResult ./composed-types-valueMeta.nix
+checkConfigOutput '42' config.mergedListResult ./composed-types-valueMeta.nix
+
+# Add check
+checkConfigOutput '^0$' config.v1CheckedPass ./add-check.nix
+checkConfigError 'A definition for option .* is not of type .signed integer.*' config.v1CheckedFail ./add-check.nix
+checkConfigOutput '^true$' config.v2checkedPass ./add-check.nix
+checkConfigError 'A definition for option .* is not of type .attribute set of signed integer.*' config.v2checkedFail ./add-check.nix
+
 
 cat <<EOF
 ====== module tests ======
diff --git a/lib/tests/modules/add-check.nix b/lib/tests/modules/add-check.nix
new file mode 100644
index 000000000000..3bd993694994
--- /dev/null
+++ b/lib/tests/modules/add-check.nix
@@ -0,0 +1,36 @@
+(
+  { lib, ... }:
+  let
+    inherit (lib) types mkOption;
+    inherit (types) addCheck int attrsOf;
+
+    # type with a v1 merge
+    v1Type = addCheck int (v: v == 0);
+
+    # type with a v2 merge
+    v2Type = addCheck (attrsOf int) (v: v ? foo);
+  in
+  {
+    options.v1CheckedPass = mkOption {
+      type = v1Type;
+      default = 0;
+    };
+    options.v1CheckedFail = mkOption {
+      type = v1Type;
+      default = 1;
+    };
+    options.v2checkedPass = mkOption {
+      type = v2Type;
+      default = {
+        foo = 1;
+      };
+      # plug the value to make test script regex simple
+      apply = v: v.foo == 1;
+    };
+    options.v2checkedFail = mkOption {
+      type = v2Type;
+      default = { };
+      apply = v: lib.deepSeq v v;
+    };
+  }
+)
diff --git a/lib/tests/modules/composed-types-valueMeta.nix b/lib/tests/modules/composed-types-valueMeta.nix
new file mode 100644
index 000000000000..734917f8b67d
--- /dev/null
+++ b/lib/tests/modules/composed-types-valueMeta.nix
@@ -0,0 +1,75 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  attrsOfModule = mkOption {
+    type = types.attrsOf (
+      types.submodule {
+        options.bar = mkOption {
+          type = types.int;
+        };
+      }
+    );
+  };
+
+  listOfModule = mkOption {
+    type = types.listOf (
+      types.submodule {
+        options.bar = mkOption {
+          type = types.int;
+        };
+      }
+    );
+  };
+
+in
+{
+  imports = [
+    #  Module A
+    ({
+      options.attrsOfModule = attrsOfModule;
+      options.mergedAttrsOfModule = attrsOfModule;
+      options.listOfModule = listOfModule;
+      options.mergedListOfModule = listOfModule;
+    })
+    # Module B
+    ({
+      options.mergedAttrsOfModule = attrsOfModule;
+      options.mergedListOfModule = listOfModule;
+    })
+    # Values
+    # It is important that the value is defined in a separate module
+    # Without valueMeta the actual value and sub-options wouldn't be accessible via:
+    # options.attrsOfModule.type.getSubOptions
+    ({
+      attrsOfModule = {
+        foo.bar = 42;
+      };
+      mergedAttrsOfModule = {
+        foo.bar = 42;
+      };
+    })
+    (
+      { options, ... }:
+      {
+        config.listOfModule = [
+          {
+            bar = 42;
+          }
+        ];
+        config.mergedListOfModule = [
+          {
+            bar = 42;
+          }
+        ];
+        # Result options to expose the list module to bash as plain attribute path
+        options.listResult = mkOption {
+          default = (builtins.head options.listOfModule.valueMeta.list).configuration.options.bar.value;
+        };
+        options.mergedListResult = mkOption {
+          default = (builtins.head options.mergedListOfModule.valueMeta.list).configuration.options.bar.value;
+        };
+      }
+    )
+  ];
+}
diff --git a/lib/tests/modules/types-valueMeta.nix b/lib/tests/modules/types-valueMeta.nix
new file mode 100644
index 000000000000..3004898f112a
--- /dev/null
+++ b/lib/tests/modules/types-valueMeta.nix
@@ -0,0 +1,60 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  inherit (types)
+    # attrsOf uses attrsWith internally
+    attrsOf
+    listOf
+    submoduleOf
+    str
+    ;
+in
+{
+  imports = [
+    (
+      { options, ... }:
+      {
+        # Should have an empty valueMeta
+        options.str = mkOption {
+          type = str;
+        };
+
+        # Should have some valueMeta which is an attribute set of the nested valueMeta
+        options.attrsOf = mkOption {
+          type = attrsOf str;
+          default = {
+            foo = "foo";
+            bar = "bar";
+          };
+        };
+        options.attrsOfResult = mkOption {
+          default = builtins.attrNames options.attrsOf.valueMeta.attrs;
+        };
+
+        # Should have some valueMeta which is the list of the nested valueMeta of types.str
+        # [ {} {} ]
+        options.listOf = mkOption {
+          type = listOf str;
+          default = [
+            "foo"
+            "bar"
+          ];
+        };
+        options.listOfResult = mkOption {
+          default = builtins.length options.listOf.valueMeta.list;
+        };
+
+        # Should have some valueMeta which is the submodule evaluation
+        # { _module, options, config, ...}
+        options.submoduleOf = mkOption {
+          type = submoduleOf {
+            options.str = mkOption {
+              type = str;
+            };
+          };
+        };
+      }
+    )
+  ];
+}
diff --git a/lib/tests/nix-unit.nix b/lib/tests/nix-unit.nix
new file mode 100644
index 000000000000..ff62aff4d96b
--- /dev/null
+++ b/lib/tests/nix-unit.nix
@@ -0,0 +1,25 @@
+{
+  pkgs ? import ../.. { },
+}:
+let
+  prevNixpkgs = pkgs.fetchFromGitHub {
+    owner = "nixos";
+    repo = "nixpkgs";
+    # Parent commit of [#391544](https://github.com/NixOS/nixpkgs/pull/391544)
+    # Which was before the type.merge.v2 introduction
+    rev = "bcf94dd3f07189b7475d823c8d67d08b58289905";
+    hash = "sha256-MuMiIY3MX5pFSOCvutmmRhV6RD0R3CG0Hmazkg8cMFI=";
+  };
+in
+(pkgs.runCommand "lib-cross-eval-merge-v2"
+  {
+    nativeBuildInputs = [ pkgs.nix-unit ];
+  }
+  ''
+    export HOME=$TMPDIR
+    nix-unit --eval-store "$HOME" ${./checkAndMergeCompat.nix} \
+      --arg currLibPath "${../.}" \
+      --arg prevLibPath "${prevNixpkgs}/lib"
+    mkdir $out
+  ''
+)
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index 4209fd9274b6..54d62f87b3d5 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -29,6 +29,9 @@ in
 pkgsBB.symlinkJoin {
   name = "nixpkgs-lib-tests";
   paths = map testWithNix nixVersions ++ [
+    (import ./nix-unit.nix {
+      inherit pkgs;
+    })
     (import ./maintainers.nix {
       inherit pkgs;
       lib = import ../.;
diff --git a/lib/types.nix b/lib/types.nix
index dcb536c4723b..6b51f9254a00 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -20,7 +20,6 @@ let
     toList
     ;
   inherit (lib.lists)
-    all
     concatLists
     count
     elemAt
@@ -48,6 +47,7 @@ let
     mergeOneOption
     mergeUniqueOption
     showFiles
+    showDefs
     showOption
     ;
   inherit (lib.strings)
@@ -99,6 +99,13 @@ let
       }is accessed, use `${lib.optionalString (loc != null) "type."}nestedTypes.elemType` instead.
     '' payload.elemType;
 
+  checkDefsForError =
+    check: loc: defs:
+    let
+      invalidDefs = filter (def: !check def.value) defs;
+    in
+    if invalidDefs != [ ] then { message = "Definition values: ${showDefs invalidDefs}"; } else null;
+
   outer_types = rec {
     isType = type: x: (x._type or "") == type;
 
@@ -705,26 +712,36 @@ let
           }";
           descriptionClass = "composite";
           check = isList;
-          merge =
-            loc: defs:
-            map (x: x.value) (
-              filter (x: x ? value) (
-                concatLists (
-                  imap1 (
-                    n: def:
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                evals = filter (x: x.optionalValue ? value) (
+                  concatLists (
                     imap1 (
-                      m: def':
-                      (mergeDefinitions (loc ++ [ "[definition ${toString n}-entry ${toString m}]" ]) elemType [
-                        {
-                          inherit (def) file;
-                          value = def';
-                        }
-                      ]).optionalValue
-                    ) def.value
-                  ) defs
-                )
-              )
-            );
+                      n: def:
+                      imap1 (
+                        m: def':
+                        (mergeDefinitions (loc ++ [ "[definition ${toString n}-entry ${toString m}]" ]) elemType [
+                          {
+                            inherit (def) file;
+                            value = def';
+                          }
+                        ])
+                      ) def.value
+                    ) defs
+                  )
+                );
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = map (x: x.optionalValue.value or x.mergedValue) evals;
+                valueMeta.list = map (v: v.checkedAndMerged.valueMeta) evals;
+              };
+          };
           emptyValue = {
             value = [ ];
           };
@@ -801,42 +818,43 @@ let
           lazy ? false,
           placeholder ? "name",
         }:
-        mkOptionType {
+        mkOptionType rec {
           name = if lazy then "lazyAttrsOf" else "attrsOf";
           description =
             (if lazy then "lazy attribute set" else "attribute set")
             + " of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
           descriptionClass = "composite";
           check = isAttrs;
-          merge =
-            if lazy then
-              (
-                # Lazy merge Function
-                loc: defs:
-                zipAttrsWith
-                  (
-                    name: defs:
-                    let
-                      merged = mergeDefinitions (loc ++ [ name ]) elemType defs;
-                      # mergedValue will trigger an appropriate error when accessed
-                    in
-                    merged.optionalValue.value or elemType.emptyValue.value or merged.mergedValue
-                  )
-                  # Push down position info.
-                  (pushPositions defs)
-              )
-            else
-              (
-                # Non-lazy merge Function
-                loc: defs:
-                mapAttrs (n: v: v.value) (
-                  filterAttrs (n: v: v ? value) (
-                    zipAttrsWith (name: defs: (mergeDefinitions (loc ++ [ name ]) elemType (defs)).optionalValue)
-                      # Push down position info.
-                      (pushPositions defs)
-                  )
-                )
-              );
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                evals =
+                  if lazy then
+                    zipAttrsWith (name: defs: mergeDefinitions (loc ++ [ name ]) elemType defs) (pushPositions defs)
+                  else
+                    # Filtering makes the merge function more strict
+                    # Meaning it is less lazy
+                    filterAttrs (n: v: v.optionalValue ? value) (
+                      zipAttrsWith (name: defs: mergeDefinitions (loc ++ [ name ]) elemType defs) (pushPositions defs)
+                    );
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = mapAttrs (
+                  n: v:
+                  if lazy then
+                    v.optionalValue.value or elemType.emptyValue.value or v.mergedValue
+                  else
+                    v.optionalValue.value
+                ) evals;
+                valueMeta.attrs = mapAttrs (n: v: v.checkedAndMerged.valueMeta) evals;
+              };
+          };
+
           emptyValue = {
             value = { };
           };
@@ -1218,6 +1236,7 @@ let
 
           name = "submodule";
 
+          check = x: isAttrs x || isFunction x || path.check x;
         in
         mkOptionType {
           inherit name;
@@ -1229,13 +1248,25 @@ let
                 docsEval = base.extendModules { modules = [ noCheckForDocsModule ]; };
               in
               docsEval._module.freeformType.description or name;
-          check = x: isAttrs x || isFunction x || path.check x;
-          merge =
-            loc: defs:
-            (base.extendModules {
-              modules = [ { _module.args.name = last loc; } ] ++ allModules defs;
-              prefix = loc;
-            }).config;
+          inherit check;
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                configuration = base.extendModules {
+                  modules = [ { _module.args.name = last loc; } ] ++ allModules defs;
+                  prefix = loc;
+                };
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = configuration.config;
+                valueMeta = { inherit configuration; };
+              };
+          };
           emptyValue = {
             value = { };
           };
@@ -1383,17 +1414,50 @@ let
               }";
           descriptionClass = "conjunction";
           check = x: t1.check x || t2.check x;
-          merge =
-            loc: defs:
-            let
-              defList = map (d: d.value) defs;
-            in
-            if all (x: t1.check x) defList then
-              t1.merge loc defs
-            else if all (x: t2.check x) defList then
-              t2.merge loc defs
-            else
-              mergeOneOption loc defs;
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                t1CheckedAndMerged =
+                  if t1.merge ? v2 then
+                    t1.merge.v2 { inherit loc defs; }
+                  else
+                    {
+                      value = t1.merge loc defs;
+                      headError = checkDefsForError t1.check loc defs;
+                      valueMeta = { };
+                    };
+                t2CheckedAndMerged =
+                  if t2.merge ? v2 then
+                    t2.merge.v2 { inherit loc defs; }
+                  else
+                    {
+                      value = t2.merge loc defs;
+                      headError = checkDefsForError t2.check loc defs;
+                      valueMeta = { };
+                    };
+
+                checkedAndMerged =
+                  if t1CheckedAndMerged.headError == null then
+                    t1CheckedAndMerged
+                  else if t2CheckedAndMerged.headError == null then
+                    t2CheckedAndMerged
+                  else
+                    rec {
+                      valueMeta = {
+                        inherit headError;
+                      };
+                      headError = {
+                        message = "The option `${showOption loc}` is neither a value of type `${t1.description}` nor `${t2.description}`, Definition values: ${showDefs defs}";
+                      };
+                      value = abort "(t.merge.v2 defs).value must only be accessed when `.headError == null`. This is a bug in code that consumes a module system type.";
+                    };
+              in
+              checkedAndMerged;
+          };
           typeMerge =
             f':
             let
@@ -1434,12 +1498,47 @@ let
             optionDescriptionPhrase (class: class == "noun") coercedType
           } convertible to it";
           check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
-          merge =
-            loc: defs:
-            let
-              coerceVal = val: if coercedType.check val then coerceFunc val else val;
-            in
-            finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                finalDefs = (
+                  map (
+                    def:
+                    def
+                    // {
+                      value =
+                        let
+                          merged = coercedType.merge.v2 {
+                            inherit loc;
+                            defs = [ def ];
+                          };
+                        in
+                        if coercedType.merge ? v2 then
+                          if merged.headError == null then coerceFunc def.value else def.value
+                        else if coercedType.check def.value then
+                          coerceFunc def.value
+                        else
+                          def.value;
+                    }
+                  ) defs
+                );
+              in
+              if finalType.merge ? v2 then
+                finalType.merge.v2 {
+                  inherit loc;
+                  defs = finalDefs;
+                }
+              else
+                {
+                  value = finalType.merge loc finalDefs;
+                  valueMeta = { };
+                  headError = checkDefsForError check loc defs;
+                };
+          };
           emptyValue = finalType.emptyValue;
           getSubOptions = finalType.getSubOptions;
           getSubModules = finalType.getSubModules;
@@ -1451,6 +1550,7 @@ let
           nestedTypes.coercedType = coercedType;
           nestedTypes.finalType = finalType;
         };
+
       /**
         Augment the given type with an additional type check function.
 
@@ -1459,8 +1559,33 @@ let
         Fixing is not trivial, we appreciate any help!
         :::
       */
-      addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
-
+      addCheck =
+        elemType: check:
+        if elemType.merge ? v2 then
+          elemType
+          // {
+            check = x: elemType.check x && check x;
+            merge = {
+              __functor =
+                self: loc: defs:
+                (self.v2 { inherit loc defs; }).value;
+              v2 =
+                { loc, defs }:
+                let
+                  orig = elemType.merge.v2 { inherit loc defs; };
+                  headError' = if orig.headError != null then orig.headError else checkDefsForError check loc defs;
+                in
+                orig
+                // {
+                  headError = headError';
+                };
+            };
+          }
+        else
+          elemType
+          // {
+            check = x: elemType.check x && check x;
+          };
     };
 
     /**
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 64683022706e..b1735ce93e59 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22358,6 +22358,12 @@
     githubId = 2660;
     name = "Russell Sim";
   };
+  RustyNova = {
+    email = "rusty.nova.jsb@gmail.com";
+    github = "RustyNova016";
+    githubId = 50844553;
+    name = "RustyNova";
+  };
   rutherther = {
     name = "Rutherther";
     email = "rutherther@proton.me";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9259a18ebdde..32bc1298f71c 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -421,7 +421,6 @@ with lib.maintainers;
       frlan
       leona
       osnyx
-      ma27
     ];
     scope = "Team for Flying Circus employees who collectively maintain packages.";
     shortName = "Flying Circus employees";
diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix
index 77f8bd4b0dca..56b29a311497 100644
--- a/nixos/modules/services/mail/exim.nix
+++ b/nixos/modules/services/mail/exim.nix
@@ -123,18 +123,11 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."exim.conf".source ];
       serviceConfig = {
+        ExecStartPre = "+${coreutils}/bin/install --group=${cfg.group} --owner=${cfg.user} --mode=0700 --directory ${cfg.spoolDir}";
         ExecStart = "!${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
         ExecReload = "!${coreutils}/bin/kill -HUP $MAINPID";
         User = cfg.user;
       };
-      preStart = ''
-        if ! test -d ${cfg.spoolDir}; then
-          ${coreutils}/bin/mkdir -p ${cfg.spoolDir}
-          ${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.spoolDir}
-        fi
-      '';
     };
-
   };
-
 }
diff --git a/nixos/tests/oci-containers.nix b/nixos/tests/oci-containers.nix
index d50a8c44aaa4..9d41e4baffdf 100644
--- a/nixos/tests/oci-containers.nix
+++ b/nixos/tests/oci-containers.nix
@@ -73,7 +73,7 @@ let
     type:
     makeTest {
       name = "oci-containers-podman-rootless-${type}";
-      meta.maintainers = lib.teams.flyingcircus.members;
+      meta.maintainers = lib.teams.flyingcircus.members ++ [ lib.maintainers.ma27 ];
       nodes = {
         podman =
           { pkgs, ... }:
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 8bb0d9277411..336d1a1136a9 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -314,7 +314,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       fpletz
       globin
-      ma27
       SchweGELBin
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 790ca307cdb1..8dc3dd3b9e40 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -444,7 +444,20 @@ buildStdenv.mkDerivation {
     # linking firefox hits the vm.max_map_count kernel limit with the default musl allocator
     # TODO: Default vm.max_map_count has been increased, retest without this
     export LD_PRELOAD=${mimalloc}/lib/libmimalloc.so
-  '';
+  ''
+  +
+    # fileport.h was exposed in SDK 15.4 but we have only 15.2 in nixpkgs so far.
+    lib.optionalString
+      (
+        stdenv.hostPlatform.isDarwin
+        && lib.versionAtLeast version "143"
+        && lib.versionOlder apple-sdk_15.version "15.4"
+      )
+      ''
+        mkdir -p xnu/sys
+        cp ${apple-sdk_15.sourceRelease "xnu"}/bsd/sys/fileport.h xnu/sys
+        export CXXFLAGS="-isystem $(pwd)/xnu"
+      '';
 
   # firefox has a different definition of configurePlatforms from nixpkgs, see configureFlags
   configurePlatforms = [ ];
diff --git a/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch b/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch
deleted file mode 100644
index 07bec5bffbd8..000000000000
--- a/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001
-From: Nicole Patricia Mazzuca <nicole@streganil.no>
-Date: Fri, 9 May 2025 09:32:21 +0200
-Subject: [PATCH] open: fix opening text/html messages
-
-This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329:
-aerc started using `path.Base(<part>)`, which returns `"."` on an empty
-path, but still checked for `""` two lines later.
-
-On macOS, the result is that aerc attempts to open the directory:
-
-```
-open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory
-```
-
-Signed-off-by: Nicole Patricia Mazzuca <nicole@streganil.no>
-Acked-by: Robin Jarry <robin@jarry.cc>
----
- commands/msgview/open.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/commands/msgview/open.go b/commands/msgview/open.go
-index a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3..7c770d4a90b771e3a18dfcb327f5e9306d5b5fa7 100644
---- a/commands/msgview/open.go
-+++ b/commands/msgview/open.go
-@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error {
- 		}
- 		filename := path.Base(part.FileName())
- 		var tmpFile *os.File
--		if filename == "" {
-+		if filename == "." {
- 			extension := ""
- 			if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 {
- 				extension = exts[0]
diff --git a/pkgs/by-name/ae/aerc/basename-temp-file.patch b/pkgs/by-name/ae/aerc/basename-temp-file.patch
deleted file mode 100644
index 8ca81c21db95..000000000000
--- a/pkgs/by-name/ae/aerc/basename-temp-file.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001
-From: Robin Jarry <robin@jarry.cc>
-Date: Wed, 9 Apr 2025 10:49:24 +0200
-Subject: [PATCH] open: only use part basename for temp file
-
-When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf",
-aerc creates a temp folder and tries to store the file by blindly
-concatenating the path as follows:
-
-	/tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf
-
-And when writing to this path, it gets a "No such file or directory"
-error because the intermediate "tmp" subfolder isn't created.
-
-Reported-by: Erik Colson <eco@ecocode.net>
-Signed-off-by: Robin Jarry <robin@jarry.cc>
----
- commands/msgview/open.go | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/commands/msgview/open.go b/commands/msgview/open.go
-index 4293b7e4892c137a7f3fbbe79245ffb6733b2671..a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3 100644
---- a/commands/msgview/open.go
-+++ b/commands/msgview/open.go
-@@ -5,6 +5,7 @@ import (
- 	"io"
- 	"mime"
- 	"os"
-+	"path"
- 	"path/filepath"
- 
- 	"git.sr.ht/~rjarry/aerc/app"
-@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error {
- 			app.PushError(err.Error())
- 			return
- 		}
--		filename := part.FileName()
-+		filename := path.Base(part.FileName())
- 		var tmpFile *os.File
- 		if filename == "" {
- 			extension := ""
diff --git a/pkgs/by-name/ae/aerc/package.nix b/pkgs/by-name/ae/aerc/package.nix
index 12ebcc226eb6..878962a650ec 100644
--- a/pkgs/by-name/ae/aerc/package.nix
+++ b/pkgs/by-name/ae/aerc/package.nix
@@ -16,31 +16,24 @@
 
 buildGoModule (finalAttrs: {
   pname = "aerc";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";
     rev = finalAttrs.version;
-    hash = "sha256-IBTM3Ersm8yUCgiBLX8ozuvMEbfmY6eW5xvJD20UgRA=";
+    hash = "sha256-UBXMAIuB0F7gG0dkpEF/3V4QK6FEbQw2ZLGGmRF884I=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-O1j0J6vCE6rap5/fOTxlUpXAG5mgZf8CfNOB4VOBxms=";
+  vendorHash = "sha256-E/DnfiHoDDNNoaNGZC/nvs8DiJ8F2+H2FzxpU7nK+bE=";
 
   nativeBuildInputs = [
     scdoc
     python3Packages.wrapPython
   ];
 
-  patches = [
-    ./runtime-libexec.patch
-
-    # TODO remove these with the next release
-    # they resolve a path injection vulnerability when saving attachments (CVE-2025-49466)
-    ./basename-temp-file.patch
-    ./basename-temp-file-fixup.patch
-  ];
+  patches = [ ./runtime-libexec.patch ];
 
   postPatch = ''
     substituteAllInPlace config/aerc.conf
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 27c928834e43..294b0fdcdd24 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -21,6 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-TyxeuDMmoRvIVaapA/KstFnARPpPv9h19Bg3/XnwQWs=";
 
+  buildNoDefaultFeatures = true;
+  # Would be cleaner with an "--all-features" option
+  buildFeatures = [ "full" ];
+
   nativeBuildInputs = [
     pkg-config
   ];
@@ -39,7 +43,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/RustyNova016/Alistral/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Power tools for Listenbrainz";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ jopejoe1 ];
+    maintainers = with lib.maintainers; [
+      jopejoe1
+      RustyNova
+    ];
     mainProgram = "alistral";
   };
 })
diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index b5730d72dc13..c1b939f51ac3 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1755532879-g2b6e3d"
+        "@sourcegraph/amp": "^0.0.1756368086-g6e639d"
       }
     },
     "node_modules/@colors/colors": {
@@ -37,11 +37,231 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@napi-rs/keyring": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.1.9.tgz",
+      "integrity": "sha512-qjg04yaJ/gFqgG7wDqLlWBvZpsjvYDtwL+xOr2vSM2JrhojuIKsw7pH013U7xJOradTVGeQqhwqgZtt2IblgOw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring-darwin-arm64": "1.1.9",
+        "@napi-rs/keyring-darwin-x64": "1.1.9",
+        "@napi-rs/keyring-freebsd-x64": "1.1.9",
+        "@napi-rs/keyring-linux-arm-gnueabihf": "1.1.9",
+        "@napi-rs/keyring-linux-arm64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-arm64-musl": "1.1.9",
+        "@napi-rs/keyring-linux-riscv64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-x64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-x64-musl": "1.1.9",
+        "@napi-rs/keyring-win32-arm64-msvc": "1.1.9",
+        "@napi-rs/keyring-win32-ia32-msvc": "1.1.9",
+        "@napi-rs/keyring-win32-x64-msvc": "1.1.9"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-arm64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-1.1.9.tgz",
+      "integrity": "sha512-/lVnrSFrut+8pQC6IcqlfHKzcEmf2XvQDOZPB5X4vI23GrNXBd56EuBlFPdTBtx46A8Bn+Aqi6pS8cnprHtcCw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-x64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-1.1.9.tgz",
+      "integrity": "sha512-G3PiFZTAFTzUnpSB31A/UaPjl48/3sDTLmLxaAZBEk7HcOyBnL31gA1YqhDCO7F2y5sD5TWiFiuID9MyqYOcjw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-freebsd-x64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-1.1.9.tgz",
+      "integrity": "sha512-R4XbvRhEzQyOy4yM+SMDgk8BgkLPkIzXGwR6QR0wJ2YrPeBx3F2TrgdHfsIGSn/X5Axg/2UlrCiZVciZ5BmusA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm-gnueabihf": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-1.1.9.tgz",
+      "integrity": "sha512-UrKy110I+zQyBtw4HLVUqZ1jDq11K3PmQIYgWAJNwB5VQOj4IQ63zLxk4V01Jx4bNOJmGNlvHDJUAyh/lC5Yww==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-1.1.9.tgz",
+      "integrity": "sha512-yOrhVpNGexDYzybe3dhmHQRPBDjlZPtJDE+eGSi1JwEqYlWDB+4IWjRsetxnO63DhnMFRLeMTdwWghsYrA7VwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-musl": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-1.1.9.tgz",
+      "integrity": "sha512-82EcuzoV/+Dxwi1HHhrEEprN5Ou7OsRKyTJSaRqiVuGvLaQDUhZX/4zXTTh4Pz24m22Q4aoJogafS31w8iKGGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-riscv64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-1.1.9.tgz",
+      "integrity": "sha512-Q1ar7DszC1X8FW6w7Ql7b72GFeAUxkTiOuxXChCFBy7eWCQSDrr52ZLroIowp82RmkQLZebnK+IwSssD2Ntoag==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-1.1.9.tgz",
+      "integrity": "sha512-LMvrYt1ho3pEDECssA7ATbcMDgayEUwwSD+UfrC7Hj1+C6dlvipwt5njwUDCno2OeXbjjisCo4CR9fDmXa4sZA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-musl": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-1.1.9.tgz",
+      "integrity": "sha512-x2i/TgS2/fM+6LRj1MrtVC580sepz5GcxbSCXpttx2H58uZKBF0vVM9HDPHoKP2w5++fyrA17eltJNYN3Ob46A==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-arm64-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-1.1.9.tgz",
+      "integrity": "sha512-14t6p8CTBNfGzLO5LXqurT+pAOf/ocGjOM/qiG/LW+jPkhyJYBNI9e3HKq3QX+ObbnxVpt4fAY02b4XLt7EWig==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-ia32-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-1.1.9.tgz",
+      "integrity": "sha512-7+7aXz5op6PtOnWYcK1GYXWQlk2zfpdPt9taLqmCCVpk1g4m3Gw1wyKyQxjrg9clHWdNhdWxhFEA0osDxG8/Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-x64-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-1.1.9.tgz",
+      "integrity": "sha512-P1wsSrSqDqvcXLL7yiH2RsO3De65wuEQj1ZjV9s1MHfEP5dIdriNYZfFsRBlOsl32GoK3qFzsuH5DTVviGEHSw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1755532879-g2b6e3d",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1755532879-g2b6e3d.tgz",
-      "integrity": "sha512-Xv3C/E6KHlq0gpEzMqaK9Fo3QhmvftBH8TcJGk5oGLhxEh/u49kRTifojDNjOh3A3HWneB1/SoYqLplOKn5QFg==",
+      "version": "0.0.1756368086-g6e639d",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1756368086-g6e639d.tgz",
+      "integrity": "sha512-sa+T/xmsz63BmdbVn8oaaq3ZgCiLQXdCO/++JPNjC7OD6UaTWWcvAhJ+Kbb5/XQDG190CMLCtWOrp8kSZK8jcQ==",
       "dependencies": {
+        "@napi-rs/keyring": "^1.1.9",
         "ansi-regex": "^6.1.0",
         "commander": "^11.1.0",
         "jsonc-parser": "^3.3.1",
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index 7f7fc10902d4..43446bf5d2cf 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1755532879-g2b6e3d";
+  version = "0.0.1756368086-g6e639d";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-i3YZcyaeq8CkMsEKhJg/39/0ijJGym2DcRFsZpBRXe0=";
+    hash = "sha256-ekSRtSwoPBL+SKkqqdTnMWZkLfF8SxYcrFPU2hpewC8=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-pZNvuSf9ioiv3UPmtdbXC0RXgtelrBl5ZtW/y/KnSqQ=";
+  npmDepsHash = "sha256-qQSn1sH1rjbKCEYdWZTgixBS6pe+scMnBofmpUYK7A0=";
 
   propagatedBuildInputs = [
     ripgrep
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index a2136796dfff..ca06e8b50472 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,18 +21,18 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-08-18";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "d919101220206d300875464a623b220dddc45fb6";
-    hash = "sha256-2q8TwBwGsUC7if/lm9yhVJCxZiAqR6JHLZCvlpGqkZ0=";
+    rev = "44659aa08a8c89c3dad2e468ff57cdb639c80732";
+    hash = "sha256-bYTZ1R/WPUUZoxmdreFGaRt9epAI+mcIrEvs5RJPUeA=";
     fetchSubmodules = true;
   };
 
   separateDebugInfo = true;
 
-  cargoHash = "sha256-k4lVgUNvQ8ySYs33nlyTcUgGxtXpiNEG/cFCAJNpJ+c=";
+  cargoHash = "sha256-94m7vl3a35pUKxDlQDPY6Ag5HniZyLZ1+vfcJj7cKhk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index 706c98dddbbb..e355842342ed 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2025-08-13";
+  version = "0-unstable-2025-08-21";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "46b2f23a2929fc367a8cd07a43975dda1e2ebc69";
-    hash = "sha256-7Y1Sshr1TXBhuNS/tmbT4UL74TycWZvTVyz1yYSXhbY=";
+    rev = "e39320b5b8a558de880d27af6e9cafac01cdc6ba";
+    hash = "sha256-aSdtaV2/xEYVL/5UXDhYBHYblS1ZZXk8fgBRq6DReX8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/da/dart-sass/package.nix b/pkgs/by-name/da/dart-sass/package.nix
index 5a24ba1e0ce3..2837769e963a 100644
--- a/pkgs/by-name/da/dart-sass/package.nix
+++ b/pkgs/by-name/da/dart-sass/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.90.0";
+  version = "1.91.0";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     tag = version;
-    hash = "sha256-ChHaFjuEhDpx2MVbsNNrFIg7LQ6tY/9BsWSF3MFofN0=";
+    hash = "sha256-a1yFDSvuEy/Xaksx9JgzcSOAigD3u3GDtWAJuB8osys=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/da/dart-sass/pubspec.lock.json b/pkgs/by-name/da/dart-sass/pubspec.lock.json
index 240f73712a1b..3a3031be8587 100644
--- a/pkgs/by-name/da/dart-sass/pubspec.lock.json
+++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json
@@ -464,11 +464,11 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "9436fe11f82d7cc1642a8671e5aa4149ffa9ae9116e6cf6dd665fc0653e3825c",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.0"
+      "version": "7.0.1"
     },
     "pool": {
       "dependency": "direct main",
@@ -484,11 +484,11 @@
       "dependency": "direct main",
       "description": {
         "name": "protobuf",
-        "sha256": "6153efcc92a06910918f3db8231fd2cf828ac81e50ebd87adc8f8a8cb3caff0e",
+        "sha256": "de9c9eb2c33f8e933a42932fe1dc504800ca45ebc3d673e6ed7f39754ee4053e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.1"
+      "version": "4.2.0"
     },
     "protoc_plugin": {
       "dependency": "direct dev",
@@ -744,11 +744,11 @@
       "dependency": "direct main",
       "description": {
         "name": "watcher",
-        "sha256": "0b7fd4a0bbc4b92641dbf20adfd7e3fd1398fe17102d94b674234563e110088a",
+        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.1.3"
     },
     "web": {
       "dependency": "transitive",
@@ -794,11 +794,11 @@
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "3202a47961c1a0af6097c9f8c1b492d705248ba309e6f7a72410422c05046851",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.6.0"
+      "version": "6.6.1"
     },
     "yaml": {
       "dependency": "direct dev",
diff --git a/pkgs/by-name/dn/dns-collector/package.nix b/pkgs/by-name/dn/dns-collector/package.nix
index 636c31493891..e2804a3a32f4 100644
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
+    hash = "sha256-99mVCuoog9ZkJoCCcUWkRJ2vA0IwftEcsSl6I02Qd4A=";
   };
   subPackages = [ "." ];
 
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
+  vendorHash = "sha256-se4vNVydYFYk07Shb3eRLnVmE82HG36cwFRYCdZiZPM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix
index e4b2e131b4c4..7e416ec9fffe 100644
--- a/pkgs/by-name/ea/easytier/package.nix
+++ b/pkgs/by-name/ea/easytier/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "easytier";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "EasyTier";
     repo = "EasyTier";
     tag = "v${version}";
-    hash = "sha256-N/WOkCaAEtPXJWdZ2452KTQmfFu+tZcH267p3azyntQ=";
+    hash = "sha256-0TuRNxf8xDhwUjBXJsv7dhgeYjr/voIt+/0tinImUhA=";
   };
 
   # remove if rust 1.89 merged
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       --replace-fail 'rust-version = "1.89.0"' ""
   '';
 
-  cargoHash = "sha256-Z4Q8ZPXPpA5OHkP2j389a6/Cdn9VmULf8sr1vPTelnw=";
+  cargoHash = "sha256-FQC3JD051fEZQO9UriNzJPrxE0QcSQ8p3VTk3tQGPBc=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index 26637b462a15..3db6fcdf3220 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "1.7.9";
+  version = "1.7.10";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CKw4FnEJVZHt7W7kxJRjTx0lW3akYap7VVil5cFSJZU=";
+    hash = "sha256-6C9ztbmYONhnNPZtZC0dQzU5qM8fqyigPVDKBhO7x8Y=";
   };
 
   buildInputs = [ php84 ];
@@ -38,12 +38,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-0qfpta3l7KXofzAw7V14KU9mRzPPSoh9435Z+Xj3cqU=";
+  vendorHash = "sha256-WCh0NeTfunWrh2gur7+2Otcoa3U21ldi4JvualiatG8=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-hY7QcQiDIJhGJk4X4lQ3qDn9WHwMF+jn2NDkKsHXeHY=";
+    hash = "sha256-NELRAxCnvUNC1LTfktufkcNc/R8gkn6S/jt7VlOWRtg=";
   };
 
   composerRepository = php84.mkComposerRepository {
diff --git a/pkgs/by-name/fr/friture/package.nix b/pkgs/by-name/fr/friture/package.nix
index 777516d458ed..127e163f4735 100644
--- a/pkgs/by-name/fr/friture/package.nix
+++ b/pkgs/by-name/fr/friture/package.nix
@@ -19,6 +19,7 @@ python3Packages.buildPythonApplication rec {
 
   postPatch = ''
     sed -i -e 's/==.*"/"/' -e '/packages=\[/a "friture.playback",' pyproject.toml
+    sed -i -e 's/tostring/tobytes/' friture/spectrogram_image.py
   '';
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index 5cdacc8b1a81..67a208edbb94 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -11,18 +11,18 @@
 }:
 let
   pname = "homebox";
-  version = "0.20.2";
+  version = "0.21.0";
   src = fetchFromGitHub {
     owner = "sysadminsmedia";
     repo = "homebox";
     tag = "v${version}";
-    hash = "sha256-6AJYC5SIITLBgYOq8TdwxAvRcyg8MOoA7WUDar9jSxM=";
+    hash = "sha256-JA0LawQHWLCJQno1GsajVSsLG3GGgDp2ttIa2xELX48=";
   };
 in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-GTSFpfql0ebXtZC3LeIZo8VbCZdsbemNK5EarDTRAf0=";
+  vendorHash = "sha256-fklNsQEqAjbiaAwTAh5H3eeANkNRDVRuJZ8ithJsfZs=";
   modRoot = "backend";
   # the goModules derivation inherits our buildInputs and buildPhases
   # Since we do pnpm thing in those it fails if we don't explicitly remove them
@@ -39,7 +39,7 @@ buildGoModule {
     inherit pname version;
     src = "${src}/frontend";
     fetcherVersion = 1;
-    hash = "sha256-gHQ8Evo31SFmnBHtLDY5j5zZwwVS4fmkT+9VHZJWhfs=";
+    hash = "sha256-gHx4HydL33i1SqzG1PChnlWdlO5NFa5F/R5Yq3mS4ng=";
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/hu/hurl/package.nix b/pkgs/by-name/hu/hurl/package.nix
index cb664fcb30b4..0d59ebefa8a9 100644
--- a/pkgs/by-name/hu/hurl/package.nix
+++ b/pkgs/by-name/hu/hurl/package.nix
@@ -2,7 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch2,
   pkg-config,
   installShellFiles,
   libxml2,
@@ -13,30 +12,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hurl";
-  version = "6.1.1";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "Orange-OpenSource";
     repo = "hurl";
     tag = version;
-    hash = "sha256-NtvBw8Nb2eZN0rjVL/LPyIdY5hBJGnz/cDun6VvwYZE=";
+    hash = "sha256-dmPXI2RHEi/wcdVVwBRtBgNXyBXFnm44236pqYjxgBs=";
   };
 
-  cargoHash = "sha256-WyNActmsHpr5fgN1a3X9ApEACWFVJMVoi4fBvKhGgZ0=";
-
-  patches = [
-    # Fix build with libxml-2.14, remove after next hurl release
-    # https://github.com/Orange-OpenSource/hurl/pull/3977
-    (fetchpatch2 {
-      name = "fix-libxml_2_14";
-      url = "https://github.com/Orange-OpenSource/hurl/commit/7c7b410c3017aeab0dfc74a6144e4cb8e186a10a.patch?full_index=1";
-      hash = "sha256-XjnCRIMwzfgUMIhm6pQ90pzA+c2U0EuhyvLUZDsI2GI=";
-    })
-  ];
+  cargoHash = "sha256-1bZaSdMJe39cDEOoqW82zS5NvOlZDGe1ia56BjXddyc=";
 
   nativeBuildInputs = [
     pkg-config
     installShellFiles
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/hw/hwloc/package.nix b/pkgs/by-name/hw/hwloc/package.nix
index 7b0fcc06a2d0..9681f97f108f 100644
--- a/pkgs/by-name/hw/hwloc/package.nix
+++ b/pkgs/by-name/hw/hwloc/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwloc";
-  version = "2.12.1";
+  version = "2.12.2";
 
   src = fetchFromGitHub {
     owner = "open-mpi";
     repo = "hwloc";
     tag = "hwloc-${finalAttrs.version}";
-    hash = "sha256-MM0xDysXv4eayi+y2YIP9CMohPe7gfvhltYUxuApRow=";
+    hash = "sha256-xLrhffz6pDSjkvAsPWSM3m8OxMV14/6kUgWOlI2u6go=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix
index 913dbc16235b..a099e449584d 100644
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kdlfmt";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xDv93cxCEaBybexleyTtcCCKHy2OL3z/BG2gJ7uqIrU=";
+    hash = "sha256-D/fv6dS17DUYGSKW4nGUdqxTQ68tOdZkSlvNbfV9lY0=";
   };
 
-  cargoHash = "sha256-TwZ/0G3lTCoj01e/qGFRxJCfe4spOpG/55GKhoI0img=";
+  cargoHash = "sha256-78AVptP4+2LHEDhn0VWp4xVIT2QzEo9B4lp6h65OamY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ke/kea/package.nix b/pkgs/by-name/ke/kea/package.nix
index f31dfb6f12b9..43ca2558e173 100644
--- a/pkgs/by-name/ke/kea/package.nix
+++ b/pkgs/by-name/ke/kea/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kea";
-  version = "3.0.0"; # only even minor versions are stable
+  version = "3.0.1"; # only even minor versions are stable
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/kea/${finalAttrs.version}/kea-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v5Y9HhCVHYxXDGBCr8zyfHCdReA4E70mOde7HPxP7nY=";
+    hash = "sha256-7IT+xLt/a50VqC51Wlcek0jrTW+8Yrs/bxKWzXokxWY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mf/mfaktc/package.nix b/pkgs/by-name/mf/mfaktc/package.nix
index 857bc9a0ef32..3db9a4d6d78f 100644
--- a/pkgs/by-name/mf/mfaktc/package.nix
+++ b/pkgs/by-name/mf/mfaktc/package.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mfaktc";
-  version = "0.23.5";
+  version = "0.23.6";
 
   src = fetchFromGitHub {
     owner = "primesearch";
     repo = "mfaktc";
     tag = "${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-NUcRd+WvmRjXC7rfOKFw4mue7V9oobsy/OTHHEoaiHo=";
+    hash = "sha256-+oO2zMGxcnkEUlD1q5Sy79aXp7BtGTTsvbKjPqBt7sw=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 31e9d61a9caa..a651cc68b74e 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-08-26";
+  version = "0-unstable-2025-08-27";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "cf6249c3930608772771c160b5a177c6bcff5801";
-    hash = "sha256-yZA8LsMMvTs/wYW2lO7hl7/79WSk+jL87FMKAcC7/AE=";
+    rev = "58cb8fe59ed6c1cbd64ae27a401286bd7cb39f23";
+    hash = "sha256-jGMZvpcpuW2ALGYkYF67HO7sV/XivWXPBqOedGazCAs=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/os/osqp-eigen/package.nix b/pkgs/by-name/os/osqp-eigen/package.nix
index 008b8910ba0c..d058ea0bb279 100644
--- a/pkgs/by-name/os/osqp-eigen/package.nix
+++ b/pkgs/by-name/os/osqp-eigen/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osqp-eigen";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "robotology";
     repo = "osqp-eigen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kK3Le8BSh81LbzjUaV6bQu2S9FfvpnC2NpM0ICfrr9c=";
+    hash = "sha256-2H7B+e6/AUjAxMmRe2OEBImV/FOBxv9tZQLoEg7mmGg=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/pl/planify/package.nix b/pkgs/by-name/pl/planify/package.nix
index 306590474fe1..c760c307e9f0 100644
--- a/pkgs/by-name/pl/planify/package.nix
+++ b/pkgs/by-name/pl/planify/package.nix
@@ -22,20 +22,19 @@
   libportal-gtk4,
   libsecret,
   libsoup_3,
-  pantheon,
   sqlite,
   webkitgtk_6_0,
 }:
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.13.2";
+  version = "4.13.4";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-bQ7kKUdInf6ZYO0X6kwW0HbuciiXhGyAdvnPcT0MllM=";
+    hash = "sha256-lHjMOpCr6ya0k5NMaiZW7jz0EGVUEADA7od87W8DcT8=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +63,6 @@ stdenv.mkDerivation rec {
     libportal-gtk4
     libsecret
     libsoup_3
-    pantheon.granite7
     sqlite
     webkitgtk_6_0
   ];
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 198c0801749e..d4375545c282 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-08-15";
+  version = "0-unstable-2025-08-25";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "b0c661931af5b376f79d1dadff684e3d165b4f64";
-    hash = "sha256-+FabuUU/OUiVks7rIGcpRUC8Ngh5GMevkuDj5kvdaPg=";
+    rev = "7ecc84d3b0e13f5d346a906dceda14321fddae1a";
+    hash = "sha256-XOatGZxhlcd1JXYJzgye/2Dok+Jmppj4cJuiYy6uhxc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sc/scion-apps/package.nix b/pkgs/by-name/sc/scion-apps/package.nix
index a382474d9ce4..6e2b16471092 100644
--- a/pkgs/by-name/sc/scion-apps/package.nix
+++ b/pkgs/by-name/sc/scion-apps/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule {
   pname = "scion-apps";
-  version = "unstable-2024-04-05";
+  version = "unstable-2025-03-12";
 
   src = fetchFromGitHub {
     owner = "netsec-ethz";
     repo = "scion-apps";
-    rev = "cb0dc365082788bcc896f0b55c4807b72c2ac338";
-    hash = "sha256-RzWtnUpZfwryOfumgXHV5QMceLY51Zv3KI0K6WLz8rs=";
+    rev = "55667b489898af09ae9d8290410da0be176549f9";
+    hash = "sha256-Tj0vtdYDmKbMpcO+t9KrtFewqdjusr0JRXpX6gY69WM=";
   };
 
-  vendorHash = "sha256-bz4vtELxrDfebk+00w9AcEiK/4skO1mE3lBDU1GkOrk=";
+  vendorHash = "sha256-om6ArtnKC9Gm5BdAqW57BnE0BsOmSPAAIPDDrQ5ZmJA=";
 
   postPatch = ''
     substituteInPlace webapp/web/tests/health/scmpcheck.sh \
diff --git a/pkgs/games/doom-ports/slade/git.nix b/pkgs/by-name/sl/slade-unstable/package.nix
similarity index 88%
rename from pkgs/games/doom-ports/slade/git.nix
rename to pkgs/by-name/sl/slade-unstable/package.nix
index 75938f8c8c8f..d9b7d2b05bc2 100644
--- a/pkgs/games/doom-ports/slade/git.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   which,
   zip,
-  wxGTK,
+  wxGTK32,
   gtk3,
   sfml_2,
   fluidsynth,
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    wxGTK
+    wxGTK32
     gtk3
     sfml_2
     fluidsynth
@@ -53,8 +53,8 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
-    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK) "wx-config"))
+    "-DwxWidgets_LIBRARIES=${wxGTK32}/lib"
+    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK32) "wx-config"))
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
@@ -72,7 +72,9 @@ stdenv.mkDerivation {
   meta = {
     description = "Doom editor";
     homepage = "http://slade.mancubus.net/";
+    mainProgram = "slade";
     license = lib.licenses.gpl2Only; # https://github.com/sirjuddington/SLADE/issues/1754
     platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ Gliczy ];
   };
 }
diff --git a/pkgs/games/doom-ports/slade/default.nix b/pkgs/by-name/sl/slade/package.nix
similarity index 75%
rename from pkgs/games/doom-ports/slade/default.nix
rename to pkgs/by-name/sl/slade/package.nix
index e804417ee625..d01793cdd99c 100644
--- a/pkgs/games/doom-ports/slade/default.nix
+++ b/pkgs/by-name/sl/slade/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   which,
   zip,
-  wxGTK,
+  wxGTK32,
   gtk3,
   sfml_2,
   fluidsynth,
@@ -19,14 +19,14 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
   version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-+i506uzO2q/9k7en6CKs4ui9gjszrMOYwW+V9W5Lvns=";
   };
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    wxGTK
+    wxGTK32
     gtk3
     sfml_2
     fluidsynth
@@ -52,8 +52,8 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
-    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK) "wx-config"))
+    "-DwxWidgets_LIBRARIES=${wxGTK32}/lib"
+    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK32) "wx-config"))
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
@@ -67,8 +67,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Doom editor";
     homepage = "http://slade.mancubus.net/";
+    changelog = "https://github.com/sirjuddington/SLADE/releases/tag/${finalAttrs.version}";
+    mainProgram = "slade";
     license = lib.licenses.gpl2Only; # https://github.com/sirjuddington/SLADE/issues/1754
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ Gliczy ];
   };
-}
+})
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index 76ae0feb72c6..8404a5c6ae70 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.98.0";
+  version = "0.98.1";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-GrREVY6P9L0ymH6QbXdtOm3mNzFD3u8HAOWDI7/x1VU=";
-  aarch64-linux.hash = "sha256-bLeU2REsKuVRei3WujGJEponiCZAviE8WyofWu2/NPg=";
-  x86_64-darwin.hash = "sha256-pN+6HapDxL/anMQJ2JeGmtBcRrlLMzJlEpSTo9QBbpg=";
-  aarch64-darwin.hash = "sha256-9y8NDrwiz9ql1Ia2F0UYF0XWBCyCahHZaAPOsvIJ5l0=";
+  x86_64-linux.hash = "sha256-e8duXDIODrU3eYuZvUcOoT8pAquRIOQ1aUtceY49s+s=";
+  aarch64-linux.hash = "sha256-HtNzzlnqApwt04R9W6cby8J/0xuYdUX2kMN4vBNKeiQ=";
+  x86_64-darwin.hash = "sha256-guM1FmDD+J0oBEH+hCzXBkrF0bzvyp5yvCeIO7mGcJg=";
+  aarch64-darwin.hash = "sha256-fHgPbJS4ZraqowkjPdDg0BbPiI+4dk9JpMSDKASl8wE=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index 822b7acfabbc..60bf63bfa01b 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.98.0";
+  version = "0.98.1";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-m5QDm8XOFi5Blbif044WMm/yyRrJx5t9/LjSto/gSL0=";
+  serverSource_x64.hash = "sha256-Ipl9mEDj6Wgzl31WonH4nouCoYs1lLgdxRAJr6I8l9c=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-1pdQEJIOxDU05z+31gNpsb9K4BpJ3njNsqxJymfD4wg=";
+  serverSource_arm64.hash = "sha256-XssGT2F1Idv7ICuTjJTAUYyors8ml50EXiOTHeA8KOw=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
diff --git a/pkgs/by-name/wa/waymore/package.nix b/pkgs/by-name/wa/waymore/package.nix
index a0f6c6fdcea1..76bcbae211c1 100644
--- a/pkgs/by-name/wa/waymore/package.nix
+++ b/pkgs/by-name/wa/waymore/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waymore";
-  version = "4.7";
+  version = "6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "waymore";
     tag = "v${version}";
-    hash = "sha256-oaswuXQPdAl2XExwEWnSN15roqNj9OVUr1Y1vsX461o=";
+    hash = "sha256-eoq1F6P3ZMb+O+SYmVhV3JHJMNbfcdyCnn4wy17RBv0=";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/wi/wiki-js/package.nix b/pkgs/by-name/wi/wiki-js/package.nix
index 81b66b23839b..159ecabc0a2d 100644
--- a/pkgs/by-name/wi/wiki-js/package.nix
+++ b/pkgs/by-name/wi/wiki-js/package.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
     homepage = "https://js.wiki/";
     description = "Modern and powerful wiki app built on Node.js";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/xf/xfsprogs/package.nix b/pkgs/by-name/xf/xfsprogs/package.nix
index 2bd9a341ac3a..0529b8efbfbf 100644
--- a/pkgs/by-name/xf/xfsprogs/package.nix
+++ b/pkgs/by-name/xf/xfsprogs/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.15.0";
+  version = "6.16.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-E7kfdL7vitERN/fZ1xBVVz2R6WG8VbsCRZVvabhM1wQ=";
+    hash = "sha256-+nuow1y5iOfWW352MP6dDhfo15eZ07mNt+GfK5sVBQY=";
   };
 
   outputs = [
diff --git a/pkgs/development/beam-modules/build-mix.nix b/pkgs/development/beam-modules/build-mix.nix
index 7903647ef43d..b8b365cdf01d 100644
--- a/pkgs/development/beam-modules/build-mix.nix
+++ b/pkgs/development/beam-modules/build-mix.nix
@@ -25,6 +25,7 @@
   meta ? { },
   enableDebugInfo ? false,
   mixEnv ? "prod",
+  mixTarget ? "host",
   removeConfig ? true,
   # A config directory that is considered for all the dependencies of an app, typically in $src/config/
   # This was initially added, as some of Mobilizon's dependencies need to access the config at build time.
@@ -51,6 +52,8 @@ let
         inherit version src;
 
         MIX_ENV = mixEnv;
+        MIX_TARGET = mixTarget;
+        MIX_BUILD_PREFIX = (if mixTarget == "host" then "" else "${mixTarget}_") + "${mixEnv}";
         MIX_DEBUG = if enableDebugInfo then 1 else 0;
         HEX_OFFLINE = 1;
 
@@ -122,7 +125,7 @@ let
 
             # Some packages like db_connection will use _build/shared instead of
             # honoring the $MIX_ENV variable.
-            for reldir in _build/{$MIX_ENV,shared}/lib/${name}/{src,ebin,priv,include} ; do
+            for reldir in _build/{$MIX_BUILD_PREFIX,shared}/lib/${name}/{src,ebin,priv,include} ; do
               if test -d $reldir ; then
                 # Some builds produce symlinks (eg: phoenix priv dircetory). They must
                 # be followed with -H flag.
diff --git a/pkgs/development/beam-modules/fetch-mix-deps.nix b/pkgs/development/beam-modules/fetch-mix-deps.nix
index 867410e4f0a0..b7b3a40e25e1 100644
--- a/pkgs/development/beam-modules/fetch-mix-deps.nix
+++ b/pkgs/development/beam-modules/fetch-mix-deps.nix
@@ -16,6 +16,7 @@
   sha256 ? "",
   src,
   mixEnv ? "prod",
+  mixTarget ? "host",
   debug ? false,
   meta ? { },
   patches ? [ ],
@@ -53,6 +54,7 @@ stdenvNoCC.mkDerivation (
     ];
 
     MIX_ENV = mixEnv;
+    MIX_TARGET = mixTarget;
     MIX_DEBUG = if debug then 1 else 0;
     DEBUG = if debug then 1 else 0; # for rebar3
     # the api with `mix local.rebar rebar path` makes a copy of the binary
diff --git a/pkgs/development/beam-modules/mix-configure-hook.sh b/pkgs/development/beam-modules/mix-configure-hook.sh
index f8b4f3d159fe..8c0ee23d5a1c 100755
--- a/pkgs/development/beam-modules/mix-configure-hook.sh
+++ b/pkgs/development/beam-modules/mix-configure-hook.sh
@@ -2,13 +2,13 @@
 # this hook will symlink all dependencies found in ERL_LIBS
 # since Elixir 1.12.2 elixir does not look into ERL_LIBS for
 # elixir depencencies anymore, so those have to be symlinked to the _build directory
-mkdir -p _build/"$MIX_ENV"/lib
+mkdir -p _build/"$MIX_BUILD_PREFIX"/lib
 while read -r -d ':' lib; do
     for dir in "$lib"/*; do
     # Strip version number for directory name if it exists, so naming of
     # all libs matches what mix's expectation.
     dest=$(basename "$dir" | cut -d '-' -f1)
-    build_dir="_build/$MIX_ENV/lib/$dest"
+    build_dir="_build/$MIX_BUILD_PREFIX/lib/$dest"
     ((MIX_DEBUG == 1)) && echo "Linking $dir to $build_dir"
     # Symlink libs to _build so that mix can find them when compiling.
     # This is what allows mix to compile the package without searching
diff --git a/pkgs/development/beam-modules/mix-release.nix b/pkgs/development/beam-modules/mix-release.nix
index eedd0917617b..ffc5e6a58979 100644
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@@ -27,6 +27,7 @@
   meta ? { },
   enableDebugInfo ? false,
   mixEnv ? "prod",
+  mixTarget ? "host",
   compileFlags ? [ ],
   # Build a particular named release.
   # see https://hexdocs.pm/mix/1.12/Mix.Tasks.Release.html#content
@@ -123,6 +124,8 @@ stdenv.mkDerivation (
     buildInputs = buildInputs ++ lib.optionals (escriptBinName != null) [ erlang ];
 
     MIX_ENV = mixEnv;
+    MIX_TARGET = mixTarget;
+    MIX_BUILD_PREFIX = (if mixTarget == "host" then "" else "${mixTarget}_") + "${mixEnv}";
     MIX_DEBUG = if enableDebugInfo then 1 else 0;
     HEX_OFFLINE = 1;
 
diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index 4d267ef0fd40..775c96ddf7ba 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -53,6 +53,11 @@ buildPythonPackage {
     filelock
   ];
 
+  disabledTests = [
+    # AssertionError: assert ''
+    "test_get_html"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 5c4c653ed981..905dc5d47a04 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -15,30 +15,21 @@
   ninja,
   numpy,
   torch,
+  pynvml,
+  einops,
 }:
 
-let
+buildPythonPackage rec {
   pname = "flashinfer";
-  version = "0.2.9";
-
-  src_cutlass = fetchFromGitHub {
-    owner = "NVIDIA";
-    repo = "cutlass";
-    # Using the revision obtained in submodule inside flashinfer's `3rdparty`.
-    tag = "v${version}";
-    hash = "sha256-d4czDoEv0Focf1bJHOVGX4BDS/h5O7RPoM/RrujhgFQ=";
-  };
-
-in
-buildPythonPackage {
-  format = "setuptools";
-  inherit pname version;
+  version = "0.2.14";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flashinfer-ai";
     repo = "flashinfer";
     tag = "v${version}";
-    hash = "sha256-M0q6d+EpuTehbw68AQ73Fhwmw2tzjymYjSXaol9QC7Y=";
+    hash = "sha256-MZiZwdedz+Vxa1+VBfHDKf4NVSiOAytGboIJ0DvCXmk=";
+    fetchSubmodules = true;
   };
 
   build-system = [ setuptools ];
@@ -48,20 +39,16 @@ buildPythonPackage {
     ninja
     (lib.getBin cudaPackages.cuda_nvcc)
   ];
+
   dontUseCmakeConfigure = true;
 
-  buildInputs = [
-    cudaPackages.cuda_cudart
-    cudaPackages.libcublas
-    cudaPackages.cuda_cccl
-    cudaPackages.libcurand
+  buildInputs = with cudaPackages; [
+    cuda_cccl
+    cuda_cudart
+    libcublas
+    libcurand
   ];
 
-  postPatch = ''
-    rmdir 3rdparty/cutlass
-    ln -s ${src_cutlass} 3rdparty/cutlass
-  '';
-
   # FlashInfer offers two installation modes:
   #
   # JIT mode: CUDA kernels are compiled at runtime using PyTorch’s JIT, with
@@ -86,6 +73,8 @@ buildPythonPackage {
   dependencies = [
     numpy
     torch
+    pynvml
+    einops
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index b671e36c0c90..508a28a22356 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -59,6 +59,9 @@ buildPythonPackage rec {
     rev-prefix = "google-cloud-kms-v";
   };
 
+  # picks the wrong tag
+  passthru.skipBulkUpdate = true;
+
   meta = {
     description = "Cloud Key Management Service (KMS) API API client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-kms";
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index 56c1382c95bd..10d86bf89974 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -158,6 +158,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # AssertionError: assert CompletionReq...lm_xargs=None) == CompletionReq...lm_xargs=None)
+    "test_convert_params"
+
+    # Flaky: ray.exceptions.ActorDiedError: The actor died unexpectedly before finishing this task.
+    "test_explain"
+    "test_infer"
+    "test_predict"
+
     # Require network access
     "test_infer_graph_endpoint"
     "test_infer_path_based_routing"
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index e245f5b7e524..305581a4ef91 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -1,57 +1,96 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  poetry-core,
-  numpy,
-  pydantic,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   jsonschema,
+  numpy,
   opencv-python-headless,
-  sentencepiece,
-  typing-extensions,
-  tiktoken,
   pillow,
+  pydantic,
+  pydantic-extra-types,
   requests,
+  sentencepiece,
+  tiktoken,
+  typing-extensions,
+
+  # tests
+  click,
+  fastapi,
+  huggingface-hub,
+  openai,
+  pycountry,
+  pydantic-settings,
+  pytestCheckHook,
+  soundfile,
+  soxr,
+  uvicorn,
 }:
 
 buildPythonPackage rec {
   pname = "mistral-common";
-  version = "1.8.3";
+  version = "1.8.4";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "mistral_common";
-    inherit version;
-    hash = "sha256-DRl52CIntiX21xs8goF28FnajQ9aMwfN9TtIQJo5cKQ=";
+  src = fetchFromGitHub {
+    owner = "mistralai";
+    repo = "mistral-common";
+    tag = "v${version}";
+    hash = "sha256-HB6dsqiDSLhjyANk7ZT/cU98mjJamegAF0uKH8GfgM8=";
   };
 
-  pythonRelaxDeps = [
-    "pillow"
-    "tiktoken"
-  ];
-
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   dependencies = [
-    numpy
-    pydantic
     jsonschema
+    numpy
     opencv-python-headless
-    sentencepiece
-    typing-extensions
-    tiktoken
     pillow
+    pydantic
+    pydantic-extra-types
     requests
+    sentencepiece
+    tiktoken
+    typing-extensions
   ];
 
-  doCheck = true;
-
   pythonImportsCheck = [ "mistral_common" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    click
+    fastapi
+    huggingface-hub
+    openai
+    pycountry
+    pydantic-settings
+    pytestCheckHook
+    soundfile
+    soxr
+    uvicorn
+  ];
+
+  disabledTests = [
+    # Require internet
+    "test_download_gated_image"
+    "test_image_encoder_formats"
+    "test_image_processing"
+
+    # AssertionError: Regex pattern did not match.
+    "test_from_url"
+
+    # AssertionError, Extra items in the right set
+    "test_openai_chat_fields"
+  ];
+
+  meta = {
     description = "Tools to help you work with Mistral models";
     homepage = "https://github.com/mistralai/mistral-common";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ bgamari ];
+    changelog = "https://github.com/mistralai/mistral-common/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bgamari ];
   };
 }
diff --git a/pkgs/development/python-modules/openai-harmony/default.nix b/pkgs/development/python-modules/openai-harmony/default.nix
new file mode 100644
index 000000000000..74251b28ad4e
--- /dev/null
+++ b/pkgs/development/python-modules/openai-harmony/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  rustPlatform,
+
+  # dependencies
+  pydantic,
+
+  # optional-dependencies
+  fastapi,
+  uvicorn,
+}:
+
+buildPythonPackage rec {
+  pname = "openai-harmony";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "openai";
+    repo = "harmony";
+    rev = "v${version}";
+    hash = "sha256-2LOrMLrNR1D3isbjiv5w+1Ni9IMwMEPPTOnG1rm//ag=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-tQq6PFMYghIfJu8CddbXFKXxr41GJaElbCCQuSpnaqk=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  dependencies = [
+    pydantic
+  ];
+
+  optional-dependencies = {
+    demo = [
+      fastapi
+      uvicorn
+    ];
+  };
+
+  pythonImportsCheck = [ "openai_harmony" ];
+
+  # Tests require internet access
+  doCheck = false;
+
+  meta = {
+    description = "Renderer for the harmony response format to be used with gpt-oss";
+    homepage = "https://github.com/openai/harmony";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index 7bc6f58ee068..a7407fdec887 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "4.4.0";
+  version = "4.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "optuna";
     repo = "optuna";
     tag = "v${version}";
-    hash = "sha256-S9F9xni1cnmIbWu5n7BFvUCvQmBP3iBYS1ntg6vQ8ZQ=";
+    hash = "sha256-qaCOpqKRepm/a1Nh98PV6RcRkadLK5E429pn1zaWQDA=";
   };
 
   build-system = [
@@ -138,6 +138,8 @@ buildPythonPackage rec {
     "test_visualizations_with_single_objectives"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "optuna" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pydash/default.nix b/pkgs/development/python-modules/pydash/default.nix
index 27f1675ccdf3..57600d4fa5b7 100644
--- a/pkgs/development/python-modules/pydash/default.nix
+++ b/pkgs/development/python-modules/pydash/default.nix
@@ -50,6 +50,6 @@ buildPythonPackage rec {
     homepage = "https://pydash.readthedocs.io";
     changelog = "https://github.com/dgilland/pydash/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyopengl-accelerate/default.nix b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
index c56ab161a921..551b059d8f34 100644
--- a/pkgs/development/python-modules/pyopengl-accelerate/default.nix
+++ b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
@@ -10,14 +10,15 @@
 
 buildPythonPackage rec {
   pname = "pyopengl-accelerate";
-  version = "3.1.9";
+  version = "3.1.10";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "pyopengl_accelerate";
     inherit version;
-    hash = "sha256-hZV8fHaXWBj/dZ7JJD+dxwke9vNz6jei61DDIP2ahvM=";
+    hash = "sha256-gnUcg/Cm9zK4tZI5kO3CRB04F2qYdWsXGOjWxDefWnE=";
   };
+
   build-system = [
     cython
     numpy
@@ -25,11 +26,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=int-conversion"
-    "-Wno-error=incompatible-pointer-types"
-  ];
-
   meta = {
     description = "This set of C (Cython) extensions provides acceleration of common operations for slow points in PyOpenGL 3.x";
     homepage = "https://pyopengl.sourceforge.net/";
diff --git a/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch b/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
deleted file mode 100644
index 3c80f8e24e65..000000000000
--- a/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/setup.py
-+++ b/setup.py
-@@ -340,14 +340,7 @@ def _is_hpu() -> bool:
-         out = subprocess.run(["hl-smi"], capture_output=True, check=True)
-         is_hpu_available = out.returncode == 0
-     except (FileNotFoundError, PermissionError, subprocess.CalledProcessError):
--        if sys.platform.startswith("linux"):
--            try:
--                output = subprocess.check_output(
--                    'lsmod | grep habanalabs | wc -l', shell=True)
--                is_hpu_available = int(output) > 0
--            except (ValueError, FileNotFoundError, PermissionError,
--                    subprocess.CalledProcessError):
--                pass
-+        is_hpu_available = False
-     return is_hpu_available
- 
- 
diff --git a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
index 9bf7d3cdf4d8..f16982ece4a7 100644
--- a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
+++ b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
@@ -1,25 +1,12 @@
-From 7511784ceb9252091a9d63ac6b54dcc67dd2b262 Mon Sep 17 00:00:00 2001
-From: Conroy Cheers <conroy@corncheese.org>
-Date: Fri, 13 Jun 2025 17:42:10 +1000
-Subject: [PATCH] drop intel reqs
-
----
- requirements/cpu.txt | 3 ---
- 1 file changed, 3 deletions(-)
-
 diff --git a/requirements/cpu.txt b/requirements/cpu.txt
-index d7b0fc6d8..be2df751b 100644
+index d80354342..7434f32f0 100644
 --- a/requirements/cpu.txt
 +++ b/requirements/cpu.txt
-@@ -24,8 +24,5 @@ datasets # for benchmark scripts
- # cpu cannot use triton 3.3.0
- triton==3.2.0; platform_machine == "x86_64"
+@@ -21,7 +21,4 @@ torchvision; platform_machine != "ppc64le" and platform_machine != "s390x"
+ torchvision==0.22.0; platform_machine == "ppc64le"
+ datasets # for benchmark scripts
  
 -# Intel Extension for PyTorch, only for x86_64 CPUs
 -intel-openmp==2024.2.1; platform_machine == "x86_64"
--intel_extension_for_pytorch==2.7.0; platform_machine == "x86_64"
- py-libnuma; platform_system != "Darwin"
- psutil; platform_system != "Darwin"
--- 
-2.49.0
-
+-intel_extension_for_pytorch==2.6.0; platform_machine == "x86_64" # torch>2.6.0+cpu has performance regression on x86 platform, see https://github.com/pytorch/pytorch/pull/151218
+ triton==3.2.0; platform_machine == "x86_64" # Triton is required for torch 2.6+cpu, as it is imported in torch.compile.
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index cec9c00eadcc..b5e4edd75edc 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   pythonAtLeast,
   fetchFromGitHub,
-  fetchpatch,
   symlinkJoin,
   autoAddDriverRunpath,
 
@@ -45,6 +44,8 @@
   lm-format-enforcer,
   prometheus-fastapi-instrumentator,
   cupy,
+  cbor2,
+  pybase64,
   gguf,
   einops,
   importlib-metadata,
@@ -69,6 +70,8 @@
   bitsandbytes,
   flashinfer,
   py-libnuma,
+  setproctitle,
+  openai-harmony,
 
   # internal dependency - for overriding in overlays
   vllm-flash-attn ? null,
@@ -92,13 +95,13 @@ let
   shouldUsePkg =
     pkg: if pkg != null && lib.meta.availableOn stdenv.hostPlatform pkg then pkg else null;
 
-  # see CMakeLists.txt, grepping for GIT_TAG near cutlass
+  # see CMakeLists.txt, grepping for CUTLASS_REVISION
   # https://github.com/vllm-project/vllm/blob/v${version}/CMakeLists.txt
   cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    tag = "v3.9.2";
-    hash = "sha256-teziPNA9csYvhkG5t2ht8W8x5+1YGGbHm8VKx4JoxgI=";
+    tag = "v4.0.0";
+    hash = "sha256-HJY+Go1viPkSVZPEs/NyMtYJzas4mMLiIZF3kNX+WgA=";
   };
 
   flashmla = stdenv.mkDerivation {
@@ -111,8 +114,8 @@ let
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "FlashMLA";
-      rev = "575f7724b9762f265bbee5889df9c7d630801845";
-      hash = "sha256-8WrKMl0olr0nYV4FRJfwSaJ0F5gWQpssoFMjr9tbHBk=";
+      rev = "0e43e774597682284358ff2c54530757b654b8d1";
+      hash = "sha256-wxL/jtq/lsLg1o+4392KNgfw5TYlW6lqEVbmR3Jl4/Q=";
     };
 
     dontConfigure = true;
@@ -138,8 +141,8 @@ let
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "flash-attention";
-      rev = "8798f27777fb57f447070301bf33a9f9c607f491";
-      hash = "sha256-UTUvATGN1NU/Bc8qo078q6bEgILLmlrjL7Yk2iAJhg4=";
+      rev = "57b4e68b9f9d94750b46de8f8dbd2bfcc86edd4f";
+      hash = "sha256-c7L7WZVVEnXMOTPBoSp7jhkl9d4TA4sj11QvOSWTDIE=";
     };
 
     dontConfigure = true;
@@ -161,7 +164,7 @@ let
 
   cpuSupport = !cudaSupport && !rocmSupport;
 
-  # https://github.com/pytorch/pytorch/blob/v2.7.0/torch/utils/cpp_extension.py#L2343-L2345
+  # https://github.com/pytorch/pytorch/blob/v2.7.1/torch/utils/cpp_extension.py#L2343-L2345
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -231,6 +234,7 @@ let
     libcusolver # cusolverDn.h
     cuda_nvtx
     cuda_nvrtc
+    # cusparselt # cusparseLt.h
     libcublas
   ];
 
@@ -247,7 +251,7 @@ in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.9.1";
+  version = "0.10.1.1";
   pyproject = true;
 
   # https://github.com/vllm-project/vllm/issues/12083
@@ -259,23 +263,12 @@ buildPythonPackage rec {
     owner = "vllm-project";
     repo = "vllm";
     tag = "v${version}";
-    hash = "sha256-sp7rDpewTPXTVRBJHJMj+8pJDS6wAu0/OTJZwbPPqKc=";
+    hash = "sha256-lLNjBv5baER0AArX3IV4HWjDZ2jTGXyGIvnHupR8MGM=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "remove-unused-opentelemetry-semantic-conventions-ai-dep.patch";
-      url = "https://github.com/vllm-project/vllm/commit/6a5d7e45f52c3a13de43b8b4fa9033e3b342ebd2.patch";
-      hash = "sha256-KYthqu+6XwsYYd80PtfrMMjuRV9+ionccr7EbjE4jJE=";
-    })
-    (fetchpatch {
-      name = "fall-back-to-gloo-when-nccl-unavailable.patch";
-      url = "https://github.com/vllm-project/vllm/commit/aa131a94410683b0a02e74fed2ce95e6c2b6b030.patch";
-      hash = "sha256-jNlQZQ8xiW85JWyBjsPZ6FoRQsiG1J8bwzmQjnaWFBg=";
-    })
     ./0002-setup.py-nix-support-respect-cmakeFlags.patch
     ./0003-propagate-pythonpath.patch
-    ./0004-drop-lsmod.patch
     ./0005-drop-intel-reqs.patch
   ];
 
@@ -354,6 +347,7 @@ buildPythonPackage rec {
     aioprometheus
     blake3
     cachetools
+    cbor2
     depyf
     fastapi
     llguidance
@@ -366,6 +360,7 @@ buildPythonPackage rec {
     prometheus-fastapi-instrumentator
     py-cpuinfo
     pyarrow
+    pybase64
     pydantic
     python-json-logger
     python-multipart
@@ -393,6 +388,8 @@ buildPythonPackage rec {
     opentelemetry-api
     opentelemetry-exporter-otlp
     bitsandbytes
+    setproctitle
+    openai-harmony
     # vLLM needs Torch's compiler to be present in order to use torch.compile
     torch.stdenv.cc
   ]
@@ -476,8 +473,5 @@ buildPythonPackage rec {
       # find_isa
       "x86_64-darwin"
     ];
-    # ValueError: 'aimv2' is already used by a Transformers config, pick another name.
-    # Version bump ongoing in https://github.com/NixOS/nixpkgs/pull/429117
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/whisperx/default.nix b/pkgs/development/python-modules/whisperx/default.nix
index 72883f63cf76..e6ad813d8e33 100644
--- a/pkgs/development/python-modules/whisperx/default.nix
+++ b/pkgs/development/python-modules/whisperx/default.nix
@@ -67,10 +67,14 @@ buildPythonPackage rec {
       '"ffmpeg"' '"${lib.getExe ffmpeg}"'
   '';
 
-  # > Checking runtime dependencies for whisperx-3.3.2-py3-none-any.whl
-  # >   - faster-whisper==1.1.0 not satisfied by version 1.1.1
-  # This has been updated on main, so we expect this clause to be removed upon the next update.
-  pythonRelaxDeps = [ "faster-whisper" ];
+  pythonRelaxDeps = [
+    # > Checking runtime dependencies for whisperx-3.3.2-py3-none-any.whl
+    # >   - faster-whisper==1.1.0 not satisfied by version 1.1.1
+    # This has been updated on main, so we expect this clause to be removed upon the next update.
+    "faster-whisper"
+
+    "ctranslate2"
+  ];
 
   # Import check fails due on `aarch64-linux` ONLY in the sandbox due to onnxruntime
   # not finding its default logger, which then promptly segfaults.
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index d8dd5c0382a6..32e976b0cc3e 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "17.0.0";
+  version = "17.0.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-YW3+pDphYrwajM9EDh32p0uXf8sCjXa3x3mh+43jnow=";
+    hash = "sha256-9WcYCEdnBzkami7bmWPqSmtrkMeMvnTs4aygxrQuUYQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 8899e7bad9d9..5f6111e5f7fa 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -38,8 +38,8 @@ let
       # Additional make flags passed to kbuild
       extraMakeFlags ? [ ],
 
-      # enables the options in ./common-config.nix; if `false` then only
-      # `structuredExtraConfig` is used
+      # enables the options in ./common-config.nix and lib/systems/platform.nix;
+      # if `false` then only `structuredExtraConfig` is used
       enableCommonConfig ? true
 
       , # kernel intermediate config overrides, as a set
@@ -136,7 +136,8 @@ let
         configfile.moduleStructuredConfig.intermediateNixConfig
         # extra config in legacy string format
         + extraConfig
-        + stdenv.hostPlatform.linux-kernel.extraConfig or "";
+        # need the 'or ""' at the end in case enableCommonConfig = true and extraConfig is not present
+        + lib.optionalString enableCommonConfig stdenv.hostPlatform.linux-kernel.extraConfig or "";
 
       structuredConfigFromPatches = map (
         {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8da20935de80..7234a4bf12a1 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,33 +5,33 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.148",
-        "hash": "sha256:18c024bqqc3srzv2gva55p95yghjc6x3p3f54v3hziki4wx3v86r",
-        "lts": false
+        "version": "6.1.149",
+        "hash": "sha256:0fdyfxw80zhkwh29m5v7xfmbyks5wi6isdq6bv96cn4ssfw0dsf4",
+        "lts": true
     },
     "5.15": {
-        "version": "5.15.189",
-        "hash": "sha256:1hshd26ahn6dbw6jnqi0v5afpk672w7p09mk7iri93i7hxdh5l73",
+        "version": "5.15.190",
+        "hash": "sha256:0146lslj0my0mhcx7wfp984f270zr8iiyq9899v6f7cflkqi9f32",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.240",
-        "hash": "sha256:04sdcf4aqsqchii38anzmk9f9x65wv8q1x3m9dandmi6fabw724d",
+        "version": "5.10.241",
+        "hash": "sha256:1mnqjvb1hmr7p035c66k3z0idirhsj9j5zwgb92gi0ac0s1fkh88",
         "lts": true
     },
     "5.4": {
-        "version": "5.4.296",
-        "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx",
+        "version": "5.4.297",
+        "hash": "sha256:0hd8x32xgvj4qnc6cls0q21zfgvxxfz7xhbwgl48hxfggbmgq37i",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.102",
-        "hash": "sha256:0p6yjifwyrqlppn40isgxb0b5vqmljggmnp7w75vlc2c6fvzxll0",
+        "version": "6.6.103",
+        "hash": "sha256:13mi8blsw0gps586qbvh7ga5r9pv9jld4fkbp9vaaaz6qcwdv26j",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.43",
-        "hash": "sha256:1vmxywg11z946i806sg7rk7jr9px87spmwwbzjxpps2nsjybpjqg",
+        "version": "6.12.44",
+        "hash": "sha256:1bmx2vpxy6nkxnmm2a3zmv9smaajfhvslj6id54j4yq2sc722l5n",
         "lts": true
     },
     "6.15": {
@@ -40,8 +40,8 @@
         "lts": false
     },
     "6.16": {
-        "version": "6.16.3",
-        "hash": "sha256:118bg72mdrf75r36gki5zi18ynl2kcygrf24pwd58by1anh9nhw0",
+        "version": "6.16.4",
+        "hash": "sha256:08mnd8qir2vxjmgblhnqfrfbv2zlig68f4r5askk7d8h3b3y79fn",
         "lts": false
     }
 }
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index b8ba563931b7..6052bde08752 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -28,21 +28,21 @@ let
   # stable is on an older patch-release of Go and then the build would fail
   # after a backport.
   patchGoVersion = ''
-    find . -name go.mod -not -path "./.bingo/*" -print0 | while IFS= read -r -d ''' line; do
+    find . -name go.mod -not -path "./.bingo/*" -and -not -path "./hack/*" -and -not -path "./.citools/*" -print0 | while IFS= read -r -d ''' line; do
       substituteInPlace "$line" \
-        --replace-fail "go 1.24.4" "go 1.24.0"
+        --replace-fail "go 1.24.6" "go 1.24.0"
     done
     find . -name go.work -print0 | while IFS= read -r -d ''' line; do
       substituteInPlace "$line" \
-        --replace-fail "go 1.24.4" "go 1.24.0"
+        --replace-fail "go 1.24.6" "go 1.24.0"
     done
     substituteInPlace Makefile \
-      --replace-fail "GO_VERSION = 1.24.4" "GO_VERSION = 1.24.0"
+      --replace-fail "GO_VERSION = 1.24.6" "GO_VERSION = 1.24.0"
   '';
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "12.1.0";
+  version = "12.1.1";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -54,7 +54,7 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-yraCuPLe68ryCgFzOZPL1H/JYynEvxijjgxMmQvcPZE=";
+    hash = "sha256-41OqvOTHlP66UtAecrpeArKldj0DNxK1oxTtQEihbo8=";
   };
 
   # Fix build
@@ -78,14 +78,14 @@ buildGoModule rec {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-+0L68wHR2nCp1g1PqyLIYatc+CIbvLqVUDa7CoyV/fo=";
+    hash = "sha256-51jCwnfWJoBICesM3SKiEvRC/Q1qUD310q59DucPdMs=";
   };
 
   disallowedRequisites = [ offlineCache ];
 
   postPatch = patchGoVersion;
 
-  vendorHash = "sha256-a31jJN1NIHihFwbtBuLzV4lRKYWv8GtIHh6EwVMWdbM=";
+  vendorHash = "sha256-9z3HqheXLNh3zfmp1A620vzzf5yZBUJsbj/cc6J+xTg=";
 
   proxyVendor = true;
 
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix
new file mode 100644
index 000000000000..309413cb645f
--- /dev/null
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix
@@ -0,0 +1,18 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "grafana-sentry-datasource";
+  version = "2.2.1";
+  zipHash = {
+    x86_64-linux = "sha256-6pjBUqUHXLLgFzfal/OKsMBVlVXxuRglOj3XRnnduRY=";
+    aarch64-linux = "sha256-0kjxBnv34lRB5qeVOyik7qvlEsz7CYur9EyIDTe+AKM=";
+    x86_64-darwin = "sha256-yHgF+XmJXnJjfPwabs1dsrnWvssTmYpeZUXUl+gQxfM=";
+    aarch64-darwin = "sha256-ysLXSKG7q/u70NynYqKKRlYIl5rkYy0AMoza3sQSPNM=";
+  };
+  meta = {
+    description = "Integrate Sentry data into Grafana";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arianvp ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana/plugins/plugins.nix b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
index bc22c3443e98..89c749ef3bcf 100644
--- a/pkgs/servers/monitoring/grafana/plugins/plugins.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
@@ -23,6 +23,7 @@
   grafana-piechart-panel = callPackage ./grafana-piechart-panel { };
   grafana-polystat-panel = callPackage ./grafana-polystat-panel { };
   grafana-pyroscope-app = callPackage ./grafana-pyroscope-app { };
+  grafana-sentry-datasource = callPackage ./grafana-sentry-datasource { };
   grafana-worldmap-panel = callPackage ./grafana-worldmap-panel { };
   marcusolsson-calendar-panel = callPackage ./marcusolsson-calendar-panel { };
   marcusolsson-csv-datasource = callPackage ./marcusolsson-csv-datasource { };
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 145708bc4fdf..38b967095c78 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -59,14 +59,14 @@ let
 in
 {
   nextcloud30 = generic {
-    version = "30.0.13";
-    hash = "sha256-viMmo689YHK08Uza05O5Y3qj3EDK9W/TgXXuo6j/j4Y=";
+    version = "30.0.14";
+    hash = "sha256-LUT1nji4UE/98GhY9I+yVboTqsJONVzfR6Q+qiLY0EE=";
     packages = nextcloud30Packages;
   };
 
   nextcloud31 = generic {
-    version = "31.0.7";
-    hash = "sha256-ACpdA64Fp/DDBWlH1toLeaRNPXIPVyj+UVWgxaO07Gk=";
+    version = "31.0.8";
+    hash = "sha256-YhF9t4P+d1Z3zotoD0tIwTuVkWV/7TtQi9w6MrQRXLA=";
     packages = nextcloud31Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/packages/30.json b/pkgs/servers/nextcloud/packages/30.json
index b51036e1df9e..a627f1779696 100644
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-D0p9ny3KeuBdWVirQUDb4gq+eCusZKrDxJ+UAjEJz84=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.4/contacts-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-A8dFfPee4Te1zbLaJfohuyxnMbaysmfDa3hicJnqfkM=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.5/contacts-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -210,8 +210,8 @@
     ]
   },
   "maps": {
-    "hash": "sha256-E0S/CwXyye19lcuiONEQCyHJqlL0ZG1A9Q7oOTEZH1g=",
-    "url": "https://github.com/nextcloud/maps/releases/download/v1.6.0-3-nightly/maps-1.6.0-3-nightly.tar.gz",
+    "hash": "sha256-IupRymjs955TiUutzoTTMeESNfBmAp51l+oBaZwfdN0=",
+    "url": "https://github.com/nextcloud/maps/releases/download/v1.6.0/maps-1.6.0.tar.gz",
     "version": "1.6.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
     "homepage": "https://github.com/nextcloud/maps",
@@ -250,9 +250,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-WpxRJ45N+aO+cOp5u6+uwlijzofpmdcUg07ax3p3WDA=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.2/notes-v4.12.2.tar.gz",
-    "version": "4.12.2",
+    "hash": "sha256-tFR9r5kmR7Egczt62I7k8JUllAc4cNu95d3NSUGD108=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.3/notes-v4.12.3.tar.gz",
+    "version": "4.12.3",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -270,10 +270,10 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-Nj8siAeNyN/lyq+K5y92ZXMqRLmhawtR9Q6b5dq7LL0=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.9.0/onlyoffice.tar.gz",
-    "version": "9.9.0",
-    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
+    "hash": "sha256-JNAQQK1jA2RI3aDuIXw7NC047oXSZKkzkVjZbw8BxXs=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.10.0/onlyoffice.tar.gz",
+    "version": "9.10.0",
+    "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
       "agpl"
@@ -450,9 +450,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-MS1+fiDTufQXtKCG/45B2hQEfAVbsZb+TZb74f4EvAE=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.6.0/user_saml-v6.6.0.tar.gz",
-    "version": "6.6.0",
+    "hash": "sha256-kE51sQWjGzDbJxgRQNFmexcW+s9/6lcbW2Rxf+Tj6hA=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v7.0.0/user_saml-v7.0.0.tar.gz",
+    "version": "7.0.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
@@ -460,9 +460,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-njiTDKDiwDeOH9biOohIQueAI8/pSijWy8EDXHoVeQo=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.2/whiteboard-v1.1.2.tar.gz",
-    "version": "1.1.2",
+    "hash": "sha256-oNu4q/s+77+h4xDhfwn4y3bQ6hxooj9gG2FC38EY8gY=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.3/whiteboard-v1.1.3.tar.gz",
+    "version": "1.1.3",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index 9580741eface..add61545b387 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-D0p9ny3KeuBdWVirQUDb4gq+eCusZKrDxJ+UAjEJz84=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.4/contacts-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-A8dFfPee4Te1zbLaJfohuyxnMbaysmfDa3hicJnqfkM=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.5/contacts-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -250,9 +250,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-WpxRJ45N+aO+cOp5u6+uwlijzofpmdcUg07ax3p3WDA=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.2/notes-v4.12.2.tar.gz",
-    "version": "4.12.2",
+    "hash": "sha256-tFR9r5kmR7Egczt62I7k8JUllAc4cNu95d3NSUGD108=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.3/notes-v4.12.3.tar.gz",
+    "version": "4.12.3",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -270,10 +270,10 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-Nj8siAeNyN/lyq+K5y92ZXMqRLmhawtR9Q6b5dq7LL0=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.9.0/onlyoffice.tar.gz",
-    "version": "9.9.0",
-    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
+    "hash": "sha256-JNAQQK1jA2RI3aDuIXw7NC047oXSZKkzkVjZbw8BxXs=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.10.0/onlyoffice.tar.gz",
+    "version": "9.10.0",
+    "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
       "agpl"
@@ -450,9 +450,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-MS1+fiDTufQXtKCG/45B2hQEfAVbsZb+TZb74f4EvAE=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.6.0/user_saml-v6.6.0.tar.gz",
-    "version": "6.6.0",
+    "hash": "sha256-kE51sQWjGzDbJxgRQNFmexcW+s9/6lcbW2Rxf+Tj6hA=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v7.0.0/user_saml-v7.0.0.tar.gz",
+    "version": "7.0.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
@@ -460,9 +460,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-njiTDKDiwDeOH9biOohIQueAI8/pSijWy8EDXHoVeQo=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.2/whiteboard-v1.1.2.tar.gz",
-    "version": "1.1.2",
+    "hash": "sha256-oNu4q/s+77+h4xDhfwn4y3bQ6hxooj9gG2FC38EY8gY=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.3/whiteboard-v1.1.3.tar.gz",
+    "version": "1.1.3",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [
diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix
index e9dfddb839de..b0ec3ee78b62 100644
--- a/pkgs/servers/shishi/default.nix
+++ b/pkgs/servers/shishi/default.nix
@@ -25,21 +25,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "shishi";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "mirror://gnu/shishi/shishi-${version}.tar.gz";
-    sha256 = "032qf72cpjdfffq1yq54gz3ahgqf2ijca4vl31sfabmjzq9q370d";
+    hash = "sha256-lXmP/RLdAaT4jgMR7gPKSibly05ekFmkDk/E2fKRfpI=";
   };
 
   separateDebugInfo = true;
 
-  # Fixes support for gcrypt 1.6+
-  patches = [
-    ./gcrypt-fix.patch
-    ./freebsd-unistd.patch
-  ];
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libgcrypt
diff --git a/pkgs/servers/shishi/freebsd-unistd.patch b/pkgs/servers/shishi/freebsd-unistd.patch
deleted file mode 100644
index 9399e20205b9..000000000000
--- a/pkgs/servers/shishi/freebsd-unistd.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/gl/unistd.in.h b/gl/unistd.in.h
-index 2ea9af4..ed58960 100644
---- a/gl/unistd.in.h
-+++ b/gl/unistd.in.h
-@@ -116,6 +116,7 @@
- # include <getopt.h>
- #endif
- 
-+#include "config.h"
- _GL_INLINE_HEADER_BEGIN
- #ifndef _GL_UNISTD_INLINE
- # define _GL_UNISTD_INLINE _GL_INLINE
diff --git a/pkgs/servers/shishi/gcrypt-fix.patch b/pkgs/servers/shishi/gcrypt-fix.patch
deleted file mode 100644
index ccc37389401b..000000000000
--- a/pkgs/servers/shishi/gcrypt-fix.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/configure b/configure
-index c9a442b..a596bfe 100755
---- a/configure
-+++ b/configure
-@@ -24491,12 +24491,6 @@ else
- /* end confdefs.h.  */
- 
- #include <gcrypt.h>
--/* GCRY_MODULE_ID_USER was added in 1.4.4 and gc-libgcrypt.c
--   will fail on startup if we don't have 1.4.4 or later, so
--   test for it early. */
--#if !defined GCRY_MODULE_ID_USER
--error too old libgcrypt
--#endif
- 
- int
- main ()
-diff --git a/gl/m4/gc.m4 b/gl/m4/gc.m4
-index b352e33..4bab9f4 100644
---- a/gl/m4/gc.m4
-+++ b/gl/m4/gc.m4
-@@ -12,12 +12,6 @@ AC_DEFUN([gl_GC],
-   if test "$libgcrypt" != no; then
-     AC_LIB_HAVE_LINKFLAGS([gcrypt], [gpg-error], [
- #include <gcrypt.h>
--/* GCRY_MODULE_ID_USER was added in 1.4.4 and gc-libgcrypt.c
--   will fail on startup if we don't have 1.4.4 or later, so
--   test for it early. */
--#if !defined GCRY_MODULE_ID_USER
--error too old libgcrypt
--#endif
- ])
-   fi
- ])
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7ad43059230a..0d7a513ec2cf 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2132,6 +2132,7 @@ mapAliases {
   SkypeExport = skypeexport; # Added 2024-06-12
   skypeforlinux = throw "Skype has been shut down in May 2025"; # Added 2025-05-05
   slack-dark = throw "'slack-dark' has been renamed to/replaced by 'slack'"; # Converted to throw 2024-10-17
+  sladeUnstable = slade-unstable; # Added 2025-08-26
   slic3r = throw "'slic3r' has been removed because it is unmaintained"; # Added 2025-08-26
   slimerjs = throw "slimerjs does not work with any version of Firefox newer than 59; upstream ended the project in 2021. <https://slimerjs.org/faq.html#end-of-development>"; # added 2025-01-06
   sloccount = throw "'sloccount' has been removed because it is unmaintained. Consider migrating to 'loccount'"; # added 2025-05-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f4d98403f882..50805e2e2870 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13830,18 +13830,6 @@ with pkgs;
 
   enyo-launcher = libsForQt5.callPackage ../games/doom-ports/enyo-launcher { };
 
-  slade = callPackage ../games/doom-ports/slade {
-    wxGTK = wxGTK32.override {
-      withWebKit = true;
-    };
-  };
-
-  sladeUnstable = callPackage ../games/doom-ports/slade/git.nix {
-    wxGTK = wxGTK32.override {
-      withWebKit = true;
-    };
-  };
-
   zandronum = callPackage ../games/doom-ports/zandronum { };
 
   zandronum-server = zandronum.override {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 365ddecbb81e..4e16c3120d20 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1801,7 +1801,11 @@ self: super: with self; {
 
   bech32 = callPackage ../development/python-modules/bech32 { };
 
-  beetcamp = callPackage ../development/python-modules/beetcamp { };
+  beetcamp = callPackage ../development/python-modules/beetcamp {
+    beets = pkgs.beets.override {
+      python3Packages = self;
+    };
+  };
 
   beewi-smartclim = callPackage ../development/python-modules/beewi-smartclim { };
 
@@ -10797,6 +10801,8 @@ self: super: with self; {
 
   openai-agents = callPackage ../development/python-modules/openai-agents { };
 
+  openai-harmony = callPackage ../development/python-modules/openai-harmony { };
+
   openai-whisper = callPackage ../development/python-modules/openai-whisper { };
 
   openaiauth = callPackage ../development/python-modules/openaiauth { };