diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 5f388ceadad1..6047fce83a5e 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -28,6 +28,8 @@
 
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
+- [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 64f0d4247ddc..b50d7c7a50c8 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -6,11 +6,17 @@
 # https://github.com/NixOS/rfcs/blob/master/rfcs/0052-dynamic-ids.md
 #
 # Use of static ids is deprecated within NixOS. Dynamic allocation is
-# required, barring special circumstacnes. Please check if the service
+# required, barring special circumstances. Please check if the service
 # is applicable for systemd's DynamicUser option and does not need a
-# uid/gid allocation at all.  Systemd can also change ownership of
-# service directories using the RuntimeDirectory/StateDirectory
-# options.
+# uid/gid allocation at all. If DynamicUser is problematic consider
+# making a `isSystemUser=true` user with the uid and gid unset and let
+# NixOS pick dynamic persistent ids on activation. These IDs are persisted
+# locally on the host in the event that the user is removed and added back.
+# Systemd will also change ownership of service directories using the
+# RuntimeDirectory/StateDirectory options just in case a change happens.
+# It's only for special circumstances like for example the ids being hardcoded
+# in the application or the ids having to be consistent across multiple hosts
+# that configuring static ids in this file makes sense.
 
 { lib, ... }:
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 77055c886318..7c2e1205169f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -739,6 +739,7 @@
   ./services/mail/opendkim.nix
   ./services/mail/opensmtpd.nix
   ./services/mail/pfix-srsd.nix
+  ./services/mail/postfix-tlspol.nix
   ./services/mail/postfix.nix
   ./services/mail/postfixadmin.nix
   ./services/mail/postgrey.nix
diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix
new file mode 100644
index 000000000000..01373659da4a
--- /dev/null
+++ b/nixos/modules/services/mail/postfix-tlspol.nix
@@ -0,0 +1,220 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    hasPrefix
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.postfix-tlspol;
+
+  format = pkgs.formats.yaml_1_2 { };
+in
+
+{
+  options.services.postfix-tlspol = {
+    enable = mkEnableOption "postfix-tlspol";
+
+    package = mkPackageOption pkgs "postfix-tlspol" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          server = {
+            address = mkOption {
+              type = types.str;
+              default = "unix:/run/postfix-tlspol/tlspol.sock";
+              example = "127.0.0.1:8642";
+              description = ''
+                Path or address/port where postfix-tlspol binds its socket to.
+              '';
+            };
+
+            socket-permissions = mkOption {
+              type = types.str;
+              default = "0660";
+              readOnly = true;
+              description = ''
+                Permissions to the UNIX socket, if configured.
+
+                ::: {.note}
+                Due to hardening on the systemd unit the socket can never be created world readable/writable.
+                :::
+              '';
+              apply = value: (builtins.fromTOML "v=0o${value}").v;
+            };
+
+            log-level = mkOption {
+              type = types.enum [
+                "debug"
+                "info"
+                "warn"
+                "error"
+              ];
+              default = "info";
+              example = "warn";
+              description = ''
+                Log level
+              '';
+            };
+
+            prefetch = mkOption {
+              type = types.bool;
+              default = true;
+              example = false;
+              description = ''
+                Whether to prefetch DNS records when the TTL of a cached record is about to expire.
+              '';
+            };
+
+            cache-file = mkOption {
+              type = types.path;
+              default = "/var/cache/postfix-tlspol/cache.db";
+              readOnly = true;
+              description = ''
+                Path to the cache file.
+              '';
+            };
+          };
+
+          dns = {
+            server = mkOption {
+              type = types.str;
+              default = "127.0.0.1:53";
+              description = ''
+                IP and port to your DNS resolver
+
+                ::: {.note}
+                The configured DNS resolver must validate DNSSEC signatures.
+                :::
+              '';
+            };
+          };
+        };
+      };
+
+      default = { };
+      description = ''
+        The postfix-tlspol configuration file as a Nix attribute set.
+
+        See the reference documentation for possible options.
+        <https://github.com/Zuplu/postfix-tlspol/blob/main/configs/config.default.yaml>
+      '';
+    };
+
+    configurePostfix = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to configure the required settings to use postfix-tlspol in the local Postfix instance.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."postfix-tlspol/config.yaml".source =
+      format.generate "postfix-tlspol.yaml" cfg.settings;
+
+    environment.systemPackages = [ cfg.package ];
+
+    # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
+    services.postfix.config = mkIf (config.services.postfix.enable && cfg.configurePostfix) {
+      smtp_dns_support_level = "dnssec";
+      smtp_tls_security_level = "dane";
+      smtp_tls_policy_maps =
+        let
+          address =
+            if (hasPrefix "unix:" cfg.settings.server.address) then
+              cfg.settings.server.address
+            else
+              "inet:${cfg.settings.server.address}";
+        in
+        [ "socketmap:${address}:QUERYwithTLSRPT" ];
+    };
+
+    systemd.services.postfix-tlspol = {
+      after = [
+        "nss-lookup.target"
+        "network-online.target"
+      ];
+      wants = [
+        "nss-lookup.target"
+        "network-online.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      description = "Postfix DANE/MTA-STS TLS policy socketmap service";
+      documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
+
+      # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
+      serviceConfig = {
+        ExecStart = toString [
+          (lib.getExe cfg.package)
+          "-config"
+          "/etc/postfix-tlspol/config.yaml"
+        ];
+        ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
+        Restart = "always";
+        RestartSec = 5;
+
+        DynamicUser = true;
+
+        CacheDirectory = "postfix-tlspol";
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
+        RemoveIPC = true;
+        RestrictAddressFamilies =
+          [
+            "AF_INET"
+            "AF_INET6"
+          ]
+          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
+            "AF_UNIX"
+          ];
+        RestrictNamespace = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        SecureBits = [
+          "noroot"
+          "noroot-locked"
+        ];
+        RuntimeDirectory = "postfix-tlspol";
+        RuntimeDirectoryMode = "1750";
+        WorkingDirectory = "/var/cache/postfix-tlspol";
+        UMask = "0117";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 2adc59eefbef..a235cc550bb5 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -589,6 +589,6 @@ in
 
   meta = {
     doc = ./exporters.md;
-    maintainers = [ maintainers.willibutz ];
+    maintainers = [ ];
   };
 }
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 6f92c0ca5e58..2fd4b98574f4 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -190,14 +190,6 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";
 
-  nextcloudGreaterOrEqualThan = versionAtLeast overridePackage.version;
-  nextcloudOlderThan = versionOlder overridePackage.version;
-
-  # https://github.com/nextcloud/documentation/pull/11179
-  ocmProviderIsNotAStaticDirAnymore =
-    nextcloudGreaterOrEqualThan "27.1.2"
-    || (nextcloudOlderThan "27.0.0" && nextcloudGreaterOrEqualThan "26.0.8");
-
   overrideConfig =
     let
       c = cfg.config;
@@ -1235,7 +1227,7 @@ in
             ] ++ runtimeSystemdCredentials;
             # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
             # an automatic creation of the database user.
-            environment.NC_setup_create_db_user = lib.mkIf (nextcloudGreaterOrEqualThan "26") "false";
+            environment.NC_setup_create_db_user = "false";
           };
         nextcloud-cron = {
           after = [ "nextcloud-setup.service" ];
@@ -1457,9 +1449,7 @@ in
             priority = 500;
             extraConfig = ''
               # legacy support (i.e. static files and directories in cfg.package)
-              rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[s${
-                optionalString (!ocmProviderIsNotAStaticDirAnymore) "m"
-              }]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+              rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
               include ${config.services.nginx.package}/conf/fastcgi.conf;
               fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
               set $path_info $fastcgi_path_info;
@@ -1487,13 +1477,10 @@ in
                 default_type application/wasm;
               }
             '';
-          "~ ^\\/(?:updater|ocs-provider${
-            optionalString (!ocmProviderIsNotAStaticDirAnymore) "|ocm-provider"
-          })(?:$|\\/)".extraConfig =
-            ''
-              try_files $uri/ =404;
-              index index.php;
-            '';
+          "~ ^\\/(?:updater|ocs-provider)(?:$|\\/)".extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
           "/remote" = {
             priority = 1500;
             extraConfig = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 134dc973183d..4ae9f4aeced5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1103,6 +1103,7 @@ in
   postfix-raise-smtpd-tls-security-level =
     handleTest ./postfix-raise-smtpd-tls-security-level.nix
       { };
+  postfix-tlspol = runTest ./postfix-tlspol.nix;
   postfixadmin = runTest ./postfixadmin.nix;
   postgres-websockets = runTest ./postgres-websockets.nix;
   postgresql = handleTest ./postgresql { };
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index 7c7728016003..3b0d5a6a3258 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -94,9 +94,7 @@ import ../make-test-python.nix (
   {
     name = "grafana-basic";
 
-    meta = with maintainers; {
-      maintainers = [ willibutz ];
-    };
+    meta.maintainers = [ ];
 
     inherit nodes;
 
diff --git a/nixos/tests/grafana/provision/default.nix b/nixos/tests/grafana/provision/default.nix
index 6eba72fb9501..d4a1e29ed7c2 100644
--- a/nixos/tests/grafana/provision/default.nix
+++ b/nixos/tests/grafana/provision/default.nix
@@ -193,9 +193,7 @@ import ../../make-test-python.nix (
   {
     name = "grafana-provision";
 
-    meta = with maintainers; {
-      maintainers = [ willibutz ];
-    };
+    meta.maintainers = [ ];
 
     inherit nodes;
 
diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix
index aaf83a30bfc5..826e35289900 100644
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@@ -2,10 +2,7 @@
 {
   name = "hedgedoc";
 
-  meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
-  };
-
+  meta.maintainers = [ ];
   nodes = {
     hedgedocSqlite =
       { ... }:
diff --git a/nixos/tests/initrd-network-ssh/default.nix b/nixos/tests/initrd-network-ssh/default.nix
index c67ead716e0f..510a9f7ef4e5 100644
--- a/nixos/tests/initrd-network-ssh/default.nix
+++ b/nixos/tests/initrd-network-ssh/default.nix
@@ -4,7 +4,6 @@ import ../make-test-python.nix (
   {
     name = "initrd-network-ssh";
     meta.maintainers = with lib.maintainers; [
-      willibutz
       emily
     ];
 
diff --git a/nixos/tests/loki.nix b/nixos/tests/loki.nix
index 08cccbb43c0d..1c67b0e7f7f2 100644
--- a/nixos/tests/loki.nix
+++ b/nixos/tests/loki.nix
@@ -3,9 +3,7 @@
 {
   name = "loki";
 
-  meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
-  };
+  meta.maintainers = [ ];
 
   nodes.machine =
     { ... }:
diff --git a/nixos/tests/postfix-tlspol.nix b/nixos/tests/postfix-tlspol.nix
new file mode 100644
index 000000000000..0c76257f6a5a
--- /dev/null
+++ b/nixos/tests/postfix-tlspol.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  ...
+}:
+{
+  name = "postfix-tlspol";
+
+  meta.maintainers = with lib.maintainers; [ hexa ];
+
+  nodes.machine = {
+    services.postfix-tlspol.enable = true;
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("postfix-tlspol.service")
+
+    with subtest("Interact with the service"):
+      machine.succeed("postfix-tlspol -purge")
+
+      response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
+      machine.log(json.dumps(response, indent=2))
+
+  '';
+
+}
diff --git a/nixos/tests/postgresql/pgjwt.nix b/nixos/tests/postgresql/pgjwt.nix
index 9a5e12bc3d7d..7ba246a778f6 100644
--- a/nixos/tests/postgresql/pgjwt.nix
+++ b/nixos/tests/postgresql/pgjwt.nix
@@ -14,7 +14,6 @@ let
       meta = with lib.maintainers; {
         maintainers = [
           spinus
-          willibutz
         ];
       };
 
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index ef356dbc7bb1..9cc455466bdf 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1905,9 +1905,7 @@ mapAttrs (
         ${nodeName}.shutdown()
       '';
 
-      meta = with maintainers; {
-        maintainers = [ willibutz ];
-      };
+      meta.maintainers = [ ];
     }
   ))
 ) exporterTests
diff --git a/nixos/tests/wireguard/default.nix b/nixos/tests/wireguard/default.nix
index da08a81c42b3..93d0efaf0889 100644
--- a/nixos/tests/wireguard/default.nix
+++ b/nixos/tests/wireguard/default.nix
@@ -39,7 +39,8 @@ listToAttrs (
     flip mapAttrsToList tests (
       name: test:
       nameValuePair "wireguard-${name}-linux-${v'}" (test {
-        kernelPackages = pkgs."linuxPackages_${v'}";
+        kernelPackages =
+          if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}";
       })
     )
   )
diff --git a/nixos/tests/wstunnel.nix b/nixos/tests/wstunnel.nix
index 12547213f20b..7a0a8ce3496a 100644
--- a/nixos/tests/wstunnel.nix
+++ b/nixos/tests/wstunnel.nix
@@ -1,5 +1,3 @@
-{ lib, ... }:
-
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
diff --git a/pkgs/applications/emulators/libretro/cores/easyrpg.nix b/pkgs/applications/emulators/libretro/cores/easyrpg.nix
index e95d443f06f4..288204631657 100644
--- a/pkgs/applications/emulators/libretro/cores/easyrpg.nix
+++ b/pkgs/applications/emulators/libretro/cores/easyrpg.nix
@@ -1,64 +1,73 @@
 {
   lib,
   fetchFromGitHub,
+  mkLibretroCore,
+  nix-update-script,
+  asciidoctor,
   cmake,
-  fetchpatch,
+  doxygen,
+  pkg-config,
+  flac,
+  fluidsynth,
   fmt,
   freetype,
+  glib,
   harfbuzz,
+  lhasa,
   liblcf,
   libpng,
   libsndfile,
+  libsysprof-capture,
   libvorbis,
   libxmp,
-  mkLibretroCore,
   mpg123,
+  nlohmann_json,
   opusfile,
-  pcre,
+  pcre2,
   pixman,
-  pkg-config,
   speexdsp,
+  wildmidi,
 }:
-mkLibretroCore {
+mkLibretroCore rec {
   core = "easyrpg";
-  version = "0.8-unstable-2023-04-29";
+  # liblcf needs to be updated before this.
+  version = "0.8.1.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
-    rev = "f8e41f43b619413f95847536412b56f85307d378";
-    hash = "sha256-nvWM4czTv/GxY9raomBEn7dmKBeLtSA9nvjMJxc3Q8s=";
+    rev = version;
+    hash = "sha256-2a8IdYP6Suc8a+Np5G+xoNzuPxkk9gAgR+sjdKUf89M=";
     fetchSubmodules = true;
   };
 
   extraNativeBuildInputs = [
+    asciidoctor
     cmake
+    doxygen
     pkg-config
   ];
   extraBuildInputs = [
+    flac # needed by libsndfile
+    fluidsynth
     fmt
     freetype
+    glib
     harfbuzz
+    lhasa
     liblcf
     libpng
     libsndfile
+    libsysprof-capture # needed by glib
     libvorbis
     libxmp
     mpg123
+    nlohmann_json
     opusfile
-    pcre
+    pcre2 # needed by glib
     pixman
     speexdsp
-  ];
-  patches = [
-    # The following patch is shared with easyrpg-player.
-    # Update when new versions of liblcf and easyrpg-player are released.
-    # See easyrpg-player expression for details.
-    (fetchpatch {
-      name = "0001-Fix-building-with-fmtlib-10.patch";
-      url = "https://github.com/EasyRPG/Player/commit/ab6286f6d01bada649ea52d1f0881dde7db7e0cf.patch";
-      hash = "sha256-GdSdVFEG1OJCdf2ZIzTP+hSrz+ddhTMBvOPjvYQHy54=";
-    })
+    wildmidi
   ];
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
@@ -67,12 +76,13 @@ mkLibretroCore {
   ];
   makefile = "Makefile";
 
-  # Do not update automatically since we want to pin a specific version
-  passthru.updateScript = null;
+  # Since liblcf needs to be updated before this, we should not
+  # use the default unstableGitUpdater.
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "EasyRPG Player libretro port";
     homepage = "https://github.com/EasyRPG/Player";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 8925a2f2d576..f9ad7182c1ca 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -57,6 +57,9 @@ stdenv.mkDerivation rec {
     export HOME="$TMPDIR"
     yarn config --offline set yarn-offline-mirror "$offlineCache"
     fixup-yarn-lock yarn.lock
+    # Ensure that the node_modules folder is created by yarn install.
+    # See https://github.com/yarnpkg/yarn/issues/5500#issuecomment-1221456246
+    echo "nodeLinker: node-modules" > .yarnrc.yml
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index fcc62660dc0f..4d74eb8c0fff 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -75,7 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with maintainers; [
       gepbird
       globin
-      willibutz
     ];
     platforms = platforms.unix;
     mainProgram = "feh";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index fdd61d56554e..f8f9d7253c9f 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -797,7 +797,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "137.0.7151.68",
+    "version": "137.0.7151.103",
     "deps": {
       "depot_tools": {
         "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
@@ -808,16 +808,16 @@
         "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
       },
       "ungoogled-patches": {
-        "rev": "137.0.7151.68-1",
-        "hash": "sha256-oPYNvnBuBKBb1SRNQkQeApmPVDoV+bFVjCh9HKa4A8o="
+        "rev": "137.0.7151.103-1",
+        "hash": "sha256-KMzO25yruwrT7rpqbQ56FMGxkVZOwDSsvFqCZbUUM5Y="
       },
       "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "2989ffee9373ea8b8623bd98b3cb350a8e95cadc",
-        "hash": "sha256-lPmmXVCNUa9of8d52hUejImPSEfOz7v7PlovZS4cfIE=",
+        "rev": "3dcc738117a3439068c9773ccd31f9858923fc4a",
+        "hash": "sha256-MIEjHLpfKIBiTFh+bO+NUf6iDpizTP9yfXQqbHfiDwo=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1037,8 +1037,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "fdc8ca697612f90e7ddf2621dffbc43733d2d238",
-        "hash": "sha256-jKYldgZJwJeTQavmcM9enTdGN8+zt/EG7K1E9wQYIBA="
+        "rev": "e423961606946be24c8c1ec0d1ec91511efbabc5",
+        "hash": "sha256-MhooXuF6aw+ixPzvVCBl+6T+79cTReCYx86qqXAZ6bg="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1587,8 +1587,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e398f9bf6d5c8a768ab736f46146d7349cf31547",
-        "hash": "sha256-cJx8IgUB3UA3jEPvb5aDvHLYmAnHydK1qR11q6Y5PnA="
+        "rev": "41f53aba7095888c959932bd8f2ee8b4e16af223",
+        "hash": "sha256-ICrdvHA6fe2CUphRgPdlofazr0L+NFypWDNOI5e5QIM="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index d2a4fc33341f..fb96aaca627a 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -194,8 +194,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.12.1";
-    hash = "sha256-ikpSkcP4zt91Lf9gziytlZ4P27A0IP2qL+H2Lp9Cspg=";
+    version = "1.12.2";
+    hash = "sha256-ilQ1rscGD66OT6lHsBgWELayC24B2D7l6iH6vtvqzFI=";
     vendorHash = "sha256-zWNLIurNP5e/AWr84kQCb2+gZIn6EAsuvr0ZnfSq7Zw=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
index 443738ff08a1..6e99039b5003 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/wee-slack/wee-slack";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     description = ''
       A WeeChat plugin for Slack.com. Synchronizes read markers, provides typing notification, search, etc..
     '';
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index a1c981c855c4..783619bce554 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -56,7 +56,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.4.6";
+  version = "4.4.7";
 
   outputs = [
     "out"
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-dzVlHxrXVCSMP4ZfyUq4N9UvL941C50Zto6Mb78LnfQ=";
+    hash = "sha256-9h25vfjw8QIrRZ6APTsvhW4D5O6fkhkiy/1bj7hGwwY=";
   };
 
   patches = [
diff --git a/pkgs/applications/version-management/git-review/default.nix b/pkgs/applications/version-management/git-review/default.nix
index ac6d7879e2bf..c0881a7e2aa9 100644
--- a/pkgs/applications/version-management/git-review/default.nix
+++ b/pkgs/applications/version-management/git-review/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
-  fetchFromGitea,
   buildPythonApplication,
+  fetchgit,
   pbr,
   requests,
   setuptools,
@@ -10,18 +10,17 @@
 
 buildPythonApplication rec {
   pname = "git-review";
-  version = "2.4.0";
+  version = "2.5.0";
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
   PBR_VERSION = version;
 
-  src = fetchFromGitea {
-    domain = "opendev.org";
-    owner = "opendev";
-    repo = "git-review";
-    rev = version;
-    hash = "sha256-UfYc662NqnQt0+CKc+18jXnNTOcZv8urCNBsWd6x0VQ=";
+  # fetchFromGitea fails trying to download archive file
+  src = fetchgit {
+    url = "https://opendev.org/opendev/git-review";
+    tag = version;
+    hash = "sha256-RE5XAUS46Y/jtI0/csR59B9l1gYpHuwGQkbWqoTfxPk=";
   };
 
   outputs = [
@@ -50,6 +49,7 @@ buildPythonApplication rec {
   meta = with lib; {
     description = "Tool to submit code to Gerrit";
     homepage = "https://opendev.org/opendev/git-review";
+    changelog = "https://docs.opendev.org/opendev/git-review/latest/releasenotes.html#relnotes-${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ kira-bruneau ];
     mainProgram = "git-review";
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index aae7e13c13af..318253459ac7 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
+  fetchurl,
   cmake,
   pkg-config,
   kdePackages,
@@ -52,6 +53,14 @@ let
       vendorHash = "sha256-zArdGj5yeRxU0X4jNgT5YBI9SJUyrANDaqNPAPH3d5M=";
     }
   );
+
+  amneziaPremiumConfig = fetchurl {
+    url = "https://raw.githubusercontent.com/amnezia-vpn/amnezia-client-lite/f45d6b242c1ac635208a72914e8df76ccb3aa44c/macos-signed-build.sh";
+    hash = "sha256-PnaPVPlyglUphhknWwP7ziuwRz+WOz0k9WRw6Q0nG2c=";
+    postFetch = ''
+      sed -nri '/PROD_AGW_PUBLIC_KEY|PROD_S3_ENDPOINT/p' $out
+    '';
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
@@ -124,6 +133,10 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qttools
   ];
 
+  preConfigure = ''
+    source ${amneziaPremiumConfig}
+  '';
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/an/ants/package.nix b/pkgs/by-name/an/ants/package.nix
index cba55f330ec0..f6ee7b2339a2 100644
--- a/pkgs/by-name/an/ants/package.nix
+++ b/pkgs/by-name/an/ants/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ANTs";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H/5X6cCjv+7KuZGJ7D4d5VxlpOqbO80U+7CoYnY/dsU=";
+    hash = "sha256-TQR3HghaFBBiHl5oz3vmu7DIGT8UY5/CxY0pP0bLZx4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/audacity/package.nix b/pkgs/by-name/au/audacity/package.nix
index 15999f4de70a..da1c92d1c441 100644
--- a/pkgs/by-name/au/audacity/package.nix
+++ b/pkgs/by-name/au/audacity/package.nix
@@ -61,13 +61,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "audacity";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-j3rbcUUHXAQmn/7SzpKHvpxGZ3bBhIYrNOFLc7jMPlc=";
+    hash = "sha256-kESKpIke9Xi4A55i3mUu1JkDjp8voBJBixiAK8pUkKA=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/bl/blueutil/package.nix b/pkgs/by-name/bl/blueutil/package.nix
index ac149c1ce743..289a445a897a 100644
--- a/pkgs/by-name/bl/blueutil/package.nix
+++ b/pkgs/by-name/bl/blueutil/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueutil";
-  version = "2.10.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "toy";
     repo = "blueutil";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x2khx8Y0PolpMiyrBatT2aHHyacrQVU/02Z4Dz9fBtI=";
+    hash = "sha256-JwX3NHXbGgEj+ZCyu9gWp2TCihokaAw5oHCrlmpy6HA=";
   };
 
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 5a13b1dfea00..45f3d2d7856c 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -19,20 +19,20 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-fE4WwgdwTB4s8NYQclUeDWJ132HJO0/3Hmesp9yvzGg=";
+    hash = "sha256-5kCYKktD71LdknIITSXzl/r5IRUyBUCKL9mmjsMwYRI=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-ZUZZWnp10Z4vQTZTTPenAXXpez6WbmB/S1VBiARuNP4=";
+  npmDepsHash = "sha256-AA+f6xVd1hmZUum7AlhHivqNez7xP1kEd/GXd798QCI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ca/cassowary/package.nix b/pkgs/by-name/ca/cassowary/package.nix
index 5d36ac2a2ceb..bbadc9ab9d49 100644
--- a/pkgs/by-name/ca/cassowary/package.nix
+++ b/pkgs/by-name/ca/cassowary/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cassowary";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
     repo = "cassowary";
     rev = "v${version}";
-    sha256 = "sha256-zaG4HrdTGXTalMFz/huRW32RZBQx55AvUi29tz6vFD8=";
+    sha256 = "sha256-27sEexOGLQ42qWY+vCiPTt5XR66TSUvKsuGgtkbMgE4=";
   };
 
   vendorHash = "sha256-YP9q9lL2A9ERhzbJBIFKsYsgvy5xYeUO3ekyQdh97f8=";
diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index 36022db8ad53..7e7b4dfa0118 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.14.0";
+  version = "8.14.1";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-vlDq7Wme8undaZ6HNd84QsWW8Vz0Tev+9nSTbn+NLic=";
+    sha256 = "sha256-gkwiDLtd7pPJY5iliTPg2/5KITps9LohHPnBYUxfaPs=";
   };
-  vendorHash = "sha256-TWVnUdqVIqTRn5tgO+DgCY421riyYkrQS8AkTVYszZ4=";
+  vendorHash = "sha256-ygRb87WjA0e+mBwK3JLh0b7dbib7tM91hq7eD2f2AAU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 6ad39382f339..e0dfa9329b8b 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.44.1";
+  version = "1.44.2";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-uzEZfzGAwA/boDft/Z3Toq3gUG0n3nqREtLjgmIO1Kw=";
+    hash = "sha256-1G0byz6kaW60yz+eN6TyFxTzyp72RfAWC9y8ZHe0FAQ=";
   };
 
-  npmDepsHash = "sha256-kWOj/78yurII4O9XYzcvC2JflCWRbbqIOU4WkdbX5AM=";
+  npmDepsHash = "sha256-OQJZ9yicdF2xdiomyKDcrmeqXxPtPO/DNtpdQJaSls8=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/do/dovecot_exporter/package.nix b/pkgs/by-name/do/dovecot_exporter/package.nix
index 4c836ff85038..a4528f400e47 100644
--- a/pkgs/by-name/do/dovecot_exporter/package.nix
+++ b/pkgs/by-name/do/dovecot_exporter/package.nix
@@ -35,7 +35,6 @@ buildGoModule rec {
     mainProgram = "dovecot_exporter";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      willibutz
       globin
     ];
   };
diff --git a/pkgs/by-name/ea/easyrpg-player/package.nix b/pkgs/by-name/ea/easyrpg-player/package.nix
index 888c91162592..6e996f245fbe 100644
--- a/pkgs/by-name/ea/easyrpg-player/package.nix
+++ b/pkgs/by-name/ea/easyrpg-player/package.nix
@@ -2,60 +2,55 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
+  asciidoctor,
   cmake,
   doxygen,
   pkg-config,
-  freetype,
+  alsa-lib,
+  flac,
+  fluidsynth,
   fmt,
+  freetype,
   glib,
   harfbuzz,
+  lhasa,
+  libdecor,
   liblcf,
   libpng,
   libsndfile,
+  libsysprof-capture,
   libvorbis,
-  libxmp,
   libXcursor,
   libXext,
   libXi,
   libXinerama,
+  libxmp,
   libXrandr,
   libXScrnSaver,
   libXxf86vm,
   mpg123,
+  nlohmann_json,
   opusfile,
-  pcre,
+  pcre2,
   pixman,
-  SDL2,
+  sdl3,
   speexdsp,
   wildmidi,
   zlib,
-  libdecor,
-  alsa-lib,
-  asciidoctor,
 }:
 
 stdenv.mkDerivation rec {
   pname = "easyrpg-player";
-  version = "0.8";
+  # liblcf needs to be updated before this.
+  version = "0.8.1.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
     rev = version;
-    hash = "sha256-t0sa9ONVVfsiTy+us06vU2bMa4QmmQeYxU395g0WS6w=";
+    hash = "sha256-fYSpFhqETkQhRK1/Uws0fWWdCr35+1J4vCPX9ZiQ3ZA=";
   };
 
-  patches = [
-    # Fixed compatibility with fmt > 9
-    # Remove when version > 0.8
-    (fetchpatch {
-      name = "0001-Fix-building-with-fmtlib-10.patch";
-      url = "https://github.com/EasyRPG/Player/commit/ab6286f6d01bada649ea52d1f0881dde7db7e0cf.patch";
-      hash = "sha256-GdSdVFEG1OJCdf2ZIzTP+hSrz+ddhTMBvOPjvYQHy54=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -67,21 +62,27 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
+      flac # needed by libsndfile
+      fluidsynth
       fmt
       freetype
       glib
       harfbuzz
+      lhasa
       liblcf
       libpng
       libsndfile
+      libsysprof-capture # needed by glib
       libvorbis
       libxmp
       mpg123
+      nlohmann_json
       opusfile
-      pcre
+      pcre2 # needed by glib
       pixman
-      SDL2
+      sdl3
       speexdsp
+      wildmidi
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
@@ -94,11 +95,12 @@ stdenv.mkDerivation rec {
       libXScrnSaver
       libXxf86vm
       libdecor
-      wildmidi # until packaged on Darwin
     ];
 
   cmakeFlags = [
     "-DPLAYER_ENABLE_TESTS=${lib.boolToString doCheck}"
+    # TODO: remove the below once SDL3 becomes default next major release
+    "-DPLAYER_TARGET_PLATFORM=SDL3"
   ];
 
   makeFlags = [
@@ -116,14 +118,13 @@ stdenv.mkDerivation rec {
     ln -s $out/{Applications/EasyRPG\ Player.app/Contents/MacOS,bin}/EasyRPG\ Player
   '';
 
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
   enableParallelChecking = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   meta = with lib; {
     description = "RPG Maker 2000/2003 and EasyRPG games interpreter";
     homepage = "https://easyrpg.org/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = [ ];
     platforms = platforms.all;
     mainProgram = lib.optionalString stdenv.hostPlatform.isDarwin "EasyRPG Player";
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index 97a4730b8168..a3dce0ff35d9 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.15.16";
+  version = "2.15.25";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-5PLR6If13f6n6v4MuT9XUCIr2QfW6aZ97lvSoLrO+wM=";
+    hash = "sha256-pdUvxWdFeL2whTgP+iqJ5spxHW5xMjSpIMf+0VbqPwI=";
   };
 
-  vendorHash = "sha256-IbOxMNmOOH2qUFlpyhwVdWFcD9gfMxKSF5paZ9L6qYM=";
+  vendorHash = "sha256-bDoomu7zyoTb6yAXwYlLTbw94gTIM0ELbey/AXgov48=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fi/fileshelter/package.nix b/pkgs/by-name/fi/fileshelter/package.nix
index 5b13c3d073b5..38f254a383d2 100644
--- a/pkgs/by-name/fi/fileshelter/package.nix
+++ b/pkgs/by-name/fi/fileshelter/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/epoupon/fileshelter";
     description = "FileShelter is a 'one-click' file sharing web application";
     mainProgram = "fileshelter";
-    maintainers = [ lib.maintainers.willibutz ];
+    maintainers = [ ];
     license = lib.licenses.gpl3;
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/by-name/fl/flashmq/package.nix b/pkgs/by-name/fl/flashmq/package.nix
index dcb75fc62b89..3b8ef98d0a61 100644
--- a/pkgs/by-name/fl/flashmq/package.nix
+++ b/pkgs/by-name/fl/flashmq/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flashmq";
-  version = "1.21.1";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "halfgaar";
     repo = "FlashMQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ccTarrInS9Af9fT43dgRTuHVuHbWlYzDAEh31myHUvY=";
+    hash = "sha256-yFoyErmBvitBRQ2bNOPY62FaV6YJNAXx8dqkIw2ACm4=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast light-weight MQTT broker/server";
     mainProgram = "flashmq";
     homepage = "https://www.flashmq.org/";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.osl3;
     maintainers = with lib.maintainers; [ sikmir ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/fr/freeradius/package.nix b/pkgs/by-name/fr/freeradius/package.nix
index b92ab190284a..17fe983e7c32 100644
--- a/pkgs/by-name/fr/freeradius/package.nix
+++ b/pkgs/by-name/fr/freeradius/package.nix
@@ -107,7 +107,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [
       sheenobu
-      willibutz
     ];
     platforms = with platforms; linux;
   };
diff --git a/pkgs/by-name/ge/geteduroam-cli/package.nix b/pkgs/by-name/ge/geteduroam-cli/package.nix
index 08a58c74d798..e38a24fd4b7b 100644
--- a/pkgs/by-name/ge/geteduroam-cli/package.nix
+++ b/pkgs/by-name/ge/geteduroam-cli/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "geteduroam-cli";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "geteduroam";
     repo = "linux-app";
     tag = finalAttrs.version;
-    hash = "sha256-CbgQn6mf1125DYKBDId+BmFMcfdWNW2M4/iLoiELOAY=";
+    hash = "sha256-+3mluLby3R0xVU9fIG+1B1A4yM1IfyUvw4wclwnV5s8=";
   };
 
-  vendorHash = "sha256-b06wnqT88J7etNTFJ6nE9Uo0gOQOGvvs0vPNnJr6r4Q=";
+  vendorHash = "sha256-l9hge1TS+7ix9/6LKWq+lTMjNM4/Lnw8gNrWB6hWCTk=";
 
   subPackages = [
     "cmd/geteduroam-cli"
diff --git a/pkgs/by-name/gi/gitu/package.nix b/pkgs/by-name/gi/gitu/package.nix
index 6290ccadd1cc..bd28d16b3b7b 100644
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-ER+k+yOJP+pgoD785wddsVaTf7/E3iysjkeGq4slgF0=";
+    hash = "sha256-9rJa6nXz9gzEVAVkvIghMaND7MY84dLHLV6Kr/ApEnU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fSaTuDa3cRxpoduKRMuMPagBGfY3vSYtvEuvwlMk2HA=";
+  cargoHash = "sha256-QN+AU9Qsqx2l2vwpANkMhycv2qFzjCQoxFgbP9WVpOk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gi/gixy/package.nix b/pkgs/by-name/gi/gixy/package.nix
index 2e7a1206fa37..8ae3ab0d7c29 100644
--- a/pkgs/by-name/gi/gixy/package.nix
+++ b/pkgs/by-name/gi/gixy/package.nix
@@ -74,7 +74,7 @@ python.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/yandex/gixy";
     sourceProvenance = [ lib.sourceTypes.fromSource ];
     license = lib.licenses.mpl20;
-    maintainers = [ lib.maintainers.willibutz ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/go/gotree/package.nix b/pkgs/by-name/go/gotree/package.nix
index bdefbb5badb5..724544e190c8 100644
--- a/pkgs/by-name/go/gotree/package.nix
+++ b/pkgs/by-name/go/gotree/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gotree";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "elbachir-one";
     repo = "gt";
     rev = "v${version}";
-    hash = "sha256-sWKqfDWwMfj4shg/MxHu7Zr4WE5pxAzHHmsjU3jQY10=";
+    hash = "sha256-0wYuIaGkJHSD8La1yfBYNPDB8ETtID8e5lgahqQgjLM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
index f58d97e5934e..3eddcbf947d8 100644
--- a/pkgs/by-name/gr/grafana-loki/package.nix
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -79,7 +79,6 @@ buildGoModule rec {
     homepage = "https://grafana.com/oss/loki/";
     changelog = "https://github.com/grafana/loki/releases/tag/v${version}";
     maintainers = with lib.maintainers; [
-      willibutz
       globin
       mmahut
       emilylange
diff --git a/pkgs/by-name/hy/hylafaxplus/package.nix b/pkgs/by-name/hy/hylafaxplus/package.nix
index cf7c47691fb1..534564734a7a 100644
--- a/pkgs/by-name/hy/hylafaxplus/package.nix
+++ b/pkgs/by-name/hy/hylafaxplus/package.nix
@@ -64,10 +64,10 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hylafaxplus";
-  version = "7.0.10";
+  version = "7.0.11";
   src = fetchurl {
     url = "mirror://sourceforge/hylafax/hylafax-${finalAttrs.version}.tar.gz";
-    hash = "sha512-6HdYMHq4cLbS06UXs+FEg3XtsMRyXflrgn/NEsgyMFkTS/MoGW8RVXgbXxAhcArpFvMsY0NUPLE3jdbqqWWQCw==";
+    hash = "sha512-JRuJdE17VBrlhVz5GBc2dKBtwzPjljeropcug0bsRvO/8SJvP5PzIP5gbBLpMQKGb77SNp2iNCCOroBOUOn57A==";
   };
   patches = [
     # adjust configure check to work with libtiff > 4.1
diff --git a/pkgs/by-name/ig/igraph/package.nix b/pkgs/by-name/ig/igraph/package.nix
index de3fc033f947..4347cbec101e 100644
--- a/pkgs/by-name/ig/igraph/package.nix
+++ b/pkgs/by-name/ig/igraph/package.nix
@@ -25,13 +25,13 @@ assert (blas.isILP64 == lapack.isILP64 && blas.isILP64 == arpack.isILP64 && !bla
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "igraph";
-  version = "0.10.15";
+  version = "0.10.16";
 
   src = fetchFromGitHub {
     owner = "igraph";
     repo = "igraph";
     rev = finalAttrs.version;
-    hash = "sha256-TSAVRLeOWh3IQ9X0Zr4CQS+h1vTeUZnzMp/IYujGMn0=";
+    hash = "sha256-Qs2WXAiAQhQ077KEtkapr8ckw6Jlbxj6qwyiplsEaLY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ji/jikespg/package.nix b/pkgs/by-name/ji/jikespg/package.nix
deleted file mode 100644
index 3651ebe31567..000000000000
--- a/pkgs/by-name/ji/jikespg/package.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "jikespg";
-  version = "1.3";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/jikes/${pname}-${version}.tar.gz";
-    sha256 = "083ibfxaiw1abxmv1crccx1g6sixkbyhxn2hsrlf6fwii08s6rgw";
-  };
-
-  postPatch = ''
-    substituteInPlace Makefile --replace-fail "gcc" "${stdenv.cc.targetPrefix}cc ${lib.optionalString stdenv.hostPlatform.isDarwin "-std=c89"}"
-  '';
-
-  sourceRoot = "jikespg/src";
-
-  installPhase = ''
-    install -Dm755 -t $out/bin jikespg
-  '';
-
-  meta = with lib; {
-    homepage = "https://jikes.sourceforge.net/";
-    description = "Jikes Parser Generator";
-    mainProgram = "jikespg";
-    platforms = platforms.all;
-    license = licenses.ipl10;
-    maintainers = with maintainers; [ pSub ];
-  };
-}
diff --git a/pkgs/by-name/ka/kanidm/1_6.nix b/pkgs/by-name/ka/kanidm/1_6.nix
index 33406713f260..b7ebd14a9d2c 100644
--- a/pkgs/by-name/ka/kanidm/1_6.nix
+++ b/pkgs/by-name/ka/kanidm/1_6.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "1.6.3";
-  hash = "sha256-oZU7XgGpkPAwuUVVjpiKApOiQN692CRFjmWzE9hcqPY=";
-  cargoHash = "sha256-cgTCLTcPXjGdvremw1afyRGHwnBvqNGXr1D8Xgxv4uA=";
+  version = "1.6.4";
+  hash = "sha256-ui3w1HDHXHARsjQ3WtJfZbM7Xgg3ODnUneXJMQwaOMw=";
+  cargoHash = "sha256-KJGELBzScwsLd6g3GR9Vk0nfDU2EjZBfXwlXJ+bZb1k=";
   patchDir = ./patches/1_6;
 }
diff --git a/pkgs/by-name/kr/krakenx/package.nix b/pkgs/by-name/kr/krakenx/package.nix
index 75482a653dcc..a2e8e6d425ac 100644
--- a/pkgs/by-name/kr/krakenx/package.nix
+++ b/pkgs/by-name/kr/krakenx/package.nix
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
     description = "Python script to control NZXT cooler Kraken X52/X62/X72";
     homepage = "https://github.com/KsenijaS/krakenx";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.willibutz ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/li/libevdevplus/package.nix b/pkgs/by-name/li/libevdevplus/package.nix
index da881c6d8bfa..c89d7faa7865 100644
--- a/pkgs/by-name/li/libevdevplus/package.nix
+++ b/pkgs/by-name/li/libevdevplus/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     inherit (src.meta) homepage;
     description = "Easy-to-use event device library in C++";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/by-name/li/liblcf/package.nix b/pkgs/by-name/li/liblcf/package.nix
index 71e4fb69a3b9..4b4fe0083864 100644
--- a/pkgs/by-name/li/liblcf/package.nix
+++ b/pkgs/by-name/li/liblcf/package.nix
@@ -2,24 +2,28 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  nix-update-script,
   autoreconfHook,
   pkg-config,
   expat,
   icu74,
+  inih,
 }:
 
 stdenv.mkDerivation rec {
   pname = "liblcf";
-  version = "0.8";
+  # When updating this package, you should probably also update
+  # easyrpg-player and libretro.easyrpg
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "liblcf";
     rev = version;
-    hash = "sha256-jJGIsNw7wplTL5FBWGL8osb9255o9ZaWgl77R+RLDMM=";
+    hash = "sha256-jIk55+n8wSk3Z3FPR18SE7U3OuWwmp2zJgvSZQBB2l0=";
   };
 
-  dtrictDeps = true;
+  strictDeps = true;
 
   nativeBuildInputs = [
     autoreconfHook
@@ -29,6 +33,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     expat
     icu74
+    inih
   ];
 
   enableParallelBuilding = true;
@@ -36,6 +41,8 @@ stdenv.mkDerivation rec {
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Library to handle RPG Maker 2000/2003 and EasyRPG projects";
     homepage = "https://github.com/EasyRPG/liblcf";
diff --git a/pkgs/by-name/li/libtorrent/package.nix b/pkgs/by-name/li/libtorrent/package.nix
index 1b5ff8e0c9d3..eeca7cc91cf7 100644
--- a/pkgs/by-name/li/libtorrent/package.nix
+++ b/pkgs/by-name/li/libtorrent/package.nix
@@ -4,7 +4,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoconf-archive,
   autoreconfHook,
   cppunit,
   openssl,
@@ -13,19 +12,18 @@
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-libtorrent";
-  version = "0.15.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "v${version}";
-    hash = "sha256-ejDne7vaV+GYP6M0n3VAEva4UHuxRGwfc2rgxf7U/EM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-EtT1g8fo2XRVO7pGUThoEklxpYKPI7OWwCZ2vVV73k4=";
   };
 
   nativeBuildInputs = [
-    autoconf-archive
     autoreconfHook
     pkg-config
   ];
@@ -53,4 +51,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/li/libuinputplus/package.nix b/pkgs/by-name/li/libuinputplus/package.nix
index 8d1ed42b6ca6..0371a66131d0 100644
--- a/pkgs/by-name/li/libuinputplus/package.nix
+++ b/pkgs/by-name/li/libuinputplus/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     inherit (src.meta) homepage;
     description = "Easy-to-use uinput library in C++";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables b/pkgs/by-name/lk/lkl/lkl-defconfig-enable-nftables
similarity index 100%
rename from pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
rename to pkgs/by-name/lk/lkl/lkl-defconfig-enable-nftables
diff --git a/pkgs/applications/virtualization/lkl/default.nix b/pkgs/by-name/lk/lkl/package.nix
similarity index 87%
rename from pkgs/applications/virtualization/lkl/default.nix
rename to pkgs/by-name/lk/lkl/package.nix
index deaefb7db927..81b2542f5465 100644
--- a/pkgs/applications/virtualization/lkl/default.nix
+++ b/pkgs/by-name/lk/lkl/package.nix
@@ -6,7 +6,7 @@
   python3,
   bison,
   flex,
-  fuse,
+  fuse3,
   libarchive,
   buildPackages,
 
@@ -16,11 +16,7 @@
 stdenv.mkDerivation {
   pname = "lkl";
 
-  # NOTE: pinned to the last known version that doesn't have a hang in cptofs.
-  # Please verify `nix build -f nixos/release-combined.nix nixos.ova` works
-  # before attempting to update again.
-  # ref: https://github.com/NixOS/nixpkgs/pull/219434
-  version = "2022-08-08";
+  version = "2025-03-20";
 
   outputs = [
     "dev"
@@ -31,8 +27,8 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "lkl";
     repo = "linux";
-    rev = "ffbb4aa67b3e0a64f6963f59385a200d08cb2d8b";
-    sha256 = "sha256-24sNREdnhkF+P+3P0qEh2tF1jHKF7KcbFSn/rPK2zWs=";
+    rev = "fd33ab3d21a99a31683ebada5bd3db3a54a58800";
+    sha256 = "sha256-3uPkOyL/hoA/H2gKrEEDsuJvwOE2x27vxY5Y2DyNNxU=";
   };
 
   nativeBuildInputs = [
@@ -43,7 +39,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    fuse
+    fuse3
     libarchive
   ];
 
@@ -116,7 +112,7 @@ stdenv.mkDerivation {
     platforms = platforms.linux; # Darwin probably works too but I haven't tested it
     license = licenses.gpl2;
     maintainers = with maintainers; [
-      raitobezarius
+      timschumi
     ];
   };
 }
diff --git a/pkgs/by-name/ln/lnd/package.nix b/pkgs/by-name/ln/lnd/package.nix
index 2bf48b1af1e9..4c0858c16d04 100644
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.19.0-beta";
+  version = "0.19.1-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-eKRgkD/kUz0MkK624R3OahTHOrdP18nBuSZP1volHq8=";
+    hash = "sha256-ifxEUEQUhy1msMsP+rIx0s1GkI+569kMR9LwymeSPkY=";
   };
 
-  vendorHash = "sha256-A7veNDrPke1N+1Ctg4cMqjPhTwyVfbkGMi/YP1xIUqY=";
+  vendorHash = "sha256-FYyjCNiHKoG7/uvxhHKnEz3J4GuKwEJcjrFXYqCxTtc=";
 
   subPackages = [
     "cmd/lncli"
diff --git a/pkgs/by-name/me/megatools/package.nix b/pkgs/by-name/me/megatools/package.nix
index 0f303363ca2f..f3ce5bdd97ce 100644
--- a/pkgs/by-name/me/megatools/package.nix
+++ b/pkgs/by-name/me/megatools/package.nix
@@ -16,12 +16,12 @@
 
 stdenv.mkDerivation rec {
   pname = "megatools";
-  version = "1.11.1";
+  version = "1.11.4";
 
   src = fetchgit {
-    url = "https://megous.com/git/megatools";
+    url = "https://xff.cz/git/megatools";
     rev = version;
-    sha256 = "sha256-AdvQqaRTsKTqdfNfFiWtA9mIPVGuui+Ru9TUARVG0+Q=";
+    hash = "sha256-pF87bphrlI0VYFXD8RMztGr+NqBSL6np/cldCbHiK7A=";
   };
 
   nativeBuildInputs = [
@@ -42,11 +42,15 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   strictDeps = true;
 
-  meta = with lib; {
+  meta = {
     description = "Command line client for Mega.co.nz";
-    homepage = "https://megatools.megous.com/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ viric ];
-    platforms = platforms.unix;
+    homepage = "https://xff.cz/megatools/";
+    changelog = "https://xff.cz/megatools/builds/NEWS";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      viric
+      vji
+    ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index ec192cdd1df4..c47c61f2055f 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-3ox+EXd5/Rh3N/7GbX+JUmH4C9j/Er+REkUHZndTxw0=";
+    hash = "sha256-T81eLshaHqbLj4X0feWJE+VEWItmOxcVCQX04zl3jeA=";
   };
 
-  vendorHash = "sha256-7EQFO7dlVhBwHdY6c3WmxJo4WdCUJbWKw5P4fL6jBsA=";
+  vendorHash = "sha256-Q3Fj73sQAmZQ9OF5hI0t1iPkY8u189PZ4LlzW34NQx0=";
 
   nativeBuildInputs = [
     gotools # goyacc
diff --git a/pkgs/by-name/na/nasm/package.nix b/pkgs/by-name/na/nasm/package.nix
index 792caffc71b1..bfc8231f1926 100644
--- a/pkgs/by-name/na/nasm/package.nix
+++ b/pkgs/by-name/na/nasm/package.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     maintainers = with maintainers; [
       pSub
-      willibutz
     ];
     license = licenses.bsd2;
   };
diff --git a/pkgs/by-name/oc/octoprint/package.nix b/pkgs/by-name/oc/octoprint/package.nix
index 182f7382702f..d6d4112bdfbe 100644
--- a/pkgs/by-name/oc/octoprint/package.nix
+++ b/pkgs/by-name/oc/octoprint/package.nix
@@ -73,13 +73,13 @@ let
       (self: super: {
         octoprint = self.buildPythonPackage rec {
           pname = "OctoPrint";
-          version = "1.11.1";
+          version = "1.11.2";
 
           src = fetchFromGitHub {
             owner = "OctoPrint";
             repo = "OctoPrint";
             rev = version;
-            hash = "sha256-eH5AWeER2spiWgtRM5zMp40OakpM5TMXO07WjdY7gNU=";
+            hash = "sha256-D6lIEa7ee44DWavMLaXIo7RsKwaMneYqOBQk626pI20=";
           };
 
           propagatedBuildInputs =
diff --git a/pkgs/by-name/op/opsdroid/package.nix b/pkgs/by-name/op/opsdroid/package.nix
index d0a0166a1af7..f313846b1bba 100644
--- a/pkgs/by-name/op/opsdroid/package.nix
+++ b/pkgs/by-name/op/opsdroid/package.nix
@@ -70,7 +70,6 @@ python3Packages.buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       globin
-      willibutz
     ];
     platforms = lib.platforms.unix;
     mainProgram = "opsdroid";
diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index f3d2c5a2f0f2..69a89a8b8319 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 buildGoModule rec {
@@ -22,6 +23,10 @@ buildGoModule rec {
 
   ldflags = [ "-X main.Version=${version}" ];
 
+  passthru.tests = {
+    inherit (nixosTests) postfix-tlspol;
+  };
+
   meta = {
     description = "Lightweight MTA-STS + DANE/TLSA resolver and TLS policy server for Postfix, prioritizing DANE.";
     homepage = "https://github.com/Zuplu/postfix-tlspol";
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index 10466580c2a7..1cb93d15602e 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -137,7 +137,6 @@ buildGoModule (finalAttrs: {
     license = licenses.asl20;
     maintainers = with maintainers; [
       fpletz
-      willibutz
       Frostman
     ];
   };
diff --git a/pkgs/by-name/qu/quiet/package.nix b/pkgs/by-name/qu/quiet/package.nix
index d458a4493443..a32c369ceab2 100644
--- a/pkgs/by-name/qu/quiet/package.nix
+++ b/pkgs/by-name/qu/quiet/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "quiet";
-  version = "5.0.1";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://github.com/TryQuiet/quiet/releases/download/@quiet/desktop@${version}/Quiet-${version}.AppImage";
-    hash = "sha256-RZ1YTSNNxCmon8+UR8NlqlYisQZRnzDUIV+oUGAWhuk=";
+    hash = "sha256-ahJUBvQVfU8CtGq5p+S8avpHRkXSn9kQv9HPN7TvJiM=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 7f74c8b6693a..056d7d0d0f90 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.99.2";
+  version = "1.100.0";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-VtZy1pUayK4r8L74llguBid5VJ1UcanNg8rWcOswVh4=";
+        hash = "sha256-uoROEh0ERGpvO4lX/ni5gn+fqwMNOzk7CoPgEnL7ktE=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-PoR7bln88TtfNixhHnBCIA8ddesjQTin2o6nZ4dXPms=";
+        hash = "sha256-LdGVNWgQ8bxgqHSvnVizbWeXnHe7JSk47Kn5jGsrNbs=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 33d0789eaf21..be3e28a4ffd3 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "3.11.1";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    hash = "sha256-vG52R8jYJlCgQqhA8zbZLMES1UxfxknAVOt87nhcflM=";
+    hash = "sha256-4C+bhUkqdn9RelHf6LfcfxVCIiBUCt4BxuI9TGdlIMc=";
   };
 
   hardeningEnable = [ "pie" ];
diff --git a/pkgs/by-name/rt/rtorrent/package.nix b/pkgs/by-name/rt/rtorrent/package.nix
index d2a892bde048..ad30eb71bea2 100644
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  autoconf-archive,
   autoreconfHook,
   cppunit,
   curl,
@@ -17,15 +16,15 @@
   gitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-rtorrent";
-  version = "0.15.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "68fdb86c723a0ae67ebaffec416af99fec41dcbc";
-    hash = "sha256-/GWC28LsY7GcUH+SBzi01sOWVfA1lyM0r9OdUDTYbT8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0OnDxmfliVP3GF2xzUZkURippzCGUwLebuyjb7nz/vs=";
   };
 
   outputs = [
@@ -38,7 +37,6 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [
-    autoconf-archive
     autoreconfHook
     installShellFiles
     pkg-config
@@ -85,4 +83,4 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     mainProgram = "rtorrent";
   };
-}
+})
diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix
index 730472af229a..72269aad6abf 100644
--- a/pkgs/by-name/te/tempo/package.nix
+++ b/pkgs/by-name/te/tempo/package.nix
@@ -44,6 +44,6 @@ buildGoModule rec {
     description = "High volume, minimal dependency trace storage";
     license = licenses.asl20;
     homepage = "https://grafana.com/oss/tempo/";
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/te/testkube/package.nix b/pkgs/by-name/te/testkube/package.nix
index fcdbd08bf58b..5f68c9c152c1 100644
--- a/pkgs/by-name/te/testkube/package.nix
+++ b/pkgs/by-name/te/testkube/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "testkube";
-  version = "2.1.154";
+  version = "2.1.157";
 
   src = fetchFromGitHub {
     owner = "kubeshop";
     repo = "testkube";
     rev = "v${version}";
-    hash = "sha256-vMARS8EWEjkrBIx4rpTQjtEshMAsXLPBztCE+HbwuX8=";
+    hash = "sha256-VI03scPMjTwLEO07kFj9SwNx2NunBBrkxpwUiOZEkNE=";
   };
 
-  vendorHash = "sha256-Bzk4+sG5Zf2qZzVyw0xRx4WuZsWtHRasDtLnTyq++HY=";
+  vendorHash = "sha256-gfJBj4LJRe/bHjWOrNrANdPKQ57AFpwzojxg5y0/Y2o=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/ti/tilt/assets.nix b/pkgs/by-name/ti/tilt/assets.nix
index 2991c2bfcd27..31b4ac1e7874 100644
--- a/pkgs/by-name/ti/tilt/assets.nix
+++ b/pkgs/by-name/ti/tilt/assets.nix
@@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation {
     dontInstall = true;
 
     outputHashAlgo = "sha256";
-    outputHash = "sha256-1poTBB9cm0EHeIvXhan6/kaxr22LXvhHD4Y+JBocioE=";
+    outputHash = "sha256-twc8mtBPizQrA9kRtQpSXG8Q404sbGVs5ay4MHitPgg=";
     outputHashMode = "recursive";
   };
 
diff --git a/pkgs/by-name/ti/tilt/package.nix b/pkgs/by-name/ti/tilt/package.nix
index 77ffc410c05c..bab53e3d1111 100644
--- a/pkgs/by-name/ti/tilt/package.nix
+++ b/pkgs/by-name/ti/tilt/package.nix
@@ -9,13 +9,13 @@ let
       running in development environment and try to serve assets from the
       source tree, which is not there once build completes.
     */
-    version = "0.33.21";
+    version = "0.34.5";
 
     src = fetchFromGitHub {
       owner = "tilt-dev";
       repo = "tilt";
-      rev = "v${version}";
-      hash = "sha256-3LFsTaz47QAIDGId/Tl3G7xP5b9gc25X+ZeMaVhXf8w=";
+      tag = "v${version}";
+      hash = "sha256-UCQN1DKscBOhta4Ok5ZeqAUQIqbn8G7aLIeYExCqg1o=";
     };
   };
 
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 98322838b98a..3df1e5d94d65 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.4.0-unstable-2025-05-21";
+  version = "3.4.0-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "678c7aa3a42aaf64b8b1b7df75e787cbec9fe2ad";
-    hash = "sha256-///JQxm+YlQQFyokqCoApxYCNVhvCK+XxwXM7psa+us=";
+    rev = "669fda298c670c55686f34d868383052b192518d";
+    hash = "sha256-UI6SqVAaM4NANf9cGvsIgYO1jSkWDOk5ysyufrPWTgg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index 923c30683b42..1464068b9f36 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "25.2.3";
+  version = "25.2.4";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-59OG/1tS4SiPZk3ep508m/ULLMU7fJ7Bj9tYe9Do5AY=";
+    hash = "sha256-XLXnQNkeOjuLv+MgX6xgHyVPJ5r9HL4QS6v7j7dRqBY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/wireguard-tools/package.nix b/pkgs/by-name/wi/wireguard-tools/package.nix
index b8bad89199da..19e3585bca1d 100644
--- a/pkgs/by-name/wi/wireguard-tools/package.nix
+++ b/pkgs/by-name/wi/wireguard-tools/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wireguard-tools";
-  version = "1.0.20210914";
+  version = "1.0.20250521";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${version}.tar.xz";
-    sha256 = "sha256-eGGkTVdPPTWK6iEyowW11F4ywRhd+0IXJTZCqY3OZws=";
+    sha256 = "sha256-V9yKf4ZvxpOoVCFkFk18+130YBMhyeMt0641tn0O0e0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index 46232d50cd7f..d09990d1a2d4 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "10.3.0";
+  version = "10.4.2";
 in
 
 rustPlatform.buildRustPackage {
@@ -19,11 +19,11 @@ rustPlatform.buildRustPackage {
     owner = "erebe";
     repo = "wstunnel";
     tag = "v${version}";
-    hash = "sha256-Eq5d80hLg0ZkXtnObDQXmC+weUq9eN5SIQ6teVxB3a4=";
+    hash = "sha256-T4FciAusu1NHxMcHhhu7+WSubGohjpfN4sS5FnQBAZo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-V5ohlS+dTrmhsvxpXW9JA7YpH/LWiyepUwEdBRrHiYE=";
+  cargoHash = "sha256-EOTEk3B49rfTri/CpJwKlvXuSErPoaRwwtpeaCZMfw4=";
 
   cargoBuildFlags = [ "--package wstunnel-cli" ];
 
diff --git a/pkgs/by-name/xm/xmrig-mo/package.nix b/pkgs/by-name/xm/xmrig-mo/package.nix
index 6db6bf7349c0..15f7e3c21db2 100644
--- a/pkgs/by-name/xm/xmrig-mo/package.nix
+++ b/pkgs/by-name/xm/xmrig-mo/package.nix
@@ -6,13 +6,13 @@
 
 xmrig.overrideAttrs (oldAttrs: rec {
   pname = "xmrig-mo";
-  version = "6.22.2-mo1";
+  version = "6.22.3-mo1";
 
   src = fetchFromGitHub {
     owner = "MoneroOcean";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-pJ4NTdpWCt7C98k1EqGoiU0Lup25Frdm1kFJuwTfXgY=";
+    hash = "sha256-jmdlIFTXm5bLScRCYPTe7cDDRyNR29wu5+09Vj6G/Pc=";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/xv/xva-img/package.nix b/pkgs/by-name/xv/xva-img/package.nix
index 13cf40683e32..84d72f57b0cf 100644
--- a/pkgs/by-name/xv/xva-img/package.nix
+++ b/pkgs/by-name/xv/xva-img/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
-    maintainers = with lib.maintainers; [ willibutz ];
+    maintainers = [ ];
     description = "Tool for converting Xen images to raw and back";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ya/yazi/plugins/mount/default.nix b/pkgs/by-name/ya/yazi/plugins/mount/default.nix
index acbe88347eba..732ea984de01 100644
--- a/pkgs/by-name/ya/yazi/plugins/mount/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mount/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mount.yazi";
-  version = "25.5.28-unstable-2025-05-28";
+  version = "25.5.28-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "f9b3f8876eaa74d8b76e5b8356aca7e6a81c0fb7";
-    hash = "sha256-EoIrbyC7WgRzrEtvso2Sr6HnNW91c5E+RZGqnjEi6Zo=";
+    rev = "c1d638374c76655896c06e9bc91cdb39857b7f15";
+    hash = "sha256-cj2RjeW4/9ZRCd/H4PxrIQWW9kSOxtdi72f+8o13aPI=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
index 7e1d00065fed..64bad91f0d3c 100644
--- a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0-unstable-2025-06-01";
+  version = "0-unstable-2025-06-10";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    rev = "10b462765f37502065555e83c68a72bb26870fe2";
-    hash = "sha256-mtXl76a54Deg4cyrD0wr++sD/5b/kCsnJ+ngM6OokTc=";
+    rev = "1ee69a56da3c4b90ec8716dd9dd6b82e7a944614";
+    hash = "sha256-4KZeDkMXlhUV0Zh+VGBtz9kFPGOWCexYVuKUSCN463o=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/rsync/default.nix b/pkgs/by-name/ya/yazi/plugins/rsync/default.nix
index a1267a3c15bf..ff5f193623a6 100644
--- a/pkgs/by-name/ya/yazi/plugins/rsync/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/rsync/default.nix
@@ -5,12 +5,12 @@
 }:
 mkYaziPlugin {
   pname = "rsync.yazi";
-  version = "0-unstable-2025-06-07";
+  version = "0-unstable-2025-06-09";
   src = fetchFromGitHub {
     owner = "GianniBYoung";
     repo = "rsync.yazi";
-    rev = "782481e58316f4b422f5c259f07c63b940555246";
-    hash = "sha256-ZrvaJl3nf/CGavvk1QEyOMUbfKQ/JYSmZguvbXIIw9M=";
+    rev = "55631aaaa7654b86469a07bbedf62a5561caa2c9";
+    hash = "sha256-4U6tYAZboMV5YguQIBpcZtcLWwF3TYYFFUXLtVxYxwU=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
index 8df8e9e55860..f2f35c3ce7db 100644
--- a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "0-unstable-2025-05-31";
+  version = "0-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "4872af0da53023358154c8233ab698581de5b2b2";
-    hash = "sha256-7uk8QXAlck0/4bynPdh/m7Os2ayW1UXbELmusPqRmf4=";
+    rev = "73bce63ffb454ea108a96f316e2a8c2e16a35262";
+    hash = "sha256-pIaqnxEGKiWvtFZJm0e7GSbbIc2qaTCB+czHLcVuVzY=";
   };
 
   meta = {
diff --git a/pkgs/by-name/yd/ydotool/package.nix b/pkgs/by-name/yd/ydotool/package.nix
index 137a701d87a3..ee0ac25bdd1a 100644
--- a/pkgs/by-name/yd/ydotool/package.nix
+++ b/pkgs/by-name/yd/ydotool/package.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Plus;
     mainProgram = "ydotool";
     maintainers = with lib.maintainers; [
-      willibutz
       kraem
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ze/zenoh-c/package.nix b/pkgs/by-name/ze/zenoh-c/package.nix
new file mode 100644
index 000000000000..39286f61322c
--- /dev/null
+++ b/pkgs/by-name/ze/zenoh-c/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  cargo,
+  rustPlatform,
+  rustc,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zenoh-c";
+  version = "1.4.0"; # nixpkgs-update: no auto update
+
+  src = fetchFromGitHub {
+    owner = "eclipse-zenoh";
+    repo = "zenoh-c";
+    tag = version;
+    hash = "sha256-Mn3diwJgMkYXP9Dn5AqquN1UJ+P+b4QadiXqzzYZK+o=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src pname version;
+    hash = "sha256-Z9xKC7svGPSuQm4KCKOfGAFOdWgSjBK+/LFT3rAebTg=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/lib/pkgconfig/zenohc.pc \
+      --replace-fail "\''${prefix}/" ""
+  '';
+
+  meta = {
+    description = "C API for zenoh";
+    homepage = "https://github.com/eclipse-zenoh/zenoh-c";
+    license = with lib.licenses; [
+      asl20
+      epl20
+    ];
+    maintainers = with lib.maintainers; [ markuskowa ];
+  };
+}
diff --git a/pkgs/by-name/ze/zenoh-cpp/package.nix b/pkgs/by-name/ze/zenoh-cpp/package.nix
new file mode 100644
index 000000000000..76add02abb12
--- /dev/null
+++ b/pkgs/by-name/ze/zenoh-cpp/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  zenoh-c,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zenoh-cpp";
+  version = "1.4.0"; # nixpkgs-update: no auto update
+
+  src = fetchFromGitHub {
+    owner = "eclipse-zenoh";
+    repo = "zenoh-cpp";
+    tag = version;
+    hash = "sha256-rznvif87UZbYzZB4yHG4R850qm6Z3beJ1NSG4wrf58M=";
+  };
+
+  cmakeFlags = [
+    "-DZENOHCXX_ZENOHC=ON"
+    "-DZENOHCXX_ZENOHPICO=OFF"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  propagatedBuildInputs = [
+    zenoh-c
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/lib/pkgconfig/zenohcxx.pc \
+      --replace-fail "\''${prefix}/" ""
+  '';
+
+  meta = {
+    description = "C++ API for zenoh";
+    homepage = "https://github.com/eclipse-zenoh/zenoh-cpp";
+    license = with lib.licenses; [
+      asl20
+      epl20
+    ];
+    maintainers = with lib.maintainers; [ markuskowa ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ocamlformat/generic.nix b/pkgs/development/ocaml-modules/ocamlformat/generic.nix
index 9c1bfa77cf26..164f54e452a3 100644
--- a/pkgs/development/ocaml-modules/ocamlformat/generic.nix
+++ b/pkgs/development/ocaml-modules/ocamlformat/generic.nix
@@ -21,7 +21,6 @@
   stdio,
   uuseg,
   uutf,
-  janeStreet_0_15,
   ...
 }:
 
@@ -67,13 +66,9 @@ rec {
 
   cmdliner_v = if lib.versionAtLeast version "0.21.0" then cmdliner_1_1 else cmdliner_1_0;
 
-  base_v = if lib.versionAtLeast version "0.25.1" then base else janeStreet_0_15.base;
-
-  stdio_v = if lib.versionAtLeast version "0.25.1" then stdio else janeStreet_0_15.stdio;
-
   library_deps =
     [
-      base_v
+      base
       cmdliner_v
       dune-build-info
       fix
@@ -81,7 +76,7 @@ rec {
       menhirLib
       menhirSdk
       ocp-indent
-      stdio_v
+      stdio
       uuseg
       uutf
     ]
diff --git a/pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix b/pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix
index dc2671a265f0..3dc8e2ab4e33 100644
--- a/pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix
+++ b/pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix
@@ -17,6 +17,7 @@ in
 lib.throwIf
   (
     lib.versionAtLeast ocaml.version "5.0" && !lib.versionAtLeast version "0.23"
+    || lib.versionAtLeast ocaml.version "5.1" && !lib.versionAtLeast version "0.25"
     || lib.versionAtLeast ocaml.version "5.2" && !lib.versionAtLeast version "0.26.2"
     || lib.versionAtLeast ocaml.version "5.3" && !lib.versionAtLeast version "0.27"
   )
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 1846517a448f..54e37bf56a3b 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -1,24 +1,20 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
+  fetchurl,
   setuptools,
   sqlite,
 }:
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.46.1.0";
+  version = "3.48.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "rogerbinns";
-    repo = "apsw";
-    tag = version;
-    hash = "sha256-/MMCwdd2juFbv/lrYwuO2mdWm0+v+YFn6h9CwdQMTpg=";
+  # https://github.com/rogerbinns/apsw/issues/548
+  src = fetchurl {
+    url = "https://github.com/rogerbinns/apsw/releases/download/${version}/apsw-${version}.tar.gz";
+    hash = "sha256-iwvUW6vOQu2EiUuYWVaz5D3ePSLrj81fmLxoGRaTzRk=";
   };
 
   build-system = [ setuptools ];
@@ -35,11 +31,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "apsw" ];
 
-  meta = with lib; {
-    changelog = "https://github.com/rogerbinns/apsw/blob/${src.rev}/doc/changes.rst";
+  meta = {
+    changelog = "https://github.com/rogerbinns/apsw/blob/${version}/doc/changes.rst";
     description = "Python wrapper for the SQLite embedded relational database engine";
     homepage = "https://github.com/rogerbinns/apsw";
-    license = licenses.zlib;
-    maintainers = with maintainers; [ gador ];
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ gador ];
   };
 }
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index cfcca247276a..03ae0b1247c4 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "auth0";
     repo = "auth0-python";
     tag = version;
-    hash = "sha256-xmA1VbXTDSnkiciyMJidzc3HPwD0OySrByJvzqiaDy4=";
+    hash = "sha256-qQbZBuwn2P2ocDjwGeVR7z7rKNHud/gfzNItiliW1P8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/configargparse/default.nix b/pkgs/development/python-modules/configargparse/default.nix
index 8f9a2bee6135..8d9dd3c00cfb 100644
--- a/pkgs/development/python-modules/configargparse/default.nix
+++ b/pkgs/development/python-modules/configargparse/default.nix
@@ -49,6 +49,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/bw2/ConfigArgParse";
     changelog = "https://github.com/bw2/ConfigArgParse/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/igraph/default.nix b/pkgs/development/python-modules/igraph/default.nix
index 30e3e28d29df..328cbbd1e33b 100644
--- a/pkgs/development/python-modules/igraph/default.nix
+++ b/pkgs/development/python-modules/igraph/default.nix
@@ -1,9 +1,9 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   pkg-config,
+  cmake,
   setuptools,
   igraph,
   texttable,
@@ -15,9 +15,7 @@
 
 buildPythonPackage rec {
   pname = "igraph";
-  version = "0.11.8";
-
-  disabled = pythonOlder "3.8";
+  version = "0.11.9";
 
   pyproject = true;
 
@@ -29,20 +27,21 @@ buildPythonPackage rec {
       # export-subst prevents reproducability
       rm $out/.git_archival.json
     '';
-    hash = "sha256-FEp9kwUAPSAnGcAuxApAq1AXiT0klXuXE2M6xNVilRg=";
+    hash = "sha256-rmIICiIyEr5JCmkDAzcdisVaaKDraTQEquPHjK4d7oU=";
   };
 
   postPatch = ''
     rm -r vendor
-
-    # TODO remove starting with 0.11.9
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=64,<72.2.0" setuptools
   '';
 
   nativeBuildInputs = [ pkg-config ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    cmake
+    setuptools
+  ];
+
+  dontUseCmakeConfigure = true;
 
   buildInputs = [ igraph ];
 
diff --git a/pkgs/development/tools/mysql-shell/8.nix b/pkgs/development/tools/mysql-shell/8.nix
index 876b56f8a905..5f2ac287b656 100644
--- a/pkgs/development/tools/mysql-shell/8.nix
+++ b/pkgs/development/tools/mysql-shell/8.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "8.4.4";
-  mysqlServerVersion = "8.4.4";
+  mysqlShellVersion = "8.4.5";
+  mysqlServerVersion = "8.4.5";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-+ykO90iJRDQIUknDG8pSrHGFMSREarIYuzvFAr8AgqU=";
+      hash = "sha256-U2OVkqcgpxn9+t8skhuUfqyGwG4zMgLkdmeFKleBvRo=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-wl57vU3YbWvtmzew801k8WHohY6Fjy59Uyy2pdYaHuw=";
+      hash = "sha256-OLU27mLd46pC6mfvBTRmC0mJ8nlwQuHPNWPkTQw3t8w=";
     })
   ];
 
diff --git a/pkgs/development/tools/mysql-shell/innovation.nix b/pkgs/development/tools/mysql-shell/innovation.nix
index dcd4b9fc764d..177992ca170b 100644
--- a/pkgs/development/tools/mysql-shell/innovation.nix
+++ b/pkgs/development/tools/mysql-shell/innovation.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "9.2.0";
-  mysqlServerVersion = "9.2.0";
+  mysqlShellVersion = "9.3.0";
+  mysqlServerVersion = "9.3.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell-innovation";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-o50R/fbPjRsDtwjVN6kTLeS5mp601hApOTfwaHzTehI=";
+      hash = "sha256-Gj7iNvHarF74l8YyXJsOCq5IY4m+G4AB3rP/d85oLWA=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-xuKXV8YllhDo7+6i5UYHAH7m7Jn5E/k0YdeN5MZSzl8=";
+      hash = "sha256-26bhtMNuaEnsW/TygbyhejlHbtSnh+EwrEdHaDqyv5s=";
     })
   ];
 
diff --git a/pkgs/os-specific/linux/nullfs/default.nix b/pkgs/os-specific/linux/nullfs/default.nix
index 8001dbab52d3..7720c5cd0d20 100644
--- a/pkgs/os-specific/linux/nullfs/default.nix
+++ b/pkgs/os-specific/linux/nullfs/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nullfs";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "nullfsvfs";
     rev = "v${version}";
-    sha256 = "sha256-tfa0SPhTm9vvv4CiwcDyz6KssJqD9F2SlWB4rwZpGoY=";
+    sha256 = "sha256-nEwLxcELLBd+BN7OHYLJZCpie0rG0a1wj0RCOKpZkRU=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 9113d8ec3307..0836519c203d 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -192,7 +192,46 @@ optionalAttrs allowAliases aliases
               (listOf valueType)
             ])
             // {
-              description = "YAML value";
+              description = "YAML 1.1 value";
+            };
+        in
+        valueType;
+
+    };
+
+  yaml_1_2 =
+    { }:
+    {
+      generate =
+        name: value:
+        pkgs.callPackage (
+          { runCommand, remarshal }:
+          runCommand name
+            {
+              nativeBuildInputs = [ remarshal ];
+              value = builtins.toJSON value;
+              passAsFile = [ "value" ];
+              preferLocalBuild = true;
+            }
+            ''
+              json2yaml "$valuePath" "$out"
+            ''
+        ) { };
+
+      type =
+        let
+          valueType =
+            nullOr (oneOf [
+              bool
+              int
+              float
+              str
+              path
+              (attrsOf valueType)
+              (listOf valueType)
+            ])
+            // {
+              description = "YAML 1.2 value";
             };
         in
         valueType;
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index d69fd9e15fb9..4f635a4070fe 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -143,7 +143,7 @@ runBuildTests {
   };
 
   yaml_1_1Atoms = shouldPass {
-    format = formats.yaml { };
+    format = formats.yaml_1_1 { };
     input = {
       null = null;
       false = false;
@@ -176,6 +176,40 @@ runBuildTests {
     '';
   };
 
+  yaml_1_2Atoms = shouldPass {
+    format = formats.yaml_1_2 { };
+    input = {
+      null = null;
+      false = false;
+      true = true;
+      float = 3.141;
+      str = "foo";
+      attrs.foo = null;
+      list = [
+        null
+        null
+      ];
+      path = ./testfile;
+      no = "no";
+      time = "22:30:00";
+    };
+    expected = ''
+      attrs:
+        foo: null
+      'false': false
+      float: 3.141
+      list:
+      - null
+      - null
+      no: no
+      'null': null
+      path: ${./testfile}
+      str: foo
+      time: 22:30:00
+      'true': true
+    '';
+  };
+
   iniAtoms = shouldPass {
     format = formats.ini { };
     input = {
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
index 782c36ab1b0a..4f71a69943a0 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-camera-card";
-  version = "7.11.0";
+  version = "7.14.1";
 
   src = fetchzip {
     url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-ZxRokID9U3igUZTf3Rz2jTqs7Sb+en+KAV3DFKNg5Rk=";
+    hash = "sha256-SBUDM4+uayW5MJFs7arHXs1WzBmlHntVlE2hDBtGlAI=";
   };
 
   # TODO: build from source once yarn berry support lands in nixpkgs
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 078f48f7233a..a42dff0517d9 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -158,7 +158,6 @@ buildGoModule rec {
     maintainers = with maintainers; [
       offline
       fpletz
-      willibutz
       globin
       ma27
       Frostman
diff --git a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
index 817ad982def4..a6e4b0b19d0e 100644
--- a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
@@ -42,7 +42,6 @@ buildGoModule rec {
     maintainers = with maintainers; [
       globin
       fpletz
-      willibutz
       Frostman
       ma27
     ];
diff --git a/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix b/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
index 9364526b9864..11ce09ab56b4 100644
--- a/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
@@ -29,7 +29,6 @@ buildGoModule rec {
     mainProgram = "dnsmasq_exporter";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
     # Broken on darwin for Go toolchain > 1.22, with error:
diff --git a/pkgs/servers/monitoring/prometheus/json-exporter.nix b/pkgs/servers/monitoring/prometheus/json-exporter.nix
index 7a9a6007bed9..f78f6af69716 100644
--- a/pkgs/servers/monitoring/prometheus/json-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/json-exporter.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
     description = "Prometheus exporter which scrapes remote JSON by JSONPath";
     homepage = "https://github.com/prometheus-community/json_exporter";
     license = licenses.asl20;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     mainProgram = "json_exporter";
   };
 }
diff --git a/pkgs/servers/monitoring/prometheus/mail-exporter.nix b/pkgs/servers/monitoring/prometheus/mail-exporter.nix
index 62b9697dca22..695b8753b5cc 100644
--- a/pkgs/servers/monitoring/prometheus/mail-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/mail-exporter.nix
@@ -34,7 +34,6 @@ buildGoModule {
     homepage = "https://github.com/cherti/mailexporter";
     license = licenses.gpl3;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
     platforms = platforms.linux;
diff --git a/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix b/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix
index de6e31c91eae..68397cf9b796 100644
--- a/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
     description = "Prometheus exporter for Nextcloud servers";
     homepage = "https://github.com/xperimental/nextcloud-exporter";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     mainProgram = "nextcloud-exporter";
   };
 }
diff --git a/pkgs/servers/monitoring/prometheus/nginx-exporter.nix b/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
index ac572fe2f159..137cd38b5ae3 100644
--- a/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
@@ -41,7 +41,6 @@ buildGoModule rec {
     maintainers = with maintainers; [
       benley
       fpletz
-      willibutz
       globin
     ];
   };
diff --git a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
index 8842329d63c0..9e218e26a439 100644
--- a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
@@ -43,7 +43,6 @@ buildGoModule rec {
     mainProgram = "postfix_exporter";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
   };
diff --git a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
index d84cb5d931dd..f61099c52c07 100644
--- a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
@@ -44,7 +44,6 @@ buildGoModule rec {
     maintainers = with maintainers; [
       fpletz
       globin
-      willibutz
       ma27
     ];
   };
diff --git a/pkgs/servers/sql/postgresql/ext/pgtap.nix b/pkgs/servers/sql/postgresql/ext/pgtap.nix
index 37cd20d70202..7ecf3313a809 100644
--- a/pkgs/servers/sql/postgresql/ext/pgtap.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgtap.nix
@@ -61,7 +61,7 @@ postgresqlBuildExtension (finalAttrs: {
       as well as the ability to integrate with other TAP-emitting test frameworks.
       It can also be used in the xUnit testing style.
     '';
-    maintainers = with lib.maintainers; [ willibutz ];
+    maintainers = [ ];
     homepage = "https://pgtap.org";
     inherit (postgresql.meta) platforms;
     license = lib.licenses.mit;
diff --git a/pkgs/tools/system/nvtop/build-nvtop.nix b/pkgs/tools/system/nvtop/build-nvtop.nix
index 7caac445a33d..bad6e4e5d72f 100644
--- a/pkgs/tools/system/nvtop/build-nvtop.nix
+++ b/pkgs/tools/system/nvtop/build-nvtop.nix
@@ -111,7 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Only;
     platforms = if apple then platforms.darwin else platforms.linux;
     maintainers = with maintainers; [
-      willibutz
       gbtb
       anthonyroussel
       moni
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index 6ef03ad24d95..c446d66f79ee 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -76,7 +76,7 @@ let
       mainProgram = "highlight";
       homepage = "http://www.andre-simon.de/doku/highlight/en/highlight.php";
       platforms = platforms.unix;
-      maintainers = with maintainers; [ willibutz ];
+      maintainers = [ ];
     };
   };
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9cd139b10916..0fefcee0cb97 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -939,6 +939,7 @@ mapAliases {
   javacard-devkit = throw "javacard-devkit was dropped due to having a dependency on the Oracle JDK, as well as being several years out-of-date."; # Added 2024-11-01
   jd-cli = throw "jd-cli has been removed due to upstream being unmaintained since 2019. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30
   jd-gui = throw "jd-gui has been removed due to a dependency on the dead JCenter Bintray. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30
+  jikespg = throw "'jikespg' has been removed due to of maintenance upstream."; # Added 2025-06-10
   jsawk = throw "'jsawk' has been removed because it is unmaintained upstream"; # Added 2028-08-07
 
   # Julia
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7f0d89f5cb67..d91aeb43a02b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11104,8 +11104,7 @@ with pkgs;
 
   projecteur = libsForQt5.callPackage ../os-specific/linux/projecteur { };
 
-  lkl = callPackage ../applications/virtualization/lkl { };
-  lklWithFirewall = callPackage ../applications/virtualization/lkl { firewallSupport = true; };
+  lklWithFirewall = lkl.override { firewallSupport = true; };
 
   inherit (callPackages ../os-specific/linux/kernel-headers { inherit (pkgsBuildBuild) elf-header; })
     linuxHeaders