diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 3e44f8cdb0a6..177021ff1497 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -194,19 +194,15 @@ jobs:
                     expectedHash: artifact.digest
                   })
 
-                  // Get all currently set labels that we manage
-                  const before =
+                  // Create a map (Label -> Boolean) of all currently set labels.
+                  // Each label is set to True and can be disabled later.
+                  const before = Object.fromEntries(
                     (await github.paginate(github.rest.issues.listLabelsOnIssue, {
                       ...context.repo,
                       issue_number: pull_request.number
                     }))
-                    .map(({ name }) => name)
-                    .filter(name =>
-                      name.startsWith('10.rebuild') ||
-                      name == '11.by: package-maintainer' ||
-                      name.startsWith('12.approvals:') ||
-                      name == '12.approved-by: package-maintainer'
-                    )
+                    .map(({ name }) => [name, true])
+                  )
 
                   const approvals = new Set(
                     (await github.paginate(github.rest.pulls.listReviews, {
@@ -221,35 +217,43 @@ jobs:
                     JSON.parse(await readFile(`${pull_request.number}/maintainers.json`, 'utf-8'))
                   ).map(m => Number.parseInt(m, 10)))
 
-                  // And the labels that should be there
-                  const after = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
-                  if (approvals.size > 0) after.push(`12.approvals: ${approvals.size > 2 ? '3+' : approvals.size}`)
-                  if (Array.from(maintainers).some(m => approvals.has(m))) after.push('12.approved-by: package-maintainer')
+                  const evalLabels = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
 
-                  if (context.eventName == 'pull_request') {
-                    core.info('Skipping labeling on a pull_request event (no privileges).')
-                    return
-                  }
-
-                  // Remove the ones not needed anymore
-                  await Promise.all(
-                    before.filter(name => !after.includes(name))
-                    .map(name => github.rest.issues.removeLabel({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      name
-                    }))
+                  // Manage the labels
+                  const after = Object.assign(
+                    {},
+                    before,
+                    // Ignore `evalLabels` if it's an array.
+                    // This can happen for older eval runs, before we switched to objects.
+                    // The old eval labels would have been set by the eval run,
+                    // so now they'll be present in `before`.
+                    // TODO: Simplify once old eval results have expired (~2025-10)
+                    (Array.isArray(evalLabels) ? undefined : evalLabels),
+                    {
+                      '12.approvals: 1': approvals.size == 1,
+                      '12.approvals: 2': approvals.size == 2,
+                      '12.approvals: 3+': approvals.size >= 3,
+                      '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
+                      '12.first-time contribution':
+                        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+                    }
                   )
 
-                  // And add the ones that aren't set already
-                  const added = after.filter(name => !before.includes(name))
-                  if (added.length > 0) {
-                    await github.rest.issues.addLabels({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      labels: added
-                    })
-                  }
+                  // No need for an API request, if all labels are the same.
+                  const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
+                  if (log('Has changes', hasChanges, !hasChanges))
+                    return;
+
+                  // Skipping labeling on a pull_request event, because we have no privileges.
+                  const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
+                  if (log('Set labels', labels, context.eventName == 'pull_request'))
+                    return;
+
+                  await github.rest.issues.setLabels({
+                    ...context.repo,
+                    issue_number: pull_request.number,
+                    labels
+                  })
                 } catch (cause) {
                   throw new Error(`Labeling PR #${pull_request.number} failed.`, { cause })
                 }
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 302a2df90611..46507a492a59 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -31,10 +31,10 @@ let
             changed: ["package2", "package3"],
             removed: ["package4"],
           },
-          labels: [
-            "10.rebuild-darwin: 1-10",
-            "10.rebuild-linux: 1-10"
-          ],
+          labels: {
+            "10.rebuild-darwin: 1-10": true,
+            "10.rebuild-linux: 1-10": true
+          },
           rebuildsByKernel: {
             darwin: ["package1", "package2"],
             linux: ["package1", "package2", "package3"]
@@ -97,19 +97,21 @@ let
           rebuildCountByKernel
           ;
         labels =
-          (getLabels rebuildCountByKernel)
-          # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
-          ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
-            lib.filterAttrs (_: lib.elem "stdenv") rebuildsByKernel
-          )
-          # Adds the "11.by: package-maintainer" label if all of the packages directly
-          # changed are maintained by the PR's author. (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
-          ++ lib.optional (
-            maintainers ? ${githubAuthorId}
-            && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
-              lib.flatten (lib.attrValues maintainers)
-            )
-          ) "11.by: package-maintainer";
+          getLabels rebuildCountByKernel
+          # Sets "10.rebuild-*-stdenv" label to whether the "stdenv" attribute was changed.
+          // lib.mapAttrs' (
+            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
+          ) rebuildsByKernel
+          # Set the "11.by: package-maintainer" label to whether all packages directly
+          # changed are maintained by the PR's author.
+          # (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
+          // {
+            "11.by: package-maintainer" =
+              maintainers ? ${githubAuthorId}
+              && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
+                lib.flatten (lib.attrValues maintainers)
+              );
+          };
       }
     );
 
diff --git a/ci/eval/compare/utils.nix b/ci/eval/compare/utils.nix
index 064d2cf57ea1..5dcb97e97535 100644
--- a/ci/eval/compare/utils.nix
+++ b/ci/eval/compare/utils.nix
@@ -151,7 +151,7 @@ rec {
     lib.genAttrs [ "linux" "darwin" ] filterKernel;
 
   /*
-    Maps an attrs of `kernel - rebuild counts` mappings to a list of labels
+    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels
 
     Turns
       {
@@ -159,54 +159,37 @@ rec {
         darwin = 1;
       }
     into
-      [
-        "10.rebuild-darwin: 1"
-        "10.rebuild-darwin: 1-10"
-        "10.rebuild-linux: 11-100"
-      ]
+      {
+        "10.rebuild-darwin: 1" = true;
+        "10.rebuild-darwin: 1-10" = true;
+        "10.rebuild-darwin: 11-100" = false;
+        # [...]
+        "10.rebuild-darwin: 1" = false;
+        "10.rebuild-darwin: 1-10" = false;
+        "10.rebuild-linux: 11-100" = true;
+        # [...]
+      }
   */
   getLabels =
     rebuildCountByKernel:
-    lib.concatLists (
+    lib.mergeAttrsList (
       lib.mapAttrsToList (
         kernel: rebuildCount:
         let
-          numbers =
-            if rebuildCount == 0 then
-              [ "0" ]
-            else if rebuildCount == 1 then
-              [
-                "1"
-                "1-10"
-              ]
-            else if rebuildCount <= 10 then
-              [ "1-10" ]
-            else if rebuildCount <= 100 then
-              [ "11-100" ]
-            else if rebuildCount <= 500 then
-              [ "101-500" ]
-            else if rebuildCount <= 1000 then
-              [
-                "501-1000"
-                "501+"
-              ]
-            else if rebuildCount <= 2500 then
-              [
-                "1001-2500"
-                "501+"
-              ]
-            else if rebuildCount <= 5000 then
-              [
-                "2501-5000"
-                "501+"
-              ]
-            else
-              [
-                "5001+"
-                "501+"
-              ];
+          range = from: to: from <= rebuildCount && (to == null || rebuildCount <= to);
         in
-        lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
+        lib.mapAttrs' (number: lib.nameValuePair "10.rebuild-${kernel}: ${number}") {
+          "0" = range 0 0;
+          "1" = range 1 1;
+          "1-10" = range 1 10;
+          "11-100" = range 11 100;
+          "101-500" = range 101 500;
+          "501-1000" = range 501 1000;
+          "501+" = range 501 null;
+          "1001-2500" = range 1001 2500;
+          "2501-5000" = range 2501 5000;
+          "5001+" = range 5001 null;
+        }
       ) rebuildCountByKernel
     );
 }
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 6b6145bd89de..55f1caa48de1 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -26,6 +26,9 @@
 
 - `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms.
 
+- `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatable due to major api changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
+  Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -43,7 +46,8 @@
 
 ### Breaking changes {#sec-nixpkgs-release-25.11-lib-breaking}
 
-- Create the first release note entry in this section!
+- `reaction` has been updated to version 2, which includes some breaking changes.
+  For more information, [check the release article](https://blog.ppom.me/en-reaction-v2).
 
 
 ### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b3658e72834e..265454f3a06b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1606,6 +1606,12 @@
     githubId = 7644264;
     name = "Andrew Gazelka";
   };
+  andrewgigena = {
+    email = "work@andrewgigena.dev";
+    github = "andrewgigena";
+    githubId = 37125554;
+    name = "Andrew Gigena";
+  };
   AndrewKvalheim = {
     email = "andrew@kvalhe.im";
     github = "AndrewKvalheim";
@@ -4622,6 +4628,13 @@
     githubId = 2245737;
     name = "Christopher Mark Poole";
   };
+  chrjabs = {
+    email = "contact@christophjabs.info";
+    github = "chrjabs";
+    githubId = 98587286;
+    name = "Christoph Jabs";
+    keys = [ { fingerprint = "47D6 1FEB CD86 F3EC D2E3  D68A 83D0 74F3 48B2 FD9D"; } ];
+  };
   chrpinedo = {
     github = "chrpinedo";
     githubId = 2324630;
@@ -5702,6 +5715,12 @@
     github = "DarkOnion0";
     githubId = 68606322;
   };
+  darkyzhou = {
+    name = "darkyzhou";
+    email = "me@zqy.io";
+    github = "darkyzhou";
+    githubId = 7220778;
+  };
   daru-san = {
     name = "Daru";
     email = "zadarumaka@proton.me";
@@ -5974,6 +5993,13 @@
     githubId = 30749142;
     keys = [ { fingerprint = "4E35 F2E5 2132 D654 E815  A672 DB2C BC24 2868 6000"; } ];
   };
+  debling = {
+    name = "Denilson S. Ebling";
+    email = "d.ebling8@gmail.com";
+    github = "debling";
+    githubId = 32403873;
+    keys = [ { fingerprint = "3EDD 9C88 B0F2 58F8 C25F  5D2C CCBC 8AA1 AF06 2142"; } ];
+  };
   declan = {
     name = "Declan Rixon";
     email = "declan.fraser.rixon@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 03b2d6584f9f..29a5391b41ff 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -48,6 +48,8 @@
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
 
+- [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 036490c9589a..18ea2359c5bc 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -767,6 +767,7 @@
   ./services/matrix/lk-jwt-service.nix
   ./services/matrix/matrix-alertmanager.nix
   ./services/matrix/maubot.nix
+  ./services/matrix/mautrix-discord.nix
   ./services/matrix/mautrix-meta.nix
   ./services/matrix/mautrix-signal.nix
   ./services/matrix/mautrix-telegram.nix
diff --git a/nixos/modules/programs/yazi.nix b/nixos/modules/programs/yazi.nix
index 8486cf611c46..6a097c8b9c9b 100644
--- a/nixos/modules/programs/yazi.nix
+++ b/nixos/modules/programs/yazi.nix
@@ -118,6 +118,9 @@ in
   };
 
   meta = {
-    maintainers = with lib.maintainers; [ linsui ];
+    maintainers = with lib.maintainers; [
+      linsui
+      ryan4yin
+    ];
   };
 }
diff --git a/nixos/modules/services/finance/libeufin/common.nix b/nixos/modules/services/finance/libeufin/common.nix
index 4e0a6bffe02f..20b99ce9c396 100644
--- a/nixos/modules/services/finance/libeufin/common.nix
+++ b/nixos/modules/services/finance/libeufin/common.nix
@@ -96,7 +96,9 @@ libeufinComponent:
             };
           in
           {
-            path = [ config.services.postgresql.package ];
+            path = [
+              (if cfg.createLocalDatabase then config.services.postgresql.package else pkgs.postgresql)
+            ];
             serviceConfig = {
               Type = "oneshot";
               DynamicUser = true;
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 7cb723e3172c..c31c4b069928 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -272,7 +272,7 @@ in
     ];
 
     systemd.services.roundcube-setup = lib.mkMerge [
-      (lib.mkIf (cfg.database.host == "localhost") {
+      (lib.mkIf localDB {
         requires = [ "postgresql.service" ];
         after = [ "postgresql.service" ];
       })
@@ -281,7 +281,9 @@ in
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
 
-        path = [ config.services.postgresql.package ];
+        path = [
+          (if localDB then config.services.postgresql.package else pkgs.postgresql)
+        ];
         script =
           let
             psql = "${lib.optionalString (!localDB) "PGPASSFILE=${cfg.database.passwordFile}"} psql ${
diff --git a/nixos/modules/services/matrix/mautrix-discord.nix b/nixos/modules/services/matrix/mautrix-discord.nix
new file mode 100644
index 000000000000..e4c5fa304223
--- /dev/null
+++ b/nixos/modules/services/matrix/mautrix-discord.nix
@@ -0,0 +1,538 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.mautrix-discord;
+  dataDir = cfg.dataDir;
+  format = pkgs.formats.yaml { };
+
+  registrationFile = "${dataDir}/discord-registration.yaml";
+
+  settingsFile = "${dataDir}/config.yaml";
+  settingsFileUnformatted = format.generate "discord-config-unsubstituted.yaml" cfg.settings;
+in
+{
+  options = {
+    services.mautrix-discord = {
+      enable = lib.mkEnableOption "Mautrix-Discord, a Matrix-Discord puppeting/relay-bot bridge";
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.mautrix-discord;
+        defaultText = lib.literalExpression "pkgs.mautrix-discord";
+        description = ''
+          The mautrix-discord package to use.
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = format.type;
+
+          config = {
+            _module.args = { inherit cfg lib; };
+          };
+
+          options = {
+            homeserver = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                software = "standard";
+                status_endpoint = null;
+                message_send_checkpoint_endpoint = null;
+                async_media = false;
+                websocket = false;
+                ping_interval_seconds = 0;
+              };
+              description = ''
+                fullDataDiration.
+                                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                                for more information.
+              '';
+            };
+
+            appservice = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                address = "http://localhost:8009";
+                port = 8009;
+                id = "discord";
+                bot = {
+                  username = "discordbot";
+                  displayname = "Discord bridge bot";
+                  avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+                };
+                as_token = "generate";
+                hs_token = "generate";
+                database = {
+                  type = "sqlite3";
+                  uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
+                };
+              };
+              defaultText = lib.literalExpression ''
+                {
+                  address = "http://localhost:8009";
+                  port = 8009;
+                  id = "discord";
+                  bot = {
+                    username = "discordbot";
+                    displayname = "Discord bridge bot";
+                    avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+                  };
+                  as_token = "generate";
+                  hs_token = "generate";
+                  database = {
+                    type = "sqlite3";
+                    uri = "file:''${config.services.mautrix-discord.dataDir}/mautrix-discord.db?_txlock=immediate";
+                  };
+                }
+              '';
+              description = ''
+                Appservice configuration.
+                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                for more information.
+              '';
+            };
+
+            bridge = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                username_template = "discord_{{.}}";
+                displayname_template = "{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}";
+                channel_name_template = "{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}";
+                guild_name_template = "{{.Name}}";
+                private_chat_portal_meta = "default";
+                public_address = null;
+                avatar_proxy_key = "generate";
+                portal_message_buffer = 128;
+                startup_private_channel_create_limit = 5;
+                delivery_receipts = false;
+                message_status_events = false;
+                message_error_notices = true;
+                restricted_rooms = true;
+                autojoin_thread_on_open = true;
+                embed_fields_as_tables = true;
+                mute_channels_on_create = false;
+                sync_direct_chat_list = false;
+                resend_bridge_info = false;
+                custom_emoji_reactions = true;
+                delete_portal_on_channel_delete = false;
+                delete_guild_on_leave = true;
+                federate_rooms = true;
+                prefix_webhook_messages = false;
+                enable_webhook_avatars = true;
+                use_discord_cdn_upload = true;
+                cache_media = "unencrypted";
+                direct_media = {
+                  enabled = false;
+                  server_name = "discord-media.example.com";
+                  allow_proxy = true;
+                  server_key = "generate";
+                };
+                animated_sticker = {
+                  target = "webp";
+                  args = {
+                    width = 320;
+                    height = 320;
+                    fps = 25;
+                  };
+                };
+                command_prefix = "!discord";
+                management_room_text = {
+                  welcome = "Hello, I'm a Discord bridge bot.";
+                  welcome_connected = "Use `help` for help.";
+                  welcome_unconnected = "Use `help` for help or `login` to log in.";
+                  additional_help = "";
+                };
+                backfill = {
+                  forward_limits = {
+                    initial = {
+                      dm = 0;
+                      channel = 0;
+                      thread = 0;
+                    };
+                    missed = {
+                      dm = 0;
+                      channel = 0;
+                      thread = 0;
+                    };
+                    max_guild_members = -1;
+                  };
+                };
+                encryption = {
+                  allow = false;
+                  default = false;
+                  appservice = false;
+                  msc4190 = false;
+                  require = false;
+                  allow_key_sharing = false;
+                  plaintext_mentions = false;
+                  delete_keys = {
+                    delete_outbound_on_ack = false;
+                    dont_store_outbound = false;
+                    ratchet_on_decrypt = false;
+                    delete_fully_used_on_decrypt = false;
+                    delete_prev_on_new_session = false;
+                    delete_on_device_delete = false;
+                    periodically_delete_expired = false;
+                    delete_outdated_inbound = false;
+                  };
+                  verification_levels = {
+                    receive = "unverified";
+                    send = "unverified";
+                    share = "cross-signed-tofu";
+                  };
+                  rotation = {
+                    enable_custom = false;
+                    milliseconds = 604800000;
+                    messages = 100;
+                    disable_device_change_key_rotation = false;
+                  };
+                };
+                provisioning = {
+                  prefix = "/_matrix/provision";
+                  shared_secret = "generate";
+                  debug_endpoints = false;
+                };
+                permissions = {
+                  "*" = "relay";
+                  # "example.com" = "user";
+                  # "@admin:example.com": "admin";
+                };
+              };
+              description = ''
+                Bridge configuration.
+                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                for more information.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = lib.literalExpression ''
+          {
+            homeserver = {
+              address = "http://localhost:8008";
+              domain = "public-domain.tld";
+            };
+
+            appservice.public = {
+              prefix = "/public";
+              external = "https://public-appservice-address/public";
+            };
+
+            bridge.permissions = {
+              "example.com" = "full";
+              "@admin:example.com" = "admin";
+            };
+          }
+        '';
+        description = ''
+          {file}`config.yaml` configuration as a Nix attribute set.
+          Configuration options should match those described in
+          [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml).
+        '';
+      };
+
+      registerToSynapse = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.matrix-synapse.enable;
+        defaultText = lib.literalExpression "config.services.matrix-synapse.enable";
+        description = ''
+          Whether to add the bridge's app service registration file to
+          `services.matrix-synapse.settings.app_service_config_files`.
+        '';
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/mautrix-discord";
+        defaultText = "/var/lib/mautrix-discord";
+        description = ''
+          Directory to store the bridge's configuration and database files.
+          This directory will be created if it does not exist.
+        '';
+      };
+
+      # TODO: Get upstream to add an environment File option. Refer to https://github.com/NixOS/nixpkgs/pull/404871#issuecomment-2895663652 and https://github.com/mautrix/discord/issues/187
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          File containing environment variables to substitute when copying the configuration
+          out of Nix store to the `services.mautrix-discord.dataDir`.
+          Can be used for storing the secrets without making them available in the Nix store.
+          For example, you can set `services.mautrix-discord.settings.appservice.as_token = "$MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN"`
+          and then specify `MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN="{token}"` in the environment file.
+          This value will get substituted into the configuration file as a token.
+        '';
+      };
+
+      serviceUnit = lib.mkOption {
+        type = lib.types.str;
+        readOnly = true;
+        default = "mautrix-discord.service";
+        description = ''
+          The systemd unit (a service or a target) for other services to depend on if they
+          need to be started after matrix-synapse.
+          This option is useful as the actual parent unit for all matrix-synapse processes
+          changes when configuring workers.
+        '';
+      };
+
+      registrationServiceUnit = lib.mkOption {
+        type = lib.types.str;
+        readOnly = true;
+        default = "mautrix-discord-registration.service";
+        description = ''
+          The registration service that generates the registration file.
+          Systemd unit (a service or a target) for other services to depend on if they
+          need to be started after mautrix-discord registration service.
+          This option is useful as the actual parent unit for all matrix-synapse processes
+          changes when configuring workers.
+        '';
+      };
+
+      serviceDependencies = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default =
+          [ cfg.registrationServiceUnit ]
+          ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+          ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
+          ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
+
+        defaultText = ''
+          [ cfg.registrationServiceUnit ] ++
+          (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit) ++
+          (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service") ++
+          (lib.lists.optional config.services.dendrite.enable "dendrite.service");
+        '';
+        description = ''
+          List of Systemd services to require and wait for when starting the application service.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          cfg.settings.homeserver.domain or "" != "" && cfg.settings.homeserver.address or "" != "";
+        message = ''
+          The options with information about the homeserver:
+          `services.mautrix-discord.settings.homeserver.domain` and
+          `services.mautrix-discord.settings.homeserver.address` have to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.bridge.permissions or { } != { };
+        message = ''
+          The option `services.mautrix-discord.settings.bridge.permissions` has to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.appservice.id != "";
+        message = ''
+          The option `services.mautrix-discord.settings.appservice.id` has to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.appservice.bot.username != "";
+        message = ''
+          The option `services.mautrix-discord.settings.appservice.bot.username` has to be set.
+        '';
+      }
+    ];
+
+    users.users.mautrix-discord = {
+      isSystemUser = true;
+      group = "mautrix-discord";
+      extraGroups = [ "mautrix-discord-registration" ];
+      home = dataDir;
+      description = "Mautrix-Discord bridge user";
+    };
+
+    users.groups.mautrix-discord = { };
+    users.groups.mautrix-discord-registration = {
+      members = lib.lists.optional config.services.matrix-synapse.enable "matrix-synapse";
+    };
+
+    services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
+      settings.app_service_config_files = [ registrationFile ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 770 mautrix-discord mautrix-discord -"
+    ];
+
+    systemd.services = {
+      matrix-synapse = lib.mkIf cfg.registerToSynapse {
+        serviceConfig.SupplementaryGroups = [ "mautrix-discord-registration" ];
+        # Make synapse depend on the registration service when auto-registering
+        wants = [ "mautrix-discord-registration.service" ];
+        after = [ "mautrix-discord-registration.service" ];
+      };
+
+      mautrix-discord-registration = {
+        description = "Mautrix-Discord registration generation service";
+
+        wantedBy = lib.mkIf cfg.registerToSynapse [ "multi-user.target" ];
+        before = lib.mkIf cfg.registerToSynapse [ "matrix-synapse.service" ];
+
+        path = [
+          pkgs.yq
+          pkgs.envsubst
+          cfg.package
+        ];
+
+        script = ''
+          # substitute the settings file by environment variables
+          # in this case read from EnvironmentFile
+          rm -f '${settingsFile}'
+          old_umask=$(umask)
+          umask 0177
+          envsubst \
+            -o '${settingsFile}' \
+            -i '${settingsFileUnformatted}'
+          config_has_tokens=$(yq '.appservice | has("as_token") and has("hs_token")' '${settingsFile}')
+          registration_already_exists=$([[ -f '${registrationFile}' ]] && echo "true" || echo "false")
+          echo "There are tokens in the config: $config_has_tokens"
+          echo "Registration already existed: $registration_already_exists"
+          # tokens not configured from config/environment file, and registration file
+          # is already generated, override tokens in config to make sure they are not lost
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "true" ]]; then
+            echo "Copying as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # make sure --generate-registration does not affect config.yaml
+          cp '${settingsFile}' '${settingsFile}.tmp'
+          echo "Generating registration file"
+          mautrix-discord \
+            --generate-registration \
+            --config='${settingsFile}.tmp' \
+            --registration='${registrationFile}'
+          rm '${settingsFile}.tmp'
+          # no tokens configured, and new were just generated by generate registration for first time
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "false" ]]; then
+            echo "Copying newly generated as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # make sure --generate-registration does not affect config.yaml
+          cp '${settingsFile}' '${settingsFile}.tmp'
+          echo "Generating registration file"
+          mautrix-discord \
+            --generate-registration \
+            --config='${settingsFile}.tmp' \
+            --registration='${registrationFile}'
+          rm '${settingsFile}.tmp'
+          # no tokens configured, and new were just generated by generate registration for first time
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "false" ]]; then
+            echo "Copying newly generated as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # Make sure correct tokens are in the registration file
+          if [[ $config_has_tokens == "true" || $registration_already_exists == "true" ]]; then
+            echo "Copying as_token, hs_token from configuration to the registration file"
+            yq -sY '.[1].as_token = .[0].appservice.as_token
+              | .[1].hs_token = .[0].appservice.hs_token
+              | .[1]' '${settingsFile}' '${registrationFile}' \
+              > '${registrationFile}.tmp'
+            mv '${registrationFile}.tmp' '${registrationFile}'
+          fi
+          umask $old_umask
+          chown :mautrix-discord-registration '${registrationFile}'
+          chmod 640 '${registrationFile}'
+        '';
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          UMask = 27;
+
+          User = "mautrix-discord";
+          Group = "mautrix-discord";
+
+          SystemCallFilter = [ "@system-service" ];
+
+          ProtectSystem = "strict";
+          ProtectHome = true;
+
+          ReadWritePaths = [ dataDir ];
+          StateDirectory = "mautrix-discord";
+          EnvironmentFile = cfg.environmentFile;
+        };
+
+        restartTriggers = [ settingsFileUnformatted ];
+      };
+
+      mautrix-discord = {
+        description = "Mautrix-Discord, a Matrix-Discord puppeting/relaybot bridge";
+
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        path = [
+          pkgs.lottieconverter
+          pkgs.ffmpeg-headless
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = "mautrix-discord";
+          Group = "mautrix-discord";
+          PrivateUsers = true;
+          Restart = "on-failure";
+          RestartSec = 30;
+          WorkingDirectory = dataDir;
+          ExecStart = ''
+            ${lib.getExe cfg.package} \
+              --config='${settingsFile}'
+          '';
+          EnvironmentFile = cfg.environmentFile;
+
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+          LockPersonality = true;
+          ProtectKernelLogs = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = "@system-service";
+          ReadWritePaths = [ cfg.dataDir ];
+        };
+
+        restartTriggers = [ settingsFileUnformatted ];
+      };
+    };
+
+    meta = {
+      maintainers = with lib.maintainers; [
+        mistyttm
+      ];
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/seafile.nix b/nixos/modules/services/networking/seafile.nix
index ca8d41492e3d..8ae361b4d8be 100644
--- a/nixos/modules/services/networking/seafile.nix
+++ b/nixos/modules/services/networking/seafile.nix
@@ -84,7 +84,7 @@ in
       default = { };
       description = ''
         Configuration for ccnet, see
-        <https://manual.seafile.com/config/ccnet-conf/>
+        <https://manual.seafile.com/11.0/config/ccnet-conf/>
         for supported values.
       '';
     };
@@ -122,7 +122,7 @@ in
       default = { };
       description = ''
         Configuration for seafile-server, see
-        <https://manual.seafile.com/config/seafile-conf/>
+        <https://manual.seafile.com/11.0/config/seafile-conf/>
         for supported values.
       '';
     };
@@ -235,7 +235,7 @@ in
       type = types.lines;
       description = ''
         Extra config to append to `seahub_settings.py` file.
-        Refer to <https://manual.seafile.com/config/seahub_settings_py/>
+        Refer to <https://manual.seafile.com/11.0/config/seahub_settings_py/>
         for all available options.
       '';
     };
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index c56501c98a5f..7695231226bf 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -13,12 +13,12 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
-
 in
 {
   options = {
     services.opensnitch = {
       enable = lib.mkEnableOption "Opensnitch application firewall";
+      package = lib.mkPackageOption pkgs "opensnitch" { };
 
       rules = lib.mkOption {
         default = { };
@@ -192,13 +192,13 @@ in
     services.opensnitch.settings = lib.mapAttrs (_: v: lib.mkDefault v) (
       builtins.fromJSON (
         builtins.unsafeDiscardStringContext (
-          builtins.readFile "${pkgs.opensnitch}/etc/opensnitchd/default-config.json"
+          builtins.readFile "${cfg.package}/etc/opensnitchd/default-config.json"
         )
       )
     );
 
     systemd = {
-      packages = [ pkgs.opensnitch ];
+      packages = [ cfg.package ];
       services.opensnitchd = {
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
@@ -210,7 +210,7 @@ in
             in
             [
               ""
-              "${pkgs.opensnitch}/bin/opensnitchd --config-file ${format.generate "default-config.json" preparedSettings}"
+              "${cfg.package}/bin/opensnitchd --config-file ${format.generate "default-config.json" preparedSettings}"
             ];
         };
         preStart = lib.mkIf (cfg.rules != { }) (
@@ -245,7 +245,7 @@ in
       };
       tmpfiles.rules = [
         "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${pkgs.opensnitch}/etc/opensnitchd/system-fw.json"
+        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
       ];
     };
 
diff --git a/nixos/modules/services/system/nix-daemon.nix b/nixos/modules/services/system/nix-daemon.nix
index bc5bbcf06cf1..8a8b746e5544 100644
--- a/nixos/modules/services/system/nix-daemon.nix
+++ b/nixos/modules/services/system/nix-daemon.nix
@@ -230,6 +230,7 @@ in
         IOSchedulingPriority = cfg.daemonIOSchedPriority;
         LimitNOFILE = 1048576;
         Delegate = "yes";
+        DelegateSubgroup = "supervisor";
       };
 
       restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index a647b552678f..86b29e657cd6 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -46,6 +46,9 @@ let
     mkOption
     mkEnableOption
     ;
+
+  postgresqlPackage =
+    if cfg.database.enable then config.services.postgresql.package else pkgs.postgresql;
 in
 {
   options.services.immich = {
@@ -228,6 +231,11 @@ in
         assertion = !isPostgresUnixSocket -> cfg.secretsFile != null;
         message = "A secrets file containing at least the database password must be provided when unix sockets are not used.";
       }
+      {
+        # When removing this assertion, please adjust the nixosTests accordingly.
+        assertion = cfg.database.enable -> lib.versionOlder config.services.postgresql.package.version "17";
+        message = "Immich doesn't support PostgreSQL 17+, yet.";
+      }
     ];
 
     services.postgresql = mkIf cfg.database.enable {
@@ -265,7 +273,7 @@ in
       in
       [
         ''
-          ${lib.getExe' config.services.postgresql.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
+          ${lib.getExe' postgresqlPackage "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
         ''
       ];
 
@@ -333,7 +341,7 @@ in
       path = [
         # gzip and pg_dumpall are used by the backup service
         pkgs.gzip
-        config.services.postgresql.package
+        postgresqlPackage
       ];
 
       serviceConfig = commonServiceConfig // {
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 355cc8154d75..2f870af477ea 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -95,6 +95,7 @@ let
         ++ optional cfg.caching.apcu apcu
         ++ optional cfg.caching.redis redis
         ++ optional cfg.caching.memcached memcached
+        ++ optional (cfg.settings.log_type == "systemd") systemd
       )
       ++ cfg.phpExtraExtensions all; # Enabled by user
     extraConfig = toKeyValue cfg.phpOptions;
@@ -859,7 +860,7 @@ in
             default = "syslog";
             description = ''
               Logging backend to use.
-              systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
+              systemd automatically adds the php-systemd extensions to services.nextcloud.phpExtraExtensions.
               See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
             '';
           };
diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix
index a2e181882bc6..1f1a595f8700 100644
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@@ -18,7 +18,10 @@ let
     '';
 in
 {
-  meta.maintainers = [ maintainers.bachp ];
+  meta.maintainers = with maintainers; [
+    bachp
+    ryan4yin
+  ];
 
   options.services.minio = {
     enable = mkEnableOption "Minio Object Storage";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 60d118cba38f..c6926aaeb901 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -543,7 +543,14 @@ in
   mimir = runTest ./mimir.nix;
   galene = discoverTests (import ./galene.nix);
   gancio = runTest ./gancio.nix;
-  garage = handleTest ./garage { };
+  garage_1 = import ./garage {
+    inherit runTest;
+    package = pkgs.garage_1;
+  };
+  garage_2 = import ./garage {
+    inherit runTest;
+    package = pkgs.garage_2;
+  };
   gatus = runTest ./gatus.nix;
   getaddrinfo = runTest ./getaddrinfo.nix;
   gemstash = handleTest ./gemstash.nix { };
@@ -810,6 +817,7 @@ in
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
   matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
+  mautrix-discord = runTest ./matrix/mautrix-discord.nix;
   mattermost = handleTest ./mattermost { };
   mautrix-meta-postgres = runTest ./matrix/mautrix-meta-postgres.nix;
   mautrix-meta-sqlite = runTest ./matrix/mautrix-meta-sqlite.nix;
diff --git a/nixos/tests/alps.nix b/nixos/tests/alps.nix
index fd4ee51e6e20..0ea9ea46e5ac 100644
--- a/nixos/tests/alps.nix
+++ b/nixos/tests/alps.nix
@@ -28,8 +28,10 @@ in
         enableSubmission = true;
         enableSubmissions = true;
         tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
       };
       services.dovecot2 = {
         enable = true;
diff --git a/nixos/tests/croc.nix b/nixos/tests/croc.nix
index 296d12c4ebe6..f5eec96d6cc3 100644
--- a/nixos/tests/croc.nix
+++ b/nixos/tests/croc.nix
@@ -13,6 +13,7 @@ in
     maintainers = [
       equirosa
       SuperSandro2000
+      ryan4yin
     ];
   };
 
diff --git a/nixos/tests/garage/basic.nix b/nixos/tests/garage/basic.nix
index c6264d2cbc9f..5c0d1794a12f 100644
--- a/nixos/tests/garage/basic.nix
+++ b/nixos/tests/garage/basic.nix
@@ -1,106 +1,40 @@
-args@{ mkNode, ver, ... }:
-(import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "garage-basic";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+{
+  lib,
+  mkNode,
+  package,
+  testScriptSetup,
+  ...
+}:
+{
+  name = "garage-basic";
+
+  nodes = {
+    single_node = mkNode {
+      extraSettings =
+        if (lib.versionAtLeast package.version "2") then
+          {
+            replication_factor = 1;
+            consistency_mode = "consistent";
+          }
+        else
+          {
+            replication_mode = "none";
+          };
     };
+  };
 
-    nodes = {
-      single_node = mkNode { replicationMode = "none"; };
-    };
-
-    testScript = ''
-      from typing import List
-      from dataclasses import dataclass
-      import re
-
-      start_all()
-
-      cur_version_regex = re.compile('Current cluster layout version: (?P<ver>\d*)')
-      key_creation_regex = re.compile('Key name: (?P<key_name>.*)\nKey ID: (?P<key_id>.*)\nSecret key: (?P<secret_key>.*)')
-
-      @dataclass
-      class S3Key:
-         key_name: str
-         key_id: str
-         secret_key: str
-
-      @dataclass
-      class GarageNode:
-         node_id: str
-         host: str
-
-      def get_node_fqn(machine: Machine) -> GarageNode:
-        node_id, host = machine.succeed("garage node id").split('@')
-        return GarageNode(node_id=node_id, host=host)
-
-      def get_node_id(machine: Machine) -> str:
-        return get_node_fqn(machine).node_id
-
-      def get_layout_version(machine: Machine) -> int:
-        version_data = machine.succeed("garage layout show")
-        m = cur_version_regex.search(version_data)
-        if m and m.group('ver') is not None:
-          return int(m.group('ver')) + 1
-        else:
-          raise ValueError('Cannot find current layout version')
-
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
-         for layout in layouts:
-            machine.succeed(f"garage layout assign {layout}")
-         version = get_layout_version(machine)
-         machine.succeed(f"garage layout apply --version {version}")
-
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
-         output = machine.succeed(f"garage key ${
-           if ver == "0_8" then "new --name" else "create"
-         } {key_name}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_id') or not m.group('secret_key'):
-            raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=key_name, key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
-         output = machine.succeed(f"garage key info {key_pattern}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_name') or not m.group('key_id') or not m.group('secret_key'):
-             raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=m.group('key_name'), key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def test_bucket_writes(node):
-        node.succeed("garage bucket create test-bucket")
-        s3_key = create_api_key(node, "test-api-key")
-        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
-        other_s3_key = get_api_key(node, 'test-api-key')
-        assert other_s3_key.secret_key == other_s3_key.secret_key
-        node.succeed(
-          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
-        )
-        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
-        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
-
-      def test_bucket_over_http(node, bucket='test-bucket', url=None):
-        if url is None:
-           url = f"{bucket}.web.garage"
-
-        node.succeed(f'garage bucket website --allow {bucket}')
-        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
-        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+  testScript = # python
+    ''
+      ${testScriptSetup}
 
       with subtest("Garage works as a single-node S3 storage"):
         single_node.wait_for_unit("garage.service")
         single_node.wait_for_open_port(3900)
         # Now Garage is initialized.
         single_node_id = get_node_id(single_node)
-        apply_garage_layout(single_node, [f'-z qemutest -c ${
-          if ver == "0_8" then "1" else "1G"
-        } "{single_node_id}"'])
+        apply_garage_layout(single_node, [f'-z qemutest -c 1G "{single_node_id}"'])
         # Now Garage is operational.
         test_bucket_writes(single_node)
         test_bucket_over_http(single_node)
     '';
-  }
-))
-  args
+}
diff --git a/nixos/tests/garage/common.nix b/nixos/tests/garage/common.nix
new file mode 100644
index 000000000000..c8392eee6dba
--- /dev/null
+++ b/nixos/tests/garage/common.nix
@@ -0,0 +1,85 @@
+{ ... }:
+{
+  _module.args.testScriptSetup = # python
+    ''
+      from typing import List
+      from dataclasses import dataclass
+      import re
+
+      start_all()
+
+      cur_version_regex = re.compile(r'Current cluster layout version: (?P<ver>\d*)')
+
+      @dataclass
+      class S3Key:
+         key_name: str
+         key_id: str
+         secret_key: str
+
+      @dataclass
+      class GarageNode:
+         node_id: str
+         host: str
+
+      def get_node_fqn(machine: Machine) -> GarageNode:
+        node_id, host = machine.succeed("garage node id").split('@')
+        return GarageNode(node_id=node_id, host=host)
+
+      def get_node_id(machine: Machine) -> str:
+        return get_node_fqn(machine).node_id
+
+      def get_layout_version(machine: Machine) -> int:
+        version_data = machine.succeed("garage layout show")
+        m = cur_version_regex.search(version_data)
+        if m and m.group('ver') is not None:
+          return int(m.group('ver')) + 1
+        else:
+          raise ValueError('Cannot find current layout version')
+
+      def apply_garage_layout(machine: Machine, layouts: List[str]):
+         for layout in layouts:
+            machine.succeed(f"garage layout assign {layout}")
+         version = get_layout_version(machine)
+         machine.succeed(f"garage layout apply --version {version}")
+
+      def create_api_key(machine: Machine, key_name: str) -> S3Key:
+         output = machine.succeed(f"garage key create {key_name}")
+         return parse_api_key_data(output)
+
+      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
+         output = machine.succeed(f"garage key info {key_pattern}")
+         return parse_api_key_data(output)
+
+      def parse_api_key_data(text) -> S3Key:
+        key_creation_regex = re.compile(r'Key name: \s*(?P<key_name>.*)|' r'Key ID: \s*(?P<key_id>.*)|' r'Secret key: \s*(?P<secret_key>.*)', re.IGNORECASE)
+        fields = {}
+        for match in key_creation_regex.finditer(text):
+          for key, value in match.groupdict().items():
+            if value:
+              fields[key] = value.strip()
+        try:
+          return S3Key(**fields)
+        except TypeError as e:
+          raise ValueError(f"Cannot parse API key data. Missing required field(s): {e}")
+
+      def test_bucket_writes(node):
+        node.succeed("garage bucket create test-bucket")
+        s3_key = create_api_key(node, "test-api-key")
+        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
+        other_s3_key = get_api_key(node, 'test-api-key')
+        assert other_s3_key.secret_key == other_s3_key.secret_key
+        node.succeed(
+          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
+        )
+        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
+        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
+
+      def test_bucket_over_http(node, bucket='test-bucket', url=None):
+        if url is None:
+           url = f"{bucket}.web.garage"
+
+        node.succeed(f'garage bucket website --allow {bucket}')
+        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
+        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+    '';
+}
diff --git a/nixos/tests/garage/default.nix b/nixos/tests/garage/default.nix
index cd2824d26ecd..93f721abe241 100644
--- a/nixos/tests/garage/default.nix
+++ b/nixos/tests/garage/default.nix
@@ -1,16 +1,12 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  package,
 }:
-with pkgs.lib;
-
 let
   mkNode =
-    package:
     {
-      replicationMode,
       publicV6Address ? "::1",
+      extraSettings ? { },
     }:
     { pkgs, ... }:
     {
@@ -30,8 +26,6 @@ let
         enable = true;
         inherit package;
         settings = {
-          replication_mode = replicationMode;
-
           rpc_bind_addr = "[::]:3901";
           rpc_public_addr = "[${publicV6Address}]:3901";
           rpc_secret = "5c1915fa04d0b6739675c61bf5907eb0fe3d9c69850c83820f51b4d25d13868c";
@@ -47,7 +41,7 @@ let
             root_domain = ".web.garage";
             index = "index.html";
           };
-        };
+        } // extraSettings;
       };
       environment.systemPackages = [ pkgs.minio-client ];
 
@@ -55,24 +49,24 @@ let
       virtualisation.diskSize = 2 * 1024;
     };
 in
-foldl
-  (
-    matrix: ver:
-    matrix
-    // {
-      "basic${toString ver}" = import ./basic.nix {
-        inherit system pkgs ver;
-        mkNode = mkNode pkgs."garage_${ver}";
-      };
-      "with-3node-replication${toString ver}" = import ./with-3node-replication.nix {
-        inherit system pkgs ver;
-        mkNode = mkNode pkgs."garage_${ver}";
-      };
-    }
-  )
-  { }
-  [
-    "0_8"
-    "0_9"
-    "1_x"
-  ]
+{
+  basic = runTest {
+    imports = [
+      ./common.nix
+      ./basic.nix
+    ];
+    _module.args = {
+      inherit mkNode package;
+    };
+  };
+
+  with-3node-replication = runTest {
+    imports = [
+      ./common.nix
+      ./with-3node-replication.nix
+    ];
+    _module.args = {
+      inherit mkNode package;
+    };
+  };
+}
diff --git a/nixos/tests/garage/with-3node-replication.nix b/nixos/tests/garage/with-3node-replication.nix
index a2f4189603b0..884ef780a4d5 100644
--- a/nixos/tests/garage/with-3node-replication.nix
+++ b/nixos/tests/garage/with-3node-replication.nix
@@ -1,107 +1,47 @@
-args@{ mkNode, ver, ... }:
-(import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "garage-3node-replication";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+{
+  lib,
+  mkNode,
+  package,
+  testScriptSetup,
+  ...
+}:
+let
+  extraSettings =
+    if (lib.versionAtLeast package.version "2") then
+      {
+        replication_factor = 3;
+        consistency_mode = "consistent";
+      }
+    else
+      {
+        replication_mode = "3";
+      };
+in
+{
+  name = "garage-3node-replication";
+
+  nodes = {
+    node1 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::1";
     };
-
-    nodes = {
-      node1 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::1";
-      };
-      node2 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::2";
-      };
-      node3 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::3";
-      };
-      node4 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::4";
-      };
+    node2 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::2";
     };
+    node3 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::3";
+    };
+    node4 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::4";
+    };
+  };
 
-    testScript = ''
-      from typing import List
-      from dataclasses import dataclass
-      import re
-      start_all()
-
-      cur_version_regex = re.compile('Current cluster layout version: (?P<ver>\d*)')
-      key_creation_regex = re.compile('Key name: (?P<key_name>.*)\nKey ID: (?P<key_id>.*)\nSecret key: (?P<secret_key>.*)')
-
-      @dataclass
-      class S3Key:
-         key_name: str
-         key_id: str
-         secret_key: str
-
-      @dataclass
-      class GarageNode:
-         node_id: str
-         host: str
-
-      def get_node_fqn(machine: Machine) -> GarageNode:
-        node_id, host = machine.succeed("garage node id").split('@')
-        return GarageNode(node_id=node_id, host=host)
-
-      def get_node_id(machine: Machine) -> str:
-        return get_node_fqn(machine).node_id
-
-      def get_layout_version(machine: Machine) -> int:
-        version_data = machine.succeed("garage layout show")
-        m = cur_version_regex.search(version_data)
-        if m and m.group('ver') is not None:
-          return int(m.group('ver')) + 1
-        else:
-          raise ValueError('Cannot find current layout version')
-
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
-         for layout in layouts:
-            machine.succeed(f"garage layout assign {layout}")
-         version = get_layout_version(machine)
-         machine.succeed(f"garage layout apply --version {version}")
-
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
-         output = machine.succeed(f"garage key ${
-           if ver == "0_8" then "new --name" else "create"
-         } {key_name}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_id') or not m.group('secret_key'):
-            raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=key_name, key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
-         output = machine.succeed(f"garage key info {key_pattern}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_name') or not m.group('key_id') or not m.group('secret_key'):
-             raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=m.group('key_name'), key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def test_bucket_writes(node):
-        node.succeed("garage bucket create test-bucket")
-        s3_key = create_api_key(node, "test-api-key")
-        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
-        other_s3_key = get_api_key(node, 'test-api-key')
-        assert other_s3_key.secret_key == other_s3_key.secret_key
-        node.succeed(
-          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
-        )
-        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
-        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
-
-      def test_bucket_over_http(node, bucket='test-bucket', url=None):
-        if url is None:
-           url = f"{bucket}.web.garage"
-
-        node.succeed(f'garage bucket website --allow {bucket}')
-        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
-        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+  testScript = # python
+    ''
+      ${testScriptSetup}
 
       with subtest("Garage works as a multi-node S3 storage"):
         nodes = ('node1', 'node2', 'node3', 'node4')
@@ -125,7 +65,7 @@ args@{ mkNode, ver, ... }:
         zones = ["nixcon", "nixcon", "paris_meetup", "fosdem"]
         apply_garage_layout(node1,
         [
-          f'{ndata.node_id} -z {zones[index]} -c ${if ver == "0_8" then "1" else "1G"}'
+          f'{ndata.node_id} -z {zones[index]} -c 1G'
           for index, ndata in enumerate(node_ids.values())
         ])
         # Now Garage is operational.
@@ -133,6 +73,4 @@ args@{ mkNode, ver, ... }:
         for node in nodes:
            test_bucket_over_http(get_machine(node))
     '';
-  }
-))
-  args
+}
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 56f1b4f19bfb..166eb32090c6 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -722,6 +722,10 @@ let
                   libxml2.bin
                   libxslt.bin
                   nixos-artwork.wallpapers.simple-dark-gray-bottom
+                  (nixos-rebuild-ng.override {
+                    withNgSuffix = false;
+                    withReexec = true;
+                  })
                   ntp
                   perlPackages.ConfigIniFiles
                   perlPackages.FileSlurp
@@ -1110,7 +1114,7 @@ in
   simple = makeInstallerTest "simple" (
     simple-test-config
     // {
-      passthru.override = args: makeInstallerTest "simple" simple-test-config // args;
+      passthru.override = args: makeInstallerTest "simple" (simple-test-config // args);
     }
   );
 
diff --git a/nixos/tests/matrix/mautrix-discord.nix b/nixos/tests/matrix/mautrix-discord.nix
new file mode 100644
index 000000000000..ebb296416fa1
--- /dev/null
+++ b/nixos/tests/matrix/mautrix-discord.nix
@@ -0,0 +1,168 @@
+{ pkgs, ... }:
+let
+  homeserverUrl = "http://homeserver:8008";
+in
+{
+  name = "mautrix-discord";
+  meta.maintainers = pkgs.mautrix-discord.meta.maintainers;
+
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            server_name = "homeserver";
+            database.name = "sqlite3";
+
+            enable_registration = true;
+            # don't use this in production, always use some form of verification
+            enable_registration_without_verification = true;
+
+            listeners = [
+              {
+                bind_addresses = [ "0.0.0.0" ];
+                port = 8008;
+                resources = [
+                  {
+                    "compress" = true;
+                    "names" = [ "client" ];
+                  }
+                  {
+                    "compress" = false;
+                    "names" = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+              }
+            ];
+          };
+        };
+
+        services.mautrix-discord = {
+          enable = true;
+          registerToSynapse = true; # Enable automatic registration
+
+          settings = {
+            homeserver = {
+              address = homeserverUrl;
+              domain = "homeserver";
+            };
+
+            appservice = {
+              address = "http://homeserver:8009";
+              port = 8009;
+              id = "discord";
+              bot = {
+                username = "discordbot";
+                displayname = "Discord bridge bot";
+                avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+              };
+              # These will be generated automatically
+              as_token = "generate";
+              hs_token = "generate";
+
+              database = {
+                type = "sqlite3";
+                uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
+              };
+            };
+
+            bridge = {
+              permissions = {
+                "@alice:homeserver" = "user";
+                "*" = "relay";
+              };
+            };
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          8008
+          8009
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test"
+            {
+              libraries = [ pkgs.python3Packages.matrix-nio ];
+              flakeIgnore = [
+                "F401" # imported but unused
+                "E302" # expected 2 blank lines
+              ];
+            }
+            ''
+              import sys
+              import asyncio
+              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse
+
+
+              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+                  print(f"Received message: {msg}")
+
+
+              async def run(homeserver: str):
+                  client = AsyncClient(homeserver, "@test:homeserver")
+
+                  # Register a new user
+                  response = await client.register("test", "password123")
+                  if not response.transport_response.ok:
+                      print(f"Failed to register: {response}")
+                      return False
+
+                  # Login
+                  response = await client.login("password123")
+                  if not response.transport_response.ok:
+                      print(f"Failed to login: {response}")
+                      return False
+
+                  print("Successfully logged in and basic functionality works")
+                  await client.close()
+                  return True
+
+
+              if __name__ == "__main__":
+                  if len(sys.argv) != 2:
+                      print("Usage: do_test <homeserver_url>")
+                      sys.exit(1)
+
+                  homeserver_url = sys.argv[1]
+                  success = asyncio.run(run(homeserver_url))
+                  sys.exit(0 if success else 1)
+            ''
+          )
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("wait for homeserver and bridge to be ready"):
+        homeserver.wait_for_unit("matrix-synapse.service")
+        homeserver.wait_for_open_port(8008)
+        homeserver.wait_for_unit("mautrix-discord.service")
+        homeserver.wait_for_open_port(8009)
+
+    with subtest("verify registration file was created"):
+        homeserver.wait_until_succeeds("test -f /var/lib/mautrix-discord/discord-registration.yaml")
+        homeserver.succeed("ls -la /var/lib/mautrix-discord/")
+
+    with subtest("verify bridge connects to homeserver"):
+        # Give the bridge a moment to connect
+        homeserver.sleep(5)
+
+        # Check that the bridge is running and listening
+        homeserver.succeed("systemctl is-active mautrix-discord.service")
+        homeserver.succeed("netstat -tlnp | grep :8009")
+
+    with subtest("test basic matrix functionality"):
+        client.succeed("do_test ${homeserverUrl} >&2")
+  '';
+}
diff --git a/nixos/tests/matrix/synapse.nix b/nixos/tests/matrix/synapse.nix
index 4b9ade875a78..296480548718 100644
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@@ -200,13 +200,7 @@ in
 
             # disable obsolete protocols, something old versions of twisted are still using
             smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
             smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_chain_files = [
-              "${mailerCerts.${mailerDomain}.key}"
-              "${mailerCerts.${mailerDomain}.cert}"
-            ];
             smtpd_tls_chain_files = [
               "${mailerCerts.${mailerDomain}.key}"
               "${mailerCerts.${mailerDomain}.cert}"
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index baef07aec993..bf3a74e6330d 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -48,7 +48,10 @@ in
 {
   name = "minio";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ bachp ];
+    maintainers = [
+      bachp
+      ryan4yin
+    ];
   };
 
   nodes = {
diff --git a/nixos/tests/schleuder.nix b/nixos/tests/schleuder.nix
index 05e22de056bd..2dab607cbd2f 100644
--- a/nixos/tests/schleuder.nix
+++ b/nixos/tests/schleuder.nix
@@ -12,8 +12,10 @@ import ./make-test-python.nix {
         enable = true;
         enableSubmission = true;
         tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
         inherit domain;
         destination = [ domain ];
         localRecipients = [
diff --git a/nixos/tests/web-apps/immich-public-proxy.nix b/nixos/tests/web-apps/immich-public-proxy.nix
index f711e56abb48..1516156223ce 100644
--- a/nixos/tests/web-apps/immich-public-proxy.nix
+++ b/nixos/tests/web-apps/immich-public-proxy.nix
@@ -30,6 +30,9 @@
         port = 8002;
         settings.ipp.responseHeaders."X-NixOS" = "Rules";
       };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
     };
 
   testScript = ''
diff --git a/nixos/tests/web-apps/immich.nix b/nixos/tests/web-apps/immich.nix
index 550a1630bda8..d716e50b8906 100644
--- a/nixos/tests/web-apps/immich.nix
+++ b/nixos/tests/web-apps/immich.nix
@@ -18,6 +18,9 @@
         enable = true;
         environment.IMMICH_LOG_LEVEL = "verbose";
       };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
     };
 
   testScript = ''
diff --git a/pkgs/README.md b/pkgs/README.md
index 0442822765b9..edf3d9e3a63e 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -521,6 +521,8 @@ When using the `patches` parameter to `mkDerivation`, make sure the patch name c
 >
 > See [Versioning](#versioning) for details on package versioning.
 
+The following describes two ways to include the patch. Regardless of how the patch is included, you _must_ ensure its purpose is clear and obvious. This enables other maintainers to more easily determine when old patches are no longer required. Typically, you can improve clarity with carefully considered filenames, attribute names, and/or comments; these should explain the patch's _intention_. Additionally, it may sometimes be helpful to clarify _how_ it resolves the issue. For example: _"fix gcc14 build by adding missing include"_.
+
 ### Fetching patches
 
 In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch2`:
diff --git a/pkgs/applications/audio/qpwgraph/default.nix b/pkgs/applications/audio/qpwgraph/default.nix
index 31295e4d3071..6a41d5c38731 100644
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6aJymZjuUMezEbOosveXyiY7y+XgGk3E8Dd4tb8UyrU=";
+    sha256 = "sha256-VvOdorj+CpFSI+iyVeMR0enXGO5mLPE8KiaHGuG/KDQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index 0d0fbae5b09a..9312df83e6cd 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.25-unstable-2025-06-20";
+  version = "0.0.25-unstable-2025-06-21";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "060c0de2aa2ef7c9e6e100f3bd8ef92c085d0555";
-    hash = "sha256-g5GVTRy1RiNNYrVIQbHxOu1ihxlQk/kww3DEKJ6hF9Q=";
+    rev = "86743a1d7d6232a820709986e971b3c1de62d9a7";
+    hash = "sha256-7lLnC/tcl5yVM6zBIk41oJ3jhRTv8AqXwJdXF2yPjwk=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
index 45cc5167fcfd..db0048e558a3 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
@@ -8,19 +8,19 @@
   gitMinimal,
 }:
 let
-  version = "1.3.1";
+  version = "1.4.1";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-ZMq7zXXP3QL73zNfgDNi7xipmrbNwBoFPzK4K0dr6Zs=";
+    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-IDoDugtNWQovfSstbVMkKHLBXKa06lxRWmywu4zyS3M=";
+    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";
 
     nativeBuildInputs = [ gitMinimal ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 963b48977134..49a10e854436 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2451,8 +2451,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.53";
-          hash = "sha256-6yhyGMX1U9clMNkcQRjNfa+HpLvWVI1WvhTUyn4g3ZY=";
+          version = "1.1.54";
+          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index 15f7912ff725..da533b10b780 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-1mBzimFM/ntjL/d0YkoCds5MtXKwB52jzcHEWpx3Ggo=";
+    hash = "sha256-QhME94U4iVUSXGLlGqM+X8WbnnxGIVeKKJYEWWAMztg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index b497f3d0d18d..96397f706a3e 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-06-06";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "8f033723a1b3437c8e3c8b42a92331eebe53ed0b";
-    hash = "sha256-RrWBN8RDAS7RcIOouU3x2Pv/RKrshrmmmCZCeXQ6upk=";
+    rev = "449d256995de36de0629dd1b97f4d67a0e50c92e";
+    hash = "sha256-7+Dn7+AUnd3+eEKRMuahaxiEMWTT1uUEP2y0ZgIs81Q=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index 740d4758a4bc..9ee731557d98 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "def3a7c0e413ef35a7d9d4430e5c9c9a5698b4fe";
-    hash = "sha256-MCLPReWzW+NsEVtt4ySplLzGKGAaNXgDtoPYJC2yY3I=";
+    rev = "e1b0d20b66441c0ff220abbb1da8e6a911b9a761";
+    hash = "sha256-pvzLI3G6046W11x8Sfev6W5tGYn8/d2EnmIQc99aHN4=";
   };
 
   meta = {
diff --git a/pkgs/applications/graphics/veusz/default.nix b/pkgs/applications/graphics/veusz/default.nix
index 1974466317f8..47c4498f3ed0 100644
--- a/pkgs/applications/graphics/veusz/default.nix
+++ b/pkgs/applications/graphics/veusz/default.nix
@@ -2,25 +2,28 @@
   lib,
   python3Packages,
   fetchPypi,
-  libsForQt5,
+  qt6,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "veusz";
-  version = "3.6.2";
+  version = "4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "whcaxF5LMEJNj8NSYeLpnb5uJboRl+vCQ1WxBrJjldE=";
+    hash = "sha256-s7TaDnt+nEIAmAqiZf9aYPFWVtSX22Ruz8eMpxMRr0U=";
   };
 
   nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
     python3Packages.sip
     python3Packages.tomli
+    qt6.qmake
+    qt6.wrapQtAppsHook
   ];
 
-  buildInputs = [ libsForQt5.qtbase ];
+  dontUseQmakeConfigure = true;
+
+  buildInputs = [ qt6.qtbase ];
 
   # veusz is a script and not an ELF-executable, so wrapQtAppsHook will not wrap
   # it automatically -> we have to do it explicitly
@@ -33,7 +36,7 @@ python3Packages.buildPythonApplication rec {
   # really have a corresponding path, so patching the location of PyQt5 inplace
   postPatch = ''
     substituteInPlace pyqt_setuptools.py \
-      --replace "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
+      --replace-fail "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
     patchShebangs tests/runselftest.py
   '';
 
@@ -45,9 +48,9 @@ python3Packages.buildPythonApplication rec {
     "--qt-libinfix="
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     numpy
-    pyqt5
+    pyqt6
     # optional requirements:
     dbus-python
     h5py
@@ -56,16 +59,20 @@ python3Packages.buildPythonApplication rec {
   ];
 
   installCheckPhase = ''
+    runHook preInstallCheck
+
     wrapQtApp "tests/runselftest.py"
     QT_QPA_PLATFORM=minimal tests/runselftest.py
+
+    runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Scientific plotting and graphing program with a GUI";
     mainProgram = "veusz";
     homepage = "https://veusz.github.io/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ laikq ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ laikq ];
   };
 }
diff --git a/pkgs/applications/misc/krename/default.nix b/pkgs/applications/misc/krename/default.nix
index 58e81790e683..fd385e7eddfe 100644
--- a/pkgs/applications/misc/krename/default.nix
+++ b/pkgs/applications/misc/krename/default.nix
@@ -11,7 +11,7 @@
   kjsembed,
   taglib,
   exiv2,
-  podofo,
+  podofo_0_9,
   kcrash,
 }:
 
@@ -39,7 +39,7 @@ mkDerivation rec {
   buildInputs = [
     taglib
     exiv2
-    podofo
+    podofo_0_9
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/maliit-framework/default.nix b/pkgs/applications/misc/maliit-framework/default.nix
index 8d14bf2bdf0e..7480e3fd371d 100644
--- a/pkgs/applications/misc/maliit-framework/default.nix
+++ b/pkgs/applications/misc/maliit-framework/default.nix
@@ -26,25 +26,17 @@
   wayland-scanner,
 }:
 
-mkDerivation rec {
+mkDerivation {
   pname = "maliit-framework";
-  version = "2.3.0";
+  version = "2.3.0-unstable-2024-06-24";
 
   src = fetchFromGitHub {
     owner = "maliit";
     repo = "framework";
-    tag = version;
-    sha256 = "sha256-q+hiupwlA0PfG+xtomCUp2zv6HQrGgmOd9CU193ucrY=";
+    rev = "ba6f7eda338a913f2c339eada3f0382e04f7dd67";
+    hash = "sha256-iwWLnstQMG8F6uE5rKF6t2X43sXQuR/rIho2RN/D9jE=";
   };
 
-  patches = [
-    # FIXME: backport GCC 12 build fix, remove for next release
-    (fetchpatch {
-      url = "https://github.com/maliit/framework/commit/86e55980e3025678882cb9c4c78614f86cdc1f04.diff";
-      hash = "sha256-5R+sCI05vJX5epu6hcDSWWzlZ8ns1wKEJ+u8xC6d8Xo=";
-    })
-  ];
-
   buildInputs = [
     at-spi2-atk
     at-spi2-core
diff --git a/pkgs/applications/misc/maliit-keyboard/default.nix b/pkgs/applications/misc/maliit-keyboard/default.nix
index d3522e47e16a..7a470d8281f2 100644
--- a/pkgs/applications/misc/maliit-keyboard/default.nix
+++ b/pkgs/applications/misc/maliit-keyboard/default.nix
@@ -8,7 +8,6 @@
   libchewing,
   libpinyin,
   maliit-framework,
-  presage,
   qtfeedback,
   qtmultimedia,
   qtquickcontrols2,
@@ -19,15 +18,15 @@
   wrapGAppsHook3,
 }:
 
-mkDerivation rec {
+mkDerivation {
   pname = "maliit-keyboard";
-  version = "2.3.1";
+  version = "2.3.1-unstable-2024-09-04";
 
   src = fetchFromGitHub {
     owner = "maliit";
     repo = "keyboard";
-    rev = version;
-    sha256 = "sha256-XH3sKQuNMLgJi2aV+bnU2cflwkFIw4RYVfxzQiejCT0=";
+    rev = "cbb0bbfa67354df76c25dbc3b1ea99a376fd15bb";
+    sha256 = "sha256-6ITlV/RJkPDrnsFyeWYWaRTYTaY6NAbHDqpUZGGKyi4=";
   };
 
   postPatch = ''
@@ -41,7 +40,6 @@ mkDerivation rec {
     libchewing
     libpinyin
     maliit-framework
-    presage
     qtfeedback
     qtmultimedia
     qtquickcontrols2
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 88a228dfcf65..a64a3377b48d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -363,11 +363,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-uAke0Zds4MERYXz+Ie0pefoVY9HDQ1ewOAU/As03V6g=",
+    "hash": "sha256-XUwHBwxkOG4oK0W1IcvIWgov3AShMmeYPoc0gu6YEwY=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.55.0",
+    "rev": "v2.57.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -489,13 +489,13 @@
     "vendorHash": "sha256-EiTWJ4bw8IwsRTD9Lt28Up2DXH0oVneO2IaO8VqWtkw="
   },
   "gitea": {
-    "hash": "sha256-pbh3ADR77iVwHQ3e7krSUU+rNfhdA8zYnxLbTdnRfaU=",
+    "hash": "sha256-A9jwUtLNT5ikB5iR5qaRHBiTXsmwvJXycpFxciZSeZg=",
     "homepage": "https://registry.terraform.io/providers/go-gitea/gitea",
     "owner": "go-gitea",
     "repo": "terraform-provider-gitea",
-    "rev": "v0.6.0",
+    "rev": "v0.7.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-d8XoZzo2XS/wAPvdODAfK31qT1c+EoTbWlzzgYPiwq4="
+    "vendorHash": "sha256-/8h2bmesnFz3tav3+iDelZSjp1Z9lreexwcw0WdYekA="
   },
   "github": {
     "hash": "sha256-rmIoyGlkw2f56UwD0mfI5MiHPDFDuhtsoPmerIrJcGs=",
@@ -516,11 +516,11 @@
     "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
   },
   "google": {
-    "hash": "sha256-HtPhwWobRBB89embUxtUwUabKmtQkeWtR0QEyb4iBYM=",
+    "hash": "sha256-i3gKrK5EcIQbVwJI7sfRam3H0mideGO1VgPuzL4l+Xw=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.39.0",
+    "rev": "v6.40.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
   },
@@ -831,13 +831,13 @@
     "vendorHash": "sha256-ryAkyS70J4yZIsTLSXfeIX+bRsh+8XnOUliMJnMhMrU="
   },
   "minio": {
-    "hash": "sha256-loUcdsr5zFoOXIu0CLYKvutIVLYG0+DsuwPCxAeVMF8=",
+    "hash": "sha256-Eo9lps73bvyJIpRWRCQYz+Ck7IMk4nfK2jismILnaKo=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.5.2",
+    "rev": "v3.5.3",
     "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
+    "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
   },
   "mongodbatlas": {
     "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
@@ -894,13 +894,13 @@
     "vendorHash": "sha256-U8eA/9og4LIedhPSEN9SyInLQuJSzvm0AeFhzC3oqyQ="
   },
   "ns1": {
-    "hash": "sha256-fR64hIM14Bc+7xn7lPfsfZnGew7bd1TAkORwwL6NBsw=",
+    "hash": "sha256-fRF2UsVpIWg0UGPAePEULxAjKi1TioYEeOeSxUuhvIc=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.6.4",
+    "rev": "v2.6.5",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YfbhYhFMdGYQlijaYoAdJFmsjric4Oi4no+sBCq5d6g="
+    "vendorHash": "sha256-9J8RrnF9k503YLmg5rBA8u8SqldhB5AF4+PVtUy8wX8="
   },
   "null": {
     "hash": "sha256-hPAcFWkeK1vjl1Cg/d7FaZpPhyU3pkU6VBIwxX2gEvA=",
@@ -1012,11 +1012,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-nCd2EQgLR1PNPBnWPSpRGxd3zwQ7dJy8fb3tWgGnbRc=",
+    "hash": "sha256-pU6IUnruM2Pi3nbRJpQ5Y8HuqFixRs8DTmTOxToVgWY=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.26.0",
+    "rev": "v3.26.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1111,11 +1111,11 @@
     "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
   },
   "rootly": {
-    "hash": "sha256-dnFQVvqvwu2K7Y5NEqwPrGiHKSOKQ4QKW8VSjarbij4=",
+    "hash": "sha256-wJ65YKJnFT1l9DkqtuvA9cwkt06OTCYYu9FolU5UosQ=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v3.0.0",
+    "rev": "v3.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-EZbYkyeQdroVJj3a7T7MICU4MSimB+ZqI2Yg9PNUcV0="
   },
@@ -1336,13 +1336,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
+    "hash": "sha256-8QYTVM9vxWg4jKlm7bUeeD7NjmkZZRu5KxK/7/+wN50=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.66.0",
+    "rev": "v0.67.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
+    "vendorHash": "sha256-fw92xhRF60f3QRLBtSvdSwOtXY4QzgJlwb6zgi0OGjw="
   },
   "thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index b8e2c765cb23..1fa893d7f7dc 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,54 +9,54 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.95";
-        ptb = "0.0.146";
-        canary = "0.0.687";
-        development = "0.0.75";
+        stable = "0.0.98";
+        ptb = "0.0.148";
+        canary = "0.0.702";
+        development = "0.0.81";
       }
     else
       {
-        stable = "0.0.347";
-        ptb = "0.0.174";
-        canary = "0.0.793";
-        development = "0.0.88";
+        stable = "0.0.350";
+        ptb = "0.0.179";
+        canary = "0.0.808";
+        development = "0.0.94";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-8NpHTG3ojEr8LCRBE/urgH6xdAHLUhqz+A95obB75y4=";
+        hash = "sha256-JT3fIG5zj2tvVPN9hYxCUFInb78fuy8QeWeZClaYou8=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-bcQsz6hhgtUD2j0MD3rEdFhsGJMQY1+yo19y/lLX+j8=";
+        hash = "sha256-VRhcnjbC42nFZ3DepKNX75pBl0GeDaSWM1SGXJpuQs0=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-OaDN+Qklxieo9xlP8qVeCwWzPBe6bLXoFUkMOFCoqPg=";
+        hash = "sha256-OcRGqwf13yPnbDpYOyXZgEQN/zWshUXfaF5geiLetlc=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-wxbmdEzJu66CqJ87cdOKH5fhWKFvD/FBaeJVFxRCvlQ=";
+        hash = "sha256-njkuWtk+359feEYtWJSDukvbD5duXuRIr1m5cJVhNvs=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-X9c5ruehxEd8FIdaQigiz7WGnh851BMqdo7Cz1wEb7Q=";
+        hash = "sha256-Giz0bE16v2Q2jULcnZMI1AY8zyjZ03hw4KVpDPJOmCo=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/suI1rVJZE1z8wLfiD65p7IdBJsJnz8zX1A2xmMMDnc=";
+        hash = "sha256-tGE7HAcWLpGlv5oXO7NEELdRtNfbhlpQeNc5zB7ba1A=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-/5jSp6dQiElzofpV7bRNPyUqRgq3Adzb8r40Nd8+Fn0=";
+        hash = "sha256-Cu7U70yzHgOAJjtEx85T3x9f1oquNz7VNsX53ISbzKg=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-vjpbLg1YIXOSCwnuMwlXo7Sj8B28i812lJ3yV2NLMrE=";
+        hash = "sha256-+bmzdkOSMpKnLGEoeXmAJSv2UHzirOLe1HDHAdHG2U8=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/remote/x2goclient/default.nix b/pkgs/applications/networking/remote/x2goclient/default.nix
index 6500d65151c9..93d118d415a9 100644
--- a/pkgs/applications/networking/remote/x2goclient/default.nix
+++ b/pkgs/applications/networking/remote/x2goclient/default.nix
@@ -1,57 +1,54 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchurl,
+  libsForQt5,
+  pkg-config,
+  bash,
   cups,
-  libssh,
   libXpm,
+  libssh,
   nx-libs,
   openldap,
   openssh,
-  qt5,
-  qtbase,
-  qtsvg,
-  qtx11extras,
-  qttools,
-  phonon,
-  pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "x2goclient";
-  version = "4.1.2.2";
+  version = "4.1.2.3";
 
   src = fetchurl {
-    url = "https://code.x2go.org/releases/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "yZUyZ8QPpnEZrZanO6yx8mYZbaIFnwzc0bjVGZQh0So=";
+    url = "https://code.x2go.org/releases/source/x2goclient/x2goclient-${finalAttrs.version}.tar.gz";
+    hash = "sha256-q4uzx40xYlx0nkLxX4EP49JCknoVKYMIwT3qO5Fayjw=";
   };
 
   buildInputs = [
     cups
-    libssh
     libXpm
+    libssh
+    libsForQt5.phonon
+    libsForQt5.qtbase
+    libsForQt5.qtsvg
+    libsForQt5.qttools
+    libsForQt5.qtx11extras
     nx-libs
     openldap
     openssh
-    qtbase
-    qtsvg
-    qtx11extras
-    qttools
-    phonon
   ];
 
   nativeBuildInputs = [
     pkg-config
-    qt5.wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   postPatch = ''
-    substituteInPlace src/onmainwindow.cpp --replace "/usr/sbin/sshd" "${openssh}/bin/sshd"
+    substituteInPlace src/onmainwindow.cpp \
+      --replace-fail "/usr/sbin/sshd" "${lib.getExe' openssh "sshd"}"
     substituteInPlace Makefile \
-      --replace "SHELL=/bin/bash" "SHELL=$SHELL" \
-      --replace "lrelease-qt4" "${qttools.dev}/bin/lrelease" \
-      --replace "qmake-qt4" "${qtbase.dev}/bin/qmake" \
-      --replace "-o root -g root" ""
+      --replace-fail "SHELL=/bin/bash" "SHELL ?= ${lib.getExe bash}" \
+      --replace-fail "lrelease-qt4" "${lib.getExe' libsForQt5.qttools.dev "lrelease"}" \
+      --replace-fail "qmake-qt4" "${lib.getExe' libsForQt5.qtbase.dev "qmake"}" \
+      --replace-fail "-o root -g root" ""
   '';
 
   makeFlags = [
@@ -59,6 +56,10 @@ stdenv.mkDerivation rec {
     "ETCDIR=$(out)/etc"
     "build_client"
     "build_man"
+    # No rule to make target 'SHELL'
+    "MAKEOVERRIDES="
+    ".MAKEOVERRIDES="
+    ".MAKEFLAGS="
   ];
 
   installTargets = [
@@ -71,12 +72,16 @@ stdenv.mkDerivation rec {
     "--set QT_QPA_PLATFORM xcb"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Graphical NoMachine NX3 remote desktop client";
     mainProgram = "x2goclient";
     homepage = "http://x2go.org/";
     maintainers = [ ];
-    license = licenses.gpl2;
-    platforms = platforms.linux;
+    license = with lib.licenses; [
+      agpl3Plus
+      mit
+      free
+    ]; # Some X2Go components are licensed under some license (MIT X11, BSD, etc.)
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/office/scribus/default.nix b/pkgs/applications/office/scribus/default.nix
index 42f157f81562..d5fc795c3645 100644
--- a/pkgs/applications/office/scribus/default.nix
+++ b/pkgs/applications/office/scribus/default.nix
@@ -14,7 +14,7 @@
   libxml2,
   pixman,
   pkg-config,
-  podofo,
+  podofo_0_10,
   poppler,
   poppler_data,
   python3,
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     libtiff
     libxml2
     pixman
-    podofo
+    podofo_0_10
     poppler
     poppler_data
     pythonEnv
diff --git a/pkgs/applications/science/astronomy/calcmysky/default.nix b/pkgs/applications/science/astronomy/calcmysky/default.nix
index ee927c8129f3..76d1a9ca3aa1 100644
--- a/pkgs/applications/science/astronomy/calcmysky/default.nix
+++ b/pkgs/applications/science/astronomy/calcmysky/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calcmysky";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "10110111";
     repo = "CalcMySky";
     tag = "v${version}";
-    hash = "sha256-r0F70ouRvUGRo7Zc7BOTe9ujRA5FN+1BdFPDtwIPly4=";
+    hash = "sha256-++011c4/IFf/5GKmFostTnxgfEdw3/GJf0e5frscCQ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 7b53783e3058..508d36294b51 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.27";
+  version = "2.2.28";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-wu4kJCs1Bo6yVGLJuzXSCtv2nXhzlwX6jDTa0gTwPsw=";
+    hash = "sha256-dBeIFmlhxfb7wT3zAK7ALYOqs0dFv2xg+455tCqjyEo=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/video/mpv/scripts/eisa01.nix b/pkgs/applications/video/mpv/scripts/eisa01.nix
index 66cb7033bc60..cd75861999e2 100644
--- a/pkgs/applications/video/mpv/scripts/eisa01.nix
+++ b/pkgs/applications/video/mpv/scripts/eisa01.nix
@@ -12,13 +12,13 @@ let
     let
       self = {
         inherit pname;
-        version = "0-unstable-2025-05-14";
+        version = "25-09-2023-unstable-2025-06-21";
 
         src = fetchFromGitHub {
           owner = "Eisa01";
           repo = "mpv-scripts";
-          rev = "100fea81ae8560c6fb113b1f6bb20857a41a5705";
-          hash = "sha256-bMEKsHrJ+mgG7Vqpzj4TAr7Hehq2o2RuneowhrDCd5k=";
+          rev = "b9e63743a858766c9cc7a801d77313b0cecdb049";
+          hash = "sha256-ohUZH6m+5Sk3VKi9qqEgwhgn2DMOFIvvC41pMkV6oPw=";
           # avoid downloading screenshots and videos
           sparseCheckout = [
             "scripts/"
diff --git a/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix b/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
index 07b8110070fc..31012612ed85 100644
--- a/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "droidcam-obs";
-  version = "2.3.4";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "dev47apps";
     repo = "droidcam-obs-plugin";
     tag = finalAttrs.version;
-    sha256 = "sha256-KWMLhddK561xA+EjvoG4tXRW4xoLil31JcTTfppblmA=";
+    sha256 = "sha256-rA+EMtAeM2LSUqtiYJt0hHZ85aZ+5bvVUUjIG2LC3pc=";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/_0/_0verkill/package.nix b/pkgs/by-name/_0/_0verkill/package.nix
index 1992dd8cc9ae..c23bad6ef5d8 100644
--- a/pkgs/by-name/_0/_0verkill/package.nix
+++ b/pkgs/by-name/_0/_0verkill/package.nix
@@ -37,11 +37,11 @@ gccStdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = "-fcommon";
   hardeningDisable = [ "all" ]; # Someday the upstream will update the code...
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/hackndev/0verkill";
     description = "ASCII-ART bloody 2D action deathmatch-like game";
-    license = with licenses; gpl2Only;
-    maintainers = with maintainers; [ ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/_0/_0xproto/package.nix b/pkgs/by-name/_0/_0xproto/package.nix
index 91857593b493..93bb9f31b3ef 100644
--- a/pkgs/by-name/_0/_0xproto/package.nix
+++ b/pkgs/by-name/_0/_0xproto/package.nix
@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Free and Open-source font for programming";
     homepage = "https://github.com/0xType/0xProto";
-    license = licenses.ofl;
-    maintainers = [ maintainers.edswordsmith ];
-    platforms = platforms.all;
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ edswordsmith ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/by-name/_1/_1fps/package.nix b/pkgs/by-name/_1/_1fps/package.nix
index 197a12a90747..59ba4349191d 100644
--- a/pkgs/by-name/_1/_1fps/package.nix
+++ b/pkgs/by-name/_1/_1fps/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "1fpsvideo";
     repo = "1fps";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3uPGFxEWmKQxQWPmotZI29GykUGQDjtDjFPps4QMs0M=";
   };
 
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index c3bfcf383d1f..c5f84562267a 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -86,16 +86,16 @@ stdenv.mkDerivation {
     updateScript = ./update.sh;
   };
 
-  meta = with lib; {
+  meta = {
     description = "1Password command-line tool";
     homepage = "https://developer.1password.com/docs/cli/";
     downloadPage = "https://app-updates.agilebits.com/product_history/CLI2";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       joelburget
       khaneliman
     ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
     inherit mainProgram platforms;
   };
 }
diff --git a/pkgs/by-name/_2/_20kly/package.nix b/pkgs/by-name/_2/_20kly/package.nix
index e860a01fe15d..56cbe0f02fb9 100644
--- a/pkgs/by-name/_2/_20kly/package.nix
+++ b/pkgs/by-name/_2/_20kly/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "20kly";
     repo = "20kly";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1zxsxg49a02k7zidx3kgk2maa0vv0n1f9wrl5vch07sq3ghvpphx";
   };
 
diff --git a/pkgs/by-name/_8/_86Box/package.nix b/pkgs/by-name/_8/_86Box/package.nix
index 51961cc76e5a..511ba02668f7 100644
--- a/pkgs/by-name/_8/_86Box/package.nix
+++ b/pkgs/by-name/_8/_86Box/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "86Box";
     repo = "86Box";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ue5Coy2MpP7Iwl81KJPQPC7eD53/Db5a0PGIR+DdPYI=";
   };
 
diff --git a/pkgs/by-name/_9/_915resolution/package.nix b/pkgs/by-name/_9/_915resolution/package.nix
index 1b2ef09a5789..681855bb2862 100644
--- a/pkgs/by-name/_9/_915resolution/package.nix
+++ b/pkgs/by-name/_9/_915resolution/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   patchPhase = "rm *.o";
   installPhase = "mkdir -p $out/sbin; cp 915resolution $out/sbin/";
 
-  meta = with lib; {
+  meta = {
     homepage = "http://915resolution.mango-lang.org/";
     description = "Tool to modify Intel 800/900 video BIOS";
     mainProgram = "915resolution";
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
       "i686-linux"
       "x86_64-linux"
     ];
-    license = licenses.publicDomain;
+    license = lib.licenses.publicDomain;
   };
 }
diff --git a/pkgs/by-name/_9/_9base/package.nix b/pkgs/by-name/_9/_9base/package.nix
index 02aa841117af..cc2410ed3cdb 100644
--- a/pkgs/by-name/_9/_9base/package.nix
+++ b/pkgs/by-name/_9/_9base/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
     "troff"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://tools.suckless.org/9base/";
     description = "9base is a port of various original Plan 9 tools for Unix, based on plan9port";
     longDescription = ''
@@ -74,12 +74,12 @@ stdenv.mkDerivation {
       The overall SLOC is about 66kSLOC, so this userland + all libs is much smaller than, e.g. bash.
       9base can be used to run werc instead of the full blown plan9port.
     '';
-    license = with licenses; [
+    license = with lib.licenses; [
       mit # and
       lpl-102
     ];
-    maintainers = with maintainers; [ jk ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ jk ];
+    platforms = lib.platforms.unix;
     # needs additional work to support aarch64-darwin
     # due to usage of _DARWIN_NO_64_BIT_INODE
     broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/aa/aaaaxy/package.nix b/pkgs/by-name/aa/aaaaxy/package.nix
index a1a3d289eea3..784eec6b892b 100644
--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@@ -128,12 +128,12 @@ buildGoModule rec {
 
   strictDeps = true;
 
-  meta = with lib; {
+  meta = {
     description = "Nonlinear 2D puzzle platformer taking place in impossible spaces";
     mainProgram = "aaaaxy";
     homepage = "https://divverent.github.io/aaaaxy/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ Luflosi ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ Luflosi ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/aa/aarch64-esr-decoder/package.nix b/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
index d54b303919c7..b2544b49bc44 100644
--- a/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
+++ b/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
@@ -18,12 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-LiNnTNpluQkomQhIOsAnUbbBftTgqgNdpT8heCrBayg=";
 
-  meta = with lib; {
+  meta = {
     description = "Utility for decoding aarch64 ESR register values";
     homepage = "https://github.com/google/aarch64-esr-decoder";
     changelog = "https://github.com/google/aarch64-esr-decoder/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jmbaur ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jmbaur ];
     mainProgram = "aarch64-esr-decoder";
   };
 }
diff --git a/pkgs/by-name/ab/abpoa/package.nix b/pkgs/by-name/ab/abpoa/package.nix
index a7f23fc035e9..9b143cbfb04e 100644
--- a/pkgs/by-name/ab/abpoa/package.nix
+++ b/pkgs/by-name/ab/abpoa/package.nix
@@ -90,13 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "SIMD-based C library for fast partial order alignment using adaptive band";
     homepage = "https://github.com/yangao07/abPOA";
     changelog = "https://github.com/yangao07/abPOA/releases/tag/v${finalAttrs.version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
     mainProgram = "abpoa";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ac/accuraterip-checksum/package.nix b/pkgs/by-name/ac/accuraterip-checksum/package.nix
index aa4bee62b4b8..848f00c2d283 100644
--- a/pkgs/by-name/ac/accuraterip-checksum/package.nix
+++ b/pkgs/by-name/ac/accuraterip-checksum/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "leo-bogert";
     repo = "accuraterip-checksum";
-    rev = "version${version}";
+    tag = "version${version}";
     sha256 = "1a6biy78jb094rifazn4a2g1dlhryg5q8p8gwj0a60ipl0vfb9bj";
   };
 
diff --git a/pkgs/by-name/ac/acpi/package.nix b/pkgs/by-name/ac/acpi/package.nix
index 54ea37c8ca2e..4f4583a3d14b 100644
--- a/pkgs/by-name/ac/acpi/package.nix
+++ b/pkgs/by-name/ac/acpi/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-5kxuALU815dCfqMqFgUTQlsD7U8HdzP3Hx8J/zQPIws=";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Show battery status and other ACPI information";
     mainProgram = "acpi";
     longDescription = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://sourceforge.net/projects/acpiclient/";
     license = lib.licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/ac/acpic/package.nix b/pkgs/by-name/ac/acpic/package.nix
index 246d6aa67904..516662ffa20d 100644
--- a/pkgs/by-name/ac/acpic/package.nix
+++ b/pkgs/by-name/ac/acpic/package.nix
@@ -27,11 +27,11 @@ python3Packages.buildPythonApplication rec {
   # no tests
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Daemon extending acpid event handling capabilities";
     mainProgram = "acpic";
     homepage = "https://github.com/psliwka/acpic";
-    license = licenses.wtfpl;
-    maintainers = with maintainers; [ aacebedo ];
+    license = lib.licenses.wtfpl;
+    maintainers = with lib.maintainers; [ aacebedo ];
   };
 }
diff --git a/pkgs/by-name/ac/acpid/package.nix b/pkgs/by-name/ac/acpid/package.nix
index 0d626b0fad71..97a5416ab271 100644
--- a/pkgs/by-name/ac/acpid/package.nix
+++ b/pkgs/by-name/ac/acpid/package.nix
@@ -16,10 +16,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://sourceforge.net/projects/acpid2/";
     description = "Daemon for delivering ACPI events to userspace programs";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ac/acpilight/package.nix b/pkgs/by-name/ac/acpilight/package.nix
index 5988f6ba58fc..737d1e5727ba 100644
--- a/pkgs/by-name/ac/acpilight/package.nix
+++ b/pkgs/by-name/ac/acpilight/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "https://gitlab.com/wavexx/acpilight.git";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1r0r3nx6x6vkpal6vci0zaa1n9dfacypldf6k8fxg7919vzxdn1w";
   };
 
@@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
   ];
   doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gitlab.com/wavexx/acpilight";
     description = "ACPI backlight control";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ smakarov ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ smakarov ];
+    platforms = lib.platforms.linux;
     mainProgram = "xbacklight";
   };
 }
diff --git a/pkgs/by-name/ac/acsccid/package.nix b/pkgs/by-name/ac/acsccid/package.nix
index 37a49bfbabc3..c24a94b3e7e3 100644
--- a/pkgs/by-name/ac/acsccid/package.nix
+++ b/pkgs/by-name/ac/acsccid/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     autoconf
   '';
 
-  meta = with lib; {
+  meta = {
     description = "PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card readers";
     longDescription = ''
       acsccid is a PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
         services.pcscd.plugins = [ pkgs.acsccid ];
     '';
     homepage = src.meta.homepage;
-    license = licenses.lgpl2Plus;
-    maintainers = [ ];
-    platforms = with platforms; unix;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ac/action-validator/package.nix b/pkgs/by-name/ac/action-validator/package.nix
index df8b6c2fec76..063bf29c3c18 100644
--- a/pkgs/by-name/ac/action-validator/package.nix
+++ b/pkgs/by-name/ac/action-validator/package.nix
@@ -25,11 +25,11 @@ rustPlatform.buildRustPackage {
     branch = "main";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Tool to validate GitHub Action and Workflow YAML files";
     homepage = "https://github.com/mpalmer/action-validator";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     mainProgram = "action-validator";
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with lib.maintainers; [ thiagokokada ];
   };
 }
diff --git a/pkgs/by-name/ac/activate-linux/package.nix b/pkgs/by-name/ac/activate-linux/package.nix
index 8bc7f83f5d60..75d67265f816 100644
--- a/pkgs/by-name/ac/activate-linux/package.nix
+++ b/pkgs/by-name/ac/activate-linux/package.nix
@@ -61,15 +61,15 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "\"Activate Windows\" watermark ported to Linux";
     homepage = "https://github.com/MrGlockenspiel/activate-linux";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [
       alexnortung
       donovanglover
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "activate-linux";
   };
 })
diff --git a/pkgs/by-name/ad/adbfs-rootless/package.nix b/pkgs/by-name/ad/adbfs-rootless/package.nix
index 0d4c6344437d..cf6cf458fc0b 100644
--- a/pkgs/by-name/ad/adbfs-rootless/package.nix
+++ b/pkgs/by-name/ad/adbfs-rootless/package.nix
@@ -34,12 +34,12 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Mount Android phones on Linux with adb, no root required";
     mainProgram = "adbfs";
     inherit (src.meta) homepage;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ aleksana ];
-    platforms = platforms.unix;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ad/addlicense/package.nix b/pkgs/by-name/ad/addlicense/package.nix
index fdff6455a630..528282c13828 100644
--- a/pkgs/by-name/ad/addlicense/package.nix
+++ b/pkgs/by-name/ad/addlicense/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = "addlicense";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-YMMHj6wctKtJi/rrcMIrLmNw/uvO6wCwokgYRQxcsFw=";
   };
 
diff --git a/pkgs/by-name/ad/adi1090x-plymouth-themes/package.nix b/pkgs/by-name/ad/adi1090x-plymouth-themes/package.nix
index 5aa7e78ac11a..f362ff50f7fa 100644
--- a/pkgs/by-name/ad/adi1090x-plymouth-themes/package.nix
+++ b/pkgs/by-name/ad/adi1090x-plymouth-themes/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     find $out/share/plymouth/themes/ -name \*.plymouth -exec sed -i "s@\/usr\/@$out\/@" {} \;
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Plymouth boot themes from adi1090x";
     longDescription = ''
       A variety of plymouth boot screens by adi1090x.  Using the default value
@@ -60,8 +60,8 @@ stdenv.mkDerivation {
       ./shas.nix for available themes.
     '';
     homepage = "https://github.com/adi1090x/plymouth-themes";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ slwst ];
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ slwst ];
   };
 }
diff --git a/pkgs/by-name/ad/adrgen/package.nix b/pkgs/by-name/ad/adrgen/package.nix
index e018fd97c083..a54fd666e4cc 100644
--- a/pkgs/by-name/ad/adrgen/package.nix
+++ b/pkgs/by-name/ad/adrgen/package.nix
@@ -35,11 +35,11 @@ buildGoModule rec {
     version = "v${version}";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/asiermarques/adrgen";
     description = "Command-line tool for generating and managing Architecture Decision Records";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "adrgen";
   };
 }
diff --git a/pkgs/by-name/ae/aefs/package.nix b/pkgs/by-name/ae/aefs/package.nix
index 024601c772fd..52e11397f9c9 100644
--- a/pkgs/by-name/ae/aefs/package.nix
+++ b/pkgs/by-name/ae/aefs/package.nix
@@ -35,12 +35,12 @@ stdenv.mkDerivation {
 
   buildInputs = [ fuse ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/edolstra/aefs";
     description = "Cryptographic filesystem implemented in userspace using FUSE";
-    maintainers = [ ];
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/ae/aeolus/package.nix b/pkgs/by-name/ae/aeolus/package.nix
index 00dc30271805..958fed5b073e 100644
--- a/pkgs/by-name/ae/aeolus/package.nix
+++ b/pkgs/by-name/ae/aeolus/package.nix
@@ -58,12 +58,12 @@ stdenv.mkDerivation rec {
       echo -n "${cfg}" > $out/etc/aeolus.conf
     '';
 
-  meta = with lib; {
+  meta = {
     description = "Synthetized (not sampled) pipe organ emulator";
     homepage = "http://kokkinizita.linuxaudio.org/linuxaudio/aeolus/index.html";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.lgpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       nico202
       orivej
     ];
diff --git a/pkgs/by-name/ae/aerospike/package.nix b/pkgs/by-name/ae/aerospike/package.nix
index 6f79ead45736..cb322361bedc 100644
--- a/pkgs/by-name/ae/aerospike/package.nix
+++ b/pkgs/by-name/ae/aerospike/package.nix
@@ -45,12 +45,12 @@ stdenv.mkDerivation rec {
     cp target/Linux-x86_64/bin/asd $out/bin/asd
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Flash-optimized, in-memory, NoSQL database";
     mainProgram = "asd";
     homepage = "https://aerospike.com/";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [ kalbasit ];
   };
 }
diff --git a/pkgs/by-name/ae/aespipe/package.nix b/pkgs/by-name/ae/aespipe/package.nix
index 7964bb697cce..e077b6d592a8 100644
--- a/pkgs/by-name/ae/aespipe/package.nix
+++ b/pkgs/by-name/ae/aespipe/package.nix
@@ -28,11 +28,11 @@ stdenv.mkDerivation rec {
      --prefix PATH : $out/bin:${lib.makeBinPath [ sharutils ]}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "AES encrypting or decrypting pipe";
     homepage = "https://loop-aes.sourceforge.net/aespipe.README";
-    license = licenses.gpl2Only;
-    maintainers = [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/af/afetch/package.nix b/pkgs/by-name/af/afetch/package.nix
index a959d0786420..5eebb959873a 100644
--- a/pkgs/by-name/af/afetch/package.nix
+++ b/pkgs/by-name/af/afetch/package.nix
@@ -19,15 +19,15 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Fetch program written in C";
     homepage = "https://github.com/13-CF/afetch";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       dan4ik605743
       jk
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "afetch";
   };
 }
diff --git a/pkgs/by-name/af/afew/package.nix b/pkgs/by-name/af/afew/package.nix
index 912f7ec3d301..a3fc331f1bff 100644
--- a/pkgs/by-name/af/afew/package.nix
+++ b/pkgs/by-name/af/afew/package.nix
@@ -60,11 +60,11 @@ python3Packages.buildPythonApplication rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";
     mainProgram = "afew";
-    license = licenses.isc;
-    maintainers = with maintainers; [ flokli ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ flokli ];
   };
 }
diff --git a/pkgs/by-name/af/afsctool/package.nix b/pkgs/by-name/af/afsctool/package.nix
index a932a79b63fd..d145161df443 100644
--- a/pkgs/by-name/af/afsctool/package.nix
+++ b/pkgs/by-name/af/afsctool/package.nix
@@ -30,11 +30,11 @@ stdenv.mkDerivation rec {
     sparsehash
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Utility that allows end-users to leverage HFS+/APFS compression";
-    license = licenses.unfree;
-    maintainers = [ maintainers.viraptor ];
-    platforms = platforms.darwin;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ viraptor ];
+    platforms = lib.platforms.darwin;
     homepage = "https://github.com/RJVB/afsctool";
   };
 }
diff --git a/pkgs/by-name/af/aften/package.nix b/pkgs/by-name/af/aften/package.nix
index 36e149541976..b0960550c857 100644
--- a/pkgs/by-name/af/aften/package.nix
+++ b/pkgs/by-name/af/aften/package.nix
@@ -23,11 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DSHARED=ON" ];
 
-  meta = with lib; {
+  meta = {
     description = "Audio encoder which generates compressed audio streams based on ATSC A/52 specification";
     homepage = "https://aften.sourceforge.net/";
-    license = licenses.lgpl21Only;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ emilytrau ];
+    license = lib.licenses.lgpl21Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ emilytrau ];
   };
 }
diff --git a/pkgs/by-name/af/afterburn/package.nix b/pkgs/by-name/af/afterburn/package.nix
index 9cf24239dea4..639d09c6d830 100644
--- a/pkgs/by-name/af/afterburn/package.nix
+++ b/pkgs/by-name/af/afterburn/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "afterburn";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-hlcUtEc0uWFolCt+mZd7f68PJPa+i/mv+2aJh4Vhmsw=";
   };
 
diff --git a/pkgs/by-name/ag/agdsn-zsh-config/package.nix b/pkgs/by-name/ag/agdsn-zsh-config/package.nix
index e430f3c69ccb..f7ee3274653b 100644
--- a/pkgs/by-name/ag/agdsn-zsh-config/package.nix
+++ b/pkgs/by-name/ag/agdsn-zsh-config/package.nix
@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "agdsn";
     repo = "agdsn-zsh-config";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-8POQPk/hsJBMJ/ZJe9XzVj7Rd7C2+QnpzgYbUR0s3Fc=";
   };
 
diff --git a/pkgs/by-name/ag/age/package.nix b/pkgs/by-name/ag/age/package.nix
index 0a0c0a43eed9..2a36745377b6 100644
--- a/pkgs/by-name/ag/age/package.nix
+++ b/pkgs/by-name/ag/age/package.nix
@@ -21,7 +21,7 @@ buildGoModule (final: {
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
-    rev = "v${final.version}";
+    tag = "v${final.version}";
     hash = "sha256-9ZJdrmqBj43zSvStt0r25wjSfnvitdx3GYtM3urHcaA=";
   };
 
diff --git a/pkgs/by-name/ag/ags_1/package.nix b/pkgs/by-name/ag/ags_1/package.nix
index 21d9ccf64894..49f658236ca1 100644
--- a/pkgs/by-name/ag/ags_1/package.nix
+++ b/pkgs/by-name/ag/ags_1/package.nix
@@ -27,7 +27,7 @@ buildNpmPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Aylur";
     repo = "ags";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ebnkUaee/pnfmw1KmOZj+MP1g5wA+8BT/TPKmn4Dkwc=";
     fetchSubmodules = true;
   };
diff --git a/pkgs/by-name/ai/airspy/package.nix b/pkgs/by-name/ai/airspy/package.nix
index 2209b21e3c27..7632f6edf218 100644
--- a/pkgs/by-name/ai/airspy/package.nix
+++ b/pkgs/by-name/ai/airspy/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "airspy";
     repo = "airspyone_host";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1v7sfkkxc6f8ny1p9xrax1agkl6q583mjx8k0lrrwdz31rf9qgw9";
   };
 
diff --git a/pkgs/by-name/al/albatross/package.nix b/pkgs/by-name/al/albatross/package.nix
index 09e220a94d04..d016fc18f944 100644
--- a/pkgs/by-name/al/albatross/package.nix
+++ b/pkgs/by-name/al/albatross/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     repo = "Albatross";
     owner = "shimmerproject";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "0mq87n2hxy44nzr567av24n5nqjaljhi1afxrn3mpjqdbkq7lx88";
   };
 
diff --git a/pkgs/by-name/al/albert/package.nix b/pkgs/by-name/al/albert/package.nix
index e7f04a96aa5f..d432e3752f6f 100644
--- a/pkgs/by-name/al/albert/package.nix
+++ b/pkgs/by-name/al/albert/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.28.0";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ciqCNQD5S7qv9Ph6AgUpFB5Sphv6Eb1LR3Ap3bTd1EE=";
+    hash = "sha256-FYl/S7+KoQ3kgUQX0hiv8B+AbTbyfmo1GX130G09bZ8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/al/alire/package.nix b/pkgs/by-name/al/alire/package.nix
index e3ebc1a04bb1..eab812c63c9f 100644
--- a/pkgs/by-name/al/alire/package.nix
+++ b/pkgs/by-name/al/alire/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "alire-project";
     repo = "alire";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
 
     fetchSubmodules = true;
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 36803b0c3acc..49ddc8765911 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -41,7 +41,10 @@ buildGoModule rec {
     homepage = "https://github.com/aliyun/aliyun-cli";
     changelog = "https://github.com/aliyun/aliyun-cli/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ornxka ];
+    maintainers = with lib.maintainers; [
+      ornxka
+      ryan4yin
+    ];
     mainProgram = "aliyun";
   };
 }
diff --git a/pkgs/by-name/al/alttab/package.nix b/pkgs/by-name/al/alttab/package.nix
index 9a81b905f3a6..15ff4dad4d80 100644
--- a/pkgs/by-name/al/alttab/package.nix
+++ b/pkgs/by-name/al/alttab/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "sagb";
     repo = "alttab";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-1+hk0OeSriXPyefv3wOgeiW781PL4VP5Luvt+RS5jmg=";
   };
 
diff --git a/pkgs/by-name/am/amdgpu_top/package.nix b/pkgs/by-name/am/amdgpu_top/package.nix
index d007ccf92adb..6058e0975b1e 100644
--- a/pkgs/by-name/am/amdgpu_top/package.nix
+++ b/pkgs/by-name/am/amdgpu_top/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "Umio-Yasuno";
     repo = "amdgpu_top";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-BT451a9S3hyugEFH1rHPiJLAb6LzB8rqMAZdWf4UNC8=";
   };
 
diff --git a/pkgs/by-name/am/amoco/package.nix b/pkgs/by-name/am/amoco/package.nix
index 66e18956e439..406ed970facf 100644
--- a/pkgs/by-name/am/amoco/package.nix
+++ b/pkgs/by-name/am/amoco/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "bdcht";
     repo = "amoco";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3+1ssFyU7SKFJgDYBQY0kVjmTHOD71D2AjnH+4bfLXo=";
   };
 
diff --git a/pkgs/by-name/an/android-file-transfer/package.nix b/pkgs/by-name/an/android-file-transfer/package.nix
index 75c7db22608e..68c27eae9c3b 100644
--- a/pkgs/by-name/an/android-file-transfer/package.nix
+++ b/pkgs/by-name/an/android-file-transfer/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "whoozle";
     repo = "android-file-transfer-linux";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-G+ErwZ/F8Cl8WLSzC+5LrEWWqNZL3xDMBvx/gjkgAXk=";
   };
 
diff --git a/pkgs/by-name/aw/aws-iam-authenticator/package.nix b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
index 58f8f3500613..dd8ebcf2987e 100644
--- a/pkgs/by-name/aw/aws-iam-authenticator/package.nix
+++ b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
@@ -37,6 +37,9 @@ buildGoModule rec {
     mainProgram = "aws-iam-authenticator";
     changelog = "https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ srhb ];
+    maintainers = with lib.maintainers; [
+      srhb
+      ryan4yin
+    ];
   };
 }
diff --git a/pkgs/by-name/aw/awsbck/package.nix b/pkgs/by-name/aw/awsbck/package.nix
index 92a2e0f9ff04..00f16a9c74c7 100644
--- a/pkgs/by-name/aw/awsbck/package.nix
+++ b/pkgs/by-name/aw/awsbck/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awsbck";
-  version = "0.3.13";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "awsbck";
     rev = "v${version}";
-    hash = "sha256-7ykDkCA6c5MzaMWT+ZjNBhPOZO8UNYIP5sNwoFx1XT8=";
+    hash = "sha256-Sa+CCRfhZyMmbbPggeJ+tXYdrhmDwfiirgLdTEma05M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-L7iWM5T/FRK+0KQROILg4Mns1+cwPPGKfe0H00FJrSo=";
+  cargoHash = "sha256-kCVMsA2tu8hxoe/JGd+a4Jcok3rM/yb/UWE4xhuPLoo=";
 
   # tests run in CI on the source repo
   doCheck = false;
diff --git a/pkgs/by-name/az/azahar/package.nix b/pkgs/by-name/az/azahar/package.nix
index 594f8e1f8f88..91f5d5517cd8 100644
--- a/pkgs/by-name/az/azahar/package.nix
+++ b/pkgs/by-name/az/azahar/package.nix
@@ -52,11 +52,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2122";
+  version = "2122.1";
 
   src = fetchzip {
     url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-isohwigDgqwPJxinBju1biAXC3CX3JrNJiQ1NY+NjRo=";
+    hash = "sha256-RQ8dgD09cWyVWGSLzHz1oJOKia1OKr2jHqYwKaVGfxE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ba/baidupcs-go/package.nix b/pkgs/by-name/ba/baidupcs-go/package.nix
index 02cf013e0635..6c2e7b191c7c 100644
--- a/pkgs/by-name/ba/baidupcs-go/package.nix
+++ b/pkgs/by-name/ba/baidupcs-go/package.nix
@@ -32,7 +32,7 @@ buildGoModule rec {
 
   postInstall = ''
     rm -f $out/bin/AndroidNDKBuild
-    ln -s $out/bin/BaiduPCS-Go $out/bin/baidupcs-go
+    ln -s $out/bin/BaiduPCS-Go $out/bin/baidupcs-go || true
   '';
 
   postVersionCheck = ''
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index fca565659a73..97415391a338 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.1.0";
+  version = "22.1.1";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-qL+hC3ydKJSzceJVbaLy+a2jpXMLsgGC++PEreZDF0k=";
+    hash = "sha256-KEYzYIrcJdpicu4L09UVAU25fC8bWbIYJOuSpCHU3K4=";
   };
 
-  npmDepsHash = "sha256-bLYKMWiXwvpMhnTHa0RPhzEpvtTFcWnqX8zXDNCY4uk=";
+  npmDepsHash = "sha256-jErFmkOQ3ySdLLXDh0Xl2tcWlfxnL2oob+x7QDuLJ8w=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/ba/bats/package.nix b/pkgs/by-name/ba/bats/package.nix
index 91683dc96c3f..120e957c5f18 100644
--- a/pkgs/by-name/ba/bats/package.nix
+++ b/pkgs/by-name/ba/bats/package.nix
@@ -28,13 +28,13 @@
 
 resholve.mkDerivation rec {
   pname = "bats";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "bats-core";
     repo = "bats-core";
     rev = "v${version}";
-    hash = "sha256-+qmCeLixfLak09XxgSe6ONcH1IoHGl5Au0s9JyNm95g=";
+    hash = "sha256-5VCkOzyaUOBW+HVVHDkH9oCWDI/MJW6yrLTQG60Ralk=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/be/berry/package.nix b/pkgs/by-name/be/berry/package.nix
index 0236acba7362..5f35e5e9e3fa 100644
--- a/pkgs/by-name/be/berry/package.nix
+++ b/pkgs/by-name/be/berry/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "berry";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "JLErvin";
     repo = "berry";
     rev = finalAttrs.version;
-    hash = "sha256-xMJRiLNtwVRQf9HiCF3ClLKEmdDNxcY35IYxe+L7+Hk=";
+    hash = "sha256-BMK5kZVoYTUA7AFZc/IVv4rpbn893b/QYXySuPAz2Z8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bt/btop/package.nix b/pkgs/by-name/bt/btop/package.nix
index 4fbf5980367b..8b9adbba4cdb 100644
--- a/pkgs/by-name/bt/btop/package.nix
+++ b/pkgs/by-name/bt/btop/package.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       khaneliman
       rmcgibbo
+      ryan4yin
     ];
     mainProgram = "btop";
   };
diff --git a/pkgs/by-name/ca/caddy/package.nix b/pkgs/by-name/ca/caddy/package.nix
index bc219a3cfbf5..2786618a4cc2 100644
--- a/pkgs/by-name/ca/caddy/package.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -91,6 +91,7 @@ buildGoModule {
       Br1ght0ne
       stepbrobd
       techknowlogick
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 52c1d0061ed8..ad0c9a0e6e59 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -21,7 +21,7 @@
   optipng,
   piper-tts,
   pkg-config,
-  podofo,
+  podofo_0_10,
   poppler-utils,
   python3Packages,
   qt6,
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     libuchardet
     libusb1
     piper-tts
-    podofo
+    podofo_0_10
     poppler-utils
     qt6.qtbase
     qt6.qtwayland
@@ -156,8 +156,8 @@ stdenv.mkDerivation (finalAttrs: {
     export MAGICK_LIB=${imagemagick.out}/lib
     export FC_INC_DIR=${fontconfig.dev}/include/fontconfig
     export FC_LIB_DIR=${fontconfig.lib}/lib
-    export PODOFO_INC_DIR=${podofo.dev}/include/podofo
-    export PODOFO_LIB_DIR=${podofo.lib}/lib
+    export PODOFO_INC_DIR=${podofo_0_10.dev}/include/podofo
+    export PODOFO_LIB_DIR=${podofo_0_10}/lib
     export XDG_DATA_HOME=$out/share
     export XDG_UTILS_INSTALL_MODE="user"
     export PIPER_TTS_DIR=${piper-tts}/bin
diff --git a/pkgs/by-name/ca/cambia/package.nix b/pkgs/by-name/ca/cambia/package.nix
new file mode 100644
index 000000000000..6134050d9e90
--- /dev/null
+++ b/pkgs/by-name/ca/cambia/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildNpmPackage,
+  cargo-tauri,
+  fetchpatch,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+}:
+let
+  version = "0-unstable-2025-03-07";
+
+  src = fetchFromGitHub {
+    owner = "arg274";
+    repo = "cambia";
+    rev = "bef0975f72e15b925d881ab70d3bc556ecf4ff7f";
+    hash = "sha256-4/GKvU3r4JpOKgkLgSOKEHnSoIsjgjQU6pay2deiIng=";
+  };
+
+  meta = {
+    description = "Compact disc ripper log checking utility";
+    homepage = "https://github.com/arg274/cambia";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "cambia-frontend";
+    inherit version;
+
+    src = "${src}/web";
+    npmDepsHash = "sha256-U+2YfsC4u6rJdeMo2zxWiXGM3061MKCcFl0oZt0ug6o=";
+
+    installPhase = ''
+      runHook preInstall
+      cp -r build/ $out
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      description = "Web UI for Cambia";
+    };
+  });
+in
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cambia";
+  inherit version src;
+
+  cargoHash = "sha256-dNgFQiJrakdP0ynyVcak6cKU02Z5dcw2nhh9XhlWsOg=";
+
+  cargoPatches = [
+    # https://github.com/arg274/cambia/pull/5
+    (fetchpatch {
+      name = "cargo.lock.patch";
+      url = "https://github.com/arg274/cambia/commit/b47944fbaf4e631ede25c560a4d7e684a2ad5014.patch";
+      hash = "sha256-y9WkEmzBaFJ0eHWK0hVmB6+IdWespp79N9lSuteZZAI=";
+    })
+  ];
+
+  postPatch = ''
+    cp -r ${finalAttrs.passthru.frontend} web/build/
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "-s"
+        "frontend"
+      ];
+    };
+    inherit frontend;
+  };
+
+  meta = meta // {
+    mainProgram = "cambia";
+  };
+})
diff --git a/pkgs/by-name/ca/camunda-modeler/package.nix b/pkgs/by-name/ca/camunda-modeler/package.nix
index 1a392e2c033d..2e764898c390 100644
--- a/pkgs/by-name/ca/camunda-modeler/package.nix
+++ b/pkgs/by-name/ca/camunda-modeler/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.36.0";
+  version = "5.36.1";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-K4N6/OVPeYk1Xd5nkap/ZEIa24PiryPAKCJ8AP00ITw=";
+    hash = "sha256-m/g1QsllShsykCIxnW9szAtZvXd59lnfSmDJX7GEHho=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 
diff --git a/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix b/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix
index f8b2355d0e2a..ac76a738d6a8 100644
--- a/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix
+++ b/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "chirpstack-udp-forwarder";
-  version = "4.1.10";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-udp-forwarder";
     rev = "v${version}";
-    hash = "sha256-71pzD1wF6oNgi2eP/f/buX/vWpZda5DpD2mN1F7n3lk=";
+    hash = "sha256-7xB85IOwOZ6cifw2TFWzNGNMPl8Pc9seqpSJdWdzStM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3RrFA/THO9fWfk41nVbFGFv/VeFOcdN2mWgshC5PODw=";
+  cargoHash = "sha256-ECq6Gfn52ZjS48h479XgTQnZHYSjnJK/T9j5NTlcxz4=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/pkgs/by-name/ci/cie-middleware-linux/package.nix b/pkgs/by-name/ci/cie-middleware-linux/package.nix
index 0495b82c0693..77c9528e4451 100644
--- a/pkgs/by-name/ci/cie-middleware-linux/package.nix
+++ b/pkgs/by-name/ci/cie-middleware-linux/package.nix
@@ -15,7 +15,7 @@
   libxml2,
   openssl,
   pcsclite,
-  podofo,
+  podofo_0_10,
   ghostscript,
 }:
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
   buildInputs = [
     cryptopp
     fontconfig
-    podofo
+    podofo_0_10
     openssl
     pcsclite
     curl
diff --git a/pkgs/by-name/ci/cilium-cli/package.nix b/pkgs/by-name/ci/cilium-cli/package.nix
index 8b101be51027..d4018083707d 100644
--- a/pkgs/by-name/ci/cilium-cli/package.nix
+++ b/pkgs/by-name/ci/cilium-cli/package.nix
@@ -56,6 +56,7 @@ buildGoModule rec {
       bryanasdev000
       humancalico
       qjoly
+      ryan4yin
     ];
     mainProgram = "cilium";
   };
diff --git a/pkgs/by-name/co/completely/Gemfile.lock b/pkgs/by-name/co/completely/Gemfile.lock
index d6985978275b..53b2f0a2d03f 100644
--- a/pkgs/by-name/co/completely/Gemfile.lock
+++ b/pkgs/by-name/co/completely/Gemfile.lock
@@ -2,11 +2,11 @@ GEM
   remote: https://rubygems.org/
   specs:
     colsole (1.0.0)
-    completely (0.6.3)
+    completely (0.7.1)
       colsole (>= 0.8.1, < 2)
       mister_bin (~> 0.7)
     docopt_ng (0.7.1)
-    mister_bin (0.7.6)
+    mister_bin (0.8.1)
       colsole (>= 0.8.1, < 2)
       docopt_ng (~> 0.7, >= 0.7.1)
 
@@ -17,4 +17,4 @@ DEPENDENCIES
   completely
 
 BUNDLED WITH
-   2.5.16
+   2.6.6
diff --git a/pkgs/by-name/co/completely/gemset.nix b/pkgs/by-name/co/completely/gemset.nix
index f823d1203a07..ec0d8c65df42 100644
--- a/pkgs/by-name/co/completely/gemset.nix
+++ b/pkgs/by-name/co/completely/gemset.nix
@@ -18,10 +18,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ci8iza647hvc4f1cmf9mpsm3i78ysf6g6213wkyrr5jk296hjjb";
+      sha256 = "0129alz54h2vy7vd19i5664sasdbvrl4zgj70hl5j4rpvckr5lf8";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.7.1";
   };
   docopt_ng = {
     groups = [ "default" ];
@@ -42,9 +42,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xx8cxvzcn47zsnshcllf477x4rbssrchvp76929qnsg5k9q7fas";
+      sha256 = "1zz3vpy6xrgzln2dpxgcnrq1bpzz0syl60whqc9zf8j29mayw1fy";
       type = "gem";
     };
-    version = "0.7.6";
+    version = "0.8.1";
   };
 }
diff --git a/pkgs/by-name/cr/crcpp/package.nix b/pkgs/by-name/cr/crcpp/package.nix
index fc6610307e90..5e920f56e81c 100644
--- a/pkgs/by-name/cr/crcpp/package.nix
+++ b/pkgs/by-name/cr/crcpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crcpp";
-  version = "1.2.0.0";
+  version = "1.2.1.0";
 
   src = fetchFromGitHub {
     owner = "d-bahr";
     repo = "CRCpp";
     rev = "release-${version}";
-    sha256 = "sha256-OY8MF8fwr6k+ZSA/p1U+9GnTFoMSnUZxKVez+mda2tA=";
+    sha256 = "sha256-9oAG2MCeSsgA9x1mSU+xiKHUlUuPndIqQJnkrItgsAA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix
index 24e0b09ea49f..442a210c1e9b 100644
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -47,6 +47,7 @@ buildGoModule rec {
     maintainers = with maintainers; [
       equirosa
       SuperSandro2000
+      ryan4yin
     ];
     mainProgram = "croc";
   };
diff --git a/pkgs/by-name/da/das/package.nix b/pkgs/by-name/da/das/package.nix
index 4635b60bd565..8ffc24cddf9d 100644
--- a/pkgs/by-name/da/das/package.nix
+++ b/pkgs/by-name/da/das/package.nix
@@ -1,10 +1,11 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "das";
   version = "1.0.3";
   pyproject = true;
@@ -21,11 +22,12 @@ python3.pkgs.buildPythonApplication rec {
     "defusedxml"
     "netaddr"
     "networkx"
+    "plotly"
   ];
 
-  build-system = with python3.pkgs; [ poetry-core ];
+  build-system = with python3Packages; [ poetry-core ];
 
-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
     dash
     defusedxml
     dnspython
@@ -40,6 +42,10 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonImportsCheck = [ "das" ];
 
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+
   meta = {
     description = "Divide full port scan results and use it for targeted Nmap runs";
     homepage = "https://github.com/snovvcrash/DivideAndScan";
diff --git a/pkgs/by-name/dd/ddnet/package.nix b/pkgs/by-name/dd/ddnet/package.nix
index 5aacd3ac568e..0160e308bd06 100644
--- a/pkgs/by-name/dd/ddnet/package.nix
+++ b/pkgs/by-name/dd/ddnet/package.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddnet";
-  version = "19.2.1";
+  version = "19.3";
 
   src = fetchFromGitHub {
     owner = "ddnet";
     repo = "ddnet";
     tag = version;
-    hash = "sha256-0G0rVqkrIKjSGW7TF218TqakzJxiCzDipLGDzJvgdRg=";
+    hash = "sha256-8mCkzZPdLFGIlOkMiNDOxiQeEHa+k0BX9PMIPbjmW5k=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/di/dive/package.nix b/pkgs/by-name/di/dive/package.nix
index d051c1771386..0fb1072c44b5 100644
--- a/pkgs/by-name/di/dive/package.nix
+++ b/pkgs/by-name/di/dive/package.nix
@@ -52,6 +52,9 @@ buildGoModule rec {
     homepage = "https://github.com/wagoodman/dive";
     changelog = "https://github.com/wagoodman/dive/releases/tag/v${version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    maintainers = with lib.maintainers; [
+      SuperSandro2000
+      ryan4yin
+    ];
   };
 }
diff --git a/pkgs/by-name/dr/drogon/package.nix b/pkgs/by-name/dr/drogon/package.nix
index ed4e019949be..52c3a6ad4c58 100644
--- a/pkgs/by-name/dr/drogon/package.nix
+++ b/pkgs/by-name/dr/drogon/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drogon";
-  version = "1.9.10";
+  version = "1.9.11";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-a6IsJZ6fR0CkR06eDksvwvMCXQk+7tTXIFbE+qmfeZI=";
+    hash = "sha256-eFOYmqfyb/yp83HRa0hWSMuROozR/nfnEp7k5yx8hj0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 0646ce5bd7f7..fc77b758e4b0 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -51,6 +51,7 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       xrelkd
       Chili-Man
+      ryan4yin
     ];
     mainProgram = "eksctl";
   };
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index af7602baa8a9..e43ccaad8a3f 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.182";
+  version = "0.0.183";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-OMLRUVLUeft5WpSj16v9DTkD/jUb0u7zH0yXP2oPUI0=";
+    hash = "sha256-fXkDT+4n8gXZ2AD+RBjHJ3tGPnZlUU7p62bdiOumaBY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/er/erofs-utils/package.nix b/pkgs/by-name/er/erofs-utils/package.nix
index 12c7369ddd67..d5b1e9d43cc0 100644
--- a/pkgs/by-name/er/erofs-utils/package.nix
+++ b/pkgs/by-name/er/erofs-utils/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.8.6";
+  version = "1.8.7";
   outputs = [
     "out"
     "man"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-WyIdw/1tFRQlswU07eRvt6kNwjOoZZy6A3J5awoGZUc=";
+    hash = "sha256-2ElBqDNpqRKPLVezAUqshuY8oasDAAqfW7IccD8Q0nI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index c32e0b4b7d1d..3490a80f9cac 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2025-06-14";
+  version = "2025-06-21";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-znJZK7EhLFg2ImxWqEfvt7Em+M8lAly+oPzrmaGznRU=";
+    hash = "sha256-6mXku+SW6xmSYxd40Ilis8H/2Ozm6eUecLQHy1xeKtM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index a3dce0ff35d9..9d5ce40c9805 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.15.25";
+  version = "2.15.32";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-pdUvxWdFeL2whTgP+iqJ5spxHW5xMjSpIMf+0VbqPwI=";
+    hash = "sha256-etUcjmRZJvwEUHX87sPBoYsh9oVFm4fxdrJR6VJBvrE=";
   };
 
-  vendorHash = "sha256-bDoomu7zyoTb6yAXwYlLTbw94gTIM0ELbey/AXgov48=";
+  vendorHash = "sha256-8mEl9/ljAKkTHgcEgf+SjeVjFv/fxVlYnhOxKzEIxgM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fi/fittrackee/package.nix b/pkgs/by-name/fi/fittrackee/package.nix
index e2500448837a..8f4e9066692f 100644
--- a/pkgs/by-name/fi/fittrackee/package.nix
+++ b/pkgs/by-name/fi/fittrackee/package.nix
@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "fittrackee";
-  version = "0.10.2";
+  version = "0.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SamR1";
     repo = "FitTrackee";
     tag = "v${version}";
-    hash = "sha256-ZCQ4Ft2TSjS62DmGDpQ7gG5Spnf82v82i5nnZtg1UmA=";
+    hash = "sha256-rJ3/JtbzYwsMRk5OZKczr/BDwfDU4NH48JdYWC5/fNk=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index d0473a3f8cf0..c18373187ee2 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -80,6 +80,7 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       bryanasdev000
       jlesquembre
+      ryan4yin
     ];
     mainProgram = "flux";
   };
diff --git a/pkgs/by-name/fo/foxglove-cli/package.nix b/pkgs/by-name/fo/foxglove-cli/package.nix
new file mode 100644
index 000000000000..a177bd518359
--- /dev/null
+++ b/pkgs/by-name/fo/foxglove-cli/package.nix
@@ -0,0 +1,85 @@
+{
+  stdenv,
+  lib,
+  buildGoModule,
+  buildPackages,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "foxglove-cli";
+  version = "1.0.23";
+
+  src = fetchFromGitHub {
+    owner = "foxglove";
+    repo = "foxglove-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jJD8sRTiJ4UGouc3KFgdgpjL7AQuU4wdxIaLqd/bih4=";
+  };
+
+  vendorHash = "sha256-8WHfXLcpYI2TlXOgjwcuJW61ftTHQEDP0Wc5XZ8ZsCQ=";
+
+  env.CGO_ENABLED = 0;
+  tags = [ "netgo" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  modRoot = "foxglove";
+
+  checkFlags =
+    let
+      skippedTests = [
+        "TestDoExport"
+        "TestExport"
+        "TestExportCommand"
+        "TestImport"
+        "TestImportCommand"
+        "TestLogin"
+        "TestLoginCommand"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd foxglove \
+        --bash <(${emulator} $out/bin/foxglove completion bash) \
+        --fish <(${emulator} $out/bin/foxglove completion fish) \
+        --zsh <(${emulator} $out/bin/foxglove completion zsh)
+    ''
+  );
+
+  passthru.updateScript = nix-update-script { };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  meta = {
+    changelog = "https://github.com/foxglove/foxglove-cli/releases/tag/v${finalAttrs.version}";
+    description = "Interact with the Foxglove platform";
+    downloadPage = "https://github.com/foxglove/foxglove-cli";
+    homepage = "https://docs.foxglove.dev/docs/cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sascha8a ];
+    mainProgram = "foxglove";
+  };
+})
diff --git a/pkgs/by-name/fr/freetds/package.nix b/pkgs/by-name/fr/freetds/package.nix
index a5d5d4d0dab2..5c0e0e7d11fe 100644
--- a/pkgs/by-name/fr/freetds/package.nix
+++ b/pkgs/by-name/fr/freetds/package.nix
@@ -15,11 +15,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchurl {
     url = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    hash = "sha256-cQCnI77xwIZvChLHCBtBBEeVnIucx1ABlsXF1kBCwFY=";
+    hash = "sha256-XLZsRqYKg7iihV5GYUi2+ieWLH/R3LP25dCrF+xf9t0=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/gg/gg-jj/package.nix b/pkgs/by-name/gg/gg-jj/package.nix
index adf3bf1f7f76..6d3a016075eb 100644
--- a/pkgs/by-name/gg/gg-jj/package.nix
+++ b/pkgs/by-name/gg/gg-jj/package.nix
@@ -17,24 +17,24 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gg";
-  version = "0.27.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "gulbanana";
     repo = "gg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vmzALX1x7VfdnwN05bCwbnTL+HfFVyNiKFoT74tFuu8=";
+    hash = "sha256-RFNROdPfJksxK5tOP1LOlV/di8AyeJbxwaIoWaZEaVU=";
   };
 
   cargoRoot = "src-tauri";
 
   buildAndTestSubdir = "src-tauri";
 
-  cargoHash = "sha256-esStQ55+T4uLbHbg7P7hqS6kIpXIMxouRSFkTo6dvAU=";
+  cargoHash = "sha256-AdatJNDqIoRHfaf81iFhOs2JGLIxy7agFJj96bFPj00=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-yFDGH33maCndH4vgyMfNg0+c5jCOeoIAWUJgAPHXwsM=";
+    hash = "sha256-izCl3pE15ocEGYOYCUR1iTR+82nDB06Ed4YOGRGByfI=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/gi/gImageReader/package.nix b/pkgs/by-name/gi/gImageReader/package.nix
index 36bdd412d35a..b3fec01f2d3d 100644
--- a/pkgs/by-name/gi/gImageReader/package.nix
+++ b/pkgs/by-name/gi/gImageReader/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   libuuid,
   sane-backends,
-  podofo,
+  podofo_0_10,
   libjpeg,
   djvulibre,
   libxmlxx3,
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
       libzip
       libuuid
       sane-backends
-      podofo
+      podofo_0_10
       libjpeg
       djvulibre
       tesseract
diff --git a/pkgs/by-name/go/go-containerregistry/package.nix b/pkgs/by-name/go/go-containerregistry/package.nix
index cfb94d695d71..7dea9263824e 100644
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -14,13 +14,13 @@ in
 
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.20.5";
+  version = "0.20.6";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-containerregistry";
     rev = "v${version}";
-    sha256 = "sha256-t1OQpXn87OInOmqRx/oFrWkbVmE3nJX/OXH/13cq4CU=";
+    sha256 = "sha256-fmn2SPmYecyKY7HMPjPKvovRS/Ez+SwDe+1maccq4Hc=";
   };
   vendorHash = null;
 
@@ -69,6 +69,9 @@ buildGoModule rec {
     homepage = "https://github.com/google/go-containerregistry";
     license = licenses.asl20;
     mainProgram = "crane";
-    maintainers = with maintainers; [ yurrriq ];
+    maintainers = with maintainers; [
+      yurrriq
+      ryan4yin
+    ];
   };
 }
diff --git a/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix b/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
index e8e221928939..eb476c93d1e9 100644
--- a/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
+++ b/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "google-alloydb-auth-proxy";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "alloydb-auth-proxy";
     tag = "v${version}";
-    hash = "sha256-rM++wipem+CWUbaOxh3BHlNEET7zdUHjPQN8uzZXoGM=";
+    hash = "sha256-NqsIx3+dlDY/WPZJloezZDdFrs/IQ3aqcTKYBD9k3Hk=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-/VxLZoJPr0Mb5ZdyiUF7Yb4BgFef19Vj8Fkydcm7XU8=";
+  vendorHash = "sha256-aRnrn9D561OMlfMQiPwTSUyflozU5D/zzApoITiAH7E=";
 
   checkFlags = [
     "-short"
diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix
index 098363f50f5e..caa4c19a8152 100644
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.0.28";
+  version = "1.0.29";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ExFVgG05jlcz3nP6n94324sgXbIHpj8L30oNuqKyfto=";
+    hash = "sha256-R4hMGW9YKsvWEvSzZKkq5JTzBXGK2rXyOPB6vzMKbs0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sW4rWLElTPVzD+KCOrikEFcoIRGujMz+wHOWlYBpi0o=";
+  cargoHash = "sha256-EEivL+6XQyC9FkGnXwOYviwpY8lk7iaEJ1vbQMk2Rao=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/go/gore/package.nix b/pkgs/by-name/go/gore/package.nix
index c9a1e4d8b5f6..aae50cf1ec2e 100644
--- a/pkgs/by-name/go/gore/package.nix
+++ b/pkgs/by-name/go/gore/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gore";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "motemen";
     repo = "gore";
     rev = "v${version}";
-    sha256 = "sha256-7mhfegSSRE9FnKz+tWYMEtEKc+hayPQE8EEOEu33CjU=";
+    sha256 = "sha256-EPySMj+mQxTJbGheAtzKvQq23DLljPR6COrmytu1x/Q=";
   };
 
-  vendorHash = "sha256-0eCRDlcqZf+RAbs8oBRr+cd7ncWX6fXk/9jd8/GnAiw=";
+  vendorHash = "sha256-W9hMxANySY31X2USbs4o5HssxQfK/ihJ+vCQ/PTyTDc=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix
index cfd1d797ad33..9db1c8eb4302 100644
--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@@ -24,21 +24,19 @@ let
 in
 buildGoModule rec {
   pname = "gotenberg";
-  version = "8.16.0";
+  version = "8.20.1";
 
   src = fetchFromGitHub {
     owner = "gotenberg";
     repo = "gotenberg";
     tag = "v${version}";
-    hash = "sha256-m8aDhfcUa3QFr+7hzlQFL2wPfcx5RE+3dl5RHzWwau0=";
+    hash = "sha256-3+6bdO6rFSyRtRQjXBPefwjuX0AMuGzHNAQas7HNNRE=";
   };
 
-  vendorHash = "sha256-EM+Rpo4Zf+aqA56aFeuQ0tbvpTgZhmfv+B7qYI6PXWc=";
+  vendorHash = "sha256-qZ4cgVZAmjIwXhtQ7DlAZAZxyXP89ZWafsSUPQE0dxE=";
 
   postPatch = ''
     find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \;
-    substituteInPlace pkg/gotenberg/fs_test.go \
-      --replace-fail "/tmp" "/build"
   '';
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
index 3eddcbf947d8..c31a93d3917a 100644
--- a/pkgs/by-name/gr/grafana-loki/package.nix
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -82,6 +82,7 @@ buildGoModule rec {
       globin
       mmahut
       emilylange
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/gr/gramps/package.nix b/pkgs/by-name/gr/gramps/package.nix
index 657b11d017bb..68f3e0178d23 100644
--- a/pkgs/by-name/gr/gramps/package.nix
+++ b/pkgs/by-name/gr/gramps/package.nix
@@ -23,7 +23,7 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  version = "6.0.2";
+  version = "6.0.3";
   pname = "gramps";
   pyproject = true;
 
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
     owner = "gramps-project";
     repo = "gramps";
     tag = "v${version}";
-    hash = "sha256-ivOa45NNw6h+QxPvN+2fOoQOU6t+HYslR4t9vA+xTic=";
+    hash = "sha256-dmokrAN6ZC7guMYHifNifL9rXqZPW+Z5LudQhIUxMs8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index b967b6262200..375f1b011380 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.4",
+      "version": "1.6.5",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index f91780ad5067..ca661d8f1743 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -8,14 +8,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-NxqqYghE9QNbO8VdBH4MsUomeRUvYNRijQMqrlE7/II=";
+    hash = "sha256-Z1lJUKe1fET4Xj2bmxCbH2abH/hX6BEtWFD+HC2w2iw=";
   };
 
-  npmDepsHash = "sha256-LDSn5lIEHRyYyicP6b7/CTs5VivzcspeCUQzR+BqrS0=";
+  npmDepsHash = "sha256-lN7mg2gNFXuQ39hbjG7kVvDhPF6mWg3E6dszywbKHZo=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/ha/hamrs-pro/package.nix b/pkgs/by-name/ha/hamrs-pro/package.nix
index 7a5892872064..3e130e99a2bb 100644
--- a/pkgs/by-name/ha/hamrs-pro/package.nix
+++ b/pkgs/by-name/ha/hamrs-pro/package.nix
@@ -8,29 +8,29 @@
 
 let
   pname = "hamrs-pro";
-  version = "2.39.0";
+  version = "2.40.0";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-cLjsJlSfwmpzB7Ef/oSMbrRr4PEklpnOHouiAs/X0Gg=";
+      hash = "sha256-DUqaF8DQu+iSpC6nnHT7l7kurN/L9yAhKOF47khkoDw=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-MisWOfSpeh48W9/3+lZVYzDoU2ZvGb8sMmLE1qfStSo=";
+      hash = "sha256-YloMNPvtprJzQ5/w0I9n7DtQLqyuzgVnQ60Yf6ueOjk=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-lThk5DRva93/IxfCfr3f3VKUCaLnrAH7L/I1BBc0whE=";
+      hash = "sha256-wgCXf6vTWZtlRjZCJYb5xYuWk7bpqiCDxVCTWR2ASxc=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-xZqC0enG/b7LSE8OzhVWPR1Rz50gjaAWDxT6UFdO3Wc=";
+      hash = "sha256-WOWIjeQtOGwpa/vR8n/irzU491C5sb0VUKn1vBckpvs=";
     };
   };
 
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 0775cf4535d9..4e3656d2b61a 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.42.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-qzNH8qGpSNtGQqce3E/mEQoJUP2mQsQ8ntTi9F3ol1I=";
+    hash = "sha256-7sF2hwj4Gnca8QVociECKY+8grIDwcUoK9Zpx5YdNr0=";
   };
 
   buildAndTestSubdir = "harper-ls";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PxYRQ6nYHXXgxb8YXkm57wIFXQrF5+cdEHA+CMk22wg=";
+  cargoHash = "sha256-SnwmXBt3wqsZPfKu3FIura8/y9MfU8VUKYRisdlcNXE=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/he/helm-ls/package.nix b/pkgs/by-name/he/helm-ls/package.nix
index c37c826fde54..2025b4c41448 100644
--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "helm-ls";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "mrjosh";
     repo = "helm-ls";
     rev = "v${version}";
-    hash = "sha256-yiPHIr1jzzk4WFjGJjeroHJWY8zP3ArrJVzb4+dPm7I=";
+    hash = "sha256-z+gSD7kcDxgJPoYQ7HjokJONjgAAuIIkg1VGyV3v01k=";
   };
 
   vendorHash = "sha256-w/BWPbpSYum0SU8PJj76XiLUjTWO4zNQY+khuLRK0O8=";
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index 1f6767fca16b..ecf415b0da8c 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "25.5.1-0";
+  version = "25.5.3-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-03WSc4/udaShc9te7Xv09gCgMv9i2/WvK55mpj4AK5k=";
+          hash = "sha256-EhwTQ52xUCLSApV2vNo4AqnAznaDaSWDt339pmwJvYU=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-1D/ZW+KxbmJtt62uQOdZZwiKk+6r1hhviwe7CZxaXns=";
+          hash = "sha256-A0Ss6JLcHaH5p7TQ67TVAAre+nt82hxVgZZgFvoBWzA=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-REj9VtAggS6PcGSh3K+GByxhUk6elKoHsSck42U9IdA=";
+          hash = "sha256-r+gi/vVkVY0QIqunnrDOk6k+Fa/6UOMMGxYdnj4SnIA=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/ho/horizon-eda/base.nix b/pkgs/by-name/ho/horizon-eda/base.nix
index c3eb3d959dbd..2c9c6c652a20 100644
--- a/pkgs/by-name/ho/horizon-eda/base.nix
+++ b/pkgs/by-name/ho/horizon-eda/base.nix
@@ -15,7 +15,7 @@
   ninja,
   opencascade-occt_7_6,
   pkg-config,
-  podofo,
+  podofo_0_10,
   sqlite,
 }:
 let
@@ -51,7 +51,7 @@ rec {
     librsvg
     libuuid
     opencascade-occt
-    podofo
+    podofo_0_10
     sqlite
   ];
 
diff --git a/pkgs/by-name/hu/hurl/package.nix b/pkgs/by-name/hu/hurl/package.nix
index b1afe82a5f02..6a273a9db1bc 100644
--- a/pkgs/by-name/hu/hurl/package.nix
+++ b/pkgs/by-name/hu/hurl/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   installShellFiles,
   libxml2,
@@ -24,6 +25,16 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-WyNActmsHpr5fgN1a3X9ApEACWFVJMVoi4fBvKhGgZ0=";
 
+  patches = [
+    # Fix build with libxml-2.14, remove after next hurl release
+    # https://github.com/Orange-OpenSource/hurl/pull/3977
+    (fetchpatch2 {
+      name = "fix-libxml_2_14";
+      url = "https://github.com/Orange-OpenSource/hurl/commit/7c7b410c3017aeab0dfc74a6144e4cb8e186a10a.patch?full_index=1";
+      hash = "sha256-XjnCRIMwzfgUMIhm6pQ90pzA+c2U0EuhyvLUZDsI2GI=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     installShellFiles
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
new file mode 100644
index 000000000000..2d52a4de3a5a
--- /dev/null
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -0,0 +1,127 @@
+{
+  lib,
+  config,
+  ags,
+  astal,
+  bluez,
+  bluez-tools,
+  brightnessctl,
+  btop,
+  dart-sass,
+  fetchFromGitHub,
+  glib,
+  glib-networking,
+  gnome-bluetooth,
+  gpu-screen-recorder,
+  gpustat,
+  grimblast,
+  gtksourceview3,
+  gvfs,
+  hyprpicker,
+  libgtop,
+  libnotify,
+  libsoup_3,
+  matugen,
+  networkmanager,
+  nix-update-script,
+  python3,
+  pywal,
+  stdenv,
+  swww,
+  upower,
+  wireplumber,
+  wl-clipboard,
+  writeShellScript,
+
+  enableCuda ? config.cudaSupport,
+}:
+ags.bundle {
+  pname = "hyprpanel";
+  version = "0-unstable-2025-06-20";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "Jas-SinghFSU";
+    repo = "HyprPanel";
+    rev = "d563cdb1f6499d981901336bd0f86303ab95c4a5";
+    hash = "sha256-oREAoOQeAExqWMkw2r3BJfiaflh7QwHFkp8Qm0qDu6o=";
+  };
+
+  # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
+  dependencies = [
+    astal.apps
+    astal.battery
+    astal.bluetooth
+    astal.cava
+    astal.hyprland
+    astal.mpris
+    astal.network
+    astal.notifd
+    astal.powerprofiles
+    astal.tray
+    astal.wireplumber
+
+    bluez
+    bluez-tools
+    brightnessctl
+    btop
+    dart-sass
+    glib
+    gnome-bluetooth
+    grimblast
+    gtksourceview3
+    gvfs
+    hyprpicker
+    libgtop
+    libnotify
+    libsoup_3
+    matugen
+    networkmanager
+    pywal
+    swww
+    upower
+    wireplumber
+    wl-clipboard
+    (python3.withPackages (
+      ps:
+      with ps;
+      [
+        dbus-python
+        pygobject3
+      ]
+      ++ lib.optional enableCuda gpustat
+    ))
+  ] ++ (lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [ gpu-screen-recorder ]);
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  postFixup =
+    let
+      script = writeShellScript "hyprpanel" ''
+        export GIO_EXTRA_MODULES='${glib-networking}/lib/gio/modules'
+        if [ "$#" -eq 0 ]; then
+          exec @out@/bin/.hyprpanel
+        else
+          exec ${astal.io}/bin/astal -i hyprpanel "$*"
+        fi
+      '';
+    in
+    # bash
+    ''
+      mv "$out/bin/hyprpanel" "$out/bin/.hyprpanel"
+      cp '${script}' "$out/bin/hyprpanel"
+      substituteInPlace "$out/bin/hyprpanel" \
+        --replace-fail '@out@' "$out"
+    '';
+
+  meta = {
+    description = "Bar/Panel for Hyprland with extensive customizability";
+    homepage = "https://github.com/Jas-SinghFSU/HyprPanel";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ perchun ];
+    mainProgram = "hyprpanel";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index 8e4daab9e84b..63a8d07dbf78 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-05-18";
+  version = "0.1-unstable-2025-06-19";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "910dad4c5755c1735d30da10c96d9086aa2a608d";
-    hash = "sha256-PMQoXbfmWPuXnF8EaWqRmvTvl7+WFUrDVgufFRPgOM4=";
+    rev = "189f32f56285aae9646bf1292976392beba5a2e2";
+    hash = "sha256-LPwgPRBTfnA76rHUr7KYvwq2pNt5IfxymNAZUJFvn/M=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";
diff --git a/pkgs/by-name/hy/hyprshot/package.nix b/pkgs/by-name/hy/hyprshot/package.nix
index 98666e17b84e..39a222d51ae6 100644
--- a/pkgs/by-name/hy/hyprshot/package.nix
+++ b/pkgs/by-name/hy/hyprshot/package.nix
@@ -52,7 +52,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/Gustash/hyprshot";
     description = "Hyprshot is an utility to easily take screenshots in Hyprland using your mouse";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ Cryolitia ];
+    maintainers = with maintainers; [
+      Cryolitia
+      ryan4yin
+    ];
     mainProgram = "hyprshot";
     platforms = hyprland.meta.platforms;
   };
diff --git a/pkgs/by-name/in/intentrace/package.nix b/pkgs/by-name/in/intentrace/package.nix
index d7f6f4dfcf7a..87cd28afa0c4 100644
--- a/pkgs/by-name/in/intentrace/package.nix
+++ b/pkgs/by-name/in/intentrace/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.10.3";
+  version = "0.10.4";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
     owner = "sectordistrict";
     repo = "intentrace";
     tag = "v${version}";
-    hash = "sha256-mCMARX6y9thgYJpDRFnWGZJupdk+EhVaBGbwABYYjNA=";
+    hash = "sha256-zVRH6uLdBXI6VTu/R3pTNCjfx25089bYYTJZdvZIFck=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-BZ+P6UT9bBuAX9zyZCA+fI2pUtV8b98oPcQDwJV5HC8=";
+  cargoHash = "sha256-1n0fXOPVktqY/H/fPCgl0rA9xZM8QRXvZQgTadfwymo=";
 
   meta = {
     description = "Prettified Linux syscall tracing tool (like strace)";
diff --git a/pkgs/by-name/io/ioq3-scion/package.nix b/pkgs/by-name/io/ioq3-scion/package.nix
index b78ef09367ee..b4960e84e9fc 100644
--- a/pkgs/by-name/io/ioq3-scion/package.nix
+++ b/pkgs/by-name/io/ioq3-scion/package.nix
@@ -7,7 +7,7 @@
 }:
 ioquake3.overrideAttrs (old: {
   pname = "ioq3-scion";
-  version = "unstable-2024-03-03";
+  version = "unstable-2024-12-14";
   buildInputs = old.buildInputs ++ [
     pan-bindings
     libsodium
@@ -15,8 +15,8 @@ ioquake3.overrideAttrs (old: {
   src = fetchFromGitHub {
     owner = "lschulz";
     repo = "ioq3-scion";
-    rev = "9f06abd5030c51cd4582ba3d24ba87531e3eadbc";
-    hash = "sha256-+zoSlNT+oqozQFnhA26PiMo1NnzJJY/r4tcm2wOCBP0=";
+    rev = "a21c257b9ad1d897f6c31883511c3f422317aa0a";
+    hash = "sha256-CBy3Av/mkFojXr0tAXPRWKwLeQJPebazXQ4wzKEmx0I=";
   };
   meta = {
     description = "ioquake3 with support for path aware networking";
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index f1b2db0e39cf..547f953eb665 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-06-02";
+  version = "1.21.1-unstable-2025-06-17";
 
   nativeBuildInputs = [
     mtools
@@ -65,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "5b3ebf8b24ae40a6f9f9f78491702d508f843e56";
-    hash = "sha256-uGR82lR6gpp6IKBVDsKYLtovnbTiWg3RgbVQt6mug+I=";
+    rev = "60e167c00b138fdb162e7b2192e9cbb196ed3cbd";
+    hash = "sha256-RaYu3gvqAxA+vEJdLOLMbCRtrt+PyrRd/Wqyj2hXYZU=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.
diff --git a/pkgs/by-name/is/istioctl/package.nix b/pkgs/by-name/is/istioctl/package.nix
index 6f711670e219..377caeb96607 100644
--- a/pkgs/by-name/is/istioctl/package.nix
+++ b/pkgs/by-name/is/istioctl/package.nix
@@ -7,15 +7,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.26.1";
+  version = "1.26.2";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    hash = "sha256-+sLObdWGl4wTLzqA4EImRDB6R6Ted9hEJKs0CPYkFxA=";
+    hash = "sha256-6wKcDVlLRyr5EuVUFtPPC2Z3+J/6tgXp+ER14wq4eec=";
   };
-  vendorHash = "sha256-K3fUJexe/mTViRX5UEhJM5sPQ/J5fWjMIJUovpaUV+w=";
+  vendorHash = "sha256-BOqlu5OLtcOcT82TmZvo5hCcVdcI6ZRvcKn5ULQXOc4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -57,6 +57,7 @@ buildGoModule rec {
     maintainers = with maintainers; [
       bryanasdev000
       veehaitch
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/jf/jfrog-cli/package.nix b/pkgs/by-name/jf/jfrog-cli/package.nix
index 172b8b5b1434..89c944735b6e 100644
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.76.1";
+  version = "2.77.0";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${version}";
-    hash = "sha256-d8TL6sJIXooMnQ2UMonNcsZ68VrnlfzcM0BhxwOaVa0=";
+    hash = "sha256-CUmx2hQppay8S+zBs4XEXle8pF5mVXPyCJhtYyZ1N8M=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-Bz2xlx1AlCR8xY8KO2cVguyUsoQiQO60XAs5T6S9Ays=";
+  vendorHash = "sha256-TmOzexlojVF+9WqbEVzKFfbdgjGVzyBgeKjFEX5UobI=";
 
   checkFlags = "-skip=^TestReleaseBundle";
 
diff --git a/pkgs/by-name/jq/jq-lsp/package.nix b/pkgs/by-name/jq/jq-lsp/package.nix
index 428947a998f1..aa9d88be95eb 100644
--- a/pkgs/by-name/jq/jq-lsp/package.nix
+++ b/pkgs/by-name/jq/jq-lsp/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "jq-lsp";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "jq-lsp";
     tag = "v${version}";
-    hash = "sha256-rq6AZsRwCWCIqLH78mOAA2tWa66ys78hRCxnNSXxegc=";
+    hash = "sha256-Oa9MuE6nUaxAlKeFnx4qjPldDfmLrbBraFkUsp5K5gY=";
   };
 
   vendorHash = "sha256-8sZGnoP7l09ZzLJqq8TUCquTOPF0qiwZcFhojUnnEIY=";
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index 29d2b6246674..2ce78f85a987 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -116,6 +116,7 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [
       xrelkd
       jk
+      ryan4yin
     ];
     mainProgram = "just";
   };
diff --git a/pkgs/by-name/k9/k9s/package.nix b/pkgs/by-name/k9/k9s/package.nix
index 6160f1db8478..e0f3491d2726 100644
--- a/pkgs/by-name/k9/k9s/package.nix
+++ b/pkgs/by-name/k9/k9s/package.nix
@@ -76,6 +76,7 @@ buildGoModule rec {
       bryanasdev000
       qjoly
       devusb
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix
index 2cd565874e0f..53bcc3f445a3 100644
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@@ -2,28 +2,50 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  stdenv,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kdlfmt";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
-    rev = "v${version}";
-    hash = "sha256-qc2wU/borl3h2fop6Sav0zCrg8WdvHrB3uMA72uwPis=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xDv93cxCEaBybexleyTtcCCKHy2OL3z/BG2gJ7uqIrU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xoOnFJqDucg3fUDx5XbXsZT4rSjZhzt5rNbH+DZ1kGA=";
+  cargoHash = "sha256-TwZ/0G3lTCoj01e/qGFRxJCfe4spOpG/55GKhoI0img=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd kdlfmt \
+      --bash <($out/bin/kdlfmt completions bash) \
+      --fish <($out/bin/kdlfmt completions fish) \
+      --zsh <($out/bin/kdlfmt completions zsh)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Formatter for kdl documents";
-    homepage = "https://github.com/hougesen/kdlfmt.git";
-    changelog = "https://github.com/hougesen/kdlfmt/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/hougesen/kdlfmt";
+    changelog = "https://github.com/hougesen/kdlfmt/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ airrnot ];
+    maintainers = with lib.maintainers; [
+      airrnot
+      defelo
+    ];
     mainProgram = "kdlfmt";
   };
-}
+})
diff --git a/pkgs/by-name/ko/kor/package.nix b/pkgs/by-name/ko/kor/package.nix
index 3007eb00f265..75fe3f53e182 100644
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = "kor";
     rev = "v${version}";
-    hash = "sha256-jqP2GsqliltjabbHDcRseMz7TOWl9YofAG/4Y7ADub8=";
+    hash = "sha256-/UeZBFLSAR6hnXGQyOV6Y7O7PaG7tXelyqS6SeFN+3M=";
   };
 
-  vendorHash = "sha256-HZS1PPlra1uGBuerGs5X9poRzn7EGhTopKaC9tkhjlo=";
+  vendorHash = "sha256-VJ5Idm5p+8li5T7h0ueLIYwXKJqe6uUZ3dL5U61BPFg=";
 
   preCheck = ''
     HOME=$(mktemp -d)
diff --git a/pkgs/by-name/kr/krillinai/package.nix b/pkgs/by-name/kr/krillinai/package.nix
index 35afea0b1aa1..a6679a3dfa37 100644
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.2.1-hotfix-2";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KrillinAI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dw30Lsf4pHMDlrLmdoU+4v5SJfzx5UId6v/OocrsiS4=";
+    hash = "sha256-RHlQeTFeG23LjLwczSGIghH3XPFTR6ZVDFk2KlRQGoA=";
   };
 
-  vendorHash = "sha256-14YNdIfylUpcWqHhrpgmjxBHYRXaoR59jb1QdTckuLY=";
+  vendorHash = "sha256-PN0ntMoPG24j3DrwuIiYHo71QmSU7u/A9iZ5OruIV/w=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ks/kstars/package.nix b/pkgs/by-name/ks/kstars/package.nix
index 57f39ef79967..8c617b0f1e34 100644
--- a/pkgs/by-name/ks/kstars/package.nix
+++ b/pkgs/by-name/ks/kstars/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   cfitsio,
   cmake,
   curl,
@@ -23,20 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kstars";
-  version = "3.7.6";
+  version = "3.7.7";
 
   src = fetchurl {
     url = "mirror://kde/stable/kstars/${finalAttrs.version}/kstars-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6hwWMmAGKJmldL8eTLQzzBsumk5thFoqGvm2dWk0Jpo=";
+    hash = "sha256-8tvWwmxFUSqnw5JPC/Bgao75eORoxUUF3MDLL+EgAkU=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://invent.kde.org/education/kstars/-/commit/92eb37bdb3e24bd06e6da9977f3bf76218c95339.diff";
-      hash = "sha256-f2m15op48FiPYsKJ7WudlejVwoiGYWGnX2QiCnBINU8=";
-    })
-  ];
-
   nativeBuildInputs = with kdePackages; [
     extra-cmake-modules
     kdoctools
diff --git a/pkgs/by-name/ku/kubeseal/package.nix b/pkgs/by-name/ku/kubeseal/package.nix
index 8e35335b8ea2..6b2f051fd735 100644
--- a/pkgs/by-name/ku/kubeseal/package.nix
+++ b/pkgs/by-name/ku/kubeseal/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "sha256-unPqjheT8/2gVQAwvzOvHtG4qTqggf9o0M5iLwl1eh4=";
+    sha256 = "sha256-lcRrLzM+/F5PRcLbrUjAjoOp35TRlte00QuWjKk1PrY=";
   };
 
-  vendorHash = "sha256-4BseFdfJjR8Th+NJ82dYsz9Dym1hzDa4kB4bpy71q7Q=";
+  vendorHash = "sha256-JpPfj8xZ1jmawazQ9LmkuxC5L2xIdLp4E43TpD+p71o=";
 
   subPackages = [ "cmd/kubeseal" ];
 
diff --git a/pkgs/by-name/le/leetgo/package.nix b/pkgs/by-name/le/leetgo/package.nix
index 9d5250d93ba3..12cb24a61efb 100644
--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "leetgo";
-  version = "1.4.13";
+  version = "1.4.14";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "leetgo";
     rev = "v${version}";
-    hash = "sha256-KEfRsaBsMCKO66HW71gNzHzZkun1yo6a05YqAvafomM=";
+    hash = "sha256-RRKQlCGVE8/RS1jPZBmzDXrv0dTW1zKR5mugByfIzsU=";
   };
 
-  vendorHash = "sha256-pdGsvwEppmcsWyXxkcDut0F2Ak1nO42Hnd36tnysE9w=";
+  vendorHash = "sha256-VNJe+F/lbW+9fX6Fie91LLSs5H4Rn+kmHhsMd5mbYtA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/li/libcava/package.nix b/pkgs/by-name/li/libcava/package.nix
index 4bb2d772936c..cd0516a98fe4 100644
--- a/pkgs/by-name/li/libcava/package.nix
+++ b/pkgs/by-name/li/libcava/package.nix
@@ -8,13 +8,13 @@
 cava.overrideAttrs (old: rec {
   pname = "libcava";
   # fork may not be updated when we update upstream
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "LukashonakV";
     repo = "cava";
     tag = version;
-    hash = "sha256-ZDFbI69ECsUTjbhlw2kHRufZbQMu+FQSMmncCJ5pagg=";
+    hash = "sha256-9eTDqM+O1tA/3bEfd1apm8LbEcR9CVgELTIspSVPMKM=";
   };
 
   nativeBuildInputs = old.nativeBuildInputs ++ [
diff --git a/pkgs/by-name/li/libvncserver/package.nix b/pkgs/by-name/li/libvncserver/package.nix
index ecaceb3c56ad..5daa8e6d1f17 100644
--- a/pkgs/by-name/li/libvncserver/package.nix
+++ b/pkgs/by-name/li/libvncserver/package.nix
@@ -44,8 +44,17 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
     (lib.cmakeBool "BUILD_SHARED_LIBS" enableShared)
     (lib.cmakeBool "WITH_EXAMPLES" buildExamples)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
+  # This test checks if using the **installed** headers works.
+  # As it doesn't set the include paths correctly, and we have nixpkgs-review to check if
+  # packages continue to build, patching it would serve no purpose, so we can just remove the test entirely.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'add_test(NAME includetest COMMAND' '# add_test(NAME includetest COMMAND'
+  '';
+
   buildInputs =
     [
       libjpeg
@@ -61,6 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
+  doCheck = enableShared;
+
   meta = with lib; {
     description = "VNC server library";
     homepage = "https://libvnc.github.io/";
diff --git a/pkgs/by-name/li/lintspec/package.nix b/pkgs/by-name/li/lintspec/package.nix
index d403c207cbf7..0c0f75e5ece6 100644
--- a/pkgs/by-name/li/lintspec/package.nix
+++ b/pkgs/by-name/li/lintspec/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lintspec";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "lintspec";
     tag = "v${version}";
-    hash = "sha256-I9u4fS3K3tPgr15lAEkBQO1KXSNPAu3aiM9Qo9IRuHE=";
+    hash = "sha256-xT+2gDaKwjnBZBmeY/5UDka/EFodRGflb433BfDeuuk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-wTR4E+Pbx0ReeVav/ECklS8on0v5aYvFqE+FZhieRHk=";
+  cargoHash = "sha256-r9CRu0zLvsllo3v8E1C8VxmsMbhOQxY8H/imZt04Nok=";
 
   meta = {
     description = "Blazingly fast linter for NatSpec comments in Solidity code";
diff --git a/pkgs/by-name/li/linux-firmware/package.nix b/pkgs/by-name/li/linux-firmware/package.nix
index e1a6f4e9fade..0d5d85f58ec5 100644
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -1,6 +1,6 @@
 {
   stdenvNoCC,
-  fetchzip,
+  fetchFromGitLab,
   lib,
   python3,
   rdfind,
@@ -22,11 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20250613";
+  version = "20250621"; # not a real tag, but the current stable tag breaks some AMD GPUs entirely
 
-  src = fetchzip {
-    url = "https://cdn.kernel.org/pub/linux/kernel/firmware/linux-firmware-${version}.tar.xz";
-    hash = "sha256-qygwQNl99oeHiCksaPqxxeH+H7hqRjbqN++Hf9X+gzs=";
+  src = fetchFromGitLab {
+    owner = "kernel-firmware";
+    repo = "linux-firmware";
+    rev = "49c833a10ad96a61a218d28028aed20aeeac124c";
+    hash = "sha256-Pz/k/ol0NRIHv/AdridwoBPDLsd0rfDAj31Paq4mPpU=";
   };
 
   postUnpack = ''
@@ -57,5 +59,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with maintainers; [ fpletz ];
     priority = 6; # give precedence to kernel firmware
   };
-  passthru.updateScript = ./update.sh;
 }
diff --git a/pkgs/by-name/li/linux-firmware/update.sh b/pkgs/by-name/li/linux-firmware/update.sh
deleted file mode 100755
index 7886e93571ab..000000000000
--- a/pkgs/by-name/li/linux-firmware/update.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p git -p common-updater-scripts
-
-set -eu -o pipefail
-
-repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
-
-revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
-
-update-source-version linux-firmware "$revision"
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index 60a0e49cfa79..84d8502d773a 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.678";
+  version = "0.679";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-FYh7LTLDdl3eYXRDAn+FDkqBCiWY0JqHrX9lbz5r+gI=";
+    hash = "sha256-PLYiGMdXA/PFZaOOv/fmRjU5b9fNmvUoExNjFq81tto=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 077dc9dd00c7..8a6453fc5ce7 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -17,18 +17,18 @@
 rustPlatform.buildRustPackage rec {
   pname = "lux-cli";
 
-  version = "0.7.1";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nvim-neorocks";
     repo = "lux";
-    tag = "v0.7.1";
-    hash = "sha256-x5Bs/Zq0gfJAC3VFKG1hCg95IZ0qpgf8kBfFccP5HgU=";
+    tag = "v0.7.3";
+    hash = "sha256-d/WznA6BRduQJOFlE+ll1H7XtGXs9BPrhAKST09Lh0s=";
   };
 
   buildAndTestSubdir = "lux-cli";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lGQToe1nM6tjcoxYy94wiGMevm3/B7MD6NOIX61GpMA=";
+  cargoHash = "sha256-B1Fu5KWLL/XuUvIROPh0huLw4/OHe/c+LC0/gRFpBnc=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index 7904f82f9503..6f84e60cb1de 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.16.10",
-    "hash": "sha256-H3RW2SikKCYhmDsoID5Kye9qq6lAbuu8tedzCHuybis="
+    "version": "5.18.1",
+    "hash": "sha256-B4klaET6YT955p606aSky5tePGhpinRCqc3gMB+uaZY="
   },
   "beta": {
-    "version": "5.17.0-beta.1",
-    "hash": "sha256-qBfy7M5jqf4aPT5kcdzLm6HFZKn8KfYeZVaZvfY9rAg="
+    "version": "5.18.1",
+    "hash": "sha256-B4klaET6YT955p606aSky5tePGhpinRCqc3gMB+uaZY="
   }
 }
diff --git a/pkgs/by-name/ma/manga-tui/package.nix b/pkgs/by-name/ma/manga-tui/package.nix
index 4c2da99f92a4..836934dc461c 100644
--- a/pkgs/by-name/ma/manga-tui/package.nix
+++ b/pkgs/by-name/ma/manga-tui/package.nix
@@ -10,7 +10,7 @@
   nix-update-script,
 }:
 let
-  version = "0.8.0";
+  version = "0.8.1";
 in
 rustPlatform.buildRustPackage {
   pname = "manga-tui";
@@ -20,11 +20,11 @@ rustPlatform.buildRustPackage {
     owner = "josueBarretogit";
     repo = "manga-tui";
     rev = "v${version}";
-    hash = "sha256-81P5LwL9njxA0qx4FvqgrHdqVgUXkZTTzAXLdRTftS4=";
+    hash = "sha256-CAmXTAUlwdc4iGzXonoYPd1okqgA4hWgR9bnsPsuDus=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-dne0sJ0K/UVXGaj/vUM9O++ZS0hu69bdLnV8VAr3tbM=";
+  cargoHash = "sha256-viiL1LcBbWuKA+jgkAPc9gpI7wQu4UXfO5DSPm26ido=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix
index 17e9f15247b6..781cf8669be0 100644
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdns-scanner";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "CramBL";
     repo = "mdns-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I0/ms1FFTGgSk101GBascTSMBCLAmzqk2yiNYskedvU=";
+    hash = "sha256-86GpBjgfBMkqzoWPEbjQM6PvSEb67A8nL7sEtplXoic=";
   };
 
-  cargoHash = "sha256-JdeIEaSfiMCQ9n3Y4DpTWhheHaA54zJKUsG/e4Xo9LU=";
+  cargoHash = "sha256-z0IHONtU1pgViQZu0Q2fZVjdJ6sSlgnIw83hqWLKfVM=";
 
   meta = {
     homepage = "https://github.com/CramBL/mdns-scanner";
diff --git a/pkgs/by-name/mi/minio-client/package.nix b/pkgs/by-name/mi/minio-client/package.nix
index 71372676733d..fa5ae7a74d9d 100644
--- a/pkgs/by-name/mi/minio-client/package.nix
+++ b/pkgs/by-name/mi/minio-client/package.nix
@@ -36,7 +36,10 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/minio/mc";
     description = "Replacement for ls, cp, mkdir, diff and rsync commands for filesystems and object storage";
-    maintainers = with maintainers; [ bachp ];
+    maintainers = with maintainers; [
+      bachp
+      ryan4yin
+    ];
     mainProgram = "mc";
     license = licenses.asl20;
   };
diff --git a/pkgs/by-name/mk/mkvtoolnix/package.nix b/pkgs/by-name/mk/mkvtoolnix/package.nix
index c0ff5eb5cc3b..8ee0bb3b28a7 100644
--- a/pkgs/by-name/mk/mkvtoolnix/package.nix
+++ b/pkgs/by-name/mk/mkvtoolnix/package.nix
@@ -52,14 +52,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mkvtoolnix";
-  version = "92.0";
+  version = "93.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mbunkus";
     repo = "mkvtoolnix";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-3yiQRGkjvOz80G6s39JHzqytxvGDmV9Lqs5bMxTAejo=";
+    hash = "sha256-xCO5wKZO2fcO6+KhPO5+OpOvAFuqOuQ2A3V+LzFYLNY=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/mo/mozillavpn/package.nix b/pkgs/by-name/mo/mozillavpn/package.nix
index 22487b17c307..4fc9428ab227 100644
--- a/pkgs/by-name/mo/mozillavpn/package.nix
+++ b/pkgs/by-name/mo/mozillavpn/package.nix
@@ -4,7 +4,6 @@
   cargo,
   cmake,
   fetchFromGitHub,
-  fetchpatch,
   go,
   lib,
   libcap,
@@ -23,36 +22,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mozillavpn";
-  version = "2.27.0";
+  version = "2.29.0";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-TfiEc5Lptr0ntp4buEEWbQTvNkVjZbdMWDv8CEZa6IM=";
+    hash = "sha256-Oh3qV5/fQNLjv3qnhRrgRV0d+homlGmEpTSeou3lZfE=";
   };
-  patches = [
-    # Provide default args for LottieStatus::changed so moc can call it (#10420)
-    (fetchpatch {
-      url = "https://github.com/mozilla-mobile/mozilla-vpn-client/commit/e5abe5714a5b506e398c088d21672f00d6f93240.patch";
-      hash = "sha256-DU5wQ1DDF8DbmMIlohoEIDJ7/9+9GVwrvsr51T9bGx8=";
-    })
-    # Remove Qt.labls.qmlmodels usage (#10422)
-    (fetchpatch {
-      url = "https://github.com/mozilla-mobile/mozilla-vpn-client/commit/4497972b1bf7b7f215dc6c1227d76d6825f5b958.patch";
-      hash = "sha256-RPRdARM/jXSHmTGGjiOrfJ7KVejp3JmUfsN5pmKYPuY=";
-    })
-    # Qt compat: Make sure to include what we use
-    (fetchpatch {
-      url = "https://github.com/mozilla-mobile/mozilla-vpn-client/commit/0909d43447a7ddbc6ec20d108637524552848bd6.patch";
-      hash = "sha256-Hpn69hQxa269XH+Ku/MYD2GwdFhfCX4yoVRCEDfIOKc=";
-    })
-    # Use QDesktopUnixServices after qt 6.9.0
-    (fetchpatch {
-      url = "https://github.com/mozilla-mobile/mozilla-vpn-client/pull/10424/commits/81e66044388459ffe2b08804ab5a326586ac7113.patch";
-      hash = "sha256-+v3NoTAdkjKEyBPbbJZQ2d11hJMyE3E4B9uYUerVa7c=";
-    })
-  ];
+  patches = [ ];
 
   netfilter = buildGoModule {
     pname = "${finalAttrs.pname}-netfilter";
@@ -67,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-SGC+YT5ATV/ZaP/wrm3c31OQBw6Pk8ZSXjxEPFdP2f8=";
+    hash = "sha256-Flsa93Nko/sHr9z+YW7xDFMVLOzJE4oJFAl841gpPpw=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mx/mxt-app/package.nix b/pkgs/by-name/mx/mxt-app/package.nix
index 58b61e7fbc00..249194054eed 100644
--- a/pkgs/by-name/mx/mxt-app/package.nix
+++ b/pkgs/by-name/mx/mxt-app/package.nix
@@ -7,14 +7,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.44";
+  version = "1.45";
   pname = "mxt-app";
 
   src = fetchFromGitHub {
     owner = "atmel-maxtouch";
     repo = "mxt-app";
     rev = "v${version}";
-    sha256 = "sha256-JE8rI1dkbrPXCbJI9cK/w5ugndPj6rO0hpyfwiSqmLc=";
+    sha256 = "sha256-kMVNakIzqGvT2+7plNsiqPdQ+0zuS7gh+YywF0hA1H4=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index ea16f7253518..1ad6858bcc4a 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.421";
+  version = "0.0.425";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-4Gsj4BlPCjSRY/b6UeSaTwTFw9xFTvK1u08cIwPjPaY=";
+    hash = "sha256-HO6aSZg6M0OE5OLzKOIJLtDEz9Ow16xlw+dQfsFm/Qs=";
   };
 
-  vendorHash = "sha256-hPZmNH4bhIds+Ps0pQCjYPfvVBaX8e3Bq/onq91Fzq8=";
+  vendorHash = "sha256-Xmd8OTW/1MfRWItcx/a13BV993aVWnsvkcTwr/ROS4w=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index e6b2cf60e7ac..0a8cf83182df 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.20.0";
+  version = "7.20.1";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    hash = "sha256-lK7jAECLAL/VX3K7AZEwxkQCRRn2ggRNBAeNPv5x35I=";
+    hash = "sha256-926M5Tg1XWZR++neCou/uy1RtLeIbqHdA1vHaJv/e9o=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/nc/ncdu/package.nix b/pkgs/by-name/nc/ncdu/package.nix
index 1db1c17fb6b2..290a01bb35fb 100644
--- a/pkgs/by-name/nc/ncdu/package.nix
+++ b/pkgs/by-name/nc/ncdu/package.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
       pSub
       rodrgz
       defelo
+      ryan4yin
     ];
     inherit (zig_0_14.meta) platforms;
     mainProgram = "ncdu";
diff --git a/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix b/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix
index 0869c97cef34..dcd787b834fb 100644
--- a/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix
+++ b/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix
@@ -8,16 +8,16 @@
 }:
 buildNpmPackage rec {
   pname = "nextcloud-whiteboard-server";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = "whiteboard";
     tag = "v${version}";
-    hash = "sha256-WdaAMSID8MekVL6nA8YRWUiiI+pi1WgC0nN3dDAJHf8=";
+    hash = "sha256-zqJL/eeTl1cekLlJess2IH8piEZpn2ubTB2NRsj8OjQ=";
   };
 
-  npmDepsHash = "sha256-T27oZdvITj9ZCEvd13fDZE3CS35XezgVmQ4iCeN75UA=";
+  npmDepsHash = "sha256-GdoVwBU/uSk1g+7R2kg8tExAXagdVelaj6xii+NRf/w=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/ni/niri/package.nix b/pkgs/by-name/ni/niri/package.nix
index 6fd08908d0d7..5aa083245bc9 100644
--- a/pkgs/by-name/ni/niri/package.nix
+++ b/pkgs/by-name/ni/niri/package.nix
@@ -36,6 +36,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-z4viQZLgC2bIJ3VrzQnR+q2F3gAOEQpU1H5xHtX/2fs=";
   };
 
+  outputs = [
+    "out"
+    "doc"
+  ];
+
   postPatch = ''
     patchShebangs resources/niri-session
     substituteInPlace resources/niri.service \
@@ -78,6 +83,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall =
     ''
+      install -Dm0644 README.md resources/default-config.kdl -t $doc/share/doc/niri
+      mv wiki $doc/share/doc/niri/wiki
+
       install -Dm0644 resources/niri.desktop -t $out/share/wayland-sessions
     ''
     + lib.optionalString withDbus ''
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index f89eddab6183..1696e73bb42f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -5,7 +5,6 @@ import os
 import sys
 from pathlib import Path
 from subprocess import CalledProcessError, run
-from textwrap import dedent
 from typing import Final, assert_never
 
 from . import nix, tmpdir
@@ -338,29 +337,6 @@ def validate_image_variant(image_variant: str, variants: ImageVariants) -> None:
         )
 
 
-def validate_nixos_config(path_to_config: Path) -> None:
-    if not (path_to_config / "nixos-version").exists() and not os.environ.get(
-        "NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM"
-    ):
-        msg = dedent(
-            # the lowercase for the first letter below is proposital
-            f"""
-                your NixOS configuration path seems to be missing essential files.
-                To avoid corrupting your current NixOS installation, the activation will abort.
-
-                This could be caused by Nix bug: https://github.com/NixOS/nix/issues/13367.
-                This is the evaluated NixOS configuration path: {path_to_config}.
-                Change the directory to somewhere else (e.g., `cd $HOME`) before trying again.
-
-                If you think this is a mistake, you can set the environment variable
-                NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM to 1
-                and re-run the command to continue.
-                Please open an issue if this is the case.
-            """
-        ).strip()
-        raise NixOSRebuildError(msg)
-
-
 def execute(argv: list[str]) -> None:
     args, args_groups = parse_args(argv)
 
@@ -514,7 +490,6 @@ def execute(argv: list[str]) -> None:
                     copy_flags=copy_flags,
                 )
                 if action in (Action.SWITCH, Action.BOOT):
-                    validate_nixos_config(path_to_config)
                     nix.set_profile(
                         profile,
                         path_to_config,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 77113a093a77..acc9448fec00 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -9,6 +9,7 @@ from importlib.resources import files
 from pathlib import Path
 from string import Template
 from subprocess import PIPE, CalledProcessError
+from textwrap import dedent
 from typing import Final, Literal
 
 from . import tmpdir
@@ -613,6 +614,33 @@ def set_profile(
     sudo: bool,
 ) -> None:
     "Set a path as the current active Nix profile."
+    if not os.environ.get(
+        "NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM"
+    ):
+        r = run_wrapper(
+            ["test", "-f", path_to_config / "nixos-version"],
+            remote=target_host,
+            check=False,
+        )
+        if r.returncode:
+            msg = dedent(
+                # the lowercase for the first letter below is proposital
+                f"""
+                    your NixOS configuration path seems to be missing essential files.
+                    To avoid corrupting your current NixOS installation, the activation will abort.
+
+                    This could be caused by Nix bug: https://github.com/NixOS/nix/issues/13367.
+                    This is the evaluated NixOS configuration path: {path_to_config}.
+                    Change the directory to somewhere else (e.g., `cd $HOME`) before trying again.
+
+                    If you think this is a mistake, you can set the environment variable
+                    NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM to 1
+                    and re-run the command to continue.
+                    Please open an issue if this is the case.
+                """
+            ).strip()
+            raise NixOSRebuildError(msg)
+
     run_wrapper(
         ["nix-env", "-p", profile.path, "--set", path_to_config],
         remote=target_host,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index d965212a8d74..05cb69e69d8b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -674,6 +674,8 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
 def test_set_profile(mock_run: Mock) -> None:
     profile_path = Path("/path/to/profile")
     config_path = Path("/path/to/config")
+    mock_run.return_value = CompletedProcess([], 0)
+
     n.set_profile(
         m.Profile("system", profile_path),
         config_path,
@@ -687,6 +689,19 @@ def test_set_profile(mock_run: Mock) -> None:
         sudo=False,
     )
 
+    mock_run.return_value = CompletedProcess([], 1)
+
+    with pytest.raises(m.NixOSRebuildError) as e:
+        n.set_profile(
+            m.Profile("system", profile_path),
+            config_path,
+            target_host=None,
+            sudo=False,
+        )
+    assert str(e.value).startswith(
+        "error: your NixOS configuration path seems to be missing essential files."
+    )
+
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_switch_to_configuration_without_systemd_run(
diff --git a/pkgs/by-name/no/notepad-next/package.nix b/pkgs/by-name/no/notepad-next/package.nix
index ab44de46b983..32760a7495cf 100644
--- a/pkgs/by-name/no/notepad-next/package.nix
+++ b/pkgs/by-name/no/notepad-next/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "notepad-next";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "dail8859";
     repo = "NotepadNext";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qpJXby355iSyAGzj19jJJFmFkKeBRgOGod2rrZJqU9Y=";
+    hash = "sha256-YD4tIPh5iJpbcDMZk334k2AV9jTVWCSGP34Mj2x0cJ0=";
     # External dependencies - https://github.com/dail8859/NotepadNext/issues/135
     fetchSubmodules = true;
   };
diff --git a/pkgs/by-name/op/opencl-caps-viewer/package.nix b/pkgs/by-name/op/opencl-caps-viewer/package.nix
new file mode 100644
index 000000000000..bff2baab4143
--- /dev/null
+++ b/pkgs/by-name/op/opencl-caps-viewer/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ocl-icd,
+  opencl-headers,
+  libsForQt5,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "opencl-caps-viewer";
+  version = "1.20";
+
+  src = fetchFromGitHub {
+    owner = "SaschaWillems";
+    repo = "OpenCLCapsViewer";
+    tag = finalAttrs.version;
+    hash = "sha256-P7G8FvVXzDAfN3d4pGXC+c9x4bY08/cJNYQ6lvjyVCQ=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    ocl-icd
+    opencl-headers
+    libsForQt5.qtx11extras
+    libsForQt5.qtbase
+  ];
+
+  postPatch = ''
+    # Fix installation paths
+    substituteInPlace OpenCLCapsViewer.pro \
+      --replace-fail "target.path = /usr/bin" "target.path = /bin/" \
+      --replace-fail "desktop.path = /usr/share/applications" "desktop.path = /share/applications" \
+      --replace-fail "icon.path = /usr/share/icons/hicolor/256x256/apps/" "icon.path = /share/icons/hicolor/256x256/apps/" \
+      --replace-fail 'else: unix:!android: target.path = /opt/$${TARGET}/bin' ""
+  '';
+
+  qmakeFlags = [
+    "OpenCLCapsViewer.pro"
+    "CONFIG+=x11"
+  ];
+
+  installFlags = [ "INSTALL_ROOT=${placeholder "out"}" ];
+
+  postInstall = ''
+    cp Resources/icon.png $out/share/icons/hicolor/256x256/apps/openclCapsViewer.png
+  '';
+
+  qtWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${ocl-icd}/lib"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    mainProgram = "OpenCLCapsViewer";
+    description = "OpenCL hardware capability viewer";
+    longDescription = ''
+      Client application to display hardware implementation details for devices supporting the OpenCL API by Khronos.
+      The hardware reports can be submitted to a public online database that allows comparing different devices, browsing available features, extensions, formats, etc.
+    '';
+    homepage = "https://opencl.gpuinfo.org/";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ andrewgigena ];
+    changelog = "https://github.com/SaschaWillems/OpenCLCapsViewer/releases/tag/${finalAttrs.version}";
+  };
+})
diff --git a/pkgs/by-name/op/openhue-cli/package.nix b/pkgs/by-name/op/openhue-cli/package.nix
new file mode 100644
index 000000000000..ba9460010bfe
--- /dev/null
+++ b/pkgs/by-name/op/openhue-cli/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "openhue-cli";
+  version = "0.18";
+
+  src = fetchFromGitHub {
+    owner = "openhue";
+    repo = "openhue-cli";
+    tag = finalAttrs.version;
+    hash = "sha256-LSaHE3gdjpNea6o+D/JGvHtwvG13LbHv2pDcZhlIoEE=";
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-lqIzmtFtkfrJSrpic79Is0yGpnLUysPQLn2lp/Mh+u4=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+  '';
+
+  postInstall = ''
+    mv $out/bin/openhue-cli $out/bin/openhue
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/openhue";
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  meta = {
+    changelog = "https://github.com/openhue/openhue-cli/releases/tag/${finalAttrs.version}";
+    description = "CLI for interacting with Philips Hue smart lighting systems";
+    homepage = "https://github.com/openhue/openhue-cli";
+    mainProgram = "openhue";
+    maintainers = with lib.maintainers; [ madeddie ];
+    license = lib.licenses.asl20;
+  };
+})
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
new file mode 100644
index 000000000000..3d4bd099069b
--- /dev/null
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchzip,
+
+  nodejs,
+  pnpm_10,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "openlist-frontend";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenListTeam";
+    repo = "OpenList-Frontend";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WflnK/DXg2kmTcOD97jiZP8kb/cEdW7SrVnNQLrWKjA=";
+  };
+
+  i18n = fetchzip {
+    url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
+    hash = "sha256-zms4x4C1CW39o/8uVm5gbasKCJQx6Oh3h66BHF1vnWY=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_10.configHook
+  ];
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    cp -r ${finalAttrs.i18n}/* src/lang/
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    echo -n "v${finalAttrs.version}" > $out/VERSION
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Frontend of OpenList";
+    homepage = "https://github.com/OpenListTeam/OpenList-Frontend";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ moraxyc ];
+  };
+})
diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix
new file mode 100644
index 000000000000..515b7d9b479a
--- /dev/null
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  callPackage,
+  buildPackages,
+  installShellFiles,
+  versionCheckHook,
+  fuse,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "openlist";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenListTeam";
+    repo = "OpenList";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PqCGA2DAfZvDqdnQzqlmz2vlybYokJe+Ybzp5BcJDGU=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # '0000-00-00T00:00:00Z'
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  frontend = callPackage ./frontend.nix { };
+
+  proxyVendor = true;
+  vendorHash = "sha256-e1glgNp5aYl1cEuLdMMLa8sE9lSuiLVdPCX9pek5grE=";
+
+  buildInputs = [ fuse ];
+
+  tags = [ "jsoniter" ];
+
+  ldflags = [
+    "-s"
+    "-X \"github.com/OpenListTeam/OpenList/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@openlist.team>\""
+    "-X github.com/OpenListTeam/OpenList/internal/conf.Version=${finalAttrs.version}"
+    "-X github.com/OpenListTeam/OpenList/internal/conf.WebVersion=${finalAttrs.frontend.version}"
+  ];
+
+  preConfigure = ''
+    rm -rf public/dist
+    cp -r ${finalAttrs.frontend} public/dist
+  '';
+
+  preBuild = ''
+    ldflags+=" -X \"github.com/OpenListTeam/OpenList/internal/conf.BuiltAt=$(<SOURCE_DATE_EPOCH)\""
+    ldflags+=" -X github.com/OpenListTeam/OpenList/internal/conf.GitCommit=$(<COMMIT)"
+  '';
+
+  checkFlags =
+    let
+      # Skip tests that require network access
+      skippedTests = [
+        "TestHTTPAll"
+        "TestWebsocketAll"
+        "TestWebsocketCaller"
+        "TestDownloadOrder"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd OpenList \
+        --bash <(${emulator} $out/bin/OpenList completion bash) \
+        --fish <(${emulator} $out/bin/OpenList completion fish) \
+        --zsh <(${emulator} $out/bin/OpenList completion zsh)
+
+      mkdir $out/share/powershell/ -p
+      ${emulator} $out/bin/OpenList completion powershell > $out/share/powershell/OpenList.Completion.ps1
+    ''
+  );
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/OpenList";
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = lib.getExe (callPackage ./update.nix { });
+
+  meta = {
+    description = "AList Fork to Anti Trust Crisis";
+    homepage = "https://github.com/OpenListTeam/OpenList";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "OpenList";
+  };
+})
diff --git a/pkgs/by-name/op/openlist/update.nix b/pkgs/by-name/op/openlist/update.nix
new file mode 100644
index 000000000000..fc181992d576
--- /dev/null
+++ b/pkgs/by-name/op/openlist/update.nix
@@ -0,0 +1,47 @@
+{
+  writeShellApplication,
+  nix,
+  nix-update,
+  curl,
+  common-updater-scripts,
+  jq,
+}:
+
+writeShellApplication {
+  name = "update-openlist";
+  runtimeInputs = [
+    curl
+    jq
+    nix
+    common-updater-scripts
+    nix-update
+  ];
+
+  text = ''
+    # get old info
+    oldVersion=$(nix-instantiate --eval --strict -A "openlist.version" | jq -e -r)
+
+    get_latest_release() {
+        local repo=$1
+        curl --fail ''${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+             -s "https://api.github.com/repos/OpenListTeam/$repo/releases/latest" | jq -r ".tag_name"
+    }
+
+    version=$(get_latest_release "OpenList")
+    version="''${version#v}"
+    frontendVersion=$(get_latest_release "OpenList-Frontend")
+    frontendVersion="''${frontendVersion#v}"
+
+    if [[ "$oldVersion" == "$version" ]]; then
+        echo "Already up to date!"
+        exit 0
+    fi
+
+    nix-update openlist.frontend --version="$frontendVersion"
+    update-source-version openlist.frontend "$frontendVersion" \
+      --source-key=i18n --ignore-same-version \
+      --file=pkgs/by-name/op/openlist/frontend.nix
+
+    nix-update openlist --version="$version"
+  '';
+}
diff --git a/pkgs/by-name/op/openmm/package.nix b/pkgs/by-name/op/openmm/package.nix
index 0ffc4da34d1f..4f8c4ba7077e 100644
--- a/pkgs/by-name/op/openmm/package.nix
+++ b/pkgs/by-name/op/openmm/package.nix
@@ -18,15 +18,15 @@
   addDriverRunpath,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openmm";
-  version = "8.2.0";
+  version = "8.3.0";
 
   src = fetchFromGitHub {
     owner = "openmm";
     repo = "openmm";
-    rev = version;
-    hash = "sha256-p0zjr8ONqGK4Vbnhljt16DeyeZ0bR1kE+YdiIlw/1L0=";
+    rev = finalAttrs.version;
+    hash = "sha256-wXk5s6OascFWjHs4WpxGU9TcX0gSiOZ3BRusIH1NjpI=";
   };
 
   # "This test is stochastic and may occasionally fail". It does.
@@ -128,4 +128,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = [ maintainers.sheepforce ];
   };
-}
+})
diff --git a/pkgs/by-name/ot/otel-desktop-viewer/package.nix b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
index 7eb7e5778385..1fd3594dcd56 100644
--- a/pkgs/by-name/ot/otel-desktop-viewer/package.nix
+++ b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
@@ -2,49 +2,60 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  testers,
-  otel-desktop-viewer,
+  fetchpatch,
   stdenv,
-  apple-sdk_12,
+  apple-sdk,
+  versionCheckHook,
+  nix-update-script,
+  ...
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "otel-desktop-viewer";
-  version = "0.1.4";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "CtrlSpice";
     repo = "otel-desktop-viewer";
-    rev = "v${version}";
-    hash = "sha256-kMgcco4X7X9WoCCH8iZz5qGr/1dWPSeQOpruTSUnonI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-qvMpebhbg/OnheZIZBoiitGYUUMdTghSwEapblE0DkA=";
   };
 
-  # https://github.com/CtrlSpice/otel-desktop-viewer/issues/139
-  patches = [ ./version-0.1.4.patch ];
-
-  subPackages = [ "..." ];
-
-  vendorHash = "sha256-pH16DCYeW8mdnkkRi0zqioovZu9slVc3gAdhMYu2y98=";
+  # NOTE: This project uses Go workspaces, but 'buildGoModule' does not support
+  # them at the time of writing; trying to build with 'env.GOWORK = "off"'
+  # fails with the following error message:
+  #
+  #     main module (github.com/CtrlSpice/otel-desktop-viewer) does not contain package github.com/CtrlSpice/otel-desktop-viewer/desktopexporter
+  #
+  # cf. https://github.com/NixOS/nixpkgs/issues/203039
+  proxyVendor = true;
+  vendorHash = "sha256-1TH9JQDnvhi+b3LDCAooMKgYhPudM7NCNCc+WXtcv/4=";
 
   ldflags = [
     "-s"
     "-w"
+    "-X main.version=${finalAttrs.version}"
   ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_12;
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk ];
 
-  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = otel-desktop-viewer;
-    command = "otel-desktop-viewer --version";
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    changelog = "https://github.com/CtrlSpice/otel-desktop-viewer/releases/tag/v${version}";
+    changelog = "https://github.com/CtrlSpice/otel-desktop-viewer/releases/tag/v${finalAttrs.version}";
     description = "Receive & visualize OpenTelemtry traces locally within one CLI tool";
     homepage = "https://github.com/CtrlSpice/otel-desktop-viewer";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ gaelreyrol ];
+    maintainers = with lib.maintainers; [
+      gaelreyrol
+      jkachmar
+      lf-
+    ];
     mainProgram = "otel-desktop-viewer";
   };
-}
+})
diff --git a/pkgs/by-name/pa/pan-bindings/package.nix b/pkgs/by-name/pa/pan-bindings/package.nix
index 904d5e59e548..8d2f85ecc79e 100644
--- a/pkgs/by-name/pa/pan-bindings/package.nix
+++ b/pkgs/by-name/pa/pan-bindings/package.nix
@@ -9,19 +9,19 @@
 }:
 
 let
-  version = "unstable-2024-03-03";
+  version = "unstable-2025-06-15";
   src = fetchFromGitHub {
     owner = "lschulz";
     repo = "pan-bindings";
-    rev = "4361d30f1c5145a70651c259f2d56369725b0d15";
-    hash = "sha256-0WxrgXTCM+BwGcjjWBBKiZawje2yxB5RRac6Sk5t3qc=";
+    rev = "708d7f36a0a32816b2b0d8e2e5a4d79f2144f406";
+    hash = "sha256-wGHa8NV8M+9dHvn8UqejderyA1UgYQUcTOKocRFhg6U=";
   };
   goDeps = (
     buildGoModule {
       name = "pan-bindings-goDeps";
       inherit src version;
       modRoot = "go";
-      vendorHash = "sha256-7EitdEJTRtiM29qmVnZUM6w68vCBI8mxZhCA7SnAxLA=";
+      vendorHash = "sha256-3MybV76pHDnKgN2ENRgsyAvynXQctv0fJcRGzesmlww=";
     }
   );
 in
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/by-name/pa/papirus-icon-theme/package.nix
similarity index 59%
rename from pkgs/data/icons/papirus-icon-theme/default.nix
rename to pkgs/by-name/pa/papirus-icon-theme/package.nix
index 73103d19964b..dee8528770f7 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/by-name/pa/papirus-icon-theme/package.nix
@@ -3,23 +3,21 @@
   stdenvNoCC,
   fetchFromGitHub,
   gtk3,
-  breeze-icons,
-  elementary-icon-theme,
+  kdePackages,
   hicolor-icon-theme,
   papirus-folders,
   color ? null,
-  withElementary ? false,
   gitUpdater,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "papirus-icon-theme";
   version = "20250501";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
-    repo = pname;
-    rev = version;
+    repo = "papirus-icon-theme";
+    tag = finalAttrs.version;
     hash = "sha256-KbUjHmNzaj7XKj+MOsPM6zh2JI+HfwuXvItUVAZAClk=";
   };
 
@@ -28,14 +26,13 @@ stdenvNoCC.mkDerivation rec {
     papirus-folders
   ];
 
-  propagatedBuildInputs =
-    [
-      breeze-icons
-      hicolor-icon-theme
-    ]
-    ++ lib.optional withElementary [
-      elementary-icon-theme
-    ];
+  propagatedBuildInputs = [
+    kdePackages.breeze-icons
+    hicolor-icon-theme
+  ];
+
+  # breeze-icons propagates qtbase
+  dontWrapQtApps = true;
 
   dontDropIconThemeCache = true;
 
@@ -43,12 +40,10 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/share/icons
-    mv ${lib.optionalString withElementary "{,e}"}Papirus* $out/share/icons
+    mv Papirus* $out/share/icons
 
     for theme in $out/share/icons/*; do
-      ${lib.optionalString (
-        color != null
-      ) "${papirus-folders}/bin/papirus-folders -t $theme -o -C ${color}"}
+      ${lib.optionalString (color != null) "papirus-folders -t $theme -o -C ${color}"}
       gtk-update-icon-cache --force $theme
     done
 
@@ -57,15 +52,15 @@ stdenvNoCC.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Pixel perfect icon theme for Linux";
     homepage = "https://github.com/PapirusDevelopmentTeam/papirus-icon-theme";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     # darwin gives hash mismatch in source, probably because of file names differing only in case
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       romildo
       moni
     ];
   };
-}
+})
diff --git a/pkgs/by-name/pa/passt/package.nix b/pkgs/by-name/pa/passt/package.nix
index a8af2a7fe952..c8011032f30d 100644
--- a/pkgs/by-name/pa/passt/package.nix
+++ b/pkgs/by-name/pa/passt/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passt";
-  version = "2025_05_03.587980c";
+  version = "2025_06_11.0293c6f";
 
   src = fetchurl {
     url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ussvShWxhR6ScBYiCJG0edrqS+W+74DSlsDRS1GCByA=";
+    hash = "sha256-ovkFQlUa5gLYwCpNjwfGVJ055aDKCXIZou/t4pf6q5o=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/pe/peazip/package.nix b/pkgs/by-name/pe/peazip/package.nix
index 78cc0b2ae3bd..977d921b2d03 100644
--- a/pkgs/by-name/pe/peazip/package.nix
+++ b/pkgs/by-name/pe/peazip/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "peazip";
-  version = "10.4.0";
+  version = "10.5.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = "peazip";
     rev = version;
-    hash = "sha256-tA2JLO4KIqFOVZyt7CPMRJTojQFQVQqGGOeh3sU/FuQ=";
+    hash = "sha256-tEx0ZSvv+byn8OPSFprFJwMFxuEQzyrkvk4FbvGtH2A=";
   };
   sourceRoot = "${src.name}/peazip-sources";
 
diff --git a/pkgs/by-name/ph/phel/package.nix b/pkgs/by-name/ph/phel/package.nix
index 83cd031815b2..9d14d111067c 100644
--- a/pkgs/by-name/ph/phel/package.nix
+++ b/pkgs/by-name/ph/phel/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phel";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "phel-lang";
     repo = "phel-lang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5FwYBt1v1zhOnv4Q4zvWUxnVnOeV6rpdSW9i8ptVpW4=";
+    hash = "sha256-YwmDTj1uc71rpp5Iq/7cDq0gLLy8Bh96bu0RaYqi5J0=";
   };
 
-  vendorHash = "sha256-mLSxlPzS/uSNEu7BnQR9yaj3OCSqMe5DHqkLI8dG6SQ=";
+  vendorHash = "sha256-zZK4v9IncoOurf2yUeFqwmAkqsMBlLfuZTUm9cWQBCA=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/pi/pigment/package.nix b/pkgs/by-name/pi/pigment/package.nix
new file mode 100644
index 000000000000..95135595e94b
--- /dev/null
+++ b/pkgs/by-name/pi/pigment/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  ninja,
+  meson,
+  pkg-config,
+  wrapGAppsHook4,
+  glib,
+  desktop-file-utils,
+  appstream-glib,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  nix-update-script,
+}:
+let
+  version = "0.5.0";
+in
+python3Packages.buildPythonApplication {
+  pname = "pigment";
+  inherit version;
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "Jeffser";
+    repo = "Pigment";
+    tag = version;
+    hash = "sha256-VwqCv2IPxPKT/6PDk8sosAIZlyu8zl5HDQEaIRWlJKg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    glib
+    desktop-file-utils
+    appstream-glib
+    gobject-introspection
+  ];
+
+  pythonPath = with python3Packages; [
+    pygobject3
+    colorthief
+    pydbus
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Extract color palettes from your images";
+    homepage = "https://jeffser.com/pigment/";
+    downloadPage = "https://github.com/Jeffser/Pigment";
+    changelog = "https://github.com/Jeffser/Pigment/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "pigment";
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.awwpotato ];
+  };
+}
diff --git a/pkgs/by-name/pl/plymouth-vortex-ubuntu-theme/package.nix b/pkgs/by-name/pl/plymouth-vortex-ubuntu-theme/package.nix
index e1faaa81ea42..1a5128f21597 100644
--- a/pkgs/by-name/pl/plymouth-vortex-ubuntu-theme/package.nix
+++ b/pkgs/by-name/pl/plymouth-vortex-ubuntu-theme/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "plymouth-vortex-ubuntu-theme";
-  version = "0-unstable-2024-11-20";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "emanuele-scarsella";
     repo = "vortex-ubuntu-plymouth-theme";
-    rev = "5b3c88102fd8f322626c01514deedd7ba8e7ebdd";
-    hash = "sha256-AuYLjyOfpmwE4pFhKDQdR1uC+6Rr5FWUC5h9yWesXRE=";
+    rev = "3072445ee35f10a0268baa9aaa326c0abd54af3e";
+    hash = "sha256-RBV5g1ccDw7O6MnrLb2yCga/ASjVo7GOE5CIoJcku4w=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/pm/pmbootstrap/package.nix b/pkgs/by-name/pm/pmbootstrap/package.nix
index 0b71d0e307e9..609ff67fed80 100644
--- a/pkgs/by-name/pm/pmbootstrap/package.nix
+++ b/pkgs/by-name/pm/pmbootstrap/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.4.2";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = "pmbootstrap";
     tag = version;
-    hash = "sha256-5N8yAd/1gSzHP2wXpqZb+LpylQ/LYspJ+YaY2YaWCSs=";
+    hash = "sha256-wdJl7DrSm1Jht0KEqZ9+qjqlkE+Y6oBdzEHTCgIGJ84=";
     domain = "gitlab.postmarketos.org";
   };
 
diff --git a/pkgs/development/libraries/podofo/0.10.x.nix b/pkgs/by-name/po/podofo_0_10/package.nix
similarity index 85%
rename from pkgs/development/libraries/podofo/0.10.x.nix
rename to pkgs/by-name/po/podofo_0_10/package.nix
index a1d202232544..6f82a5c9c7b2 100644
--- a/pkgs/development/libraries/podofo/0.10.x.nix
+++ b/pkgs/by-name/po/podofo_0_10/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  expat,
   fontconfig,
   freetype,
   libidn,
@@ -11,7 +10,6 @@
   libpng,
   libtiff,
   libxml2,
-  lua5,
   openssl,
   pkg-config,
   zlib,
@@ -19,19 +17,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "podofo";
-  version = "0.10.4";
+  version = "0.10.5";
 
   src = fetchFromGitHub {
     owner = "podofo";
     repo = "podofo";
     rev = finalAttrs.version;
-    hash = "sha256-ZY+kyimLzAeEgvDaflXM7MbyzsGgivOnG1aBD9/ozbk=";
+    hash = "sha256-lYykDGhxFWLwuZhfBIgbw3B0SEhrAP7vLNNXsPKRFZw=";
   };
 
   outputs = [
     "out"
     "dev"
-    "lib"
   ];
 
   nativeBuildInputs = [
@@ -40,7 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    expat
     fontconfig
     freetype
     libidn
@@ -48,7 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libtiff
     libxml2
-    lua5
     openssl
     zlib
   ];
@@ -66,6 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       lgpl2Plus
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      kuflierl
+    ];
   };
 })
diff --git a/pkgs/development/libraries/podofo/default.nix b/pkgs/by-name/po/podofo_0_9/package.nix
similarity index 77%
rename from pkgs/development/libraries/podofo/default.nix
rename to pkgs/by-name/po/podofo_0_9/package.nix
index c49c31be8822..1d7bf196678c 100644
--- a/pkgs/development/libraries/podofo/default.nix
+++ b/pkgs/by-name/po/podofo_0_9/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   cmake,
   zlib,
   freetype,
@@ -13,16 +13,17 @@
   lua5,
   pkg-config,
   libidn,
-  expat,
 }:
 
 stdenv.mkDerivation rec {
   version = "0.9.8";
   pname = "podofo";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/podofo/${pname}-${version}.tar.gz";
-    sha256 = "sha256-XeYH4V8ZK4rZBzgwB1nYjeoPXM3OO/AASKDJMrxkUVQ=";
+  src = fetchFromGitHub {
+    owner = "podofo";
+    repo = "podofo";
+    rev = version;
+    hash = "sha256-VGsACeCC8xKC1n/ackT576ZU3ZR1LAw8H0l/Q9cH27s=";
   };
 
   outputs = [
@@ -45,7 +46,6 @@ stdenv.mkDerivation rec {
     openssl
     libpng
     libidn
-    expat
     lua5
   ];
 
@@ -64,13 +64,16 @@ stdenv.mkDerivation rec {
         -e 's/^libdir=.*/libdir=@CMAKE_INSTALL_LIBDIR@/' -e "$failNoMatches"
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://podofo.sourceforge.net";
     description = "Library to work with the PDF file format";
-    platforms = platforms.all;
-    license = with licenses; [
+    platforms = lib.platforms.all;
+    license = with lib.licenses; [
       gpl2Plus
       lgpl2Plus
     ];
+    maintainers = with lib.maintainers; [
+      kuflierl
+    ];
   };
 }
diff --git a/pkgs/by-name/po/podofo_1_0/package.nix b/pkgs/by-name/po/podofo_1_0/package.nix
new file mode 100644
index 000000000000..773b7de814cf
--- /dev/null
+++ b/pkgs/by-name/po/podofo_1_0/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  fontconfig,
+  freetype,
+  libjpeg,
+  libpng,
+  libtiff,
+  libxml2,
+  openssl,
+  pkg-config,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "podofo";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "podofo";
+    repo = "podofo";
+    rev = finalAttrs.version;
+    hash = "sha256-DtbTaPNXjVRl1KU0NH/Sd2j9y3OZlUQGOYYJL3bTQQg=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libjpeg
+    libpng
+    libtiff
+    libxml2
+    openssl
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DPODOFO_BUILD_STATIC=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
+    "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+  ];
+
+  meta = {
+    homepage = "https://github.com/podofo/podofo";
+    description = "Library to work with the PDF file format";
+    platforms = lib.platforms.all;
+    license = with lib.licenses; [
+      gpl2Plus
+      lgpl2Plus
+    ];
+    maintainers = with lib.maintainers; [
+      kuflierl
+    ];
+  };
+})
diff --git a/pkgs/by-name/pr/presage/fixed-cppunit-detection.patch b/pkgs/by-name/pr/presage/fixed-cppunit-detection.patch
deleted file mode 100644
index 27238d2956d1..000000000000
--- a/pkgs/by-name/pr/presage/fixed-cppunit-detection.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5624aa156c551ab2b81bb86279844397ed690653 Mon Sep 17 00:00:00 2001
-From: Matteo Vescovi <matteo.vescovi@yahoo.co.uk>
-Date: Sun, 21 Jan 2018 17:17:12 +0000
-Subject: [PATCH] Fixed cppunit detection.
-
----
- configure.ac | 16 +++++++++++-----
- 1 file changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index a02e9f1..1538a51 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -204,10 +204,16 @@ AM_CONDITIONAL([USE_SQLITE], [test "x$use_sqlite" = "xyes"])
- dnl ==================
- dnl Checks for CppUnit
- dnl ==================
--AM_PATH_CPPUNIT([1.9.6],
--                [],
--                [AC_MSG_WARN([CppUnit not found. Unit tests will not be built. CppUnit can be obtained from http://cppunit.sourceforge.net.])])
--AM_CONDITIONAL([HAVE_CPPUNIT], [test "$CPPUNIT_LIBS"])
-+PKG_CHECK_MODULES([CPPUNIT],
-+                  [cppunit >= 1.9],
-+                  [have_cppunit=yes],
-+                  [AM_PATH_CPPUNIT([1.9],
-+                                   [have_cppunit=yes],
-+                                   [AC_MSG_WARN([CppUnit not found. Unit tests will not be built. CppUnit can be obtained from http://cppunit.sourceforge.net.])])
-+                  ])
-+AC_SUBST([CPPUNIT_CFLAGS])
-+AC_SUBST([CPPUNIT_LIBS])
-+AM_CONDITIONAL([HAVE_CPPUNIT], [test "x$have_cppunit" = "xyes"])
- 
- 
- dnl ============================
-@@ -592,7 +598,7 @@ then
- else
-     build_demo_application="no"
- fi
--if test "$CPPUNIT_LIBS"
-+if test "x$have_cppunit" = "xyes"
- then
-     build_unit_tests="yes"
- else
--- 
-2.31.1
-
diff --git a/pkgs/by-name/pr/presage/package.nix b/pkgs/by-name/pr/presage/package.nix
deleted file mode 100644
index 79d2fafac485..000000000000
--- a/pkgs/by-name/pr/presage/package.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  autoreconfHook,
-  dbus,
-  doxygen,
-  fontconfig,
-  gettext,
-  graphviz,
-  help2man,
-  pkg-config,
-  sqlite,
-  tinyxml,
-  cppunit,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "presage";
-  version = "0.9.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/presage/presage/${version}/presage-${version}.tar.gz";
-    sha256 = "0rm3b3zaf6bd7hia0lr1wyvi1rrvxkn7hg05r5r1saj0a3ingmay";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "gcc6.patch";
-      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch?id=40e2044c9ecb36eacb3a1fd043f09548d210dc01";
-      sha256 = "0243nx1ygggmsly7057vndb4pkjxg9rpay5gyqqrq9jjzjzh63dj";
-    })
-    ./fixed-cppunit-detection.patch
-    # fix gcc11 build
-    (fetchpatch {
-      name = "presage-0.9.1-gcc11.patch";
-      url = "https://build.opensuse.org/public/source/openSUSE:Factory/presage/presage-0.9.1-gcc11.patch?rev=3f8b4b19c99276296d6ea595cc6c431f";
-      sha256 = "sha256-pLrIFXvJHRvv4x9gBIfal4Y68lByDE3XE2NZNiAXe9k=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    doxygen
-    fontconfig
-    gettext
-    graphviz
-    help2man
-    pkg-config
-  ];
-
-  preBuild = ''
-    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
-  '';
-
-  buildInputs = [
-    dbus
-    sqlite
-    tinyxml
-  ];
-
-  nativeCheckInputs = [
-    cppunit
-  ];
-
-  doCheck = true;
-
-  checkTarget = "check";
-
-  meta = with lib; {
-    description = "Intelligent predictive text entry system";
-    homepage = "https://presage.sourceforge.io/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 8743450e547d..14a47e331bad 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -260,6 +260,11 @@ python.pkgs.buildPythonApplication rec {
     "test_same_day_spanish"
     "test_same_month_spanish"
     "test_same_year_spanish"
+
+    # broken with fakeredis>=2.27.0
+    "test_waitinglist_cache_separation"
+    "test_waitinglist_item_active"
+    "test_waitinglist_variation_active"
   ];
 
   preCheck = ''
diff --git a/pkgs/by-name/ps/psudohash/package.nix b/pkgs/by-name/ps/psudohash/package.nix
index d373f631ad54..e8ca15edd221 100644
--- a/pkgs/by-name/ps/psudohash/package.nix
+++ b/pkgs/by-name/ps/psudohash/package.nix
@@ -1,22 +1,24 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
-  python3,
+  python3Packages,
 }:
 
-stdenv.mkDerivation rec {
+python3Packages.buildPythonApplication rec {
   pname = "psudohash";
-  version = "1.0.2";
+  version = "1.1.0";
+  pyproject = false;
 
   src = fetchFromGitHub {
     owner = "t3l3machus";
     repo = "psudohash";
     tag = "v${version}";
-    hash = "sha256-l/Rp9405Wf6vh85PFrRTtTLJE7GPODowseNqEw42J18=";
+    hash = "sha256-I/vHQraGmIWmx/v+szL5ZQJpjkSBaCpEx0r4Mc6FgKA=";
   };
 
-  buildInputs = [ python3 ];
+  dependencies = with python3Packages; [
+    tqdm
+  ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/qd/qdirstat/package.nix b/pkgs/by-name/qd/qdirstat/package.nix
index 04e6ae824f22..2cdcb19f6c6d 100644
--- a/pkgs/by-name/qd/qdirstat/package.nix
+++ b/pkgs/by-name/qd/qdirstat/package.nix
@@ -8,6 +8,7 @@
   bash,
   makeWrapper,
   perlPackages,
+  util-linux,
 }:
 
 stdenv.mkDerivation rec {
@@ -32,26 +33,21 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace scripts/scripts.pro \
-      --replace /bin/true ${coreutils}/bin/true
-
-    for i in src/SysUtil.cpp src/FileSizeStatsWindow.cpp
-    do
-      substituteInPlace $i \
-        --replace /usr/bin/xdg-open ${xdg-utils}/bin/xdg-open
-    done
-    for i in src/Cleanup.cpp src/cleanup-config-page.ui
-    do
-      substituteInPlace $i \
-        --replace /bin/bash ${bash}/bin/bash \
-        --replace /bin/sh ${bash}/bin/sh
-    done
+      --replace-fail /bin/true ${coreutils}/bin/true
+    substituteInPlace src/SysUtil.cpp src/FileSizeStatsWindow.cpp \
+      --replace-fail /usr/bin/xdg-open ${xdg-utils}/bin/xdg-open
+    substituteInPlace src/Cleanup.cpp src/cleanup-config-page.ui \
+      --replace-fail /bin/bash ${bash}/bin/bash \
+      --replace-fail /bin/sh ${bash}/bin/sh
+    substituteInPlace src/MountPoints.cpp \
+      --replace-fail /bin/lsblk ${util-linux}/bin/lsblk
     substituteInPlace src/StdCleanup.cpp \
-      --replace /bin/bash ${bash}/bin/bash
+      --replace-fail /bin/bash ${bash}/bin/bash
   '';
 
   qmakeFlags = [ "INSTALL_PREFIX=${placeholder "out"}" ];
 
-  postInstall = ''
+  postFixup = ''
     wrapProgram $out/bin/qdirstat-cache-writer \
       --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.URI ]}"
   '';
diff --git a/pkgs/by-name/qq/qq/package.nix b/pkgs/by-name/qq/qq/package.nix
index fb48240150e5..1ca56f038925 100644
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@@ -54,6 +54,7 @@ let
       bot-wxt1221
       fee1-dead
       prince213
+      ryan4yin
     ];
   };
 in
diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index 6b32e4b319aa..ab1a9051f01f 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -1,46 +1,46 @@
 {
   lib,
-  buildGoModule,
   fetchFromGitLab,
+  rustPlatform,
+  nix-update-script,
+  installShellFiles,
 }:
-let
-  version = "1.4.1";
-in
-buildGoModule {
-  inherit version;
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
+  version = "2.0.1";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "ppom";
     repo = "reaction";
-    rev = "v${version}";
-    hash = "sha256-UL3ck+gejZAu/mZS3ZiZ78a2/I+OesaSRZUhHirgu9o=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HpnLh0JfGZsHcvDQSiKfW62QcCe/QDsVP/nGBo9x494=";
   };
 
-  vendorHash = "sha256-THUIoWFzkqaTofwH4clBgsmtUlLS9WIB2xjqW7vkhpg=";
+  cargoHash = "sha256-i8KZygESxgty8RR3C+JMuE1aAsBxoLuGsL4jqjdGr0E=";
 
-  ldflags = [
-    "-X main.version=${version}"
-    "-X main.commit=unknown"
+  nativeBuildInputs = [
+    installShellFiles
   ];
 
-  postBuild = ''
-    $CC helpers_c/ip46tables.c -o ip46tables
-    $CC helpers_c/nft46.c -o nft46
+  postInstall = ''
+    installBin $releaseDir/ip46tables $releaseDir/nft46
+    installManPage $releaseDir/reaction*.1
+    installShellCompletion --cmd reaction \
+      --bash $releaseDir/reaction.bash \
+      --fish $releaseDir/reaction.fish \
+      --zsh $releaseDir/_reaction
   '';
 
-  postInstall = ''
-    cp ip46tables nft46 $out/bin
-  '';
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Scan logs and take action: an alternative to fail2ban";
     homepage = "https://framagit.org/ppom/reaction";
-    changelog = "https://framagit.org/ppom/reaction/-/releases/v${version}";
+    changelog = "https://framagit.org/ppom/reaction/-/releases/v${finalAttrs.version}";
     license = lib.licenses.agpl3Plus;
     mainProgram = "reaction";
     maintainers = with lib.maintainers; [ ppom ];
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/re/readarr/package.nix b/pkgs/by-name/re/readarr/package.nix
index ae9b7581894e..5f2874bd8c3c 100644
--- a/pkgs/by-name/re/readarr/package.nix
+++ b/pkgs/by-name/re/readarr/package.nix
@@ -24,15 +24,15 @@ let
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash =
     {
-      x64-linux_hash = "sha256-3Oir/a5TwaCraYierE6pPPZWYObNOD6+V7olw/HmckM=";
-      arm64-linux_hash = "sha256-B/Or5hdqMxqQEmBULG+Z1JqlL9Kdk5M6SBdjhbfMBZA=";
-      x64-osx_hash = "sha256-FYfX50pomjlB/oGVeIHqYvZ00S1SSgBaVB7R8150rvY=";
+      x64-linux_hash = "sha256-hCqxH6xPLhA+V7reqsHi1EY2sU3HJ6ESMJiiWXrcUUE=";
+      arm64-linux_hash = "sha256-7NpH32tkEOYVyfwIBq9LCKAo0IQ1IehYfKi+qiBzf8o=";
+      x64-osx_hash = "sha256-ypzOWXxtzvOTgTmU7pQ1cS+FcyNCOo5R2Z4l5Mk+4wA=";
     }
     ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.4.17.2801";
+  version = "0.4.18.2805";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/by-name/re/regionset/package.nix b/pkgs/by-name/re/regionset/package.nix
index 547a307ea1fb..cd21a3f23873 100644
--- a/pkgs/by-name/re/regionset/package.nix
+++ b/pkgs/by-name/re/regionset/package.nix
@@ -16,9 +16,15 @@ stdenv.mkDerivation {
     sha256 = "1fgps85dmjvj41a5bkira43vs2aiivzhqwzdvvpw5dpvdrjqcp0d";
   };
 
+  prePatch = ''
+    substituteInPlace regionset.8 \
+        --replace-fail /usr/share/doc/ "$out"/share/doc/
+  '';
+
   installPhase = ''
     install -Dm755 {.,$out/bin}/regionset
     install -Dm644 {.,$out/share/man/man8}/regionset.8
+    install -Dm644 {.,$out/share/doc/regionset}/README
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index b345e3a3d27e..320acf3b0cdc 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-06-09";
+  version = "0-unstable-2025-06-16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "f7419099a1678a1de3e20324b67c5e2baff24be6";
-    hash = "sha256-RG/3UZkuivou+jedyfqcORr0y6DY5EUnPwC6IPPC+aU=";
+    rev = "65232f0be8d171650e050690ade02c50755241c4";
+    hash = "sha256-v/RzEXRie3O37DVVY7bX09rnXMLH7L99o8sWPOPnDOw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/restic/package.nix b/pkgs/by-name/re/restic/package.nix
index e4723e357a41..1580c2c247fd 100644
--- a/pkgs/by-name/re/restic/package.nix
+++ b/pkgs/by-name/re/restic/package.nix
@@ -65,9 +65,10 @@ buildGoModule rec {
     description = "Backup program that is fast, efficient and secure";
     platforms = platforms.linux ++ platforms.darwin;
     license = licenses.bsd2;
-    maintainers = [
-      maintainers.mbrgm
-      maintainers.dotlambda
+    maintainers = with maintainers; [
+      mbrgm
+      dotlambda
+      ryan4yin
     ];
     mainProgram = "restic";
   };
diff --git a/pkgs/by-name/ri/river-ultitile/build.zig.zon.nix b/pkgs/by-name/ri/river-ultitile/build.zig.zon.nix
new file mode 100644
index 000000000000..a26d29e2067e
--- /dev/null
+++ b/pkgs/by-name/ri/river-ultitile/build.zig.zon.nix
@@ -0,0 +1,99 @@
+# generated by zon2nix (https://github.com/Cloudef/zig2nix)
+
+{
+  lib,
+  linkFarm,
+  fetchurl,
+  fetchgit,
+  runCommandLocal,
+  zig,
+  name ? "zig-packages",
+}:
+
+with builtins;
+with lib;
+
+let
+  unpackZigArtifact =
+    { name, artifact }:
+    runCommandLocal name { nativeBuildInputs = [ zig ]; } ''
+      hash="$(zig fetch --global-cache-dir "$TMPDIR" ${artifact})"
+      mv "$TMPDIR/p/$hash" "$out"
+      chmod 755 "$out"
+    '';
+
+  fetchZig =
+    {
+      name,
+      url,
+      hash,
+    }:
+    let
+      artifact = fetchurl { inherit url hash; };
+    in
+    unpackZigArtifact { inherit name artifact; };
+
+  fetchGitZig =
+    {
+      name,
+      url,
+      hash,
+      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
+    }:
+    let
+      parts = splitString "#" url;
+      url_base = elemAt parts 0;
+      url_without_query = elemAt (splitString "?" url_base) 0;
+    in
+    fetchgit {
+      inherit name rev hash;
+      url = url_without_query;
+      deepClone = false;
+    };
+
+  fetchZigArtifact =
+    {
+      name,
+      url,
+      hash,
+      ...
+    }@args:
+    let
+      parts = splitString "://" url;
+      proto = elemAt parts 0;
+      path = elemAt parts 1;
+      fetcher = {
+        "git+http" = fetchGitZig (
+          args
+          // {
+            url = "http://${path}";
+          }
+        );
+        "git+https" = fetchGitZig (
+          args
+          // {
+            url = "https://${path}";
+          }
+        );
+        http = fetchZig {
+          inherit name hash;
+          url = "http://${path}";
+        };
+        https = fetchZig {
+          inherit name hash;
+          url = "https://${path}";
+        };
+      };
+    in
+    fetcher.${proto};
+in
+linkFarm name [
+  {
+    name = "wayland-0.3.0-lQa1kjPIAQDmhGYpY-zxiRzQJFHQ2VqhJkQLbKKdt5wl";
+    path = fetchZigArtifact {
+      name = "wayland";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.3.0.tar.gz";
+      hash = "sha256-xU8IrETSFOKKQQMgwVyRKLwGaek4USaKXg49S9oHSTQ=";
+    };
+  }
+]
diff --git a/pkgs/by-name/ri/river-ultitile/package.nix b/pkgs/by-name/ri/river-ultitile/package.nix
new file mode 100644
index 000000000000..83c5c351a7a7
--- /dev/null
+++ b/pkgs/by-name/ri/river-ultitile/package.nix
@@ -0,0 +1,69 @@
+{
+  callPackage,
+  fetchFromSourcehut,
+  lib,
+  pandoc,
+  pkg-config,
+  stdenv,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  zig_0_14,
+}:
+
+let
+  zig = zig_0_14;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "river-ultitile";
+  version = "1.3.0";
+
+  src = fetchFromSourcehut {
+    owner = "~midgard";
+    repo = "river-ultitile";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-whzJZLgd51kXOVq9YVqcADTOyGmHmwJZWzbrZGZx3Ak=";
+  };
+
+  nativeBuildInputs = [
+    zig.hook
+    pkg-config
+    wayland
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    wayland-protocols
+    pandoc # used for building documentation
+  ];
+
+  deps = callPackage ./build.zig.zon.nix { };
+
+  zigBuildFlags = [
+    "--system"
+    "${finalAttrs.deps}"
+  ];
+
+  meta = {
+    description = "Configurable layout generator for the River compositor";
+    longDescription = ''
+      A layout generator for **river**. Features include:
+      - **configurable** layouts employing nested tiles (no juggling with coordinates),
+      - **widescreen** support by default,
+      - default layouts, switchable at run time with a command or key binding:
+          - dwm-like main/stack layout,
+              - main on the left on normal screens,
+              - **main in the center and stacks on both sides** on widescreens,
+          - a vertical stack,
+          - a horizontal stack, and
+          - a monocle layout,
+      - optional per-tag-per-output state.
+    '';
+    changelog = "https://git.sr.ht/~midgard/river-ultitile/tree/v${finalAttrs.version}/item/CHANGELOG.md";
+    homepage = "https://git.sr.ht/~midgard/river-ultitile";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "river-ultitile";
+    maintainers = with lib.maintainers; [ debling ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 651269965234..4068c505d404 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -32,18 +32,18 @@ in
 buildDotnetModule rec {
   inherit pname dotnet-sdk dotnet-runtime;
 
-  vsVersion = "2.82.12";
+  vsVersion = "2.83.5";
   src = fetchFromGitHub {
     owner = "dotnet";
     repo = "roslyn";
     rev = "VSCode-CSharp-${vsVersion}";
-    hash = "sha256-5QCiA2NxjWUFLut8gxboR2kTibN66QCxbe2g2jdrINo=";
+    hash = "sha256-1YH2cxj+Or73Z1Ery/63RubIgkM5Iz9PiKii65noj/c=";
   };
 
   # versioned independently from vscode-csharp
   # "roslyn" in here:
   # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "5.0.0-1.25302.10";
+  version = "5.0.0-1.25312.6";
   projectFile = "src/LanguageServer/${project}/${project}.csproj";
   useDotnetFromEnv = true;
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/ro/rospo/package.nix b/pkgs/by-name/ro/rospo/package.nix
index 5658c5854d74..c3b0323460e0 100644
--- a/pkgs/by-name/ro/rospo/package.nix
+++ b/pkgs/by-name/ro/rospo/package.nix
@@ -2,39 +2,48 @@
   lib,
   stdenv,
   buildGoModule,
+  buildPackages,
   fetchFromGitHub,
   installShellFiles,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "rospo";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "ferama";
     repo = "rospo";
-    rev = "v${version}";
-    hash = "sha256-H6hZbOnX+1P1Ob5fCROQtV+64NiFD9mO3kiaQY63OBM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xfCjRAsKJxtYeY2Mx+l1tDtqAF0SKjTCJCh1gCG+Rl8=";
   };
 
-  vendorHash = "sha256-KyTDyV27YQDqbEyKSYfbJuTKw2EsZAqWsHhmMncUHUs=";
+  vendorHash = "sha256-6hCaguJP7XXdxYYS2KuBegwPaKP8rD9YI5727HZo7uA=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/ferama/rospo/cmd.Version=${version}"
+    "-X github.com/ferama/rospo/cmd.Version=${finalAttrs.version}"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
 
   doCheck = false;
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd rospo \
-      --bash <($out/bin/rospo completion bash) \
-      --fish <($out/bin/rospo completion fish) \
-      --zsh <($out/bin/rospo completion zsh)
-  '';
+  postInstall =
+    let
+      rospoBin =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          placeholder "out"
+        else
+          buildPackages.rospo;
+    in
+    ''
+      installShellCompletion --cmd rospo \
+        --bash <(${rospoBin}/bin/rospo completion bash) \
+        --fish <(${rospoBin}/bin/rospo completion fish) \
+        --zsh <(${rospoBin}/bin/rospo completion zsh)
+    '';
 
   meta = {
     description = "Simple, reliable, persistent ssh tunnels with embedded ssh server";
@@ -43,4 +52,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "rospo";
   };
-}
+})
diff --git a/pkgs/by-name/ry/ryubing/package.nix b/pkgs/by-name/ry/ryubing/package.nix
index f8bca0586c66..fc86129a49a7 100644
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -96,7 +96,7 @@ buildDotnetModule rec {
     "Ryujinx"
   ];
 
-  makeWrapperArgs = [
+  makeWrapperArgs = lib.optional stdenv.hostPlatform.isLinux [
     # Without this Ryujinx fails to start on wayland. See https://github.com/Ryujinx/Ryujinx/issues/2714
     "--set SDL_VIDEODRIVER x11"
   ];
diff --git a/pkgs/by-name/sa/sad/package.nix b/pkgs/by-name/sa/sad/package.nix
index 5ee30cee37e3..19ee417cf5fb 100644
--- a/pkgs/by-name/sa/sad/package.nix
+++ b/pkgs/by-name/sa/sad/package.nix
@@ -32,7 +32,10 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/ms-jpq/sad";
     changelog = "https://github.com/ms-jpq/sad/releases/tag/v${version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      ryan4yin
+    ];
     mainProgram = "sad";
   };
 }
diff --git a/pkgs/by-name/se/seafile-server/package.nix b/pkgs/by-name/se/seafile-server/package.nix
index c30fa38965a5..864eedd69663 100644
--- a/pkgs/by-name/se/seafile-server/package.nix
+++ b/pkgs/by-name/se/seafile-server/package.nix
@@ -39,8 +39,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "seafile-server";
-  version = "11.0.12";
-
+  version = "11.0.12"; # Doc links match Seafile 11.0 in seafile.nix – update if version changes.
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-server";
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 3f20f900e3da..c6f59015afa1 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -38,13 +38,13 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2025-06-10";
+    version = "0-unstable-2025-06-14";
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "8888d71ab9391a8865959aa125cc7a1ae537f0b8";
-      hash = "sha256-nQvh8tp11WYe44nzBofLmJr/2el+SECoGK0Ds4lvdC4=";
+      rev = "e52e9bb4b699e39d9ce51874ea339d4773717389";
+      hash = "sha256-azSFD1Uxa8RTbX3xllxkZuLCahpQdh/8F1TiUx2irhA=";
     };
 
     postPatch = ''
diff --git a/pkgs/by-name/se/sesh/package.nix b/pkgs/by-name/se/sesh/package.nix
index 2e42558ac8b9..8c7e8dd3a897 100644
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "sesh";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "joshmedeski";
     repo = "sesh";
     rev = "v${version}";
-    hash = "sha256-D//yt8DVy7DMX38qfmVa5UbGIgjzsGXQoscrhcgPzh4=";
+    hash = "sha256-3kD7t3lgkxrK53cL+5i9DB5w1hIYA4J/MiauLZ1Z7KQ=";
   };
 
   vendorHash = "sha256-r6n0xZbOvqDU63d3WrXenvV4x81iRgpOS2h73xSlVBI=";
diff --git a/pkgs/by-name/sf/sftpgo/package.nix b/pkgs/by-name/sf/sftpgo/package.nix
index 4aa8c8faddb2..5a2b98ca953d 100644
--- a/pkgs/by-name/sf/sftpgo/package.nix
+++ b/pkgs/by-name/sf/sftpgo/package.nix
@@ -63,7 +63,10 @@ buildGoModule rec {
       agpl3Only
       unfreeRedistributable
     ]; # Software is AGPLv3, web UI is unfree
-    maintainers = with lib.maintainers; [ thenonameguy ];
+    maintainers = with lib.maintainers; [
+      thenonameguy
+      ryan4yin
+    ];
     mainProgram = "sftpgo";
   };
 }
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index de01cc520de0..5877748ae454 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.6.8";
+  version = "0.6.10";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     tag = version;
-    hash = "sha256-vLy3HWHfsUaf80iuBUYYAP87wJNke8/h48r3Db18kFQ=";
+    hash = "sha256-kzf54rPac/OYmmqEAoQPWFjtzMj0FOGOMoxdX2zlX8s=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
     dart-sass
   ];
 
-  vendorHash = "sha256-pidR7b4k3PG9FVHJ5oWz2nYtCZwE8SlBjQqqvyFPNzM=";
+  vendorHash = "sha256-gw0O9cLRkCo8FMlUSgVsL7c5xSSP7sAcwL/WUAy6MiI=";
 
   postInstall = ''
     installShellCompletion --cmd shopware-cli \
diff --git a/pkgs/by-name/si/signal-desktop-bin/generic.nix b/pkgs/by-name/si/signal-desktop-bin/generic.nix
index 978ba0ae4dfe..9b0fd4aec65c 100644
--- a/pkgs/by-name/si/signal-desktop-bin/generic.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/generic.nix
@@ -51,6 +51,9 @@
   libpulseaudio,
   xdg-utils,
   wayland,
+
+  # command line arguments which are always set e.g "--password-store=kwallet6"
+  commandLineArgs,
 }:
 
 {
@@ -255,6 +258,7 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+      --add-flags ${lib.escapeShellArg commandLineArgs}
     )
 
     # Fix the desktop link
diff --git a/pkgs/by-name/si/signal-desktop-bin/package.nix b/pkgs/by-name/si/signal-desktop-bin/package.nix
index f2faec1ccb35..79e6becbe892 100644
--- a/pkgs/by-name/si/signal-desktop-bin/package.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/package.nix
@@ -1,7 +1,11 @@
-{ stdenv, callPackage }:
+{
+  stdenv,
+  callPackage,
+  commandLineArgs ? "",
+}:
 if stdenv.hostPlatform.system == "aarch64-linux" then
-  callPackage ./signal-desktop-aarch64.nix { }
+  callPackage ./signal-desktop-aarch64.nix { inherit commandLineArgs; }
 else if stdenv.hostPlatform.isDarwin then
   callPackage ./signal-desktop-darwin.nix { }
 else
-  callPackage ./signal-desktop.nix { }
+  callPackage ./signal-desktop.nix { inherit commandLineArgs; }
diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
index 40c707422afe..1f1f5344e11f 100644
--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
@@ -1,7 +1,7 @@
-{ callPackage }:
-callPackage ./generic.nix { } {
+{ callPackage, commandLineArgs }:
+callPackage ./generic.nix { inherit commandLineArgs; } {
   pname = "signal-desktop-bin";
-  version = "7.55.0";
+  version = "7.58.0";
 
   libdir = "usr/lib64/signal-desktop";
   bindir = "usr/bin";
@@ -10,6 +10,6 @@ callPackage ./generic.nix { } {
     bsdtar -xf $downloadedFile -C "$out"
   '';
 
-  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09073923-signal-desktop/signal-desktop-7.55.0-1.fc42.aarch64.rpm";
-  hash = "sha256-rRt2hYyj6kyN0RCupy+hpRJuzq0aaUzP2tsVr2Qd5V4=";
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09183198-signal-desktop/signal-desktop-7.58.0-1.fc42.aarch64.rpm";
+  hash = "sha256-0Ix+1SdvmKLVbtGzbjUupvVzdWAJFNQ6sSAIt+T9fHo=";
 }
diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
index 29140ecf699d..12d651efd925 100644
--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop-bin";
-  version = "7.55.0";
+  version = "7.58.0";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-9PD4SDTACjKSBqIdv3CFtKhRKA5ugbQe2AcWA4hFoqs=";
+    hash = "sha256-yOPYG9bCSCIE1L8RgEXCy6pJUHONBh9SpPY4WDfZEho=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
index 31e3b0c7dc08..9bb3f231165c 100644
--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
@@ -1,12 +1,12 @@
-{ callPackage }:
-callPackage ./generic.nix { } rec {
+{ callPackage, commandLineArgs }:
+callPackage ./generic.nix { inherit commandLineArgs; } rec {
   pname = "signal-desktop-bin";
-  version = "7.55.0";
+  version = "7.58.0";
 
   libdir = "opt/Signal";
   bindir = libdir;
   extractPkg = "dpkg-deb -x $downloadedFile $out";
 
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-uc623M/GiIfED1mTFnXUggnFdvDBmngrsdTIlq6QxqM=";
+  hash = "sha256-zZ63AE+qb0lrGtGUtU4FV6pHDO2DUV2vknz3a4+f4aA=";
 }
diff --git a/pkgs/by-name/si/simpleDBus/package.nix b/pkgs/by-name/si/simpleDBus/package.nix
index b79b20b974b1..916557231296 100644
--- a/pkgs/by-name/si/simpleDBus/package.nix
+++ b/pkgs/by-name/si/simpleDBus/package.nix
@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "simpleDBus";
 
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "OpenBluetoothToolbox";
     repo = "SimpleBLE";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SFQs0f36xW0PibK1P1rTCWOA7pp3kY6659xLOBeZt6A=";
+    hash = "sha256-Qi78o3WJ28Gp1OsCyFHhd/7F4/jWLzGjPRwT5qSqqtM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sk/skopeo/package.nix b/pkgs/by-name/sk/skopeo/package.nix
index 9e8eeff9ad1d..335f6c5ae2c1 100644
--- a/pkgs/by-name/sk/skopeo/package.nix
+++ b/pkgs/by-name/sk/skopeo/package.nix
@@ -92,6 +92,7 @@ buildGoModule rec {
     maintainers = with maintainers; [
       lewo
       developer-guy
+      ryan4yin
     ];
     teams = [ teams.podman ];
     license = licenses.asl20;
diff --git a/pkgs/by-name/sl/slumber/package.nix b/pkgs/by-name/sl/slumber/package.nix
index 98776cbff851..670e418a6a8e 100644
--- a/pkgs/by-name/sl/slumber/package.nix
+++ b/pkgs/by-name/sl/slumber/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "slumber";
-  version = "3.1.3";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "LucasPickering";
     repo = "slumber";
     tag = "v${version}";
-    hash = "sha256-HSC0G0Ll8geBwd4eBhk5demL2likhMZqlkYGcbzNOck=";
+    hash = "sha256-FR+XHgL/DfVFeEbAT1h1nwBnJkG7jnHfd+JRLVTY0LE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5i4lfW21QJzVReUGdgeymI1tBX367qBu8yveVFtgORI=";
+  cargoHash = "sha256-qRqdNCeVb7dD91q6gEK1c5rQ8LhcwJ5hwn1TfSPseO4=";
 
   meta = {
     description = "Terminal-based HTTP/REST client";
diff --git a/pkgs/by-name/sn/snyk/package.nix b/pkgs/by-name/sn/snyk/package.nix
index 020b60b99a68..99929f56b105 100644
--- a/pkgs/by-name/sn/snyk/package.nix
+++ b/pkgs/by-name/sn/snyk/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "1.1297.1";
+  version = "1.1297.2";
 in
 buildNpmPackage {
   pname = "snyk";
@@ -18,7 +18,7 @@ buildNpmPackage {
     owner = "snyk";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-/wA6bBjgz3KhTBw/JJpLM5UkRNHehVdm6ubpq92N4IY=";
+    hash = "sha256-guDCwLvl5cYzeZJbwOQvzCuBtXo3PNrvOimS2GmQwaY=";
   };
 
   npmDepsHash = "sha256-SzrBhY7iWGlIPNB+5ROdaxAlQSetSKc3MPBp+4nNh+o=";
diff --git a/pkgs/by-name/so/socat/package.nix b/pkgs/by-name/so/socat/package.nix
index 257529fe2366..55fcc3bb5992 100644
--- a/pkgs/by-name/so/socat/package.nix
+++ b/pkgs/by-name/so/socat/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.dest-unreach.org/socat/";
     platforms = platforms.unix;
     license = with licenses; [ gpl2Only ];
-    maintainers = [ ];
+    maintainers = with maintainers; [ ryan4yin ];
     mainProgram = "socat";
   };
 }
diff --git a/pkgs/by-name/sp/spytrap-adb/package.nix b/pkgs/by-name/sp/spytrap-adb/package.nix
index c830c0a1abf0..93b14647dd98 100644
--- a/pkgs/by-name/sp/spytrap-adb/package.nix
+++ b/pkgs/by-name/sp/spytrap-adb/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spytrap-adb";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "spytrap-org";
     repo = "spytrap-adb";
     tag = "v${version}";
-    hash = "sha256-Yqa+JmqYCmy9ehxmRebPNlU5U2RPHtnHDHiqSg8EvAo=";
+    hash = "sha256-t5MNgsuH5FVEjUP9FFxbjXs5BVim0ZyfNKUTQOjKpqg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hXDxo0b2nJbPyo99Qc39LM0P41SDbyfadHLIRrbQdj0=";
+  cargoHash = "sha256-VoUzAHTxJLeyi60ftuOkI6PAuLUsSsQSUjk9rcGz86A=";
 
   env.SPYTRAP_ADB_BINARY = lib.getExe' android-tools "adb";
 
diff --git a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
index 4168b8b1d828..a38ba61c178d 100644
--- a/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
+++ b/pkgs/by-name/ss/ssm-session-manager-plugin/package.nix
@@ -74,6 +74,7 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       amarshall
       mbaillie
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/su/subfinder/package.nix b/pkgs/by-name/su/subfinder/package.nix
index 3d1622daf883..09c8700d15ff 100644
--- a/pkgs/by-name/su/subfinder/package.nix
+++ b/pkgs/by-name/su/subfinder/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "subfinder";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "subfinder";
     tag = "v${version}";
-    hash = "sha256-pbrW95CrRRQok6MfA0ujjLiXTr1VFUswc/gK9WhU6qI=";
+    hash = "sha256-HfQz0tLBKt16IrtxOT3lX28FcVG05X1hICw5Xq/dQJw=";
   };
 
-  vendorHash = "sha256-v+AyeQoeTTPI7C1WysCu8adX6cBk06JudPigCIWNFGQ=";
+  vendorHash = "sha256-3bHIrjA5Bbl6prF+ttEs+N2Sa4AMZDtRk3ysoIitsdY=";
 
   modRoot = "./v2";
 
diff --git a/pkgs/by-name/su/sudo/package.nix b/pkgs/by-name/su/sudo/package.nix
index 31ddf4d3af1f..34b1a8e98e16 100644
--- a/pkgs/by-name/su/sudo/package.nix
+++ b/pkgs/by-name/su/sudo/package.nix
@@ -17,13 +17,13 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "sudo";
   # be sure to check if nixos/modules/security/sudo.nix needs updating when bumping
   # e.g. links to man pages, value constraints etc.
-  version = "1.9.16p2";
+  version = "1.9.17";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/sudo-${finalAttrs.version}.tar.gz";
-    hash = "sha256-l2qlbT47KnVZMweGQoit23SMnBNuJdlanMaZqvp3I5w=";
+    hash = "sha256-PyEsadU01YIrSS0JmrsCpZP5HKmfWv3ly5vT4dza0Gk=";
   };
 
   prePatch = ''
diff --git a/pkgs/by-name/sw/swaybg/package.nix b/pkgs/by-name/sw/swaybg/package.nix
index 2d854647d1fc..846a4d5d19b3 100644
--- a/pkgs/by-name/sw/swaybg/package.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
@@ -60,7 +60,10 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.mit;
     mainProgram = "swaybg";
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [
+      primeos
+      ryan4yin
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/sy/sydbox/package.nix b/pkgs/by-name/sy/sydbox/package.nix
index 3a51a9ac6375..c35f55a3dc02 100644
--- a/pkgs/by-name/sy/sydbox/package.nix
+++ b/pkgs/by-name/sy/sydbox/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sydbox";
-  version = "3.35.1";
+  version = "3.35.2";
 
   outputs = [
     "out"
@@ -24,11 +24,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Sydbox";
     repo = "sydbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EfsL8UEZdWRYqQ5QymteUBxtabfrHxq3WU4MMqsXWAg=";
+    hash = "sha256-n3mvzYXb965eUWNJ5iHezqqAZj6v05gj092osYZuk5s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ckeOk4/fpJ9J8JV/NT0D/0jXUOt4ub+m+6ZBUpBEs08=";
+  cargoHash = "sha256-D0lUkiARl0QL2OsojaJqsACn2fmN9x8Jp7mZzyRjyWY=";
 
   nativeBuildInputs = [
     mandoc
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index cec7cc8b19f5..daa8b6fb1e62 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -224,6 +224,7 @@ buildGoModule {
       jk
       mfrw
       pyrox0
+      ryan4yin
     ];
   };
 }
diff --git a/pkgs/by-name/ta/tauno-monitor/package.nix b/pkgs/by-name/ta/tauno-monitor/package.nix
index c92b1e7d1b5c..709db657b9c8 100644
--- a/pkgs/by-name/ta/tauno-monitor/package.nix
+++ b/pkgs/by-name/ta/tauno-monitor/package.nix
@@ -13,14 +13,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "tauno-monitor";
-  version = "0.1.29";
+  version = "0.2.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "taunoe";
     repo = "tauno-monitor";
     tag = "v${version}";
-    hash = "sha256-U7vp0cPIRQeeuLGazoCQAnVQaKxDznC65bE31SwYU3A=";
+    hash = "sha256-144kRMhZUwgn3BRy6c0A5Fwh1Yisuf7H2s/0ChpIKVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tb/tbb_2021/package.nix b/pkgs/by-name/tb/tbb_2021/package.nix
index bddbb1a546fe..d20f88c6681a 100644
--- a/pkgs/by-name/tb/tbb_2021/package.nix
+++ b/pkgs/by-name/tb/tbb_2021/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tbb";
-  version = "2021.13.0";
+  version = "2021.12.0";
 
   outputs = [
     "out"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "oneapi-src";
     repo = "oneTBB";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZoUzY71SweVQ8/1k09MNSXiEqab6Ae+QTbxORnar9JU=";
+    hash = "sha256-yG/Fs+3f9hNKzZ8le+W7+JDZk9hMzPsVAzbq0yTcUTc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tc/tcld/package.nix b/pkgs/by-name/tc/tcld/package.nix
index f34713ab6343..e47f452cfb68 100644
--- a/pkgs/by-name/tc/tcld/package.nix
+++ b/pkgs/by-name/tc/tcld/package.nix
@@ -4,25 +4,46 @@
   lib,
   stdenvNoCC,
   installShellFiles,
+  versionCheckHook,
   nix-update-script,
   ...
 }:
 
 buildGoModule (finalAttrs: {
   pname = "tcld";
-  version = "0.40.0";
+  version = "0.41.0";
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "tcld";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-bIJSvop1T3yiLs/LTgFxIMmObfkVfvvnONyY4Bsjj8g=";
+    hash = "sha256-Jnm6l9Jj1mi9esDS6teKTEMhq7V1QD/dTl3qFhKsW4o=";
+    # Populate values from the git repository; by doing this in 'postFetch' we
+    # can delete '.git' afterwards and the 'src' should stay reproducible.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      # Replicate 'COMMIT' and 'DATE' variables from upstream's Makefile.
+      git rev-parse --short=12 HEAD > $out/COMMIT
+      git log -1 --format=%cd --date=iso-strict > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -exec rm -rf '{}' '+'
+    '';
   };
+
   vendorHash = "sha256-GOko8nboj7eN4W84dqP3yLD6jK7GA0bANV0Tj+1GpgY=";
-  ldFlags = [
+
+  subPackages = [ "cmd/tcld" ];
+  ldflags = [
     "-s"
     "-w"
+    "-X=github.com/temporalio/tcld/app.version=${finalAttrs.version}"
   ];
 
+  # ldflags based on metadata from git.
+  preBuild = ''
+    ldflags+=" -X=github.com/temporalio/tcld/app.date=$(cat SOURCE_DATE_EPOCH)"
+    ldflags+=" -X=github.com/temporalio/tcld/app.commit=$(cat COMMIT)"
+  '';
+
   # FIXME: Remove after https://github.com/temporalio/tcld/pull/447 lands.
   patches = [ ./compgen.patch ];
 
@@ -36,12 +57,19 @@ buildGoModule (finalAttrs: {
     installShellCompletion --cmd tcld --zsh ${./zsh_autocomplete}
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Temporal cloud cli";
     homepage = "https://www.github.com/temporalio/tcld";
+    changelog = "https://github.com/temporalio/tcld/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     teams = [ lib.teams.mercury ];
+    mainProgram = "tcld";
   };
 })
diff --git a/pkgs/by-name/te/tealdeer/package.nix b/pkgs/by-name/te/tealdeer/package.nix
index 27eb4d3fd6a7..e87db45d1725 100644
--- a/pkgs/by-name/te/tealdeer/package.nix
+++ b/pkgs/by-name/te/tealdeer/package.nix
@@ -47,6 +47,7 @@ rustPlatform.buildRustPackage rec {
       davidak
       newam
       mfrw
+      ryan4yin
     ];
     license = with licenses; [
       asl20
diff --git a/pkgs/by-name/te/termius/package.nix b/pkgs/by-name/te/termius/package.nix
index 356efee6f660..893cacdbcc08 100644
--- a/pkgs/by-name/te/termius/package.nix
+++ b/pkgs/by-name/te/termius/package.nix
@@ -16,8 +16,8 @@
 
 stdenv.mkDerivation rec {
   pname = "termius";
-  version = "9.21.2";
-  revision = "227";
+  version = "9.22.1";
+  revision = "229";
 
   src = fetchurl {
     # find the latest version with
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     # and the sha512 with
     # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
     url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-xiTxJJa9OpwNZW3x6TbmY+8lE/61417OLfOWdK9UMbUyqOtbhD3pSVq9M/uG13gvUndOkEoM2bbci/gKG+J0xw==";
+    hash = "sha512-RT/vtrtwxFWcZL2x87rHdj9AdvxNP6rAQj2pLL2DvzyDOLyp5eFo9uoTvrrHPlCLz6wevJj7moTmQig68uCmpQ==";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/te/terraformer/package.nix b/pkgs/by-name/te/terraformer/package.nix
index ffe8efbe0a35..478685a30813 100644
--- a/pkgs/by-name/te/terraformer/package.nix
+++ b/pkgs/by-name/te/terraformer/package.nix
@@ -24,6 +24,6 @@ buildGoModule rec {
     mainProgram = "terraformer";
     homepage = "https://github.com/GoogleCloudPlatform/terraformer";
     license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ryan4yin ];
   };
 }
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index f945349ac638..50887d368236 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-47glX5O8MALXv8JFrbIGaj6LKJyRuZcR8yapwKmzWbc=";
-    "x86_64-linux" = "sha256-5HIxbswZV94Tem8LUVtGcx8cb00J5qGLBsNZR077Bm4=";
-    "aarch64-linux" = "sha256-wXiSL3hJ6yulrGagb5TflJSWujAQqpUGZtz+GJWcy0M=";
+    "universal-macos" = "sha256-muEoLk6pL0hobpdzalXs/SjlB+eRJgbt7rPHbgs0IZo=";
+    "x86_64-linux" = "sha256-TP7pqXZceqboMuQGkO2/yyPH4K2YWEpNIzREKQDY2is=";
+    "aarch64-linux" = "sha256-GGbCJVqBud+Fh1aasEEupmRF3B/sYntBkC8B5mGxnWI=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.44";
+  version = "0.16.45";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index ebcae270462e..31fdd4b8bc5c 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,17 +15,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.13.12";
+  version = "0.13.14";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5uokMl+ZgDKVoxnQ/her/Aq6c69Gv0ngZuTDH0jcyoE=";
+    hash = "sha256-CTZhMbXLL13ybKFC34LArE/OXGfrAnXKXM79DP8ct60=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GJJXTVm7hLmMaRJnpmslrpKNHnyhgo/6ZWXU//xl1Vc=";
+  cargoHash = "sha256-aD50+awwVds9zwW5hM0Hgxv8NGV7J63BOSpU9907O+k=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,6 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # Require internet access
     "--skip=docs::package::tests::cetz"
+    "--skip=docs::package::tests::fletcher"
     "--skip=docs::package::tests::tidy"
     "--skip=docs::package::tests::touying"
 
diff --git a/pkgs/by-name/to/todds/TBB-version.patch b/pkgs/by-name/to/todds/TBB-version.patch
new file mode 100644
index 000000000000..6b16778aa801
--- /dev/null
+++ b/pkgs/by-name/to/todds/TBB-version.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index d41a1e2..7990cdf 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -60,7 +60,7 @@ if (TODDS_REGULAR_EXPRESSIONS)
+ endif ()
+ find_package(OpenCV 4.0 REQUIRED)
+ find_package(Threads REQUIRED)
+-find_package(TBB 2021.5.0 REQUIRED)
++find_package(TBB REQUIRED)
+ 
+ if (TODDS_TRACY)
+ 	find_package(Tracy REQUIRED)
diff --git a/pkgs/by-name/to/todds/package.nix b/pkgs/by-name/to/todds/package.nix
new file mode 100644
index 000000000000..f6d0a9baca64
--- /dev/null
+++ b/pkgs/by-name/to/todds/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  pkg-config,
+  ispc,
+  boost,
+  fmt,
+  hyperscan,
+  opencv,
+  tbb_2021,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "todds";
+  version = "0.4.1";
+
+  patches = [ ./TBB-version.patch ];
+
+  src = fetchFromGitHub {
+    owner = "todds-encoder";
+    repo = "todds";
+    tag = finalAttrs.version;
+    hash = "sha256-nyYFYym9ZZskkaTPV30+QavdqpvVopnIXXZC6zkeu7c=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    ispc
+  ];
+
+  buildInputs = [
+    boost
+    fmt
+    hyperscan
+    opencv
+    tbb_2021
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "CPU-based DDS encoder optimized for fast batch conversions with high encoding quality";
+    homepage = "https://github.com/todds-encoder/todds";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ weirdrock ];
+    mainProgram = "todds";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ur/url-parser/package.nix b/pkgs/by-name/ur/url-parser/package.nix
index 36ef2165ca4a..6a38e24aa19c 100644
--- a/pkgs/by-name/ur/url-parser/package.nix
+++ b/pkgs/by-name/ur/url-parser/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "url-parser";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     tag = "v${version}";
-    hash = "sha256-pmsF2wYEjJ8//sUvkW0psj4ULOjwp8s3hzxVKXCM0Ok=";
+    hash = "sha256-EJ1FVFv0MF9BoOtY6+JKgTeu3RBBlUWB79C6+Geb0cY=";
   };
 
-  vendorHash = "sha256-873EOiS57LKZDehtDZyc3ACEXhUFOtIX6v+D2LUarwE=";
+  vendorHash = "sha256-GhBSVbzZ3UqFroLimi5VbTVO6DhEMVAd6iyhGwO6HK0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index b0ae1721c435..891f6adce484 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.21.8";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b5n0SuJ0WEm7Mx77BVgjabw5QQeXR7lGUHLxIyqmM9I=";
+    hash = "sha256-8MdgtfmgWVUl5YPP/91KrGNNHl60P2ID2TUMZ4V3BiI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/v2/v2ray/package.nix b/pkgs/by-name/v2/v2ray/package.nix
index 4bb399d9280a..b4ea1a5a3416 100644
--- a/pkgs/by-name/v2/v2ray/package.nix
+++ b/pkgs/by-name/v2/v2ray/package.nix
@@ -70,6 +70,9 @@ buildGoModule rec {
     description = "Platform for building proxies to bypass network restrictions";
     mainProgram = "v2ray";
     license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ servalcatty ];
+    maintainers = with lib.maintainers; [
+      servalcatty
+      ryan4yin
+    ];
   };
 }
diff --git a/pkgs/by-name/v2/v2rayn/deps.json b/pkgs/by-name/v2/v2rayn/deps.json
index 474e080ddbc7..ff1266cf0fd2 100644
--- a/pkgs/by-name/v2/v2rayn/deps.json
+++ b/pkgs/by-name/v2/v2rayn/deps.json
@@ -11,13 +11,13 @@
   },
   {
     "pname": "Avalonia",
-    "version": "11.3.0",
-    "hash": "sha256-Hot4dWkrP5x+JzaP2/7E1QOOiXfPGhkvK1nzBacHvzg="
+    "version": "11.3.1",
+    "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
-    "version": "2.1.22045.20230930",
-    "hash": "sha256-RxPcWUT3b/+R3Tu5E5ftpr5ppCLZrhm+OTsi0SwW3pc="
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
   },
   {
     "pname": "Avalonia.BuildServices",
@@ -31,38 +31,38 @@
   },
   {
     "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.3.0",
-    "hash": "sha256-ee3iLrn8OdWH6Mg01p93wYMMCPXS25VM/uZeQWEr+k0="
+    "version": "11.3.1",
+    "hash": "sha256-95sAkALievpuwLtCl7+6PgwNyxx9DAi/vVvQUFT7Qqs="
   },
   {
     "pname": "Avalonia.Controls.DataGrid",
-    "version": "11.3.0",
-    "hash": "sha256-McFggedX7zb9b0FytFeuh+3nPdFqoKm2JMl2VZDs/BQ="
+    "version": "11.3.1",
+    "hash": "sha256-UcfsSNYCd9zO75hyLevVe59/esHgNmcjJOproy3nhNM="
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.3.0",
-    "hash": "sha256-XZXmsKrYCOEWzFUbnwNKvEz5OCD/1lAPi+wM4BiMB7I="
+    "version": "11.3.1",
+    "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90="
   },
   {
     "pname": "Avalonia.Diagnostics",
-    "version": "11.3.0",
-    "hash": "sha256-jO8Fs9kfNGsoZ87zQCxPdn0tyWHcEdgBRIpzkZ0ceM0="
+    "version": "11.3.1",
+    "hash": "sha256-zDX3BfqUFUQ+p1ZWdHuhnV0n5B9RfiEtB8m0Px5AhsI="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.0",
-    "hash": "sha256-nWIW3aDPI/00/k52BNU4n43sS3ymuw+e97EBSsjjtU4="
+    "version": "11.3.1",
+    "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.3.0",
-    "hash": "sha256-l6gcCeGd422mLQgVLp2sxh4/+vZxOPoMrxyfjGyhYLs="
+    "version": "11.3.1",
+    "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs="
   },
   {
     "pname": "Avalonia.ReactiveUI",
-    "version": "11.3.0",
-    "hash": "sha256-yY/xpe4Te6DLa1HZCWZgIGpdKeZqvknRtpkpBTrZhmU="
+    "version": "11.3.1",
+    "hash": "sha256-m7AFSxwvfz9LAueu0AFC+C7jHrB+lysBmpBh7bhpmUs="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
@@ -76,33 +76,33 @@
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.0",
-    "hash": "sha256-7ytabxzTbPLR3vBCCb7Z6dYRZZVvqiDpvxweOYAqi7I="
+    "version": "11.3.1",
+    "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.3.0",
-    "hash": "sha256-p+mWsyrYsC9PPhNjOxPZwarGuwmIjxaQ4Ml/2XiEuEc="
+    "version": "11.3.1",
+    "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI="
   },
   {
     "pname": "Avalonia.Themes.Simple",
-    "version": "11.3.0",
-    "hash": "sha256-F2DMHskmrJw/KqpYLHGEEuQMVP8T4fXgq5q3tfwFqG0="
+    "version": "11.3.1",
+    "hash": "sha256-U9btigJeFcuOu7T3ryyJJesffnZo1JBb9pWkF0PFu9s="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.3.0",
-    "hash": "sha256-Ltf6EuL6aIG+YSqOqD/ecdqUDsuwhNuh+XilIn7pmlE="
+    "version": "11.3.1",
+    "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.3.0",
-    "hash": "sha256-QOprHb0HjsggEMWOW7/U8pqlD8M4m97FeTMWlriYHaU="
+    "version": "11.3.1",
+    "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ="
   },
   {
     "pname": "CliWrap",
-    "version": "3.8.2",
-    "hash": "sha256-sZQqu03sJL0LlnLssXVXHTen9marNbC/G15mAKjhFJU="
+    "version": "3.9.0",
+    "hash": "sha256-WC1bX8uy+8VZkrV6eK8nJ24Uy81Bj4Aao27OsP1sGyE="
   },
   {
     "pname": "DialogHost.Avalonia",
@@ -116,8 +116,8 @@
   },
   {
     "pname": "DynamicData",
-    "version": "9.1.2",
-    "hash": "sha256-rDbtd7Fw/rhq6s9G4p/rltZ3EIR5r1RcMXsAEe7nZjw="
+    "version": "9.3.2",
+    "hash": "sha256-00fzA28aU48l52TsrDSJ9ucljYOunmH7s2qPyR3YjRA="
   },
   {
     "pname": "Fody",
@@ -126,28 +126,28 @@
   },
   {
     "pname": "HarfBuzzSharp",
-    "version": "7.3.0.3",
-    "hash": "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM="
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Linux",
-    "version": "7.3.0.3",
-    "hash": "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM="
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.macOS",
-    "version": "7.3.0.3",
-    "hash": "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w="
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
-    "version": "7.3.0.3",
-    "hash": "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I="
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Win32",
-    "version": "7.3.0.3",
-    "hash": "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I="
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
   },
   {
     "pname": "MessageBox.Avalonia",
@@ -186,8 +186,8 @@
   },
   {
     "pname": "ReactiveUI",
-    "version": "20.2.45",
-    "hash": "sha256-7JzWD40/iNnp7+wuG/qEJoVXQz0T7qipq5NWJFxJ6VM="
+    "version": "20.3.1",
+    "hash": "sha256-1eCZ5M+zkVmlPYuK1gBDCdyCGlYbXIfX+h6Vz0hu8e4="
   },
   {
     "pname": "ReactiveUI.Fody",
@@ -196,13 +196,13 @@
   },
   {
     "pname": "Semi.Avalonia",
-    "version": "11.2.1.7",
-    "hash": "sha256-LFlgdRcqNR+ZV9Hkyuw7LhaFWKwCuXWRWYM+9sQRBDU="
+    "version": "11.2.1.8",
+    "hash": "sha256-1P3hr634woqLtNrWOiJWzizwh0AMWt9Y7J1SXHIkv5M="
   },
   {
     "pname": "Semi.Avalonia.DataGrid",
-    "version": "11.2.1.7",
-    "hash": "sha256-EWfzKeM5gMoJHx7L9+kAeGtaaY6HeG+NwAxv08rOv6E="
+    "version": "11.2.1.8",
+    "hash": "sha256-OKb+vlKSf9e0vL5mGNzSEr62k1Zy/mS4kXWGHZHcBq0="
   },
   {
     "pname": "SkiaSharp",
@@ -294,11 +294,6 @@
     "version": "8.0.0",
     "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="
   },
-  {
-    "pname": "System.IO.Pipelines",
-    "version": "9.0.2",
-    "hash": "sha256-uxM7J0Q/dzEsD0NGcVBsOmdHiOEawZ5GNUKBwpdiPyE="
-  },
   {
     "pname": "System.Memory",
     "version": "4.5.3",
@@ -319,16 +314,6 @@
     "version": "5.0.0",
     "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
   },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "9.0.2",
-    "hash": "sha256-tZhc/Xe+SF9bCplthph2QmQakWxKVjMfQJZzD1Xbpg8="
-  },
-  {
-    "pname": "System.Text.Json",
-    "version": "9.0.2",
-    "hash": "sha256-kftKUuGgZtF4APmp77U79ws76mEIi+R9+DSVGikA5y8="
-  },
   {
     "pname": "TaskScheduler",
     "version": "2.12.1",
diff --git a/pkgs/by-name/v2/v2rayn/package.nix b/pkgs/by-name/v2/v2rayn/package.nix
index d0520467233f..5526d50f5268 100644
--- a/pkgs/by-name/v2/v2rayn/package.nix
+++ b/pkgs/by-name/v2/v2rayn/package.nix
@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "v2rayn";
-  version = "7.12.5";
+  version = "7.12.7";
 
   src = fetchFromGitHub {
     owner = "2dust";
     repo = "v2rayN";
     tag = version;
-    hash = "sha256-gXVriD9g4Coc0B0yN5AlfNre9C9l8V5wv4q3KgKRsF0=";
+    hash = "sha256-pYkUbctdN3qaGxI5DbreoOGmXyIVrpHqYlN3BFRCcZ8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/va/vaults/not-found-flatpak-info.patch b/pkgs/by-name/va/vaults/not-found-flatpak-info.patch
deleted file mode 100644
index d1a9e0dd0079..000000000000
--- a/pkgs/by-name/va/vaults/not-found-flatpak-info.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/global_config_manager.rs
-+++ b/src/global_config_manager.rs
-@@ -100,7 +100,7 @@
-         let object: Self = glib::Object::new();
- 
-         *object.imp().flatpak_info.borrow_mut() =
--            Ini::load_from_file("/.flatpak-info").expect("Could not load .flatpak-info");
-+            Ini::load_from_file("/.flatpak-info").unwrap_or_else(|_| Ini::new());
- 
-         match user_config_dir().as_os_str().to_str() {
-             Some(user_config_directory) => {
diff --git a/pkgs/by-name/va/vaults/package.nix b/pkgs/by-name/va/vaults/package.nix
index ea854d043f7f..8a55f45bf772 100644
--- a/pkgs/by-name/va/vaults/package.nix
+++ b/pkgs/by-name/va/vaults/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  replaceVars,
   appstream-glib,
   desktop-file-utils,
   meson,
@@ -18,45 +19,39 @@
   wayland,
   gocryptfs,
   cryfs,
+  fuse,
+  util-linux,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "vaults";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "mpobaschnig";
     repo = "vaults";
-    tag = version;
-    hash = "sha256-PczDj6G05H6XbkMQBr4e1qgW5s8GswEA9f3BRxsAWv0=";
+    tag = finalAttrs.version;
+    hash = "sha256-B4CNEghMfP+r0poyhE102zC1Yd2U5ocV1MCMEVEMjEY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-j0A6HlApV0l7LuB7ISHp+k/bSH5Icdv+aNQ9juCCO9I=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-my4CxFIEN19juo/ya2vlkejQTaZsyoYLtFTR7iCT9s0=";
   };
 
-  patches = [ ./not-found-flatpak-info.patch ];
+  patches = [
+    (replaceVars ./remove_flatpak_dependency.patch {
+      cryfs = lib.getExe' cryfs "cryfs";
+      gocryptfs = lib.getExe' gocryptfs "gocryptfs";
+      fusermount = lib.getExe' fuse "fusermount";
+      umount = lib.getExe' util-linux "umount";
+    })
+  ];
 
   postPatch = ''
     patchShebangs build-aux
   '';
 
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PATH : "${
-        lib.makeBinPath [
-          gocryptfs
-          cryfs
-        ]
-      }"
-    )
-  '';
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
@@ -82,7 +77,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "GTK frontend for encrypted vaults supporting gocryptfs and CryFS for encryption";
     homepage = "https://mpobaschnig.github.io/vaults/";
-    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${version}";
+    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       benneti
@@ -91,4 +86,4 @@ stdenv.mkDerivation rec {
     mainProgram = "vaults";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/va/vaults/remove_flatpak_dependency.patch b/pkgs/by-name/va/vaults/remove_flatpak_dependency.patch
new file mode 100644
index 000000000000..7f7e863494de
--- /dev/null
+++ b/pkgs/by-name/va/vaults/remove_flatpak_dependency.patch
@@ -0,0 +1,139 @@
+diff --git a/src/backend/cryfs.rs b/src/backend/cryfs.rs
+index 089bf03..157c72a 100644
+--- a/src/backend/cryfs.rs
++++ b/src/backend/cryfs.rs
+@@ -35,13 +35,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+         }
+     }
+ 
+-    let global_config = GlobalConfigManager::instance().get_flatpak_info();
+-    let instance_path = global_config
+-        .section(Some("Instance"))
+-        .unwrap()
+-        .get("app-path")
+-        .unwrap();
+-    let cryfs_instance_path = instance_path.to_owned() + "/bin/cryfs";
++    let cryfs_instance_path = "@cryfs@".to_string();
+     log::info!("CryFS binary path: {}", cryfs_instance_path);
+     cryfs_instance_path
+ }
+@@ -49,9 +43,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+     log::trace!("is_available({:?})", vault_config);
+ 
+-    let output = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let output = Command::new(get_binary_path(vault_config))
+         .arg("--version")
+         .output()?;
+     log::debug!("CryFS output: {:?}", output);
+@@ -64,9 +56,7 @@ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("init({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let mut child = Command::new(get_binary_path(vault_config))
+         .env("CRYFS_FRONTEND", "noninteractive")
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+@@ -106,9 +96,7 @@ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("open({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let mut child = Command::new(get_binary_path(vault_config))
+         .env("CRYFS_FRONTEND", "noninteractive")
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+@@ -143,9 +131,7 @@ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn close(vault_config: &VaultConfig) -> Result<(), BackendError> {
+     log::trace!("close({:?})", vault_config);
+ 
+-    let child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg("fusermount")
++    let child = Command::new("@fusermount@")
+         .arg("-u")
+         .stdout(Stdio::piped())
+         .arg(&vault_config.mount_directory)
+diff --git a/src/backend/gocryptfs.rs b/src/backend/gocryptfs.rs
+index 9638f3a..ffa8f44 100644
+--- a/src/backend/gocryptfs.rs
++++ b/src/backend/gocryptfs.rs
+@@ -35,13 +35,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+         }
+     }
+ 
+-    let global_config = GlobalConfigManager::instance().get_flatpak_info();
+-    let instance_path = global_config
+-        .section(Some("Instance"))
+-        .unwrap()
+-        .get("app-path")
+-        .unwrap();
+-    let gocryptfs_instance_path = instance_path.to_owned() + "/bin/gocryptfs";
++    let gocryptfs_instance_path = "@gocryptfs@".to_string();
+     log::info!("gocryptfs binary path: {}", gocryptfs_instance_path);
+     gocryptfs_instance_path
+ }
+@@ -49,9 +43,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+     log::trace!("is_available({:?})", vault_config);
+ 
+-    let output = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let output = Command::new(get_binary_path(vault_config))
+         .arg("--version")
+         .output()?;
+     log::debug!("gocryptfs output: {:?}", output);
+@@ -64,9 +56,7 @@ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("init({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let mut child = Command::new(get_binary_path(vault_config))
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+         .arg("--init")
+@@ -104,9 +94,7 @@ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("open({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
++    let mut child = Command::new(get_binary_path(vault_config))
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+         .arg("-q")
+@@ -142,9 +130,7 @@ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn close(vault_config: &VaultConfig) -> Result<(), BackendError> {
+     log::trace!("close({:?}, password: <redacted>)", vault_config);
+ 
+-    let child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg("umount")
++    let child = Command::new("@umount@")
+         .stdout(Stdio::piped())
+         .arg(&vault_config.mount_directory)
+         .spawn()?;
+diff --git a/src/global_config_manager.rs b/src/global_config_manager.rs
+index 619bb18..cea9ac3 100644
+--- a/src/global_config_manager.rs
++++ b/src/global_config_manager.rs
+@@ -102,7 +102,7 @@ impl GlobalConfigManager {
+         let object: Self = glib::Object::new();
+ 
+         *object.imp().flatpak_info.borrow_mut() =
+-            Ini::load_from_file("/.flatpak-info").expect("Could not load .flatpak-info");
++            Ini::load_from_file("/.flatpak-info").unwrap_or_else(|_| Ini::new());
+ 
+         match user_config_dir().as_os_str().to_str() {
+             Some(user_config_directory) => {
diff --git a/pkgs/by-name/ve/venera/package.nix b/pkgs/by-name/ve/venera/package.nix
index 383332425944..c8039c03522e 100644
--- a/pkgs/by-name/ve/venera/package.nix
+++ b/pkgs/by-name/ve/venera/package.nix
@@ -14,13 +14,13 @@
 
 flutter332.buildFlutterApplication rec {
   pname = "venera";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "venera-app";
     repo = "venera";
     tag = "v${version}";
-    hash = "sha256-ZJ5TMoBamXHU/pU790/6HHJwNqVsXpZ1OttPR/JSydY=";
+    hash = "sha256-yg7VwR1IGswyqkyuvTZnVVLI4YKnfcea+VemWLOUXto=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/ve/venera/pubspec.lock.json b/pkgs/by-name/ve/venera/pubspec.lock.json
index e0af10885f82..5e2fe10d13da 100644
--- a/pkgs/by-name/ve/venera/pubspec.lock.json
+++ b/pkgs/by-name/ve/venera/pubspec.lock.json
@@ -1379,6 +1379,6 @@
   },
   "sdks": {
     "dart": ">=3.8.0 <4.0.0",
-    "flutter": ">=3.32.0"
+    "flutter": ">=3.32.4"
   }
 }
diff --git a/pkgs/by-name/vi/via/package.nix b/pkgs/by-name/vi/via/package.nix
index 32497ea01073..04e624a6395b 100644
--- a/pkgs/by-name/vi/via/package.nix
+++ b/pkgs/by-name/vi/via/package.nix
@@ -36,7 +36,8 @@ appimageTools.wrapType2 {
   meta = with lib; {
     description = "Yet another keyboard configurator";
     homepage = "https://caniusevia.com/";
-    license = licenses.gpl3;
+    # Upstream claims to be GPL-3 but doesn't release source code
+    license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ emilytrau ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "via";
diff --git a/pkgs/by-name/vk/vkd3d-proton/sources.nix b/pkgs/by-name/vk/vkd3d-proton/sources.nix
index 4c4a39c6f6b6..0844a245508c 100644
--- a/pkgs/by-name/vk/vkd3d-proton/sources.nix
+++ b/pkgs/by-name/vk/vkd3d-proton/sources.nix
@@ -5,12 +5,12 @@
     let
       self = {
         pname = "vkd3d-proton";
-        version = "2.13";
+        version = "2.14.1";
 
         src = fetchFromGitHub {
           owner = "HansKristian-Work";
           repo = "vkd3d-proton";
-          rev = "v${self.version}";
+          tag = "v${self.version}";
           fetchSubmodules = true;
           #
           # Some files are filled by using Git commands; it requires deepClone.
@@ -31,7 +31,7 @@
             git describe --always --tags --dirty=+ > .nixpkgs-auxfiles/vkd3d_version
             find $out -name .git -print0 | xargs -0 rm -fr
           '';
-          hash = "sha256-dJYQ6pJdfRQwr8OrxxpWG6YMfeTXqzTrHXDd5Ecxbi8=";
+          hash = "sha256-8YA/I5UL6G5v4uZE2qKqXzHWeZxg67jm20rONKocvvE=";
         };
       };
     in
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index 43c7306022fc..9cfe61f4b68d 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "vunnel";
-  version = "0.33.0";
+  version = "0.34.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "vunnel";
     tag = "v${version}";
-    hash = "sha256-NmU+84hgKryn1zX7vk0ixy2msxeqwGwuTm1H44Lue7I=";
+    hash = "sha256-+ZWrFODJNhQeB/Zn+3fwuuH4Huu542/imwcv7qEiZes=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix
index 53a6abb425b3..8d7a91c8623f 100644
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@@ -71,18 +71,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waybar";
-  version = "0.12.0";
+  version = "0.12.0-unstable-2025-06-13";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
-    tag = finalAttrs.version;
-    hash = "sha256-VpT3ePqmo75Ni6/02KFGV6ltnpiV70/ovG/p1f2wKkU=";
+    # TODO: switch back to using tag when a new version is released which
+    # includes the fixes for issues like
+    # https://github.com/Alexays/Waybar/issues/3956
+    rev = "2c482a29173ffcc03c3e4859808eaef6c9014a1f";
+    hash = "sha256-29g4SN3Yr4q7zxYS3dU48i634jVsXHBwUUeALPAHZGM=";
   };
 
   postUnpack = lib.optional cavaSupport ''
     pushd "$sourceRoot"
-    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.3
+    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.4
     patchShebangs .
     popd
   '';
@@ -188,7 +191,9 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgramArg = "--version";
-  doInstallCheck = true;
+
+  # TODO: re-enable after bump to next release.
+  doInstallCheck = false;
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/wa/waydroid/package.nix b/pkgs/by-name/wa/waydroid/package.nix
index 3f968e65745c..c4c6128770e7 100644
--- a/pkgs/by-name/wa/waydroid/package.nix
+++ b/pkgs/by-name/wa/waydroid/package.nix
@@ -21,14 +21,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "waydroid";
     repo = "waydroid";
     tag = version;
-    hash = "sha256-G/JQR1C4osbZDUQSqLu48C468W6f2SeNkogVEiGhnmA=";
+    hash = "sha256-wDLnkHcVdHqjaR1Sfu+bhfZO2nfHadG3LgJtYJw6bsQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index eed4d7d88552..7bbc825262be 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.17.0";
+  version = "4.20.5";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-PXVfNYy1gzK1OqYOeGRxTRRrxNEQkEhAjE5J9yKcQ/w=";
+    hash = "sha256-jf4HZVLNqwl8IcS/Po2PKPCd1iMvBuFybhz0z3b0stM=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       postPatch
       ;
-    hash = "sha256-OCxUhvPIPKSGTTeXaLmkErOBpYQ8mKmieUYj6qxuTK4=";
+    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
diff --git a/pkgs/by-name/xm/xmrig-mo/package.nix b/pkgs/by-name/xm/xmrig-mo/package.nix
index 15f7e3c21db2..7a3725e3c952 100644
--- a/pkgs/by-name/xm/xmrig-mo/package.nix
+++ b/pkgs/by-name/xm/xmrig-mo/package.nix
@@ -6,13 +6,13 @@
 
 xmrig.overrideAttrs (oldAttrs: rec {
   pname = "xmrig-mo";
-  version = "6.22.3-mo1";
+  version = "6.23.0-mo1";
 
   src = fetchFromGitHub {
     owner = "MoneroOcean";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-jmdlIFTXm5bLScRCYPTe7cDDRyNR29wu5+09Vj6G/Pc=";
+    hash = "sha256-9ne2qpN6F6FJyD/Havb7fhY1oB4AxFrB17gI7QtoE1E=";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index 960a5a8cea7f..25306411197b 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ytdl-sub";
-  version = "2025.06.12";
+  version = "2025.06.19.post1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = version;
-    hash = "sha256-42fvyUCaVaaGLW7CdoJidJQAUgjG2wmCeHxWA+XUQCk=";
+    hash = "sha256-aZ7LzpOZgI9KUt0aWMdzVH299O83d3zPxldRKZvwO8I=";
   };
 
   postPatch = ''
@@ -42,9 +42,29 @@ python3Packages.buildPythonApplication rec {
     "--set YTDL_SUB_FFPROBE_PATH ${lib.getExe' ffmpeg "ffprobe"}"
   ];
 
-  nativeCheckInputs = [ versionCheckHook ];
+  nativeCheckInputs = [
+    versionCheckHook
+    python3Packages.pytestCheckHook
+  ];
   versionCheckProgramArg = "--version";
 
+  env = {
+    YTDL_SUB_FFMPEG_PATH = "${lib.getExe' ffmpeg "ffmpeg"}";
+    YTDL_SUB_FFPROBE_PATH = "${lib.getExe' ffmpeg "ffprobe"}";
+  };
+
+  disabledTests = [
+    "test_logger_can_be_cleaned_during_execution"
+    "test_presets_run"
+    "test_thumbnail"
+  ];
+
+  pytestFlagsArray = [
+    # According to documentation, e2e tests can be flaky:
+    # "This checksum can be inaccurate for end-to-end tests"
+    "--ignore=tests/e2e"
+  ];
+
   passthru.updateScript = ./update.sh;
 
   meta = {
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index a3a17c7221e2..d4d031d62319 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zashboard";
-  version = "1.94.0";
+  version = "1.94.2";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jhnK7G1OLAntVRpozVCn/Gky3qy6rAu8Eevs0nLTvSI=";
+    hash = "sha256-bG4fa6lsOsHYly6ORDx9WzUjgW5liY8hgUblYicbXXY=";
   };
 
   nativeBuildInputs = [
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-hZ6Lvj4YimhIKFu/fJHCd+EOCny+RSFMOdhBcUUNqNw=";
+    hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ze/zellij/package.nix b/pkgs/by-name/ze/zellij/package.nix
index 0c4b7e976449..f699b9a18441 100644
--- a/pkgs/by-name/ze/zellij/package.nix
+++ b/pkgs/by-name/ze/zellij/package.nix
@@ -92,6 +92,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       abbe
       pyrox0
       matthiasbeyer
+      ryan4yin
     ];
     mainProgram = "zellij";
   };
diff --git a/pkgs/by-name/zo/zoxide/package.nix b/pkgs/by-name/zo/zoxide/package.nix
index bcd33cc1d65f..6fedee757560 100644
--- a/pkgs/by-name/zo/zoxide/package.nix
+++ b/pkgs/by-name/zo/zoxide/package.nix
@@ -50,6 +50,7 @@ rustPlatform.buildRustPackage rec {
       cole-h
       SuperSandro2000
       matthiasbeyer
+      ryan4yin
     ];
     mainProgram = "zoxide";
   };
diff --git a/pkgs/development/compilers/flutter/patches/do-not-log-os-release-read-failure.patch b/pkgs/development/compilers/flutter/patches/do-not-log-os-release-read-failure.patch
new file mode 100644
index 000000000000..42e940af2d9d
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/do-not-log-os-release-read-failure.patch
@@ -0,0 +1,12 @@
+diff --git a/packages/flutter_tools/lib/src/base/os.dart b/packages/flutter_tools/lib/src/base/os.dart
+index 9134a014f8d..0410f328c66 100644
+--- a/packages/flutter_tools/lib/src/base/os.dart
++++ b/packages/flutter_tools/lib/src/base/os.dart
+@@ -316,7 +316,6 @@ class _LinuxUtils extends _PosixUtils {
+         final String osRelease = _fileSystem.file(osReleasePath).readAsStringSync();
+         prettyName = _getOsReleaseValueForKey(osRelease, prettyNameKey);
+       } on Exception catch (e) {
+-        _logger.printTrace('Failed obtaining PRETTY_NAME for Linux: $e');
+         prettyName = '';
+       }
+       try {
diff --git a/pkgs/development/interpreters/perl/cross-fdopendir.patch b/pkgs/development/interpreters/perl/cross-fdopendir.patch
new file mode 100644
index 000000000000..f46d23006b4c
--- /dev/null
+++ b/pkgs/development/interpreters/perl/cross-fdopendir.patch
@@ -0,0 +1,21 @@
+From f702c387e6940fab3801d7562a668b974a2b3a8f Mon Sep 17 00:00:00 2001
+From: Audrey Dutcher <audrey@rhelmot.io>
+Date: Fri, 30 May 2025 12:29:54 -0700
+Subject: [PATCH] add d_fdopendir configuration
+
+---
+ cnf/configure_func.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/cnf/configure_func.sh b/cnf/configure_func.sh
+index 4c13e4c..b24fe03 100644
+--- a/cnf/configure_func.sh
++++ b/cnf/configure_func.sh
+@@ -83,6 +83,7 @@ checkfunc d_fchmodat 'fchmodat' "0,NULL,0,0" 'unistd.h sys/stat.h'
+ checkfunc d_fchown 'fchown' "0,0,0" 'unistd.h'
+ checkfunc d_fcntl 'fcntl' "0,0" 'unistd.h fcntl.h'
+ checkfunc d_fdclose 'fdclose' "NULL,NULL" 'stdio.h'
++checkfunc d_fdopendir 'fdopendir' "0" 'dirent.h'
+ checkfunc d_ffs 'ffs' "0" 'strings.h'
+ checkfunc d_ffsl 'ffsl' "0" 'strings.h'
+ checkfunc d_fgetpos 'fgetpos' "NULL, 0" 'stdio.h'
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index dbeb4fa69d85..57306ce6d551 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -317,15 +317,20 @@ stdenv.mkDerivation (
     };
   }
   // lib.optionalAttrs crossCompiling rec {
-    crossVersion = "1.6";
+    crossVersion = "1.6.2";
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      sha256 = "sha256-TVDLxw8ctl64LSfLfB4/WLYlSTO31GssSzmdVfqkBmg=";
+      hash = "sha256-mG9ny+eXGBL4K/rXqEUPSbar+4Mq4IaQrGRFIHIyAAw=";
     };
+    patches = [
+      # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
+      # https://github.com/arsv/perl-cross/pull/159
+      ./cross-fdopendir.patch
+    ];
 
     depsBuildBuild = [
       buildPackages.stdenv.cc
diff --git a/pkgs/development/libraries/astal/source.nix b/pkgs/development/libraries/astal/source.nix
index 29fd220716d1..09877fcf5bd0 100644
--- a/pkgs/development/libraries/astal/source.nix
+++ b/pkgs/development/libraries/astal/source.nix
@@ -3,31 +3,34 @@
   nix-update-script,
   fetchFromGitHub,
 }:
-(fetchFromGitHub {
-  owner = "Aylur";
-  repo = "astal";
-  rev = "dc0e5d37abe9424c53dcbd2506a4886ffee6296e";
-  hash = "sha256-5WgfJAeBpxiKbTR/gJvxrGYfqQRge5aUDcGKmU1YZ1Q=";
-}).overrideAttrs
-  (
-    final: prev: {
-      name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
-      pname = "astal-source";
-      version = "0-unstable-2025-03-21";
+let
+  originalDrv = fetchFromGitHub {
+    owner = "Aylur";
+    repo = "astal";
+    rev = "4820a3e37cc8eb81db6ed991528fb23472a8e4de";
+    hash = "sha256-SaHAtzUyfm4urAcUEZlBFn7dWhoDqA6kaeFZ11CCTf8=";
+  };
+in
+originalDrv.overrideAttrs (
+  final: prev: {
+    name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
+    pname = "astal-source";
+    version = "0-unstable-2025-05-12";
 
-      meta = prev.meta // {
-        description = "Building blocks for creating custom desktop shells (source)";
-        longDescription = ''
-          Please don't use this package directly, use one of subpackages in
-          `astal` namespace. This package is just a `fetchFromGitHub`, which is
-          reused between all subpackages.
-        '';
-        maintainers = with lib.maintainers; [ perchun ];
-        platforms = lib.platforms.linux;
-      };
+    meta = prev.meta // {
+      description = "Building blocks for creating custom desktop shells (source)";
+      longDescription = ''
+        Please don't use this package directly, use one of subpackages in
+        `astal` namespace. This package is just a `fetchFromGitHub`, which is
+        reused between all subpackages.
+      '';
+      maintainers = with lib.maintainers; [ perchun ];
+      platforms = lib.platforms.linux;
+    };
 
-      passthru = prev.passthru // {
-        updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
-      };
-    }
-  )
+    passthru = prev.passthru // {
+      updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+      src = originalDrv;
+    };
+  }
+)
diff --git a/pkgs/development/libraries/flint/3.nix b/pkgs/development/libraries/flint/3.nix
index e6566d706a27..971598950740 100644
--- a/pkgs/development/libraries/flint/3.nix
+++ b/pkgs/development/libraries/flint/3.nix
@@ -5,6 +5,7 @@
   gmp,
   mpfr,
   ntl,
+  windows,
   autoconf,
   automake,
   gettext,
@@ -13,7 +14,7 @@
   blas,
   lapack,
   withBlas ? true,
-  withNtl ? true,
+  withNtl ? !ntl.meta.broken,
 }:
 
 assert
@@ -49,6 +50,9 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals withNtl [
       ntl
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isMinGW [
+      windows.mingw_w64_pthreads
     ];
 
   # We're not using autoreconfHook because flint's bootstrap
@@ -79,7 +83,7 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ smasher164 ];
     teams = [ teams.sage ];
-    platforms = platforms.unix;
+    platforms = platforms.all;
     homepage = "https://www.flintlib.org/";
     downloadPage = "https://www.flintlib.org/downloads.html";
   };
diff --git a/pkgs/development/libraries/java/rhino/default.nix b/pkgs/development/libraries/java/rhino/default.nix
index 1d8c54faed15..8016c7374ea3 100644
--- a/pkgs/development/libraries/java/rhino/default.nix
+++ b/pkgs/development/libraries/java/rhino/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
       to provide scripting to end users.
     '';
 
-    homepage = "http://www.mozilla.org/rhino/";
+    homepage = "https://rhino.github.io/";
 
     license = with licenses; [
       mpl11 # or
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index a1b153b5dfed..7c837e67a39f 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -32,11 +32,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-XgQTKYStg8q5zFP3YHLSte9abSSwqf+QR6j/lhIbzGM=";
+    hash = "sha256-rMEcsr3Glnjci7p0fCSigjPFhZb4HwN4W/K3u3oO99w=";
   };
 
   patches = [
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index c6f870c04031..290b5a9a6636 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -814,15 +814,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.1923-1";
+      version = "0.0.1937-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.1923-1.rockspec";
-          sha256 = "0plnbs9wcrjmmrrnjj3l39033c97fgn6p0md2i4fp3qkwql7sh2i";
+          url = "mirror://luarocks/fzf-lua-0.0.1937-1.rockspec";
+          sha256 = "1xmckkrp69kxvcs2k7izrgv8af309hnw2vpdr4wzqrvyx2xvmpjl";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/29e982dfc96a134fecc80853c8cb8324e43e574b.zip";
-        sha256 = "15qry8xx1yjs3262pmsyp1am6l4jyyxf9raibss5s5bgdsfypg44";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/c53ba4f40f0514a5038646fb1e9ce05872b18eb1.zip";
+        sha256 = "0mxlmmnrs74w9b2inkdifykhrc9csfavwj554j82g50jywiq1x24";
       };
 
       disabled = luaOlder "5.1";
@@ -903,15 +903,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.34-1";
+      version = "1.6.41-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.34-1.rockspec";
-          sha256 = "0rydx0lh58gz8mw2g9ay0zlh4bx6x3gf38vg57ljq4x85l5x6c2l";
+          url = "mirror://luarocks/grug-far.nvim-1.6.41-1.rockspec";
+          sha256 = "0fn3596z1krd916507mg8xczxf3mcxzwp78z58h6g9vnd9l32wn9";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/7434d9247c9b95234e058b07b393443d5adeb2fe.zip";
-        sha256 = "0r0m4pckxba1kkm8mgyf95h61czf28rgy5325w3nggg1hyvbbrvs";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/1a85fba510c6086b396be5a3c7c77ab32829d7df.zip";
+        sha256 = "1ww5q8lw1lnnisr587kj4gzavscg7j7q473h5i9yjh3ca2lln6wr";
       };
 
       disabled = luaOlder "5.1";
@@ -2011,17 +2011,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lua-resty-session";
-      version = "4.1.1-1";
+      version = "4.1.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-session-4.1.1-1.rockspec";
-          sha256 = "1ndkivmrrcdd1qm762ajkkzvncyyssfq1zpkinqkj6qqydjvpzws";
+          url = "mirror://luarocks/lua-resty-session-4.1.2-1.rockspec";
+          sha256 = "14g4gm8cc4kyibhl03z2y8ggv4q7pkqidd66za53mfa4vg2ym7yv";
         }).outPath;
       src = fetchFromGitHub {
         owner = "bungle";
         repo = "lua-resty-session";
-        rev = "v4.1.1";
-        hash = "sha256-rsMUnszo0QnK4dYWDrHMue9Nsyf6jOMMYh6VdH3mXPM=";
+        rev = "v4.1.2";
+        hash = "sha256-mVjC/7AD/oX1gD6jUUTeNWfX0Vy6ikvIYdIkbbWVBQ0=";
       };
 
       disabled = luaOlder "5.1";
@@ -2730,13 +2730,13 @@ final: prev: {
       knownRockspec =
         (fetchurl {
           url = "mirror://luarocks/lualine.nvim-scm-1.rockspec";
-          sha256 = "1r610n0b1fkrczsq8yipcfk8l6pnjrr7byr2bk1dnp9iqskkyjyy";
+          sha256 = "0cmss7ks8d1yxw43m9zc8glbqgxylpnh25xw7c0ym5l04p61ary0";
         }).outPath;
       src = fetchFromGitHub {
         owner = "nvim-lualine";
         repo = "lualine.nvim";
-        rev = "0c6cca9f2c63dadeb9225c45bc92bb95a151d4af";
-        hash = "sha256-Z6efNmO6nvaNASYS9d0WcazJm7OJyp/kbgREEI/JHIc=";
+        rev = "a94fc68960665e54408fe37dcf573193c4ce82c9";
+        hash = "sha256-2aPgA7riA/FubQpTkqsxLKl7OZ8L6FkucNHc2QEx2HQ=";
       };
 
       disabled = luaOlder "5.1";
@@ -2950,17 +2950,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luarocks-build-rust-mlua";
-      version = "0.2.3-1";
+      version = "0.2.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luarocks-build-rust-mlua-0.2.3-1.rockspec";
-          sha256 = "0vkbl2xcjjpi5gn7v2fr7nyyd7fg91zknrgm61cz91mwp4x5i3pf";
+          url = "mirror://luarocks/luarocks-build-rust-mlua-0.2.4-1.rockspec";
+          sha256 = "1mi4lpd2an35rb61vz9070102yqykr2hpb850dh33lr377b7y2bh";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mlua-rs";
         repo = "luarocks-build-rust-mlua";
-        rev = "0.2.3";
-        hash = "sha256-SktU54lLaa9x6ntsyeaomsvCQJOtkJhIK/q5uDDFHqY=";
+        rev = "0.2.4";
+        hash = "sha256-uAoAvn95FdGhMnzDT3Z2aQZyM1AG+HNPCF/J2shKVbQ=";
       };
 
       meta = {
@@ -2982,15 +2982,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luarocks-build-treesitter-parser";
-      version = "6.0.0-1";
+      version = "6.0.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luarocks-build-treesitter-parser-6.0.0-1.rockspec";
-          sha256 = "1al6id20nvdz2whyiig271bydxmvrpgjdzn2sv2zkpkgsadp8p3h";
+          url = "mirror://luarocks/luarocks-build-treesitter-parser-6.0.1-1.rockspec";
+          sha256 = "1sck7xjk0mpavq54n0qv0j08345mg5n6rhmi1p5kk77566kl8644";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser/archive/v6.0.0.zip";
-        sha256 = "17ikz8nna8jngdd8pxg0x65sxpzv0njhiqzb2nh6ng2s195sya23";
+        url = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser/archive/v6.0.1.zip";
+        sha256 = "1lagh03s6h7069p03g82r87xddpifhg5ifhahzrcmyafm564rwvm";
       };
 
       disabled = luaOlder "5.1";
@@ -3015,15 +3015,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luarocks-build-treesitter-parser-cpp";
-      version = "2.0.4-1";
+      version = "2.0.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luarocks-build-treesitter-parser-cpp-2.0.4-1.rockspec";
-          sha256 = "0hrqy1s9c1naad43bri4icf5y139h5wk52yv4f0dxbvsfqbf8isb";
+          url = "mirror://luarocks/luarocks-build-treesitter-parser-cpp-2.0.5-1.rockspec";
+          sha256 = "05hx146gmrn8c6ndgnqq521h66cd4lmpjkclvdlfpp5inck22cdd";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser-cpp/archive/v2.0.4.zip";
-        sha256 = "0r7mvc1f7wgmb4xgknmr38cv35chwdyxmj1fxw4xsdjrvb1qyvi6";
+        url = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser-cpp/archive/v2.0.5.zip";
+        sha256 = "12q6kfnrw9cy0r8l3h79fnvfq5faapxgjmhf1xksb5kf077l0g7j";
       };
 
       disabled = luaOlder "5.1";
@@ -4618,15 +4618,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "6.3.0-1";
+      version = "6.3.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.3.0-1.rockspec";
-          sha256 = "07ypiabgp6025q7v8v1w0kmc8msxl5cyxqm7y8s6kgcnwv5lzwb5";
+          url = "mirror://luarocks/rustaceanvim-6.3.2-1.rockspec";
+          sha256 = "0mvwhv3x3c5wmkxcqpm3slipfi8ns1p6wzfn0jhdwbgj5zmxa3br";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.3.0.zip";
-        sha256 = "1jm48y6691pib445h2qlv3f03n0qccv0nyrlm06dlq0msf7vwch9";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.3.2.zip";
+        sha256 = "1hs31xdawvs8ln4b7idmad2689rwlls480w0hvv8xkrl638wjbd5";
       };
 
       disabled = luaOlder "5.1";
@@ -4708,29 +4708,29 @@ final: prev: {
 
   sofa = callPackage (
     {
+      argparse,
       buildLuarocksPackage,
+      compat53,
       fetchFromGitHub,
       fetchurl,
       luaAtLeast,
       luaOlder,
-      argparse,
-      compat53,
       luatext,
       lyaml,
     }:
     buildLuarocksPackage {
       pname = "sofa";
-      version = "0.7.0-0";
+      version = "0.8.0-0";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/sofa-0.7.0-0.rockspec";
-          sha256 = "0hkdm4h8yjh5zw9116cclff8q6br4yyhb7f7y7lv4ydrkxfl1lzq";
+          url = "mirror://luarocks/sofa-0.8.0-0.rockspec";
+          sha256 = "09mjnygy8xpcp892mfqmcirjjndndvynl7bs7j4vp4r4svh17b05";
         }).outPath;
       src = fetchFromGitHub {
         owner = "f4z3r";
         repo = "sofa";
-        rev = "v0.7.0";
-        hash = "sha256-aoFmzhzWuBTbDnSWDGLbkhORlrtvVOtfIV7oq2xc0pQ=";
+        rev = "v0.8.0";
+        hash = "sha256-MWGp0kbLaXQV3ElSgPTFoVuWk4+ujktG0xh20kQPex4=";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.5";
diff --git a/pkgs/development/python-modules/ansible-compat/default.nix b/pkgs/development/python-modules/ansible-compat/default.nix
index 0d74aa9b8fe6..6eb3575938e5 100644
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-compat";
-  version = "25.5.0";
+  version = "25.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "ansible-compat";
     tag = "v${version}";
-    hash = "sha256-ael9SByIlq8ss/tujQV4+U3vLo55RSSFc7pVRCnV1go=";
+    hash = "sha256-OobW7dlj++SzTrX4tWMS5E0C32gDJWFbZwpGskjnCCQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/coiled/default.nix b/pkgs/development/python-modules/coiled/default.nix
index 1cb9cd7e94df..f6f18b9ccd93 100644
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.101.1";
+  version = "1.103.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7+uRvyK+PbQ8jHFQhi0+jkwSvUzAMOVAeCZMIUaujeM=";
+    hash = "sha256-EtshOvxaGbciOf0bc0EaNVkOEKI6Z2PbR6ZtgPCuzkc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/craft-providers/default.nix b/pkgs/development/python-modules/craft-providers/default.nix
index ab10ed1717b4..8cabe09de715 100644
--- a/pkgs/development/python-modules/craft-providers/default.nix
+++ b/pkgs/development/python-modules/craft-providers/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "craft-providers";
-  version = "2.3.0";
+  version = "2.3.1";
 
   pyproject = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-providers";
     tag = version;
-    hash = "sha256-EJoFuESgjEKoI1BKO02jd4iI/DFBphLujR/vGST/JGk=";
+    hash = "sha256-MeQOqw0F4OwaooHHrUh3qITTOFNXG1Qg1oJcYxRQTz0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/crispy-bootstrap4/default.nix b/pkgs/development/python-modules/crispy-bootstrap4/default.nix
index 18f8650edde2..2a7cea92e215 100644
--- a/pkgs/development/python-modules/crispy-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/crispy-bootstrap4/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "crispy-bootstrap4";
-  version = "2024.10";
+  version = "2025.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-crispy-forms";
     repo = "crispy-bootstrap4";
     tag = version;
-    hash = "sha256-lBm48krF14WuUMX9lgx9a++UhJWHWPxOhj3R1j4QTOs=";
+    hash = "sha256-2W5tswtRqXdS1nef/2Q/jdX3e3nHYF3v4HiyNF723k8=";
   };
 
   build-system = [ setuptools ];
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Bootstrap 4 template pack for django-crispy-forms";
     homepage = "https://github.com/django-crispy-forms/crispy-bootstrap4";
-    changelog = "https://github.com/django-crispy-forms/crispy-bootstrap4/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/django-crispy-forms/crispy-bootstrap4/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 3d2cc763a0e8..d4bcd7e0e9e6 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "devito";
-  version = "4.8.18";
+  version = "4.8.19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${version}";
-    hash = "sha256-DJwdtUAmhgiTPifj1UmrE7tnXUiK3FwAry0USp5xJP0=";
+    hash = "sha256-kE4u5r2GFe4Y+IdSEnNZEOAO9WoSIM00Ify1eLaflWI=";
   };
 
   pythonRemoveDeps = [ "pip" ];
diff --git a/pkgs/development/python-modules/django-soft-delete/default.nix b/pkgs/development/python-modules/django-soft-delete/default.nix
index 23124ff3f324..cd6b721bf03b 100644
--- a/pkgs/development/python-modules/django-soft-delete/default.nix
+++ b/pkgs/development/python-modules/django-soft-delete/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "django-soft-delete";
-  version = "1.0.18";
+  version = "1.0.19";
   pyproject = true;
 
   src = fetchPypi {
     pname = "django_soft_delete";
     inherit version;
-    hash = "sha256-0vnbRJpPAI6XhvgvpLr75AdfegsyhIRHNQB+mIsqTfY=";
+    hash = "sha256-xn7okg4UVuyoTMWbMwTvJ/qdR2tRa+cmzn4fxVhQKQg=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/djangocms-alias/default.nix b/pkgs/development/python-modules/djangocms-alias/default.nix
index 4fef532d870d..e6b1fc9815ca 100644
--- a/pkgs/development/python-modules/djangocms-alias/default.nix
+++ b/pkgs/development/python-modules/djangocms-alias/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "djangocms-alias";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "django-cms";
     repo = "djangocms-alias";
     tag = version;
-    hash = "sha256-q5iNTnoPto7jgxF/46I0oA8NYFBbDafsRUFmKMFoQM4=";
+    hash = "sha256-0lIhPgI+HbAKX9wEpZ/v40OHvN6WWK9ehFxIcpzdcq8=";
   };
 
   build-system = [ setuptools ];
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Lean enterprise content management powered by Django";
     homepage = "https://django-cms.org";
-    changelog = "https://github.com/django-cms/django-cms/releases/tag/${src.tag}";
+    changelog = "https://github.com/django-cms/djangocms-alias/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.onny ];
   };
diff --git a/pkgs/development/python-modules/djoser/default.nix b/pkgs/development/python-modules/djoser/default.nix
new file mode 100644
index 000000000000..f0f9669cc046
--- /dev/null
+++ b/pkgs/development/python-modules/djoser/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  django,
+  djangorestframework-simplejwt,
+  social-auth-app-django,
+}:
+
+buildPythonPackage rec {
+  pname = "djoser";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "sunscrapers";
+    repo = "djoser";
+    tag = version;
+    hash = "sha256-xPhf7FiJSq5bHfAU5RKbobgnsRh/6cLcXP6vfrLdzJA=";
+  };
+
+  buildInputs = [
+    django
+    djangorestframework-simplejwt
+    social-auth-app-django
+  ];
+
+  pyproject = true;
+
+  build-system = [
+    poetry-core
+  ];
+
+  # djet isn't packaged yet
+  # nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "djoser" ];
+
+  meta = {
+    changelog = "https://github.com/sunscrapers/djoser/releases/tag/${version}";
+    description = "REST implementation of Django authentication system";
+    homepage = "https://github.com/sunscrapers/djoser";
+    maintainers = with lib.maintainers; [ MostafaKhaled ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index 566a60d47f2e..1f3b4a7ba61b 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -16,24 +16,24 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "1.1.2";
-  format = "pyproject";
+  version = "2.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EiXzAUThzJfjiNuvf+PpltKJdHOlOm2uJo3d4hw1S5g=";
+    hash = "sha256-EmetMnWJcfvPmRRCQXo5Nce8nlJVDnNiLg5WulXqHUA=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools-scm
     wheel
   ];
 
   buildInputs = [ pbr ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     docutils
     chardet
     stevedore
@@ -43,16 +43,14 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonRelaxDeps = [ "docutils" ];
-
   pythonImportsCheck = [ "doc8" ];
 
-  meta = with lib; {
+  meta = {
     description = "Style checker for Sphinx (or other) RST documentation";
     mainProgram = "doc8";
     homepage = "https://github.com/pycqa/doc8";
     changelog = "https://github.com/PyCQA/doc8/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ onny ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ onny ];
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-os-config/default.nix b/pkgs/development/python-modules/google-cloud-os-config/default.nix
index e2ed80d4ff81..445b367a177c 100644
--- a/pkgs/development/python-modules/google-cloud-os-config/default.nix
+++ b/pkgs/development/python-modules/google-cloud-os-config/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.20.1";
+  version = "1.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_os_config";
     inherit version;
-    hash = "sha256-15sKmKW9y3/JU7rTLRZJXYqxWdWvqIFmIqpXKo2tE8Q=";
+    hash = "sha256-N/fk02b8eJYPd9/+wN53hPud/QvCJ4YtOZb9tHryNFQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/hf-xet/default.nix b/pkgs/development/python-modules/hf-xet/default.nix
index 0d174dd22bf4..7fd58719000a 100644
--- a/pkgs/development/python-modules/hf-xet/default.nix
+++ b/pkgs/development/python-modules/hf-xet/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "hf-xet";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "xet-core";
     tag = "v${version}";
-    hash = "sha256-pS9FbSybswyboHQwczISYkHAcLclu97zbCMG9olv/D4=";
+    hash = "sha256-udjZcXTH+Mc4Gvj6bSPv1xi4MyXrLeCYav+7CzKWyhY=";
   };
 
   sourceRoot = "${src.name}/hf_xet";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-kBOiukGheqg7twoD++9Z3n+LqQsTAUqyQi0obUeNh08=";
+    hash = "sha256-PTzYubJHFvhq6T3314R4aqBAJlwehOqF7SbpLu4Jo6E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/junitparser/default.nix b/pkgs/development/python-modules/junitparser/default.nix
index 8833775b8074..efb5b0bae7a3 100644
--- a/pkgs/development/python-modules/junitparser/default.nix
+++ b/pkgs/development/python-modules/junitparser/default.nix
@@ -2,34 +2,29 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  future,
   glibcLocales,
   lxml,
-  unittestCheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "junitparser";
-  version = "2.8.0";
+  version = "3.2.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "weiwei";
     repo = "junitparser";
     rev = version;
-    hash = "sha256-rhDP05GSWT4K6Z2ip8C9+e3WbvBJOwP0vctvANBs7cw=";
+    hash = "sha256-efP9t5eto6bcjk33wpJmunLlPH7wUwAa6/OjjYG/fgM=";
   };
 
-  propagatedBuildInputs = [ future ];
-
   nativeCheckInputs = [
-    unittestCheckHook
+    pytestCheckHook
     lxml
     glibcLocales
   ];
 
-  unittestFlagsArray = [ "-v" ];
-
   meta = with lib; {
     description = "Manipulates JUnit/xUnit Result XML files";
     mainProgram = "junitparser";
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index d86353c3eb04..03cf701b4d55 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.72.2";
+  version = "1.72.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     tag = "v${version}-stable";
-    hash = "sha256-CGmdk5SjtmeqXLVWiBqvofQ4+C2gW4TJXFkQdaQqMEA=";
+    hash = "sha256-Qs/jmNJx/fztLqce47yd1pzIZyPsz0XhXUyoC1vkp6g=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/litemapy/default.nix b/pkgs/development/python-modules/litemapy/default.nix
index 02e321182f05..0f3ec4659100 100644
--- a/pkgs/development/python-modules/litemapy/default.nix
+++ b/pkgs/development/python-modules/litemapy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "litemapy";
-  version = "0.10.0b0";
+  version = "0.11.0b0";
   pyproject = true;
   build-system = [ setuptools ];
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SmylerMC";
     repo = "litemapy";
     rev = "v${version}";
-    hash = "sha256-mGRnrFfrg0VD9pXs0WOuiP6QnYyu0Jbv/bqCWtkOie0=";
+    hash = "sha256-jqJYiggAs/JA+CJ35HzpsIQA/5p8PRFkbmPlwJvTI28=";
   };
 
   propagatedBuildInputs = [
@@ -34,6 +34,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/SmylerMC/litemapy";
     changelog = "https://github.com/SmylerMC/litemapy/blob/${src.rev}/CHANGELOG.md";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ gdd ];
+    maintainers = with maintainers; [
+      gdd
+      kuflierl
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/llm-gemini/default.nix b/pkgs/development/python-modules/llm-gemini/default.nix
index 85f000c471be..9f72e8452f08 100644
--- a/pkgs/development/python-modules/llm-gemini/default.nix
+++ b/pkgs/development/python-modules/llm-gemini/default.nix
@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
   pname = "llm-gemini";
-  version = "0.22";
+  version = "0.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-gemini";
     tag = version;
-    hash = "sha256-8zUOP+LNwdUXx4hR3m5lodcVUmB4ZjyiWqWzk2tV9wM=";
+    hash = "sha256-e+l7YjMJi+ZtkaBQUXT9364F7ncQO476isSm8uMCCB0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/opencontainers/default.nix b/pkgs/development/python-modules/opencontainers/default.nix
index c3dbd0e1bfde..1790209b8323 100644
--- a/pkgs/development/python-modules/opencontainers/default.nix
+++ b/pkgs/development/python-modules/opencontainers/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "opencontainers";
-  version = "0.0.14";
+  version = "0.0.15";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/eO4CZtWtclWQV34kz4iJ+GRToBaJ3uETy+eUjQXOPI=";
+    hash = "sha256-o6QBJMxo7aVse0xauSTxi1UEW4RYrKlhH1v6g/fvrv4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pbs-installer/default.nix b/pkgs/development/python-modules/pbs-installer/default.nix
index f2d2a348b02c..0fd8e7fd5a3a 100644
--- a/pkgs/development/python-modules/pbs-installer/default.nix
+++ b/pkgs/development/python-modules/pbs-installer/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pbs-installer";
-  version = "2025.06.10";
+  version = "2025.06.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "frostming";
     repo = "pbs-installer";
     tag = version;
-    hash = "sha256-WN1TevGTSG6yQnssuvtGKb850lo5hzehOPoFJhMVvGo=";
+    hash = "sha256-OIG+CLtJsYmE2nTHjVpGPIAuEnFzNMVsDYcxPcirgjs=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/pdbfixer/default.nix b/pkgs/development/python-modules/pdbfixer/default.nix
index f140a4cf9c5d..aed34f07d255 100644
--- a/pkgs/development/python-modules/pdbfixer/default.nix
+++ b/pkgs/development/python-modules/pdbfixer/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pdbfixer";
-  version = "1.10";
+  version = "1.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openmm";
     repo = "pdbfixer";
     tag = "v${version}";
-    hash = "sha256-7bg/i7nhbBw/DCc7Rabt5pwUUPF27Iiy2dMQnV6GTiM=";
+    hash = "sha256-Xk3m2w1p3Wu4g6qKGOH679wkKT0LKZLgGn/ARn219fQ=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,10 @@ buildPythonPackage rec {
     "test_mutate_multiple_copies_of_chain_A"
     "test_pdbid"
     "test_url"
+    "test_charge_and_solvate"
+    "test_download_template"
+    "test_nonstandard"
+    "test_leaving_atoms"
   ];
 
   pythonImportsCheck = [ "pdbfixer" ];
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index 468464010762..daa072619867 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -19,16 +19,16 @@
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.10.7";
+  version = "1.10.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "psd-tools";
     repo = "psd-tools";
     tag = "v${version}";
-    hash = "sha256-n3OqyItvKXD6NjCm/FgEuu1G5apTmUypwKJ+Y2DCmEg=";
+    hash = "sha256-IgDgHVSnqSsodVm/tUnINVbUOen8lw+y6q4Z8C+eFE8=";
   };
 
   build-system = [
@@ -54,12 +54,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "psd_tools" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python package for reading Adobe Photoshop PSD files";
     mainProgram = "psd-tools";
     homepage = "https://github.com/kmike/psd-tools";
     changelog = "https://github.com/psd-tools/psd-tools/blob/${src.tag}/CHANGES.rst";
-    license = licenses.mit;
-    maintainers = with maintainers; [ onny ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
   };
 }
diff --git a/pkgs/development/python-modules/pwdlib/default.nix b/pkgs/development/python-modules/pwdlib/default.nix
new file mode 100644
index 000000000000..53c1e226daeb
--- /dev/null
+++ b/pkgs/development/python-modules/pwdlib/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  hatch-regex-commit,
+  pytestCheckHook,
+  pytest-cov-stub,
+  argon2-cffi,
+  bcrypt,
+}:
+
+buildPythonPackage rec {
+  pname = "pwdlib";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "frankie567";
+    repo = "pwdlib";
+    tag = "v${version}";
+    hash = "sha256-aPrgn5zfKk72QslGzb0acCNnZ7m3lyIBjvu4yhfZhSQ=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-regex-commit
+  ];
+
+  dependencies = [
+    argon2-cffi
+    bcrypt
+  ];
+
+  pythonImportsCheck = [ "pwdlib" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  meta = {
+    description = "Modern password hashing for Python";
+    changelog = "https://github.com/frankie567/pwdlib/releases/tag/v${version}";
+    homepage = "https://github.com/frankie567/pwdlib";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylance/default.nix b/pkgs/development/python-modules/pylance/default.nix
index 1f9faf26245c..cf6586cf512e 100644
--- a/pkgs/development/python-modules/pylance/default.nix
+++ b/pkgs/development/python-modules/pylance/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "pylance";
-  version = "0.29.0";
+  version = "0.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance";
     tag = "v${version}";
-    hash = "sha256-lEGxutBKbRFqr9Uhdv2oOXCdb8Y2quqLoSoJ0F+F3h0=";
+    hash = "sha256-Bs0xBRAehAzLEHvsGIFPX6y1msvfhkTbBRPMggbahxE=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -51,7 +51,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-NZeFgEWkiDewWI5R+lpBsMTU7+7L7oaHefSGAS+CoFU=";
+    hash = "sha256-ZUS83iuaC7IkwhAplTSHTqaa/tHO1Kti4rSQDuRgX98=";
   };
 
   nativeBuildInputs = [
@@ -114,6 +114,17 @@ buildPythonPackage rec {
 
       # Flaky (AssertionError)
       "test_index_cache_size"
+
+      # OSError: LanceError(IO): Failed to initialize default tokenizer:
+      # An invalid argument was passed:
+      # 'LinderaError { kind: Parse, source: failed to build tokenizer: LinderaError(kind=Io, source=No such file or directory (os error 2)) }', /build/source/rust/lance-index/src/scalar/inverted/tokenizer/lindera.rs:63:21
+      "test_lindera_load_config_fallback"
+
+      # OSError: LanceError(IO): Failed to load tokenizer config
+      "test_indexed_filter_with_fts_index_with_lindera_ipadic_jp_tokenizer"
+      "test_lindera_ipadic_jp_tokenizer_bin_user_dict"
+      "test_lindera_ipadic_jp_tokenizer_csv_user_dict"
+      "test_lindera_load_config_priority"
     ]
     ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
       # OSError: LanceError(IO): Resources exhausted: Failed to allocate additional 1245184 bytes for ExternalSorter[0]...
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index ceb73ec21522..9aeda0b09afa 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2025.2.3";
+  version = "2025.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     repo = "pyopencl";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-o1HZWxohc5CAf28nTBhR6scF1mWW5gzGv8/MU0Rmpnc=";
+    hash = "sha256-Tan6HUwDnG7/z6lLPysUhRkr32qqa6ix8SoBCBf4dCA=";
   };
 
   build-system = [
@@ -93,7 +93,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper for OpenCL";
     homepage = "https://github.com/pyopencl/pyopencl";
-    changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
+    changelog = "https://github.com/inducer/pyopencl/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/python-sat/default.nix b/pkgs/development/python-modules/python-sat/default.nix
index bf1c6c45982c..940dbfe3273d 100644
--- a/pkgs/development/python-modules/python-sat/default.nix
+++ b/pkgs/development/python-modules/python-sat/default.nix
@@ -6,17 +6,16 @@
   pypblib,
   pytestCheckHook,
 }:
-
 buildPythonPackage rec {
   pname = "python-sat";
-  version = "0.1.7.dev1";
+  version = "0.1.8.dev17";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pysathq";
     repo = "pysat";
-    rev = version;
-    hash = "sha256-zGdgD+SgoMB7/zDQI/trmV70l91TB7OkDxaJ30W3dkI=";
+    rev = "a04763de6dafb8d3a0d7f1b231fc0d30be1de4c0"; # upstream does not tag releases
+    hash = "sha256-FG6oAAI8XKXumj6Ys2QjjYcRp1TpwkUZzyfpkdq5V6E=";
   };
 
   propagatedBuildInputs = [
@@ -26,23 +25,18 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  # https://github.com/pysathq/pysat/pull/102
-  postPatch = ''
-        # Fix for case-insensitive filesystem
-        cat >>solvers/patches/cadical.patch <<EOF
-    diff --git solvers/cadical/VERSION solvers/cdc/VERSION
-    deleted file mode 100644
-    --- solvers/cadical/VERSION
-    +++ /dev/null
-    @@ -1 +0,0 @@
-    -1.0.3
-    EOF
-  '';
+  disabledTestPaths = [ "tests/test_unique_mus.py" ];
 
   meta = with lib; {
     description = "Toolkit to provide interface for various SAT (without optional dependancy py-aiger-cnf)";
     homepage = "https://github.com/pysathq/pysat";
+    changelog = "https://pysathq.github.io/updates/";
     license = licenses.mit;
-    maintainers = [ maintainers.marius851000 ];
+    maintainers = [
+      maintainers.marius851000
+      maintainers.chrjabs
+    ];
+    platforms = lib.platforms.all;
+    badPlatforms = lib.platforms.darwin ++ [ "i686-linux" ];
   };
 }
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
index bc9352edcde3..f3d3cdb312b5 100644
--- a/pkgs/development/python-modules/qtile-extras/default.nix
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -10,6 +10,7 @@
   pulseaudio,
   pytest-asyncio,
   pytest-lazy-fixture,
+  pytest-rerunfailures,
   pytestCheckHook,
   python-dateutil,
   qtile,
@@ -20,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "qtile-extras";
-  version = "0.31.0";
+  version = "0.32.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elParaguayo";
     repo = "qtile-extras";
     tag = "v${version}";
-    hash = "sha256-87xdSw4JKQyb/jpfTUkFDjHvKgPKzu+rKLGeaAzP8NI=";
+    hash = "sha256-NMbgSStXJV8fVtula1cyIwFlD8WrO8kBnOphDxbig04=";
   };
 
   build-system = [ setuptools-scm ];
@@ -41,6 +42,7 @@ buildPythonPackage rec {
     pulseaudio
     pytest-asyncio
     pytest-lazy-fixture
+    pytest-rerunfailures
     pytestCheckHook
     python-dateutil
     qtile
@@ -87,7 +89,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Extra modules and widgets for the Qtile tiling window manager";
     homepage = "https://github.com/elParaguayo/qtile-extras";
-    changelog = "https://github.com/elParaguayo/qtile-extras/blob/${src.rev}/CHANGELOG";
+    changelog = "https://github.com/elParaguayo/qtile-extras/blob/${src.tag}/CHANGELOG";
     license = licenses.mit;
     maintainers = with maintainers; [ arjan-s ];
   };
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 63d39dc595c1..2c6a0ffac9dd 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "qtile";
-  version = "0.31.0";
+  version = "0.32.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
     tag = "v${version}";
-    hash = "sha256-aBVIkyR906+vSLDNxvkmWu6DBujZHErSi+aZPVMRuCI=";
+    hash = "sha256-UF4gRmcevtH9WNA7g/pwcciJcDariXcMNpqya68mQ38=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/standard-nntplib/default.nix b/pkgs/development/python-modules/standard-nntplib/default.nix
new file mode 100644
index 000000000000..b88cf58a7126
--- /dev/null
+++ b/pkgs/development/python-modules/standard-nntplib/default.nix
@@ -0,0 +1,37 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "standard-nntplib";
+  version = "3.13.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.13";
+
+  src = fetchFromGitHub {
+    owner = "youknowone";
+    repo = "python-deadlib";
+    tag = "v${version}";
+    hash = "sha256-J8c55f527QGcK8p/QKJBZeZV0y9DU0iM1RUFVkWh2Hc=";
+    sparseCheckout = [ "nntplib" ];
+  };
+
+  build-system = [ setuptools ];
+  sourceRoot = "${src.name}/nntplib";
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "nntplib" ];
+
+  meta = {
+    description = "Standard library nntplib redistribution";
+    homepage = "https://github.com/youknowone/python-deadlib";
+    license = lib.licenses.psfl;
+    maintainers = [ lib.maintainers.qyliss ];
+  };
+}
diff --git a/pkgs/development/python-modules/stravalib/default.nix b/pkgs/development/python-modules/stravalib/default.nix
index c639769de3b6..d626b1d921bc 100644
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "stravalib";
-  version = "2.3";
+  version = "2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "stravalib";
     repo = "stravalib";
     tag = "v${version}";
-    hash = "sha256-kqR/fujspOyQ6QbWjP2n3NoLVkzzVxAMqntdhY84sl4=";
+    hash = "sha256-RMvahoUOy4RnSu0O7dBpYylaQ8nPfMiivx8k1XBeEGA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 6346431da7fd..862bdc8b01e8 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1404";
+  version = "3.0.1405";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-3T/Y5qGbJvsqrB972iV4FkVYuv3YPRwH2B7B4SnjRhg=";
+    hash = "sha256-cFEuSlOZMUBgUT7KeWBODtCnT+Pog75hkyavwvqzVEU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index f036ef9a4ed7..6343c4e5c83d 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "1.1.3";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     tag = "v${version}";
-    hash = "sha256-1jh4NfIuuP5GMwIc/0Nr1aXuyWyrHPTQ9ZTCJPDDtn0=";
+    hash = "sha256-z7oniC58MpWlz/IGd2oRWgoj5yAL/gaDHGotLKK2CVc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/translate-toolkit/default.nix b/pkgs/development/python-modules/translate-toolkit/default.nix
index 51b97cef0403..9f6bc15ad8ed 100644
--- a/pkgs/development/python-modules/translate-toolkit/default.nix
+++ b/pkgs/development/python-modules/translate-toolkit/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "translate-toolkit";
-  version = "3.15.3";
+  version = "3.15.5";
 
   pyproject = true;
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "translate";
     repo = "translate";
     tag = version;
-    hash = "sha256-T/bH9qz8UbiDfuL0hkmIN7Pmj/aZLRF+lJSjsUmDXiU=";
+    hash = "sha256-VrnL9hD7NroXCyTydLIJlpBTGkUuCLKhrQJPWe3glAM=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/troposphere/default.nix b/pkgs/development/python-modules/troposphere/default.nix
index b363b267f897..b21b422d6d86 100644
--- a/pkgs/development/python-modules/troposphere/default.nix
+++ b/pkgs/development/python-modules/troposphere/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "troposphere";
-  version = "4.9.2";
+  version = "4.9.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "cloudtools";
     repo = "troposphere";
     tag = version;
-    hash = "sha256-IqWgqkxJ4EFNt9z58cuCqSTnlbMNi7bFhA04hgQjG8E=";
+    hash = "sha256-AC54tUJZ0aV16p06Fabss60AC/BF3QBeOQPvnbuyRqQ=";
   };
 
   propagatedBuildInputs = [ cfn-flip ] ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 7f2ae47dcb5b..faf5ca222917 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -20,21 +20,24 @@
   weasyprint,
   gevent,
   pillow,
+  pwdlib,
+  simpleeval,
   withPostgresql ? true,
   psycopg2,
   unittestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "7.4.10";
+  version = "7.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kzoZDcHNPjmsNxrQ11MAksK+24nI1YNmONQd21s3weA=";
+    hash = "sha256-KD9gZ0ForX1iYQMYlsle2fJ+zlmQOymDf71p17aCr1k=";
   };
 
   build-system = [ setuptools ];
@@ -58,16 +61,23 @@ buildPythonPackage rec {
       weasyprint
       gevent
       pillow
+      pwdlib
+      simpleeval
     ]
     ++ relatorio.optional-dependencies.fodt
     ++ passlib.optional-dependencies.bcrypt
     ++ passlib.optional-dependencies.argon2
     ++ lib.optional withPostgresql psycopg2;
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  # Fontconfig error: Cannot load default config file: No such file: (null)
+  doCheck = false;
+
+  nativeCheckInputs = [
+    unittestCheckHook
+    writableTmpDirAsHomeHook
+  ];
 
   preCheck = ''
-    export HOME=$(mktemp -d)
     export TRYTOND_DATABASE_URI="sqlite://"
     export DB_NAME=":memory:";
   '';
@@ -77,7 +87,7 @@ buildPythonPackage rec {
     "trytond.tests"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Server of the Tryton application platform";
     longDescription = ''
       The server for Tryton, a three-tier high-level general purpose
@@ -89,9 +99,9 @@ buildPythonPackage rec {
     '';
     homepage = "http://www.tryton.org/";
     changelog = "https://foss.heptapod.net/tryton/tryton/-/blob/trytond-${version}/trytond/CHANGELOG?ref_type=tags";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     broken = stdenv.hostPlatform.isDarwin;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       udono
       johbo
     ];
diff --git a/pkgs/development/python-modules/weblate-language-data/default.nix b/pkgs/development/python-modules/weblate-language-data/default.nix
index 42f455423a76..894c6090c08e 100644
--- a/pkgs/development/python-modules/weblate-language-data/default.nix
+++ b/pkgs/development/python-modules/weblate-language-data/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "weblate-language-data";
-  version = "2025.6";
+  version = "2025.7";
   pyproject = true;
 
   src = fetchPypi {
     pname = "weblate_language_data";
     inherit version;
-    hash = "sha256-5nVLYeqM3V+Q+FiBvOrk6UrgNs0oA+5vJ8mXAf6ete0=";
+    hash = "sha256-eDefK2g4EwJJttFHCNurOYifC2OXQXjRcqRT36nfLOc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wslink/default.nix b/pkgs/development/python-modules/wslink/default.nix
new file mode 100644
index 000000000000..99efcdbb7357
--- /dev/null
+++ b/pkgs/development/python-modules/wslink/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  msgpack,
+  cryptography,
+}:
+
+buildPythonPackage rec {
+  pname = "wslink";
+  version = "2.3.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kitware";
+    repo = "wslink";
+    tag = "v${version}";
+    hash = "sha256-QTMEZgoV7Ua3x2C2E9Z1NsX35/JcfmpLZDjNd/HzDj8=";
+  };
+
+  sourceRoot = "${src.name}/python";
+
+  # add missing version string to dist-info
+  postPatch = ''
+    sed -i "/name *= */a\    version='${version}'," setup.py
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    msgpack
+  ];
+
+  optional-dependencies = {
+    ssl = [ cryptography ];
+  };
+
+  pythonImportsCheck = [ "wslink" ];
+
+  # doCheck need interacting with the http server
+  doCheck = false;
+
+  meta = {
+    description = "Python/JavaScript library for communicating over WebSocket";
+    homepage = "https://github.com/Kitware/wslink";
+    changelog = "https://github.com/Kitware/wslink/releases/tag/${src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+}
diff --git a/pkgs/development/python-modules/yargy/default.nix b/pkgs/development/python-modules/yargy/default.nix
index b4350676665f..1b13419b04bb 100644
--- a/pkgs/development/python-modules/yargy/default.nix
+++ b/pkgs/development/python-modules/yargy/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Rule-based facts extraction for Russian language";
-    homepage = "https://github.com/natasha/yargu";
+    homepage = "https://github.com/natasha/yargy";
     license = licenses.mit;
     maintainers = with maintainers; [ npatsakula ];
   };
diff --git a/pkgs/development/python-modules/zxcvbn-rs-py/default.nix b/pkgs/development/python-modules/zxcvbn-rs-py/default.nix
index 5531fb6c4ba0..fb932352b120 100644
--- a/pkgs/development/python-modules/zxcvbn-rs-py/default.nix
+++ b/pkgs/development/python-modules/zxcvbn-rs-py/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   pythonOlder,
-  pythonAtLeast,
   fetchPypi,
   rustPlatform,
 }:
@@ -13,7 +12,7 @@ buildPythonPackage rec {
 
   pyproject = true;
 
-  disabled = pythonOlder "3.9" || pythonAtLeast "3.13";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "zxcvbn_rs_py";
diff --git a/pkgs/games/doom-ports/slade/git.nix b/pkgs/games/doom-ports/slade/git.nix
index 205e6ec50af2..50929eb5c08a 100644
--- a/pkgs/games/doom-ports/slade/git.nix
+++ b/pkgs/games/doom-ports/slade/git.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.7-unstable-2025-05-31";
+  version = "3.2.7-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "996bf5de51072d99846bf2a8a82c92d7fce58741";
-    hash = "sha256-TDPT+UbDrw3GDY9exX8QYBsNpyHG5n3Hw3vAxGJ9M3o=";
+    rev = "1c8bb341ef0ec8393de0ce1f951a033daf334cf0";
+    hash = "sha256-FMBSgavYdk+0TZt4/GttAauSjcGLaFiI51sGUw1X8/0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/minecraft-servers/versions.json b/pkgs/games/minecraft-servers/versions.json
index 86239afe8579..a03d4ef79963 100644
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@@ -1,8 +1,8 @@
 {
   "1.21": {
-    "sha1": "e6ec2f64e6080b9b5d9b471b291c33cc7f509733",
-    "url": "https://piston-data.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar",
-    "version": "1.21.5",
+    "sha1": "6e64dcabba3c01a7271b4fa6bd898483b794c59b",
+    "url": "https://piston-data.mojang.com/v1/objects/6e64dcabba3c01a7271b4fa6bd898483b794c59b/server.jar",
+    "version": "1.21.6",
     "javaVersion": 21
   },
   "1.20": {
diff --git a/pkgs/games/shattered-pixel-dungeon/default.nix b/pkgs/games/shattered-pixel-dungeon/default.nix
index 1711dfc6092c..4ebd508dac9e 100644
--- a/pkgs/games/shattered-pixel-dungeon/default.nix
+++ b/pkgs/games/shattered-pixel-dungeon/default.nix
@@ -6,13 +6,13 @@
 
 callPackage ./generic.nix rec {
   pname = "shattered-pixel-dungeon";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "00-Evan";
     repo = "shattered-pixel-dungeon";
     rev = "v${version}";
-    hash = "sha256-BPZN163Opr2uKYckqlimizr0pIhmz4wUzI5r2aYzZFY=";
+    hash = "sha256-MUpQdH8RMzZtI6e2duSRWHK1gPJDhMRKsm5kIKDcFuk=";
   };
 
   depsPath = ./deps.json;
diff --git a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
index 54e5fbb1c2b4..818b3489aaeb 100644
--- a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
+++ b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/kcms/audio_information/kcm_audio_information.json b/kcms/audio_information/kcm_audio_information.json
-index d94ef1d0..13f1c377 100644
+index 7ece92ee..a4fb6664 100644
 --- a/kcms/audio_information/kcm_audio_information.json
 +++ b/kcms/audio_information/kcm_audio_information.json
-@@ -80,7 +80,7 @@
+@@ -82,7 +82,7 @@
          "Name[zh_CN]": "音频",
          "Name[zh_TW]": "音訊"
      },
@@ -25,10 +25,10 @@ index adb196fd..9d6c8675 100644
      CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/block_devices/kcm_block_devices.json b/kcms/block_devices/kcm_block_devices.json
-index a73e33ad..3a1ab4da 100644
+index f73cf5a5..b18ecbfb 100644
 --- a/kcms/block_devices/kcm_block_devices.json
 +++ b/kcms/block_devices/kcm_block_devices.json
-@@ -80,7 +80,7 @@
+@@ -82,7 +82,7 @@
          "Name[zh_CN]": "块设备",
          "Name[zh_TW]": "區塊裝置"
      },
@@ -51,10 +51,10 @@ index 2de923f3..6b14f7fb 100644
      CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/cpu/kcm_cpu.json b/kcms/cpu/kcm_cpu.json
-index a783b5bc..5866c4d2 100644
+index e8fb086e..c87b98f8 100644
 --- a/kcms/cpu/kcm_cpu.json
 +++ b/kcms/cpu/kcm_cpu.json
-@@ -102,7 +102,7 @@
+@@ -104,7 +104,7 @@
          "Name[zh_CN]": "CPU",
          "Name[zh_TW]": "CPU"
      },
@@ -90,12 +90,12 @@ index da803598..4e24eaaf 100755
      printf "%s\n\n" "$data"
  done
 diff --git a/kcms/edid/kcm_edid.json b/kcms/edid/kcm_edid.json
-index 68e4e670..19dfdc59 100644
+index e180df8d..3d5bbd0b 100644
 --- a/kcms/edid/kcm_edid.json
 +++ b/kcms/edid/kcm_edid.json
-@@ -64,7 +64,7 @@
-         "Name[x-test]": "xxEDIDxx",
-         "Name[zh_CN]": "EDID"
+@@ -72,7 +72,7 @@
+         "Name[zh_CN]": "EDID",
+         "Name[zh_TW]": "EDID"
      },
 -    "TryExec": "di-edid-decode",
 +    "TryExec": "@di_edid_decode@",
@@ -116,10 +116,10 @@ index 9f04e7fd..8ef37d2c 100644
      [[nodiscard]] CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/egl/kcm_egl.json b/kcms/egl/kcm_egl.json
-index 1cc89eb2..f1aed6c3 100644
+index 02a90071..64bfb609 100644
 --- a/kcms/egl/kcm_egl.json
 +++ b/kcms/egl/kcm_egl.json
-@@ -102,7 +102,7 @@
+@@ -104,7 +104,7 @@
          "Name[zh_CN]": "OpenGL (EGL)",
          "Name[zh_TW]": "OpenGL (EGL)"
      },
@@ -155,10 +155,10 @@ index eab20e0f..5a0d2499 100644
                                                     {executable},
                                                     Qt::TextFormat::RichText,
 diff --git a/kcms/glx/kcm_glx.json b/kcms/glx/kcm_glx.json
-index 640ef4a5..791e8ce9 100644
+index 8a56690a..e2caaec7 100644
 --- a/kcms/glx/kcm_glx.json
 +++ b/kcms/glx/kcm_glx.json
-@@ -101,7 +101,7 @@
+@@ -103,7 +103,7 @@
          "Name[zh_CN]": "OpenGL (GLX)",
          "Name[zh_TW]": "OpenGL (GLX)"
      },
@@ -197,10 +197,10 @@ index 11921934..1160c5f0 100644
  
  KAuth::ActionReply DMIDecodeHelper::memoryinformation(const QVariantMap &args)
 diff --git a/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in b/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
-index 24dc11a7..bc72f2af 100644
+index 9e502d52..f9f26cbd 100644
 --- a/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
 +++ b/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
-@@ -93,6 +93,6 @@
+@@ -95,6 +95,6 @@
          "Name[zh_CN]": "窗口管理器",
          "Name[zh_TW]": "視窗管理員"
      },
@@ -222,10 +222,10 @@ index ddb55b5c..8dc6b668 100644
                                                     parent);
      }
 diff --git a/kcms/memory/kcm_memory.json b/kcms/memory/kcm_memory.json
-index 54f729ec..8e7aeb57 100644
+index 20df9662..6a64c762 100644
 --- a/kcms/memory/kcm_memory.json
 +++ b/kcms/memory/kcm_memory.json
-@@ -132,7 +132,7 @@
+@@ -134,7 +134,7 @@
          "Name[zh_CN]": "内存",
          "Name[zh_TW]": "記憶體"
      },
@@ -235,10 +235,10 @@ index 54f729ec..8e7aeb57 100644
      "X-KDE-Keywords": "Memory,RAM,dmidecode",
      "X-KDE-Keywords[ar]": "Memory,RAM,dmidecode,رام,ذاكرة,ذاكرة حية",
 diff --git a/kcms/network/kcm_network.json b/kcms/network/kcm_network.json
-index 65e929e2..20bc2289 100644
+index 5fc677a5..59ec49da 100644
 --- a/kcms/network/kcm_network.json
 +++ b/kcms/network/kcm_network.json
-@@ -147,7 +147,7 @@
+@@ -148,7 +148,7 @@
          "Name[zh_CN]": "网络接口",
          "Name[zh_TW]": "網路介面"
      },
@@ -261,10 +261,10 @@ index f02577a3..479e18df 100644
      CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/opencl/kcm_opencl.json b/kcms/opencl/kcm_opencl.json
-index 774dd42e..40e2076a 100644
+index 61706cb9..b7fb9c59 100644
 --- a/kcms/opencl/kcm_opencl.json
 +++ b/kcms/opencl/kcm_opencl.json
-@@ -90,7 +90,7 @@
+@@ -92,7 +92,7 @@
          "Name[zh_CN]": "OpenCL",
          "Name[zh_TW]": "OpenCL"
      },
@@ -299,11 +299,37 @@ index 36d82ef8..16ce2703 100644
      set(PCI_BACKEND_ARGUMENTS "-v")
  endif()
  
+diff --git a/kcms/sensors/kcm_sensors.json b/kcms/sensors/kcm_sensors.json
+index e1994f2c..e1c27245 100644
+--- a/kcms/sensors/kcm_sensors.json
++++ b/kcms/sensors/kcm_sensors.json
+@@ -58,7 +58,7 @@
+         "Name[zh_CN]": "传感器",
+         "Name[zh_TW]": "感測器"
+     },
+-    "TryExec": "sensors",
++    "TryExec": "@sensors@",
+     "X-KDE-KInfoCenter-Category": "device_information",
+     "X-KDE-Keywords": "lm_sensors,sensors,temp,temperature,volt,voltage,sensors,fan,fan speed,monitoring,amp,amps,current,power",
+     "X-KDE-Keywords[ar]": "مستشعرات lm,مستشعرات,درجة الحرارة,درجة الحرارة,فولت,جهد,مستشعرات,مروحة,سرعة المروحة,مراقبة,أمبير,أمبير,تيار,طاقة",
+diff --git a/kcms/sensors/main.cpp b/kcms/sensors/main.cpp
+index 8dae9f8f..ee70f381 100644
+--- a/kcms/sensors/main.cpp
++++ b/kcms/sensors/main.cpp
+@@ -18,7 +18,7 @@ public:
+     explicit KCMSensors(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(u"sensors"_s, {}, parent);
++        m_outputContext = new CommandOutputContext(u"@sensors@"_s, {}, parent);
+         m_outputContext->setAutoRefreshMs(1000);
+     }
+     CommandOutputContext *outputContext() const
 diff --git a/kcms/vulkan/kcm_vulkan.json b/kcms/vulkan/kcm_vulkan.json
-index 78b42cfd..1ec93c91 100644
+index 9a297a07..2c30b20a 100644
 --- a/kcms/vulkan/kcm_vulkan.json
 +++ b/kcms/vulkan/kcm_vulkan.json
-@@ -100,7 +100,7 @@
+@@ -102,7 +102,7 @@
          "Name[zh_CN]": "Vulkan",
          "Name[zh_TW]": "Vulkan"
      },
@@ -326,10 +352,10 @@ index 5665d9d2..008f1bf0 100644
      CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/wayland/kcm_wayland.json b/kcms/wayland/kcm_wayland.json
-index 9ae953bb..27d98104 100644
+index 66022b79..1756eb0e 100644
 --- a/kcms/wayland/kcm_wayland.json
 +++ b/kcms/wayland/kcm_wayland.json
-@@ -107,7 +107,7 @@
+@@ -108,7 +108,7 @@
          "Name[zh_CN]": "Wayland",
          "Name[zh_TW]": "Wayland"
      },
@@ -352,10 +378,10 @@ index 3a4825c7..4633927b 100644
      CommandOutputContext *outputContext() const
      {
 diff --git a/kcms/xserver/kcm_xserver.json b/kcms/xserver/kcm_xserver.json
-index f5642e25..11f108a7 100644
+index a5e64d94..81190779 100644
 --- a/kcms/xserver/kcm_xserver.json
 +++ b/kcms/xserver/kcm_xserver.json
-@@ -147,7 +147,7 @@
+@@ -148,7 +148,7 @@
          "Name[zh_CN]": "X 服务器",
          "Name[zh_TW]": "X 伺服器"
      },
diff --git a/pkgs/kde/plasma/kinfocenter/default.nix b/pkgs/kde/plasma/kinfocenter/default.nix
index c6849d94c93e..2e8ebe634cd9 100644
--- a/pkgs/kde/plasma/kinfocenter/default.nix
+++ b/pkgs/kde/plasma/kinfocenter/default.nix
@@ -6,6 +6,7 @@
   lib,
   libdisplay-info,
   libusb1,
+  lm_sensors,
   mesa-demos,
   mkKdeDerivation,
   pkg-config,
@@ -33,6 +34,7 @@ let
     lscpu = lib.getExe' util-linux "lscpu";
     pactl = lib.getExe' pulseaudio "pactl";
     qdbus = lib.getExe' qttools "qdbus";
+    sensors = lib.getExe' lm_sensors "sensors";
     vulkaninfo = lib.getExe' vulkan-tools "vulkaninfo";
     waylandinfo = lib.getExe wayland-utils;
     xdpyinfo = lib.getExe xdpyinfo;
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 61ff3b6989ff..6d84ea81be6f 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -8,7 +8,7 @@
 }:
 let
   rev-prefix = "ena_linux_";
-  version = "2.14.1";
+  version = "2.15.0";
 in
 stdenv.mkDerivation {
   inherit version;
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "${rev-prefix}${version}";
-    hash = "sha256-jfyzL102gvkqt8d//ZfFpwotNa/Q3vleT11kRtQ7tfA=";
+    hash = "sha256-AwA7YduFACxmDk4+K/ghp39tdkjewgk4NLktnrSpK5k=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 063c50e7c25b..8e8bbf421bff 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2024-09-27";
+  version = "${kernel.version}-unstable-2025-05-08";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "2dce552dc6aa0cdab427bfa810c3df002eab0078";
-    hash = "sha256-8hGAfZyDCGl0RnPnYjc7iMEulZvoIGe2ghfIfoiz7ZI=";
+    rev = "d74134a1c68f59f2b80cdd6c6afb8c1a8a687cbf";
+    hash = "sha256-ExT7ONQeejFoMwUUXKua7wMnRi+3IYayLmlWIEWteK4=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Realtek rtl8821cu driver";
-    homepage = "https://github.com/morrownr/8821cu";
+    homepage = "https://github.com/morrownr/8821cu-20210916";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.contrun ];
diff --git a/pkgs/os-specific/linux/ryzen-smu/default.nix b/pkgs/os-specific/linux/ryzen-smu/default.nix
index 40226010ec9e..c0704ffe41d2 100644
--- a/pkgs/os-specific/linux/ryzen-smu/default.nix
+++ b/pkgs/os-specific/linux/ryzen-smu/default.nix
@@ -6,17 +6,17 @@
 }:
 
 let
-  version = "0.1.5-unstable-2024-01-03";
+  version = "0.1.5-unstable-2025-06-04";
 
   ## Upstream has not been merging PRs.
   ## Nixpkgs maintainers are providing a
   ## repo with PRs merged until upstream is
   ## updated.
   src = fetchFromGitHub {
-    owner = "Cryolitia";
+    owner = "amkillam";
     repo = "ryzen_smu";
-    rev = "ce1aa918efa33ca79998f0f7d467c04d4b07016c";
-    hash = "sha256-s9SSmbL6ixWqZUKEhrZdxN4xoWgk+8ClZPoKq2FDAAE=";
+    rev = "9f9569f889935f7c7294cc32c1467e5a4081701a";
+    hash = "sha256-i8T0+kUYsFMzYO3h6ffUXP1fgGOXymC4Ml2dArQLOdk=";
   };
 
   monitor-cpu = stdenv.mkDerivation {
@@ -59,13 +59,14 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
-    homepage = "https://gitlab.com/leogx9r/ryzen_smu";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [
+    homepage = "https://github.com/amkillam/ryzen_smu";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
       Cryolitia
       phdyellow
+      aleksana
     ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "monitor_cpu";
diff --git a/pkgs/os-specific/linux/shufflecake/default.nix b/pkgs/os-specific/linux/shufflecake/default.nix
index acc7ab0b340a..6871364183b5 100644
--- a/pkgs/os-specific/linux/shufflecake/default.nix
+++ b/pkgs/os-specific/linux/shufflecake/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   name = "shufflecake";
-  version = "0.5.1";
+  version = "0.5.2";
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "shufflecake";
     repo = "shufflecake-c";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ULRx+WEz7uQ1C0JDaXORo6lmiwBAwD20j/XP92YE/K0=";
+    hash = "sha256-EF9VKaqcNJt3hd/CUT+QeW17tc5ByStDanGGwi4uL4s=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
+  # GCC 14 makes this an error by default, remove when fixed upstream
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   outputs = [
     "out"
     "bin"
diff --git a/pkgs/os-specific/linux/veikk-linux-driver/default.nix b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
index 55ce63db7902..7663707fe662 100644
--- a/pkgs/os-specific/linux/veikk-linux-driver/default.nix
+++ b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
@@ -6,17 +6,19 @@
   kernelModuleMakeFlags,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "veikk-linux-driver";
   version = "2.0";
 
   src = fetchFromGitHub {
     owner = "jlam55555";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "11mg74ds58jwvdmi3i7c4chxs6v9g09r9ll22pc2kbxjdnrp8zrn";
+    repo = "veikk-linux-driver";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-Nn90s22yrynYFYLSlBN4aRvdISPsxBFr21yiohs5r4Y=";
   };
 
+  patches = [ ./fix-6.12-build.patch ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   buildInputs = [ kernel ];
@@ -26,16 +28,20 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/veikk
     install -Dm755 veikk.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/veikk
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Linux driver for VEIKK-brand digitizers";
     homepage = "https://github.com/jlam55555/veikk-linux-driver/";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ nicbk ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nicbk ];
     broken = kernel.kernelOlder "4.19";
   };
-}
+})
diff --git a/pkgs/os-specific/linux/veikk-linux-driver/fix-6.12-build.patch b/pkgs/os-specific/linux/veikk-linux-driver/fix-6.12-build.patch
new file mode 100644
index 000000000000..feae73dd83e2
--- /dev/null
+++ b/pkgs/os-specific/linux/veikk-linux-driver/fix-6.12-build.patch
@@ -0,0 +1,26 @@
+https://github.com/torvalds/linux/commit/5f60d5f6bbc12e782fac78110b0ee62698f3b576
+---
+ veikk_vdev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/veikk_vdev.c b/veikk_vdev.c
+index 9d0b49f..83e9efa 100644
+--- a/veikk_vdev.c
++++ b/veikk_vdev.c
+@@ -6,7 +6,13 @@
+  * - Set up the module parameters
+  */
+
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 12, 0)
+ #include <asm/unaligned.h>
++#else
++#include <linux/unaligned.h>
++#endif
+ #include <linux/module.h>
+ #include "veikk.h"
+
+--
+2.49.0
+
diff --git a/pkgs/servers/mail/mailman/package.nix b/pkgs/servers/mail/mailman/package.nix
index cb5dc354cf74..68b38c51aebf 100644
--- a/pkgs/servers/mail/mailman/package.nix
+++ b/pkgs/servers/mail/mailman/package.nix
@@ -42,6 +42,7 @@ buildPythonPackage rec {
     python-dateutil
     requests
     sqlalchemy
+    standard-nntplib
     zope-component
     zope-configuration
   ];
@@ -59,6 +60,11 @@ buildPythonPackage rec {
       url = "https://gitlab.com/mailman/mailman/-/commit/9613154f3c04fa2383fbf017031ef263c291418d.patch";
       sha256 = "0vyw87s857vfxbf7kihwb6w094xyxmxbi1bpdqi3ybjamjycp55r";
     })
+    (fetchpatch {
+      name = "python-3.13.patch";
+      url = "https://gitlab.com/mailman/mailman/-/commit/685d9a7bdbd382d9e8d4a2da74bd973e93356e05.patch";
+      hash = "sha256-KCXVP+5zqgluUXQCGmMRC+G1hEDnFBlTUETGpmFDOOk=";
+    })
     ./log-stderr.patch
   ];
 
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 7f3e4104f7bd..b8bf29be44e9 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -68,7 +68,10 @@ buildGoModule rec {
     homepage = "https://www.minio.io/";
     description = "S3-compatible object storage server";
     changelog = "https://github.com/minio/minio/releases/tag/RELEASE.${version}";
-    maintainers = with maintainers; [ bachp ];
+    maintainers = with maintainers; [
+      bachp
+      ryan4yin
+    ];
     license = licenses.agpl3Plus;
     mainProgram = "minio";
   };
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 2e212a062c8d..604163ff9fae 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -161,6 +161,7 @@ buildGoModule rec {
       globin
       ma27
       Frostman
+      ryan4yin
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index 074df2f75d76..7be1d7a10b8d 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.19.11",
-  "uiVersion": "0.19.11",
-  "serverHash": "sha256-veF+fJTjsB543PyBnnBN4rmejTWrnlnLghnP6mLDP7U=",
-  "serverCargoHash": "sha256-H9Eu/nKxK27OXvzPi5ItTbKcHqISKAjN17MRWsw5xlc=",
-  "uiHash": "sha256-K8nNb/HQy/s5S5h9Ndt3t8F9/h1D2zOGrTEKhv+Z4Ks=",
-  "uiPNPMDepsHash": "sha256-SqU/kYadwszogaBErP2v1VXIMhJj9AHRKdrHLc99fMw="
+  "serverVersion": "0.19.12",
+  "uiVersion": "0.19.12",
+  "serverHash": "sha256-1xkm2iKoeNXuTW5ZMKPQyqePTUqKXJ5upz97MVwqjzo=",
+  "serverCargoHash": "sha256-QnDN0Lvfw8d5SF7nrb8hBVG2gwT1xgEhYlLElfR15Z0=",
+  "uiHash": "sha256-bxppQtDFgxvdeBE/8PsfBNpnEdvX8AoELyhrwEV8Hsg=",
+  "uiPNPMDepsHash": "sha256-tuarUG1uKx6Q1O+rF6DHyK8MEseF9lKk34qtRWWScAg="
 }
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 8c3d3ef2b748..903cced2a9cd 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -95,6 +95,7 @@ rustPlatform.buildRustPackage {
       Br1ght0ne
       johntitor
       joaquintrinanes
+      ryan4yin
     ];
     mainProgram = "nu";
   };
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index b8fa30ba1802..c9322945a596 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -182,6 +182,7 @@ stdenv.mkDerivation rec {
       pradyuman
       stephenmw
       zimbatm
+      ryan4yin
     ];
     platforms = builtins.attrNames data.googleCloudSdkPkgs;
     mainProgram = "gcloud";
diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index a33b3587185e..177862b18d26 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -92,7 +92,7 @@ let
         "k2v::poll::test_poll_item"
       ];
 
-      passthru.tests = nixosTests.garage;
+      passthru.tests = nixosTests."garage_${lib.versions.major version}";
 
       meta = {
         description = "S3-compatible object store for small self-hosted geo-distributed deployments";
@@ -137,11 +137,20 @@ rec {
     cargoHash = "sha256-vcvD0Fn/etnAuXrM3+rj16cqpEmW2nzRmrjXsftKTFE=";
   };
 
+  garage_2_0_0 = generic {
+    version = "2.0.0";
+    hash = "sha256-dn7FoouF+5qmW6fcC20bKQSc6D2G9yrWdBK3uN3bF58=";
+    cargoHash = "sha256-6VM/EesrUIaQOeDGqzb0kOqMz4hW7zBJUnaRQ9C3cqc=";
+  };
+
   garage_0_8 = garage_0_8_7;
 
   garage_0_9 = garage_0_9_4;
 
   garage_1_x = garage_1_2_0;
+  garage_1 = garage_1_x;
+
+  garage_2 = garage_2_0_0;
 
   garage = garage_1_x;
 }
diff --git a/pkgs/tools/misc/qt6gtk2/default.nix b/pkgs/tools/misc/qt6gtk2/default.nix
index 6aec3673d423..b2ffaac64abe 100644
--- a/pkgs/tools/misc/qt6gtk2/default.nix
+++ b/pkgs/tools/misc/qt6gtk2/default.nix
@@ -6,19 +6,19 @@
   pkg-config,
   qmake,
   qtbase,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qt6gtk2";
-  version = "0.4-unstable-2025-05-11";
+  version = "0.5";
 
   src = fetchFromGitLab {
     domain = "opencode.net";
     owner = "trialuser";
     repo = "qt6gtk2";
-    rev = "a95d620193bfc3a2d5e17c3d1c883849182f77b8";
-    hash = "sha256-gcCujWImw7WOnz7QI4h4ye/v5EZWVIq5eFLYoOxYoog=";
+    tag = finalAttrs.version;
+    hash = "sha256-G2TQ4LU8Cmvd+u6/s1ugbUkZcRXHTBm3+ISY0g/5/60=";
   };
 
   buildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     "PLUGINDIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
   ];
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "GTK+2.0 integration plugins for Qt6";
@@ -45,4 +45,4 @@ stdenv.mkDerivation {
     maintainers = [ lib.maintainers.misterio77 ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/networking/mtr/default.nix b/pkgs/tools/networking/mtr/default.nix
index c3fc477f1c2d..f25d0109900e 100644
--- a/pkgs/tools/networking/mtr/default.nix
+++ b/pkgs/tools/networking/mtr/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
       orivej
       raskin
       globin
+      ryan4yin
     ];
     mainProgram = "mtr";
     platforms = platforms.unix;
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index df64103e8a45..9b666e5e78fb 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -139,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
         p.pytest
         p.pytest-xdist
         p.python-frontmatter
+        p.toml
       ]))
       pkg-config
       flex
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 28f368731118..c6d905d78048 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -234,14 +234,14 @@ lib.makeExtensible (self: {
     attrName = "git";
 
     lix-args = rec {
-      version = "2.94.0-pre-20250516_${builtins.substring 0 12 src.rev}";
+      version = "2.94.0-pre-20250621_${builtins.substring 0 12 src.rev}";
 
       src = fetchFromGitea {
         domain = "git.lix.systems";
         owner = "lix-project";
         repo = "lix";
-        rev = "a7634f87aac545fa01fa19878cc5ad2c994e2116";
-        hash = "sha256-+yX+xF1cZUd1Pub7MJ7uGcC6JQ0FN+CsEmBg6rGLfjU=";
+        rev = "242a228124f77b57c2e3b3aedb259ffb7913cd3c";
+        hash = "sha256-hCbhc9P+UmIlYv81+vs6v3bDqviCUhwPH3XqClZdfSk=";
       };
 
       cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index c9382cc05547..a7644ffe4126 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -197,6 +197,7 @@ stdenv.mkDerivation rec {
       tadfisher
       globin
       ma27
+      ryan4yin
     ];
     platforms = platforms.unix;
 
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 48ae41eb8ed2..b90941a385e1 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.89.1";
+  version = "3.89.2";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-mzApiAWPLq2Q69NNLj1/FNuktYjIGHt9iWO9OlercjM=";
+    hash = "sha256-l697tyS3ydWIMGK2igbypj0O0zw0dqYGWk51VY8P4T8=";
   };
 
-  vendorHash = "sha256-Zum9Clc7yL81QT6dA6sjLV2HmB5Why76fmooSSAo63Y=";
+  vendorHash = "sha256-yq/wuq67LOIZLV84BQ3hGYsQVFpfLEM2rLW5noj5uqc=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b48c0a419d13..fda28c60bc70 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -624,6 +624,7 @@ mapAliases {
   EmptyEpsilon = empty-epsilon; # Added 2024-07-14
   enyo-doom = enyo-launcher; # Added 2022-09-09
   eolie = throw "'eolie' has been removed due to being unmaintained"; # Added 2025-04-15
+  epapirus-icon-theme = throw "'epapirus-icon-theme' has been removed because 'papirus-icon-theme' no longer supports building with elementaryOS icon support"; # Added 2025-06-15
   epdfview = throw "'epdfview' has been removed due to lack of maintenance upstream. Consider using 'qpdfview' instead"; # Added 2024-10-19
   ephemeral = throw "'ephemeral' has been archived upstream since 2022-04-02"; # added 2025-04-12
   epoxy = throw "'epoxy' has been renamed to/replaced by 'libepoxy'"; # Converted to throw 2024-10-17
@@ -1549,6 +1550,7 @@ mapAliases {
   plots = throw "'plots' has been replaced by 'gnome-graphs'"; # Added 2025-02-05
   pltScheme = racket; # just to be sure
   poac = cabinpkg; # Added 2025-01-22
+  podofo010 = podofo_0_10; # Added 2025-06-01
   polkit-kde-agent = throw ''
     The top-level polkit-kde-agent alias has been removed.
 
@@ -1559,6 +1561,7 @@ mapAliases {
   ''; # Added 2025-03-07
   poretools = throw "poretools has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-06-03
   powerdns = pdns; # Added 2022-03-28
+  presage = throw "presage has been removed, as it has been unmaintained since 2018"; # Added 2024-03-24
   projectm = throw "Since version 4, 'projectm' has been split into 'libprojectm' (the library) and 'projectm-sdl-cpp' (the SDL2 frontend). ProjectM 3 has been moved to 'projectm_3'"; # Added 2024-11-10
 
   cstore_fdw = postgresqlPackages.cstore_fdw;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3d483fc5f0a1..e3e54a9302a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3029,8 +3029,13 @@ with pkgs;
     garage_0_9
     garage_0_8_7
     garage_0_9_4
+
     garage_1_2_0
     garage_1_x
+    garage_1
+
+    garage_2_0_0
+    garage_2
     ;
 
   gaugePlugins = recurseIntoAttrs (callPackage ../by-name/ga/gauge/plugins { });
@@ -9233,9 +9238,7 @@ with pkgs;
 
   place-cursor-at = haskell.lib.compose.justStaticExecutables haskellPackages.place-cursor-at;
 
-  podofo = callPackage ../development/libraries/podofo { };
-
-  podofo010 = callPackage ../development/libraries/podofo/0.10.x.nix { };
+  podofo = podofo_1_0;
 
   poppler = callPackage ../development/libraries/poppler { lcms = lcms2; };
 
@@ -11540,8 +11543,6 @@ with pkgs;
 
   documentation-highlighter = callPackage ../misc/documentation-highlighter { };
 
-  epapirus-icon-theme = papirus-icon-theme.override { withElementary = true; };
-
   moeli = eduli;
 
   emojione = callPackage ../data/fonts/emojione {
@@ -11675,11 +11676,6 @@ with pkgs;
 
   openmoji-black = callPackage ../data/fonts/openmoji { fontFormats = [ "glyf" ]; };
 
-  papirus-icon-theme = callPackage ../data/icons/papirus-icon-theme {
-    inherit (pantheon) elementary-icon-theme;
-    inherit (plasma5Packages) breeze-icons;
-  };
-
   papirus-maia-icon-theme = callPackage ../data/icons/papirus-maia-icon-theme {
     inherit (plasma5Packages) breeze-icons;
   };
@@ -11937,10 +11933,6 @@ with pkgs;
 
   calcmysky = qt6Packages.callPackage ../applications/science/astronomy/calcmysky { };
 
-  calibre = callPackage ../by-name/ca/calibre/package.nix {
-    podofo = podofo010;
-  };
-
   # calico-felix and calico-node have not been packaged due to libbpf, linking issues
   inherit (callPackage ../applications/networking/cluster/calico { })
     calico-apiserver
@@ -14365,7 +14357,7 @@ with pkgs;
     autoconf = buildPackages.autoconf269;
   };
 
-  x2goclient = libsForQt5.callPackage ../applications/networking/remote/x2goclient { };
+  x2goclient = callPackage ../applications/networking/remote/x2goclient { };
 
   x2gokdriveclient = libsForQt5.callPackage ../applications/networking/remote/x2gokdriveclient { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e2c95f778198..954c54da7583 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4080,6 +4080,8 @@ self: super: with self; {
 
   djmail = callPackage ../development/python-modules/djmail { };
 
+  djoser = callPackage ../development/python-modules/djoser { };
+
   dkimpy = callPackage ../development/python-modules/dkimpy { };
 
   dlib = callPackage ../development/python-modules/dlib { inherit (pkgs) dlib; };
@@ -11975,6 +11977,8 @@ self: super: with self; {
 
   pvo = callPackage ../development/python-modules/pvo { };
 
+  pwdlib = callPackage ../development/python-modules/pwdlib { };
+
   pweave = callPackage ../development/python-modules/pweave { };
 
   pwinput = callPackage ../development/python-modules/pwinput { };
@@ -16956,6 +16960,9 @@ self: super: with self; {
   standard-mailcap =
     if pythonOlder "3.13" then null else callPackage ../development/python-modules/standard-mailcap { };
 
+  standard-nntplib =
+    if pythonOlder "3.13" then null else callPackage ../development/python-modules/standard-nntplib { };
+
   standard-pipes =
     if pythonAtLeast "3.13" then callPackage ../development/python-modules/standard-pipes { } else null;
 
@@ -19424,6 +19431,8 @@ self: super: with self; {
 
   wsgitools = callPackage ../development/python-modules/wsgitools { };
 
+  wslink = callPackage ../development/python-modules/wslink { };
+
   wsme = callPackage ../development/python-modules/wsme { };
 
   wsproto = callPackage ../development/python-modules/wsproto { };