diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml
index b7d914caffdc..77aafd9f0ff2 100644
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@@ -115,16 +115,17 @@ jobs:
                 repo: context.repo.repo,
                 pull_number: context.payload.pull_request.number
               })).filter(review =>
-                review.user.login == 'github-actions[bot]' &&
-                review.state == 'CHANGES_REQUESTED'
+                review.user.login == 'github-actions[bot]'
               ).map(async (review) => {
-                await github.rest.pulls.dismissReview({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: context.payload.pull_request.number,
-                  review_id: review.id,
-                  message: 'All cherry-picks are good now, thank you!'
-                })
+                if (review.state == 'CHANGES_REQUESTED') {
+                  await github.rest.pulls.dismissReview({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: context.payload.pull_request.number,
+                    review_id: review.id,
+                    message: 'All cherry-picks are good now, thank you!'
+                  })
+                }
                 await github.graphql(`mutation($node_id:ID!) {
                   minimizeComment(input: {
                     classifier: RESOLVED,
diff --git a/.github/workflows/check-format.yml b/.github/workflows/check-format.yml
index 0d2ed9d0b967..616d8e574592 100644
--- a/.github/workflows/check-format.yml
+++ b/.github/workflows/check-format.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
index fc90a449fb34..03649bfd934d 100644
--- a/.github/workflows/check-shell.yml
+++ b/.github/workflows/check-shell.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 5c6b0b8da4c6..a857b1542263 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -45,7 +45,6 @@ jobs:
   check:
     name: Check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -56,7 +55,7 @@ jobs:
           merged-as-untrusted: true
           target-as-trusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -68,7 +67,7 @@ jobs:
         run: nix-build trusted/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_RO_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -91,9 +90,8 @@ jobs:
   request:
     name: Request
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
       # This is intentional, because we need to request the review of owners as declared in the base branch.
@@ -101,8 +99,11 @@ jobs:
         with:
           path: trusted
 
+      - name: Build review request package
+        run: nix-build trusted/ci -A requestReviews
+
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,9 +112,6 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
-      - name: Build review request package
-        run: nix-build trusted/ci -A requestReviews
-
       - name: Request reviews
         if: steps.app-token.outputs.token
         env:
diff --git a/.github/workflows/eval-aliases.yml b/.github/workflows/eval-aliases.yml
index 2d0a156a8cdf..451656a103ab 100644
--- a/.github/workflows/eval-aliases.yml
+++ b/.github/workflows/eval-aliases.yml
@@ -26,7 +26,7 @@ jobs:
           merged-as-untrusted: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 40a60bbfe025..bb99c0dfbc68 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     paths:
       - .github/workflows/eval.yml
-      - .github/workflows/reviews.yml # needs eval results from the same event type
+      - .github/workflows/reviewers.yml # needs eval results from the same event type
   pull_request_target:
   push:
     # Keep this synced with ci/request-reviews/dev-branches.txt
@@ -68,7 +68,7 @@ jobs:
           path: untrusted
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -180,7 +180,7 @@ jobs:
           path: trusted
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/lib-tests.yml b/.github/workflows/lib-tests.yml
index f11dca13581d..710356d8b771 100644
--- a/.github/workflows/lib-tests.yml
+++ b/.github/workflows/lib-tests.yml
@@ -28,7 +28,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml
index e76251838665..6d0b050fb3f8 100644
--- a/.github/workflows/manual-nixos-v2.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -45,7 +45,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml
index d685cc8994d8..7fa628959c64 100644
--- a/.github/workflows/manual-nixpkgs-v2.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/nix-parse-v2.yml b/.github/workflows/nix-parse-v2.yml
index fa3ae5c2ac1a..201a9c8b48ca 100644
--- a/.github/workflows/nix-parse-v2.yml
+++ b/.github/workflows/nix-parse-v2.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=channel:nixpkgs-unstable
diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml
index bc99e7333520..e8694cc68979 100644
--- a/.github/workflows/nixpkgs-vet.yml
+++ b/.github/workflows/nixpkgs-vet.yml
@@ -36,7 +36,7 @@ jobs:
           merged-as-untrusted: true
           target-as-trusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - name: Running nixpkgs-vet
         env:
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 884cd2b266a6..bf205a8b3890 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -34,7 +34,7 @@ jobs:
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
@@ -44,7 +44,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
diff --git a/ci/nixpkgs-vet.nix b/ci/nixpkgs-vet.nix
index 1ceec363c347..ccc5ba289dcf 100644
--- a/ci/nixpkgs-vet.nix
+++ b/ci/nixpkgs-vet.nix
@@ -25,6 +25,8 @@ runCommand "nixpkgs-vet"
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
+    export NIX_STATE_DIR=$(mktemp -d)
+
     nixpkgs-vet --base ${filtered base} ${filtered head}
 
     touch $out
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 0e0d44114971..7da9580e2045 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -161,6 +161,27 @@ completely incompatible with packages from `haskellPackages`.
 
 <!-- TODO(@maralorn) Link to package set generation docs in the contributors guide below. -->
 
+### GHC Deprecation Policy {#ghc-deprecation-policy}
+
+We remove GHC versions according to the following policy:
+
+#### Major GHC versions {#major-ghc-deprecation}
+
+We keep the following GHC major versions:
+1. The current Stackage LTS as the default and all later major versions.
+2. The two latest major versions older than our default.
+3. The currently recommended GHCup version and all later major versions.
+
+Older GHC versions might be kept longer, if there are in-tree consumers. We will coordinate with the maintainers of those dependencies to find a way forward.
+
+#### Minor GHC versions {#minor-ghc-deprecation}
+
+Every major version has a default minor version. The default minor version will be updated as soon as viable without breakage.
+
+Older minor versions for a supported major version will only be kept, if they are the last supported version of a major Stackage LTS release.
+
+<!-- Policy introduced here: https://discourse.nixos.org/t/nixpkgs-ghc-deprecation-policy-user-feedback-necessary/64153 -->
+
 ## `haskellPackages.mkDerivation` {#haskell-mkderivation}
 
 Every haskell package set has its own haskell-aware `mkDerivation` which is used
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 5078de14d80f..39a24856cd31 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -605,8 +605,8 @@ In some projects, the Rust crate is not in the main Python source
 directory.  In such cases, the `cargoRoot` attribute can be used to
 specify the crate's directory relative to `sourceRoot`. In the
 following example, the crate is in `src/rust`, as specified in the
-`cargoRoot` attribute. Note that we also need to specify the correct
-path for `fetchCargoVendor`.
+`cargoRoot` attribute. Note that we also need to pass in `cargoRoot`
+to `fetchCargoVendor`.
 
 ```nix
 {
@@ -627,8 +627,12 @@ buildPythonPackage rec {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-ctUt8maCjnGddKPf+Ii++wKsAXA1h+JM6zKQNXXwJqQ=";
   };
 
diff --git a/doc/redirects.json b/doc/redirects.json
index fecc092080bb..933cc8e085f7 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -40,9 +40,18 @@
   "ex-testEqualArrayOrMap-test-function-add-cowbell": [
     "index.html#ex-testEqualArrayOrMap-test-function-add-cowbell"
   ],
+  "ghc-deprecation-policy": [
+    "index.html#ghc-deprecation-policy"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
+  "major-ghc-deprecation": [
+    "index.html#major-ghc-deprecation"
+  ],
+  "minor-ghc-deprecation": [
+    "index.html#minor-ghc-deprecation"
+  ],
   "neovim": [
     "index.html#neovim"
   ],
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index c2042cf0c77d..da60ab75b4e1 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -13,7 +13,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+- The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader
 
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 06888aecad83..88cbb9141632 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17139,6 +17139,12 @@
     githubId = 1131571;
     name = "naelstrof";
   };
+  naggie = {
+    name = "Cal Bryant";
+    email = "callan.bryant@gmail.com";
+    github = "naggie";
+    githubId = 208440;
+  };
   nagisa = {
     name = "Simonas Kazlauskas";
     email = "nixpkgs@kazlauskas.me";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 07322ea56669..448f6ee5e024 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -30,6 +30,8 @@
 
 - `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.
 
+- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/programs/nix-required-mounts.nix b/nixos/modules/programs/nix-required-mounts.nix
index 47019dafab8f..787947226e79 100644
--- a/nixos/modules/programs/nix-required-mounts.nix
+++ b/nixos/modules/programs/nix-required-mounts.nix
@@ -90,7 +90,7 @@ in
           }
         '';
         example.require-ipfs.paths = [ "/ipfs" ];
-        example.require-ipfs.onFeatures = [ "ifps" ];
+        example.require-ipfs.onFeatures = [ "ipfs" ];
       };
     extraWrapperArgs = lib.mkOption {
       type = with lib.types; listOf str;
diff --git a/nixos/modules/services/home-automation/wyoming/satellite.nix b/nixos/modules/services/home-automation/wyoming/satellite.nix
index b0064569cc32..532129dc7552 100644
--- a/nixos/modules/services/home-automation/wyoming/satellite.nix
+++ b/nixos/modules/services/home-automation/wyoming/satellite.nix
@@ -23,8 +23,8 @@ let
     ;
 
   finalPackage = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs =
-      oldAttrs.propagatedBuildInputs
+    dependencies =
+      oldAttrs.dependencies
       # for audio enhancements like auto-gain, noise suppression
       ++ cfg.package.optional-dependencies.webrtc
       # vad is currently optional, because it is broken on aarch64-linux
diff --git a/nixos/modules/services/networking/dsnet.md b/nixos/modules/services/networking/dsnet.md
new file mode 100644
index 000000000000..1d6a91024540
--- /dev/null
+++ b/nixos/modules/services/networking/dsnet.md
@@ -0,0 +1,31 @@
+# dsnet {#module-services-dsnet}
+
+dsnet is a CLI tool to manage a centralised wireguard server. It allows easy
+generation of client configuration, handling key generation, IP allocation etc.
+
+It keeps its own configuration at `/etc/dsnetconfig.json`, which is more of a
+database. It contains key material too.
+
+The way this module works is to patch this database with whatever is configured
+in the nix service instantiation. This happens automatically when required.
+
+This way it is possible to decide what to let dnset manage and what parts you
+want to keep declaratively.
+
+```
+services.dsnet = {
+  enable = true;
+  settings = {
+    ExternalHostname = "vpn.example.com";
+    Network = "10.171.90.0/24";
+    Network6 = "";
+    IP = "10.171.90.1";
+    IP6 = "";
+    DNS = "10.171.90.1";
+    Networks = [ "0.0.0.0/0" ];
+  };
+
+```
+
+
+See <https://github.com/naggie/dsnet> for more information.
diff --git a/nixos/modules/services/networking/dsnet.nix b/nixos/modules/services/networking/dsnet.nix
new file mode 100644
index 000000000000..131f1b0adb40
--- /dev/null
+++ b/nixos/modules/services/networking/dsnet.nix
@@ -0,0 +1,184 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.dsnet;
+  settingsFormat = pkgs.formats.json { };
+  patchFile = settingsFormat.generate "dsnet-patch.json" cfg.settings;
+in
+{
+  options.services.dsnet = {
+    enable = lib.mkEnableOption "dsnet, a centralised Wireguard VPN manager";
+
+    package = lib.mkPackageOption pkgs "dsnet" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+
+        freeformType = settingsFormat.type;
+
+        options = {
+          ExternalHostname = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "vpn.example.com";
+            description = ''
+              The hostname that clients should use to connect to this server.
+              This is used to generate the client configuration files.
+
+              This is preferred over ExternalIP, as it allows for IPv4 and
+              IPv6, as well as enabling the ability tp change IP.
+            '';
+          };
+
+          ExternalIP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "192.0.2.1";
+            description = ''
+              The external IP address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is not set.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          ExternalIP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The external IPv6 address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is
+              not set. Used in preference to ExternalIP.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          Network = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.0/24";
+            description = ''
+              The IPv4 network that the server will use to allocate IPs on the network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          Network6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1/64";
+            description = ''
+              The IPv6 network that the server will use to allocate IPs on the
+              network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          IP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.1";
+            description = ''
+              The IPv4 address that the server will use on the network.
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          IP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The IPv6 address that the server will use on the network
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          Networks = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            example = [
+              "0.0.0.0/0"
+              "192.168.0.0/24"
+            ];
+            description = ''
+              The CIDR networks that should route through this server. Clients
+              will be configured to route traffic for these networks through
+              the server peer.
+            '';
+          };
+        };
+      };
+
+      default = { };
+      description = ''
+        The settings to use for dsnet. This will be converted to a JSON
+        object that will be passed to dsnet as a patch, using the patch
+        command when the service is started. See the dsnet documentation for
+        more information on the additional options.
+
+        Note that the resulting /etc/dsnetconfg.json is more of a database
+        than it is a configuration file. It is therefore recommended that
+        system specific values are configured here, rather than the full
+        configuration including peers.
+
+        Peers may be managed via the dsnet add/remove commands, negating the
+        need to manage key material and cumbersom configuration with nix. If
+        you want peer configuration in nix, you may as well use the regular
+        wireguard module.
+      '';
+      example = {
+        ExternalHostname = "vpn.example.com";
+        ExternalIP = "127.0.0.1";
+        ExternalIP6 = "";
+        ListenPort = 51820;
+        Network = "10.3.148.0/22";
+        Network6 = "";
+        IP = "10.3.148.1";
+        IP6 = "";
+        DNS = "8.8.8.8";
+        Networks = [ "0.0.0.0/0" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.dsnet = {
+      description = "dsnet VPN Management";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test ! -f /etc/dsnetconfig.json && ${lib.getExe cfg.package} init
+        ${lib.getExe cfg.package} patch < ${patchFile}
+      '';
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} up";
+        ExecStop = "${lib.getExe cfg.package} down";
+        Type = "oneshot";
+        # consider the service to be active after process exits, so it can be
+        # reloaded
+        RemainAfterExit = true;
+      };
+
+      reload = ''
+        ${lib.getExe cfg.package} patch < ${patchFile}
+        ${lib.getExe cfg.package} sync < ${patchFile}
+      '';
+
+      # reload _instead_ of restarting on change
+      reloadIfChanged = true;
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index aa205d1f60b4..8ff4c8110638 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.murmur;
   forking = cfg.logFile != null;
@@ -14,68 +12,53 @@ let
     database=${cfg.stateDir}/murmur.sqlite
     dbDriver=QSQLITE
 
-    autobanAttempts=${toString cfg.autobanAttempts}
-    autobanTimeframe=${toString cfg.autobanTimeframe}
-    autobanTime=${toString cfg.autobanTime}
+    autobanAttempts=${lib.toString cfg.autobanAttempts}
+    autobanTimeframe=${lib.toString cfg.autobanTimeframe}
+    autobanTime=${lib.toString cfg.autobanTime}
 
-    logfile=${optionalString (cfg.logFile != null) cfg.logFile}
-    ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
+    logfile=${lib.optionalString (cfg.logFile != null) cfg.logFile}
+    ${lib.optionalString forking "pidfile=/run/murmur/murmurd.pid"}
 
     welcometext="${cfg.welcometext}"
-    port=${toString cfg.port}
+    port=${lib.toString cfg.port}
 
-    ${optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
-    ${optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
+    ${lib.optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
+    ${lib.optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
 
-    bandwidth=${toString cfg.bandwidth}
-    users=${toString cfg.users}
+    bandwidth=${lib.toString cfg.bandwidth}
+    users=${lib.toString cfg.users}
 
-    textmessagelength=${toString cfg.textMsgLength}
-    imagemessagelength=${toString cfg.imgMsgLength}
-    allowhtml=${boolToString cfg.allowHtml}
-    logdays=${toString cfg.logDays}
-    bonjour=${boolToString cfg.bonjour}
-    sendversion=${boolToString cfg.sendVersion}
+    textmessagelength=${lib.toString cfg.textMsgLength}
+    imagemessagelength=${lib.toString cfg.imgMsgLength}
+    allowhtml=${lib.boolToString cfg.allowHtml}
+    logdays=${lib.toString cfg.logDays}
+    bonjour=${lib.boolToString cfg.bonjour}
+    sendversion=${lib.boolToString cfg.sendVersion}
 
-    ${optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
-    ${optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
-    ${optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
-    ${optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
+    ${lib.optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
+    ${lib.optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
+    ${lib.optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
+    ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
 
-    certrequired=${boolToString cfg.clientCertRequired}
-    ${optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    certrequired=${lib.boolToString cfg.clientCertRequired}
+    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
 
-    ${optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
+    ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
 
     ${cfg.extraConfig}
   '';
 in
 {
-  imports = [
-    (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
-    (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
-  ];
-
   options = {
     services.murmur = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "If enabled, start the Murmur Mumble server.";
-      };
+      enable = lib.mkEnableOption "Mumble server";
 
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Open ports in the firewall for the Murmur Mumble server.
-        '';
-      };
+      openFirewall = lib.mkEnableOption "opening ports in the firewall for the Mumble server";
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing user to use to run the service.
@@ -83,8 +66,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing group to use to run the service.
@@ -92,16 +75,16 @@ in
         '';
       };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/murmur";
         description = ''
           Directory to store data for the server.
         '';
       };
 
-      autobanAttempts = mkOption {
-        type = types.int;
+      autobanAttempts = lib.mkOption {
+        type = lib.types.int;
         default = 10;
         description = ''
           Number of attempts a client is allowed to make in
@@ -110,8 +93,8 @@ in
         '';
       };
 
-      autobanTimeframe = mkOption {
-        type = types.int;
+      autobanTimeframe = lib.mkOption {
+        type = lib.types.int;
         default = 120;
         description = ''
           Timeframe in which a client can connect without being banned
@@ -119,47 +102,47 @@ in
         '';
       };
 
-      autobanTime = mkOption {
-        type = types.int;
+      autobanTime = lib.mkOption {
+        type = lib.types.int;
         default = 300;
         description = "The amount of time an IP ban lasts (in seconds).";
       };
 
-      logFile = mkOption {
-        type = types.nullOr types.path;
+      logFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/log/murmur/murmurd.log";
         description = "Path to the log file for Murmur daemon. Empty means log to journald.";
       };
 
-      welcometext = mkOption {
-        type = types.str;
+      welcometext = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Welcome message for connected clients.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 64738;
         description = "Ports to bind to (UDP and TCP).";
       };
 
-      hostName = mkOption {
-        type = types.str;
+      hostName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Host to bind to. Defaults binding on all addresses.";
       };
 
-      package = mkPackageOption pkgs "murmur" { };
+      package = lib.mkPackageOption pkgs "murmur" { };
 
-      password = mkOption {
-        type = types.str;
+      password = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Required password to join server, if specified.";
       };
 
-      bandwidth = mkOption {
-        type = types.int;
+      bandwidth = lib.mkOption {
+        type = lib.types.int;
         default = 72000;
         description = ''
           Maximum bandwidth (in bits per second) that clients may send
@@ -167,26 +150,26 @@ in
         '';
       };
 
-      users = mkOption {
-        type = types.int;
+      users = lib.mkOption {
+        type = lib.types.int;
         default = 100;
         description = "Maximum number of concurrent clients allowed.";
       };
 
-      textMsgLength = mkOption {
-        type = types.int;
+      textMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 5000;
         description = "Max length of text messages. Set 0 for no limit.";
       };
 
-      imgMsgLength = mkOption {
-        type = types.int;
+      imgMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 131072;
         description = "Max length of image messages. Set 0 for no limit.";
       };
 
-      allowHtml = mkOption {
-        type = types.bool;
+      allowHtml = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Allow HTML in client messages, comments, and channel
@@ -194,8 +177,8 @@ in
         '';
       };
 
-      logDays = mkOption {
-        type = types.int;
+      logDays = lib.mkOption {
+        type = lib.types.int;
         default = 31;
         description = ''
           How long to store RPC logs for in the database. Set 0 to
@@ -203,23 +186,16 @@ in
         '';
       };
 
-      bonjour = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable Bonjour auto-discovery, which allows clients over
-          your LAN to automatically discover Murmur servers.
-        '';
-      };
+      bonjour = lib.mkEnableOption "Bonjour auto-discovery, which allows clients over your LAN to automatically discover Mumble servers";
 
-      sendVersion = mkOption {
-        type = types.bool;
+      sendVersion = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Send Murmur version in UDP response.";
       };
 
-      registerName = mkOption {
-        type = types.str;
+      registerName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registration name, and also the name of the
@@ -228,8 +204,8 @@ in
         '';
       };
 
-      registerPassword = mkOption {
-        type = types.str;
+      registerPassword = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registry password, used authenticate your
@@ -238,14 +214,14 @@ in
         '';
       };
 
-      registerUrl = mkOption {
-        type = types.str;
+      registerUrl = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "URL website for your server.";
       };
 
-      registerHostname = mkOption {
-        type = types.str;
+      registerHostname = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           DNS hostname where your server can be reached. This is only
@@ -255,40 +231,36 @@ in
         '';
       };
 
-      clientCertRequired = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Require clients to authenticate via certificates.";
-      };
+      clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
 
-      sslCert = mkOption {
-        type = types.str;
+      sslCert = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL certificate.";
       };
 
-      sslKey = mkOption {
-        type = types.str;
+      sslKey = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL key.";
       };
 
-      sslCa = mkOption {
-        type = types.str;
+      sslCa = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL CA certificate.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Extra configuration to put into murmur.ini.";
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        example = literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
+        example = lib.literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
         description = ''
           Environment file as defined in {manpage}`systemd.exec(5)`.
 
@@ -311,8 +283,8 @@ in
         '';
       };
 
-      dbus = mkOption {
-        type = types.enum [
+      dbus = lib.mkOption {
+        type = lib.types.enum [
           null
           "session"
           "system"
@@ -323,19 +295,19 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    users.users.murmur = mkIf (cfg.user == "murmur") {
+  config = lib.mkIf cfg.enable {
+    users.users.murmur = lib.mkIf (cfg.user == "murmur") {
       description = "Murmur Service user";
       home = cfg.stateDir;
       createHome = true;
       uid = config.ids.uids.murmur;
       group = cfg.group;
     };
-    users.groups.murmur = mkIf (cfg.group == "murmur") {
+    users.groups.murmur = lib.mkIf (cfg.group == "murmur") {
       gid = config.ids.gids.murmur;
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
       allowedUDPPorts = [ cfg.port ];
     };
@@ -353,8 +325,8 @@ in
       serviceConfig = {
         # murmurd doesn't fork when logging to the console.
         Type = if forking then "forking" else "simple";
-        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
         Restart = "always";
         RuntimeDirectory = "murmur";
@@ -390,7 +362,7 @@ in
 
     # currently not included in upstream package, addition requested at
     # https://github.com/mumble-voip/mumble/issues/6078
-    services.dbus.packages = mkIf (cfg.dbus == "system") [
+    services.dbus.packages = lib.mkIf (cfg.dbus == "system") [
       (pkgs.writeTextFile {
         name = "murmur-dbus-policy";
         text = ''
@@ -432,19 +404,19 @@ in
           r /run/murmur/murmurd.ini,
           r ${configFile},
       ''
-      + optionalString (cfg.logFile != null) ''
+      + lib.optionalString (cfg.logFile != null) ''
         rw ${cfg.logFile},
       ''
-      + optionalString (cfg.sslCert != "") ''
+      + lib.optionalString (cfg.sslCert != "") ''
         r ${cfg.sslCert},
       ''
-      + optionalString (cfg.sslKey != "") ''
+      + lib.optionalString (cfg.sslKey != "") ''
         r ${cfg.sslKey},
       ''
-      + optionalString (cfg.sslCa != "") ''
+      + lib.optionalString (cfg.sslCa != "") ''
         r ${cfg.sslCa},
       ''
-      + optionalString (cfg.dbus != null) ''
+      + lib.optionalString (cfg.dbus != null) ''
         dbus bus=${cfg.dbus}
       ''
       + ''
diff --git a/nixos/modules/services/web-apps/lasuite-docs.nix b/nixos/modules/services/web-apps/lasuite-docs.nix
index eb1c44c2e87b..ee9042037a1b 100644
--- a/nixos/modules/services/web-apps/lasuite-docs.nix
+++ b/nixos/modules/services/web-apps/lasuite-docs.nix
@@ -9,6 +9,7 @@ let
   inherit (lib)
     getExe
     mapAttrs
+    match
     mkEnableOption
     mkIf
     mkPackageOption
@@ -32,6 +33,8 @@ let
       toString value
   ) cfg.settings;
 
+  proxySuffix = if match "unix:.*" cfg.bind != null then ":" else "";
+
   commonServiceConfig = {
     RuntimeDirectory = "lasuite-docs";
     StateDirectory = "lasuite-docs";
@@ -264,7 +267,7 @@ in
             type = types.str;
             default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
             defaultText = lib.literalExpression ''
-              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+              if cfg.enableNginx then "localhost,127.0.0.1,''${cfg.domain}" else ""
             '';
             description = "Comma-separated list of hosts that are able to connect to the server";
           };
@@ -348,8 +351,6 @@ in
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-docs/static
-
         if [ ! -f .version ]; then
           touch .version
         fi
@@ -371,6 +372,8 @@ in
       environment = pythonEnvironment;
 
       serviceConfig = {
+        BindReadOnlyPaths = "${cfg.backendPackage}/share/static:/var/lib/lasuite-docs/static";
+
         ExecStart = utils.escapeSystemdExecArgs (
           [
             (lib.getExe' cfg.backendPackage "gunicorn")
@@ -476,10 +479,9 @@ in
         };
 
         locations."/media-auth" = {
-          proxyPass = "http://${cfg.bind}";
+          proxyPass = "http://${cfg.bind}${proxySuffix}/api/v1.0/documents/media-auth/";
           recommendedProxySettings = true;
           extraConfig = ''
-            rewrite $/(.*)^ /api/v1.0/documents/$1 break;
             proxy_set_header X-Original-URL $request_uri;
             proxy_pass_request_body off;
             proxy_set_header Content-Length "";
@@ -489,7 +491,6 @@ in
 
         locations."/media/" = {
           proxyPass = cfg.s3Url;
-          recommendedProxySettings = true;
           extraConfig = ''
             auth_request /media-auth;
             auth_request_set $authHeader $upstream_http_authorization;
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index dfe7f169def1..baef07aec993 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -82,7 +82,7 @@ in
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc mb minio/test-bucket")
     machine.succeed("${minioPythonScript}")
@@ -101,7 +101,7 @@ in
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc --insecure mb minio/test-bucket")
     machine.succeed("${minioPythonScript} tls")
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index b76cf183d92e..19b4fd806bb7 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.23-unstable-2025-05-30";
+  version = "0.0.23-unstable-2025-06-02";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "22418bff8bcac4377ebf975cd48f716823867979";
-    hash = "sha256-qyeiDDjeReOr+TvgCWnKhb8FBN9t1YPFGvVqPvxXr0k=";
+    rev = "647a459a2b87e5c9b2987cb44150b71beffdfb10";
+    hash = "sha256-GgLOcVp2IuMBr4aBRWJTvrAuWWiMEIHmec/S97piBaM=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
index d29421a04fc5..1fcb457e08c3 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
@@ -6,13 +6,13 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "sonarlint.nvim";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-05-30";
 
   src = fetchFromGitLab {
     owner = "schrieveslaach";
     repo = "sonarlint.nvim";
-    rev = "2aa7a9fd9d8022d1c8d472fb63ce62e021d70130";
-    hash = "sha256-RfQthodqF6r24I6EJxlewjYiX3jLAIb/RMAOVnWs73s=";
+    rev = "060df51352f9fb876d4ff43b8cd4b669a6bdfd89";
+    hash = "sha256-2MAi0nZIvAly+5p5fWKMi3tGSzMJgMnAzWnsr0rt+NM=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ad498faa43b4..e2f270939fcf 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2792,8 +2792,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.140.2";
-          hash = "sha256-YQwJq3QSzb2pAOLyy0w8RtrjAlxudBGN52fQtj+OmOk=";
+          version = "1.141.2";
+          hash = "sha256-i5mY037rs65BKiQLvUbu9Lup2ljhZI0owqjZ0AUsXMw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4703,8 +4703,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.283.0";
-          hash = "sha256-zn58iml+uN6K1qneLqnikaL5Gyk4rmNXo8TKKlO88jA=";
+          version = "3.287.0";
+          hash = "sha256-E4ew40NNuOW9e7ZIsJjkO/4r6gbbC2IsghFbO+n27cg=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 639719d8d32d..d943e0efccab 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -77,7 +77,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "3.0.2";
+  version = "3.0.4";
 
   outputs = [
     "out"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
+    hash = "sha256-jKouwnW/CTJldWVKwnavwIP4SR58ykXRnPKeaWrsqyU=";
   };
 
   patches = [
@@ -242,9 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    patchShebangs \
-      app/tests/create_test_env.sh \
-      tools/gimp-mkenums
+    patchShebangs tools/gimp-mkenums
 
     # GIMP is executed at build time so we need to fix this.
     # TODO: Look into if we can fix the interp thing.
diff --git a/pkgs/applications/misc/openbangla-keyboard/default.nix b/pkgs/applications/misc/openbangla-keyboard/default.nix
index a059a14df05a..b2239c5d38a8 100644
--- a/pkgs/applications/misc/openbangla-keyboard/default.nix
+++ b/pkgs/applications/misc/openbangla-keyboard/default.nix
@@ -62,11 +62,7 @@ stdenv.mkDerivation rec {
     ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit src cargoRoot postPatch;
     hash = "sha256-qZMTZi7eqEp5kSmVx7qdS7eDKOzSv9fMjWT0h/MGyeY=";
   };
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index f499bdc271af..5a20483448ed 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "137.0.7151.55",
+    "version": "137.0.7151.68",
     "chromedriver": {
-      "version": "137.0.7151.56",
-      "hash_darwin": "sha256-z4GTPrONaXARP0d8vInJdFxR052PuuI6IJy1PEv2RNg=",
-      "hash_darwin_aarch64": "sha256-wlSDfCiBTdLWwabpHwOiM8Y3asn7ueHGSMh2AANaE+A="
+      "version": "137.0.7151.69",
+      "hash_darwin": "sha256-G88jte6xraXrrfEvCj7zndpQ7nxyzappuu4oZ79XY8U=",
+      "hash_darwin_aarch64": "sha256-wbOD/sVjLVcpPzrbAGu8b8YMbUOKkOt7eNxJDLKRjxo="
     },
     "deps": {
       "depot_tools": {
@@ -20,8 +20,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
-        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
+        "rev": "2989ffee9373ea8b8623bd98b3cb350a8e95cadc",
+        "hash": "sha256-lPmmXVCNUa9of8d52hUejImPSEfOz7v7PlovZS4cfIE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -241,8 +241,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
-        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
+        "rev": "fdc8ca697612f90e7ddf2621dffbc43733d2d238",
+        "hash": "sha256-jKYldgZJwJeTQavmcM9enTdGN8+zt/EG7K1E9wQYIBA="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -791,8 +791,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
-        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
+        "rev": "e398f9bf6d5c8a768ab736f46146d7349cf31547",
+        "hash": "sha256-cJx8IgUB3UA3jEPvb5aDvHLYmAnHydK1qR11q6Y5PnA="
       }
     }
   },
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 0f38468968ec..ae415610983a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -126,13 +126,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-gBVJx6rk7rjrvyLaDJrHUmLRUbvgy60c/uQwsFXuQzA=",
+    "hash": "sha256-asrIQrhSSHjuOBFomgq9lbHc8rmkcy3OjJ5ig9I7XbU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.98.0",
+    "rev": "v5.99.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OxyOD/um7hOpYpsZCyNnbdvo5K/r/L7JlWvXQBncIDw="
+    "vendorHash": "sha256-low0aq3i3pmqbadYg1VZra+ZzoV6nqyGutf8xzaces0="
   },
   "azuread": {
     "hash": "sha256-lNjU/206yS+smSe1SYlz0TOqHRlvSQKqhJ67fswNlIQ=",
@@ -216,11 +216,11 @@
     "vendorHash": "sha256-arLGaa/o9X0MYg/qIl6qhpBqcduu5Bu06FteR5KGSPw="
   },
   "buildkite": {
-    "hash": "sha256-+9gxJjLVExnpWtcF1NRQoKPg0jn1zGNSkmim5YFgs4w=",
+    "hash": "sha256-u2BkD6h12drlz6MQIjoi/EFSj7l1dBWBjHVSmL+hB4g=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.18.0",
+    "rev": "v1.19.0",
     "spdx": "MIT",
     "vendorHash": "sha256-bhPpFPn1hdpSJYTvO1HWTrFRBvcm8gIDmMEGOaFjM6c="
   },
@@ -390,13 +390,13 @@
     "vendorHash": "sha256-xu5t7VaLvbwo/Q7Xb4mkNt7UjU+hzfk7NgfFlxwbIhU="
   },
   "dnsimple": {
-    "hash": "sha256-CkfgHBNtYCFZIMoXpX0ivkm1dyIs4mKSrHaiQ3qt/+w=",
+    "hash": "sha256-7o8shnWECaCLTCvmXrJ2eYloxtln2A2No8OK8Ig36qE=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v1.9.0",
+    "rev": "v1.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WZqwBkVXoFmDikIyt9GWszLA/9YBoQHAdBuWbGKZBZw="
+    "vendorHash": "sha256-0axKIqF1t4AW1PPi+fHfsFQLRrjhpsloQIZ9clR+8Gc="
   },
   "docker": {
     "hash": "sha256-sPeX1bupACBSmt8ppyxQKyD+FXIPdCBWn8cnOAvNHwQ=",
@@ -516,13 +516,13 @@
     "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
   },
   "google": {
-    "hash": "sha256-q/BFHpA3ig0QfB0mhJGqr/uQYs/SH5YX8QgWCyjcSio=",
+    "hash": "sha256-TSDkXXYkneTsY10WV5cSFzOX04kFdFVHJPgpKt5hBSE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.36.1",
+    "rev": "v6.37.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rGpnPH8ebHXasvelGoJEUU4YbeGJY4adFBbgAHJ8vSs="
+    "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
   },
   "google-beta": {
     "hash": "sha256-VpfIfzIG1h5qnvEqogCK359LLLSgdgxg0DtRGvdZtLU=",
@@ -840,13 +840,13 @@
     "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
   },
   "mongodbatlas": {
-    "hash": "sha256-JQW9y1EfrEInmz2+Er8BE0+6ZdcrO/w1y+czg7jPeRE=",
+    "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.34.0",
+    "rev": "v1.35.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y9dhiG0zyOcvjgygLEW2o+GPXUug0ibxC2aLvfcY260="
+    "vendorHash": "sha256-fz6e/QEcWQY7ZrWyUbk8M/+RPB8dwN3NHPLmNLyGVhQ="
   },
   "namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@@ -1084,11 +1084,11 @@
     "vendorHash": "sha256-j+3qtGlueKZgf0LuNps4Wc9G3EmpSgl8ZNSLqslyizI="
   },
   "rancher2": {
-    "hash": "sha256-H6ZdGvKSYRlDsCKIHlPHdEv1+6aa1rll/73IeJ+PDhc=",
+    "hash": "sha256-5NkvGETjJ5eoZC5Ohnoq2y1DQVs2WTrh/wEVO1HQsOA=",
     "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
     "owner": "rancher",
     "repo": "terraform-provider-rancher2",
-    "rev": "v7.0.0",
+    "rev": "v7.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
   },
@@ -1111,11 +1111,11 @@
     "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
   },
   "rootly": {
-    "hash": "sha256-SwZm4XCQUf3TQ6m77fAnhHMoW6ckpO5XSnjpEYuNyec=",
+    "hash": "sha256-2TVqXQYiCMsMQJtZMWtYiPbeOOsPck5Hpu6cmo9ZaIM=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v2.27.1",
+    "rev": "v2.27.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
   },
@@ -1327,22 +1327,22 @@
     "vendorHash": "sha256-HBdvXWZNPPAqPEKodwG0ZeiJOhfJHe9HRCcuozKpwVs="
   },
   "tencentcloud": {
-    "hash": "sha256-CHYuiAgzFIAApK8wZ75DtgVf8sAEVwrXP7l/l+VxB1o=",
+    "hash": "sha256-JMLuH/NDCNiByLh65NQH/goaN7/J7MGfsUNKfHJ3LFQ=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.194",
+    "rev": "v1.81.197",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-hMpCuLAnwwAb8ugKxKDuFvtII2k/lcwYYL0sCvZewOY=",
+    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.65.2",
+    "rev": "v0.66.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PSUob2u8hue5ii+kV4bGcvexkIQxzWsHbbEbYO0celU="
+    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
   },
   "thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
diff --git a/pkgs/applications/networking/cluster/timoni/default.nix b/pkgs/applications/networking/cluster/timoni/default.nix
index 75977b38cdaa..a9c2f1dd153b 100644
--- a/pkgs/applications/networking/cluster/timoni/default.nix
+++ b/pkgs/applications/networking/cluster/timoni/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "timoni";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "stefanprodan";
     repo = "timoni";
     rev = "v${version}";
-    hash = "sha256-nI0yy/zhsJUvisHo+C+/uNRF96ZQ1Ve8VWpE8ZvUeJc=";
+    hash = "sha256-Obx8I8n2UY6sTHKQ0qFNQ50XI+ajrbQtjQ7PCVwrSTI=";
   };
 
-  vendorHash = "sha256-YpwESaR+X2eOyaPdR+I3mURD7yvwzmpPmgPoSPrXjH8=";
+  vendorHash = "sha256-hCvFe27DdX/pAeyfSEDx5oiLEZjhldOVDz6ElsUPjJs=";
 
   subPackages = [ "cmd/timoni" ];
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/science/electronics/librepcb/default.nix b/pkgs/applications/science/electronics/librepcb/default.nix
index 6a706e5a81c4..34b430b07e10 100644
--- a/pkgs/applications/science/electronics/librepcb/default.nix
+++ b/pkgs/applications/science/electronics/librepcb/default.nix
@@ -42,8 +42,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ qtbase ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    sourceRoot = "source/${cargoRoot}";
+    inherit src cargoRoot;
     hash = "sha256-1td3WjxbDq2lX7c0trpYRhO82ChNAG/ZABBRsekYtq4=";
   };
 
diff --git a/pkgs/applications/video/obs-studio/plugins/default.nix b/pkgs/applications/video/obs-studio/plugins/default.nix
index 4da72ab45f92..07e02c9c45d4 100644
--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@@ -22,6 +22,8 @@
 
   obs-advanced-masks = callPackage ./obs-advanced-masks.nix { };
 
+  obs-aitum-multistream = qt6Packages.callPackage ./obs-aitum-multistream.nix { };
+
   obs-backgroundremoval = callPackage ./obs-backgroundremoval { };
 
   obs-color-monitor = qt6Packages.callPackage ./obs-color-monitor.nix { };
@@ -30,6 +32,8 @@
 
   obs-composite-blur = callPackage ./obs-composite-blur.nix { };
 
+  obs-dir-watch-media = callPackage ./obs-dir-watch-media.nix { };
+
   obs-dvd-screensaver = callPackage ./obs-dvd-screensaver.nix { };
 
   obs-freeze-filter = qt6Packages.callPackage ./obs-freeze-filter.nix { };
@@ -42,6 +46,8 @@
 
   obs-livesplit-one = callPackage ./obs-livesplit-one { };
 
+  obs-markdown = callPackage ./obs-markdown.nix { };
+
   obs-media-controls = qt6Packages.callPackage ./obs-media-controls.nix { };
 
   obs-move-transition = callPackage ./obs-move-transition.nix { };
@@ -62,6 +68,8 @@
 
   obs-replay-source = qt6Packages.callPackage ./obs-replay-source.nix { };
 
+  obs-retro-effects = callPackage ./obs-retro-effects.nix { };
+
   obs-rgb-levels = callPackage ./obs-rgb-levels.nix { };
 
   obs-scale-to-sound = callPackage ./obs-scale-to-sound.nix { };
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-aitum-multistream.nix b/pkgs/applications/video/obs-studio/plugins/obs-aitum-multistream.nix
new file mode 100644
index 000000000000..c97b47e98266
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-aitum-multistream.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  obs-studio,
+  qtbase,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-aitum-multistream";
+  version = "1.0.7";
+
+  src = fetchFromGitHub {
+    owner = "Aitum";
+    repo = "obs-aitum-multistream";
+    tag = version;
+    hash = "sha256-TqddyTBRWLyfwYi9I0nQE8Z19YL2RwkZqUwi7F9XpwQ=";
+  };
+
+  # Fix FTBFS with Qt >= 6.8
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_qt(COMPONENTS Widgets Core)' 'find_package(Qt6 REQUIRED COMPONENTS Core Widgets)'
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    curl
+    obs-studio
+    qtbase
+  ];
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    # Prevent deprecation warnings from failing the build
+    (lib.cmakeOptionType "string" "CMAKE_CXX_FLAGS" "-Wno-error=deprecated-declarations")
+  ];
+
+  meta = {
+    description = "Plugin to stream everywhere from a single instance of OBS";
+    homepage = "https://github.com/Aitum/obs-aitum-multistream";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-dir-watch-media.nix b/pkgs/applications/video/obs-studio/plugins/obs-dir-watch-media.nix
new file mode 100644
index 000000000000..2ef998788b40
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-dir-watch-media.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-dir-watch-media";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-dir-watch-media";
+    rev = version;
+    sha256 = "sha256-zvg8Bu5wlcQe91ggteEj7G9Kx+mY1R6EN64T13vp7pc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio adding a filter that can watch a directory for media files";
+    homepage = "https://github.com/exeldro/obs-dir-watch-media";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-markdown.nix b/pkgs/applications/video/obs-studio/plugins/obs-markdown.nix
new file mode 100644
index 000000000000..c837952e6c2d
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-markdown.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-markdown";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-markdown";
+    rev = version;
+    sha256 = "sha256-5ajX/cEa0n12Putx1k3ctl1v9wRzJRhyJNDlmjSMbeU=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio to add Markdown sources";
+    homepage = "https://github.com/exeldro/obs-markdown";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix b/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix
new file mode 100644
index 000000000000..3b9c2aadbdbd
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-retro-effects";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-retro-effects";
+    rev = "${version}";
+    sha256 = "sha256-+dg5ySleMb9abT9kIM7HvRSRx9V08B9XPjfoAVe+tWY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postFixup = ''
+    mv $out/data/obs-plugins/${pname}/shaders $out/share/obs/obs-plugins/${pname}/
+    rm -rf $out/obs-plugins
+    rm -rf $out/data
+  '';
+
+  meta = with lib; {
+    description = "A collection of OBS filters to give your stream that retro feel.";
+    homepage = "https://github.com/FiniteSingularity/obs-retro-effects";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
index ce733347cfa0..fd6aebc335f7 100644
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -90,9 +90,11 @@
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     fetchTags = true;
     leaveDotGit = true;
-    sha256 = "sha256-2vfZnYjZlnC8ODz6B6aOqAqtb1Wbjojnn/5TmzwUrmo=";
+    sha256 = "sha256-y7l+46lVP2pzJwGON5qEV0EoxWofRoWAym5q9VXvpc8=";
     postFetch = ''
       cd $out && git describe --tags --always > describe-output.txt 2>&1 || echo "git describe failed" > describe-output.txt
+      # See https://github.com/NixOS/nixpkgs/issues/412967#issuecomment-2927452118
+      rm -rf .git
     '';
   };
 }
diff --git a/pkgs/by-name/ac/act/package.nix b/pkgs/by-name/ac/act/package.nix
index 121ad3a60415..2e181bf370f6 100644
--- a/pkgs/by-name/ac/act/package.nix
+++ b/pkgs/by-name/ac/act/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.2.77";
+  version = "0.2.78";
 in
 buildGoModule {
   pname = "act";
@@ -18,7 +18,7 @@ buildGoModule {
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-bcqHj40lySE2xXGuUbXbH5cjQ5NoJCvjE/uX8HaKVho=";
+    hash = "sha256-S4Ev7MszuvlsUstnjOltYnZTuhzeqP/GDqMEWsFLe5Y=";
   };
 
   vendorHash = "sha256-YH5SIZ73VYqg7+sSJpvqkIlBUy1rs3uNEWiEBDRdkQw=";
diff --git a/pkgs/by-name/al/alertmanager-ntfy/package.nix b/pkgs/by-name/al/alertmanager-ntfy/package.nix
index be0d1e4a35a9..c3e2db5b5345 100644
--- a/pkgs/by-name/al/alertmanager-ntfy/package.nix
+++ b/pkgs/by-name/al/alertmanager-ntfy/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule {
   pname = "alertmanager-ntfy";
-  version = "0-unstable-2025-05-04";
+  version = "0-unstable-2025-05-31";
 
   src = fetchFromGitHub {
     owner = "alexbakker";
     repo = "alertmanager-ntfy";
-    rev = "f05e3c029bab3bdfb9aefbddbfc6bd9c7d4aa80f";
-    hash = "sha256-rKCJnffsBEXmTg2s0nqQf8BuHQnSgcwVBhC7gRzg4ew=";
+    rev = "76d5f772f70d6915c89da00414c20009b03cc361";
+    hash = "sha256-newJ1fCMEE3gsZncWU899Q6cS6llPNwJlHT7HdLQZf8=";
   };
 
   vendorHash = "sha256-e1JAoDNm2+xB/bZcEGr5l4+va8GIg1R8pdj3d+/Y+UY=";
diff --git a/pkgs/applications/video/animdl/default.nix b/pkgs/by-name/an/animdl/package.nix
similarity index 79%
rename from pkgs/applications/video/animdl/default.nix
rename to pkgs/by-name/an/animdl/package.nix
index 3c0fe37dd062..28a2ecab20fd 100644
--- a/pkgs/applications/video/animdl/default.nix
+++ b/pkgs/by-name/an/animdl/package.nix
@@ -1,27 +1,12 @@
 {
   lib,
-  buildPythonApplication,
   fetchFromGitHub,
-  poetry-core,
-  anchor-kr,
-  anitopy,
-  click,
-  cssselect,
-  httpx,
-  lxml,
-  packaging,
-  pkginfo,
-  pycryptodomex,
-  pyyaml,
-  regex,
-  rich,
-  tqdm,
-  yarl,
+  python3Packages,
 }:
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "animdl";
   version = "1.7.27";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "justfoolingaround";
@@ -34,7 +19,9 @@ buildPythonApplication {
   pythonRemoveDeps = [
     "comtypes" # windows only
   ];
+
   pythonRelaxDeps = [
+    "cssselect"
     "httpx"
     "lxml"
     "packaging"
@@ -45,10 +32,11 @@ buildPythonApplication {
     "yarl"
   ];
 
-  nativeBuildInputs = [
+  build-system = with python3Packages; [
     poetry-core
   ];
-  propagatedBuildInputs = [
+
+  dependencies = with python3Packages; [
     anchor-kr
     anitopy
     click
diff --git a/pkgs/by-name/bo/bootspec/package.nix b/pkgs/by-name/bo/bootspec/package.nix
index b34ef43d0b2a..242a3450e1e0 100644
--- a/pkgs/by-name/bo/bootspec/package.nix
+++ b/pkgs/by-name/bo/bootspec/package.nix
@@ -2,32 +2,20 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "bootspec";
     rev = "v${version}";
-    hash = "sha256-5IGSMHeL0eKfl7teDejAckYQjc8aeLwfwIQSzQ8YaAg=";
+    hash = "sha256-0MO+SqG7Gjq+fmMJkIFvaKsfTmC7z3lGfi7bbBv7iBE=";
   };
 
-  patches = [
-    # https://github.com/DeterminateSystems/bootspec/pull/127
-    # Fixes the synthesize tool for aarch64-linux
-    (fetchpatch {
-      name = "aarch64-support.patch";
-      url = "https://github.com/DeterminateSystems/bootspec/commit/1d0e925f360f0199f13422fb7541225fd162fd4f.patch";
-      sha256 = "sha256-wU/jWnOqVBrU2swANdXbQfzRpNd/JIS4cxSyCvixZM0=";
-    })
-
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-65jk8UlXZgQoxuwRcGlMnI4e+LpCJuP2TaqK+Kn4GnQ=";
+  cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";
 
   meta = with lib; {
     description = "Implementation of RFC-0125's datatype and synthesis tooling";
diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix
index b3d2fea710aa..5f45e0746bad 100644
--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@@ -9,20 +9,20 @@
 }:
 
 let
-  version = "2025.4.2";
+  version = "2025.5.1";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-wtCZ3/7JvygSCka4i3Il2ajpSuuTPTwHeVJa4gGFDPw=";
+        hash = "sha256-1AXAVXselQKqKsjTRJVN3rBQpSReTH3d0ulIahp9QCc=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-+1aTq7XKacsi/gzUpeZvSuwpKPDMo6H3C81pxWCC4w8=";
+        hash = "sha256-zX5QJz996WgKvDA6p5dRtmbZTRsgCl0URn302MkhVew=";
       };
 
   src = fetchurl {
@@ -91,6 +91,8 @@ buildFHSEnv {
     cp -r ${desktopItem}/share/applications $out/share
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     inherit description;
     longDescription = ''
diff --git a/pkgs/by-name/bu/burpsuite/update.sh b/pkgs/by-name/bu/burpsuite/update.sh
new file mode 100755
index 000000000000..7d0214045c50
--- /dev/null
+++ b/pkgs/by-name/bu/burpsuite/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq xxd gnused diffutils
+set -eu -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+curl -s 'https://portswigger.net/burp/releases/data' |
+  jq -r '
+      [[
+        .ResultSet.Results[]
+        | select(
+            (.categories | sort) == (["Professional","Community"] | sort)
+            and .releaseChannels == ["Early Adopter"]
+          )
+      ][0].builds[]
+      | select(.ProductPlatform == "Jar")
+    ]' >latest.json
+
+version=$(jq -r '.[0].Version' latest.json)
+
+comm_hex=$(jq -r '.[] | select(.ProductId=="community") .Sha256Checksum' latest.json)
+pro_hex=$(jq -r '.[] | select(.ProductId=="pro") .Sha256Checksum' latest.json)
+
+comm_sri="sha256-$(printf %s "$comm_hex" | xxd -r -p | base64 -w0)"
+pro_sri="sha256-$(printf %s "$pro_hex" | xxd -r -p | base64 -w0)"
+
+sed -i \
+  -e "s|^\(\s*version = \)\"[^\"]*\";|\1\"$version\";|" \
+  -e "/productName = \"community\"/,/hash =/ {
+        s|sha256-[^\"]*|$comm_sri|
+     }" \
+  -e "/productName = \"pro\"/,/hash =/ {
+        s|sha256-[^\"]*|$pro_sri|
+     }" \
+  $SCRIPT_DIR/package.nix
+
+echo "burpsuite → $version"
+echo "  community: $comm_sri"
+echo "  pro      : $pro_sri"
diff --git a/pkgs/by-name/cc/ccextractor/package.nix b/pkgs/by-name/cc/ccextractor/package.nix
index ae94897395ff..7c8fbb886b86 100644
--- a/pkgs/by-name/cc/ccextractor/package.nix
+++ b/pkgs/by-name/cc/ccextractor/package.nix
@@ -49,10 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
   cargoRoot = "src/rust";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     patches = [ ./use-rsmpeg-0.15.patch ];
-    patchFlags = [ "-p3" ];
     hash = "sha256-7v3gQghByUDWZLJRRGa/7X2ivUumirq6BbexNQcCXCk=";
   };
 
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index e913134cfa21..938ac9acdbef 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.20";
+  version = "1.1.21";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-qL2SNVHsAH+Z0A5Vv+kBa1O9VgdR7eZ29Z19s5GuTXA=";
+    hash = "sha256-GTYgo5rx4PrWLytqdH3LrasgyEAr1FuPyI26tGRaV0A=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
diff --git a/pkgs/by-name/ch/chart-testing/package.nix b/pkgs/by-name/ch/chart-testing/package.nix
index 707e20c0c92d..976e0c9c48fa 100644
--- a/pkgs/by-name/ch/chart-testing/package.nix
+++ b/pkgs/by-name/ch/chart-testing/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule rec {
   pname = "chart-testing";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "chart-testing";
     rev = "v${version}";
-    hash = "sha256-q56ZM+YzL7RRC3RD3xO3K0hIDomKun5xmSKuiDTq1cU=";
+    hash = "sha256-59a86yR/TDAWGCsj3pbDjXJGMvyHYnjsnxzjWr61PuU=";
   };
 
-  vendorHash = "sha256-kTlqGZVOppf+WMcFw0T9FVbu9eOWAWzotR8fPPyo2Ms=";
+  vendorHash = "sha256-aVXISRthJxxvtrfC0DpewLHCiJPh4tO+SKl3Q9uP14k=";
 
   postPatch = ''
     substituteInPlace pkg/config/config.go \
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 79e99aa733d9..6600099b3e2f 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-05-14";
+  version = "0.4.0-unstable-2025-05-29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "eb4e4547b517c3d10ede760bcd31eeb448c455dc";
-    hash = "sha256-e10WFYpIy6JnPAqUcapli9Q6R0GxNwb1YjnE4cu+xfk=";
+    rev = "db838b0c1ae9b0964efcd625c415a76ff9fbea4a";
+    hash = "sha256-C8sicZ4krALpsRFbX8Ls5GZc7FUimg2Ix6WsQP2oMvw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clorinde/package.nix b/pkgs/by-name/cl/clorinde/package.nix
index 981fd2cf1b14..f56be8024eef 100644
--- a/pkgs/by-name/cl/clorinde/package.nix
+++ b/pkgs/by-name/cl/clorinde/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clorinde";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "halcyonnouveau";
     repo = "clorinde";
     tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-Ynz1pdgckQzMLuUJUGSzNRNwWZKrEZuYgrrT/BxAxzc=";
+    hash = "sha256-CrgJtgFX5RBNfFFr2ZZ0d3oKfryyLAHva7g2JyBFiB8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g3pWvoTq1DlKlIDJq79IJrvDiLR0HZRPIt4K1YUPsvM=";
+  cargoHash = "sha256-jUtkhOAosrxHGRbAdzdrgLzL5Xp2YhxcrG/dcwUhdLg=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 8c94416ecd4b..e3b8f72ee830 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.8.19";
+  version = "0.8.20";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-pLimn6OfqByOyFIDYq0VD4yQ0BpL+st5VwYBKP5zSug=";
-        aarch64-linux = "sha256-Xr3locwzuCg0LRPvNBphhleHFZOnXLi9Md8R17k4vWU=";
-        x86_64-darwin = "sha256-klwicOa/jbjsGL09HR6v2CTA+vhHd1EjCbblAmEPqWQ=";
-        aarch64-darwin = "sha256-47AbC8SHDb1hRlePF6CszHqf2gpwIxsOhJK4+PMCHbQ=";
+        x86_64-linux = "sha256-pDZmrPLIppMMj8KqNGQLUM4ue43vSwVyEKCYrN0G2LM=";
+        aarch64-linux = "sha256-GraqtexpHN+bpArA1HQDYC7DG2QHK1P7o9QDXyFEir4=";
+        x86_64-darwin = "sha256-X/Gf4OipbUM8FwAYfA1+yMBVbsZK5UYz4HFiOYYaTdA=";
+        aarch64-darwin = "sha256-jmsj1VPpxTgly0xIB5pxl79NBZe1zp9rqAYePScMe80=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index f6227f3edea0..c44c10b68fd9 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "295";
+  version = "297";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-BxyE14vXS7lGFwWsruDAcdXMRsoETFwXPQxfMpSh1+E=";
+    hash = "sha256-3dEZb7XZluTi+sUTgSqwLzCdNMJwekt1Em0XEDSAY/E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/di/distroshelf/package.nix b/pkgs/by-name/di/distroshelf/package.nix
index 154e622bd951..d83c2c58931a 100644
--- a/pkgs/by-name/di/distroshelf/package.nix
+++ b/pkgs/by-name/di/distroshelf/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "distroshelf";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "ranfdev";
     repo = "DistroShelf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4xiqdLSmO9LXfVwF/QRJL8BhZDsNistdGVVT4YDdt4A=";
+    hash = "sha256-UZP/VohgYUe6Ly89oD9WlYyiAfQmTK1lXnf5TipoiNI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
index 3fb228eabfab..17c27fd563a6 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-g41K7aTCZZc1zRoc9k1oG8rk88ZwJJH3jnnX+MKQ9mE=";
+  hash = "sha256-sn10yaYbp6VWspqEMKCd7HbDvKi35AW5Xn8FGzzN3kM=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.4.wasm";
-  version = "0.95.4";
+  url = "https://plugins.dprint.dev/typescript-0.95.5.wasm";
+  version = "0.95.5";
 }
diff --git a/pkgs/by-name/dr/dracula-theme/package.nix b/pkgs/by-name/dr/dracula-theme/package.nix
index a6daf5216f2e..c07748267027 100644
--- a/pkgs/by-name/dr/dracula-theme/package.nix
+++ b/pkgs/by-name/dr/dracula-theme/package.nix
@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-04-27";
+  version = "4.0.0-unstable-2025-05-24";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "3834a1bac175b226cff6b1c94faac9aba2819bd5";
-    hash = "sha256-T0X0h4Bz3sy5jqtB1PkpjFnB8jO3CehOxgRwPPG54Ds=";
+    rev = "74255b110e7e5f50a07f500f739bc59c2cbee472";
+    hash = "sha256-0NA/MTmcgRlR6JEOFz1+SgyoRwRygygEWAQDrpznA5w=";
   };
 
   propagatedUserEnvPkgs = [
diff --git a/pkgs/by-name/ds/dsnet/package.nix b/pkgs/by-name/ds/dsnet/package.nix
new file mode 100644
index 000000000000..07b9a7aaed98
--- /dev/null
+++ b/pkgs/by-name/ds/dsnet/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dsnet";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "naggie";
+    repo = "dsnet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CKDtILZMWFeSU5nTSguM2fi0BCFdvR2LqELIZ6LYOMk=";
+  };
+  vendorHash = "sha256-Q2Ipj9yZ+/GUBEmDvgwFLLww7EXnbvdvj/shGQnh1G8=";
+
+  subPackages = [ "cmd" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/dsnet
+  '';
+
+  # The ldflags reduce the executable size by stripping some debug stuff.
+  # The other variables are set so that the output of dsnet version shows the
+  # git ref and the release version from github.
+  # Ref <https://github.com/NixOS/nixpkgs/pull/87383#discussion_r432097657>
+  ldflags = [
+    "-w"
+    "-s"
+    "-X github.com/naggie/dsnet.VERSION=${finalAttrs.src.tag}"
+    "-X github.com/naggie/dsnet.GIT_COMMIT=${finalAttrs.src.tag}"
+  ];
+
+  meta = {
+    description = "Fast command to manage a centralised Wireguard VPN";
+    homepage = "https://github.com/naggie/dsnet";
+    changelog = "https://github.com/naggie/dsnet/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.naggie ];
+    mainProgram = "dsnet";
+  };
+
+})
diff --git a/pkgs/by-name/fl/flaresolverr/package.nix b/pkgs/by-name/fl/flaresolverr/package.nix
index 8ee30bdfc468..a3f6a17a21b8 100644
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@@ -59,11 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   installPhase = ''
-    mkdir -p $out/{bin,share/${finalAttrs.pname}-${finalAttrs.version}}
-    cp -r * $out/share/${finalAttrs.pname}-${finalAttrs.version}/.
+    mkdir -p $out/{bin,share/flaresolverr-${finalAttrs.version}}
+    cp -r * $out/share/flaresolverr-${finalAttrs.version}/.
 
     makeWrapper ${python}/bin/python $out/bin/flaresolverr \
-      --add-flags "$out/share/${finalAttrs.pname}-${finalAttrs.version}/src/flaresolverr.py" \
+      --add-flags "$out/share/flaresolverr-${finalAttrs.version}/src/flaresolverr.py" \
       --prefix PATH : "${lib.makeBinPath [ xorg.xvfb ]}"
   '';
 
diff --git a/pkgs/by-name/ge/geoclock/package.nix b/pkgs/by-name/ge/geoclock/package.nix
index d8718f34a680..b4325ed4f7b3 100644
--- a/pkgs/by-name/ge/geoclock/package.nix
+++ b/pkgs/by-name/ge/geoclock/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   cargoHash = "sha256-7mApZj3Ksy8Av0W+0+UZQCkH281bSBd4xo8/7JowmHs=";
-  cargoDepsName = finalAttrs.pname;
+  cargoDepsName = "geoclock";
 
   meta = {
     description = "Displays time as calculated by your longitude";
diff --git a/pkgs/by-name/gi/gildas/package.nix b/pkgs/by-name/gi/gildas/package.nix
index 0669b77c7881..c6ca9514111a 100644
--- a/pkgs/by-name/gi/gildas/package.nix
+++ b/pkgs/by-name/gi/gildas/package.nix
@@ -24,8 +24,8 @@ let
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "may25a";
-  version = "20250501_a";
+  srcVersion = "jun25a";
+  version = "20250601_a";
   pname = "gildas";
 
   src = fetchurl {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
     ];
-    hash = "sha256-ofcuwc4vIKLbY/2uRqWG4sdrm9N0hpqz6zYwkZyySWo=";
+    hash = "sha256-DhUGaG96bsZ1NGfDQEujtiM0AUwZBMD42uRpRWI5DX0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitleaks/package.nix b/pkgs/by-name/gi/gitleaks/package.nix
index b04e75d007c1..b286dc45285b 100644
--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.26.0";
+  version = "8.27.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = "gitleaks";
     tag = "v${version}";
-    hash = "sha256-lBIoEUjAllhUTS9PRSqdWUeBhEGs6wOHOWivj0PC9Is=";
+    hash = "sha256-62Tcj5NiEk4uaGpiallCjDzpkFbuTazfMiemEe+ATLg=";
   };
 
-  vendorHash = "sha256-MSF9N9kXsIM2WKsjKAVztYypwGPng2EElHx7p6vADqc=";
+  vendorHash = "sha256-vd39TbooEdmYa6QZGEnYOmYU9p+9mV+SrLKVY+h/PEM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gl/gleam/package.nix b/pkgs/by-name/gl/gleam/package.nix
index f5bf49d08e5f..e34a3baea82d 100644
--- a/pkgs/by-name/gl/gleam/package.nix
+++ b/pkgs/by-name/gl/gleam/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gleam";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = "gleam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0qK9dWkKnoXbIIBMN3p5noPEke/bgC8Bjtmf6lwtyr4=";
+    hash = "sha256-oxzFAqPZ+ZHd/+GwofDg0gA4NIFYWi2v8fOjMn8ixSU=";
   };
 
-  cargoHash = "sha256-EoRu8p6cUe1li54nVUkf+3qywIsDXh4ptIVLluJ3eFs=";
+  cargoHash = "sha256-9kk7w85imYIhywBuAgJS8wYAIEM3hXoHymGgMMmrgnI=";
 
   nativeBuildInputs = [
     git
@@ -53,7 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://gleam.run/";
     changelog = "https://github.com/gleam-lang/gleam/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.philtaken ];
+    maintainers = with lib.maintainers; [
+      philtaken
+      llakala
+    ];
     teams = [ lib.teams.beam ];
   };
 })
diff --git a/pkgs/by-name/go/gopher/int_main.patch b/pkgs/by-name/go/gopher/int_main.patch
deleted file mode 100644
index 07024525b309..000000000000
--- a/pkgs/by-name/go/gopher/int_main.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index 1b20711..79ce215 100644
---- a/configure
-+++ b/configure
-@@ -679,7 +679,7 @@ cat > conftest.$ac_ext << EOF
- #line 680 "configure"
- #include "confdefs.h"
- 
--main(){return(0);}
-+int main(){return(0);}
- EOF
- if { (eval echo configure:685: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
-   ac_cv_prog_cc_works=yes
diff --git a/pkgs/by-name/go/gopher/package.nix b/pkgs/by-name/go/gopher/package.nix
index 248d507da4db..19a05a661c92 100644
--- a/pkgs/by-name/go/gopher/package.nix
+++ b/pkgs/by-name/go/gopher/package.nix
@@ -7,21 +7,17 @@
 
 stdenv.mkDerivation rec {
   pname = "gopher";
-  version = "3.0.18";
+  version = "3.0.19";
 
   src = fetchFromGitHub {
     owner = "jgoerzen";
     repo = "gopher";
     rev = "release/${version}";
-    sha256 = "sha256-YAcpEV3SbiUZ4nqYk6k1M41YWdTGSSH7rNB15gv31qQ=";
+    sha256 = "sha256-8J63TnC3Yq7+64PPLrlPEueMa9D/eWkPsb08t1+rPAA=";
   };
 
   buildInputs = [ ncurses ];
 
-  patches = [
-    ./int_main.patch # https://github.com/jgoerzen/gopher/pull/8
-  ];
-
   preConfigure = "export LIBS=-lncurses";
 
   meta = with lib; {
diff --git a/pkgs/by-name/he/helm-ls/package.nix b/pkgs/by-name/he/helm-ls/package.nix
index 055fcfdb2d40..9664e81c5c44 100644
--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "helm-ls";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "mrjosh";
     repo = "helm-ls";
     rev = "v${version}";
-    hash = "sha256-NI9qtbt0Ci300DhDR+yjFThTGLXKrbsc1wuLPpC1l9o=";
+    hash = "sha256-OxrPqDa2g5jmm+XtLE0YCnVhkvVK60xxrO49Gl8VT60=";
   };
 
-  vendorHash = "sha256-1BO/0Ous4mclainPV+nqk5K+tHKgRnaxMtsI4xAhZF4=";
+  vendorHash = "sha256-w/BWPbpSYum0SU8PJj76XiLUjTWO4zNQY+khuLRK0O8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/hy/hyprls/package.nix b/pkgs/by-name/hy/hyprls/package.nix
index bd713f25d09f..3815066a55ae 100644
--- a/pkgs/by-name/hy/hyprls/package.nix
+++ b/pkgs/by-name/hy/hyprls/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "hyprls";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "hyprland-community";
     repo = "hyprls";
     rev = "v${version}";
-    hash = "sha256-sXC/JMd2NYc74k19DxZyldH+QLZ6W8dVHy0uyqyuCmg=";
+    hash = "sha256-cJDDyF44nD/XvxtaGPYCk2MC574HDBHP1ByhVwqatvQ=";
   };
 
-  vendorHash = "sha256-rG+oGJOABA9ee5nIpC5/U0mMsPhwvVtQvJBlQWfxi5Y=";
+  vendorHash = "sha256-WTdwIAC3gDWgCKlVuOtMyl0ZfdZ9RhlpqUl2S2d65HA=";
 
   checkFlags = [
     # Not yet implemented
diff --git a/pkgs/by-name/ik/ike-scan/package.nix b/pkgs/by-name/ik/ike-scan/package.nix
index 754ab2afa6c5..903dcd2003e7 100644
--- a/pkgs/by-name/ik/ike-scan/package.nix
+++ b/pkgs/by-name/ik/ike-scan/package.nix
@@ -9,15 +9,24 @@
 
 stdenv.mkDerivation rec {
   pname = "ike-scan";
-  version = "1.9.5";
+  version = "1.9.5-unstable-2024-09-15";
 
   src = fetchFromGitHub {
     owner = "royhills";
     repo = "ike-scan";
-    rev = version;
-    sha256 = "sha256-mbfg8p3y4aKoXpmLuF9GXAMPEqV5CsvetwGCRDJ9UNY=";
+    rev = "c74c01fd22d9a3aae3d8ba9a0bd2eb1a2146ac6f";
+    hash = "sha256-+eicvirqzZrAJiaGaVjqZlSpU2+jTG/MRPv50P+1Tpc=";
   };
 
+  patches = [
+    # Using the same patches as for the Fedora RPM
+    (fetchpatch {
+      # Memory leaks, https://github.com/royhills/ike-scan/pull/15
+      url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
+      hash = "sha256-VVJZSTZfDV0qHuxdNoZV1NXJYCEMtB0bO1oi2hLCeXE=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     openssl
@@ -25,15 +34,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-openssl=${openssl.dev}" ];
 
-  patches = [
-    # Using the same patches as for the Fedora RPM
-    (fetchpatch {
-      # Memory leaks, https://github.com/royhills/ike-scan/pull/15
-      url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
-      sha256 = "0wbrq89dl8js7cdivd0c45hckmflan33cpgc3qm5s3az6r4mjljm";
-    })
-  ];
-
   meta = with lib; {
     description = "Tool to discover, fingerprint and test IPsec VPN servers";
     longDescription = ''
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
       fingerprint and test IPsec VPN servers.
     '';
     homepage = "https://github.com/royhills/ike-scan";
-    license = with licenses; [ gpl3Plus ];
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/by-name/ko/kool/package.nix b/pkgs/by-name/ko/kool/package.nix
index 8ad93a44e022..5527f9ffb065 100644
--- a/pkgs/by-name/ko/kool/package.nix
+++ b/pkgs/by-name/ko/kool/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kool";
-  version = "3.5.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "kool-dev";
     repo = "kool";
     rev = version;
-    hash = "sha256-iB/9owaBNQVzdA4edrx0zl+COs7yVLs61Mij5kfjEhg=";
+    hash = "sha256-yUJbuMOLEa9LVRltskSwD0XBdmwwLcEaLYUHsSQOiCk=";
   };
 
   vendorHash = "sha256-IqUkIf0uk4iUTedTO5xRzjmJwHS+p6apo4E0WEEU6cc=";
diff --git a/pkgs/by-name/kr/krapslog/package.nix b/pkgs/by-name/kr/krapslog/package.nix
index ceef566a4169..297c896d8f99 100644
--- a/pkgs/by-name/kr/krapslog/package.nix
+++ b/pkgs/by-name/kr/krapslog/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "krapslog";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "acj";
     repo = "krapslog-rs";
     rev = version;
-    sha256 = "sha256-wRziLNMwLZBCn330FNC9x6loCCyuC+31Kh51ZI/j1Cc=";
+    sha256 = "sha256-c/Zh4fOsSKY0XopaklRbFEh4QM5jjUcj0zhAx5v9amI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Mv0wTuTWCsBGjlr4BhLezBOCtgQ0qq2kwLcZxU1nREM=";
+  cargoHash = "sha256-cXK7YZ9i/eKXTHPYnJcvcKyzFlZDnqmCBrEa75Mxfqc=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 
diff --git a/pkgs/by-name/kr/krillinai/package.nix b/pkgs/by-name/kr/krillinai/package.nix
index 181a896e0c39..35afea0b1aa1 100644
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.1.5";
+  version = "1.2.1-hotfix-2";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KrillinAI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jQlgkpQ+UTzn6MqGa+yVQ9v04IGGlMQQim3s0Oc9Zts=";
+    hash = "sha256-Dw30Lsf4pHMDlrLmdoU+4v5SJfzx5UId6v/OocrsiS4=";
   };
 
-  vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
+  vendorHash = "sha256-14YNdIfylUpcWqHhrpgmjxBHYRXaoR59jb1QdTckuLY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/li/libfaketime/0001-Remove-unsupported-clang-flags.patch b/pkgs/by-name/li/libfaketime/0001-Remove-unsupported-clang-flags.patch
deleted file mode 100644
index 7dfad4978005..000000000000
--- a/pkgs/by-name/li/libfaketime/0001-Remove-unsupported-clang-flags.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 2af4804..bcff809 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -80,7 +80,7 @@ PREFIX ?= /usr/local
- LIBDIRNAME ?= /lib/faketime
- PLATFORM ?=$(shell uname)
- 
--CFLAGS += -std=gnu99 -Wall -Wextra -Werror -Wno-nonnull-compare -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
-+CFLAGS += -std=gnu99 -Wall -Wextra -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
- ifeq ($(PLATFORM),SunOS)
- CFLAGS += -D__EXTENSIONS__ -D_XOPEN_SOURCE=600
- endif
diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index 6feb112f8074..9c7847b94567 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -9,41 +9,26 @@
 
 stdenv.mkDerivation rec {
   pname = "libfaketime";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchFromGitHub {
     owner = "wolfcw";
     repo = "libfaketime";
     rev = "v${version}";
-    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
+    sha256 = "sha256-a0TjHYzwbkRQyvr9Sj/DqjgLBnE1Z8kjsTQxTfGqLjE=";
   };
 
-  patches =
-    [
-      ./nix-store-date.patch
-      (fetchpatch {
-        name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
-        sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
-      })
-      (fetchpatch {
-        name = "LFS64.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/f32986867addc9d22b0fab29c1c927f079d44ac1.patch";
-        hash = "sha256-fIXuxxcV9J2IcgwcwSrMo4maObkH9WYv1DC/wdtbq/g=";
-      })
-    ]
-    ++ (lib.optionals stdenv.cc.isClang [
-      # https://github.com/wolfcw/libfaketime/issues/277
-      ./0001-Remove-unsupported-clang-flags.patch
-    ]);
+  patches = [
+    ./nix-store-date.patch
+  ];
 
   postPatch = ''
     patchShebangs test src
     for a in test/functests/test_exclude_mono.sh src/faketime.c ; do
       substituteInPlace $a \
-        --replace /bin/bash ${stdenv.shell}
+        --replace-fail /bin/bash ${stdenv.shell}
     done
-    substituteInPlace src/faketime.c --replace @DATE_CMD@ ${coreutils}/bin/date
+    substituteInPlace src/faketime.c --replace-fail @DATE_CMD@ ${coreutils}/bin/date
   '';
 
   PREFIX = placeholder "out";
diff --git a/pkgs/by-name/li/libkate/package.nix b/pkgs/by-name/li/libkate/package.nix
index 418e91d7ebb0..553ba6e89ce3 100644
--- a/pkgs/by-name/li/libkate/package.nix
+++ b/pkgs/by-name/li/libkate/package.nix
@@ -1,34 +1,50 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
+  bison,
+  flex,
   libogg,
   libpng,
+  pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libkate";
-  version = "0.4.1";
+  version = "0.4.3";
 
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/libkate/${pname}-${version}.tar.gz";
-    sha256 = "0s3vr2nxfxlf1k75iqpp4l78yf4gil3f0v778kvlngbchvaq23n4";
+  src = fetchFromGitLab {
+    domain = "gitlab.xiph.org/";
+    owner = "xiph";
+    repo = "kate";
+    tag = "kate-${finalAttrs.version}";
+    hash = "sha256-HwDahmjDC+O321Ba7MnHoQdHOFUMpFzaNdLHQeEg11Q=";
   };
 
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config # provides macro PKG_CHECK_MODULES
+  ];
+
   buildInputs = [
     libogg
     libpng
   ];
 
-  meta = with lib; {
+  enableParallelBuilding = true;
+
+  meta = {
     description = "Library for encoding and decoding Kate streams";
     longDescription = ''
       This is libkate, the reference implementation of a codec for the Kate
       bitstream format. Kate is a karaoke and text codec meant for encapsulation
       in an Ogg container. It can carry Unicode text, images, and animate
       them.'';
-    homepage = "https://code.google.com/archive/p/libkate/";
-    platforms = platforms.unix;
-    license = licenses.bsd3;
+    homepage = "https://wiki.xiph.org/index.php/OggKate";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.bsd3;
   };
-}
+})
diff --git a/pkgs/by-name/lo/logdy/package.nix b/pkgs/by-name/lo/logdy/package.nix
index 443331aa8dae..7489359941a9 100644
--- a/pkgs/by-name/lo/logdy/package.nix
+++ b/pkgs/by-name/lo/logdy/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "logdy";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "logdyhq";
     repo = "logdy-core";
     tag = "v${version}";
-    hash = "sha256-OpG9jgm/A++PBDQH5IYY6PyXx87QvihyZqnwhdBWZGg=";
+    hash = "sha256-779ZO9WhE3IKbHJLchCfrIepMH+GOrlQJALLpoNZvbc=";
   };
 
   vendorHash = "sha256-kFhcbBMymzlJ+2zw7l09LJfCdps26Id+VzOehqrLDWU=";
diff --git a/pkgs/by-name/ma/manga-tui/package.nix b/pkgs/by-name/ma/manga-tui/package.nix
index af215b99a4dd..4c2da99f92a4 100644
--- a/pkgs/by-name/ma/manga-tui/package.nix
+++ b/pkgs/by-name/ma/manga-tui/package.nix
@@ -10,7 +10,7 @@
   nix-update-script,
 }:
 let
-  version = "0.7.0";
+  version = "0.8.0";
 in
 rustPlatform.buildRustPackage {
   pname = "manga-tui";
@@ -20,11 +20,11 @@ rustPlatform.buildRustPackage {
     owner = "josueBarretogit";
     repo = "manga-tui";
     rev = "v${version}";
-    hash = "sha256-1WFg2hG3UnOO9+HpUcdPkZNhsNYa2QG1PhzLZ4bQiQM=";
+    hash = "sha256-81P5LwL9njxA0qx4FvqgrHdqVgUXkZTTzAXLdRTftS4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1nERwIZCR/afgfGdronpy145GnDkbsB7YjF6XyDcfEY=";
+  cargoHash = "sha256-dne0sJ0K/UVXGaj/vUM9O++ZS0hu69bdLnV8VAr3tbM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/mi/minio-client/package.nix b/pkgs/by-name/mi/minio-client/package.nix
index a5d1f8d023b8..71372676733d 100644
--- a/pkgs/by-name/mi/minio-client/package.nix
+++ b/pkgs/by-name/mi/minio-client/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2025-04-16T18-13-26Z";
+  version = "2025-05-21T01-59-54Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-23shNQWVIuTLL0FLM00919JaT2QR4R0ou5ZA2/mQ4PA=";
+    sha256 = "sha256-ss/GqOJz9FNrQzYABb8ePCMcmNVTYVji/Id1WOuu24M=";
   };
 
   vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";
diff --git a/pkgs/by-name/ne/ne/package.nix b/pkgs/by-name/ne/ne/package.nix
index b3290e7184e2..5d253ac43900 100644
--- a/pkgs/by-name/ne/ne/package.nix
+++ b/pkgs/by-name/ne/ne/package.nix
@@ -9,22 +9,24 @@
   ghostscript,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ne";
   version = "3.3.4";
 
   src = fetchFromGitHub {
     owner = "vigna";
     repo = "ne";
-    rev = version;
-    sha256 = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
+    tag = finalAttrs.version;
+    hash = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
   };
 
   postPatch = ''
-    substituteInPlace makefile --replace "./version.pl" "perl version.pl"
-    substituteInPlace src/makefile --replace "-lcurses" "-lncurses"
+    substituteInPlace makefile --replace-fail "./version.pl" "perl version.pl"
+    substituteInPlace src/makefile --replace-fail "-lcurses" "-lncurses"
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     texliveMedium
     texinfo6
@@ -35,18 +37,20 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
-  meta = with lib; {
+  meta = {
     description = "Nice editor";
     homepage = "https://ne.di.unimi.it/";
+    changelog = "https://github.com/vigna/ne/releases/tag/${finalAttrs.version}";
+    downloadPage = "https://github.com/vigna/ne";
     longDescription = ''
       ne is a free (GPL'd) text editor based on the POSIX standard that runs
       (we hope) on almost any UN*X machine.  ne is easy to use for the beginner,
       but powerful and fully configurable for the wizard, and most sparing in its
       resource usage.  See the manual for some highlights of ne's features.
     '';
-    license = licenses.gpl3;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ geri1701 ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ geri1701 ];
     mainProgram = "ne";
   };
-}
+})
diff --git a/pkgs/by-name/of/offrss/package.nix b/pkgs/by-name/of/offrss/package.nix
deleted file mode 100644
index 0d60b2d6e3c7..000000000000
--- a/pkgs/by-name/of/offrss/package.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  curl,
-  libmrss,
-  podofo,
-  libiconv,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "offrss";
-  version = "1.3";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp offrss $out/bin
-  '';
-
-  buildInputs =
-    [
-      curl
-      libmrss
-    ]
-    ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) podofo
-    ++ lib.optional (!stdenv.hostPlatform.isLinux) libiconv;
-
-  # Workaround build failure on -fno-common toolchains:
-  #   ld: serve_pdf.o:offrss.h:75: multiple definition of `cgi_url_path';
-  #     offrss.o:offrss.h:75: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=implicit-function-declaration";
-
-  configurePhase =
-    ''
-      substituteInPlace Makefile \
-        --replace '$(CC) $(CFLAGS) $(LDFLAGS)' '$(CXX) $(CFLAGS) $(LDFLAGS)'
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isLinux) ''
-      sed 's/#EXTRA/EXTRA/' -i Makefile
-    ''
-    + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      sed 's/^PDF/#PDF/' -i Makefile
-    '';
-
-  src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/offrss/offrss-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5oIiDLdFrnEfPfSiwCv3inIcxK+bbgbMT1VISVAPfKo=";
-  };
-
-  meta = {
-    homepage = "http://vicerveza.homeunix.net/~viric/cgi-bin/offrss";
-    description = "Offline RSS/Atom reader";
-    license = lib.licenses.agpl3Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    mainProgram = "offrss";
-  };
-})
diff --git a/pkgs/by-name/og/ogen/package.nix b/pkgs/by-name/og/ogen/package.nix
index b2c9e881f638..e31e52fe3db8 100644
--- a/pkgs/by-name/og/ogen/package.nix
+++ b/pkgs/by-name/og/ogen/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ogen";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "ogen-go";
     repo = "ogen";
     tag = "v${version}";
-    hash = "sha256-M2xKxaf+iWXTq+vMXsucMmVqs9BarCoyG6prmwcL8KI=";
+    hash = "sha256-w3h65MNXBgsH8PCHfoPqY+XNI6TMbLUAMI4Y3WWLEJM=";
   };
 
-  vendorHash = "sha256-TVnTg+SbTmpdfxWSr3KIPioQ/0OlUxCuCfyn5oMWPu8=";
+  vendorHash = "sha256-PQ2ZrigS9jZY1oL3Dsuc2RZwedZLzLKUqhMYfWiZ854=";
 
   patches = [ ./modify-version-handling.patch ];
 
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
index 38833afae1ea..e39081ae01fa 100644
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -81,18 +81,18 @@ buildGoModule (
 
   {
     pname = "olivetin";
-    version = "2025.5.26";
+    version = "2025.6.1";
 
     src = fetchFromGitHub {
       owner = "OliveTin";
       repo = "OliveTin";
       tag = finalAttrs.version;
-      hash = "sha256-BD52MxIHE56y3oWuRTCYmrEYMge70/MXt4B6g84ahF0=";
+      hash = "sha256-Bd+zxVEhP7LZk74Mfai/MkML1pKlPBKm4kh4jAkC/kQ=";
     };
 
     modRoot = "service";
 
-    vendorHash = "sha256-kfk4QFG+l+XKkKoOs2C1B6ZuMeeDz9DrzzR46S8Qnyk=";
+    vendorHash = "sha256-8rPJoB75de2Y56iyIwdI9HPk7OlCgfMPy28TW1i7+sU=";
 
     ldflags = [
       "-s"
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index f972d5af23e3..0a5c925c77bd 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ee2MkvdVDQaSFJDDuXEwedqOB2DUl3MIfp5tRxqbL8A=";
+    hash = "sha256-+8UHE9M2JWUARuuIRdKwNkn1hoxtuitVH7do5V5uEg0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/op/opengamepadui/package.nix b/pkgs/by-name/op/opengamepadui/package.nix
index 497f1e03eda1..e700d72d27e9 100644
--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -35,8 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "source/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     hash = "sha256-T79G2bShJuFRfaCqG3IDHqW0s68yAdGyv58kdDYg6kg=";
   };
   cargoRoot = "extensions";
diff --git a/pkgs/by-name/ph/phrase-cli/package.nix b/pkgs/by-name/ph/phrase-cli/package.nix
index 64a81fb07e3c..ff5cfee3099d 100644
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.40.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-d/B5XzEAM1GlpQxshy0kEJexF01FlF99hnoctKDXhp0=";
+    sha256 = "sha256-dLdgJdR2faxpfHmYhhzn7nQxTrXDhF6XqOIKFLXDEj4=";
   };
 
-  vendorHash = "sha256-VV4ctHj9fPosAgqBOfkqOKETSeGJXFPPP+kBMgqV2nk=";
+  vendorHash = "sha256-zVIxBZ2zTXk407piA4dXxKfyD7Ke8RIq7lYogr/+rcs=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 127b683dece6..ad256b2253f9 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -27,14 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = _experimental-update-script-combinators.sequence [
     (nix-update-script { })
     (lib.getExe (writeShellApplication {
-      name = "${finalAttrs.pname}-dependencies-updater";
+      name = "podman-desktop-dependencies-updater";
       runtimeInputs = [
         nix
         jq
         gnugrep
       ];
       runtimeEnv = {
-        PNAME = finalAttrs.pname;
+        PNAME = "podman-desktop";
         PKG_FILE = builtins.toString ./package.nix;
       };
       text = ''
diff --git a/pkgs/by-name/pr/prelink/package.nix b/pkgs/by-name/pr/prelink/package.nix
index b149e2e857f5..b5328d7b5d05 100644
--- a/pkgs/by-name/pr/prelink/package.nix
+++ b/pkgs/by-name/pr/prelink/package.nix
@@ -5,17 +5,18 @@
   autoreconfHook,
   libelf,
   libiberty,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
   pname = "prelink";
-  version = "unstable-2019-06-24";
+  version = "20151030-unstable-2024-07-02";
 
   src = fetchgit {
-    url = "https://git.yoctoproject.org/git/prelink-cross";
+    url = "https://git.yoctoproject.org/prelink-cross";
     branchName = "cross_prelink";
-    rev = "f9975537dbfd9ade0fc813bd5cf5fcbe41753a37";
-    sha256 = "sha256-O9/oZooLRyUBBZX3SFcB6LFMmi2vQqkUlqtZnrq5oZc=";
+    rev = "ff2561c02ade96c5d4d56ddd4e27ff064840a176";
+    sha256 = "sha256-wmX7ybrZDWEop9fiInZMvgK/fpEk3sq+Wu8DSWWIvQY=";
   };
 
   strictDeps = true;
@@ -40,6 +41,8 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     description = "ELF prelinking utility to speed up dynamic linking";
     homepage = "https://wiki.yoctoproject.org/wiki/Cross-Prelink";
diff --git a/pkgs/by-name/pr/protoc-gen-es/package.nix b/pkgs/by-name/pr/protoc-gen-es/package.nix
index ea38a71b109b..9c30e4d41b5c 100644
--- a/pkgs/by-name/pr/protoc-gen-es/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-es/package.nix
@@ -7,20 +7,20 @@
 
 buildNpmPackage rec {
   pname = "protoc-gen-es";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protobuf-es";
     tag = "v${version}";
-    hash = "sha256-wllLeX7veCbpb/mTAIs0cf/hcVItEmw2HW/UR4k0Epc=";
+    hash = "sha256-afCfRi9YSQS8BoYrDR66FBW7sbfYvSxVSpxYM8F6CRw=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-PGieFyPgb2ERTdQc3HH5mg/uh5xj7nkUa0qwmgxofVY=";
+  npmDepsHash = "sha256-DDFMQqWoixZZ9u8MLOEaKiPAOB3pEGnsF7el8AIOPrc=";
 
   npmWorkspace = "packages/protoc-gen-es";
 
diff --git a/pkgs/by-name/pr/protolint/package.nix b/pkgs/by-name/pr/protolint/package.nix
index 5fbfce23b211..cc2eb70c91cb 100644
--- a/pkgs/by-name/pr/protolint/package.nix
+++ b/pkgs/by-name/pr/protolint/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "protolint";
-  version = "0.55.5";
+  version = "0.55.6";
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
     repo = "protolint";
     rev = "v${version}";
-    hash = "sha256-uim4M1C51VVCOhcE/dyCLzx/Bks0h50+haw5mbAfiN8=";
+    hash = "sha256-RTej9zVQz6GESAoAAChidiolGEoHabUYlEZSV2gc8KQ=";
   };
 
-  vendorHash = "sha256-Zt1HbmdUpQmmK+404tfSs6qfZxZEqHIgQBoN63Els3M=";
+  vendorHash = "sha256-RS0t7n6pLYVKHluQtXsMjYL1SvN7IZFdKmkxOI8wFoE=";
 
   # Something about the way we run tests causes issues. It doesn't happen
   # when using "go test" directly:
diff --git a/pkgs/by-name/pr/protols/package.nix b/pkgs/by-name/pr/protols/package.nix
index dd75421810dc..3b9043a35f16 100644
--- a/pkgs/by-name/pr/protols/package.nix
+++ b/pkgs/by-name/pr/protols/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protols";
-  version = "0.12.0";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = version;
-    hash = "sha256-v4ROQVoJmrukHFrxykr6EuBFXRuaBnPZ7f36ly7rPhg=";
+    hash = "sha256-zs78TKZU35UGAmEXK3EA9B6zRCqeCtNexHVAJERKyX8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fmsPkXwu8qy+SRyP5w940gqNmXg0V/p/vDSI7EIFrh0=";
+  cargoHash = "sha256-Lh6KJ5zclT650tPIpMJBALLj4gnis+fglhewiZ5mpMs=";
 
   meta = {
     description = "Protocol Buffers language server written in Rust";
diff --git a/pkgs/by-name/py/pykickstart/package.nix b/pkgs/by-name/py/pykickstart/package.nix
index 3d93456d6146..3afdc6aadf71 100644
--- a/pkgs/by-name/py/pykickstart/package.nix
+++ b/pkgs/by-name/py/pykickstart/package.nix
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication rec {
   meta = {
     description = "Python package to interact with Kickstart files commonly found in the RPM world";
     homepage = "https://github.com/pykickstart/pykickstart";
-    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/r${src.tag}";
+    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/${src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       thefossguy
diff --git a/pkgs/by-name/qm/qmk/package.nix b/pkgs/by-name/qm/qmk/package.nix
index 4d5d40f34469..91c5cdc262d6 100644
--- a/pkgs/by-name/qm/qmk/package.nix
+++ b/pkgs/by-name/qm/qmk/package.nix
@@ -15,12 +15,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "qmk";
-  version = "1.1.7";
+  version = "1.1.8";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Qhzsa5GAAeSgt7FZsRWIVO1ZB+010WtBv9SV38Xgto=";
+    hash = "sha256-C0Jra/IK61tngGsuEnMD4mySRc/iZVgdYEbMXtwpBZ0=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 471402426394..2b0492851ead 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-05-20";
+  version = "0-unstable-2025-05-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "be40a3764a727a7a22eebb481b1fd3e0f70fca8c";
-    hash = "sha256-r+7J7AgWpBZuGpPU7EBn0KxM5ksHC6aED4oLe4oZzfQ=";
+    rev = "8413c5a08ed53867493b2a08fd4c730d7b419ee7";
+    hash = "sha256-Dl/JzkUP/mNBxz20C4qH5B3qpXjd4/q/r5n0RO3ga+U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slirp4netns/package.nix b/pkgs/by-name/sl/slirp4netns/package.nix
index f7a643222a23..1b226420b85b 100644
--- a/pkgs/by-name/sl/slirp4netns/package.nix
+++ b/pkgs/by-name/sl/slirp4netns/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "slirp4netns";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "rootless-containers";
     repo = "slirp4netns";
     rev = "v${version}";
-    sha256 = "sha256-1OiomraQ4wfrBPihGrf9sq8hPJUB45gvf7Y5j7iN8/E=";
+    sha256 = "sha256-dPhUr9GdujTpUsnfvZDp8eOBQwlzqwtwziII2QWD4JA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sn/snipaste/package.nix b/pkgs/by-name/sn/snipaste/package.nix
index 1230e2e284d6..f6eec3131d03 100644
--- a/pkgs/by-name/sn/snipaste/package.nix
+++ b/pkgs/by-name/sn/snipaste/package.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "snipaste";
-  version = "2.10.6";
+  version = "2.10.7";
   src = fetchurl {
     url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-lkP3YN4ZNbtM2beQEIWPxBE6JXToRBW48QAMLw/TBzQ=";
+    hash = "sha256-WzCSI0BfjolbWbj/mLhRj75tW/CvlbzQtFuBizg8xl4=";
   };
   contents = appimageTools.extract { inherit pname version src; };
 in
diff --git a/pkgs/by-name/sn/snort/package.nix b/pkgs/by-name/sn/snort/package.nix
index 405ed2cb1de7..ed050c8fe092 100644
--- a/pkgs/by-name/sn/snort/package.nix
+++ b/pkgs/by-name/sn/snort/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snort";
-  version = "3.7.4.0";
+  version = "3.8.1.0";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "snort3";
     tag = finalAttrs.version;
-    hash = "sha256-c5GVFzZOeaI2te49m9crt9I0E/awHjcDR621tvDVgSQ=";
+    hash = "sha256-+59e6rLMvLQ+LNxwRRG6nLXqjMsbn3bdykfMpwPgSpA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sr/srb2/cmake.patch b/pkgs/by-name/sr/srb2/cmake.patch
index 91af532e86fb..077bfb661253 100644
--- a/pkgs/by-name/sr/srb2/cmake.patch
+++ b/pkgs/by-name/sr/srb2/cmake.patch
@@ -1,56 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 80a3bdcd6..380a1573a 100644
+index a4c631102..13b5743ca 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -61,7 +61,7 @@ option(
- 	"Link dependencies using CMake's find_package and do not use internal builds"
- 	${SRB2_CONFIG_SYSTEM_LIBRARIES_DEFAULT}
- )
--option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" ON)
-+option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" OFF)
- # This option isn't recommended for distribution builds and probably won't work (yet).
- cmake_dependent_option(
- 	SRB2_CONFIG_SHARED_INTERNAL_LIBRARIES
-@@ -80,25 +80,6 @@ option(SRB2_CONFIG_ZDEBUG "Compile with ZDEBUG defined." OFF)
- option(SRB2_CONFIG_PROFILEMODE "Compile for profiling (GCC only)." OFF)
- set(SRB2_CONFIG_ASSET_DIRECTORY "" CACHE PATH "Path to directory that contains all asset files for the installer. If set, assets will be part of installation and cpack.")
- 
--if(SRB2_CONFIG_ENABLE_TESTS)
--	# https://github.com/catchorg/Catch2
--	CPMAddPackage(
--		NAME Catch2
--		VERSION 3.4.0
--		GITHUB_REPOSITORY catchorg/Catch2
--		OPTIONS
--			"CATCH_INSTALL_DOCS OFF"
--	)
--	list(APPEND CMAKE_MODULE_PATH "${Catch2_SOURCE_DIR}/extras")
--	include(CTest)
--	include(Catch)
--	add_executable(srb2tests)
--	# To add tests, use target_sources to add individual test files to the target in subdirs.
--	target_link_libraries(srb2tests PRIVATE Catch2::Catch2 Catch2::Catch2WithMain)
--	target_compile_features(srb2tests PRIVATE c_std_11 cxx_std_17)
--	catch_discover_tests(srb2tests)
--endif()
--
- # Enable CCache
- # (Set USE_CCACHE=ON to use, CCACHE_OPTIONS for options)
- if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
-@@ -113,12 +94,6 @@ if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
- 			message(WARNING "USE_CCACHE was set but ccache is not found (set CCACHE_TOOL_PATH)")
- 		endif()
- 	endif()
--else()
--	CPMAddPackage(
--		NAME Ccache.cmake
--		GITHUB_REPOSITORY TheLartians/Ccache.cmake
--		VERSION 1.2
--	)
- endif()
- 
- # Dependencies
-@@ -179,7 +154,7 @@ include(GitUtilities)
+@@ -141,7 +141,7 @@ include(GitUtilities)
  if("${SRB2_SDL2_EXE_NAME}" STREQUAL "")
  	# cause a reconfigure if the branch changes
  	get_git_dir(SRB2_GIT_DIR)
diff --git a/pkgs/by-name/sr/srb2/package.nix b/pkgs/by-name/sr/srb2/package.nix
index 70b606d782c9..4d02b4addc95 100644
--- a/pkgs/by-name/sr/srb2/package.nix
+++ b/pkgs/by-name/sr/srb2/package.nix
@@ -7,8 +7,8 @@
   curl,
   nasm,
   libopenmpt,
+  miniupnpc,
   game-music-emu,
-  libGLU,
   libpng,
   SDL2,
   SDL2_mixer,
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srb2";
-  version = "2.2.13";
+  version = "2.2.15";
 
   src = fetchFromGitHub {
     owner = "STJr";
     repo = "SRB2";
     rev = "SRB2_release_${finalAttrs.version}";
-    hash = "sha256-OSkkjCz7ZW5+0vh6l7+TpnHLzXmd/5QvTidRQSHJYX8=";
+    hash = "sha256-eJ0GYe3Rw6qQXj+jtyt8MkP87DaCiO9ffChg+SpQqaI=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     game-music-emu
     libpng
     libopenmpt
+    miniupnpc
     SDL2
     SDL2_mixer
     zlib
@@ -53,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     src = fetchgit {
       url = "https://git.do.srb2.org/STJr/srb2assets-public";
       rev = "SRB2_release_${finalAttrs.version}";
-      hash = "sha256-OXvO5ZlujIYmYevc62Dtx192dxoujQMNFUCrH5quBBg=";
+      hash = "sha256-1kwhWHzL2TbSx1rhFExbMhXqn0HMBRhR6LZiuoRx+iI=";
       fetchLFS = true;
     };
 
@@ -76,17 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Make the build work without internet connectivity
-    # See: https://build.opensuse.org/request/show/1109889
     ./cmake.patch
-    ./thirdparty.patch
   ];
 
-  postPatch = ''
-    substituteInPlace ./src/sdl/ogl_sdl.c \
-      --replace libGLU.so.1 ${libGLU}/lib/libGLU.so.1
-  '';
-
   desktopItems = [
     (makeDesktopItem rec {
       name = "Sonic Robo Blast 2";
diff --git a/pkgs/by-name/sr/srb2/thirdparty.patch b/pkgs/by-name/sr/srb2/thirdparty.patch
deleted file mode 100644
index bb550290d85d..000000000000
--- a/pkgs/by-name/sr/srb2/thirdparty.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/thirdparty/CMakeLists.txt b/thirdparty/CMakeLists.txt
-index f33b3bf3f..1214f179c 100644
---- a/thirdparty/CMakeLists.txt
-+++ b/thirdparty/CMakeLists.txt
-@@ -16,6 +16,5 @@ if(NOT "${SRB2_CONFIG_SYSTEM_LIBRARIES}")
- 	include("cpm-png.cmake")
- 	include("cpm-curl.cmake")
- 	include("cpm-openmpt.cmake")
-+	include("cpm-libgme.cmake")
- endif()
--
--include("cpm-libgme.cmake")
diff --git a/pkgs/by-name/su/surrealist/package.nix b/pkgs/by-name/su/surrealist/package.nix
index 175366a2c8fe..ac2372736750 100644
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@@ -60,8 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     hash = "sha256-Su9ZOPIskV5poeS8pgtri+sZANBpdgnuCsQqE4WKFdA=";
   };
 
diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
index 4937bca343f3..01e3c58d2206 100644
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.11.0-etke42";
+  version = "0.11.1-etke43";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HWhyG/dVP9M84OOYH95RPLqiXDYOs+QOxwLM8pPl1vA=";
+    hash = "sha256-mubONaT4qnbPlnYY15UtHGEp45k5mIxWt1shHRdwwTA=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-GO5m+7fcm/XO38XlsQq6fwKslzdZkE6WleP3GHNKuPU=";
+    hash = "sha256-WFE2mtyK3xBOVIgJ0ODsv1C0pjpGdBM3+TtIiZUpj58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/terramate/package.nix b/pkgs/by-name/te/terramate/package.nix
index f2a97e17c770..0f6330a48a4f 100644
--- a/pkgs/by-name/te/terramate/package.nix
+++ b/pkgs/by-name/te/terramate/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-lIYtNvluKRufV0bXi2z2/8F7221Sum20usA0j0pHU7I=";
+    hash = "sha256-NN7M4ZJ67YwguDzSHkluW1wbwVbn+7otMQm+ot2el5I=";
   };
 
-  vendorHash = "sha256-84xlUXCJhsZjNxdWQ/Tr/WA4/+gP8NlqQQHnA8R8nz8=";
+  vendorHash = "sha256-Ldl4TGmfMLk9DJgoVUYCpjX5TyAwZyCSrOKdb6uo4eM=";
 
   # required for version info
   nativeBuildInputs = [ git ];
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 17f0d4c970d4..2b8bdffb4de9 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-RSP9nJ2dmLGci4v2iPRzE//QzAY1m7ZdzCkN43k3w8A=";
-    "x86_64-linux" = "sha256-Xy3kGShqaTbuf9BLx4fUahZrrby2r04+nmuHwDxENMo=";
-    "aarch64-linux" = "sha256-98BAH7yb6I1kG7j/zJyoFEwS1jBjF3oEM/YKk32bbZY=";
+    "universal-macos" = "sha256-1U24bdd4tvkzZmsRrrc4AUwxm9IhxHNAcPtxxX5ZO2w=";
+    "x86_64-linux" = "sha256-DCEqAePHkNj0bfgW5l83DyZG5+bre6C6C7AMbhxwytQ=";
+    "aarch64-linux" = "sha256-jKpt7hqCbgcBv9npR7IhryaCgrdOlX40Icq9T10/Af0=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.41";
+  version = "0.16.42";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/tr/treesheets/package.nix b/pkgs/by-name/tr/treesheets/package.nix
index 9c57eb2a3cbe..9f38024f1abb 100644
--- a/pkgs/by-name/tr/treesheets/package.nix
+++ b/pkgs/by-name/tr/treesheets/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "0-unstable-2025-05-19";
+  version = "0-unstable-2025-06-02";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "a64445212a224b48c3daf054433a7ff68906670a";
-    hash = "sha256-o2En1E6MaYZcQLRPl4uU3isM2Q3aiu7mQ88ZJq1vrmo=";
+    rev = "1e6604b6257b41ba518907bfa21c24fa8245c46f";
+    hash = "sha256-zSZ7tMjG5/kSzHifMSA7Wsypv0/x+Oir6jx0I5Fyk2c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 1f8526f61419..fb7fc3989273 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.1-alpha.7";
+  version = "0.0.1-alpha.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-aonCRtXi9MZWhZO3SjMxAxsTm8iZZdrm36psGArFz/I=";
+    hash = "sha256-w/UEENP9tqwqFX/oCvI67DDMSmXzlCazAIP2wfmdDSs=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-pYv99huRgqcFcnkMkfFoejmZmVkb9q/VVlYfylPXo4o=";
+  cargoHash = "sha256-XISRy7Ncy0lTlsCFYmJBcgGiDJfdygTDF4f9O9ZlzDU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/wa/waagent/package.nix b/pkgs/by-name/wa/waagent/package.nix
index a5f0efb924d1..1e716da55009 100644
--- a/pkgs/by-name/wa/waagent/package.nix
+++ b/pkgs/by-name/wa/waagent/package.nix
@@ -15,12 +15,12 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "waagent";
-  version = "2.13.1.1";
+  version = "2.14.0.0";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "WALinuxAgent";
-    tag = "v${version}";
-    hash = "sha256-W2NXxQOxRhJD/D/w58xknA9X8YYnQxwIhhjXzlCVVWA=";
+    tag = "pre-v${version}";
+    hash = "sha256-nJZXyqdsSQgW+nGqyTS9XSW4z5mGRHtCYsDHKDw/eiM=";
   };
   patches = [
     # Suppress the following error when waagent tries to configure sshd:
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 4f8b7ac07faf..56672781d455 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -36,8 +36,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-MmdvEutdkX98DgX1aVuxs4gabuMX5aM8yC4eqgvd8Q4=";
   };
 
diff --git a/pkgs/by-name/we/web-ext/package.nix b/pkgs/by-name/we/web-ext/package.nix
index e746254159b8..98823048496a 100644
--- a/pkgs/by-name/we/web-ext/package.nix
+++ b/pkgs/by-name/we/web-ext/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "8.7.0";
+  version = "8.7.1";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-k/S9YBU7D7FoXLK9aufBQfD4ZjCdlhGeDBnvfOk5H6Y=";
+    hash = "sha256-B0wlGOg4ZfFRBVrHdERHMv3BPKfLX28YYtdyDphQTcE=";
   };
 
-  npmDepsHash = "sha256-sykNWATICiPz3naZyzl6+b0g0v0D1AsfGYT5bahTlBI=";
+  npmDepsHash = "sha256-J7uDivhLjdMVQyuejcrCL7m7EsAs/DeeKD7r1Cv81qQ=";
 
   npmBuildFlags = [ "--production" ];
 
diff --git a/pkgs/by-name/wi/windowmaker/package.nix b/pkgs/by-name/wi/windowmaker/package.nix
index 3d65bf94c43c..f5eef14cdf0e 100644
--- a/pkgs/by-name/wi/windowmaker/package.nix
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@@ -83,6 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     mainProgram = "wmaker";
     maintainers = [ ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ya/yandex-music/package.nix b/pkgs/by-name/ya/yandex-music/package.nix
index 4830d8c30667..a67c69c6f56b 100644
--- a/pkgs/by-name/ya/yandex-music/package.nix
+++ b/pkgs/by-name/ya/yandex-music/package.nix
@@ -29,13 +29,13 @@ assert lib.assertMsg (trayStyle >= 1 && trayStyle <= 3) "Tray style must be with
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.51.1";
+  version = "5.52.0";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-jk/u0a6rnLDANHebtJ9yTAeFSIPg/CEIqm0oZnGdD0k=";
+    hash = "sha256-39aVY2D8fM243Uhr4i3d9OdBKRqb4MNnkSjKOH3tF4s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yandex-music/ym_info.json b/pkgs/by-name/ya/yandex-music/ym_info.json
index 4013bff5e2c5..12055ba97473 100644
--- a/pkgs/by-name/ya/yandex-music/ym_info.json
+++ b/pkgs/by-name/ya/yandex-music/ym_info.json
@@ -1,6 +1,6 @@
 {
-  "version": "5.51.1",
-  "exe_name": "Yandex_Music_x64_5.51.1.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.51.1.exe",
-  "exe_hash": "sha256-iu7DqcFs9/4aw46eIgWKIYyZ6fIzoW6XkiqdpERup/M="
+  "version": "5.52.0",
+  "exe_name": "Yandex_Music_x64_5.53.1.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.53.1.exe",
+  "exe_hash": "sha256-aTl3sF8n0v17TeAyQwjrXUDKK/MaCtoHQ34IHDEeme8="
 }
diff --git a/pkgs/by-name/ya/yazi/plugins/bypass/default.nix b/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
index f98a0ad23c66..a4a62b2b4e33 100644
--- a/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "bypass.yazi";
-  version = "25.3.2-unstable-2025-05-30";
+  version = "25.3.2-unstable-2025-06-01";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "bypass.yazi";
-    rev = "381fb89a21a58605c555c109f190309b2d116d30";
-    hash = "sha256-04cyOlG843Ot+jRT8GNFjJOzV4YdPBpI9XqbaK6KXu0=";
+    rev = "c1e5fcf6eeed0bfceb57b9738da6db9d0fb8af56";
+    hash = "sha256-ZndDtTMkEwuIMXG4SGe4B95Nw4fChfFhxJHj+IY30Kc=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
index aec407f88dad..7e1d00065fed 100644
--- a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0-unstable-2025-04-12";
+  version = "0-unstable-2025-06-01";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    rev = "2496cd9ac2d1fb52597b22ae84f3af06c826a86d";
-    hash = "sha256-OsNfR7rtnq+ceBTiFjbz+NFMSV/6cQ1THxEFzI4oPJk=";
+    rev = "10b462765f37502065555e83c68a72bb26870fe2";
+    hash = "sha256-mtXl76a54Deg4cyrD0wr++sD/5b/kCsnJ+ngM6OokTc=";
   };
 
   meta = {
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 48a5724b150b..5e7357f2d01e 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -216,8 +216,7 @@ let
           cargoDeps =
             if yjitSupport then
               rustPlatform.fetchCargoVendor {
-                inherit (finalAttrs) src;
-                sourceRoot = "${finalAttrs.pname}-${version}/${finalAttrs.cargoRoot}";
+                inherit (finalAttrs) src cargoRoot;
                 hash =
                   assert cargoHash != null;
                   cargoHash;
diff --git a/pkgs/development/python-modules/aioairq/default.nix b/pkgs/development/python-modules/aioairq/default.nix
index ce74245ccd42..585f29d14f13 100644
--- a/pkgs/development/python-modules/aioairq/default.nix
+++ b/pkgs/development/python-modules/aioairq/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioairq";
-  version = "0.4.4";
+  version = "0.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "CorantGmbH";
     repo = "aioairq";
     tag = "v${version}";
-    hash = "sha256-RwkqhPAKbNZ/RrVxJchtqGDpbmS9eusv1X/B3NseAFk=";
+    hash = "sha256-XlOVCDWbcdh8VjNxlEcVNttRN3mw19AXlIIQJ1II144=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index ea6b2f5b3454..4bd67403b3ad 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.2.14";
+  version = "3.2.15";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = "aiohomekit";
     tag = version;
-    hash = "sha256-TP5YW4pIWO0xHV1EY5hDa80MrBOvkZLyQTNP7m0x+AU=";
+    hash = "sha256-UAFiYTAz5TZVviwoCFzeSGi9acVytQU9hgVVVVecOBU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index 9c83ab0c5b1b..fa49f45058fd 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -33,8 +33,12 @@ buildPythonPackage rec {
 
   cargoRoot = "src/_bcrypt";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-HgHvfMBspPsSYhllnKBg5XZB6zxFIqJj+4//xKG8HwA=";
   };
 
diff --git a/pkgs/development/python-modules/biliass/default.nix b/pkgs/development/python-modules/biliass/default.nix
index f58f280dae5e..03a8c74936f5 100644
--- a/pkgs/development/python-modules/biliass/default.nix
+++ b/pkgs/development/python-modules/biliass/default.nix
@@ -28,8 +28,9 @@ buildPythonPackage rec {
       pname
       version
       src
+      sourceRoot
+      cargoRoot
       ;
-    sourceRoot = "${sourceRoot}/${cargoRoot}";
     hash = "sha256-tkHl6z0En+od//fCGJXK/p8Dz5KDOXltHrXhxHmHL6U=";
   };
 
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 1343bae47695..99a18e14a498 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "caldav";
     tag = "v${version}";
-    hash = "sha256-SYjfQG4muuBcnVeu9cl00Zb2fGUhw157LLxA5/N5EJ0=";
+    hash = "sha256-SWecaXiXp8DSOLVWzgPsbL7UGCtTBfNXYmuDQGdyqbQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/command-runner/default.nix b/pkgs/development/python-modules/command-runner/default.nix
index 6506e68ccf31..fa1faf8da38a 100644
--- a/pkgs/development/python-modules/command-runner/default.nix
+++ b/pkgs/development/python-modules/command-runner/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "command-runner";
-  version = "1.7.3";
+  version = "1.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "netinvent";
     repo = "command_runner";
     tag = "v${version}";
-    hash = "sha256-BNjMMs44eDnGmcFXiMydJIU0RpsFOyd2TjH7BOGQP2E=";
+    hash = "sha256-i5VWoXHCdZtf4tJGgYvBqcMaBSSruCOkIl5ntZoSHio=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/curl-cffi/default.nix b/pkgs/development/python-modules/curl-cffi/default.nix
index e5434c6247c3..1f55b5bc466f 100644
--- a/pkgs/development/python-modules/curl-cffi/default.nix
+++ b/pkgs/development/python-modules/curl-cffi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "curl-cffi";
-  version = "0.7.4";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lexiforest";
     repo = "curl_cffi";
     tag = "v${version}";
-    hash = "sha256-Q1VppzQ1Go+ia1D1BemTf40o9wV0miWyoGy/tY+95qE==";
+    hash = "sha256-h7PPlxjIVT6T9x7gKBSifuWl8wzUNDwRcaUifUS0icM=";
   };
 
   patches = [ ./use-system-libs.patch ];
diff --git a/pkgs/development/python-modules/duckduckgo-search/default.nix b/pkgs/development/python-modules/duckduckgo-search/default.nix
index fe7f0ac8af64..3000bbdbe448 100644
--- a/pkgs/development/python-modules/duckduckgo-search/default.nix
+++ b/pkgs/development/python-modules/duckduckgo-search/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "duckduckgo-search";
-  version = "8.0.0";
+  version = "8.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "deedy5";
     repo = "duckduckgo_search";
     tag = "v${version}";
-    hash = "sha256-FoGBVHxEXM9Mt0wpy7GctrlqUfhZb8DlK3UhlHld7E0=";
+    hash = "sha256-Hbhrm++F6aVvJ//WAgyLNsJe+KS0cjnQ83I1ba72Ows=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fontparts/default.nix b/pkgs/development/python-modules/fontparts/default.nix
index efcdcad0f044..a2d3525343b3 100644
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "fontparts";
-  version = "0.12.5";
+  version = "0.12.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cD7ppaYLnKOLyBMlSlF+ham74yid8MBunxgVkyE3I0I=";
+    hash = "sha256-zg8QkiHh4UhhXdTRhDKulB+Q2E6GZyD0fnPIm6fWZGc=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index e8d2749cdf80..54aa7860dd11 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.5.10";
+  version = "0.5.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IGBJNEGD+XgQQJG3sBh6t0CMZH9eRhJIfHE0+4Jx0H0=";
+    hash = "sha256-bzEPHhIg6F/WQOUoXuaVlZGxn9PU8VdevA/DQuQ7fBw=";
   };
 
   pythonRelaxDeps = [ "requests-oauthlib" ];
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 7f3c3e20d79f..933332684056 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.7.4";
+  version = "0.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d/Q5Kh/ApXP0AcNOuATy8GyssLcNUjboQPEj1Q48tuA=";
+    hash = "sha256-jc48DKUp3ai6AxcveyvR7TF80wmVLWfG58W2xR/HIsE=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts
diff --git a/pkgs/development/python-modules/ghome-foyer-api/default.nix b/pkgs/development/python-modules/ghome-foyer-api/default.nix
index 4025dd890f2a..34dbac9c9b0b 100644
--- a/pkgs/development/python-modules/ghome-foyer-api/default.nix
+++ b/pkgs/development/python-modules/ghome-foyer-api/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "ghome-foyer-api";
-  version = "1.1.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KapJI";
     repo = "ghome-foyer-api";
     tag = "v${version}";
-    hash = "sha256-sup+j9GFGTR+HimpkpvvAqtgYWtJt2qCPZzLvMG8hzI=";
+    hash = "sha256-Y8TfQ0cvmKyLw0UOoLbkXk2vSj+Qb11fCVfNrC1iYao=";
   };
 
   buildInputs = [
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   meta = {
     description = "Generated Python protobuf stubs for Google Home internal API";
     homepage = "https://github.com/KapJI/ghome-foyer-api";
-    changelog = "https://github.com/KapJI/ghome-foyer-api/releases/tag/v${version}";
+    changelog = "https://github.com/KapJI/ghome-foyer-api/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       hensoko
diff --git a/pkgs/development/python-modules/gphoto2/default.nix b/pkgs/development/python-modules/gphoto2/default.nix
index 67da4bd44503..58e3d19d3701 100644
--- a/pkgs/development/python-modules/gphoto2/default.nix
+++ b/pkgs/development/python-modules/gphoto2/default.nix
@@ -1,39 +1,48 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   buildPythonPackage,
   pkg-config,
   libgphoto2,
+  pytestCheckHook,
   setuptools,
   toml,
 }:
 
 buildPythonPackage rec {
   pname = "gphoto2";
-  version = "2.5.1";
+  version = "2.6.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Jgh7ff+iUaeNQtBsXw2Jm+2gj1ctvrY3oahGrbxx3uE=";
+  src = fetchFromGitHub {
+    owner = "jim-easterbrook";
+    repo = "python-gphoto2";
+    tag = "v${version}";
+    hash = "sha256-S/uMP2kRXJDetpXT4+MmCvb35xSxEbzhtKJ0PbHIOIU=";
   };
 
-  nativeBuildInputs = [
-    pkg-config
+  build-system = [
     setuptools
     toml
   ];
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = [ libgphoto2 ];
 
-  doCheck = false; # No tests available
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "gphoto2" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/jim-easterbrook/python-gphoto2/blob/${src.tag}/CHANGELOG.txt";
     description = "Python interface to libgphoto2";
     homepage = "https://github.com/jim-easterbrook/python-gphoto2";
-    license = licenses.gpl3;
+    license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index ca0cca858c1f..01c16773a24b 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "ha-mqtt-discoverable";
-  version = "0.19.1";
+  version = "0.19.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "unixorn";
     repo = "ha-mqtt-discoverable";
     tag = "v${version}";
-    hash = "sha256-zQ3ABrKhuWBZhRPM5tH8VmYErM+mP26rNweFOpoSeEg=";
+    hash = "sha256-LRXgB85jo0Frmdsq5cHQKQ60bYzuVPXsjPeGLj5uyNU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/hyperion-py/default.nix b/pkgs/development/python-modules/hyperion-py/default.nix
index f19fe0ca85d5..5cb6a69ec2ac 100644
--- a/pkgs/development/python-modules/hyperion-py/default.nix
+++ b/pkgs/development/python-modules/hyperion-py/default.nix
@@ -3,60 +3,44 @@
   aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  pytestCheckHook,
-  pythonOlder,
   poetry-core,
   pytest-aiohttp,
   pytest-asyncio,
+  pytest-cov-stub,
+  pytest-timeout,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "hyperion-py";
-  version = "0.7.5";
-  disabled = pythonOlder "3.8";
-  format = "pyproject";
+  version = "0.7.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dermotduffy";
     repo = "hyperion-py";
-    rev = "v${version}";
-    hash = "sha256-arcnpCQsRuiWCrAz/t4TCjTe8DRDtRuzYp8k7nnjGDk=";
+    tag = "v${version}";
+    hash = "sha256-14taFSrtmgTBiie0eY2fSRkZndJSZ4GJNRx3MonrTzs=";
   };
 
-  patches = [
-    (fetchpatch {
-      # python3.10 compat: Drop loop kwarg in asyncio.sleep call
-      url = "https://github.com/dermotduffy/hyperion-py/commit/f02af52fcce17888984c99bfc03935e372011394.patch";
-      hash = "sha256-4nfsQVxd77VV9INwNxTyFRDlAjwdTYqfSGuF487hFCs=";
-    })
-  ];
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [ aiohttp ];
+  dependencies = [ aiohttp ];
 
   nativeCheckInputs = [
     pytest-asyncio
     pytest-aiohttp
+    pytest-cov-stub
+    pytest-timeout
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # pytest-asyncio 0.17.0 compat
-    "--asyncio-mode=auto"
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --timeout=9 --cov=hyperion" ""
-  '';
-
   pythonImportsCheck = [ "hyperion" ];
 
   meta = with lib; {
     description = "Python package for Hyperion Ambient Lighting";
     homepage = "https://github.com/dermotduffy/hyperion-py";
+    changelog = "https://github.com/dermotduffy/hyperion-py/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 9eabfdd0a426..4ae8f0d97060 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "9.2.5";
+  version = "10.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "ical";
     tag = version;
-    hash = "sha256-db7xwNN7xAoeqPngZNJxQNM2wLVcr7VpuG2IWswLCEE=";
+    hash = "sha256-vEVhZ7UBftXsB5xq1LhwitV2Gl6kcR5P0ReJ+71SQFY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/langfuse/default.nix b/pkgs/development/python-modules/langfuse/default.nix
index c5783e92994c..11447656a919 100644
--- a/pkgs/development/python-modules/langfuse/default.nix
+++ b/pkgs/development/python-modules/langfuse/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "langfuse";
-  version = "2.60.5";
+  version = "2.60.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langfuse";
     repo = "langfuse-python";
     tag = "v${version}";
-    hash = "sha256-DpfbebbONJ8+7mVouvULRbGs9t1cGjOZHhk3KvaY+gM=";
+    hash = "sha256-8IlqHO46Kzz+ifmIu2y5SxshNv/lpZO74b1KTE2Opk4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index 5740deda9663..58c7c5e67781 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -33,8 +33,12 @@ buildPythonPackage rec {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-K8hug7JeLPIvrqgVaONKfixu8XRvn+pnqS0fHV+nTqg=";
   };
 
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 2c28eaabbf35..1a38f699a0fb 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.20.7";
+  version = "0.20.8";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "mautrix";
     repo = "python";
     tag = "v${version}";
-    hash = "sha256-tOX/KQrECeEV3/0q3tpO4brUdalmw6IincF6pHzsEE8=";
+    hash = "sha256-giK8JZ6nzsA8SV6CzDNEbJmbwDju9t6fLJr/oXNjvKs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/numpy-groupies/default.nix b/pkgs/development/python-modules/numpy-groupies/default.nix
index 92f93774817c..36d3a343565f 100644
--- a/pkgs/development/python-modules/numpy-groupies/default.nix
+++ b/pkgs/development/python-modules/numpy-groupies/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "numpy-groupies";
-  version = "0.11.2";
+  version = "0.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ml31415";
     repo = "numpy-groupies";
     tag = "v${version}";
-    hash = "sha256-Eu+5SR28jIasKe1p7rvbq2yo3PGZRQWWdG3A5vGhnyM=";
+    hash = "sha256-pg9hOtIgS8pB/Y9Xqto9Omsdg8TxaA5ZGE1Qh1DCceU=";
   };
 
   build-system = [
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/ml31415/numpy-groupies";
-    changelog = "https://github.com/ml31415/numpy-groupies/releases/tag/v${version}";
+    changelog = "https://github.com/ml31415/numpy-groupies/releases/tag/${src.tag}";
     description = "Optimised tools for group-indexing operations: aggregated sum and more";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ berquist ];
diff --git a/pkgs/development/python-modules/primp/default.nix b/pkgs/development/python-modules/primp/default.nix
index 4c3d72fbc39a..3a7f8da6f22e 100644
--- a/pkgs/development/python-modules/primp/default.nix
+++ b/pkgs/development/python-modules/primp/default.nix
@@ -25,11 +25,11 @@ let
     modRoot = "./src";
     patches = [
       # A patch required to build boringssl compatible with `boring-sys2`.
-      # See https://github.com/0x676e67/boring2/blob/1a0f1cd24e728aac100df68027c820f858199224/boring-sys/build/main.rs#L486-L489
+      # See https://github.com/0x676e67/boring2/blob/refs/tags/v4.15.11/boring-sys/build/main.rs#L486-L489
       (fetchpatch {
         name = "boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
-        url = "https://raw.githubusercontent.com/0x676e67/boring2/4edbff8cade24d5d83cc372c4502b59c5192b5a1/boring-sys/patches/boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
-        hash = "sha256-lM+2lLvfDHnxLl+OgZ6R8Y4Z6JfA9AiDqboT1mbxmao=";
+        url = "https://raw.githubusercontent.com/0x676e67/boring2/refs/tags/v4.15.11/boring-sys/patches/boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
+        hash = "sha256-JRRATcCXo0HBQTzgCAuLpxC3NEGrTw1cEmC0VHOgO2M=";
       })
     ];
 
@@ -45,7 +45,11 @@ let
       oa.env.NIX_CFLAGS_COMPILE
       + " "
       + toString (
-        lib.optionals stdenv.cc.isGNU [
+        lib.optionals stdenv.cc.isClang [
+          "-Wno-error=reorder-ctor"
+        ]
+        ++ lib.optionals stdenv.cc.isGNU [
+          "-Wno-error=reorder"
           "-Wno-error=ignored-attributes"
         ]
       );
@@ -61,19 +65,19 @@ let
 in
 buildPythonPackage rec {
   pname = "primp";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deedy5";
     repo = "primp";
     tag = "v${version}";
-    hash = "sha256-LrSygeioJlccOH1oyagw02ankkZK+H6Mzrgy8tB83mo=";
+    hash = "sha256-13o0Ni0dvZaoKgYy2cFQhebwKAJGm5Z2s+gVAddxYxU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-iPf25DMGNHrWYByNTylB6bPpLfzs0ADwgkjfhVxiiXA=";
+    hash = "sha256-UBpf9f3wJgbizHERsm83cuKHiMixj/8JX/IGvteySIo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/py-sucks/default.nix b/pkgs/development/python-modules/py-sucks/default.nix
index 281228398f7e..efff0337b295 100644
--- a/pkgs/development/python-modules/py-sucks/default.nix
+++ b/pkgs/development/python-modules/py-sucks/default.nix
@@ -14,32 +14,37 @@
 
 buildPythonPackage rec {
   pname = "py-sucks";
-  version = "0.9.10";
+  version = "0.9.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "py-sucks";
     tag = "v${version}";
-    hash = "sha256-MjlE5HdxChAgV/O7cD3foqkmKie7FgRRxvOcW+NAtfA=";
+    hash = "sha256-srj/3x04R9KgbdC6IgbQdgUz+srAx0OttB6Ndb2+Nh4=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
-    click
-    pycountry-convert
     pycryptodome
     requests
     sleekxmppfs
   ];
 
+  optional-dependencies = {
+    cli = [
+      click
+      pycountry-convert
+    ];
+  };
+
   pythonImportsCheck = [ "sucks" ];
 
   nativeCheckInputs = [
     requests-mock
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   disabledTests = [
     # assumes $HOME is at a specific place
@@ -47,7 +52,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/mib1185/py-sucks/releases/tag/v${version}";
+    changelog = "https://github.com/mib1185/py-sucks/releases/tag/${src.tag}";
     description = "Library for controlling certain robot vacuums";
     homepage = "https://github.com/mib1185/py-sucks";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/pynitrokey/default.nix b/pkgs/development/python-modules/pynitrokey/default.nix
index 7d71afb25bec..1586313a8823 100644
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@@ -30,7 +30,7 @@
 
 let
   pname = "pynitrokey";
-  version = "0.8.4";
+  version = "0.8.5";
   mainProgram = "nitropy";
 in
 
@@ -40,7 +40,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Sr3ecKyIjsemM2G72BQR0S5YzfXA0nK9i29yKNie9Ys=";
+    hash = "sha256-mPhH4IdpKKA9d8sJOGMWpGerzki5qZHFHe4u4ao2RgE=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/python-debian/default.nix b/pkgs/development/python-modules/python-debian/default.nix
index c94707bc8a9b..0f638282e50f 100644
--- a/pkgs/development/python-modules/python-debian/default.nix
+++ b/pkgs/development/python-modules/python-debian/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-debian";
-  version = "0.1.52";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "python-debian-team";
     repo = "python-debian";
     tag = version;
-    hash = "sha256-+c+AiUCnpasOLbY6K4cuKUb6Ojwn0py78fL5W24WRwU=";
+    hash = "sha256-lSKtlBqAa8cJZZHMVb90eYIGem4DwVZLldaYSAJBNek=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytubefix/default.nix b/pkgs/development/python-modules/pytubefix/default.nix
index 4091e62307de..cf1e8abd0334 100644
--- a/pkgs/development/python-modules/pytubefix/default.nix
+++ b/pkgs/development/python-modules/pytubefix/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytubefix";
-  version = "9.0.1";
+  version = "9.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JuanBindez";
     repo = "pytubefix";
     tag = "v${version}";
-    hash = "sha256-TIrt20FAQumtDisscY9jcJY+Cuh1zA92hU3HVmwr4Bk=";
+    hash = "sha256-OKOP1kDPYXMQkVOITSxYqMYQvtVom8VCaLnCBYEhgR8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyyaml-ft/default.nix b/pkgs/development/python-modules/pyyaml-ft/default.nix
index 5106be721f67..433f95f4db6e 100644
--- a/pkgs/development/python-modules/pyyaml-ft/default.nix
+++ b/pkgs/development/python-modules/pyyaml-ft/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyyaml";
+  pname = "pyyaml-ft";
   version = "7.0.1";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index 59b509aa942d..dda175d64495 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.1.6";
+  version = "2.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     tag = "v${version}";
-    hash = "sha256-+tZMg0AmfmAFOqUQhOl+vHQVF1DApZbVNjGV4BkGRTg=";
+    hash = "sha256-OMi8788F2qjMOVDLuJLVReqNv7c/DpXTy1UpqoKRmnQ=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest
diff --git a/pkgs/development/python-modules/simsimd/default.nix b/pkgs/development/python-modules/simsimd/default.nix
index 9302bb24ee82..d01b7de53831 100644
--- a/pkgs/development/python-modules/simsimd/default.nix
+++ b/pkgs/development/python-modules/simsimd/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "simsimd";
-  version = "6.4.4";
+  version = "6.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "simsimd";
     tag = "v${version}";
-    hash = "sha256-lOE8ZQlUZ0Y+3Lpm4H/ps4o0YO9k245lADxrfR3oI1E=";
+    hash = "sha256-FM1ge3opt0hwVSjNQWOAYeG6tDIwVLSbu9mZOJBxvJY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/sse-starlette/default.nix b/pkgs/development/python-modules/sse-starlette/default.nix
index 08691d5c5e2e..e64e15fe2c0a 100644
--- a/pkgs/development/python-modules/sse-starlette/default.nix
+++ b/pkgs/development/python-modules/sse-starlette/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "sse-starlette";
-  version = "2.3.5";
+  version = "2.3.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "sysid";
     repo = "sse-starlette";
     tag = "v${version}";
-    hash = "sha256-KTq8NwV4YhyfTLpsaF5jyrD3kyBcJ/xXtOwx4WvDFOo=";
+    hash = "sha256-7FlyV+TsVKGFsecONPm/Z50cCnyuUsr6pimPdc4Cs6c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/temporalio/default.nix b/pkgs/development/python-modules/temporalio/default.nix
index 63c45ee9f3f7..110d9a68b333 100644
--- a/pkgs/development/python-modules/temporalio/default.nix
+++ b/pkgs/development/python-modules/temporalio/default.nix
@@ -33,8 +33,12 @@ buildPythonPackage rec {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-9hP+zN6jcRmRhPmcZ4Zgp61IeS7gDPfsOvweAxKHnHM=";
   };
 
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index c50956c17ad5..fc1035dadcf4 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1390";
+  version = "3.0.1391";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-UOJ1NCWKFqcrU2uMX4qTy8ooFEy6TIrb1YTIthHspuM=";
+    hash = "sha256-bzxaCN2fXoZT2W8zpTg7DrBTmRfyUi2aVhrg+/Y1YkU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/yara-python/default.nix b/pkgs/development/python-modules/yara-python/default.nix
index aa3eea2d1975..c0e1bae93728 100644
--- a/pkgs/development/python-modules/yara-python/default.nix
+++ b/pkgs/development/python-modules/yara-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "yara-python";
-  version = "4.5.2";
+  version = "4.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = "yara-python";
     tag = "v${version}";
-    hash = "sha256-RXqazMg78eGxA4JPUqSx0PTcNDmrGjBt5m6OJTmshNU=";
+    hash = "sha256-2ZwLpkT46KNTQ1ymvMGjnrfHQaIy/rXid0kXoCBixXA=";
   };
 
   # undefined symbol: yr_finalize
diff --git a/pkgs/kde/gear/akonadi-search/default.nix b/pkgs/kde/gear/akonadi-search/default.nix
index 7d46f87af0e1..03b37bb7bc7e 100644
--- a/pkgs/kde/gear/akonadi-search/default.nix
+++ b/pkgs/kde/gear/akonadi-search/default.nix
@@ -14,9 +14,8 @@ mkKdeDerivation rec {
   cargoRoot = "agent/rs/htmlparser";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version;
+    inherit pname version cargoRoot;
     src = sources.${pname};
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
     hash = "sha256-hdm4LfQcs4TTfBLzlZYJ0uzqfLxMXuYQExLGJg81W2U=";
   };
 
diff --git a/pkgs/kde/gear/kdepim-addons/default.nix b/pkgs/kde/gear/kdepim-addons/default.nix
index b898e5d6410f..edae47c991bc 100644
--- a/pkgs/kde/gear/kdepim-addons/default.nix
+++ b/pkgs/kde/gear/kdepim-addons/default.nix
@@ -17,9 +17,8 @@ mkKdeDerivation rec {
   cargoRoot = "plugins/webengineurlinterceptor/adblock";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version;
+    inherit pname version cargoRoot;
     src = sources.${pname};
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
     hash = "sha256-66FqoD3JoPbtg6zc32uaPYaTo4zHxywiN8wPI2jtcjc=";
   };
 
diff --git a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
index d61c13f57f0d..7775b1ea0261 100644
--- a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildHomeAssistantComponent,
   fetchFromGitHub,
+  aiofiles,
   shapely,
   pytestCheckHook,
   pytest-homeassistant-custom-component,
@@ -11,16 +12,17 @@
 buildHomeAssistantComponent rec {
   owner = "amitfin";
   domain = "oref_alert";
-  version = "2.20.1";
+  version = "2.21.1";
 
   src = fetchFromGitHub {
     owner = "amitfin";
     repo = "oref_alert";
     tag = "v${version}";
-    hash = "sha256-EsDGH7/newjHRYu4Lr5UkJ3qaaNupqlhe5CdffEpIVg=";
+    hash = "sha256-ov/smP7rflRfQMqYduTxDAYj5xQkpZJSzIQZrP0YADQ=";
   };
 
   dependencies = [
+    aiofiles
     shapely
   ];
 
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
index bf50a0ca5e20..847e8209fa87 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@@ -6,18 +6,18 @@
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.5.2";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-woplybqlpx+xJdLJ0RWgDp3mR1l8Ntt+JA0SVyFaDQA=";
+    hash = "sha256-AxPpKp7SjeSB8VqclDJgkArC9zmjIkLQx+RBWQX0sLM=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-YN+Ftv5gEwXHqoO7KAyijZMS6g6i3bKbEnvoVLakrTQ=";
+  npmDepsHash = "sha256-KFgo1sKwCLmW0Il4tK2L+giF3th+YvVUWG3n+3HkRg4=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index e2d621e9cdc6..43cb08c137ba 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.8";
+  version = "2.0.9";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-x8U4L8taZHpc5v7QuWch6UGY+i9XJc9RJPW2URsF3+8=";
+    hash = "sha256-iu0N70FNf0m2iOgmeXUT6VGC7L17b4tvAl5Se4UGXAI=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 1e9b4618c1b6..88c636048ab4 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -243,8 +243,12 @@ let
           };
           cargoRoot = "src/_bcrypt";
           cargoDeps = rustPlatform.fetchCargoVendor {
-            inherit pname version src;
-            sourceRoot = "${pname}-${version}/${cargoRoot}";
+            inherit
+              pname
+              version
+              src
+              cargoRoot
+              ;
             hash = "sha256-8PyCgh/rUO8uynzGdgylAsb5k55dP9fCnf40UOTCR/M=";
           };
         });
diff --git a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
index 0ecf97dc27b5..5d82beffd690 100644
--- a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
+++ b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
@@ -42,8 +42,12 @@ buildPythonPackage rec {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-pZHu3Oo9DWRAtldU0UvrH1FIg0bEvyfizPUhj9IBL58=";
   };
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f9062d9b4b8f..58fd81d447cf 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1391,6 +1391,7 @@ mapAliases {
   oauth2_proxy = throw "'oauth2_proxy' has been renamed to/replaced by 'oauth2-proxy'"; # Converted to throw 2024-10-17
   ocis-bin = throw "ocis-bin has been renamed to ocis_5-bin'. Future major.minor versions will be made available as separate packages"; # Added 2025-03-30
   odoo15 = throw "odoo15 has been removed from nixpkgs as it is unsupported; migrate to a newer version of odoo"; # Added 2025-05-06
+  offrss = throw "offrss has been removed due to lack of upstream maintenance; consider using another rss reader"; # Added 2025-06-01
   oil = lib.warnOnInstantiate "Oil has been replaced with the faster native C++ version and renamed to 'oils-for-unix'. See also https://github.com/oils-for-unix/oils/wiki/Oils-Deployments" oils-for-unix; # Added 2024-10-22
   onevpl-intel-gpu = lib.warnOnInstantiate "onevpl-intel-gpu has been renamed to vpl-gpu-rt" vpl-gpu-rt; # Added 2024-06-04
   openai-whisper-cpp = whisper-cpp; # Added 2024-12-13
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 11840d79dcf7..0fd890051e36 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16928,8 +16928,6 @@ with pkgs;
 
   yaziPlugins = recurseIntoAttrs (callPackage ../by-name/ya/yazi/plugins { });
 
-  animdl = python3Packages.callPackage ../applications/video/animdl { };
-
   dillo = callPackage ../by-name/di/dillo/package.nix {
     fltk = fltk13;
   };