diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 8cc523d1bef3..c887638ab9b8 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -19,54 +19,14 @@ jobs:
   get-merge-commit:
     uses: ./.github/workflows/get-merge-commit.yml
 
-  attrs:
-    name: Attributes
-    runs-on: ubuntu-24.04-arm
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
-    outputs:
-      targetSha: ${{ steps.targetSha.outputs.targetSha }}
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          fetch-depth: 2
-          path: nixpkgs
-
-      - name: Determine target commit
-        if: github.event_name == 'pull_request_target'
-        id: targetSha
-        run: |
-          targetSha=$(git -C nixpkgs rev-parse HEAD^1)
-          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Evaluate the list of all attributes and get the systems matrix
-        id: systems
-        run: |
-          nix-build nixpkgs/ci -A eval.attrpathsSuperset
-          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"
-
-      - name: Upload the list of all attributes
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: paths
-          path: result/*
-
   outpaths:
     name: Outpaths
     runs-on: ubuntu-24.04-arm
-    needs: [ attrs, get-merge-commit ]
+    needs: [ get-merge-commit ]
     strategy:
       fail-fast: false
       matrix:
-        system: ${{ fromJSON(needs.attrs.outputs.systems) }}
+        system: ${{ fromJSON(needs.get-merge-commit.outputs.systems) }}
     steps:
       - name: Enable swap
         run: |
@@ -75,12 +35,6 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - name: Download the list of all attributes
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: paths
-          path: paths
-
       - name: Check out the PR at the test merge commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -98,7 +52,6 @@ jobs:
         run: |
           nix-build nixpkgs/ci -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg attrpathFile ./paths/paths.json \
             --arg chunkSize 10000
           # If it uses too much memory, slightly decrease chunkSize
 
@@ -111,7 +64,7 @@ jobs:
   process:
     name: Process
     runs-on: ubuntu-24.04-arm
-    needs: [ outpaths, attrs, get-merge-commit ]
+    needs: [ outpaths, get-merge-commit ]
     outputs:
       targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
     steps:
@@ -146,7 +99,7 @@ jobs:
           path: prResult/*
 
       - name: Get target run id
-        if: needs.attrs.outputs.targetSha
+        if: needs.get-merge-commit.outputs.targetSha
         id: targetRunId
         run: |
           # Get the latest eval.yml workflow run for the PR's target commit
@@ -175,7 +128,7 @@ jobs:
           echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
         env:
           REPOSITORY: ${{ github.repository }}
-          TARGET_SHA: ${{ needs.attrs.outputs.targetSha }}
+          TARGET_SHA: ${{ needs.get-merge-commit.outputs.targetSha }}
           GH_TOKEN: ${{ github.token }}
 
       - uses: actions/download-artifact@v4
@@ -189,8 +142,8 @@ jobs:
       - name: Compare against the target branch
         if: steps.targetRunId.outputs.targetRunId
         run: |
-          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}
-          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \
+          git -C nixpkgs worktree add ../target ${{ needs.get-merge-commit.outputs.targetSha }}
+          git -C nixpkgs diff --name-only ${{ needs.get-merge-commit.outputs.targetSha }} \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
 
           # Use the target branch to get accurate maintainer info
@@ -213,7 +166,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-24.04-arm
-    needs: [ attrs, process ]
+    needs: [ process ]
     if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write
@@ -244,7 +197,7 @@ jobs:
       - name: Check out Nixpkgs at the base commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ needs.attrs.outputs.targetSha }}
+          ref: ${{ needs.get-merge-commit.outputs.targetSha }}
           path: base
           sparse-checkout: ci
 
diff --git a/.github/workflows/get-merge-commit.yml b/.github/workflows/get-merge-commit.yml
index cb38438cae3b..7d8dd03fbf66 100644
--- a/.github/workflows/get-merge-commit.yml
+++ b/.github/workflows/get-merge-commit.yml
@@ -6,6 +6,12 @@ on:
       mergedSha:
         description: "The merge commit SHA"
         value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
+      targetSha:
+        description: "The target commit SHA"
+        value: ${{ jobs.resolve-merge-commit.outputs.targetSha }}
+      systems:
+        description: "The supported systems"
+        value: ${{ jobs.resolve-merge-commit.outputs.systems }}
 
 permissions: {}
 
@@ -14,6 +20,8 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       mergedSha: ${{ steps.merged.outputs.mergedSha }}
+      targetSha: ${{ steps.merged.outputs.targetSha }}
+      systems: ${{ steps.systems.outputs.systems }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -31,13 +39,17 @@ jobs:
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
             pull_request_target)
-              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the merge commit $mergedSha"
-                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+              if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+                echo "Checking the commits:\n$commits"
+                echo "$commits" >> "$GITHUB_OUTPUT"
               else
                 # Skipping so that no notifications are sent
                 echo "Skipping the rest..."
               fi
               ;;
           esac
-          rm -rf base
+
+      - name: Load supported systems
+        id: systems
+        run: |
+          echo "systems=$(jq -c <base/ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
diff --git a/ci/README.md b/ci/README.md
index a1b327de4e5d..6ef665e8b099 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -44,14 +44,14 @@ Why not just build the tooling right from the PRs Nixpkgs version?
 ## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`
 
 Check whether a PR is mergeable and return the test merge commit as
-[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests).
+[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests) and its parent.
 
 Arguments:
 - `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
 - `PR_NUMBER`: The PR number, e.g. `1234`
 
 Exit codes:
-- 0: The PR can be merged, the test merge commit hash is returned on stdout
+- 0: The PR can be merged, the hashes of the test merge commit and the target commit are returned on stdout
 - 1: The PR cannot be merged because it's not open anymore
 - 2: The PR cannot be merged because it has a merge conflict
 - 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
diff --git a/ci/eval/README.md b/ci/eval/README.md
index 0436a028ed69..011f3dd74ed0 100644
--- a/ci/eval/README.md
+++ b/ci/eval/README.md
@@ -11,7 +11,7 @@ nix-build ci -A eval.full \
   --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
 ```
 
-- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.nix) gets a separate derivation, so it doesn't make sense to set this higher than that number.
+- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.
 - `--cores`: The number of cores to use for each job. Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
 - `chunkSize`: The number of attributes that are evaluated simultaneously on a single core. Lowering this decreases memory usage at the cost of increased evaluation time. If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
 - `evalSystems`: The set of systems for which `nixpkgs` should be evaluated. Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 639e75ec4211..e3f035e18d56 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -26,14 +26,14 @@ let
           "nixos"
           "pkgs"
           ".version"
-          "ci/supportedSystems.nix"
+          "ci/supportedSystems.json"
         ]
       );
     };
 
   nix = nixVersions.nix_2_24;
 
-  supportedSystems = import ../supportedSystems.nix;
+  supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);
 
   attrpathsSuperset =
     runCommand "attrpaths-superset.json"
@@ -43,8 +43,6 @@ let
           nix
           time
         ];
-        env.supportedSystems = builtins.toJSON supportedSystems;
-        passAsFile = [ "supportedSystems" ];
       }
       ''
         export NIX_STATE_DIR=$(mktemp -d)
@@ -58,7 +56,6 @@ let
             --option restrict-eval true \
             --option allow-import-from-derivation false \
             --arg enableWarnings false > $out/paths.json
-        mv "$supportedSystemsPath" $out/systems.json
       '';
 
   singleSystem =
@@ -68,7 +65,7 @@ let
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem,
       # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile,
+      attrpathFile ? "${attrpathsSuperset}/paths.json",
       # The number of attributes per chunk, see ./README.md for more info.
       chunkSize,
       checkMeta ? true,
@@ -289,7 +286,6 @@ let
           name = evalSystem;
           path = singleSystem {
             inherit quickTest evalSystem chunkSize;
-            attrpathFile = attrpathsSuperset + "/paths.json";
           };
         }) evalSystems
       );
diff --git a/ci/get-merge-commit.sh b/ci/get-merge-commit.sh
index c62bb56dd993..c233f7f91691 100755
--- a/ci/get-merge-commit.sh
+++ b/ci/get-merge-commit.sh
@@ -55,7 +55,10 @@ done
 
 if [[ "$mergeable" == "true" ]]; then
     log "The PR can be merged"
-    jq -r .merge_commit_sha <<< "$prInfo"
+    mergedSha="$(jq -r .merge_commit_sha <<< "$prInfo")"
+    echo "mergedSha=$mergedSha"
+    targetSha="$(gh api "/repos/$repo/commits/$mergedSha" --jq '.parents[0].sha')"
+    echo "targetSha=$targetSha"
 else
     log "The PR has a merge conflict"
     exit 2
diff --git a/ci/supportedSystems.json b/ci/supportedSystems.json
new file mode 100644
index 000000000000..44c18f1abf0e
--- /dev/null
+++ b/ci/supportedSystems.json
@@ -0,0 +1,6 @@
+[
+  "aarch64-linux",
+  "aarch64-darwin",
+  "x86_64-linux",
+  "x86_64-darwin"
+]
diff --git a/ci/supportedSystems.nix b/ci/supportedSystems.nix
deleted file mode 100644
index 471f84b92fc2..000000000000
--- a/ci/supportedSystems.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-[
-  "aarch64-linux"
-  "aarch64-darwin"
-  "x86_64-linux"
-  "x86_64-darwin"
-]
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 05da2a8b7b3d..d023db3e0b4c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5802,7 +5802,7 @@
     email = "me@dblsaiko.net";
     github = "2xsaiko";
     githubId = 3987560;
-    name = "Marco Rebhan";
+    name = "Katalin Rebhan";
   };
   dbohdan = {
     email = "dbohdan@dbohdan.com";
@@ -10735,6 +10735,12 @@
     githubId = 49885246;
     keys = [ { fingerprint = "6358 EF87 86E0 EF2F 1628  103F BAB5 F165 1C71 C9C3"; } ];
   };
+  ivalery111 = {
+    name = "Valery";
+    email = "ivalery111@gmail.com";
+    github = "ivalery111";
+    githubId = 37245535;
+  };
   ivan = {
     email = "ivan@ludios.org";
     github = "ivan";
diff --git a/nixos/modules/image/file-options.nix b/nixos/modules/image/file-options.nix
index dff30e7408af..4a6b377111a0 100644
--- a/nixos/modules/image/file-options.nix
+++ b/nixos/modules/image/file-options.nix
@@ -9,6 +9,7 @@
     baseName = lib.mkOption {
       type = lib.types.str;
       default = "nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+      defaultText = lib.literalExpression "nixos-image-\${config.system.nixos.label}-\${pkgs.stdenv.hostPlatform.system}";
       description = ''
         Basename of the image filename without any extension (e.g. `image_1`).
       '';
@@ -29,6 +30,7 @@
     fileName = lib.mkOption {
       type = lib.types.str;
       default = "${config.image.baseName}.${config.image.extension}";
+      defaultText = lib.literalExpression "\${config.image.baseName}.\${config.image.extension}";
       description = ''
         Filename of the image including all extensions (e.g `image_1.raw` or
         `image_1.raw.zst`).
@@ -38,6 +40,7 @@
     filePath = lib.mkOption {
       type = lib.types.str;
       default = config.image.fileName;
+      defaultText = lib.literalExpression "config.image.fileName";
       description = ''
         Path of the image, relative to `$out` in `system.build.image`.
         While it defaults to `config.image.fileName`, it can be different for builders where
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index db026870d4fc..891bfeb30449 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -88,6 +88,31 @@ in
 {
   imports = [
     ./repart-verity-store.nix
+    ./file-options.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "image"
+        "repart"
+        "imageFileBasename"
+      ];
+      to = [
+        "image"
+        "baseName"
+      ];
+    })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "image"
+        "repart"
+        "imageFile"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options.image.repart = {
@@ -95,7 +120,7 @@ in
     name = lib.mkOption {
       type = lib.types.str;
       description = ''
-        Name of the image.
+          Name of the image.
 
         If this option is unset but config.system.image.id is set,
         config.system.image.id is used as the default value.
@@ -109,23 +134,6 @@ in
       description = "Version of the image";
     };
 
-    imageFileBasename = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      description = ''
-        Basename of the image filename without any extension (e.g. `image_1`).
-      '';
-    };
-
-    imageFile = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      description = ''
-        Filename of the image including all extensions (e.g `image_1.raw` or
-        `image_1.raw.zst`).
-      '';
-    };
-
     compression = {
       enable = lib.mkEnableOption "Image compression";
 
@@ -152,7 +160,7 @@ in
       # Generated with `uuidgen`. Random but fixed to improve reproducibility.
       default = "0867da16-f251-457d-a9e8-c31f9a3c220b";
       description = ''
-        A UUID to use as a seed. You can set this to `null` to explicitly
+          A UUID to use as a seed. You can set this to `null` to explicitly
         randomize the partition UUIDs.
       '';
     };
@@ -161,7 +169,7 @@ in
       type = lib.types.bool;
       default = false;
       description = ''
-        Enables generation of split artifacts from partitions. If enabled, for
+          Enables generation of split artifacts from partitions. If enabled, for
         each partition with SplitName= set, a separate output file containing
         just the contents of that partition is generated.
       '';
@@ -172,7 +180,7 @@ in
       default = 512;
       example = lib.literalExpression "4096";
       description = ''
-        The sector size of the disk image produced by systemd-repart. This
+          The sector size of the disk image produced by systemd-repart. This
         value must be a power of 2 between 512 and 4096.
       '';
     };
@@ -191,7 +199,7 @@ in
       type = with lib.types; attrsOf (submodule partitionOptions);
       default = { };
       example = lib.literalExpression ''
-        {
+          {
           "10-esp" = {
             contents = {
               "/EFI/BOOT/BOOTX64.EFI".source =
@@ -213,7 +221,7 @@ in
         };
       '';
       description = ''
-        Specify partitions as a set of the names of the partitions with their
+          Specify partitions as a set of the names of the partitions with their
         configuration as the key.
       '';
     };
@@ -222,12 +230,12 @@ in
       type = with lib.types; attrsOf (listOf str);
       default = { };
       example = lib.literalExpression ''
-        {
+          {
           vfat = [ "-S 512" "-c" ];
         }
       '';
       description = ''
-        Specify extra options for created file systems. The specified options
+          Specify extra options for created file systems. The specified options
         are converted to individual environment variables of the format
         `SYSTEMD_REPART_MKFS_OPTIONS_<FSTYPE>`.
 
@@ -253,7 +261,6 @@ in
   };
 
   config = {
-
     assertions = lib.mapAttrsToList (
       fileName: partitionConfig:
       let
@@ -295,10 +302,14 @@ in
       ) cfg.partitions
     );
 
-    image.repart =
+    image.baseName =
       let
         version = config.image.repart.version;
         versionInfix = if version != null then "_${version}" else "";
+      in
+      cfg.name + versionInfix;
+    image.extension =
+      let
         compressionSuffix =
           lib.optionalString cfg.compression.enable
             {
@@ -308,6 +319,11 @@ in
             }
             ."${cfg.compression.algorithm}";
 
+      in
+      "raw" + compressionSuffix;
+
+    image.repart =
+      let
         makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };
 
         # Add the closure of the provided Nix store paths to cfg.partitions so
@@ -321,9 +337,6 @@ in
       in
       {
         name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
-        imageFileBasename = cfg.name + versionInfix;
-        imageFile = cfg.imageFileBasename + ".raw" + compressionSuffix;
-
         compression = {
           # Generally default to slightly faster than default compression
           # levels under the assumption that most of the building will be done
@@ -357,10 +370,10 @@ in
       in
       pkgs.callPackage ./repart-image.nix {
         systemd = cfg.package;
+        imageFileBasename = config.image.baseName;
         inherit (cfg)
           name
           version
-          imageFileBasename
           compression
           split
           seed
diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index e7c133bceac1..bc91edbbe000 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -22,7 +22,7 @@ let
     secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
     domains = ${libconfuseDomains}
     separator = "${cfg.separator}"
-    socketmap = "unix:${runtimeDirectory}/socket"
+    socketmap = "unix:${cfg.socketPath}"
 
     # Disable postsrsd's jailing in favor of confinement with systemd.
     unprivileged-user = ""
@@ -93,6 +93,15 @@ in
         default = "postsrsd";
         description = "Group for the daemon";
       };
+
+      socketPath = lib.mkOption {
+        type = lib.types.path;
+        default = "${runtimeDirectory}/socket";
+        readOnly = true;
+        description = ''
+          Path to the Unix socket for connecting to postsrsd.
+          Read-only, intended for usage when integrating postsrsd into other NixOS config.'';
+      };
     };
   };
 
diff --git a/nixos/modules/services/networking/networkd-dispatcher.nix b/nixos/modules/services/networking/networkd-dispatcher.nix
index 99b56609a70f..eb874447bb3a 100644
--- a/nixos/modules/services/networking/networkd-dispatcher.nix
+++ b/nixos/modules/services/networking/networkd-dispatcher.nix
@@ -103,21 +103,29 @@ in
 
     services.networkd-dispatcher.extraArgs =
       let
-        scriptDir = pkgs.symlinkJoin {
-          name = "networkd-dispatcher-script-dir";
-          paths = lib.mapAttrsToList (
-            name: cfg:
-            (map (
-              state:
-              pkgs.writeTextFile {
-                inherit name;
-                text = cfg.script;
-                destination = "/${state}.d/${name}";
-                executable = true;
-              }
-            ) cfg.onState)
-          ) cfg.rules;
-        };
+        scriptDir = pkgs.runCommand "networkd-dispatcher-script-dir" { } (
+          ''
+            mkdir $out
+          ''
+          + (lib.concatStrings (
+            lib.mapAttrsToList (
+              name: cfg:
+              (lib.concatStrings (
+                map (state: ''
+                  mkdir -p $out/${state}.d
+                  ln -s ${
+                    lib.getExe (
+                      pkgs.writeShellApplication {
+                        inherit name;
+                        text = cfg.script;
+                      }
+                    )
+                  } $out/${state}.d/${name}
+                '') cfg.onState
+              ))
+            ) cfg.rules
+          ))
+        );
       in
       [
         "--verbose"
diff --git a/nixos/tests/netdata.nix b/nixos/tests/netdata.nix
index 97a033f831a1..77c34e70e7d0 100644
--- a/nixos/tests/netdata.nix
+++ b/nixos/tests/netdata.nix
@@ -33,12 +33,12 @@ import ./make-test-python.nix (
     };
 
     testScript = ''
-        start_all()
+      start_all()
 
-        netdata.wait_for_unit("netdata.service")
+      netdata.wait_for_unit("netdata.service")
 
-        # wait for the service to listen before sending a request
-        netdata.wait_for_open_port(19999)
+      # wait for the service to listen before sending a request
+      netdata.wait_for_open_port(19999)
 
       # check if the netdata main page loads.
       netdata.succeed("curl --fail http://127.0.0.1:19999")
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index c8e73a2f51b9..f038c61b53b5 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.23-unstable-2025-05-10";
+  version = "0.0.23-unstable-2025-05-12";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "adae032f5fbc611d59545792d3c5bb1c9ddc3fdb";
-    hash = "sha256-v99yu5LvwdmHBcH61L6JIqjQkZR8Lm2fR/uzQZNPo38=";
+    rev = "aae4cc4014149e544fb00e78687bcdef8335dd10";
+    hash = "sha256-ixJcD8V2rCLCrqE7hHtHfEtQuHeVyIDgyZ1VOY1jmD0=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
diff --git a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
new file mode 100644
index 000000000000..306df8c3cb55
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
+  mktplcRef = {
+    name = "amazon-q-vscode";
+    publisher = "AmazonWebServices";
+    version = "1.66.0";
+    hash = "sha256-EnNwlSmJWBcSfFCayxJS94qVUqgQlbX0RLCB4jJsn+4=";
+  };
+
+  meta = {
+    changelog = "https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv${finalAttrs.version}";
+    description = "Amazon Q, CodeCatalyst, Local Lambda debug, SAM/CFN syntax, ECS Terminal, AWS resources";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.amazon-q-vscode";
+    homepage = "https://github.com/aws/aws-toolkit-vscode";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+})
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d7af32418e9a..d8ab642fff23 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -254,6 +254,8 @@ let
         };
       };
 
+      amazonwebservices.amazon-q-vscode = callPackage ./amazonwebservices.amazon-q-vscode { };
+
       angular.ng-template = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "ng-template";
diff --git a/pkgs/by-name/aw/aws-sso-cli/package.nix b/pkgs/by-name/aw/aws-sso-cli/package.nix
index 99412edca5e0..edbaed61c55f 100644
--- a/pkgs/by-name/aw/aws-sso-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sso-cli/package.nix
@@ -9,15 +9,15 @@
 }:
 buildGoModule rec {
   pname = "aws-sso-cli";
-  version = "1.17.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "synfinatic";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VEI+vCNeNoFOE+2j/OUjRszXsUQP2E1iUdPUW9X3tHk=";
+    hash = "sha256-D6ytiuh335r1XHwX6riI5OkpA8C1Ta0EwD1yPwob2ms=";
   };
-  vendorHash = "sha256-a57RtK8PxwaRrSA6W6R//GacZ+pK8mBi4ZASS5NvShE=";
+  vendorHash = "sha256-SNMU7qDfLRGUSLjzrJHtIMgbcRc2DxXwWEUaUEY6PME=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index 2cb63e250917..dead16e648bf 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -96,6 +96,7 @@ stdenv.mkDerivation rec {
     homepage = "https://btrfs.readthedocs.io/en/latest/";
     changelog = "https://github.com/kdave/btrfs-progs/raw/v${version}/CHANGES";
     license = licenses.gpl2Only;
+    mainProgram = "btrfs";
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/by-name/cl/clorinde/package.nix b/pkgs/by-name/cl/clorinde/package.nix
index f1e211b01386..c6a4052d8999 100644
--- a/pkgs/by-name/cl/clorinde/package.nix
+++ b/pkgs/by-name/cl/clorinde/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clorinde";
-  version = "0.14.4";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "halcyonnouveau";
     repo = "clorinde";
     tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-ZCD8unHHA1yFKlmAaQw9zlJWAecu+j3/fwlp/ro2IFc=";
+    hash = "sha256-PUAySbgmbulSlkabABiSFeDDa+o0tQ2uQtiQGSqO1/w=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-V69c/Ks9qNmwqH4IV0uNDRc2eH7HMHpupE3liZofJhA=";
+  cargoHash = "sha256-zSeAD3MBflO+lhuLxH57YhR6wxsqZn62XQ0dgImdNLE=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 
diff --git a/pkgs/by-name/cm/cmctl/package.nix b/pkgs/by-name/cm/cmctl/package.nix
index c1c7bdc16b41..a443b7df1faf 100644
--- a/pkgs/by-name/cm/cmctl/package.nix
+++ b/pkgs/by-name/cm/cmctl/package.nix
@@ -7,34 +7,35 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "cmctl";
   version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cmctl";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Kr7vwVW6v08QRbJDs2u0vK241ljNfhLVYIQCBl31QSs=";
   };
 
-  vendorHash = "sha256-D83Ufpa7PLQWBCHX5d51me3aYprGzc9RoKVma2Ax1Is=";
+  vendorHash = "sha256-SYCWvt2K3MEow4cDKxLSK+Bp0hZG9rNI9PoXdPcPESg=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/cert-manager/cert-manager/pkg/util.AppVersion=v${version}"
-    "-X github.com/cert-manager/cert-manager/pkg/util.AppGitCommit=${src.rev}"
+    "-X github.com/cert-manager/cert-manager/pkg/util.AppVersion=v${finalAttrs.version}"
+    "-X github.com/cert-manager/cert-manager/pkg/util.AppGitCommit=${finalAttrs.src.rev}"
   ];
 
+  # integration tests require running etcd, kubernetes
+  postPatch = ''
+    rm -r test/integration
+  '';
+
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  checkPhase = ''
-    go test --race $(go list ./... | grep -v /test/)
-  '';
-
   # Trusted by this computer: no: x509: “cert-manager” certificate is not
   # trusted
   doCheck = !stdenv.hostPlatform.isDarwin;
@@ -46,7 +47,9 @@ buildGoModule rec {
         --zsh <($out/bin/cmctl completion zsh)
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Command line utility to interact with a cert-manager instalation on Kubernetes";
     mainProgram = "cmctl";
     longDescription = ''
@@ -63,8 +66,8 @@ buildGoModule rec {
       resources inside your Kubernetes cluster.
     '';
     downloadPage = "https://github.com/cert-manager/cmctl";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     homepage = "https://cert-manager.io/";
-    maintainers = with maintainers; [ joshvanl ];
+    maintainers = with lib.maintainers; [ joshvanl ];
   };
-}
+})
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index b9f696dc1eb6..30777342646c 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -32,6 +32,7 @@
   pkg-config,
   polkit,
   python3Packages,
+  sscg,
   systemd,
   udev,
   xmlto,
@@ -167,6 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix PATH : ${
         lib.makeBinPath [
           coreutils
+          sscg
           openssl
         ]
       } \
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 9a60b0d10629..60de831b46f1 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -22,14 +22,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.4.1";
+  version = "2025.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     tag = version;
-    hash = "sha256-EWSV87z0Npsf/1lDzbk2s4Phx0tZJZnMzubaX+W6fAY=";
+    hash = "sha256-vy/wjtl/IbdSOxAUsV4bl7VNEBTetsvIDh2V1gDHSMs=";
   };
 
   build-systems = with python.pkgs; [
diff --git a/pkgs/by-name/gi/gitlab-ci-ls/package.nix b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
index c38041e4f577..29a8de572a53 100644
--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitlab-ci-ls";
-  version = "1.0.4";
+  version = "1.0.5";
   src = fetchFromGitHub {
     owner = "alesbrelih";
     repo = "gitlab-ci-ls";
     rev = "${version}";
-    hash = "sha256-rgdrbPqpdQlIVcQMLAi2rtTPpeWj+azbm6FaqUBHIIw=";
+    hash = "sha256-nfcG1fGmWutWwyROlTEnKN2+wPVmDkN0Z1VKdZDHGmU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WjTfIKWu5fivPXmlGXduHWA5dKmKz2620tprtuoJbD4=";
+  cargoHash = "sha256-I8LSN50uSEAGAlaQzscAZWUqRpLUq+7gfzdj0UPkg4o=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index eaecba550352..6ce676e19d7a 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-03-31";
+  version = "0.1-unstable-2025-05-12";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "bc2ad24e0b2e66c3e164994c4897cd94a933fd10";
-    hash = "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=";
+    rev = "8e6c02ac3dfbff878ef300266598737ee9cedf94";
+    hash = "sha256-VKs/GtedyOrcWiEOf9JPPX6ZgKzngXTVMUlqsL60G/c=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";
diff --git a/pkgs/by-name/im/imposm/package.nix b/pkgs/by-name/im/imposm/package.nix
index b10bc79f450e..c09ae89cadd5 100644
--- a/pkgs/by-name/im/imposm/package.nix
+++ b/pkgs/by-name/im/imposm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "imposm";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "omniscale";
     repo = "imposm3";
     tag = "v${version}";
-    hash = "sha256-PF7pi2UTZJe7WzfaJrQrOGusO/RRfh8KNz8YyrVcBvg=";
+    hash = "sha256-Bl6LSF/aN/c0lH93fxm2HGvxs7Grv4qJc/iN04AlQP0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ja/jai/package.nix b/pkgs/by-name/ja/jai/package.nix
index 6ca0060f3c64..cd255c330a8d 100644
--- a/pkgs/by-name/ja/jai/package.nix
+++ b/pkgs/by-name/ja/jai/package.nix
@@ -9,7 +9,7 @@
 let
   pname = "jai";
   minor = "2";
-  patch = "010";
+  patch = "011";
   version = "0.${minor}.${patch}";
   zipName = "jai-beta-${minor}-${patch}.zip";
   jai = stdenv.mkDerivation {
@@ -20,7 +20,7 @@ let
           nix-store --add-fixed sha256 ${zipName}
       '';
       name = zipName;
-      sha256 = "sha256-7S0DFvmiKEvmCT12ukwLu+SSitk4y6BuS6WWCImeOhc=";
+      sha256 = "sha256-Du4rTA2g7hjlsUA/hvPY6O6L34e/MmnUN8rzi1jF/dY";
     };
     nativeBuildInputs = [ unzip ];
     buildCommand = "unzip $src -d $out";
diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index 11db8c5557ad..71da7705ebd3 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "jjui";
-  version = "0.8.6";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FfodDPHMNiB4vh+v+m2k6x9o82idHM68Os9OuXpyVGY=";
+    hash = "sha256-5gDEcwS14Hur/Mw/vALPU+EVC5BJxdgjFbpzz1kcSKM=";
   };
 
   vendorHash = "sha256-YlOK+NvyH/3uvvFcCZixv2+Y2m26TP8+ohUSdl3ppro=";
diff --git a/pkgs/by-name/ka/karabiner-elements/package.nix b/pkgs/by-name/ka/karabiner-elements/package.nix
index f7c02f9bf9fa..881b6c3f6816 100644
--- a/pkgs/by-name/ka/karabiner-elements/package.nix
+++ b/pkgs/by-name/ka/karabiner-elements/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "karabiner-elements";
-  version = "15.0.0";
+  version = "15.3.0";
 
   src = fetchurl {
     url = "https://github.com/pqrs-org/Karabiner-Elements/releases/download/v${finalAttrs.version}/Karabiner-Elements-${finalAttrs.version}.dmg";
-    hash = "sha256-xWCsbkP9cVnDjWFTgWl5KrR7wEpcQYM4Md99pTI/l14=";
+    hash = "sha256-Szf2mBC8c4JA3Ky4QPTvS4GJ0PXFbN0Y7Rpum9lRABE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/kc/kcl-language-server/package.nix b/pkgs/by-name/kc/kcl-language-server/package.nix
new file mode 100644
index 000000000000..22108ca4195e
--- /dev/null
+++ b/pkgs/by-name/kc/kcl-language-server/package.nix
@@ -0,0 +1,53 @@
+{
+  fetchFromGitHub,
+  kcl,
+  lib,
+  pkg-config,
+  protobuf,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "kcl-language-server";
+  version = "0.11.2";
+
+  src = fetchFromGitHub {
+    owner = "kcl-lang";
+    repo = "kcl";
+    rev = "v${version}";
+    hash = "sha256-6XDLxTpgENhP7F51kicAJB7BNMtX4cONKJApAhqgdno=";
+  };
+
+  sourceRoot = "${src.name}/kclvm";
+
+  cargoHash = "sha256-eJ3Gh2l6T2DxJRQRHamPOr/ILtzsqFB497DdXVJ90RE=";
+
+  PROTOC = "${protobuf}/bin/protoc";
+  PROTOC_INCLUDE = "${protobuf}/include";
+
+  buildAndTestSubdir = "tools/src/LSP";
+
+  buildPhaseCargoFlags = [
+    "--profile"
+    "release"
+    "--offline"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/kcl-lang/kcl/releases/tag/v${version}";
+    description = "A high-performance implementation of KCL written in Rust that uses LLVM as the compiler backend";
+    downloadPage = "https://github.com/kcl-lang/kcl/tree/v${version}/kclvm/tools/src/LSP";
+    homepage = "https://www.kcl-lang.io/";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = kcl.meta.maintainers;
+    mainProgram = "kcl-language-server";
+  };
+}
diff --git a/pkgs/by-name/le/lemminx/package.nix b/pkgs/by-name/le/lemminx/package.nix
index 74ec6ee81028..d8725383d944 100644
--- a/pkgs/by-name/le/lemminx/package.nix
+++ b/pkgs/by-name/le/lemminx/package.nix
@@ -25,13 +25,13 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "lemminx";
-  version = "0.30.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "lemminx";
     rev = version;
-    hash = "sha256-DkJaSEWmQV1vkC+knJNIDzVPyAYtf2lFZUpGhDTJXLE=";
+    hash = "sha256-a+9RN1265fsmYAUMuUTxA+VqJv7xPlzuc8HqoZwmR4M=";
     # Lemminx reads this git information at runtime from a git.properties
     # file on the classpath
     leaveDotGit = true;
diff --git a/pkgs/by-name/li/libchewing/package.nix b/pkgs/by-name/li/libchewing/package.nix
index 65d60e19eaff..a7d80e3a8a08 100644
--- a/pkgs/by-name/li/libchewing/package.nix
+++ b/pkgs/by-name/li/libchewing/package.nix
@@ -4,31 +4,52 @@
   fetchFromGitHub,
   cmake,
   sqlite,
+  corrosion,
+  rustPlatform,
+  cargo,
+  rustc,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libchewing";
-  version = "0.6.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "chewing";
     repo = "libchewing";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-X+4Rr5Mfc4qeJxmHczu4MKgHBvQN1rhqUrJSx8SFnDk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5aeAsvTiUMTm+ibNfJI57rzSUpJB7luhA/aWmTcnBj4=";
   };
 
-  buildInputs = [ sqlite ];
+  # ld: unknown option: -version-script
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "if(CMAKE_C_COMPILER_ID MATCHES GNU|^Clang)" "if((CMAKE_C_COMPILER_ID MATCHES GNU|^Clang) AND NOT APPLE)"
+  '';
 
-  nativeBuildInputs = [ cmake ];
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-LTuUhQ0ZeyGloNvVs+6OGjFvPdBsQNZupwC8QTjUfyk=";
+  };
 
-  meta = with lib; {
+  nativeBuildInputs = [
+    cmake
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
+  ];
+
+  buildInputs = [
+    sqlite
+    corrosion
+  ];
+
+  meta = {
     description = "Intelligent Chinese phonetic input method";
     homepage = "https://chewing.im/";
-    license = licenses.lgpl21Only;
-    maintainers = with maintainers; [
-      ShamrockLee
-    ];
-    platforms = platforms.all;
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ ShamrockLee ];
+    platforms = lib.platforms.all;
     # compile time tools init_database, dump_database are built for host
     broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
   };
diff --git a/pkgs/by-name/mi/minio-warp/package.nix b/pkgs/by-name/mi/minio-warp/package.nix
index 45c438eb41da..869c12017efa 100644
--- a/pkgs/by-name/mi/minio-warp/package.nix
+++ b/pkgs/by-name/mi/minio-warp/package.nix
@@ -4,20 +4,29 @@
   buildGoModule,
   versionCheckHook,
   nix-update-script,
+  fetchpatch,
 }:
 
 buildGoModule rec {
   pname = "minio-warp";
-  version = "1.1.2";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "warp";
     rev = "v${version}";
-    hash = "sha256-loyEGnJ6ExWMUyArNNpQGzpagFgwlNzaNBO8EPXkMws=";
+    hash = "sha256-KOhBSxR9P3Q6DpC8QCRaiw6Y51OyHLRlhr0WmXE74PI=";
   };
 
-  vendorHash = "sha256-/+vKs5NzzyP9Ihz+zbxGf/OEHD0kaf0wZzE0Sg++3bE=";
+  patches = [
+    # upstream ships a broken go.sum file in the release and fixes it one commit later ..
+    (fetchpatch {
+      url = "https://github.com/minio/warp/commit/c830e94367efce6e6d70c337d490a3b6eba5e558.patch";
+      hash = "sha256-LXkgwpTPe4WvU+nAsYfjs38uXiBoeoavnxliw8nweRQ=";
+    })
+  ];
+
+  vendorHash = "sha256-duEd5uss6mS2aTOTsI3dzZV2TEDHyKN5QKWb4Tt5+7s=";
 
   # See .goreleaser.yml
   ldflags = [
@@ -43,6 +52,7 @@ buildGoModule rec {
   meta = {
     description = "S3 benchmarking tool";
     homepage = "https://github.com/minio/warp";
+    changelog = "https://github.com/minio/warp/releases/tag/v${version}";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ christoph-heiss ];
     mainProgram = "minio-warp";
diff --git a/pkgs/by-name/mo/mountpoint-s3/package.nix b/pkgs/by-name/mo/mountpoint-s3/package.nix
index 0d18d51179e7..113178672eb1 100644
--- a/pkgs/by-name/mo/mountpoint-s3/package.nix
+++ b/pkgs/by-name/mo/mountpoint-s3/package.nix
@@ -9,18 +9,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mountpoint-s3";
-  version = "1.16.2";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "mountpoint-s3";
     rev = "v${version}";
-    hash = "sha256-5zib6F+OtOqxJei4+HzzEEMvjOoltdcPfIc6kzUJYgw=";
+    hash = "sha256-uV0umUoJkYgmjWjv8GMnk5TRRbCCJS1ut3VV1HvkaAw=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3wEmtBEYvvHZ0Tde+o//YW8J20o6t/v8C0vq/CICHD0=";
+  cargoHash = "sha256-zDgAGOuK0Jkmm554qZsaA/ABFhuupJ+WToO8HSPp7Xc=";
 
   # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
   # cargo metadata failure: error: none of the selected packages contains these features: libfuse3
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index a6c8196d8f16..d04843e56c44 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "20.1.3";
+  version = "21.0.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-CLhlGwr7W3GW8V+wqMXHfKbU2dmMWlgEmo4QohcPAwo=";
+    sha256 = "sha256-K86kOCJ9Fnf/ZvS11Tyf81mdKA9R5pgBz1XzDY4N/8E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/nb/nbfc-linux/package.nix b/pkgs/by-name/nb/nbfc-linux/package.nix
index 2ae265b615db..8f3d6e7be515 100644
--- a/pkgs/by-name/nb/nbfc-linux/package.nix
+++ b/pkgs/by-name/nb/nbfc-linux/package.nix
@@ -3,21 +3,24 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
+  curl,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "nbfc-linux";
-  version = "0.2.7";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "nbfc-linux";
     repo = "nbfc-linux";
-    rev = "${finalAttrs.version}";
-    hash = "sha256-1tLW/xEh01y8BjVbgIa95DkYWf7CDVSo/lI/1U28Xs8=";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-i6G7r9Mg90WMWjSIDDbyNLAr2ZxJX9D02bNaL5EY48I=";
   };
 
-  nativeBuildInputs = [
-    autoreconfHook
-  ];
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ curl ];
+
   configureFlags = [
     "--prefix=${placeholder "out"}"
     "--sysconfdir=${placeholder "out"}/etc"
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 3e4177fa421d..391a454af7dc 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-talk-desktop";
-  version = "1.1.7";
+  version = "1.1.8";
 
   # Building from source would require building also building Server and Talk components
   # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
   src = fetchzip {
     url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${finalAttrs.version}/Nextcloud.Talk-linux-x64.zip";
-    hash = "sha256-tcg3ctqbarJKJ9oROI+PHVTddJoioA1rF/QLR659q0Q=";
+    hash = "sha256-rKUf6BQk/snwI6Sf67+PbNEnoZZY1u+EOEWE11p3dYw=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index 91b9c2588009..f762d2f78a22 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
     rev = "v${version}";
-    hash = "sha256-QD9b3r91ukGbAg+ZWj9cdBsXb6pl3wlVgEY3zF+tDQI=";
+    hash = "sha256-SuD6FTyCGT+H5uEPkPmBSI00R87weAoO5xZHPJElSu8=";
   };
 
   vendorHash = "sha256-A7ZuY8Gc/a0Y8O6UG2WHWxptHstJOxi4n9F8TY6zqiw=";
diff --git a/pkgs/by-name/pa/pay-respects/package.nix b/pkgs/by-name/pa/pay-respects/package.nix
index 0c9ffdb2eb4e..a98ae0d5c4e7 100644
--- a/pkgs/by-name/pa/pay-respects/package.nix
+++ b/pkgs/by-name/pa/pay-respects/package.nix
@@ -2,8 +2,9 @@
   lib,
   fetchFromGitea,
   rustPlatform,
+  versionCheckHook,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pay-respects";
   version = "0.7.6";
 
@@ -11,16 +12,20 @@ rustPlatform.buildRustPackage rec {
     domain = "codeberg.org";
     owner = "iff";
     repo = "pay-respects";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-+50MKpZgJqjuUvJeFFv8fMILkJ3cOAN7R7kmlR+98II=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-TJP+GPkXwPvnBwiF0SCkn8NGz/xyrYjbUZKCbUUSqHQ=";
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   meta = {
-    description = "Terminal command correction, alternative to `thefuck`, written in Rust";
+    description = "Terminal command correction, alternative to thefuck, written in Rust";
     homepage = "https://codeberg.org/iff/pay-respects";
+    changelog = "https://codeberg.org/iff/pay-respects/src/tag/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [
       sigmasquadron
@@ -29,4 +34,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "pay-respects";
   };
-}
+})
diff --git a/pkgs/by-name/re/readarr/package.nix b/pkgs/by-name/re/readarr/package.nix
index 6bacf19c5f6f..30b5a3de57bf 100644
--- a/pkgs/by-name/re/readarr/package.nix
+++ b/pkgs/by-name/re/readarr/package.nix
@@ -24,15 +24,15 @@ let
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash =
     {
-      x64-linux_hash = "sha256-pkFyal2u/2YeKuv8QwZNvO1HBT4lpNSw+M2u6isDK5s=";
-      arm64-linux_hash = "sha256-NPBUmeAihbS8qMML3E/9QEmOfgdH2fzaWtA4vV1TIK8=";
-      x64-osx_hash = "sha256-6urFLKOL63xAUQHDqDq8NkFUnQuOC5i+MI3ANJUU1Vg=";
+      x64-linux_hash = "sha256-sJcnCysBNRL0rY+leTW9oTmHPa1Ook8oC6ateAyP58A=";
+      arm64-linux_hash = "sha256-PQYWApDyl5HFv+lNFi/VQ0suG32QHm0icjsEjHopf/U=";
+      x64-osx_hash = "sha256-NBy3shWURHQdZauTqeZMi7OMfGkBmJjhF/l4oX2xTp4=";
     }
     ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.4.15.2787";
+  version = "0.4.16.2793";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/by-name/ri/ripgrep-all/package.nix b/pkgs/by-name/ri/ripgrep-all/package.nix
index 4e317167864d..49f1342c7641 100644
--- a/pkgs/by-name/ri/ripgrep-all/package.nix
+++ b/pkgs/by-name/ri/ripgrep-all/package.nix
@@ -23,17 +23,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep-all";
-  version = "0.10.6";
+  version = "0.10.9";
 
   src = fetchFromGitHub {
     owner = "phiresky";
     repo = "ripgrep-all";
     rev = "v${version}";
-    hash = "sha256-ns7RL7kiG72r07LkF6RzShNg8M2SU6tU5+gXDxzUQHM=";
+    hash = "sha256-r/+u76Qxat6U0Hb3Xh31K/F0dNSPzteFzoE69NNCerI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-VbkLs5TuDSY7UHh2hA8R4dp99RU7pMmGhS1P9U9osq8=";
+  cargoHash = "sha256-nTCqqTFt87snzOXkjablaX9ZMGu/s88ZnUVr5uYrzPs=";
 
   # override debug=true set in Cargo.toml upstream
   RUSTFLAGS = "-C debuginfo=none";
diff --git a/pkgs/by-name/ro/routino/package.nix b/pkgs/by-name/ro/routino/package.nix
index 2844356923b5..a40a2397f8a7 100644
--- a/pkgs/by-name/ro/routino/package.nix
+++ b/pkgs/by-name/ro/routino/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "routino";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://routino.org/download/routino-${version}.tgz";
-    hash = "sha256-Dms1u/KuS6qFYcslKfsvIFPx0ApdyWtKK/XlgW+kToI=";
+    hash = "sha256-TroGfTLJfKk4itbpfA9aPBDUiCk2ckDXjFE3XYzBHlQ=";
   };
 
   patchFlags = [ "-p0" ];
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index a22a0bf5ae54..667369b201d3 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -132,6 +132,11 @@ rustPlatform.buildRustPackage {
       apple-sdk_14
     ];
 
+  # Builds with additional features for aarch64, see https://github.com/servo/servo/issues/36819
+  buildFeatures = lib.optionals stdenv.hostPlatform.isAarch64 [
+    "servo_allocator/use-system-allocator"
+  ];
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-I${lib.getInclude stdenv.cc.libcxx}/include/c++/v1";
 
   # copy resources into `$out` to be used during runtime
diff --git a/pkgs/by-name/so/sobjectizer/package.nix b/pkgs/by-name/so/sobjectizer/package.nix
new file mode 100644
index 000000000000..e46c47baafab
--- /dev/null
+++ b/pkgs/by-name/so/sobjectizer/package.nix
@@ -0,0 +1,60 @@
+{
+  pkgs,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  withStatic ? stdenv.hostPlatform.isStatic,
+  withShared ? !withStatic,
+  buildExamples ? false,
+}:
+
+# Ensure build examples with static library.
+assert buildExamples -> withStatic;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sobjectizer";
+  version = "5.8.4";
+
+  src = fetchFromGitHub {
+    owner = "Stiffstream";
+    repo = "sobjectizer";
+    tag = "v.${finalAttrs.version}";
+    hash = "sha256-tIqWgd6TppHfqZk3XHzhG0t+Nn8BQCTP81UD7ls67UE=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "tests-do-not-require-static-library.patch";
+      url = "https://github.com/Stiffstream/sobjectizer/commit/10eb34c65ccdaa4fea62d0c4354b83104256370d.patch";
+      hash = "sha256-a2g6jDGDC/y8cmbAD0KtVQKhVS5ZAjKtMhbAUyoQIvg=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeDir = "../dev";
+
+  cmakeFlags = [
+    (lib.cmakeBool "SOBJECTIZER_BUILD_STATIC" withStatic)
+    (lib.cmakeBool "SOBJECTIZER_BUILD_SHARED" withShared)
+    (lib.cmakeBool "BUILD_EXAMPLES" (buildExamples && withStatic))
+    (lib.cmakeBool "BUILD_TESTS" (finalAttrs.doCheck && withShared))
+  ];
+
+  # The tests require the shared library thanks to the patch.
+  doCheck = withShared;
+
+  # Receive semi-automated updates.
+  passthru.updateScript = pkgs.nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/Stiffstream/sobjectizer/tree/master";
+    changelog = "https://github.com/Stiffstream/sobjectizer/releases/tag/v.${finalAttrs.version}";
+    description = "Implementation of Actor, Publish-Subscribe, and CSP models in one rather small C++ framework";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.ivalery111 ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ti/timg/package.nix b/pkgs/by-name/ti/timg/package.nix
index 70d9c4557a54..bc9206b1af25 100644
--- a/pkgs/by-name/ti/timg/package.nix
+++ b/pkgs/by-name/ti/timg/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "timg";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "timg";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-D5pQozxy5eSKVaV5qhoneG/b2yKcPQWD8OHs8MsGL1w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UiQ8CW0mxjjQM6XLN0FL2v7ccYq2EmIy/3pm+yKQh8w=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix b/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
index 6dd39d334b27..3247710fa10a 100644
--- a/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
+++ b/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
@@ -6,11 +6,11 @@
 
 buildGoModule rec {
   pname = "zabbix-agent2-plugin-postgresql";
-  version = "7.2.5";
+  version = "7.2.6";
 
   src = fetchurl {
     url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${version}.tar.gz";
-    hash = "sha256-FJf7rjghYe0paIzjzdkiummzPcBFaH7fcfTJ+pTSZUE=";
+    hash = "sha256-ZDSz+zCH9nHbcRYG1GR+TH+S7VV4nI1HSomNL3Un0/A=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index bf266e8c6e5b..192fdafd2f9e 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
-    owner = "woodruffw";
+    owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Has3PrXJIKQh6FdhZ3aGvqJ5keHTRqa+nDAb4fv3xWg=";
+    hash = "sha256-HDQDaIZVxMTkVTwCNyevSdVZELw8e6hIN/NhaHLcT24=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uXUvEbQpY9E7kTOeXMFN/9b4u4tn/S3HCs0a65Hssn4=";
+  cargoHash = "sha256-hr/1RFXvbsRLxlmXNPuU3x+i41byE+v5k2aBg5UIbvM=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -28,8 +28,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Tool for finding security issues in GitHub Actions setups";
-    homepage = "https://woodruffw.github.io/zizmor/";
-    changelog = "https://github.com/woodruffw/zizmor/releases/tag/v${finalAttrs.version}";
+    homepage = "https://docs.zizmor.sh/";
+    changelog = "https://github.com/zizmorcore/zizmor/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lesuisse ];
     mainProgram = "zizmor";
diff --git a/pkgs/development/beam-modules/hex/default.nix b/pkgs/development/beam-modules/hex/default.nix
index 74de36b9269e..13863f70044b 100644
--- a/pkgs/development/beam-modules/hex/default.nix
+++ b/pkgs/development/beam-modules/hex/default.nix
@@ -18,13 +18,13 @@ let
     self:
     stdenv.mkDerivation rec {
       pname = "hex";
-      version = "2.1.1";
+      version = "2.2.1";
 
       src = fetchFromGitHub {
         owner = "hexpm";
         repo = "hex";
         rev = "v${version}";
-        sha256 = "sha256-pEfd2BqkVwZVbnka98MafJ/NRn94BHh+wM0i2Q5duTo=";
+        sha256 = "sha256-a4VNBlvW+IM7HuI66dYGqOmIF9kO6wWFqVz4vYtQOhw=";
       };
 
       setupHook = writeText "setupHook.sh" ''
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 7ba0957b615e..8800a6408c01 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -33,9 +33,9 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.4".officialRelease.sha256 = "sha256-/WomqG2DdnUHwlVsMfpzaK/dhGV3zychfU0wLmihQac=";
     "21.0.0-git".gitRelease = {
-      rev = "b3e8b21c57cc5549767d21a2be43baeec431c6f7";
-      rev-version = "21.0.0-unstable-2025-05-04";
-      sha256 = "sha256-4fe6xaE5FEvHRFDcs9mNE08b54Cq3lzEezyI2hs2e/8=";
+      rev = "5b91756c0ca7ef4d75c33c2617bfd0f9719907dc";
+      rev-version = "21.0.0-unstable-2025-05-11";
+      sha256 = "sha256-5e72pOZO2/hYY7/1Kt0ITtEjJzWwKR58ufCU/9EkdS0=";
     };
   } // llvmVersions;
 
diff --git a/pkgs/development/cuda-modules/cudnn/shims.nix b/pkgs/development/cuda-modules/cudnn/shims.nix
index 9cb879b363bf..0a7f09bc9f0f 100644
--- a/pkgs/development/cuda-modules/cudnn/shims.nix
+++ b/pkgs/development/cuda-modules/cudnn/shims.nix
@@ -1,13 +1,12 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
 {
-  lib,
   package,
   # redistArch :: String
   # String is "unsupported" if the given architecture is unsupported.
   redistArch,
 }:
 {
-  featureRelease = lib.optionalAttrs (redistArch != "unsupported") {
+  featureRelease = {
     inherit (package) minCudaVersion maxCudaVersion;
     ${redistArch}.outputs = {
       lib = true;
diff --git a/pkgs/development/cuda-modules/generic-builders/multiplex.nix b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
index 3e2958449dc0..816a375e620f 100644
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@@ -52,12 +52,20 @@ let
     lib.versionAtLeast cudaMajorMinorVersion package.minCudaVersion
     && lib.versionAtLeast package.maxCudaVersion cudaMajorMinorVersion;
 
-  # Releases for our platform and CUDA version.
-  # See ../modules/${pname}/releases/releases.nix
-  # allPackages :: List Package
-  allPackages = lib.filter satisfiesCudaVersion (
-    evaluatedModules.config.${pname}.releases.${redistArch} or [ ]
-  );
+  # FIXME: do this at the module system level
+  propagatePlatforms = lib.mapAttrs (redistArch: lib.map (p: { inherit redistArch; } // p));
+
+  # Releases for all platforms and all CUDA versions.
+  allReleases = propagatePlatforms evaluatedModules.config.${pname}.releases;
+
+  # Releases for all platforms and our CUDA version.
+  allReleases' = lib.mapAttrs (_: lib.filter satisfiesCudaVersion) allReleases;
+
+  # Packages for all platforms and our CUDA versions.
+  allPackages = lib.concatLists (lib.attrValues allReleases');
+
+  packageOlder = p1: p2: lib.versionOlder p1.version p2.version;
+  packageSupportedPlatform = p: p.redistArch == redistArch;
 
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
@@ -77,8 +85,15 @@ let
         newestPackages
         // {
           ${majorMinorVersion} =
-            # Only keep the existing package if it is newer than the one we are considering.
-            if existingPackage != null && lib.versionOlder package.version existingPackage.version then
+            # Only keep the existing package if it is newer than the one we are considering or it is supported on the
+            # current platform and the one we are considering is not.
+            if
+              existingPackage != null
+              && (
+                packageOlder package existingPackage
+                || (!packageSupportedPlatform package && packageSupportedPlatform existingPackage)
+              )
+            then
               existingPackage
             else
               package;
@@ -87,9 +102,8 @@ let
     in
     # Sort the packages by version so the newest is first.
     # NOTE: builtins.sort requires a strict weak ordering, so we must use versionOlder rather than versionAtLeast.
-    lib.sort (p1: p2: lib.versionOlder p2.version p1.version) (
-      lib.attrValues newestForEachMajorMinorVersion
-    );
+    # See https://github.com/NixOS/nixpkgs/commit/9fd753ea84e5035b357a275324e7fd7ccfb1fc77.
+    lib.sort (lib.flip packageOlder) (lib.attrValues newestForEachMajorMinorVersion);
 
   extension =
     final: _:
diff --git a/pkgs/development/cuda-modules/tensorrt/shims.nix b/pkgs/development/cuda-modules/tensorrt/shims.nix
index 7832f8e97c51..d347ef7e294c 100644
--- a/pkgs/development/cuda-modules/tensorrt/shims.nix
+++ b/pkgs/development/cuda-modules/tensorrt/shims.nix
@@ -1,13 +1,12 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
 {
-  lib,
   package,
   # redistArch :: String
   # String is `"unsupported"` if the given architecture is unsupported.
   redistArch,
 }:
 {
-  featureRelease = lib.optionalAttrs (redistArch != "unsupported") {
+  featureRelease = {
     inherit (package) cudnnVersion minCudaVersion maxCudaVersion;
     ${redistArch}.outputs = {
       bin = true;
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index 005afaa1ab85..1abc538fe663 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -62,7 +62,6 @@ self: super:
 
     # issues finding libcharset.h without libiconv in buildInputs on darwin.
     with-utf8 = addExtraLibrary pkgs.libiconv super.with-utf8;
-    with-utf8_1_1_0_0 = addExtraLibrary pkgs.libiconv super.with-utf8_1_1_0_0;
 
     git-annex = overrideCabal (drv: {
       # We can't use testFlags since git-annex side steps the Cabal test mechanism
diff --git a/pkgs/development/python-modules/coiled/default.nix b/pkgs/development/python-modules/coiled/default.nix
index d2e0ff36effb..8b6ddd80424b 100644
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.93.0";
+  version = "1.95.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3vniVOW4byF+J2dsnhNp2qvEPzeONbpZ760z9wIYDRA=";
+    hash = "sha256-+YmBKfiJYJVjpSrPGXlzMbQtweObLrLZr1c+aJ58fu4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-q2/default.nix b/pkgs/development/python-modules/django-q2/default.nix
index a3768637324a..3b388ab34cf5 100644
--- a/pkgs/development/python-modules/django-q2/default.nix
+++ b/pkgs/development/python-modules/django-q2/default.nix
@@ -14,6 +14,7 @@
   poetry-core,
   pytest-django,
   pytestCheckHook,
+  stdenv,
 }:
 
 buildPythonPackage rec {
@@ -78,10 +79,21 @@ buildPythonPackage rec {
     REDIS_HOST = "127.0.0.1";
   };
 
-  disabledTests = [
-    # requires a running mongodb
-    "test_mongo"
-  ];
+  disabledTests =
+    [
+      # requires a running mongodb
+      "test_mongo"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # fails with an assertion
+      "test_max_rss"
+      "test_recycle"
+      # cannot connect to redis
+      "test_broker"
+      "test_custom"
+      "test_redis"
+      "test_redis_connection"
+    ];
 
   disabledTestPaths = [
     "django_q/tests/test_commands.py"
@@ -89,11 +101,13 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "-vv" ];
 
-  meta = with lib; {
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Multiprocessing distributed task queue for Django based on Django-Q";
     homepage = "https://github.com/django-q2/django-q2";
     changelog = "https://github.com/django-q2/django-q2/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
index cdc6e1086c21..7c3b703a4d96 100644
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "jupyter-collaboration-ui";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
     inherit version;
-    hash = "sha256-9UONyyhvhpywCVNbGtZz9eL8EGUS4XBM1zEY1RWsomY=";
+    hash = "sha256-YaNUu0+g5DgcqfLUte7pwsEvwyKCmxBjiOgQmVl/H/o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/openrazer/daemon.nix b/pkgs/development/python-modules/openrazer/daemon.nix
index a6a089bd2845..92d240f46a63 100644
--- a/pkgs/development/python-modules/openrazer/daemon.nix
+++ b/pkgs/development/python-modules/openrazer/daemon.nix
@@ -13,6 +13,7 @@
   wrapGAppsNoGuiHook,
   notify2,
   glib,
+  libnotify,
 }:
 
 let
@@ -56,6 +57,7 @@ buildPythonPackage (
       pyudev
       setproctitle
       notify2
+      libnotify
     ];
 
     postInstall = ''
diff --git a/pkgs/development/python-modules/psygnal/default.nix b/pkgs/development/python-modules/psygnal/default.nix
index ae913b1935ab..3db8b1f6da4f 100644
--- a/pkgs/development/python-modules/psygnal/default.nix
+++ b/pkgs/development/python-modules/psygnal/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "psygnal";
-  version = "0.11.1";
+  version = "0.13.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-eGJWtmw2Ps3jII4T8E6s3djzxfqcSdyPemvejal0cn4=";
+    hash = "sha256-ZEN8S2sI1usXl5A1Ow1+l4BBB6qNnlVt/nvFtAX4maY=";
   };
 
   build-system = [
@@ -58,7 +58,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Implementation of Qt Signals";
     homepage = "https://github.com/pyapp-kit/psygnal";
-    changelog = "https://github.com/pyapp-kit/psygnal/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pyapp-kit/psygnal/blob/${src.tag}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ SomeoneSerge ];
   };
diff --git a/pkgs/development/python-modules/rctclient/default.nix b/pkgs/development/python-modules/rctclient/default.nix
new file mode 100644
index 000000000000..803af987c96a
--- /dev/null
+++ b/pkgs/development/python-modules/rctclient/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  click,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "rctclient";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "svalouch";
+    repo = "python-rctclient";
+    tag = "v${version}";
+    hash = "sha256-QPla5h8wSM9Ynj44Uwc1a2yAnu8TXbyBWzVHQeW6jnI=";
+  };
+
+  build-system = [ setuptools ];
+
+  optional-dependencies.cli = [ click ];
+
+  pythonImportsCheck = [ "rctclient" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Python implementation of the RCT Power GmbH Serial Communication Protocol";
+    homepage = "https://github.com/svalouch/python-rctclient";
+    changelog = "https://github.com/svalouch/python-rctclient/releases/tag/${src.tag}";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ _9R ];
+  };
+}
diff --git a/pkgs/development/python-modules/spidev/default.nix b/pkgs/development/python-modules/spidev/default.nix
index 1e62e9b3f988..346ebc5a60e6 100644
--- a/pkgs/development/python-modules/spidev/default.nix
+++ b/pkgs/development/python-modules/spidev/default.nix
@@ -1,25 +1,30 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "spidev";
-  version = "3.6";
-  format = "setuptools";
+  version = "3.7";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-FNvDdZSkqu+FQDq2F5hdPD70ZNYrybdp71UttTcBEVs=";
+  src = fetchFromGitHub {
+    owner = "doceme";
+    repo = "py-spidev";
+    tag = "v${version}";
+    hash = "sha256-XLCWuLjBpsEGjP3yUNbFMxJQ1m9S7TY0LfVVteUU2bY=";
   };
 
-  # package does not include tests
-  doCheck = false;
+  build-system = [ setuptools ];
+
+  doCheck = false; # no tests
 
   pythonImportsCheck = [ "spidev" ];
 
   meta = with lib; {
+    changelog = "https://github.com/doceme/py-spidev/releases/tag/${src.tag}";
     homepage = "https://github.com/doceme/py-spidev";
     description = "Python bindings for Linux SPI access through spidev";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/sqlframe/default.nix b/pkgs/development/python-modules/sqlframe/default.nix
index b09674bbe8ac..84885a2767cc 100644
--- a/pkgs/development/python-modules/sqlframe/default.nix
+++ b/pkgs/development/python-modules/sqlframe/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "sqlframe";
-  version = "3.31.2";
+  version = "3.31.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eakmanrq";
     repo = "sqlframe";
     tag = "v${version}";
-    hash = "sha256-X7KZSbq9KKUE4lXZIHj++koJmjWYI1sMhA6LfClr9pU=";
+    hash = "sha256-x9ILbtl71Xp4p5OWQ/goays5W6uE17FCes7ZVfWZBwY=";
   };
 
   build-system = [
diff --git a/pkgs/development/skaware-packages/execline/default.nix b/pkgs/development/skaware-packages/execline/default.nix
index 500d39b773c0..6adf4a2895fe 100644
--- a/pkgs/development/skaware-packages/execline/default.nix
+++ b/pkgs/development/skaware-packages/execline/default.nix
@@ -2,11 +2,12 @@
   lib,
   skawarePackages,
   skalibs,
+  execline,
+  writeTextFile,
 }:
 
 let
   version = "2.9.6.1";
-
 in
 skawarePackages.buildPackage {
   inherit version;
@@ -75,4 +76,24 @@ skawarePackages.buildPackage {
       ${./execlineb-wrapper.c} \
       -lskarnet
   '';
+
+  # Write an execline script.
+  # Documented in ../../../../doc/build-helpers/trivial-build-helpers.chapter.md
+  passthru.writeScript =
+    name: options: script:
+    writeTextFile {
+      inherit name;
+      text = ''
+        #!${execline}/bin/execlineb ${toString options}
+        ${script}
+      '';
+
+      executable = true;
+      derivationArgs.nativeBuildInputs = [ execline ];
+      checkPhase = ''
+        echo redirfd -w 1 /dev/null echo >test.el
+        cat <$target >>test.el
+        execlineb -W test.el
+      '';
+    };
 }
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index c9b4b501b7b5..ce8da507630c 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "3.5.2";
-  srcHash = "sha256-aHzaBYQ+IHen15FwmSIHaRLe8oWm3BpADrmqW4UWwj0=";
+  version = "3.6.0";
+  srcHash = "sha256-/vBWuCHvVaFqCbwZAXgkHpfAQaOt4dtqeCXmDuQzBoc=";
   # The tarball contains vendored dependencies
   vendorHash = null;
 in
diff --git a/pkgs/servers/home-assistant/custom-components/rct_power/package.nix b/pkgs/servers/home-assistant/custom-components/rct_power/package.nix
new file mode 100644
index 000000000000..c9d04886b0df
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/rct_power/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildHomeAssistantComponent,
+  rctclient,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "weltenwort";
+  domain = "rct_power";
+  version = "v0.14.1";
+
+  src = fetchFromGitHub {
+    owner = "weltenwort";
+    repo = "home-assistant-rct-power-integration";
+    tag = version;
+    hash = "sha256-wM66MyRhBsMfUr+KlqV4jSuXcnKfW0fkbDAyuU2crsc=";
+  };
+
+  dependencies = [
+    rctclient
+  ];
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    changelog = "https://github.com/weltenwort/home-assistant-rct-power-integration/releases/tag/${src.tag}";
+    description = "Custom integration for RCT Power Inverters";
+    homepage = "https://github.com/weltenwort/home-assistant-rct-power-integration";
+    maintainers = with maintainers; [ _9R ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
index 43f69ac891f2..84f605d84536 100644
--- a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "mampfes";
   domain = "waste_collection_schedule";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hacs_waste_collection_schedule";
     tag = version;
-    hash = "sha256-llrECprqzjioEAF+eGbDJ8pkyG3ejTrQd5L60JpPp/Y=";
+    hash = "sha256-2dsuDVk2vFZPKLuFdNISg3b3z7PI+Ag3c2IZRbQnrgg=";
   };
 
   dependencies = [
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index dc2f5a516949..1c298715b44a 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -44,7 +44,7 @@
   withConnPrometheus ? false,
   withConnPubSub ? false,
   withCups ? false,
-  withDBengine ? false,
+  withDBengine ? true,
   withDebug ? false,
   withEbpf ? false,
   withIpmi ? (stdenv.hostPlatform.isLinux),
@@ -57,14 +57,14 @@
   withML ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.4.0";
+  version = "2.5.1";
   pname = "netdata";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "netdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-egHsWmhnrl8D59gr7uD5hBnleCOI8gVEBGwdO5GSnOg=";
+    hash = "sha256-77k93mg7iED53k38jATbS2Y1N0eLKhjo0RYyinApkuE=";
     fetchSubmodules = true;
   };
 
@@ -133,10 +133,10 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withCloudUi (
       replaceVars ./dashboard-v3-add.patch {
         # FIXME web.archive.org link can be replace once https://github.com/netdata/netdata-cloud/issues/1081 resolved
-        # last update 03/16/2025 23:56:24
+        # last update 04/01/2025 04:45:14
         dashboardTarball = fetchurl {
-          url = "https://web.archive.org/web/20250316235624/https://app.netdata.cloud/agent.tar.gz";
-          hash = "sha256-Vtw+CbBgqGRenkis0ZR2/TLsoM83NjNA6mbndb95EK8=";
+          url = "https://web.archive.org/web/20250401044514/https://app.netdata.cloud/agent.tar.gz";
+          hash = "sha256-NtmM1I3VrvFErMoBl+w63Nt0DzOOsaB98cxE/axm8mE=";
         };
       }
     );
@@ -220,9 +220,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DWEB_DIR=share/netdata/web"
     (lib.cmakeBool "ENABLE_DASHBOARD" withCloudUi)
-    # FIXME uncomment when https://github.com/netdata/netdata/issues/19901#issuecomment-2819701451 resolved
-    (lib.cmakeBool "ENABLE_DBENGINE" true)
-    # (lib.cmakeBool "ENABLE_DBENGINE" withDBengine)
+    (lib.cmakeBool "ENABLE_DBENGINE" withDBengine)
     (lib.cmakeBool "ENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE" withConnPrometheus)
     (lib.cmakeBool "ENABLE_JEMALLOC" true)
     (lib.cmakeBool "ENABLE_LIBBACKTRACE" withLibbacktrace)
@@ -260,7 +258,7 @@ stdenv.mkDerivation (finalAttrs: {
 
         sourceRoot = "${finalAttrs.src.name}/src/go/plugin/go.d";
 
-        vendorHash = "sha256-PgQs3+++iD9Lg8psTBVzF4b+kGJzhV5yNQBkw/+Dqks=";
+        vendorHash = "sha256-N03IGTtF78PCo4kf0Sdtzv6f8z47ohg8g3YIXtINRjU=";
         doCheck = false;
         proxyVendor = true;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d30661616f6d..279222defef2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14870,6 +14870,8 @@ self: super: with self; {
 
   rcssmin = callPackage ../development/python-modules/rcssmin { };
 
+  rctclient = callPackage ../development/python-modules/rctclient { };
+
   rdbtools = callPackage ../development/python-modules/rdbtools { };
 
   rdflib = callPackage ../development/python-modules/rdflib { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 42c2503ede95..3ad70a5dc177 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -10,7 +10,7 @@
   $ hydra-eval-jobs -I . pkgs/top-level/release-haskell.nix
 */
 {
-  supportedSystems ? import ../../ci/supportedSystems.nix,
+  supportedSystems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
 }:
 
 let
diff --git a/pkgs/top-level/release-outpaths.nix b/pkgs/top-level/release-outpaths.nix
index e6caabec04e9..8ca14fc95007 100644
--- a/pkgs/top-level/release-outpaths.nix
+++ b/pkgs/top-level/release-outpaths.nix
@@ -13,7 +13,7 @@
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
-  systems ? import ../../ci/supportedSystems.nix,
+  systems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
 }:
 let
   lib = import (path + "/lib");
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 31fe8fb38e13..7126252d7976 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -19,7 +19,7 @@
   system ? builtins.currentSystem,
   officialRelease ? false,
   # The platform doubles for which we build Nixpkgs.
-  supportedSystems ? import ../../ci/supportedSystems.nix,
+  supportedSystems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
   # The platform triples for which we build bootstrap tools.
   bootstrapConfigs ? [
     "aarch64-apple-darwin"