diff --git a/lib/types.nix b/lib/types.nix
index 715da842ac01..73d59309e91b 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -1456,6 +1456,12 @@ let
           nestedTypes.finalType = finalType;
         };
 
+      # A list of attrnames is coerced into an attrset of bools by
+      # setting the values to true.
+      attrNamesToTrue = coercedTo (types.listOf types.str) (
+        enabledList: lib.genAttrs enabledList (_attrName: true)
+      ) (types.attrsOf types.bool);
+
       # Augment the given type with an additional type check function.
       addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
 
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index c0add330b72e..8539da71a214 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -135,6 +135,29 @@ merging is handled.
     problems.
     :::
 
+`types.attrNamesToTrue`
+
+:   Either a list of attribute names, or an attribute set of
+    booleans. A list will be coerced into an attribute set with those
+    names, whose values are set to `true`. This is useful when it is
+    convenient to be able to write definitions as a simple list, but
+    still need to be able to override and disable individual values.
+
+    ::: {#ex-types-attrNamesToTrue .example}
+    ### `types.attrNamesToTrue`
+    ```
+    {
+      foo = [ "bar" ];
+    }
+    ```
+
+    ```
+    {
+      foo.bar = true;
+    }
+    ```
+    :::
+
 `types.pkgs`
 
 :   A type for the top level Nixpkgs package set.
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index b660d2c6d7a9..1d8f65ad28d3 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -13,6 +13,14 @@ let
   inherit (config.boot.kernel) features randstructSeed;
   inherit (config.boot.kernelPackages) kernel;
 
+  modulesTypeDesc = ''
+    This can either be a list of modules, or an attrset. In an
+    attrset, names that are set to `true` represent modules that will
+    be included. Note that setting these names to `false` does not
+    prevent the module from being loaded. For that, use
+    {option}`boot.blacklistedKernelModules`.
+  '';
+
   kernelModulesConf = pkgs.writeText "nixos.conf" ''
     ${concatStringsSep "\n" config.boot.kernelModules}
   '';
@@ -188,20 +196,23 @@ in
     };
 
     boot.kernelModules = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
+      type = types.attrNamesToTrue;
+      default = { };
       description = ''
         The set of kernel modules to be loaded in the second stage of
         the boot process.  Note that modules that are needed to
         mount the root file system should be added to
         {option}`boot.initrd.availableKernelModules` or
         {option}`boot.initrd.kernelModules`.
+
+        ${modulesTypeDesc}
       '';
+      apply = mods: lib.attrNames (lib.filterAttrs (_: v: v) mods);
     };
 
     boot.initrd.availableKernelModules = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
+      type = types.attrNamesToTrue;
+      default = { };
       example = [
         "sata_nv"
         "ext3"
@@ -220,13 +231,21 @@ in
         modules for PCI devices are loaded when they match the PCI ID
         of a device in your system).  To force a module to be loaded,
         include it in {option}`boot.initrd.kernelModules`.
+
+        ${modulesTypeDesc}
       '';
+      apply = mods: lib.attrNames (lib.filterAttrs (_: v: v) mods);
     };
 
     boot.initrd.kernelModules = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      description = "List of modules that are always loaded by the initrd.";
+      type = types.attrNamesToTrue;
+      default = { };
+      description = ''
+        Set of modules that are always loaded by the initrd.
+
+        ${modulesTypeDesc}
+      '';
+      apply = mods: lib.attrNames (lib.filterAttrs (_: v: v) mods);
     };
 
     boot.initrd.includeDefaultModules = mkOption {
@@ -239,6 +258,24 @@ in
       '';
     };
 
+    boot.initrd.allowMissingModules = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether the initrd can be built even though modules listed in
+        {option}`boot.initrd.kernelModules` or
+        {option}`boot.initrd.availableKernelModules` are missing from
+        the kernel. This is useful when combining configurations that
+        include a lot of modules, such as
+        {option}`hardware.enableAllHardware`, with kernels that don't
+        provide as many modules as typical NixOS kernels.
+
+        Note that enabling this is discouraged. Instead, try disabling
+        individual modules by setting e.g.
+        `boot.initrd.availableKernelModules.foo = lib.mkForce false;`
+      '';
+    };
+
     system.modulesTree = mkOption {
       type = types.listOf types.path;
       internal = true;
diff --git a/nixos/modules/system/boot/modprobe.nix b/nixos/modules/system/boot/modprobe.nix
index df0d5d667988..b38e78c3222a 100644
--- a/nixos/modules/system/boot/modprobe.nix
+++ b/nixos/modules/system/boot/modprobe.nix
@@ -25,16 +25,19 @@ with lib;
       };
 
     boot.blacklistedKernelModules = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
+      type = types.attrNamesToTrue;
+      default = { };
       example = [
         "cirrusfb"
         "i2c_piix4"
       ];
       description = ''
-        List of names of kernel modules that should not be loaded
-        automatically by the hardware probing code.
+        Set of names of kernel modules that should not be loaded
+        automatically by the hardware probing code. This can either be
+        a list of modules or an attrset. In an attrset, names that are
+        set to `true` represent modules that will be blacklisted.
       '';
+      apply = mods: lib.attrNames (lib.filterAttrs (_: v: v) mods);
     };
 
     boot.extraModprobeConfig = mkOption {
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index c916160aa791..09e6fcaf9ea7 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -25,7 +25,7 @@ let
     rootModules = config.boot.initrd.availableKernelModules ++ config.boot.initrd.kernelModules;
     kernel = config.system.modulesTree;
     firmware = config.hardware.firmware;
-    allowMissing = false;
+    allowMissing = config.boot.initrd.allowMissingModules;
     inherit (config.boot.initrd) extraFirmwarePaths;
   };
 
@@ -783,7 +783,14 @@ in
     ];
 
     system.build = mkMerge [
-      { inherit bootStage1 initialRamdiskSecretAppender extraUtils; }
+      {
+        inherit
+          bootStage1
+          initialRamdiskSecretAppender
+          extraUtils
+          modulesClosure
+          ;
+      }
 
       # generated in nixos/modules/system/boot/systemd/initrd.nix
       (mkIf (!config.boot.initrd.systemd.enable) { inherit initialRamdisk; })
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 65caee745124..b82a79376e07 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -99,14 +99,6 @@ let
   };
 
   kernel-name = config.boot.kernelPackages.kernel.name or "kernel";
-  # Determine the set of modules that we need to mount the root FS.
-  modulesClosure = pkgs.makeModulesClosure {
-    rootModules = config.boot.initrd.availableKernelModules ++ config.boot.initrd.kernelModules;
-    kernel = config.system.modulesTree;
-    firmware = config.hardware.firmware;
-    allowMissing = false;
-    inherit (config.boot.initrd) extraFirmwarePaths;
-  };
 
   initrdBinEnv = pkgs.buildEnv {
     name = "initrd-bin-env";
@@ -471,7 +463,7 @@ in
             }
           '';
 
-          "/lib".source = "${modulesClosure}/lib";
+          "/lib".source = "${config.system.build.modulesClosure}/lib";
 
           "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;
 
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index ef2a5a685003..b28a902a7c54 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -326,9 +326,7 @@ in
           zfs = lib.mkForce false;
         }
       '';
-      type = types.coercedTo (types.listOf types.str) (
-        enabled: lib.listToAttrs (map (fs: lib.nameValuePair fs true) enabled)
-      ) (types.attrsOf types.bool);
+      type = types.attrNamesToTrue;
       description = ''
         Names of supported filesystem types, or an attribute set of file system types
         and their state. The set form may be used together with `lib.mkForce` to
diff --git a/pkgs/applications/editors/neovim/build-neovim-plugin.nix b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
index 18e1c550ade5..fece233768af 100644
--- a/pkgs/applications/editors/neovim/build-neovim-plugin.nix
+++ b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
@@ -26,6 +26,7 @@ let
 
   luaDrv = originalLuaDrv.overrideAttrs (oa: {
     version = attrs.version or oa.version;
+    __intentionallyOverridingVersion = true;
     rockspecVersion = oa.rockspecVersion;
 
     extraConfig = ''
@@ -43,6 +44,7 @@ let
           lua.pkgs.luarocksMoveDataFolder
         ];
         version = "${originalLuaDrv.version}-unstable-${oa.version}";
+        __intentionallyOverridingVersion = true;
       }
     )
   );
diff --git a/pkgs/applications/video/kodi/addons/netflix/default.nix b/pkgs/applications/video/kodi/addons/netflix/default.nix
index d360e2b3507a..76ec7fd1d242 100644
--- a/pkgs/applications/video/kodi/addons/netflix/default.nix
+++ b/pkgs/applications/video/kodi/addons/netflix/default.nix
@@ -12,13 +12,13 @@
 buildKodiAddon rec {
   pname = "netflix";
   namespace = "plugin.video.netflix";
-  version = "1.23.3";
+  version = "1.23.4";
 
   src = fetchFromGitHub {
     owner = "CastagnaIT";
     repo = namespace;
     rev = "v${version}";
-    hash = "sha256-tve7E7dK60BIHETdwt9hD3/5eEdJB6c6rhw4oDoLAKM=";
+    hash = "sha256-yq5XNhKQSBh7r/2apHXLMjhovV6xhL9DcDwXn9nt0KQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index f3ddf8f24ae8..85619d66e647 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -67,6 +67,7 @@ let
 
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "127.3.5";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "114ea2a";
     chromiumVersion = "127.0.6533.120";
 
diff --git a/pkgs/by-name/bo/bolt-launcher/package.nix b/pkgs/by-name/bo/bolt-launcher/package.nix
index 6c6466acc1aa..f2c01aceb329 100644
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -23,6 +23,7 @@
 let
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "126.2.18";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "3647d39";
     chromiumVersion = "126.0.6478.183";
 
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index bc307ee5d9ed..a58a3ee4c2be 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -36,7 +36,6 @@
   systemd,
   udev,
   xmlto,
-  which,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -67,7 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.setuptools
     systemd
     xmlto
-    which
   ];
 
   buildInputs = [
@@ -81,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     udev
     python3Packages.pygobject3
     python3Packages.pip
+    bashInteractive
   ];
 
   postPatch = ''
@@ -99,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
 
     substituteInPlace src/**/*.c \
-      --replace '"/bin/sh"' "\"$(which sh)\""
+      --replace-quiet "/bin/sh" "${lib.getExe bashInteractive}"
 
     # instruct users with problems to create a nixpkgs issue instead of nagging upstream directly
     substituteInPlace configure.ac \
diff --git a/pkgs/by-name/de/debsigs/package.nix b/pkgs/by-name/de/debsigs/package.nix
new file mode 100644
index 000000000000..ce9cba98f6d0
--- /dev/null
+++ b/pkgs/by-name/de/debsigs/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  perlPackages,
+  fetchFromGitLab,
+}:
+
+perlPackages.buildPerlPackage rec {
+  pname = "debsigs";
+  version = "0.2.2";
+
+  src = fetchFromGitLab {
+    owner = "debsigs";
+    repo = "debsigs";
+    tag = "release/${version}";
+    hash = "sha256-gCc5JmmdhTAUQqkMOK/0YmlCRD0JcpemCpqusYmpoKU=";
+  };
+
+  sourceRoot = "${src.name}/perl";
+
+  meta = {
+    description = "Manipulate the cryptographic signatures stored inside a .deb file";
+    mainProgram = "debsigs";
+    homepage = "https://gitlab.com/debsigs/debsigs";
+    changelog = "https://gitlab.com/debsigs/debsigs/-/tags/release/${version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ usertam ];
+  };
+}
diff --git a/pkgs/by-name/de/devtoolbox/package.nix b/pkgs/by-name/de/devtoolbox/package.nix
index dc3797428f13..85ea3b387653 100644
--- a/pkgs/by-name/de/devtoolbox/package.nix
+++ b/pkgs/by-name/de/devtoolbox/package.nix
@@ -20,14 +20,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "devtoolbox";
-  version = "1.2.3";
+  version = "1.2.5";
   pyproject = false; # uses meson
 
   src = fetchFromGitHub {
     owner = "aleiepure";
     repo = "devtoolbox";
     tag = "v${version}";
-    hash = "sha256-Ns2utC/qiwzEJJkdqwpx320k3srj5OJi8K+u5fI1LwE=";
+    hash = "sha256-CgpSZvpwBKo2gzp2QbBPFBK0tPhqKFC/DxXdmTWVAwc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/di/dinit/package.nix b/pkgs/by-name/di/dinit/package.nix
index 0aa23f46e645..394d370bfb88 100644
--- a/pkgs/by-name/di/dinit/package.nix
+++ b/pkgs/by-name/di/dinit/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dinit";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "davmac314";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     postFetch = ''
       [ -f "$out/BUILD" ] && rm "$out/BUILD"
     '';
-    hash = "sha256-mhb/0EeJpUReGE2xxVXs0iUGctDOVnpR1Q+IVUtFT0Y=";
+    hash = "sha256-IKT4k2eXCOCXtiypGbsIpN0OHS+WKqXvr4Mb61fbl0M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/do/dotnet-ef/package.nix b/pkgs/by-name/do/dotnet-ef/package.nix
index 40a125634e65..9fe2edac1f2c 100644
--- a/pkgs/by-name/do/dotnet-ef/package.nix
+++ b/pkgs/by-name/do/dotnet-ef/package.nix
@@ -2,9 +2,9 @@
 
 buildDotnetGlobalTool {
   pname = "dotnet-ef";
-  version = "9.0.4";
+  version = "9.0.5";
 
-  nugetHash = "sha256-eQ821C6bx98LJEcdSiozgAaHD2m2+hKVowRTL+L6vzM=";
+  nugetHash = "sha256-Mu+MlsjH/qa4kMb7z/TuG1lSVSKPX9j9S4mJLVRZ2+E=";
 
   meta = {
     description = "The Entity Framework Core tools help with design-time development tasks.";
diff --git a/pkgs/by-name/du/dumpvdl2/package.nix b/pkgs/by-name/du/dumpvdl2/package.nix
new file mode 100644
index 000000000000..06af53f19177
--- /dev/null
+++ b/pkgs/by-name/du/dumpvdl2/package.nix
@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  cmake,
+  pkg-config,
+  glib,
+  soapysdr,
+  sdrplay,
+  sdrplaySupport ? false,
+  sqlite,
+  zeromq,
+  libacars,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dumpvdl2";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "szpajder";
+    repo = "dumpvdl2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kb8FLVuG9tSZta8nmaKRCRZinF1yy4+NNxD5s7X82Wk=";
+  };
+
+  buildInputs = [
+    glib
+    soapysdr
+    sqlite
+    zeromq
+    libacars
+  ] ++ lib.optionals sdrplaySupport [ sdrplay ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/szpajder/dumpvdl2";
+    description = "VDL Mode 2 message decoder and protocol analyzer";
+    license = lib.licenses.gpl3Plus;
+    platforms = with lib.platforms; linux ++ darwin;
+    maintainers = [ lib.maintainers.mafo ];
+    mainProgram = "dumpvdl2";
+  };
+})
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 54e006c2c2ff..4bf15d43a41b 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "equibop";
-  version = "2.1.2";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "Equicord";
     repo = "Equibop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lDDGZUpW9LU5S/gzNJFIuVIk08pQlQLK07RwuzcYyjg=";
+    hash = "sha256-y5q3shwmMjXlMaLWfxjN164uM8hSbWymsHIIJxM82Nk=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-MuCQJgUHyAKpKWM7lYE49zur+G+KtIVBVXCspWImnY8=";
+    hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ga/garmindb/package.nix b/pkgs/by-name/ga/garmindb/package.nix
index c5f19b89e90c..604d56b21fea 100644
--- a/pkgs/by-name/ga/garmindb/package.nix
+++ b/pkgs/by-name/ga/garmindb/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "garmindb";
-  version = "3.6.3";
+  version = "3.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tcgoetz";
     repo = "garmindb";
     tag = "v${version}";
-    hash = "sha256-JAUDAYf9CH/BxwV88ziF5Zy+3ibcbieEfHrZpHSU8m0=";
+    hash = "sha256-0srcvYBexsrkQw+AVH3LuIB/+VaQ77Kjv6rHVOq2Reo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ge/geolite-legacy/package.nix b/pkgs/by-name/ge/geolite-legacy/package.nix
index 6cbf620388d9..eb12e7e498d7 100644
--- a/pkgs/by-name/ge/geolite-legacy/package.nix
+++ b/pkgs/by-name/ge/geolite-legacy/package.nix
@@ -3,23 +3,26 @@
   stdenv,
   fetchzip,
   zstd,
+  writeShellApplication,
+  common-updater-scripts,
+  pcre2,
 }:
 
 stdenv.mkDerivation rec {
   pname = "geolite-legacy";
-  version = "20240720";
+  version = "20250129";
 
   # We use Arch Linux package as a snapshot, because upstream database is updated in-place.
   geoip = fetchzip {
     url = "https://archive.archlinux.org/packages/g/geoip-database/geoip-database-${version}-1-any.pkg.tar.zst";
-    hash = "sha256-9rPp1Lu6Q4+Cb4N4e/ezHacpLuUwbGQefEPuSrH8O6o=";
+    hash = "sha256-/aT/ndml7a3P9/1CM3KhB4/L+F0CDHpHj/NnKWOv2G0=";
     nativeBuildInputs = [ zstd ];
     stripRoot = false;
   };
 
   extra = fetchzip {
     url = "https://archive.archlinux.org/packages/g/geoip-database-extra/geoip-database-extra-${version}-1-any.pkg.tar.zst";
-    hash = "sha256-sb06yszstKalc+b9rSuStRuY3YRebAL1Q4jEJkbGiMI=";
+    hash = "sha256-qFJKeLEWag5Wvzye5heDs79ai0pkJndmZgS8Ip5T3G4=";
     nativeBuildInputs = [ zstd ];
     stripRoot = false;
   };
@@ -30,6 +33,28 @@ stdenv.mkDerivation rec {
     cp ${extra}/usr/share/GeoIP/*.dat $out/share/GeoIP
   '';
 
+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "update-geolite-legacy";
+      runtimeInputs = [
+        common-updater-scripts
+        pcre2
+      ];
+      text = ''
+        url=https://archive.archlinux.org/packages/g/geoip-database/
+
+        version=$(list-directory-versions --pname geoip-database --url $url |
+                  pcre2grep -o1 '^(\d{8})-1-any\.pkg\.tar\.zst$' |
+                  sort -n |
+                  tail -1)
+
+        for key in geoip extra; do
+            update-source-version "$UPDATE_NIX_ATTR_PATH" "$version" --source-key=$key --ignore-same-version
+        done
+      '';
+    });
+  };
+
   meta = {
     description = "GeoLite Legacy IP geolocation databases";
     homepage = "https://mailfud.org/geoip-legacy/";
diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index b69bcb15b1e6..9e58949dde7f 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "0.26.0";
+  version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${version}";
-    hash = "sha256-ya2KCUGHLdKcoxR83YqNG/4GiSgPABUeVaf1jqHtdzE=";
+    hash = "sha256-mC7C5B2e57xWrqbyaLM2n79BgdmlgiF2TxTmxT/McSA=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
index defcbe97676d..5dfee0f92ad5 100644
--- a/pkgs/by-name/li/linux-wallpaperengine/package.nix
+++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix
@@ -33,6 +33,7 @@
 let
   cef = cef-binary.overrideAttrs (oldAttrs: {
     version = "120.1.10";
+    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "3ce3184";
     chromiumVersion = "120.0.6099.129";
 
diff --git a/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix b/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix
index 01e300270541..a1b01ba9a057 100644
--- a/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix
+++ b/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix
@@ -18,20 +18,6 @@
   libxml2,
 }:
 
-let
-  libadwaita' = libadwaita.overrideAttrs (oldAttrs: {
-    version = "1.6.2-unstable-2025-01-02";
-    src = oldAttrs.src.override {
-      tag = null;
-      rev = "f5f0e7ce69405846a8f8bdad11cef2e2a7e99010";
-      hash = "sha256-n5RbGHtt2g627T/Tg8m3PjYIl9wfYTIcrplq1pdKAXk=";
-    };
-
-    # `test-application-window` is flaky on aarch64-linux
-    doCheck = false;
-  });
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "netease-cloud-music-gtk";
   version = "2.5.2";
@@ -70,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       openssl
       dbus
-      libadwaita'
+      libadwaita
       glib-networking
     ]
     ++ (with gst_all_1; [
diff --git a/pkgs/by-name/on/oniux/package.nix b/pkgs/by-name/on/oniux/package.nix
new file mode 100644
index 000000000000..e63fe4a308b3
--- /dev/null
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "oniux";
+  version = "0.4.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    owner = "tpo/core";
+    repo = "oniux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wWB/ch8DB2tO4+NuNDaGv8K4AbV5/MbyY01oRGai86A=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-tUOxs9bTcXS3Gq6cHYe+eAGAEYSRvf3JVGugBImbvJM=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://gitlab.torproject.org/tpo/core/oniux";
+    description = "Isolate Applications over Tor using Linux Namespaces";
+    maintainers = with lib.maintainers; [ tnias ];
+    platforms = lib.platforms.linux;
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    mainProgram = "oniux";
+  };
+})
diff --git a/pkgs/by-name/ss/sslh/package.nix b/pkgs/by-name/ss/sslh/package.nix
index eb937f3ef823..0c70cbb07023 100644
--- a/pkgs/by-name/ss/sslh/package.nix
+++ b/pkgs/by-name/ss/sslh/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslh";
-  version = "2.2.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "yrutschle";
     repo = "sslh";
     rev = "v${version}";
-    hash = "sha256-AAGS7/mhlPRbZ6VazVA0wnKf3SrEB/AgF8HgeICwvx4=";
+    hash = "sha256-SWkhTgJM6s89mgvJbqa+N75+0TYCvlEH1NQgaKjocFo=";
   };
 
   postPatch = "patchShebangs *.sh";
diff --git a/pkgs/by-name/ta/taler-exchange/package.nix b/pkgs/by-name/ta/taler-exchange/package.nix
index d9be94b66252..090db22e04ca 100644
--- a/pkgs/by-name/ta/taler-exchange/package.nix
+++ b/pkgs/by-name/ta/taler-exchange/package.nix
@@ -18,6 +18,7 @@
   jq,
   gettext,
   texinfo,
+  libtool,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,7 +36,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
+    recutils # recfix
     pkg-config
+    python3.pkgs.jinja2
+    texinfo # makeinfo
+    # jq is necessary for some tests and is checked by configure script
+    jq
   ];
 
   buildInputs = [
@@ -44,16 +50,14 @@ stdenv.mkDerivation (finalAttrs: {
     jansson
     libsodium
     libpq
+    libtool
     curl
-    recutils
     gettext
-    texinfo # Fix 'makeinfo' is missing on your system.
     libunistring
-    python3.pkgs.jinja2
-    # jq is necessary for some tests and is checked by configure script
-    jq
   ];
 
+  strictDeps = true;
+
   propagatedBuildInputs = [ gnunet ];
 
   # From ./bootstrap
@@ -90,6 +94,10 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  configureFlags = [
+    "ac_cv_path__libcurl_config=${lib.getDev curl}/bin/curl-config"
+  ];
+
   enableParallelBuilding = true;
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index 7b58ab29e424..815f77cbae09 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -104,5 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     teams = [ lib.teams.ngi ];
     platforms = lib.platforms.linux;
     mainProgram = "taler-wallet-cli";
+    # ./configure doesn't understand --build / --host
+    broken = stdenv.buildPlatform != stdenv.hostPlatform;
   };
 })
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index c33ecbf7f6b3..a36cb0aad6cf 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -13,18 +13,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taze";
-  version = "19.0.4";
+  version = "19.1.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "taze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WHqocBPIop3sNP55+SL1+yibuMQtUnIdMyHxQdQJN5M=";
+    hash = "sha256-hBXs8S8mOMV7FQIhCzJuhcbTczkwMc5B44fTacAJvyw=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-AyQMFqtRW8U0zPl0c9kq8olxqgZ97ln0u/UuXw/+QXI=";
+    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ui/uiua/unstable.nix b/pkgs/by-name/ui/uiua/unstable.nix
index 3245ab85de52..1729bdd2d25e 100644
--- a/pkgs/by-name/ui/uiua/unstable.nix
+++ b/pkgs/by-name/ui/uiua/unstable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.16.0-dev.2";
+  version = "0.16.0-rc.1";
   tag = version;
-  hash = "sha256-ZCyK6wqFRcKBGo1dgmN9pkvixkLev/STQg7HcrHfG0c=";
-  cargoHash = "sha256-zqhVwg9+iqjrK2cCGaT4QIN+6CUKZ5ecogA1Oqd8OqQ=";
+  hash = "sha256-c17CBFPBWe0UR+qwRMLCPGeaozVBq6aRv3haVDoIyyA=";
+  cargoHash = "sha256-8MulQU6SU1M/ITmPLtYa8SShXRsp7NTMhEZRXEgY5zw=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/up/upsun/versions.json b/pkgs/by-name/up/upsun/versions.json
index 5d0a450a0728..82b10f1f7e80 100644
--- a/pkgs/by-name/up/upsun/versions.json
+++ b/pkgs/by-name/up/upsun/versions.json
@@ -1,19 +1,19 @@
 {
-  "version": "5.0.23",
+  "version": "5.1.1",
   "darwin-amd64": {
-    "hash": "sha256-6bnna+8cDuZ593FTbEG6IGAxpuH/hVCjCDZJgkB3qRw=",
-    "url": "https://github.com/platformsh/cli/releases/download/5.0.23/upsun_5.0.23_darwin_all.tar.gz"
+    "hash": "sha256-oOM+CP4wWjfWBEejhmDM1hjyWistigPfIqotyOJJU/o=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.1.1/upsun_5.1.1_darwin_all.tar.gz"
   },
   "darwin-arm64": {
-    "hash": "sha256-6bnna+8cDuZ593FTbEG6IGAxpuH/hVCjCDZJgkB3qRw=",
-    "url": "https://github.com/platformsh/cli/releases/download/5.0.23/upsun_5.0.23_darwin_all.tar.gz"
+    "hash": "sha256-oOM+CP4wWjfWBEejhmDM1hjyWistigPfIqotyOJJU/o=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.1.1/upsun_5.1.1_darwin_all.tar.gz"
   },
   "linux-amd64": {
-    "hash": "sha256-yxn9r98mUEBCfnd0gkmEKbhPfnHiRxNEsDi3kTJBo6k=",
-    "url": "https://github.com/platformsh/cli/releases/download/5.0.23/upsun_5.0.23_linux_amd64.tar.gz"
+    "hash": "sha256-aozHXVnWGGIsOi5AopGbTLzah8AunaUrUoWnakM1+vs=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.1.1/upsun_5.1.1_linux_amd64.tar.gz"
   },
   "linux-arm64": {
-    "hash": "sha256-hr4XXEt/mK4HsV1Wp5oqieQs3gQcAy7AFNACaKA6wmA=",
-    "url": "https://github.com/platformsh/cli/releases/download/5.0.23/upsun_5.0.23_linux_arm64.tar.gz"
+    "hash": "sha256-MHb++8FXYo7YRq2HO5IypnyxxCQ7jZ5qysiuqmm0YJg=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.1.1/upsun_5.1.1_linux_arm64.tar.gz"
   }
 }
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 4bad0fb62fc8..4e467290386b 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -109,6 +109,7 @@ in
         rev = lib.last (lib.splitString "-" (lib.last rel));
       in
       "${date}-${rev}";
+    __intentionallyOverridingVersion = true;
 
     meta.broken = luaOlder "5.1" || luaAtLeast "5.5";
 
diff --git a/pkgs/development/php-packages/php-codesniffer/default.nix b/pkgs/development/php-packages/php-codesniffer/default.nix
index e38c47f91399..714cd7904556 100644
--- a/pkgs/development/php-packages/php-codesniffer/default.nix
+++ b/pkgs/development/php-packages/php-codesniffer/default.nix
@@ -6,16 +6,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "php-codesniffer";
-  version = "3.12.2";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "PHPCSStandards";
     repo = "PHP_CodeSniffer";
     tag = finalAttrs.version;
-    hash = "sha256-6bv5ejTsCAlSoCqtb7NOGVWJ9rYodAgl2zke+2x7ZaM=";
+    hash = "sha256-ReWLRVKkVY2fiPgZ3MQnHXDUGQYV1zci5B3Musxq5Q0=";
   };
 
-  vendorHash = "sha256-z3DWMACau49Z46OiUw88y7aTuaFywbFquhjla90FS3E=";
+  vendorHash = "sha256-+e80bUeTQ6bSvI/rFlCC7vwuM8pMTSnylEnPhH1LD14=";
 
   meta = {
     changelog = "https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/development/php-packages/uuid/default.nix b/pkgs/development/php-packages/uuid/default.nix
index 7102e50e7ebe..6112aa1d0db5 100644
--- a/pkgs/development/php-packages/uuid/default.nix
+++ b/pkgs/development/php-packages/uuid/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.1";
+  version = "1.3.0";
 in
 buildPecl {
   inherit version;
@@ -16,7 +16,7 @@ buildPecl {
     owner = "php";
     repo = "pecl-networking-uuid";
     tag = "v${version}";
-    hash = "sha256-C4SoSKkCTQOLKM1h47vbBgiHTG+ChocDB9tzhWfKUsw=";
+    hash = "sha256-00zJ//O1xqKTedRYThzeXOuL25wKLMZXjJWm/eXLkC4=";
   };
 
   buildInputs = [ libuuid ];
diff --git a/pkgs/development/python-modules/bitstruct/default.nix b/pkgs/development/python-modules/bitstruct/default.nix
index eea554734d9a..03cb7c8ad807 100644
--- a/pkgs/development/python-modules/bitstruct/default.nix
+++ b/pkgs/development/python-modules/bitstruct/default.nix
@@ -1,29 +1,33 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  pytestCheckHook,
   setuptools,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "bitstruct";
-  version = "8.20.0";
+  version = "8.21.0";
   pyproject = true;
 
+  src = fetchFromGitHub {
+    owner = "eerimoq";
+    repo = "bitstruct";
+    tag = version;
+    hash = "sha256-r2FPfSoW1Za7kglwpPXnWvWwzhAB8fQXiLPmbsi/8Ps=";
+  };
+
   build-system = [
     setuptools
   ];
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9rFqkwlzE/KmwUZkDJPl+YijnDM2T4wgpChqwcXtXa4=";
-  };
-
   pythonImportsCheck = [ "bitstruct" ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "Python bit pack/unpack package";
     homepage = "https://github.com/eerimoq/bitstruct";
diff --git a/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix b/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
index dd0e9df2edaf..b52ab776cbfc 100644
--- a/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-sensor-state-data";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bluetooth-sensor-state-data";
     tag = "v${version}";
-    hash = "sha256-XWSdPFhoCuIkQR/tXDhEFUsxpoDoiebI73MqRjtAvFo=";
+    hash = "sha256-V7stHAID6zkLFYDX5HUVF38/8OHa4AZr48FPmSoDcAE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/directv/default.nix b/pkgs/development/python-modules/directv/default.nix
index 43a1a1d0e655..dfc205beb077 100644
--- a/pkgs/development/python-modules/directv/default.nix
+++ b/pkgs/development/python-modules/directv/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   aiohttp,
   yarl,
   aresponses,
@@ -12,16 +13,24 @@
 buildPythonPackage rec {
   pname = "directv";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ctalkington";
     repo = "python-directv";
-    rev = version;
-    sha256 = "19jckf6qvl8fwi8yff1qy8c44xdz3zpi1ip1md6zl2c503qc91mk";
+    tag = version;
+    hash = "sha256-s4bE8ACFCfpNq+HGEO8fv3VCGPI4OOdR5A7RjY2bTKY=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    # TypeError: 'Timeout' object does not support the context manager protocol
+    substituteInPlace directv/directv.py \
+      --replace-fail "with async_timeout.timeout" "async with async_timeout.timeout"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     yarl
   ];
@@ -32,6 +41,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     #  ValueError: Host '#' cannot contain '#' (at position 0)
     "test_client_error"
@@ -39,10 +50,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "directv" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/ctalkington/python-directv/releases/tag/${src.tag}";
     description = "Asynchronous Python client for DirecTV (SHEF)";
     homepage = "https://github.com/ctalkington/python-directv";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/langgraph-checkpoint/default.nix b/pkgs/development/python-modules/langgraph-checkpoint/default.nix
index f80cab9c3982..7409ddd404ed 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-checkpoint";
-  version = "2.0.25";
+  version = "2.0.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "checkpoint==${version}";
-    hash = "sha256-MmbdG5oYLG3rwJ1kr9oJuaWc0Wo7nvqEoFwO9DAw7oM=";
+    hash = "sha256-DSkjaxUfpsOg2ex0dgfO/UJ7WiQb5wQsAGgHPTckF6o=";
   };
 
   sourceRoot = "${src.name}/libs/checkpoint";
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index 8ed1a8e05f7e..cfe3b58ea442 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -15,22 +15,22 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "25.02.4";
+  version = "25.02.5";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      hash = "sha256-vMEmrPrqaasHYQI362mm3/dxCZ6gxan+rPjZrhECYEE=";
+      hash = "sha256-wYFqT1g+rtoqOR7+Bb5mIJLZ5JdT2M1kcHqJUCuNElA=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      hash = "sha256-2C4AEy18kP4l2uORqFz7pQvi4wmLqYFyKBJJM26DIzI=";
+      hash = "sha256-PDlu+oFKWHraPdTuGDCUkO0bhPtkNVibo11B1QkCICw=";
     };
     darwin-aarch64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      hash = "sha256-5cwcoKxpbeGoBWM/462loI9hwUKg6iQX6VjswI8nA7U=";
+      hash = "sha256-RqcGHXN29GDGGuFbrQCBmj3cctzoRQZ8svR5hMYPhxs=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 35ae6875aa57..b734d66be00e 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.13";
+  version = "4.1.14";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Uls3S53jdoGyJ5xUEipQ0Ev5LAp5wzF2DsaLZCy+6Gc=";
+    hash = "sha256-fAs289FFdUnddkikm4ceA9d/w1qqqaWuPXmAiq3cIA8=";
   };
 }
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 8ecdb6879740..cf7917f366a9 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -87,7 +87,48 @@ let
       args = rattrs (args // { inherit finalPackage overrideAttrs; });
       #              ^^^^
 
-      overrideAttrs = f0: makeDerivationExtensible (lib.extends (lib.toExtension f0) rattrs);
+      overrideAttrs =
+        f0:
+        let
+          extends' =
+            overlay: f:
+            (
+              final:
+              let
+                prev = f final;
+                thisOverlay = overlay final prev;
+                warnForBadVersionOverride = (
+                  thisOverlay ? version
+                  && !(thisOverlay ? src)
+                  && !(thisOverlay.__intentionallyOverridingVersion or false)
+                );
+                pname = args.pname or "<unknown name>";
+                version = args.version or "<unknown version>";
+                pos = builtins.unsafeGetAttrPos "version" thisOverlay;
+              in
+              lib.warnIf warnForBadVersionOverride ''
+                ${
+                  args.name or "${pname}-${version}"
+                } was overridden with `version` but not `src` at ${pos.file or "<unknown file>"}:${
+                  builtins.toString pos.line or "<unknown line>"
+                }:${builtins.toString pos.column or "<unknown column>"}.
+
+                This is most likely not what you want. In order to properly change the version of a package, override
+                both the `version` and `src` attributes:
+
+                hello.overrideAttrs (oldAttrs: rec {
+                  version = "1.0.0";
+                  src = pkgs.fetchurl {
+                    url = "mirror://gnu/hello/hello-''${version}.tar.gz";
+                    hash = "...";
+                  };
+                })
+
+                (To silence this warning, set `__intentionallyOverridingVersion = true` in your `overrideAttrs` call.)
+              '' (prev // (builtins.removeAttrs thisOverlay [ "__intentionallyOverridingVersion" ]))
+            );
+        in
+        makeDerivationExtensible (extends' (lib.toExtension f0) rattrs);
 
       finalPackage = mkDerivationSimple overrideAttrs args;