diff --git a/nixos/modules/services/misc/bees.nix b/nixos/modules/services/misc/bees.nix
index 2815bb035cb7..96c4789f86e0 100644
--- a/nixos/modules/services/misc/bees.nix
+++ b/nixos/modules/services/misc/bees.nix
@@ -87,7 +87,7 @@ in
       default = { };
       example = lib.literalExpression ''
         {
-          root = {
+          "-" = {
             spec = "LABEL=root";
             hashTableSizeMB = 2048;
             verbosity = "crit";
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 0a901148dc9c..70a96e4740d6 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -886,10 +886,10 @@ in
               "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
                 install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
                 ${optionalString (cfg.cert != null) ''
-                  install -Dm400 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
+                  install -Dm644 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
                 ''}
                 ${optionalString (cfg.key != null) ''
-                  install -Dm400 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
+                  install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
           ExecStart = ''
diff --git a/nixos/modules/services/networking/zeronsd.nix b/nixos/modules/services/networking/zeronsd.nix
index 23f1a5fa7e4f..25e7c03395bf 100644
--- a/nixos/modules/services/networking/zeronsd.nix
+++ b/nixos/modules/services/networking/zeronsd.nix
@@ -102,7 +102,7 @@ in
     }) cfg.servedNetworks;
 
     systemd.tmpfiles.rules = [
-      "a+ /var/lib/zerotier-one - - - - u:zeronsd:x"
+      "a+ /var/lib/zerotier-one - - - - mask::x,u:zeronsd:x"
       "a+ /var/lib/zerotier-one/authtoken.secret - - - - mask::r,u:zeronsd:r"
     ];
 
diff --git a/nixos/tests/jenkins.nix b/nixos/tests/jenkins.nix
index 0b941e1617b0..cd82214fb3ac 100644
--- a/nixos/tests/jenkins.nix
+++ b/nixos/tests/jenkins.nix
@@ -11,7 +11,6 @@ import ./make-test-python.nix (
     meta = with pkgs.lib.maintainers; {
       maintainers = [
         bjornfor
-        coconnor
         domenkozar
       ];
     };
diff --git a/nixos/tests/pam/pam-file-contents.nix b/nixos/tests/pam/pam-file-contents.nix
index 18f61d0b0beb..50551d8fd340 100644
--- a/nixos/tests/pam/pam-file-contents.nix
+++ b/nixos/tests/pam/pam-file-contents.nix
@@ -25,8 +25,8 @@ import ../make-test-python.nix (
 
     testScript =
       builtins.replaceStrings
-        [ "@@pam_ccreds@@" "@@pam_krb5@@" ]
-        [ pkgs.pam_ccreds.outPath pkgs.pam_krb5.outPath ]
+        [ "@@pam@@" "@@pam_ccreds@@" "@@pam_krb5@@" ]
+        [ pkgs.pam.outPath pkgs.pam_ccreds.outPath pkgs.pam_krb5.outPath ]
         (builtins.readFile ./test_chfn.py);
   }
 )
diff --git a/nixos/tests/pam/test_chfn.py b/nixos/tests/pam/test_chfn.py
index 3cfbb3908e9d..900feb35f4b3 100644
--- a/nixos/tests/pam/test_chfn.py
+++ b/nixos/tests/pam/test_chfn.py
@@ -1,17 +1,17 @@
 expected_lines = {
-    "account required pam_unix.so",
+    "account required @@pam@@/lib/security/pam_unix.so",
     "account sufficient @@pam_krb5@@/lib/security/pam_krb5.so",
     "auth [default=die success=done] @@pam_ccreds@@/lib/security/pam_ccreds.so action=validate use_first_pass",
     "auth [default=ignore success=1 service_err=reset] @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass",
-    "auth required pam_deny.so",
+    "auth required @@pam@@/lib/security/pam_deny.so",
     "auth sufficient @@pam_ccreds@@/lib/security/pam_ccreds.so action=store use_first_pass",
-    "auth sufficient pam_rootok.so",
-    "auth sufficient pam_unix.so likeauth try_first_pass",
+    "auth sufficient @@pam@@/lib/security/pam_rootok.so",
+    "auth sufficient @@pam@@/lib/security/pam_unix.so likeauth try_first_pass",
     "password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass",
-    "password sufficient pam_unix.so nullok yescrypt",
+    "password sufficient @@pam@@/lib/security/pam_unix.so nullok yescrypt",
     "session optional @@pam_krb5@@/lib/security/pam_krb5.so",
-    "session required pam_env.so conffile=/etc/pam/environment readenv=0",
-    "session required pam_unix.so",
+    "session required @@pam@@/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0",
+    "session required @@pam@@/lib/security/pam_unix.so",
 }
 actual_lines = set(machine.succeed("cat /etc/pam.d/chfn").splitlines())
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 28a3bec2e046..fe343e2881de 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -8162,6 +8162,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  mini-keymap = buildVimPlugin {
+    pname = "mini.keymap";
+    version = "2025-05-20";
+    src = fetchFromGitHub {
+      owner = "echasnovski";
+      repo = "mini.keymap";
+      rev = "2aa0a66d6cbf15c9cea331d976ac4d4b9f01621e";
+      sha256 = "18samb1yjvmw2yjl0l4csl484aqah71qr19zspx46z5dk3jib908";
+    };
+    meta.homepage = "https://github.com/echasnovski/mini.keymap/";
+    meta.hydraPlatforms = [ ];
+  };
+
   mini-map = buildVimPlugin {
     pname = "mini.map";
     version = "2025-04-01";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index ea00dc8180fd..1b622615869f 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -626,6 +626,7 @@ https://github.com/echasnovski/mini.icons/,HEAD,
 https://github.com/echasnovski/mini.indentscope/,HEAD,
 https://github.com/echasnovski/mini.jump/,HEAD,
 https://github.com/echasnovski/mini.jump2d/,HEAD,
+https://github.com/echasnovski/mini.keymap/,HEAD,
 https://github.com/echasnovski/mini.map/,HEAD,
 https://github.com/echasnovski/mini.misc/,HEAD,
 https://github.com/echasnovski/mini.move/,HEAD,
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/0001-fix-libxml-error-signature.patch b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/0001-fix-libxml-error-signature.patch
new file mode 100644
index 000000000000..2ff8821e6119
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/0001-fix-libxml-error-signature.patch
@@ -0,0 +1,21 @@
+diff --git a/src/core/sipe-xml.c b/src/core/sipe-xml.c
+index cfc5311..c38f6e8 100644
+--- a/src/core/sipe-xml.c
++++ b/src/core/sipe-xml.c
+@@ -29,6 +29,7 @@
+ #include <time.h>
+ 
+ #include "libxml/parser.h"
++#include "libxml/xmlerror.h"
+ #include "libxml/c14n.h"
+ #include "libxml/xmlversion.h"
+ 
+@@ -154,7 +155,7 @@ static void callback_error(void *user_data, const char *msg, ...)
+ 	g_free(errmsg);
+ }
+ 
+-static void callback_serror(void *user_data, xmlErrorPtr error)
++static void callback_serror(void *user_data, const xmlError *error)
+ {
+ 	struct _parser_data *pd = user_data;
+ 
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/default.nix
index 37e69759286f..15706024b23c 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/sipe/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
       url = "https://repo.or.cz/siplcs.git/patch/583a734e63833f03d11798b7b0d59a17d08ae60f";
       sha256 = "Ai6Czpy/FYvBi4GZR7yzch6OcouJgfreI9HcojhGVV4=";
     })
+    ./0001-fix-libxml-error-signature.patch
   ];
 
   nativeBuildInputs = [ intltool ];
diff --git a/pkgs/by-name/an/android-udev-rules/package.nix b/pkgs/by-name/an/android-udev-rules/package.nix
index 402f598a10d5..9e8eb2f5a069 100644
--- a/pkgs/by-name/an/android-udev-rules/package.nix
+++ b/pkgs/by-name/an/android-udev-rules/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20250314";
+  version = "20250525";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    hash = "sha256-QADyZ3FHVuxX/PfsRt2ijwJRCksQb1Hz5lSgYJlyb1Q=";
+    hash = "sha256-4ODU9EoVYV+iSu6+M9ePed45QkOZgWkDUlFTlWJ8ttQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/co/commandergenius/package.nix b/pkgs/by-name/co/commandergenius/package.nix
index a9b0afe5d19d..5c60cde73927 100644
--- a/pkgs/by-name/co/commandergenius/package.nix
+++ b/pkgs/by-name/co/commandergenius/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   SDL2,
   SDL2_image,
   pkg-config,
@@ -14,6 +15,7 @@
   SDL2_mixer,
   SDL2_ttf,
   python3,
+  xorg,
 }:
 
 stdenv.mkDerivation rec {
@@ -38,6 +40,7 @@ stdenv.mkDerivation rec {
     zlib
     curl
     python3
+    xorg.libX11
   ];
 
   cmakeFlags = [
@@ -54,6 +57,16 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  patches = [
+    # Fixes a broken build due to a renamed inner struct of SDL_ttf.
+    # Should be removable as soon as upstream releases v. 3.5.3.
+    (fetchpatch {
+      name = "fix-sdl-ttf_font_rename.patch";
+      url = "https://github.com/gerstrong/Commander-Genius/commit/e8af0d16970d75e94392f57de0992dfddc509bc3.patch";
+      hash = "sha256-bcCzXzh9yDngwHMfQTrnvyDal4YBiBcMTtKTgt9BtDk=";
+    })
+  ];
+
   postPatch = ''
     NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(sdl2-config --cflags)"
     sed -i 's,APPDIR games,APPDIR bin,' src/install.cmake
diff --git a/pkgs/by-name/dd/ddev/package.nix b/pkgs/by-name/dd/ddev/package.nix
index 2df598aa57f6..85d1f0e837e8 100644
--- a/pkgs/by-name/dd/ddev/package.nix
+++ b/pkgs/by-name/dd/ddev/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "ddev";
-  version = "1.24.5";
+  version = "1.24.6";
 
   src = fetchFromGitHub {
     owner = "ddev";
     repo = "ddev";
     rev = "v${version}";
-    hash = "sha256-CyYGmxYJ5ef+H1qt0CiFcGOslBwkeHqdDQcmuqu4g9M=";
+    hash = "sha256-vOf500/HdOWn24MdXDfbetqAyKbEsaut707O+Rndks8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fo/font-manager/package.nix b/pkgs/by-name/fo/font-manager/package.nix
index 243c36a26c87..c74d5b86e39f 100644
--- a/pkgs/by-name/fo/font-manager/package.nix
+++ b/pkgs/by-name/fo/font-manager/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   meson,
   ninja,
   gettext,
@@ -16,6 +17,7 @@
   gsettings-desktop-schemas,
   gtk4,
   adwaita-icon-theme,
+  libarchive,
   desktop-file-utils,
   nix-update-script,
   wrapGAppsHook4,
@@ -27,17 +29,26 @@
   webkitgtk_6_0,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "font-manager";
-  version = "0.9.2";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "font-manager";
-    rev = version;
-    hash = "sha256-x7ZRC/xwF6Y2BhbtApVZ4hPZGNGaJiilqpxLyax9r2g=";
+    tag = finalAttrs.version;
+    hash = "sha256-hggRvwMy/D2jc98CQPc7GChTV9+zYbYHPMENf/8Uq9s=";
   };
 
+  patches = [
+    # TODO: drop this patch when updating beyond version 0.9.4
+    (fetchpatch {
+      name = "fix-reproducible-build-issue.patch";
+      url = "https://github.com/FontManager/font-manager/commit/cc0c148d90741e39615e3380d283f684a052dd94.patch";
+      hash = "sha256-bRn+jVjBu6ZqmQCErgcqxv6OyFa4hkPYB5bvK7rEibA=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     meson
@@ -61,6 +72,7 @@ stdenv.mkDerivation rec {
       gsettings-desktop-schemas # for font settings
       gtk4
       adwaita-icon-theme
+      libarchive
     ]
     ++ lib.optionals withWebkit [
       glib-networking # for SSL so that Google Fonts can load
@@ -77,6 +89,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://fontmanager.github.io/";
+    changelog = "https://github.com/FontManager/font-manager/raw/refs/tags/${finalAttrs.version}/CHANGELOG";
     description = "Simple font management for GTK desktop environments";
     mainProgram = "font-manager";
     longDescription = ''
@@ -92,4 +105,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     maintainers = [ maintainers.romildo ];
   };
-}
+})
diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix
index d0fbd3fd6571..a1d16594344b 100644
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@@ -25,6 +25,7 @@ python3Packages.buildPythonApplication {
 
   dependencies = [
     python3Packages.requests
+    python3Packages.pysocks
     yt-dlp
   ];
 
diff --git a/pkgs/by-name/gc/gcli/package.nix b/pkgs/by-name/gc/gcli/package.nix
index 135790f60afc..36b9e3b2cf93 100644
--- a/pkgs/by-name/gc/gcli/package.nix
+++ b/pkgs/by-name/gc/gcli/package.nix
@@ -6,6 +6,7 @@
   pkg-config,
   byacc,
   flex,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,6 +20,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-N5dzGhyXPDWcm/cNUSUQt4rR+PzaD1OUssRO3Sdfmoo=";
   };
 
+  patches = [
+    # Darwin builds are fixed in master, but the change is unreleased.
+    (fetchpatch {
+      name = "darwin-build-fix.patch";
+      url = "https://github.com/herrhotzenplotz/gcli/commit/720e372250fd363bdd90e9452907508563e30f93.patch";
+      hash = "sha256-TpjIisje20YObN2wf8iQlwHlY5kg0S7xTkUWxAmK+po=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     byacc
diff --git a/pkgs/by-name/go/gose/package.nix b/pkgs/by-name/go/gose/package.nix
index c5a47ee46be1..2a5cec699716 100644
--- a/pkgs/by-name/go/gose/package.nix
+++ b/pkgs/by-name/go/gose/package.nix
@@ -7,13 +7,13 @@
   lib,
 }:
 let
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     repo = "gose";
     owner = "stv0g";
     tag = "v${version}";
-    hash = "sha256-8ghz2CpHNUUUpxg7VFi4DwDFa0GlPKaRJ3zC4XC0IyA=";
+    hash = "sha256-H+15d0wCfL+jd+xjKSOrimLIAG1Mh8vO+5MaHaVocJg=";
   };
 
   frontend = buildNpmPackage {
@@ -37,7 +37,7 @@ buildGoModule {
   inherit version;
   inherit src;
 
-  vendorHash = "sha256-6AfLoIRDO3diKZ9yFpVVIsRUFxQfLbmk91Cs5336OIE=";
+  vendorHash = "sha256-HsYF4v7RUzGDJvZEoq0qTo9iPGJoqK4YqTsXSv8SwKQ=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/hy/hydra/package.nix b/pkgs/by-name/hy/hydra/package.nix
index 84d326b54865..3c8422635c82 100644
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -130,13 +130,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hydra";
-  version = "0-unstable-2025-04-16";
+  version = "0-unstable-2025-04-23";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "bdde73acbd66c569e8171b42b810adf92a56f76a";
-    hash = "sha256-1hj8JJ4ngqzJ8Xt3WvCBnQmwTnzzaZaQlCJcPWQvvM4=";
+    rev = "455f1a0665c6ca55df2a17679f6103402a9e9431";
+    hash = "sha256-rn9ZE4ERml8ZkT9ziDrqGEJfzr0rJlzYfu2PHL71oiI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index 9e58949dde7f..38f8ef761218 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "0.26.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${version}";
-    hash = "sha256-mC7C5B2e57xWrqbyaLM2n79BgdmlgiF2TxTmxT/McSA=";
+    hash = "sha256-M7hvT7y11X6BN6WJqTIlb5b5x7kaa7MAdhbztZAvJ48=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
@@ -32,7 +32,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-z9gS8i9GatDq4flomPcBUpf7b/6BJZ42lGOmpfpdmao=";
+  vendorHash = "sha256-7zOW1nRhxh+jpGNxAxgepC67NCBA3IIfcOKmniGjkwM=";
 
   # options used by upstream:
   # https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml
diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index 9a284e9e6881..c692d25eda70 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -80,7 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = with maintainers; [
-      coconnor
       earldouglas
       nequissimus
     ];
diff --git a/pkgs/by-name/la/lapack/package.nix b/pkgs/by-name/la/lapack/package.nix
index 017c84213760..ba24b000b827 100644
--- a/pkgs/by-name/la/lapack/package.nix
+++ b/pkgs/by-name/la/lapack/package.nix
@@ -9,12 +9,16 @@
 
 let
 
+  libraryExtension = stdenv.hostPlatform.extensions.sharedLibrary or ".a";
   version = "3";
   canonicalExtension =
     if stdenv.hostPlatform.isLinux then
-      "${stdenv.hostPlatform.extensions.sharedLibrary}.${version}"
+      if stdenv.hostPlatform.extensions ? sharedLibrary then
+        "${stdenv.hostPlatform.extensions.sharedLibrary}.${version}"
+      else
+        ".a"
     else
-      stdenv.hostPlatform.extensions.sharedLibrary;
+      libraryExtension;
 
   lapackImplementation = lib.getName lapackProvider;
   lapackProvider' =
@@ -71,14 +75,14 @@ stdenv.mkDerivation {
       chmod +w $out/lib/liblapack${canonicalExtension}
 
     ''
-    + (lib.optionalString stdenv.hostPlatform.isElf ''
+    + (lib.optionalString (stdenv.hostPlatform.isElf && !stdenv.hostPlatform.isStatic) ''
       patchelf --set-soname liblapack${canonicalExtension} $out/lib/liblapack${canonicalExtension}
       patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider'}/lib" $out/lib/liblapack${canonicalExtension}
     '')
     + ''
 
-        if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
-          ln -s $out/lib/liblapack${canonicalExtension} "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}"
+        if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${libraryExtension}" ]; then
+          ln -s $out/lib/liblapack${canonicalExtension} "$out/lib/liblapack${libraryExtension}"
         fi
 
         install -D ${lib.getDev lapack-reference}/include/lapack.h $dev/include/lapack.h
@@ -102,7 +106,7 @@ stdenv.mkDerivation {
         chmod +w $out/lib/liblapacke${canonicalExtension}
 
     ''
-    + (lib.optionalString stdenv.hostPlatform.isElf ''
+    + (lib.optionalString (stdenv.hostPlatform.isElf && !stdenv.hostPlatform.isStatic) ''
       patchelf --set-soname liblapacke${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
       patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider'}/lib" $out/lib/liblapacke${canonicalExtension}
     '')
@@ -125,7 +129,7 @@ stdenv.mkDerivation {
     + lib.optionalString (lapackImplementation == "mkl") ''
       mkdir -p $out/nix-support
       echo 'export MKL_INTERFACE_LAYER=${lib.optionalString isILP64 "I"}LP64,GNU' > $out/nix-support/setup-hook
-      ln -s $out/lib/liblapack${canonicalExtension} $out/lib/libmkl_rt${stdenv.hostPlatform.extensions.sharedLibrary}
+      ln -s $out/lib/liblapack${canonicalExtension} $out/lib/libmkl_rt${libraryExtension}
       ln -sf ${lapackProvider'}/include/* $dev/include
     ''
   );
diff --git a/pkgs/by-name/li/libcgroup/package.nix b/pkgs/by-name/li/libcgroup/package.nix
index 69f2238df1b8..c2032d1511db 100644
--- a/pkgs/by-name/li/libcgroup/package.nix
+++ b/pkgs/by-name/li/libcgroup/package.nix
@@ -5,7 +5,9 @@
   pam,
   bison,
   flex,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   systemdLibs,
+  musl-fts,
   autoreconfHook,
 }:
 
@@ -21,15 +23,30 @@ stdenv.mkDerivation rec {
     hash = "sha256-kWW9ID/eYZH0O/Ge8pf3Cso4yu644R5EiQFYfZMcizs=";
   };
 
+  configureFlags =
+    [
+      (lib.enableFeature enableSystemd "systemd")
+    ]
+    # implicit declaration of function 'rpl_malloc', ; did you mean 'realloc'
+    #
+    # It looks like in case of cross-compilation, autoconf assumes that malloc of the
+    # target platform is broken.
+    ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
+      "ac_cv_func_malloc_0_nonnull=yes"
+      "ac_cv_func_realloc_0_nonnull=yes"
+    ];
+
   nativeBuildInputs = [
     autoreconfHook
     bison
     flex
   ];
-  buildInputs = [
-    pam
-    systemdLibs
-  ];
+  buildInputs =
+    [
+      pam
+    ]
+    ++ lib.optional enableSystemd systemdLibs
+    ++ lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
   postPatch = ''
     substituteInPlace src/tools/Makefile.am \
diff --git a/pkgs/by-name/li/libcs50/package.nix b/pkgs/by-name/li/libcs50/package.nix
index becca7221ef6..ffb201859600 100644
--- a/pkgs/by-name/li/libcs50/package.nix
+++ b/pkgs/by-name/li/libcs50/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -11,22 +12,25 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "cs50";
     repo = "libcs50";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-G6QayPGR4lkeFuUYsFszekLAzzpA3hhIRmqt/OB0cdY=";
   };
 
   installPhase = ''
     runHook preInstall
-    mkdir $out
+    mkdir -p $out
     cp -R build/lib $out/lib
     cp -R build/include $out/include
     ln -sf $out/lib/libcs50.so.11.0.3 $out/lib/libcs50.so.11
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://github.com/cs50/libcs50";
     description = "CS50 Library for C";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
   };
 })
diff --git a/pkgs/by-name/ma/matrix-appservice-discord/package.nix b/pkgs/by-name/ma/matrix-appservice-discord/package.nix
index dcd43ba0d852..bd8f6d9c5db4 100644
--- a/pkgs/by-name/ma/matrix-appservice-discord/package.nix
+++ b/pkgs/by-name/ma/matrix-appservice-discord/package.nix
@@ -7,11 +7,12 @@
   makeWrapper,
   removeReferencesTo,
   python3,
-  nodejs,
+  nodejs_20,
   matrix-sdk-crypto-nodejs,
 }:
 
 let
+  nodejs = nodejs_20; # only supports nodejs v18.X - v20.X
   pin = lib.importJSON ./pin.json;
   nodeSources = srcOnly nodejs;
 
@@ -19,6 +20,7 @@ in
 mkYarnPackage rec {
   pname = "matrix-appservice-discord";
   inherit (pin) version;
+  inherit nodejs;
 
   src = fetchFromGitHub {
     owner = "matrix-org";
@@ -101,7 +103,7 @@ mkYarnPackage rec {
 
   meta = {
     description = "Bridge between Matrix and Discord";
-    homepage = "https://github.com/Half-Shot/matrix-appservice-discord";
+    homepage = "https://github.com/matrix-org/matrix-appservice-discord";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ euxane ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/oc/ocrad/package.nix b/pkgs/by-name/oc/ocrad/package.nix
index 8ffd4ecf8a16..32cbf8b034e0 100644
--- a/pkgs/by-name/oc/ocrad/package.nix
+++ b/pkgs/by-name/oc/ocrad/package.nix
@@ -1,28 +1,33 @@
 {
-  fetchurl,
   lib,
   stdenv,
+  fetchurl,
   lzip,
   texinfo,
+  libpng,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocrad";
-  version = "0.27";
+  version = "0.29";
 
   src = fetchurl {
-    url = "mirror://gnu/ocrad/${pname}-${version}.tar.lz";
-    sha256 = "0divffvcaim89g4pvqs8kslbcxi475bcl3b4ynphf284k9zfdgx9";
+    url = "mirror://gnu/ocrad/ocrad-${finalAttrs.version}.tar.lz";
+    hash = "sha256-ESAMxrC3uhaISnLcy1jvaU96omzSsgQeVVWA8GTS2ek=";
   };
 
   nativeBuildInputs = [
     lzip # unpack
   ];
-  buildInputs = [ texinfo ];
+
+  buildInputs = [
+    texinfo
+    libpng
+  ];
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Optical character recognition (OCR) program & library";
     longDescription = ''
       GNU Ocrad is an OCR (Optical Character Recognition) program based on
@@ -37,9 +42,9 @@ stdenv.mkDerivation rec {
       backend to other programs.
     '';
 
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pSub ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ pSub ];
+    platforms = lib.platforms.unix;
     mainProgram = "ocrad";
   };
-}
+})
diff --git a/pkgs/by-name/ri/rime-wanxiang/package.nix b/pkgs/by-name/ri/rime-wanxiang/package.nix
index b835ac901c1c..a0b08f99b4df 100644
--- a/pkgs/by-name/ri/rime-wanxiang/package.nix
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "6.7.9";
+  version = "6.8.7";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime_wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-cOHwgy0rjqce7MedL0hK59royKlAPmZRGcVHRx0FrRU=";
+    hash = "sha256-t3A79jvNxroq+aeHwwc24rvzPDJbKxkOgrb9mgdN340=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rusty-man/package.nix b/pkgs/by-name/ru/rusty-man/package.nix
index 1f9d78b7ca21..748c717ad514 100644
--- a/pkgs/by-name/ru/rusty-man/package.nix
+++ b/pkgs/by-name/ru/rusty-man/package.nix
@@ -2,28 +2,39 @@
   lib,
   rustPlatform,
   fetchFromSourcehut,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusty-man";
   version = "0.5.0";
 
   src = fetchFromSourcehut {
     owner = "~ireas";
     repo = "rusty-man";
-    rev = "v${version}";
-    sha256 = "sha256-djprzmogT1OEf0/+twdxzx30YaMNzFjXkZd4IDsH8oo=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-djprzmogT1OEf0/+twdxzx30YaMNzFjXkZd4IDsH8oo=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-ZIRwp5AJugMDxg3DyFIH5VlD0m4Si2tJdspKE5QEB4M=";
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Command-line viewer for documentation generated by rustdoc";
     mainProgram = "rusty-man";
     homepage = "https://git.sr.ht/~ireas/rusty-man";
-    changelog = "https://git.sr.ht/~ireas/rusty-man/tree/v${version}/item/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+    changelog = "https://git.sr.ht/~ireas/rusty-man/tree/v${finalAttrs.version}/item/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      figsoda
+      defelo
+    ];
   };
-}
+})
diff --git a/pkgs/by-name/to/tokei/package.nix b/pkgs/by-name/to/tokei/package.nix
index 42e0ba450c75..da60731d9992 100644
--- a/pkgs/by-name/to/tokei/package.nix
+++ b/pkgs/by-name/to/tokei/package.nix
@@ -5,42 +5,49 @@
   rustPlatform,
   libiconv,
   zlib,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tokei";
   version = "13.0.0-alpha.8";
 
   src = fetchFromGitHub {
     owner = "XAMPPRocky";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
+    repo = "tokei";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jCI9VM3y76RI65E5UGuAPuPkDRTMyi+ydx64JWHcGfE=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-LzlyrKaRjUo6JnVLQnHidtI4OWa+GrhAc4D8RkL+nmQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libiconv
-  ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
   checkInputs = lib.optionals stdenv.hostPlatform.isDarwin [ zlib ];
 
   # enable all output formats
   buildFeatures = [ "all" ];
 
-  meta = with lib; {
-    description = "Program that allows you to count your code, quickly";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=unstable" ]; };
+
+  meta = {
+    description = "Count your code, quickly";
     longDescription = ''
-      Tokei is a program that displays statistics about your code. Tokei will show number of files, total lines within those files and code, comments, and blanks grouped by language.
+      Tokei is a program that displays statistics about your code. Tokei will show the number of files, total lines within those files and code, comments, and blanks grouped by language.
     '';
     homepage = "https://github.com/XAMPPRocky/tokei";
-    license = with licenses; [
+    changelog = "https://github.com/XAMPPRocky/tokei/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
       asl20 # or
       mit
     ];
-    maintainers = with maintainers; [ ];
+    maintainers = with lib.maintainers; [ defelo ];
     mainProgram = "tokei";
   };
-}
+})
diff --git a/pkgs/by-name/vo/vopono/package.nix b/pkgs/by-name/vo/vopono/package.nix
index 94f933a03327..f40fae3d24b1 100644
--- a/pkgs/by-name/vo/vopono/package.nix
+++ b/pkgs/by-name/vo/vopono/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "vopono";
-  version = "0.10.11";
+  version = "0.10.12";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-qgsfTniikrdykFSFqZATp7ewPZm5z5p5FMztNKWzPIY=";
+    hash = "sha256-bn3I5Yx9Kzj9ZQWn0fQUeDa6qjFAhWM38wJ/Oz3Q72k=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hQfLj2wbCjI2O/6hh9IJk9ehakGrvF2IbY8aVAPPT0o=";
+  cargoHash = "sha256-vtZeL8XjsdzJcuHAVZKoI4GpcqHaOucX9qkjToIVqfQ=";
 
   meta = with lib; {
     description = "Run applications through VPN connections in network namespaces";
diff --git a/pkgs/development/beam-modules/elixir-ls/default.nix b/pkgs/development/beam-modules/elixir-ls/default.nix
index 75e73ffbe75d..a683c6b126cd 100644
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -11,12 +11,12 @@
 
 let
   pname = "elixir-ls";
-  version = "0.27.2";
+  version = "0.28.1";
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    hash = "sha256-y1QT+wRFc+++OVFJwEheqcDIwaKHlyjbhEjhLJ2rYaI=";
+    hash = "sha256-r4P+3MPniDNdF3SG2jfBbzHsoxn826eYd2tsv6bJBoI=";
   };
 in
 mixRelease {
@@ -32,7 +32,7 @@ mixRelease {
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version elixir;
-    hash = "sha256-een28zUukN8H/8bZNc3pqtg1NXmkU9zv89muCAF93Xk=";
+    hash = "sha256-8zs+99jwf+YX5SwD65FCPmfrYhTCx4AQGCGsDeCKxKc=";
   };
 
   # elixir-ls is an umbrella app
diff --git a/pkgs/development/compilers/dart/package-source-builders/sentry_flutter/default.nix b/pkgs/development/compilers/dart/package-source-builders/sentry_flutter/default.nix
index dec8882e59d0..11a2f3c6ad6b 100644
--- a/pkgs/development/compilers/dart/package-source-builders/sentry_flutter/default.nix
+++ b/pkgs/development/compilers/dart/package-source-builders/sentry_flutter/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   fetchFromGitHub,
 }:
@@ -18,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   inherit version src;
   inherit (src) passthru;
 
-  postPatch = ''
+  postPatch = lib.optionalString (lib.versionAtLeast version "8.10.0") ''
     sed -i "s|GIT_REPOSITORY.*|SOURCE_DIR "${sentry-native}"|" sentry-native/sentry-native.cmake
     sed -i '/GIT_TAG/d' sentry-native/sentry-native.cmake
   '';
diff --git a/pkgs/development/compilers/llvm/common/libc/default.nix b/pkgs/development/compilers/llvm/common/libc/default.nix
index ecb70c783431..69d830a19d71 100644
--- a/pkgs/development/compilers/llvm/common/libc/default.nix
+++ b/pkgs/development/compilers/llvm/common/libc/default.nix
@@ -79,12 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "libc;compiler-rt")
       # Tests requires the host to have a libc.
       (lib.cmakeBool "LLVM_INCLUDE_TESTS" (stdenv.cc.libc != null))
-      (lib.cmakeBool "LLVM_LIBC_INCLUDE_SCUDO" true)
-      (lib.cmakeBool "COMPILER_RT_BUILD_SCUDO_STANDALONE_WITH_LLVM_LIBC" true)
-      (lib.cmakeBool "COMPILER_RT_BUILD_GWP_ASAN" false)
-      (lib.cmakeBool "COMPILER_RT_SCUDO_STANDALONE_BUILD_SHARED" false)
     ]
-    ++ lib.optional (isFullBuild && stdenv.cc.libc == null) [
+    ++ lib.optionals (isFullBuild && stdenv.cc.libc == null) [
       # CMake runs a check to see if the compiler works.
       # This includes including headers which requires a libc.
       # Skip these checks because a libc cannot be used when one doesn't exist.
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 93fa1969b4c0..5d7f0f492e52 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-o4fy46oh3iWLAcszcFo1m5GdalQs6OswT+OQTYo2cZc=";
+    hash = "sha256-YCQdScBCgmyallocGB8JGgkNkKTfy53/KPStq97S6wU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/flask-silk/default.nix b/pkgs/development/python-modules/flask-silk/default.nix
deleted file mode 100644
index 22d5075280d0..000000000000
--- a/pkgs/development/python-modules/flask-silk/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  flask,
-  pytestCheckHook,
-}:
-
-buildPythonPackage {
-  pname = "flask-silk";
-  version = "0.2-unstable-2018-06-14";
-  pyproject = true;
-
-  # master fixes flask import syntax and has no major changes
-  # new release requested: https://github.com/sublee/flask-silk/pull/6
-  src = fetchFromGitHub {
-    owner = "sublee";
-    repo = "flask-silk";
-    rev = "3a8166550f9a0ec52edae7bf31d9818c4c15c531";
-    hash = "sha256-AFbGp/d+3Tci8Kj2BuT7GPdKQRBVb6PV1U6KwnH89FY=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ flask ];
-
-  pythonImportsCheck = [ "flask_silk" ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pytestFlagsArray = [ "test.py" ];
-
-  disabledTests = [
-    # requires network access
-    "test_subdomain"
-  ];
-
-  meta = {
-    description = "Adds silk icons to your Flask application or module, or extension";
-    license = lib.licenses.bsd3;
-    teams = [ lib.teams.sage ];
-    homepage = "https://github.com/sublee/flask-silk";
-  };
-}
diff --git a/pkgs/development/python-modules/google-search-results/default.nix b/pkgs/development/python-modules/google-search-results/default.nix
index 7a982370ec86..fdef24f6c6dd 100644
--- a/pkgs/development/python-modules/google-search-results/default.nix
+++ b/pkgs/development/python-modules/google-search-results/default.nix
@@ -1,36 +1,37 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
+  fetchFromGitHub,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "google-search-results";
   version = "2.4.2";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit version;
-    pname = builtins.replaceStrings [ "-" ] [ "_" ] pname;
-    hash = "sha256-YDow7K4q+OYAsiY1dXpt8nXa1Lk0+XXmeHjM1kC3gkU=";
+  src = fetchFromGitHub {
+    owner = "serpapi";
+    repo = "google-search-results-python";
+    tag = version;
+    hash = "sha256-2GRhBaRE0KHNFsdMrIC87dx6yMzql+QQFSSm2Gf7xHU=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # almost all tests require an API key or network access
   doCheck = false;
 
   pythonImportsCheck = [ "serpapi" ];
 
-  meta = with lib; {
+  meta = {
     description = "Scrape and search localized results from Google, Bing, Baidu, Yahoo, Yandex, Ebay, Homedepot, youtube at scale using SerpApi.com";
     homepage = "https://github.com/serpapi/google-search-results-python";
     changelog = "https://github.com/serpapi/google-search-results-python/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
   };
 }
diff --git a/pkgs/development/python-modules/igloohome-api/default.nix b/pkgs/development/python-modules/igloohome-api/default.nix
index e119d7d8b0f2..18b82b492eae 100644
--- a/pkgs/development/python-modules/igloohome-api/default.nix
+++ b/pkgs/development/python-modules/igloohome-api/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "igloohome-api";
-  version = "0.1.0";
+  version = "0.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "keithle888";
     repo = "igloohome-api";
     tag = "v${version}";
-    hash = "sha256-CFxVZiga6008oNbacK12t7U8mOvL8YgEgQ82MsvZ46w=";
+    hash = "sha256-BLmmypbvYTgQisT0+9Ym1ZTK6asAP2tWXP2DWhKYM7U=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/testing-postgresql/default.nix b/pkgs/development/python-modules/testing-postgresql/default.nix
deleted file mode 100644
index 5a786a4b01d2..000000000000
--- a/pkgs/development/python-modules/testing-postgresql/default.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  pg8000,
-  postgresql,
-  psycopg2,
-  pytestCheckHook,
-  pythonOlder,
-  sqlalchemy,
-  testing-common-database,
-}:
-
-buildPythonPackage {
-  pname = "testing-postgresql";
-  # Version 1.3.0 isn't working so let's use the latest commit from GitHub
-  version = "unstable-2017-10-31";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "tk0miya";
-    repo = "testing.postgresql";
-    rev = "c81ded434d00ec8424de0f9e1f4063c778c6aaa8";
-    hash = "sha256-A4tahAaa98X66ZYa3QxIQDZkwAwVB6ZDRObEhkbUWKs=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    testing-common-database
-    pg8000
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    psycopg2
-    sqlalchemy
-  ];
-
-  # Add PostgreSQL to search path
-  prePatch = ''
-    substituteInPlace src/testing/postgresql.py \
-      --replace-fail "/usr/local/pgsql" "${postgresql}"
-  '';
-
-  pythonRelaxDeps = [ "pg8000" ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "pg8000 >= 1.10" "pg8000"
-    substituteInPlace tests/test_postgresql.py \
-      --replace-fail "self.assertRegexpMatches" "self.assertRegex"
-  '';
-
-  pythonImportsCheck = [ "testing.postgresql" ];
-
-  # Fix tests for Darwin build. See:
-  # https://github.com/NixOS/nixpkgs/pull/74716#issuecomment-598546916
-  __darwinAllowLocalNetworking = true;
-
-  meta = with lib; {
-    description = "Use temporary postgresql instance in testing";
-    homepage = "https://github.com/tk0miya/testing.postgresql";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ jluttine ];
-  };
-}
diff --git a/pkgs/os-specific/linux/firmware/ath9k/default.nix b/pkgs/os-specific/linux/firmware/ath9k/default.nix
index 44a5d65358b4..87448530fb11 100644
--- a/pkgs/os-specific/linux/firmware/ath9k/default.nix
+++ b/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -47,7 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-w"; # old libiberty emits fatal warnings
+  env.NIX_CFLAGS_COMPILE =
+    # old libiberty emits fatal warnings
+    "-w"
+    # old gmp fails to compile with newer gcc
+    # FIXME remove when the normal version has moved on
+    + lib.optionalString (!enableUnstable) " -fpermissive";
 
   dontUseCmakeConfigure = true;
   enableParallelBuilding = true;
diff --git a/pkgs/servers/nextcloud/packages/apps/recognize.nix b/pkgs/servers/nextcloud/packages/apps/recognize.nix
index 436d86d8cb50..1e7fb2570fd4 100644
--- a/pkgs/servers/nextcloud/packages/apps/recognize.nix
+++ b/pkgs/servers/nextcloud/packages/apps/recognize.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
     # Install tfjs dependency
     export CPPFLAGS="-I${lib.getDev nodejs}/include/node -Ideps/include"
     cd node_modules/@tensorflow/tfjs-node
-    node-pre-gyp install --prefer-offline --build-from-source --nodedir=${nodejs}/include/node
+    node-pre-gyp install --prefer-offline --build-from-source --nodedir=${nodejs}
     cd -
 
     # Test tfjs returns exit code 0
diff --git a/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch b/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch
index bd374b679d84..7a1ec8429049 100644
--- a/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch
+++ b/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch
@@ -1,10 +1,12 @@
 --- a/posix-extras.scm	1970-01-01 01:00:01.000000000 +0100
 +++ b/posix-extras.scm	1970-01-01 01:00:01.000000000 +0100
-@@ -110,6 +110,7 @@ static void *C_not_implemented_ptr(void)
+@@ -110,6 +110,9 @@ static void *C_not_implemented_ptr(void)
  #endif
- 
- #if defined (__unix__) || defined (C_XXXBSD)
+
++#if defined (__unix__) 
 +#include <sys/sysmacros.h>
++#endif
+ #if defined (__unix__) || defined (C_XXXBSD)
  #include <sys/types.h>
  #define C_mknod(fn, m, d) C_fix(mknod(C_data_pointer(fn), C_unfix(m), C_unfix(d)))
  #define C_mknod64(fn, m, maj, min) C_fix(mknod(C_data_pointer(fn), C_unfix(m), makedev(C_num_to_int(maj), C_num_to_int(min))))
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f5acb80a328e..a17625927fc2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -736,7 +736,7 @@ mapAliases {
   gg = go-graft; # Added 2025-03-07
   ggobi = throw "'ggobi' has been removed from Nixpkgs, as it is unmaintained and broken"; # Added 2025-05-18
   ghostwriter = makePlasma5Throw "ghostwriter"; # Added 2023-03-18
-  git-annex-utils = throw "'git-annex-utiks' has been removed as it is unmaintained"; # Added 2025-05-18
+  git-annex-utils = throw "'git-annex-utils' has been removed as it is unmaintained"; # Added 2025-05-18
   git-codeowners = throw "'git-codeowners' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   gjay = throw "'gjay' has been removed as it is unmaintained upstream"; # Added 2025-05-25
   gmni = throw "gmni has been removed as it is no longer maintained upstream"; # Added 2025-05-02
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4b9c7b453450..57a222dd2d4a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -267,6 +267,7 @@ mapAliases ({
   flask-common = throw "flask-common was removed, as it is not compatible with flask 3.0 and unmaintained since 2018."; # added 2025-01-11
   flask-basicauth = throw "flask-basicauth was removed, as it is not compatible with flask 3.0 and unmaintained since 2016.";
   flask-sessionstore = throw "flask-sessionstore was removed, as it is not compatible with flask 3.0 and unmaintained since 2017.";
+  flask-silk = throw "flask-silk was removed, as it is unmaintained since 2018."; # added 2025-05-25
   flask-sockets = throw "flask-sockets has been removed as the upstream repository was archived in 2022"; # Added 2025-01-01
   flowlogs_reader = flowlogs-reader; # added 2024-01-03
   flufl_bounce = flufl-bounce; # added 2023-11-03
@@ -755,6 +756,7 @@ mapAliases ({
   tensorflow-estimator_2 = tensorflow-estimator; # added 2021-11-25
   tensorflow-tensorboard = tensorboard; # added 2022-03-06
   tensorflow-tensorboard_2 = tensorflow-tensorboard; # added 2021-11-25
+  testing-postgresql = throw "testing-postgresql has been removed, since it is unmaintained since 2017"; # added 2025-05-25
   tilestache = throw "tilestache is unmaintained and Python3 compatibility is unknown"; # Added 2025-03-23
   Theano = theano; # added 2023-02-19
   TheanoWithCuda = theanoWithCuda; # added 2023-02-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ac9e742e5ebb..1d5c8c8448ce 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5123,8 +5123,6 @@ self: super: with self; {
 
   flask-session-captcha = callPackage ../development/python-modules/flask-session-captcha { };
 
-  flask-silk = callPackage ../development/python-modules/flask-silk { };
-
   flask-simpleldap = callPackage ../development/python-modules/flask-simpleldap { };
 
   flask-sock = callPackage ../development/python-modules/flask-sock { };
@@ -17280,8 +17278,6 @@ self: super: with self; {
 
   testing-common-database = callPackage ../development/python-modules/testing-common-database { };
 
-  testing-postgresql = callPackage ../development/python-modules/testing-postgresql { };
-
   testpath = callPackage ../development/python-modules/testpath { };
 
   testrail-api = callPackage ../development/python-modules/testrail-api { };